Monedula
monedula-acl-rbac-converter docs menu

Find the cluster IDs for scopes.yaml

Get the Kafka, Schema Registry, ksqlDB and Connect cluster IDs that scope every role binding, with or without access to MDS.

How-to guides 3 of 11

2 min read

Updated 5 October 2026

Markdown

On this page

Every Confluent role binding is scoped to a cluster, so plan needs scopes.yaml with the IDs of the clusters your bindings target. For most migrations that is one value, kafka_cluster: the ID that MDS knows your Kafka cluster by.

Ask MDS, if you have access

discover queries MDS for the clusters it knows and writes a scopes.yaml stub:

monedula-acl-rbac discover --mds-url https://mds.example.com > scopes.yaml

It takes the same MDS flags as apply. The stub sets kafka_cluster to the first Kafka cluster MDS reports and lists any others in a comment. It fills in the Schema Registry, ksqlDB and Connect cluster IDs when MDS reports them, and leaves comments for the fields you may need to complete by hand. discover reads the cluster registry at /security/1.0/registry/clusters, so you can also query that endpoint yourself.

Read the ID from the cluster, without MDS

  • Self-managed Confluent Platform: the ID is a base64 cluster UUID, for example MkU3OEVBNTcwNTJENDM2Qk. Read it from the meta.properties file in any broker’s log directory:

    grep cluster.id <log.dir>/meta.properties

    Or ask a broker: kafka-cluster cluster-id --bootstrap-server <host:port> prints it. MDS learns the ID from the broker’s own cluster.id, so this is the value MDS uses.

  • Confluent Cloud: the logical cluster ID, which starts with lkc-, from the Cloud Console or confluent kafka cluster list.

Write scopes.yaml

Put the IDs in scopes.yaml. A Kafka-only migration needs one line:

kafka_cluster: MkU3OEVBNTcwNTJENDM2Qk

Add schema_registry_cluster when your ACLs cover Schema Registry subjects. The file also accepts ksql_cluster and connect_cluster, which discover fills in, but plan requires neither: the ACL resource types the tool reads include no ksqlDB or Connect resources. Config files lists every field of scopes.yaml.

Check it worked

Run plan with the file: when a binding needs a cluster ID that scopes.yaml does not have, plan stops with an error that names the missing field. After apply, if verify reports EFFECTIVE_MISSING for all the source ACLs, check the cluster ID first.