DocsICP FilingConsole
Documentation
Home Page ApsaraMQ for Kafka ApsaraMQ for Confluent User Guide Cluster configuration and usage Confluent CLI RBAC role binding examples

Confluent CLI RBAC role binding examples

Updated at:
Copy as MD
Product
My Favorites

You can use the Confluent CLI to create, list, and delete RBAC role bindings for different cluster types and resources.

Cluster types and resources

The following table describes the cluster types and resource types supported by ApsaraMQ for Confluent.

Cluster

Resource type

Kafka cluster

cluster

group

topic

TransactionalId

KSQL

cluster

Schema Registry

cluster

subject

Connect cluster

cluster

connector

Kafka cluster

A Kafka cluster contains four resource types: cluster, group, topic, and TransactionalId.

Cluster

The following roles are supported:

  • AuditAdmin

  • ClusterAdmin

  • DeveloperManage

  • DeveloperWrite

  • Operator

  • ResourceOwner

  • SecurityAdmin

  • SystemAdmin

  • UserAdmin

Example 1: Grant the SystemAdmin role to the user test on a Kafka cluster.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role SystemAdmin  --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role SystemAdmin  --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role SystemAdmin  --kafka-cluster <kafka-cluster-id>

Example 2: Grant the ResourceOwner role to the user test on a Kafka cluster.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner  --resource Cluster:kafka-cluster --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner  --resource Cluster:kafka-cluster --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner  --resource Cluster:kafka-cluster --kafka-cluster <kafka-cluster-id>

Group

The following roles are supported:

  • DeveloperManage

  • DeveloperRead

  • ResourceOwner

Example 1: Grant the DeveloperRead role to the user test on the group test_group.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role DeveloperRead  --resource Group:group_test --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role DeveloperRead --resource Group:group_test --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role DeveloperRead --resource Group:group_test --kafka-cluster <kafka-cluster-id>

Example 2: Grant the ResourceOwner role to the user test for groups with the prefix demo.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner  --resource Group:demo --prefix --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner  --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource Group:demo --prefix --kafka-cluster <kafka-cluster-id>

Example 3: Grant the ResourceOwner role to the user test for all groups.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner  --resource Group:* --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner  --resource Group:* --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource Group:* --kafka-cluster <kafka-cluster-id>

Topic

The following roles are supported:

  • DeveloperManage

  • DeveloperRead

  • DeveloperWrite

  • ResourceOwner

Example 1: Grant the DeveloperWrite role to the user test on the topic test_topic.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role DeveloperWrite  --resource Topic:test_topic --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role DeveloperWrite --resource Topic:test_topic --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role DeveloperWrite --resource Topic:test_topic --kafka-cluster <kafka-cluster-id>

Example 2: Grant the ResourceOwner role to the user test for topics with the prefix demo.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner  --resource Topic:demo --prefix --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner --resource Topic:demo --prefix --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource Topic:demo --prefix --kafka-cluster <kafka-cluster-id>

Example 3: Grant the ResourceOwner role to the user test for all topics.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner  --resource Topic:* --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner --resource Topic:* --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource Topic:* --kafka-cluster <kafka-cluster-id>

TransactionalId

The following roles are supported:

  • DeveloperManage

  • DeveloperRead

  • DeveloperWrite

  • ResourceOwner

Example: Grant the ResourceOwner role to the user test for all TransactionalId resources.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner  --resource TransactionalId:* --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner --resource TransactionalId:* --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource TransactionalId:* --kafka-cluster <kafka-cluster-id>

KSQL

KSQL has only one resource type: cluster.

Cluster

The following roles are supported:

  • AuditAdmin

  • ClusterAdmin

  • DeveloperManage

  • DeveloperWrite

  • Operator

  • ResourceOwner

  • SecurityAdmin

  • SystemAdmin

  • UserAdmin

Example: Grant the ResourceOwner role to the user test on a KSQL cluster.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner --resource KsqlCluster:ksql-cluster --ksql-cluster <ksql-cluster-id> --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner --resource KsqlCluster:ksql-cluster --ksql-cluster <ksql-cluster-id> --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource KsqlCluster:ksql-cluster --ksql-cluster <ksql-cluster-id> --kafka-cluster <kafka-cluster-id>

Schema Registry

Schema Registry contains two resource types: cluster and subject.

Cluster

The following roles are supported:

  • AuditAdmin

  • ClusterAdmin

  • Operator

  • SecurityAdmin

  • SystemAdmin

  • UserAdmin

Example: Grant the SystemAdmin role to the user test on a Schema Registry cluster.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role SystemAdmin --schema-registry-cluster <schema-registry-cluster-id> --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role SystemAdmin --schema-registry-cluster <schema-registry-cluster-id> --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role SystemAdmin --schema-registry-cluster <schema-registry-cluster-id> --kafka-cluster <kafka-cluster-id>

Subject

The following roles are supported:

  • DeveloperManage

  • DeveloperRead

  • DeveloperWrite

  • ResourceOwner

Example: Grant the ResourceOwner role to the user test for all subject resources.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner --resource Subject:* --schema-registry-cluster <schema-registry-cluster-id> --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner --resource Subject:* --schema-registry-cluster <schema-registry-cluster-id> --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource Subject:* --schema-registry-cluster <schema-registry-cluster-id> --kafka-cluster <kafka-cluster-id>

Connect cluster

A Connect cluster contains two resource types: cluster and connector.

Cluster

The following roles are supported:

  • AuditAdmin

  • ClusterAdmin

  • Operator

  • SecurityAdmin

  • SystemAdmin

  • UserAdmin

Example: Grant the SystemAdmin role to the user test on a Connect cluster.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role SystemAdmin  --connect-cluster <connect-cluster-id> --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role SystemAdmin  --connect-cluster <connect-cluster-id> --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role SystemAdmin  --connect-cluster <connect-cluster-id> --kafka-cluster <kafka-cluster-id>

Connector

The following roles are supported:

  • DeveloperManage

  • DeveloperRead

  • DeveloperWrite

  • ResourceOwner

Example: Grant the ResourceOwner role to the user test for all connectors.

# Create role binding
confluent iam rbac role-binding create --principal User:test --role ResourceOwner  --resource Connector:*  --connect-cluster <connect-cluster-id> --kafka-cluster <kafka-cluster-id>

# List role bindings
confluent iam rbac role-binding list --principal User:test --role ResourceOwner --resource Connector:*  --connect-cluster <connect-cluster-id> --kafka-cluster <kafka-cluster-id>

# Delete role binding
confluent iam rbac role-binding delete --principal User:test --role ResourceOwner --resource Connector:*  --connect-cluster <connect-cluster-id> --kafka-cluster <kafka-cluster-id>
Previous：Connector use casesNext：Log on to Control Center using SSO