[SETU-2677] Add USM cluster-level RBAC role-binding scopes to CLI

cmd/lint/main.go

@@ -363,6 +363,7 @@ var vocabWords = []string{
 	"uri",
 	"url",
 	"us",
+	"usm",
 	"v2",
 	"vertexai",
 	"vnet",

internal/iam/command_rbac_role_binding.go

@@ -180,12 +180,14 @@
 func addClusterFlags(cmd *cobra.Command, cfg *config.Config, cliCommand *pcmd.CLICommand) {
 	if cfg.IsCloudLogin() {
 		cmd.Flags().String("environment", "", "Environment ID for scope of role-binding operation.")
 		cmd.Flags().Bool("current-environment", false, "Use current environment ID for scope.")
 		cmd.Flags().String("cloud-cluster", "", "Cloud cluster ID for the role binding.")
 		cmd.Flags().String("kafka-cluster", "", "Kafka cluster ID for the role binding.")
 		cmd.Flags().String("schema-registry-cluster", "", "Schema Registry cluster ID for the role binding.")
 		cmd.Flags().String("ksql-cluster", "", "ksqlDB cluster name for the role binding.")
 		cmd.Flags().String("flink-region", "", `Flink region for the role binding, formatted as "cloud.region".`)
+		cmd.Flags().String("usm-kafka-cluster", "", "USM Kafka cluster ID for the role binding.")
+		cmd.Flags().String("usm-connect-cluster", "", "USM Connect cluster ID for the role binding.")
 	} else {
 		cmd.Flags().String("kafka-cluster", "", "Kafka cluster ID for the role binding.")
 		cmd.Flags().String("schema-registry-cluster", "", "Schema Registry cluster ID for the role binding.")
@@ -569,7 +571,7 @@
 	}, nil
 }
 
 func (c *roleBindingCommand) parseV2BaseCrnPattern(cmd *cobra.Command) (string, error) {
 	crnPattern := "crn://confluent.cloud/organization=" + c.Context.GetCurrentOrganization()
 
 	if cmd.Flags().Changed("current-environment") {
@@ -626,6 +628,22 @@
 		crnPattern += "/flink-region=" + flinkRegion
 	}
 
+	if cmd.Flags().Changed("usm-kafka-cluster") {
+		usmKafkaCluster, err := cmd.Flags().GetString("usm-kafka-cluster")
+		if err != nil {
+			return "", err
+		}
+		crnPattern += "/usm-kafka-cluster=" + usmKafkaCluster
+	}
+
+	if cmd.Flags().Changed("usm-connect-cluster") {
+		usmConnectCluster, err := cmd.Flags().GetString("usm-connect-cluster")
+		if err != nil {
+			return "", err
+		}
+		crnPattern += "/usm-connect-cluster=" + usmConnectCluster
+	}
+
 	if cmd.Flags().Changed("role") {
 		role, err := cmd.Flags().GetString("role")
 		if err != nil {
@@ -639,7 +657,7 @@
 		}
 	}
 
-	if cmd.Flags().Changed("cloud-cluster") && !cmd.Flags().Changed("current-environment") && !cmd.Flags().Changed("environment") {
+	if (cmd.Flags().Changed("cloud-cluster") || cmd.Flags().Changed("usm-kafka-cluster") || cmd.Flags().Changed("usm-connect-cluster")) && !cmd.Flags().Changed("current-environment") && !cmd.Flags().Changed("environment") {
 		return "", errors.New(specifyEnvironmentErrorMsg)
 	}
 	return crnPattern, nil

internal/iam/command_rbac_role_binding_create.go

@@ -63,6 +63,14 @@ func (c *roleBindingCommand) newCreateCommand() *cobra.Command {
 				Text: `Grant the "FlinkDeveloper" scoped to Flink compute pool "lfcp-123456" in AWS us-east-1 to principal "User:u-123456":`,
 				Code: "confluent iam rbac role-binding create --principal User:u-123456 --role FlinkDeveloper --environment env-123456 --flink-region aws.us-east-1 --resource ComputePool:lfcp-123456",
 			},
+			examples.Example{
+				Text: `Grant the role "UsmClusterAdmin" to the principal "User:u-123456" for the USM Kafka cluster "usmkc-123456" in the environment "env-123456":`,
+				Code: "confluent iam rbac role-binding create --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456",
+			},
+			examples.Example{
+				Text: `Grant the role "UsmClusterAdmin" to the principal "User:u-123456" for the USM Connect cluster "usmcc-123456" in the environment "env-123456":`,
+				Code: "confluent iam rbac role-binding create --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-connect-cluster usmcc-123456",
+			},
 		)
 	} else {
 		exs = append(exs,

