Role Bindings for Confluent Cloud

Mon, 01 Jan 0001 00:00:00 +0000

The RoleBinding resources are used to manage RBAC role bindings in Confluent Cloud. A RoleBinding resource defines which role is granted to a principal for a specific scope (identified by a CRN pattern).

`RoleBinding`

Specification

Here is the resource definition file for defining a RoleBinding.

---
apiVersion: "iam.confluent.cloud/v1" # The api version (required)
kind: "RoleBinding" # The resource kind (required)
metadata:
 labels: { }
 annotations: { }
spec:
 principal: <>  # The principal (e.g., User:sa-abc123 or User:u-xyz789)
 roleName: <>  # The role name (e.g., CloudClusterAdmin, DeveloperRead)
 crnPattern: <>  # The Confluent Resource Name pattern (e.g., crn://confluent.cloud/...)

Fields

Field	Type	Required	Description
`principal`	String	Yes	The principal. Pattern: `User:<user-id>` or `Group:<group-name>`.
`roleName`	String	Yes	The role to bind. See Confluent Cloud RBAC roles.
`crnPattern`	String	Yes	The Confluent Resource Name (CRN) pattern defining the scope of the binding.

Common Role Names

Role	Description
`OrganizationAdmin`	Full access to the organization.
`EnvironmentAdmin`	Full access to an environment.
`CloudClusterAdmin`	Full access to a Kafka cluster.
`DeveloperManage`	Manage topics and schemas.
`DeveloperRead`	Read from topics and view schemas.
`DeveloperWrite`	Write to topics and manage schemas.
`ResourceOwner`	Full access to a specific resource.

Example

Here is a simple example that shows how to define a single role binding using the RoleBinding resource type.