---
title: "Runnable examples"
description: "The eight runnable examples in the monedula-acl-rbac repository, one per ACL source, with the pipeline each runs and how to run and check it."
url: https://monedula.dev/flock/docs/acl-rbac-converter/reference/examples/
---
Each example in the repository's [`examples/`](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples) directory converts one ACL source end to end and commits its expected output under `expected/`. All but `cfk-manifests` convert the same microservices platform, with a read-write relay that becomes two bindings and a DENY that is rejected; `cfk-manifests` converts super users and skips a binding that already exists.

| Example | ACL source | Pipeline | Needs |
| --- | --- | --- | --- |
| [live-mds-migration](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/live-mds-migration) | A live broker, `--from live` | `extract`, `plan`, `apply`, `verify`, `delete-acls` against a real MDS | Docker with Compose |
| [k8s-live-cluster](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/k8s-live-cluster) | Strimzi `KafkaUser` resources in a running Kubernetes cluster, `--from k8s` | `extract`, `plan`, `emit` | Docker, `kubectl` and `kind` |
| [text-dump](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/text-dump) | `kafka-acls.sh --list` output, `--from text` | `extract`, `plan`, `emit` | The binary, or Docker |
| [structured-dump](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/structured-dump) | `acls.yaml` and `acls.json`, `--from yaml` and `--from json` | `extract`, `plan`, `emit` | The binary, or Docker |
| [csv-spreadsheet](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/csv-spreadsheet) | A CSV export, `--from csv` | `extract`, `plan`, `emit` | The binary, or Docker |
| [setup-script](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/setup-script) | A script of `kafka-acls --add` commands with a `vars.yaml`, `--from script` | `extract`, `plan`, `emit` | The binary, or Docker |
| [strimzi-kafkauser](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/strimzi-kafkauser) | Strimzi `KafkaUser` manifests, `--from strimzi` | `extract`, `plan`, `emit` | The binary, or Docker |
| [cfk-manifests](https://github.com/monedula-dev/monedula-acl-rbac-converter/tree/v0.10.0/examples/cfk-manifests) | CFK manifests on disk, `--from cfk` | `extract`, `plan`, `emit --format cfk` | The binary, or Docker |

Every example that runs `emit` writes the `script` format, except `cfk-manifests`, which writes `cfk`; [Hand bindings to a CD pipeline](/flock/docs/acl-rbac-converter/how-to/emit-for-a-cd-pipeline/) describes the formats.

## Get the examples

Clone the repository at the release these docs describe:

```bash
git clone --branch v0.10.0 https://github.com/monedula-dev/monedula-acl-rbac-converter.git
```

Run each example's commands from its own directory, such as `monedula-acl-rbac-converter/examples/text-dump`.

## Run a file-based example

```bash
cd monedula-acl-rbac-converter/examples/text-dump
./run.sh --check
```

`./run.sh` runs `extract`, `plan` and `emit` and writes the results to `out/`. `--check` also compares `out/` with the committed `expected/` files: it prints `ALL GOLDENS MATCH`, or a diff and `GOLDEN DRIFT` with exit code 1. The script runs `monedula-acl-rbac` from `CONVERTER_BIN`, your `PATH` or the repository's `bin/`, in that order, or builds it into `bin/` with Go when none has it.

With Docker and no local binary, run the same check in a container:

```bash
docker compose run --rm converter ./run.sh --check
```

The first run builds the CLI from the repository into the image `monedula-acl-rbac:examples`, which every file-based example shares.

## Run the live examples

`live-mds-migration` brings up a single-node Confluent Platform with RBAC and MDS, seeds ACLs on the broker, runs the whole migration and checks the result:

```bash
cd monedula-acl-rbac-converter/examples/live-mds-migration
./run.sh          # leaves the stack running
./run.sh --down   # removes the stack at the end
```

The first run pulls the `cp-server` image, about 1 GB. [Your first ACL to RBAC migration](/flock/docs/acl-rbac-converter/tutorials/first-migration/) runs the same example one command at a time.

`k8s-live-cluster` creates a `kind` cluster, registers the Strimzi and CFK resource definitions without any operator, applies `KafkaUser` resources, converts them, checks the result and deletes the cluster. Add `--keep` to leave the cluster running. It runs the CLI on your machine, found or built as above, because the tool needs your kubeconfig:

```bash
cd monedula-acl-rbac-converter/examples/k8s-live-cluster
./run.sh
```

The live examples check their result with assertions instead of `--check`, because their output depends on the cluster.