Limitations and API stability

These limits and the stability promise apply to monedula-acl-rbac 0.10.0.

What the tool does not do

• On RBAC, it only creates role bindings. It does not migrate from RBAC back to ACLs, and does not modify or delete existing bindings; Recover from a failed run shows how to roll bindings back.
• It does not convert DENY ACLs or host-restricted ACLs, because RBAC has no deny and no host scoping. How ACLs map to RBAC roles explains where they end up.
• It never removes DENY ACLs for a wildcard principal; only a person can, with kafka-acls (Remove DENY ACLs).
• Its apply lock does not coordinate two operators using different run directories against the same MDS (Safety guarantees).
• convert reads file sources only. The live and k8s sources need the explicit extract, plan and emit steps, so that the run directory keeps the audit artifacts.
• The script source rejects control flow, command substitutions and variables without a value; give missing values in vars.yaml and expand loops into plain kafka-acls lines first (Extract ACLs from any source).
• No command writes CSV. If you need it, post-process the JSON output with a tool such as jq.

Scale

The tool is designed for batches of up to about 10,000 ACLs per run, held in memory. For larger sets, partition the migration by principal, with one run directory per batch. A streaming mode is planned for after version 1.0.

API stability

The supported interface, governed by semantic versioning, is the command-line tool:

• its commands and flags,
• its exit codes,
• the JSON documents it writes to disk and to stdout, as described by the schemas in the repository’s schemas/ directory.

Those are what the 1.0.0 compatibility promise covers. The documents carry schema_version: "1": on disk acls.json, plan.json and verify.json, and on stdout the JSON output of apply, verify, status, report, diff and mds list-bindings. A single check that fails when schema_version changes therefore works on all of them, and a future version bumps it if a document’s shape changes incompatibly. The CLI overview links the reference page of each schema.

The Go packages under pkg/aclrbac/ are internal by convention. They are exported only because the CLI and its tests span several packages, and their signatures and behavior can change between releases without a major version bump. To integrate programmatically, run the CLI and parse its JSON output.