monedula-acl-rbac extract

Read ACLs from a source and emit canonical acls.json. Usage and flags for monedula-acl-rbac extract.

Reference 16 of 29

Reference for monedula-acl-rbac-converter v0.10.0

Updated 2 October 2026

usage

monedula-acl-rbac extract [flags]

Read Kafka ACLs from one of nine sources and serialise them into the canonical acls.json that every downstream command consumes.

Sources (pass via --from): live Apache Kafka cluster (requires --bootstrap-server, optional --command-config) text a 'kafka-acls.sh --list' text dump (--input) json|yaml an acls.json/yaml matching schemas/acls.v1.json (--input) csv flat tabular form, RFC 4180 (--input) script a shell script of 'kafka-acls --add' invocations (--input, optional --vars) strimzi Strimzi KafkaUser CRs on disk (--input) cfk CFK Kafka + ConfluentRolebinding manifests on disk (--input) k8s a running Kubernetes cluster (--context / --namespace / --all-namespaces)

Example: monedula-acl-rbac extract --from live \ --bootstrap-server kafka.example.com:9093 \ --command-config admin.properties \ --out runs/2026-05-21T10-00-00Z/acls.json

acls.json is the only mutating output. extract.log and extract-source.json sidecars are also written for audit.

Read-only: this command does not change the cluster.

Flags

Flag	Type	Description
`--from`	string	live\|text\|json\|yaml\|csv\|strimzi\|cfk\|k8s\|script
`--input`	string	Input file path (file sources only)
`--vars`	string	vars.yaml for the script source
`--ignore-non-add`	bool	Script source: skip --remove/--list invocations
`--principal-filter`	stringSlice	Live source: restrict by principal (repeatable)
`--topic-filter`	stringSlice	Live source: restrict by topic prefix (repeatable)
`--context`	string	K8s source: kubeconfig context
`--namespace`	string	K8s source: namespace
`--all-namespaces`	bool	K8s source: walk all visible namespaces
`--label-selector`	string	K8s source: label selector
`--kubeconfig`	string	K8s source: kubeconfig path override
`--run-dir`	string	Explicit run directory
`--out`	string	Output path; parent dir becomes the run dir
`--bootstrap-server`	string	Kafka bootstrap server(s) (comma-separated)
`--bootstrap`	string	Alias for --bootstrap-server
`--command-config`	string	Path to a Kafka client properties file

Global flags

Flag	Type	Default	Description
`--log-format`	string	`text`	Log output format (text\|json); set MONEDULA_ACL_RBAC_LOG_FORMAT to override the default.
`--log-level`	string	`info`	Log level (debug\|info\|warn\|error); set MONEDULA_ACL_RBAC_LOG_LEVEL to override the default.

Examples

examples

monedula-acl-rbac extract --from live --bootstrap-server kafka.example.com:9093 --command-config admin.properties --out runs/2026-05-21T10-00-00Z/acls.json
monedula-acl-rbac extract --from text --input acls.txt --out runs/2026-05-21T10-00-00Z/acls.json

Exit codes

Code	Meaning
`0`	Success.
`1`	Usage error: missing required flag, malformed argument, or unknown subcommand.
`2`	Input error: unparseable ACLs or missing/malformed config (rules, principals, scopes, or vars files).
`4`	External system error: MDS unreachable or unauthorized, Kafka unreachable or auth failure, or the Kubernetes API unreachable, unauthorized, or RBAC denied.