monedula-acl-rbac delete-deny-acls

Generate the DENY-ACL deletion script. Usage and flags for monedula-acl-rbac delete-deny-acls.

usage

monedula-acl-rbac delete-deny-acls [flags]

Remove DENY ACLs that 'apply' converted, after 'verify' has confirmed the corresponding bindings are EFFECTIVE_OK. Highly destructive - DENY ACLs are safety-net rules; removing one without confirming the access shouldn't flow through it can grant access to a principal that previously had none.

Emits a 'delete-deny-acls.sh' script in the run directory. The script does NOT contain bare 'kafka-acls --remove' calls; instead each line invokes 'monedula-acl-rbac delete-deny-one' which re-checks effective permission at script-execution time, per-ACL. The script is safe to inspect, reorder, or partially run by hand.

Guardrails (all enforced): - 'verify' must be present (--verify) - --principal (or --principal-file) is REQUIRED - no untargeted sweep - wildcard-principal DENYs ('Deny User:* ...', bare '*', any '<Type>:*') are classified UNKNOWN (unbounded blast radius) and CANNOT be removed by this tool - remove them manually with kafka-acls if you are certain - --confirm AND --i-understand-this-may-grant-access required either way - DENY analysis must classify each ACL as SAFE_TO_REMOVE in plan.json

Unlike apply/verify, this command does NOT accept cache-only auth: pass --mds-token-file, or --mds-user + --mds-password-file. The credentials are baked into runtime.env so the generated script's delete-deny-one calls can authenticate non-interactively at execution time, when a cached token may have expired.

Example: monedula-acl-rbac delete-deny-acls \ --plan runs/.../plan.json --verify runs/.../verify.json \ --bootstrap-server kafka.example.com:9093 \ --command-config admin.properties \ --mds-url https://mds.example.com \ --mds-token-file ~/.confluent/token \ --principal User:alice \ --confirm --i-understand-this-may-grant-access

Outputs: delete-deny-acls.sh, rollback-deny.sh, deleted-deny-acls.json, delete-deny.log, runtime.env (0o600, removed on script exit).

Emits a script; does not delete anything itself.

Read-only: this command does not change the cluster.

Flags

Flag	Type	Default	Description
`--plan`	string		Path to plan.json
`--verify`	string		Path to verify.json
`--principal`	stringSlice		Principal filter (REQUIRED; repeatable; alias: --principal-filter)
`--principal-filter`	stringSlice		Alias for --principal (same semantics; matches extract / mds list-bindings)
`--principal-file`	string		Path to a file with one principal per line (alternative or supplement to --principal)
`--i-understand-this-may-grant-access`	bool		Required acknowledgement
`--confirm`	bool		Confirm the operation
`--mds-url`	string		MDS base URL (required)
`--mds-ca-cert`	string		Path to a PEM CA bundle for MDS TLS
`--mds-client-cert`	string		Path to a PEM client certificate for mTLS to MDS
`--mds-client-key`	string		Path to a PEM client key for mTLS to MDS
`--mds-insecure-skip-verify`	bool		Skip TLS certificate verification
`--mds-user`	string		MDS username
`--mds-password-file`	string		Path to a file containing the MDS password
`--mds-token-file`	string		Path to a pre-fetched MDS bearer token file
`--cache-token`	bool		Persist the resolved token to the user config dir
`--mds-max-retries`	int	`3`	Retry transient MDS failures (5xx, 429, connection reset) up to N additional times after the initial call; pass 0 to disable retries
`--bootstrap-server`	string		Kafka bootstrap server(s) (comma-separated)
`--bootstrap`	string		Alias for --bootstrap-server
`--command-config`	string		Path to a Kafka client properties file
`--run-dir`	string		Explicit run directory
`--out`	string		Output path; parent dir becomes the run dir

Global flags

Flag	Type	Default	Description
`--log-format`	string	`text`	Log output format (text\|json); set MONEDULA_ACL_RBAC_LOG_FORMAT to override the default.
`--log-level`	string	`info`	Log level (debug\|info\|warn\|error); set MONEDULA_ACL_RBAC_LOG_LEVEL to override the default.

Examples

examples

monedula-acl-rbac delete-deny-acls --plan runs/2026-05-21T10-00-00Z/plan.json --verify runs/2026-05-21T10-00-00Z/verify.json --bootstrap-server kafka.example.com:9093 --command-config admin.properties --mds-url https://mds.example.com --mds-token-file ~/.confluent/token --principal User:alice --confirm --i-understand-this-may-grant-access

Exit codes

Code	Meaning
`0`	Success.
`1`	Usage error: missing required flag, malformed argument, or unknown subcommand.
`2`	Input error: unparseable ACLs or missing/malformed config (rules, principals, scopes, or vars files).
`4`	Any other error: failures the CLI does not classify (for example verify.json has unresolved EFFECTIVE_MISSING/UNKNOWN results, or no DENY ACLs are eligible for removal) fall back to exit code 4.
`5`	Destructive operation refused by a guardrail, or a guardrail check reports unhealthy state.