适用于 Service Fabric 客户端的基于角色的访问控制Role-based access control for Service Fabric clients

Azure Service Fabric 针对连接到 Service Fabric 群集的客户端支持两种不同的访问控制类型:管理员和用户。Azure Service Fabric supports two different access control types for clients that are connected to a Service Fabric cluster: administrator and user. 访问控制可让群集管理员针对不同的用户组限制特定群集操作的访问权限,使群集更加安全。Access control allows the cluster administrator to limit access to certain cluster operations for different groups of users, making the cluster more secure.

管理员对管理功能(包括读取/写入功能)拥有完全访问权限。Administrators have full access to management capabilities (including read/write capabilities). 默认情况下,用户只有管理功能的读取访问权限(例如查询功能),以及解析应用程序和服务的能力。By default, users only have read access to management capabilities (for example, query capabilities), and the ability to resolve applications and services.

可在创建群集时为每个角色提供不同的证书,以指定两个客户端角色(管理员和客户端)。You specify the two client roles (administrator and client) at the time of cluster creation by providing separate certificates for each. 有关设置安全 Service Fabric 群集的详细信息,请参阅 Service Fabric 群集安全性See Service Fabric cluster security for details on setting up a secure Service Fabric cluster.

默认访问控制设置Default access control settings

管理员访问控制类型对所有 FabricClient API 拥有完全访问权限。The administrator access control type has full access to all the FabricClient APIs. 它可以对 Service Fabric 群集执行任何读取和写入,包括以下操作:It can perform any reads and writes on the Service Fabric cluster, including the following operations:

应用程序和服务操作Application and service operations

  • CreateService:创建服务CreateService: service creation
  • CreateServiceFromTemplate:从模板创建服务CreateServiceFromTemplate: service creation from template
  • UpdateService:更新服务UpdateService: service updates
  • DeleteService:删除服务DeleteService: service deletion
  • ProvisionApplicationType:预配应用程序类型ProvisionApplicationType: application type provisioning
  • CreateApplication:创建应用程序CreateApplication: application creation
  • DeleteApplication:删除应用程序DeleteApplication: application deletion
  • UpgradeApplication:启动或中断应用程序升级UpgradeApplication: starting or interrupting application upgrades
  • UnprovisionApplicationType:取消预配应用程序类型UnprovisionApplicationType: application type unprovisioning
  • MoveNextUpgradeDomain:使用显式更新域恢复应用程序升级MoveNextUpgradeDomain: resuming application upgrades with an explicit update domain
  • ReportUpgradeHealth:恢复应用程序升级并提供当前升级进度ReportUpgradeHealth: resuming application upgrades with the current upgrade progress
  • ReportHealth:报告运行状况ReportHealth: reporting health
  • PredeployPackageToNode:预先部署 APIPredeployPackageToNode: predeployment API
  • CodePackageControl:重新启动代码包CodePackageControl: restarting code packages
  • RecoverPartition:恢复一个分区RecoverPartition: recovering a partition
  • RecoverPartitions:恢复多个分区RecoverPartitions: recovering partitions
  • RecoverServicePartitions:恢复服务分区RecoverServicePartitions: recovering service partitions
  • RecoverSystemPartitions:恢复系统服务分区RecoverSystemPartitions: recovering system service partitions

