Streaming

rpk security acl delete

Delete ACLs.

See the rpk security acl help text for a full write up on ACLs. Delete flags work in a similar multiplying effect as creating ACLs, but delete is more advanced: deletion works on a filter basis. Any unspecified flag defaults to matching everything (all operations, or all allowed principals, etc). To ensure that you do not accidentally delete more than you intend, this command prints everything that matches your input filters and prompts for a confirmation before the delete request is issued. Anything matching more than 10 ACLs doubly confirms.

As mentioned, not specifying flags matches everything. If no resources are specified, all resources are matched. If no operations are specified, all operations are matched. You can also opt in to matching everything with any: --operation any matches any operation.

The --resource-pattern-type, defaulting to any, configures how to filter. resource names: * any returns exact name matches of either prefixed or literal pattern type * match returns wildcard matches, prefix patterns that match your input, and literal matches * prefix returns prefix patterns that match your input (prefix fo matches foo) * literal returns exact name matches

Usage

rpk security acl delete [flags]

Examples

This section provides examples of how to use rpk security acl delete.

Delete all permissions for a user

Delete all permissions to user bar on topic foo and group g:

rpk security acl delete --allow-principal bar --operation all --topic foo --group g

Delete specific ACL from a role

In a scenario that 2 ACLs were created for the same role (red-role), 1 that allows access to topic foo, 1 that deny access to topic bar:

rpk security acl create --topic foo --operation all --allow-role red-role
rpk security acl create --topic bar --operation all --deny-role red-role

It’s possible to delete one of the roles:

rpk security acl delete --topic foo --operation all --allow-role red-role

Flags

Value Type Description

--allow-host

stringSlice

Allowed host ACLs to remove (repeatable).

--allow-principal

stringSlice

Allowed principal ACLs to remove (repeatable).

--allow-role

stringSlice

Allowed role to remove this ACL from (repeatable).

--cluster

bool

Whether to remove ACLs for the cluster.

--deny-host

stringSlice

Hosts from which access will be denied (repeatable).

--deny-principal

stringSlice

Denied principal ACLs to remove (repeatable).

--deny-role

stringSlice

Denied role to remove this ACL from (repeatable).

-d, --dry

bool

Dry run: validate what would be deleted.

--group

stringSlice

Group to remove ACLs for (repeatable).

--no-confirm

bool

Disable confirmation prompt.

--operation

stringSlice

Operation to remove (repeatable).

-f, --print-filters

bool

Print the filters that were requested (failed filters are always printed).

--registry-global

bool

Whether to remove ACLs for the schema registry.

--registry-subject

stringSlice

Schema Registry subjects to remove ACLs for (repeatable).

--resource-pattern-type

string

Pattern to use when matching resource names (any, match, literal, or prefixed).

--topic

stringSlice

Topic to remove ACLs for (repeatable).

--transactional-id

stringSlice

Transactional IDs to remove ACLs for (repeatable).

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.