internal/iam/command_rbac_role_binding_delete.go

@@ -31,6 +31,10 @@ func (c *roleBindingCommand) newDeleteCommand() *cobra.Command {
 				Text: `Delete the role "ResourceOwner" for the resource "Topic:my-topic" on the Kafka cluster "lkc-123456":`,
 				Code: "confluent iam rbac role-binding delete --principal User:u-123456 --role ResourceOwner --environment env-123456 --kafka-cluster lkc-123456 --resource Topic:my-topic",
 			},
+			examples.Example{
+				Text: `Delete the role "UsmClusterAdmin" for the principal "User:u-123456" on the USM Kafka cluster "usmkc-123456" in the environment "env-123456":`,
+				Code: "confluent iam rbac role-binding delete --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456",
+			},
 		)
 	} else {
 		cmd.Example = examples.BuildExampleString(

internal/iam/command_rbac_role_binding_list.go

@@ -54,6 +54,10 @@ func (c *roleBindingCommand) newListCommand() *cobra.Command {
 				Text: `List the role bindings for user "u-123456" with role "CloudClusterAdmin":`,
 				Code: "confluent iam rbac role-binding list --principal User:u-123456 --role CloudClusterAdmin --environment env-123456 --cloud-cluster lkc-123456",
 			},
+			examples.Example{
+				Text: `List the role bindings for user "u-123456" with role "UsmClusterAdmin" for the USM Kafka cluster "usmkc-123456":`,
+				Code: "confluent iam rbac role-binding list --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456",
+			},
 			examples.Example{
 				Text: `List the role bindings for user "u-123456" for all scopes:`,
 				Code: "confluent iam rbac role-binding list --principal User:u-123456 --inclusive",
@@ -100,6 +104,8 @@ func (c *roleBindingCommand) newListCommand() *cobra.Command {
 		cmd.Flags().String("schema-registry-cluster", "", "Schema Registry cluster ID, which specifies the Schema Registry cluster scope.")
 		cmd.Flags().String("ksql-cluster", "", "ksqlDB cluster name, which specifies the ksqlDB cluster scope.")
 		cmd.Flags().String("flink-region", "", `Flink region for the role binding, formatted as "cloud.region".`)
+		cmd.Flags().String("usm-kafka-cluster", "", "USM Kafka cluster ID, which specifies the USM Kafka cluster scope.")
+		cmd.Flags().String("usm-connect-cluster", "", "USM Connect cluster ID, which specifies the USM Connect cluster scope.")
 	} else {
 		cmd.Flags().String("kafka-cluster", "", "Kafka cluster ID, which specifies the Kafka cluster scope.")
 		cmd.Flags().String("schema-registry-cluster", "", "Schema Registry cluster ID, which specifies the Schema Registry cluster scope.")
@@ -424,6 +430,12 @@ func (c *roleBindingCommand) listMyRoleBindings(cmd *cobra.Command, listRoleBind
 				envName = content
 			case "cloud-cluster":
 				cloudClusterName = content
+			case "usm-kafka-cluster":
+				clusterType = "USM Kafka"
+				logicalCluster = content
+			case "usm-connect-cluster":
+				clusterType = "USM Connect"
+				logicalCluster = content
 			case "ksql":
 				clusterType = "ksqlDB"
 				logicalCluster = content

internal/iam/command_rbac_role_binding_test.go

@@ -3,7 +3,11 @@ package iam
 import (
 	"testing"
 
+	"github.com/spf13/cobra"
 	"github.com/stretchr/testify/require"
+
+	pcmd "github.com/confluentinc/cli/v4/pkg/cmd"
+	"github.com/confluentinc/cli/v4/pkg/config"
 )
 
