Confluent RBAC backup

Enterprise 0.7 provides the rbac-backup command for capturing Confluent Platform MDS role bindings. It does not provide a complete, qualified permission recovery workflow. Keep bootstrap administration and a separate record of required access when planning disaster recovery.

rbac-backup.yaml

mode: backup
backup_id: permissions-audit
storage:
  backend: filesystem
  path: ./backups
enterprise:
  confluent_rbac:
    mds_url: "https://mds.example.com:8090"
    auth:
      username: ${MDS_USERNAME}
      password: ${MDS_PASSWORD}

kafka-backup rbac-backup --config rbac-backup.yaml

The account needs permission to enumerate the selected MDS scopes and bindings. An export does not create identities, recover credentials or prove effective access on a different cluster. Review enumeration errors before relying on an export.

Authorization recovery development

The next Enterprise minor release is being qualified for additive recovery of Platform MDS bindings, Cloud IAM bindings and Kafka ACLs onto existing identities. It is not yet a released support claim. Do not use development commands with a production recovery identity.

The intended workflow captures a fresh complete snapshot, maps principals and scopes explicitly, produces a plan, applies its approved checksum, and verifies destination assignments. Existing target-only permissions remain in place. Administrator bindings need explicit opt-in. A failed apply retains completed changes and a partial report; it does not revoke permissions automatically.

Legacy unversioned RBAC exports remain useful for inspection. They cannot establish enumeration completeness and will not be accepted as recovery input. Capture a fresh versioned authorization snapshot with the recovery release.

See the authorization recovery rehearsal guide for the evidence to collect before releasing application access. Cloud qualification is limited to mapped service accounts in two environments in one organization; cross-organization recovery, user/group/identity-pool contracts, operator integration and complete application recovery sets are outside that qualification.