monedula-acl-rbac convert

Stateless extract -> plan -> emit in one call. Usage and flags for monedula-acl-rbac convert.

Reference 10 of 29

Reference for monedula-acl-rbac-converter v0.10.0

Updated 2 October 2026

usage

monedula-acl-rbac convert [flags]

One-shot file-to-file conversion for exploration and small batches: read ACLs from --input, plan against --scopes (and optional rules / principals), and emit the result to --out (default stdout).

This is the fast path. It does NOT create a run directory, does NOT apply anything to MDS, does NOT verify, and does NOT support live or k8s sources (those need state). Production migrations should use the explicit pipeline: extract -> plan -> apply -> verify -> delete-acls.

Source detection: --from is required for live/k8s/cfk directories; otherwise the file extension chooses (.yaml/.yml -> yaml, .json -> json, .csv -> csv, .sh -> script, .txt -> text).

Example: monedula-acl-rbac convert \ --from yaml --input acls.yaml \ --scopes scopes.yaml --rules rules.yaml \ --format script \ > bindings.sh

Read-only: this command does not change the cluster.

Flags

Flag	Type	Default	Description
`--from`	string		text\|json\|yaml\|csv\|strimzi\|cfk\|script (use extract+plan workflow for live/k8s)
`--input`	string		Input file path
`--scopes`	string		scopes.yaml (required)
`--rules`	string		Optional rules.yaml
`--principals`	string		Optional principals.yaml
`--format`	string	`script`	script\|cfk\|mds-curl
`--out`	string		Output path (default: stdout)
`--vars`	string		Script source: vars.yaml for variable substitution
`--ignore-non-add`	bool		Script source: skip --remove/--list invocations
`--cfk-namespace`	string		CFK ConfluentRolebinding namespace (cfk emit format)
`--cfk-name-salt`	string		Salt mixed into binding IDs

Global flags

Flag	Type	Default	Description
`--log-format`	string	`text`	Log output format (text\|json); set MONEDULA_ACL_RBAC_LOG_FORMAT to override the default.
`--log-level`	string	`info`	Log level (debug\|info\|warn\|error); set MONEDULA_ACL_RBAC_LOG_LEVEL to override the default.

Examples

examples

monedula-acl-rbac convert --from yaml --input acls.yaml --scopes scopes.yaml --rules rules.yaml --principals principals.yaml > bindings.sh

Exit codes

Code	Meaning
`0`	Success.
`1`	Usage error: missing required flag, malformed argument, or unknown subcommand.
`4`	Any other error: failures the CLI does not classify (for example an unreadable or invalid input file, scopes.yaml, or rules.yaml) fall back to exit code 4.