 func TestParseAndValidateResourcePattern_Prefixed(t *testing.T) {
@@ -35,3 +39,68 @@ func TestParseAndValidateResourcePattern_ErrIncorrectResourceFormat(t *testing.T
 	_, err := parseAndValidateResourcePattern("string with no colon", true)
 	require.Error(t, err)
 }
+
+// newRoleBindingTestCommand returns a roleBindingCommand with a minimal context that only
+// supplies the current organization, which is all parseV2BaseCrnPattern reads from context.
+func newRoleBindingTestCommand() *roleBindingCommand {
+	return &roleBindingCommand{
+		AuthenticatedCLICommand: &pcmd.AuthenticatedCLICommand{
+			Context: &config.Context{LastOrgId: "abc-123"},
+		},
+	}
+}
+
+// newCloudRoleBindingFlagSet registers the cloud scope flags that parseV2BaseCrnPattern reads.
+func newCloudRoleBindingFlagSet() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.Flags().String("role", "", "")
+	cmd.Flags().String("environment", "", "")
+	cmd.Flags().Bool("current-environment", false, "")
+	cmd.Flags().String("cloud-cluster", "", "")
+	cmd.Flags().String("schema-registry-cluster", "", "")
+	cmd.Flags().String("ksql-cluster", "", "")
+	cmd.Flags().String("kafka-cluster", "", "")
+	cmd.Flags().String("flink-region", "", "")
+	cmd.Flags().String("usm-kafka-cluster", "", "")
+	cmd.Flags().String("usm-connect-cluster", "", "")
+	return cmd
+}
+
+func TestParseV2BaseCrnPattern_UsmKafkaCluster(t *testing.T) {
+	cmd := newCloudRoleBindingFlagSet()
+	require.NoError(t, cmd.Flags().Set("role", "UsmClusterAdmin"))
+	require.NoError(t, cmd.Flags().Set("environment", "env-596"))
+	require.NoError(t, cmd.Flags().Set("usm-kafka-cluster", "usmkc-123456"))
+
+	crnPattern, err := newRoleBindingTestCommand().parseV2BaseCrnPattern(cmd)
+	require.NoError(t, err)
+	require.Equal(t, "crn://confluent.cloud/organization=abc-123/environment=env-596/usm-kafka-cluster=usmkc-123456", crnPattern)
+}
+
+func TestParseV2BaseCrnPattern_UsmConnectCluster(t *testing.T) {
+	cmd := newCloudRoleBindingFlagSet()
+	require.NoError(t, cmd.Flags().Set("role", "UsmClusterAdmin"))
+	require.NoError(t, cmd.Flags().Set("environment", "env-596"))
+	require.NoError(t, cmd.Flags().Set("usm-connect-cluster", "usmcc-123456"))
+
+	crnPattern, err := newRoleBindingTestCommand().parseV2BaseCrnPattern(cmd)
+	require.NoError(t, err)
+	require.Equal(t, "crn://confluent.cloud/organization=abc-123/environment=env-596/usm-connect-cluster=usmcc-123456", crnPattern)
+}
+
+func TestParseV2BaseCrnPattern_UsmRoleRequiresEnvironment(t *testing.T) {
+	cmd := newCloudRoleBindingFlagSet()
+	require.NoError(t, cmd.Flags().Set("role", "UsmClusterAdmin"))
+	require.NoError(t, cmd.Flags().Set("usm-kafka-cluster", "usmkc-123456"))
+
+	_, err := newRoleBindingTestCommand().parseV2BaseCrnPattern(cmd)
+	require.EqualError(t, err, specifyEnvironmentErrorMsg)
+}
+
+func TestParseV2BaseCrnPattern_UsmClusterFlagRequiresEnvironment(t *testing.T) {
+	cmd := newCloudRoleBindingFlagSet()
+	require.NoError(t, cmd.Flags().Set("usm-connect-cluster", "usmcc-123456"))
+
+	_, err := newRoleBindingTestCommand().parseV2BaseCrnPattern(cmd)
+	require.EqualError(t, err, specifyEnvironmentErrorMsg)
+}

test/fixtures/output/iam/rbac/role-binding/create-help.golden

@@ -44,6 +44,14 @@ Grant the "FlinkDeveloper" scoped to Flink compute pool "lfcp-123456" in AWS us-
 
   $ confluent iam rbac role-binding create --principal User:u-123456 --role FlinkDeveloper --environment env-123456 --flink-region aws.us-east-1 --resource ComputePool:lfcp-123456
 
+Grant the role "UsmClusterAdmin" to the principal "User:u-123456" for the USM Kafka cluster "usmkc-123456" in the environment "env-123456":
+
+  $ confluent iam rbac role-binding create --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456
+
+Grant the role "UsmClusterAdmin" to the principal "User:u-123456" for the USM Connect cluster "usmcc-123456" in the environment "env-123456":
+
+  $ confluent iam rbac role-binding create --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-connect-cluster usmcc-123456
+
 Flags:
       --role string                      REQUIRED: Role name of the new role binding.
       --principal string                 REQUIRED: Principal type and identifier using "Prefix:ID" format.
@@ -54,6 +62,8 @@ Flags:
       --schema-registry-cluster string   Schema Registry cluster ID for the role binding.
       --ksql-cluster string              ksqlDB cluster name for the role binding.
       --flink-region string              Flink region for the role binding, formatted as "cloud.region".
+      --usm-kafka-cluster string         USM Kafka cluster ID for the role binding.
+      --usm-connect-cluster string       USM Connect cluster ID for the role binding.
       --resource string                  Resource type and identifier using "Prefix:ID" format.
       --prefix                           Whether the provided resource name is treated as a prefix pattern.
   -o, --output string                    Specify the output format as "human", "json", or "yaml". (default "human")

test/fixtures/output/iam/rbac/role-binding/create-usm-connect-cluster-admin-cloud.golden

