monedula-acl-rbac verify

Check effective access of each binding in MDS. Usage and flags for monedula-acl-rbac verify.

Reference 23 of 29

Reference for monedula-acl-rbac-converter v0.10.0

Updated 2 October 2026

usage

monedula-acl-rbac verify [flags]

Confirm that each binding created by 'apply' actually grants the access the original ACL granted. Strongly recommended before 'delete-acls' - deletion is blocked unless verify reports EFFECTIVE_OK for every source ACL.

Modes: --mode effective (default) MDS effective-access lookup per source ACL --mode bindings-exist smoke check that the binding row is present

Effective mode classifies each source ACL as: EFFECTIVE_OK the binding grants the access it should EFFECTIVE_MISSING the binding exists but the principal still can't act EFFECTIVE_UNKNOWN MDS lookup endpoint unavailable or ambiguous

Example: monedula-acl-rbac verify \ --plan runs/.../plan.json \ --mds-url https://mds.example.com \ --mds-token-file ~/.confluent/token

verify.json is written into the run directory next to plan.json. Reads acls.json from the same directory to populate per-source-ACL operation/resource maps required for effective mode.

Read-only: this command does not change the cluster.

Flags

Flag	Type	Default	Description
`--plan`	string		Path to plan.json
`--mode`	string	`effective`	bindings-exist\|effective
`--verify-parallelism`	int	`8`	Concurrent MDS lookups
`--accept-unknown-verify`	bool		Treat EFFECTIVE_UNKNOWN as OK
`--progress`	bool		Print per-binding progress to stderr (default: on when stderr is a TTY)
`--format`	string	`text`	Summary output format on stdout (text\|json)
`--mds-url`	string		MDS base URL (required)
`--mds-ca-cert`	string		Path to a PEM CA bundle for MDS TLS
`--mds-client-cert`	string		Path to a PEM client certificate for mTLS to MDS
`--mds-client-key`	string		Path to a PEM client key for mTLS to MDS
`--mds-insecure-skip-verify`	bool		Skip TLS certificate verification
`--mds-user`	string		MDS username
`--mds-password-file`	string		Path to a file containing the MDS password
`--mds-token-file`	string		Path to a pre-fetched MDS bearer token file
`--cache-token`	bool		Persist the resolved token to the user config dir
`--mds-max-retries`	int	`3`	Retry transient MDS failures (5xx, 429, connection reset) up to N additional times after the initial call; pass 0 to disable retries
`--run-dir`	string		Explicit run directory
`--out`	string		Output path; parent dir becomes the run dir

Global flags

Flag	Type	Default	Description
`--log-format`	string	`text`	Log output format (text\|json); set MONEDULA_ACL_RBAC_LOG_FORMAT to override the default.
`--log-level`	string	`info`	Log level (debug\|info\|warn\|error); set MONEDULA_ACL_RBAC_LOG_LEVEL to override the default.

Examples

examples

monedula-acl-rbac verify --plan runs/2026-05-21T10-00-00Z/plan.json --mds-url https://mds.example.com --mds-token-file ~/.confluent/token

Exit codes

Code	Meaning
`0`	Success.
`1`	Usage error: missing required flag, malformed argument, or unknown subcommand.
`4`	External system error: MDS unreachable or unauthorized, Kafka unreachable or auth failure, or the Kubernetes API unreachable, unauthorized, or RBAC denied.
`5`	Destructive operation refused by a guardrail, or a guardrail check reports unhealthy state.