Skip to main content

Required Permissions

Palette requires a set of permissions to properly deploy and manage the lifecycle of clusters deployed to Azure. We recommend creating a role assignment that has the service principal you want to use with Palette and the appropriate scope level. To ensure that Palette and VerteX can deploy and manage clusters on Azure in all use cases, use a subscription as the scope level for the role assignment.

warning

We recommend against assigning the built-in Azure Contributor role to the service principal you want to use in Palette because its permission scope exceeds our requirements. Instead, create a custom role to provide only those permissions that Palette requires.

We support the following use cases:

  • Dynamic Placement - Palette creates network resources required for your cluster.

  • Static Placement - Palette deploys clusters on the pre-existing network resources you specify.

tip

You can use the Validator with the Azure plugin to verify you have setup the correct permissions. The Validator Azure plugin requires the following permissions:

  • Microsoft.Authorization/denyAssignments/read
  • Microsoft.Authorization/roleAssignments/read
  • Microsoft.Authorization/roleDefinitions/read

Dynamic Placement

Dynamic placement is the default method for deploying Azure clusters through Palette. With dynamic placement, Palette dynamically creates the network resources required for your cluster.

ActionsScope level
Microsoft.Compute/disks/deleteSubscription
Microsoft.Compute/disks/readSubscription
Microsoft.Compute/disks/writeSubscription
Microsoft.Compute/galleries/images/readSubscription
Microsoft.Compute/galleries/images/versions/readSubscription
Microsoft.Compute/galleries/images/versions/writeSubscription
Microsoft.Compute/galleries/images/writeSubscription
Microsoft.Compute/galleries/readSubscription
Microsoft.Compute/galleries/writeSubscription
Microsoft.Compute/images/readSubscription
Microsoft.Compute/images/writeSubscription
Microsoft.Compute/virtualMachines/deleteSubscription
Microsoft.Compute/virtualMachines/extensions/deleteSubscription
Microsoft.Compute/virtualMachines/extensions/readSubscription
Microsoft.Compute/virtualMachines/extensions/writeSubscription
Microsoft.Compute/virtualMachines/readSubscription
Microsoft.Compute/virtualMachines/writeSubscription
Microsoft.Network/loadBalancers/backendAddressPools/join/actionSubscription
Microsoft.Network/loadBalancers/deleteSubscription
Microsoft.Network/loadBalancers/inboundNatRules/deleteSubscription
Microsoft.Network/loadBalancers/inboundNatRules/join/actionSubscription
Microsoft.Network/loadBalancers/inboundNatRules/readSubscription
Microsoft.Network/loadBalancers/inboundNatRules/writeSubscription
Microsoft.Network/loadBalancers/readSubscription
Microsoft.Network/loadBalancers/writeSubscription
Microsoft.Network/networkInterfaces/deleteSubscription
Microsoft.Network/networkInterfaces/join/actionSubscription
Microsoft.Network/networkInterfaces/readSubscription
Microsoft.Network/networkInterfaces/writeSubscription
Microsoft.Network/networkSecurityGroups/readSubscription
Microsoft.Network/networkSecurityGroups/securityRules/deleteSubscription
Microsoft.Network/networkSecurityGroups/securityRules/readSubscription
Microsoft.Network/networkSecurityGroups/securityRules/writeSubscription
Microsoft.Network/privateDnsZones/A/deleteSubscription
Microsoft.Network/privateDnsZones/A/readSubscription
Microsoft.Network/privateDnsZones/A/writeSubscription
Microsoft.Network/privateDnsZones/deleteSubscription
Microsoft.Network/privateDnsZones/readSubscription
Microsoft.Network/privateDnsZones/virtualNetworkLinks/deleteSubscription
Microsoft.Network/privateDnsZones/virtualNetworkLinks/readSubscription
Microsoft.Network/privateDnsZones/virtualNetworkLinks/writeSubscription
Microsoft.Network/privateDnsZones/writeSubscription
Microsoft.Network/publicIPAddresses/deleteSubscription
Microsoft.Network/publicIPAddresses/join/actionSubscription
Microsoft.Network/publicIPAddresses/readSubscription
Microsoft.Network/publicIPAddresses/writeSubscription
Microsoft.Network/routeTables/deleteSubscription
Microsoft.Network/routeTables/readSubscription
Microsoft.Network/routeTables/writeSubscription
Microsoft.Network/virtualNetworks/deleteSubscription
Microsoft.Network/virtualNetworks/join/actionSubscription
Microsoft.Network/virtualNetworks/join/actionSubscription
Microsoft.Network/virtualNetworks/joinLoadBalancer/actionSubscription
Microsoft.Network/virtualNetworks/peer/actionSubscription
Microsoft.Network/virtualNetworks/readSubscription
Microsoft.Network/virtualNetworks/subnets/deleteSubscription
Microsoft.Network/virtualNetworks/subnets/join/actionSubscription
Microsoft.Network/virtualNetworks/subnets/joinLoadBalancer/actionSubscription
Microsoft.Network/virtualNetworks/subnets/readSubscription
Microsoft.Network/virtualNetworks/subnets/virtualMachines/readSubscription
Microsoft.Network/virtualNetworks/subnets/writeSubscription
Microsoft.Network/virtualNetworks/virtualMachines/readSubscription
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/deleteSubscription
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/readSubscription
Microsoft.Network/virtualNetworks/virtualNetworkPeerings/writeSubscription
Microsoft.Network/virtualNetworks/writeSubscription
Microsoft.Resources/subscriptions/resourceGroups/readSubscription
Microsoft.Storage/storageAccounts/blobServices/containers/readSubscription
Microsoft.Storage/storageAccounts/blobServices/containers/writeSubscription
Microsoft.Storage/storageAccounts/blobServices/listKeys/actionSubscription
Microsoft.Storage/storageAccounts/readSubscription
Microsoft.Storage/storageAccounts/writeSubscription

