monedula-acl-rbac apply

Create RBAC bindings in MDS from plan.json. Usage and flags for monedula-acl-rbac apply.

Reference 4 of 29

Reference for monedula-acl-rbac-converter v0.10.0

Updated 2 October 2026

usage

monedula-acl-rbac apply [flags]

Create the RBAC role bindings described in plan.json by calling MDS. Idempotent: bindings already present in MDS are skipped. Concurrent writers are blocked via a per-run-directory lockfile.

Mutating. Requires either --confirm on the command line or an interactive 'yes' typed at the TTY prompt. Use --dry-run first to preview the MDS calls without writing.

Output and behaviour flags worth knowing: --format text|json structured summary on stdout --apply-parallelism N concurrent MDS writes (default 4) --mds-max-retries N retry transient failures (default 3; 0 disables) --progress per-binding progress on stderr (default: on when stderr is a TTY)

Auth (any one of): --mds-token-file FILE pre-fetched bearer token --mds-user + --mds-password-file exchange via /security/1.0/authenticate cached token from a prior 'auth login' (auto-discovered)

Example: monedula-acl-rbac apply \ --plan runs/.../plan.json \ --mds-url https://mds.example.com \ --mds-token-file ~/.confluent/token \ --confirm

Outputs: apply.log (every MDS call + result). --dry-run additionally writes would-apply.log with the request bodies that would have been sent.

This command can change external state. Check the flags that gate it before running it against production.

Flags

Flag	Type	Default	Description
`--plan`	string		Path to plan.json
`--dry-run`	bool		Preview the MDS API calls without mutating
`--confirm`	bool		Confirm the mutation
`--apply-parallelism`	int	`4`	Concurrent MDS writes
`--force-unlock`	bool		Clear a stale lockfile
`--progress`	bool		Print per-binding progress to stderr (default: on when stderr is a TTY)
`--format`	string	`text`	Summary output format on stdout (text\|json)
`--mds-url`	string		MDS base URL (required)
`--mds-ca-cert`	string		Path to a PEM CA bundle for MDS TLS
`--mds-client-cert`	string		Path to a PEM client certificate for mTLS to MDS
`--mds-client-key`	string		Path to a PEM client key for mTLS to MDS
`--mds-insecure-skip-verify`	bool		Skip TLS certificate verification
`--mds-user`	string		MDS username
`--mds-password-file`	string		Path to a file containing the MDS password
`--mds-token-file`	string		Path to a pre-fetched MDS bearer token file
`--cache-token`	bool		Persist the resolved token to the user config dir
`--mds-max-retries`	int	`3`	Retry transient MDS failures (5xx, 429, connection reset) up to N additional times after the initial call; pass 0 to disable retries
`--run-dir`	string		Explicit run directory
`--out`	string		Output path; parent dir becomes the run dir

Global flags

Flag	Type	Default	Description
`--log-format`	string	`text`	Log output format (text\|json); set MONEDULA_ACL_RBAC_LOG_FORMAT to override the default.
`--log-level`	string	`info`	Log level (debug\|info\|warn\|error); set MONEDULA_ACL_RBAC_LOG_LEVEL to override the default.

Examples

examples

monedula-acl-rbac apply --plan runs/2026-05-21T10-00-00Z/plan.json --mds-url https://mds.example.com --mds-token-file ~/.confluent/token --dry-run
monedula-acl-rbac apply --plan runs/2026-05-21T10-00-00Z/plan.json --mds-url https://mds.example.com --mds-token-file ~/.confluent/token --confirm

Exit codes

Code	Meaning
`0`	Success.
`1`	Usage error: missing required flag, malformed argument, or unknown subcommand.
`4`	External system error: MDS unreachable or refusing the credentials. Errors the CLI does not classify also exit 4, for example a run-directory lock held by another apply, or a stale lock not cleared with --force-unlock.
`5`	Destructive operation refused by a guardrail, or a guardrail check reports unhealthy state.