群集操作Cluster operations

  • ProvisionFabric:预配 MSI 和/或群集清单ProvisionFabric: MSI and/or cluster manifest provisioning
  • UpgradeFabric:启动群集升级UpgradeFabric: starting cluster upgrades
  • UnprovisionFabric:取消预配 MSI 和/或群集清单UnprovisionFabric: MSI and/or cluster manifest unprovisioning
  • MoveNextFabricUpgradeDomain:使用显式更新域恢复群集升级MoveNextFabricUpgradeDomain: resuming cluster upgrades with an explicit update domain
  • ReportFabricUpgradeHealth:恢复群集升级并提供当前升级进度ReportFabricUpgradeHealth: resuming cluster upgrades with the current upgrade progress
  • StartInfrastructureTask:启动基础结构任务StartInfrastructureTask: starting infrastructure tasks
  • FinishInfrastructureTask:完成基础结构任务FinishInfrastructureTask: finishing infrastructure tasks
  • InvokeInfrastructureCommand:基础结构任务管理命令InvokeInfrastructureCommand: infrastructure task management commands
  • ActivateNode:激活一个节点ActivateNode: activating a node
  • DeactivateNode:停用一个节点DeactivateNode: deactivating a node
  • DeactivateNodesBatch:停用多个节点DeactivateNodesBatch: deactivating multiple nodes
  • RemoveNodeDeactivations:在多个节点上还原停用操作RemoveNodeDeactivations: reverting deactivation on multiple nodes
  • GetNodeDeactivationStatus:检查停用状态GetNodeDeactivationStatus: checking deactivation status
  • NodeStateRemoved:报告已删除的节点状态NodeStateRemoved: reporting node state removed
  • ReportFault:报告错误ReportFault: reporting fault
  • FileContent:传输映像存储客户端文件(群集外部)FileContent: image store client file transfer (external to cluster)
  • FileDownload:启动映像存储客户端文件下载(群集外部)FileDownload: image store client file download initiation (external to cluster)
  • InternalList:映像存储客户端文件列表操作(内部)InternalList: image store client file list operation (internal)
  • Delete:映像存储客户端删除操作Delete: image store client delete operation
  • Upload:映像存储客户端上传操作Upload: image store client upload operation
  • NodeControl:启动、停止和重新启动节点NodeControl: starting, stopping, and restarting nodes
  • MoveReplicaControl:将副本从一个节点移到另一个节点MoveReplicaControl: moving replicas from one node to another

其他操作Miscellaneous operations

  • Ping:客户端 pingPing: client pings
  • Query:允许所有查询Query: all queries allowed
  • NameExists:检查命名 URI 是否存在NameExists: naming URI existence checks

用户访问控制类型默认限制为以下操作:The user access control type is, by default, limited to the following operations:

  • EnumerateSubnames:枚举命名 URIEnumerateSubnames: naming URI enumeration
  • EnumerateProperties:枚举命名属性EnumerateProperties: naming property enumeration
  • PropertyReadBatch:命名属性读取操作PropertyReadBatch: naming property read operations
  • GetServiceDescription:长时间轮询服务通知和读取服务描述GetServiceDescription: long-poll service notifications and reading service descriptions
  • ResolveService:根据投诉解决服务问题ResolveService: complaint-based service resolution
  • ResolveNameOwner:解析命名 URI 所有者ResolveNameOwner: resolving naming URI owner
  • ResolvePartition:解析系统服务ResolvePartition: resolving system services
  • ServiceNotifications:基于事件的服务通知ServiceNotifications: event-based service notifications
  • GetUpgradeStatus:轮询应用程序升级状态GetUpgradeStatus: polling application upgrade status
  • GetFabricUpgradeStatus:轮询群集升级状态GetFabricUpgradeStatus: polling cluster upgrade status
  • InvokeInfrastructureQuery:查询基础结构任务InvokeInfrastructureQuery: querying infrastructure tasks
  • List:映像存储客户端文件列表操作List: image store client file list operation
  • ResetPartitionLoad:重置故障转移单元的负载ResetPartitionLoad: resetting load for a failover unit
  • ToggleVerboseServicePlacementHealthReporting:切换详细服务放置运行状况报告ToggleVerboseServicePlacementHealthReporting: toggling verbose service placement health reporting

管理员访问控制也有权访问上述操作。The admin access control also has access to the preceding operations.

更改客户端角色的默认设置Changing default settings for client roles

在群集清单文件中,可以根据需要向客户端提供管理功能。In the cluster manifest file, you can provide admin capabilities to the client if needed. 可以更改默认设置,方法是在创建群集过程中转到“结构设置”选项,并在“名称”、“管理员”、“用户”和“”字段中提供上述设置。You can change the defaults by going to the Fabric Settings option during cluster creation, and providing the preceding settings in the name, admin, user, and value fields.

后续步骤Next steps

Service Fabric 群集安全性Service Fabric cluster security

创建 Service Fabric 群集Service Fabric cluster creation