@@ -0,0 +1,5 @@
++-----------+----------------------+
+| Principal | User:u-11aaa         |
+| Email     | u-11aaa@confluent.io |
+| Role      | UsmClusterAdmin      |
++-----------+----------------------+

test/fixtures/output/iam/rbac/role-binding/create-usm-kafka-cluster-admin-cloud.golden

@@ -0,0 +1,5 @@
++-----------+----------------------+
+| Principal | User:u-11aaa         |
+| Email     | u-11aaa@confluent.io |
+| Role      | UsmClusterAdmin      |
++-----------+----------------------+

test/fixtures/output/iam/rbac/role-binding/delete-help.golden

@@ -8,6 +8,10 @@ Delete the role "ResourceOwner" for the resource "Topic:my-topic" on the Kafka c
 
   $ confluent iam rbac role-binding delete --principal User:u-123456 --role ResourceOwner --environment env-123456 --kafka-cluster lkc-123456 --resource Topic:my-topic
 
+Delete the role "UsmClusterAdmin" for the principal "User:u-123456" on the USM Kafka cluster "usmkc-123456" in the environment "env-123456":
+
+  $ confluent iam rbac role-binding delete --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456
+
 Flags:
       --role string                      REQUIRED: Role name of the existing role binding.
       --principal string                 REQUIRED: Principal type and identifier using "Prefix:ID" format.
@@ -19,6 +23,8 @@ Flags:
       --schema-registry-cluster string   Schema Registry cluster ID for the role binding.
       --ksql-cluster string              ksqlDB cluster name for the role binding.
       --flink-region string              Flink region for the role binding, formatted as "cloud.region".
+      --usm-kafka-cluster string         USM Kafka cluster ID for the role binding.
+      --usm-connect-cluster string       USM Connect cluster ID for the role binding.
       --resource string                  Resource type and identifier using "Prefix:ID" format.
       --prefix                           Whether the provided resource name is treated as a prefix pattern.
   -o, --output string                    Specify the output format as "human", "json", or "yaml". (default "human")

test/fixtures/output/iam/rbac/role-binding/delete-missing-role-cloud.golden

@@ -7,6 +7,10 @@ Delete the role "ResourceOwner" for the resource "Topic:my-topic" on the Kafka c
 
   $ confluent iam rbac role-binding delete --principal User:u-123456 --role ResourceOwner --environment env-123456 --kafka-cluster lkc-123456 --resource Topic:my-topic
 
+Delete the role "UsmClusterAdmin" for the principal "User:u-123456" on the USM Kafka cluster "usmkc-123456" in the environment "env-123456":
+
+  $ confluent iam rbac role-binding delete --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456
+
 Flags:
       --role string                      REQUIRED: Role name of the existing role binding.
       --principal string                 REQUIRED: Principal type and identifier using "Prefix:ID" format.
@@ -18,6 +22,8 @@ Flags:
       --schema-registry-cluster string   Schema Registry cluster ID for the role binding.
       --ksql-cluster string              ksqlDB cluster name for the role binding.
       --flink-region string              Flink region for the role binding, formatted as "cloud.region".
+      --usm-kafka-cluster string         USM Kafka cluster ID for the role binding.
+      --usm-connect-cluster string       USM Connect cluster ID for the role binding.
       --resource string                  Resource type and identifier using "Prefix:ID" format.
       --prefix                           Whether the provided resource name is treated as a prefix pattern.
   -o, --output string                    Specify the output format as "human", "json", or "yaml". (default "human")

test/fixtures/output/iam/rbac/role-binding/delete-usm-kafka-cluster-admin-cloud.golden

@@ -0,0 +1,6 @@
++-----------+----------------------+
+| ID        | rb-88hhh             |
+| Principal | User:u-11aaa         |
+| Email     | u-11aaa@confluent.io |
+| Role      | UsmClusterAdmin      |
++-----------+----------------------+

test/fixtures/output/iam/rbac/role-binding/list-failure-help-cloud.golden

@@ -19,6 +19,10 @@ List the role bindings for user "u-123456" with role "CloudClusterAdmin":
 
