monedula-acl-rbac plan

Transform acls.json into plan.json + report.txt. Usage and flags for monedula-acl-rbac plan.

Reference 19 of 29

Reference for monedula-acl-rbac-converter v0.10.0

Updated 2 October 2026

usage

monedula-acl-rbac plan [flags]

Apply the mapping engine to acls.json and emit a RoleBindingPlan in plan.json plus a human-readable report.txt next to it.

Required: --acls path to canonical acls.json from 'extract' --scopes scopes.yaml identifying the Confluent cluster IDs to bind into

Optional: --rules custom rules.yaml merged on top of the embedded defaults --principals principals.yaml mapping source ACL principals to MDS forms --allow-unmapped proceed even if some ACLs had no rule (exit 0 instead of 3) --allow-rejected proceed even if some ACLs are DENY or otherwise unrepresentable --revalidate PLAN re-checksum a hand-edited plan.json after operator edits

Example: monedula-acl-rbac plan \ --acls runs/.../acls.json --scopes scopes.yaml \ --rules rules.yaml --principals principals.yaml \ --out runs/.../plan.json

plan exits non-zero (code 3) when unmapped or rejected ACLs are present unless the corresponding --allow-* flag is set. Read report.txt before moving to 'apply'.

Read-only: this command does not change the cluster.

Flags

Flag	Type	Description
`--acls`	string	Path to acls.json
`--rules`	string	Optional rules.yaml overrides
`--principals`	string	Optional principals.yaml
`--scopes`	string	scopes.yaml
`--allow-unmapped`	bool	Don't fail on unmapped ACLs
`--allow-rejected`	bool	Don't fail on rejected (DENY) ACLs
`--revalidate`	string	Re-checksum a hand-edited plan.json
`--cfk-name-salt`	string	Salt mixed into binding IDs; lets you disambiguate identical bindings across tenants
`--run-dir`	string	Explicit run directory
`--out`	string	Output path; parent dir becomes the run dir

Global flags

Flag	Type	Default	Description
`--log-format`	string	`text`	Log output format (text\|json); set MONEDULA_ACL_RBAC_LOG_FORMAT to override the default.
`--log-level`	string	`info`	Log level (debug\|info\|warn\|error); set MONEDULA_ACL_RBAC_LOG_LEVEL to override the default.

Examples

examples

monedula-acl-rbac plan --acls runs/2026-05-21T10-00-00Z/acls.json --rules rules.yaml --principals principals.yaml --scopes scopes.yaml --out runs/2026-05-21T10-00-00Z/plan.json

Exit codes

Code	Meaning
`0`	Success.
`1`	Usage error: missing required flag, malformed argument, or unknown subcommand.
`2`	Input error: unparseable ACLs or missing/malformed config (rules, principals, scopes, or vars files).
`3`	Plan has unresolved unmapped or rejected items.