Confluent Cloud

• 1: Configuration
• 2: Resources
• 2.1: Role Bindings for Confluent Cloud
• 3: Annotations

1 - Configuration

Configuration

You can configure the properties to connect to Confluent Cloud through the Jikkou client configuration property jikkou.provider.confluent-cloud.

Example:

jikkou {
  provider.confluent-cloud {
    enabled = true
    type = io.jikkou.extension.confluent.ConfluentCloudExtensionProvider
    config = {
      # URL to the Confluent Cloud REST API (default: https://api.confluent.cloud)
      apiUrl = "https://api.confluent.cloud"
      # Confluent Cloud API Key (must be a Cloud API Key, not a Cluster API Key)
      apiKey = ${CONFLUENT_CLOUD_API_KEY}
      # Confluent Cloud API Secret
      apiSecret = ${CONFLUENT_CLOUD_API_SECRET}
      # CRN pattern used to scope role binding list operations
      crnPattern = ${CONFLUENT_CLOUD_CRN_PATTERN}
      # HTTP proxy URL, e.g. 'http://proxy.example.com:3128' (optional)
      proxyUrl = "http://proxy.example.com:3128"
      # Username for proxy Basic authentication (optional)
      proxyUsername = null
      # Password for proxy Basic authentication (optional)
      proxyPassword = null
      # Comma-separated hosts that bypass the proxy (optional)
      nonProxyHosts = "localhost,127.0.0.1"
      # Enable debug logging (default: false)
      debugLoggingEnabled = false

      # Additional HTTP headers sent on every request to the Confluent Cloud REST API.
      # Applied last, so these override headers Jikkou sets itself, including 'Authorization'.
      clientHeaders {
        X-Api-Gateway-Key = "my-gateway-key"
        X-Tenant = "acme"
      }
    }
  }
}

Configuration Properties

If proxyUrl is not set, Jikkou honors the standard JVM proxy system properties (-Dhttps.proxyHost, -Dhttp.proxyHost, -Dhttp.proxyUser, -Dhttp.proxyPassword, -Dhttp.nonProxyHosts), which can be supplied via JAVA_TOOL_OPTIONS. The OS-level http_proxy / https_proxy environment variables are not read by the JVM and have no effect.

Custom HTTP headers

The clientHeaders property attaches arbitrary HTTP headers to every request Jikkou sends to the Confluent Cloud REST API. It is useful for API gateway keys, tenant identifiers, and tracing headers.

clientHeaders {
  X-Api-Gateway-Key = "my-gateway-key"
  X-Tenant = "acme"
}

Custom headers are applied last, so a header set here replaces the one Jikkou would otherwise send under the same name, including the Authorization header built from apiKey and apiSecret. Header names are matched case-insensitively.

When debug logging is enabled, header values are redacted if the header name is Authorization, Proxy-Authorization, Cookie, or Set-Cookie, or if it contains token, secret, key, or password. Header names are always logged in full.

Creating a Cloud API Key

Cloud API Keys can be created using the Confluent Cloud CLI:

confluent api-key create --resource cloud --description "Jikkou role binding management"

Important: You must use a Cloud API Key (organization-level), not a Cluster API Key. Cluster API Keys will result in a 401 Unauthorized error.

CRN Pattern

The crnPattern property is required and scopes all list operations to a specific part of your organization hierarchy. Examples:

2 - Resources

2.1 - Role Bindings for Confluent Cloud

RoleBinding

Specification

Here is the resource definition file for defining a RoleBinding.

---
apiVersion: "iam.confluent.cloud/v1"    # The api version (required)
kind: "RoleBinding"                     # The resource kind (required)
metadata:
  labels: { }
  annotations: { }
spec:
  principal: <>              # The principal (e.g., User:sa-abc123 or User:u-xyz789)
  roleName: <>               # The role name (e.g., CloudClusterAdmin, DeveloperRead)
  crnPattern: <>             # The Confluent Resource Name pattern (e.g., crn://confluent.cloud/...)

Fields

Common Role Names

Example

Here is a simple example that shows how to define a single role binding using the RoleBinding resource type.

file: role-binding.yaml

---
apiVersion: "iam.confluent.cloud/v1"
kind: "RoleBinding"
metadata:
  labels: { }
  annotations: { }
spec:
  principal: "User:sa-abc123"
  roleName: "CloudClusterAdmin"
  crnPattern: "crn://confluent.cloud/organization=org-123/environment=env-456/cloud-cluster=lkc-789"

Usage

# List all role bindings
jikkou get ccloud-rbs

# Apply role bindings from a file
jikkou apply --files ./role-binding.yaml

# Delete orphan role bindings not defined in the file
jikkou apply --files ./role-binding.yaml -o delete-orphans=true

# Dry-run to preview changes without applying
jikkou diff --files ./role-binding.yaml

Metadata Labels

When listing role bindings, Jikkou automatically enriches each resource with metadata labels to help identify principals:

Example output:

apiVersion: "iam.confluent.cloud/v1"
kind: "RoleBinding"
metadata:
  labels:
    confluent.cloud/principal-name: "Florian Hussonnois"
    confluent.cloud/principal-email: "florian@example.com"
  annotations:
    confluent.cloud/role-binding-id: "rb-NBl9kE"
spec:
  principal: "User:u-rrnm2g9"
  roleName: "OrganizationAdmin"
  crnPattern: "crn://confluent.cloud/organization=d497af93-23f5-434a-a008-0547797be410"

RoleBindingList

If you need to define multiple role bindings (e.g., using a template), it may be easier to use a RoleBindingList resource.

Specification

Here is the resource definition file for defining a RoleBindingList.

---
apiVersion: "iam.confluent.cloud/v1"    # The api version (required)
kind: "RoleBindingList"                 # The resource kind (required)
metadata: # (optional)
  labels: { }
  annotations: { }
items: [ ]                             # An array of RoleBinding

Example

---
apiVersion: "iam.confluent.cloud/v1"
kind: "RoleBindingList"
items:
  - spec:
      principal: "User:sa-abc123"
      roleName: "CloudClusterAdmin"
      crnPattern: "crn://confluent.cloud/organization=org-123/environment=env-456/cloud-cluster=lkc-789"
  - spec:
      principal: "User:sa-abc123"
      roleName: "DeveloperRead"
      crnPattern: "crn://confluent.cloud/organization=org-123/environment=env-456/cloud-cluster=lkc-789/kafka=lkc-789/topic=my-topic"
  - spec:
      principal: "User:u-xyz789"
      roleName: "OrganizationAdmin"
      crnPattern: "crn://confluent.cloud/organization=org-123"

Note: Role bindings are immutable in the Confluent Cloud API. If you need to change a role binding, delete the old one and create a new one. Jikkou only supports CREATE and DELETE operations (no UPDATE).

3 - Annotations

List of built-in annotations

confluent.cloud/role-binding-id

Used by Jikkou.

The annotation is automatically added by Jikkou to store the Confluent Cloud role binding ID (e.g., rb-NBl9kE). This ID is used internally when deleting role bindings.