Runnable examples

Each example in the repository’s examples/ directory converts one ACL source end to end and commits its expected output under expected/. All but cfk-manifests convert the same microservices platform, with a read-write relay that becomes two bindings and a DENY that is rejected; cfk-manifests converts super users and skips a binding that already exists.

Example	ACL source	Pipeline	Needs
live-mds-migration	A live broker, --from live	extract, plan, apply, verify, delete-acls against a real MDS	Docker with Compose
k8s-live-cluster	Strimzi KafkaUser resources in a running Kubernetes cluster, --from k8s	extract, plan, emit	Docker, kubectl and kind
text-dump	kafka-acls.sh --list output, --from text	extract, plan, emit	The binary, or Docker
structured-dump	acls.yaml and acls.json, --from yaml and --from json	extract, plan, emit	The binary, or Docker
csv-spreadsheet	A CSV export, --from csv	extract, plan, emit	The binary, or Docker
setup-script	A script of kafka-acls --add commands with a vars.yaml, --from script	extract, plan, emit	The binary, or Docker
strimzi-kafkauser	Strimzi KafkaUser manifests, --from strimzi	extract, plan, emit	The binary, or Docker
cfk-manifests	CFK manifests on disk, --from cfk	extract, plan, emit --format cfk	The binary, or Docker

Every example that runs emit writes the script format, except cfk-manifests, which writes cfk; Hand bindings to a CD pipeline describes the formats.

Get the examples

Clone the repository at the release these docs describe:

git clone --branch v0.10.0 https://github.com/monedula-dev/monedula-acl-rbac-converter.git

Run each example’s commands from its own directory, such as monedula-acl-rbac-converter/examples/text-dump.

Run a file-based example

cd monedula-acl-rbac-converter/examples/text-dump
./run.sh --check

./run.sh runs extract, plan and emit and writes the results to out/. --check also compares out/ with the committed expected/ files: it prints ALL GOLDENS MATCH, or a diff and GOLDEN DRIFT with exit code 1. The script runs monedula-acl-rbac from CONVERTER_BIN, your PATH or the repository’s bin/, in that order, or builds it into bin/ with Go when none has it.

With Docker and no local binary, run the same check in a container:

docker compose run --rm converter ./run.sh --check

The first run builds the CLI from the repository into the image monedula-acl-rbac:examples, which every file-based example shares.

Run the live examples

live-mds-migration brings up a single-node Confluent Platform with RBAC and MDS, seeds ACLs on the broker, runs the whole migration and checks the result:

cd monedula-acl-rbac-converter/examples/live-mds-migration
./run.sh          # leaves the stack running
./run.sh --down   # removes the stack at the end

The first run pulls the cp-server image, about 1 GB. Your first ACL to RBAC migration runs the same example one command at a time.

k8s-live-cluster creates a kind cluster, registers the Strimzi and CFK resource definitions without any operator, applies KafkaUser resources, converts them, checks the result and deletes the cluster. Add --keep to leave the cluster running. It runs the CLI on your machine, found or built as above, because the tool needs your kubeconfig:

cd monedula-acl-rbac-converter/examples/k8s-live-cluster
./run.sh

The live examples check their result with assertions instead of --check, because their output depends on the cluster.