Unable to delete ACLs for existing service account

[ppatierno]

I have a service account together with some ACLs related to it.

rhoas kafka acl list --service-account srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf

PRINCIPAL (9)                                    PERMISSION   OPERATION          DESCRIPTION              
------------------------------------------------ ------------ ------------------ ------------------------- 
All Accounts                                     allow        describe           cluster is "*"           
All Accounts                                     allow        describe           group is "*"             
All Accounts                                     allow        describe           topic is "*"             
All Accounts                                     allow        describe-configs   topic is "*"             
srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf   allow        create             topic starts with "f1-"  
srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf   allow        describe           topic starts with "f1-"  
srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf   allow        write              topic starts with "f1-"  
srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf   allow        describe           transactional-id is "*"  
srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf   allow        write              transactional-id is "*"

I would like to delete all the ACLs related to that specific service account, so I tried the following:

rhoas kafka acl delete --operation all --permission any --topic f1- --prefix --service-account srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf

But the result is the following:

? All ACLs matching the criteria provided will be deleted from the Kafka instance "formula1-kafka". Are you sure you want to proceed? Yes


ℹ  No ACLs match the specified criteria

[ppatierno]

So it seems that the problem is with --operation all because if I run the same command by specifying the specific operation (i.e. create), the corresponding ACL is deleted.

[wtrocki]

Will discuss that with @MikeEdgar

[craicoverflow]

--operation all does not mean all operations - "all" is a specific operation type. You cannot currently delete all ACLs tied to an account.

[wtrocki]

Thank you @craicoverflow. I did talked with @ppatierno and we have 2 cases to cover here:

• Confusion what all means - We need to document that better.
• As user you would more likely want to delete all ACLS for service account/user but that is requiring users to list multiple ACLS etc. - I will see if we can build dedicated API for this.

[MikeEdgar]

Does the CLI support omitting the operation and permission from the command? I would expect the following command to delete any ACL matching the principal and topic filters given. The back-end defaults the other filters to "ANY".

rhoas kafka acl delete --topic f1- --prefix --service-account srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf

If you wanted to delete everything for the service account, omit the topic/prefix filters.

[wtrocki]

Yes. We can do all of that no problem.
Does backend support that right now (Delete without specifying operation,permission?)

Meaning can we have:

rhoas kafka acl delete --service-account srvc-acct-adg23480-dsdf-244a-gt65-d4vd65784dsf

That will do single request to backend to remove all ACLs for that service account.

[MikeEdgar]

Yes, that will currently work. In fact, none of them are required so it's possible (but a bad idea) to delete them all with one request and no filters.

[wtrocki]

@ppatierno Fix have been published. Will be released soon. Thank you for feedback