Monedula
monedula-acl-rbac-converter docs menu

Check on a previous run

Summarize a run directory with status, compare two runs or plans with diff, and inventory existing MDS role bindings.

How-to guides 10 of 11

2 min read

Updated 5 October 2026

Markdown

On this page

A migration spreads over days and run directories. Three read-only commands tell you where things stand: status summarizes one run directory, diff compares the ACLs or plans of two runs, and mds list-bindings shows what MDS already holds.

Summarize a run directory

monedula-acl-rbac status runs/2026-05-21T10-00-00Z

status reads only the files in the run directory and makes no external calls. It prints one line per step, NOT RUN for a step that left no artifact, and the state of the lock. The README’s sample output:

Run directory: runs/2026-05-21T10-00-00Z

extract:           acl_count=500, source=json
plan:              bindings=487, checksum_ok=true, rejected=0, unmapped=13
apply:             
verify:            487 EFFECTIVE_OK, 0 missing, 0 unknown (487 total)
delete-acls:       NOT RUN
delete-deny-acls:  NOT RUN
lock:              none
  • checksum_ok=false on the plan line means plan.json changed since it was planned or revalidated, and apply, verify and the delete commands will refuse it.
  • verify counts the results in verify.json. status looks for that file name; results written elsewhere with verify --out do not show here.
  • delete-acls and delete-deny-acls show as run once their scripts have written delete.log or delete-deny.log in the run directory.
  • An empty apply line means that apply.log exists; NOT RUN means it does not.
  • lock shows the contents of an apply lock file, when one exists.

Add --format json for CI; status.v1.json describes the output. Recover from a failed run starts from what status shows.

Compare two runs

For an incremental migration, compare the ACLs or the plans of two run directories:

# What ACLs are new this batch?
monedula-acl-rbac diff --acls runs/A/acls.json,runs/B/acls.json

# What does the new plan add or change vs. the previously-approved one?
monedula-acl-rbac diff --plan runs/A/plan.json,runs/B/plan.json

--acls and --plan each take exactly two paths, separated by a comma, or given by repeating the flag: --acls runs/A/acls.json --acls runs/B/acls.json. The two flags cannot be combined.

Each line of the output starts with ADDED or REMOVED, and for plans also CHANGED for a binding whose content differs. diff reads only the two files and exits 0 whether or not it finds differences; --format json gives a machine-readable result.

See what MDS already holds

Before you plan a new batch, check which role bindings a principal already has:

monedula-acl-rbac mds list-bindings \
  --mds-url https://mds.example.com \
  --mds-token-file ~/.confluent/token \
  --principal-filter User:alice

It takes the same MDS flags as apply. --principal-filter is required and repeatable, because MDS has no lookup across all principals. Narrow the result with --scope-filter, for example --scope-filter kafka-cluster, or set the lookup scope with --kafka-cluster, --schema-registry-cluster, --ksql-cluster or --connect-cluster. --format takes text, json or yaml.