Manage Confluent Role-based Access Control¶
Confluent for Kubernetes (CFK) provides the ConfluentRolebinding custom resource definition (CRD). With the ConfluentRolebinding CRD, you can declaratively create and manage Confluent Role-Based Access Control (RBAC) for users and groups as custom resources (CRs) in Kubernetes.
For rolebinding custom resource examples, see Sample Rolebindings in GitHub.
Before you create rolebindings using ConfluentRolebinding CRs, the following requirements must be satisfied:
Set up the Confluent Admin REST API.
Confluent rolebindings are created and managed using Admin REST APIs, and Admin REST APIs must be running on the Confluent Platform cluster.
Create a rolebinding¶
Create a ConfluentRoleBinding CR.
The following is the structure of the CR:
spec: principal: ---  type: ---  name: ---  role: ---  resourcePatterns: ---  - name: ---  resourceType: ---  patternType: ---  clustersScopeByIds: ---  kafkaClusterId: schemaRegistryClusterId: ksqlClusterId: connectClusterId: clustersScopByRegistryName: ---  kafkaRestClassRef: ---  name: ---  namespace: --- 
-  Required. The identity of a user or group this rolebinding is created for.
-  Required. The type of the principal. Set it to
-  Required. The name of the principal.
-  Required. Predefined role name. For the predefined roles you can use, refer to Confluent RBAC Predefined Roles.
-  Optional. Qualified resources associated with this rolebinding.
-  Required. The name of the resource associated with this rolebinding.
-  Required. The type of the resource.
-  Optional. Specify whether the pattern of resource is
LITERAL. The default is
LITERALif not set.
-  Optional. The scope of the cluster id. You can specify a cluster name
() or one scope id among
-  Optional. The cluster name registered in the cluster registry, which uniquely identifies the cluster for this rolebinding.
-  Optional. The KafkaRestClass CR that defines configurations for the Confluent REST API. If it is not configured, the default KafkaRestClass is used.
-  Required under
kafkaRestClassRef(). The name of the KafkaRestClass CR.
-  Optional. If omitted, the same namespace of this ConfluentRoleBinding CR is used.
Apply the ConfluentRolebinding CR:
kubectl apply -f <ConfluentRolebinding CR>
Update a rolebinding¶
Principal and Role cannot be updated in a ConfluentRoleBinding CR.
When you use Confluent CLI or other ways to update/delete rolebindings, CFK will resync the corresponding ConfluentRoleBinding CR.
To update a rolebinding, edit the ConfluentRoleBinding CR and apply the changes
kubectl apply command.
View status of a rolebinding¶
To see the current status of a rolebinding, run the following command:
kubectl describe confluentrolebinding <ConfluentRolebinding CR>
Delete a rolebinding¶
To delete a rolebinding, run the following command:
kubectl delete -f <ConfluentRolebinding CR>
View all rolebindings¶
To view all the Confluent rolebindings, run the following command:
kubectl get cfrb/confluentrolebinding
The output lists all Confluent rolebindings with the below information for each rolebinding:
- Cluster id