Static Placement

Choose static placement when you want Palette to use pre-existing network resource groups, VNets, subnets, and security groups. Review the table below for the required actions and the different scope levels for each use case.

ActionScope Level
Microsoft.Compute/disks/deleteResource Group
Microsoft.Compute/disks/readResource Group
Microsoft.Compute/disks/writeResource Group
Microsoft.Compute/virtualMachines/deleteResource Group
Microsoft.Compute/virtualMachines/extensions/deleteResource Group
Microsoft.Compute/virtualMachines/extensions/readResource Group
Microsoft.Compute/virtualMachines/extensions/writeResource Group
Microsoft.Compute/virtualMachines/readResource Group
Microsoft.Compute/virtualMachines/writeResource Group
Microsoft.Network/loadBalancers/backendAddressPools/join/actionResource Group
Microsoft.Network/loadBalancers/deleteResource Group
Microsoft.Network/loadBalancers/inboundNatRules/deleteResource Group
Microsoft.Network/loadBalancers/inboundNatRules/join/actionResource Group
Microsoft.Network/loadBalancers/inboundNatRules/readResource Group
Microsoft.Network/loadBalancers/inboundNatRules/writeResource Group
Microsoft.Network/loadBalancers/readResource Group
Microsoft.Network/loadBalancers/writeResource Group
Microsoft.Network/networkInterfaces/deleteResource Group
Microsoft.Network/networkInterfaces/join/actionResource Group
Microsoft.Network/networkInterfaces/readResource Group
Microsoft.Network/networkInterfaces/writeResource Group
Microsoft.Network/networkSecurityGroups/readResource Group
Microsoft.Network/networkSecurityGroups/securityRules/deleteResource Group
Microsoft.Network/networkSecurityGroups/securityRules/readResource Group
Microsoft.Network/networkSecurityGroups/securityRules/writeResource Group
Microsoft.Network/privateDnsZones/A/deleteResource Group
Microsoft.Network/privateDnsZones/A/readResource Group
Microsoft.Network/privateDnsZones/A/writeResource Group
Microsoft.Network/privateDnsZones/deleteResource Group
Microsoft.Network/privateDnsZones/readResource Group
Microsoft.Network/privateDnsZones/virtualNetworkLinks/deleteResource Group
Microsoft.Network/privateDnsZones/virtualNetworkLinks/readResource Group
Microsoft.Network/privateDnsZones/virtualNetworkLinks/writeResource Group
Microsoft.Network/privateDnsZones/writeResource Group
Microsoft.Network/publicIPAddresses/deleteResource Group
Microsoft.Network/publicIPAddresses/join/actionResource Group
Microsoft.Network/publicIPAddresses/readResource Group
Microsoft.Network/publicIPAddresses/writeResource Group
Microsoft.Network/routeTables/deleteResource Group
Microsoft.Network/routeTables/readResource Group
Microsoft.Network/routeTables/writeResource Group
Microsoft.Network/virtualNetworks/join/actionResource Group
Microsoft.Resources/subscriptions/resourceGroups/readResource Group
Microsoft.Network/virtualNetworks/readVirtual Network Level
Microsoft.Network/virtualNetworks/subnets/join/actionSubnet Level
Microsoft.Network/virtualNetworks/subnets/readSubnet Level
Microsoft.Compute/galleries/images/readCompute Gallery Level
Microsoft.Compute/galleries/images/versions/readCompute Gallery Level