   $ confluent iam rbac role-binding list --principal User:u-123456 --role CloudClusterAdmin --environment env-123456 --cloud-cluster lkc-123456
 
+List the role bindings for user "u-123456" with role "UsmClusterAdmin" for the USM Kafka cluster "usmkc-123456":
+
+  $ confluent iam rbac role-binding list --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456
+
 List the role bindings for user "u-123456" for all scopes:
 
   $ confluent iam rbac role-binding list --principal User:u-123456 --inclusive
@@ -38,6 +42,8 @@ Flags:
       --schema-registry-cluster string   Schema Registry cluster ID, which specifies the Schema Registry cluster scope.
       --ksql-cluster string              ksqlDB cluster name, which specifies the ksqlDB cluster scope.
       --flink-region string              Flink region for the role binding, formatted as "cloud.region".
+      --usm-kafka-cluster string         USM Kafka cluster ID, which specifies the USM Kafka cluster scope.
+      --usm-connect-cluster string       USM Connect cluster ID, which specifies the USM Connect cluster scope.
       --resource string                  Resource type and identifier using "Prefix:ID" format. If specified with "--role" and no principals, list all principals and role bindings.
       --inclusive                        List role bindings for specified scopes and nested scopes. Otherwise, list role bindings for the specified scopes. If scopes are unspecified, list only organization-scoped role bindings.
   -o, --output string                    Specify the output format as "human", "json", or "yaml". (default "human")

test/fixtures/output/iam/rbac/role-binding/list-help.golden

@@ -20,6 +20,10 @@ List the role bindings for user "u-123456" with role "CloudClusterAdmin":
 
   $ confluent iam rbac role-binding list --principal User:u-123456 --role CloudClusterAdmin --environment env-123456 --cloud-cluster lkc-123456
 
+List the role bindings for user "u-123456" with role "UsmClusterAdmin" for the USM Kafka cluster "usmkc-123456":
+
+  $ confluent iam rbac role-binding list --principal User:u-123456 --role UsmClusterAdmin --environment env-123456 --usm-kafka-cluster usmkc-123456
+
 List the role bindings for user "u-123456" for all scopes:
 
   $ confluent iam rbac role-binding list --principal User:u-123456 --inclusive
@@ -39,6 +43,8 @@ Flags:
       --schema-registry-cluster string   Schema Registry cluster ID, which specifies the Schema Registry cluster scope.
       --ksql-cluster string              ksqlDB cluster name, which specifies the ksqlDB cluster scope.
       --flink-region string              Flink region for the role binding, formatted as "cloud.region".
+      --usm-kafka-cluster string         USM Kafka cluster ID, which specifies the USM Kafka cluster scope.
+      --usm-connect-cluster string       USM Connect cluster ID, which specifies the USM Connect cluster scope.
       --resource string                  Resource type and identifier using "Prefix:ID" format. If specified with "--role" and no principals, list all principals and role bindings.
       --inclusive                        List role bindings for specified scopes and nested scopes. Otherwise, list role bindings for the specified scopes. If scopes are unspecified, list only organization-scoped role bindings.
   -o, --output string                    Specify the output format as "human", "json", or "yaml". (default "human")

test/fixtures/output/iam/rbac/role-binding/list-user-usm-connect-cloud.golden

@@ -0,0 +1,3 @@
+     ID    |  Principal   |        Email         |      Role       | Environment | Cloud Cluster | Cluster Type | Logical Cluster | Resource Type | Name | Pattern Type  
+-----------+--------------+----------------------+-----------------+-------------+---------------+--------------+-----------------+---------------+------+---------------
+  rb-99iii | User:u-11aaa | u-11aaa@confluent.io | UsmClusterAdmin | env-596     |               | USM Connect  | usmcc-123456    |               |      |               

test/fixtures/output/iam/rbac/role-binding/list-user-usm-kafka-cloud.golden

@@ -0,0 +1,3 @@
+     ID    |  Principal   |        Email         |      Role       | Environment | Cloud Cluster | Cluster Type | Logical Cluster | Resource Type | Name | Pattern Type  
+-----------+--------------+----------------------+-----------------+-------------+---------------+--------------+-----------------+---------------+------+---------------
+  rb-88hhh | User:u-11aaa | u-11aaa@confluent.io | UsmClusterAdmin | env-596     |               | USM Kafka    | usmkc-123456    |               |      |               

test/fixtures/output/iam/rbac/role-binding/list-usm-kafka-cluster-admin-cloud.golden

@@ -0,0 +1,3 @@
+   Principal   |  Name  |        Email          
+---------------+--------+-----------------------
+  User:u-11aaa | 11 Aaa | u-11aaa@confluent.io