[UX-838] Add rpk support for local gbac by graham-rp · Pull Request #29738 · redpanda-data/redpanda

graham-rp · 2026-02-27T20:57:15Z

Backports Required

Release Notes

Adds rpk security group subcommands

Features

Adds the following commands to rpk security group

rpk security group list
rpk security group describe <group>
rpk security group assign <group> --role <role>
rpk security group unassign <group> --role <role>

r-vasquez · 2026-02-27T23:04:28Z

+		Use:   "assign [GROUP] --role [ROLE]",
+		Short: "Assign an IDP group to a Redpanda role",
+		Long: `Assign an IDP group to a Redpanda role.
+


Why a new command group assign --role instead of using rpk security role assign --group <group>? Both commands (group assign and role assign) update role memberships.

Don't get me wrong, I like that it is all within the same command space, so it is self-contained and easily discoverable, but perhaps we should add the --group flag to role assign for those who are already accustomed to the role command space

good call - it's a little weird to have users and groups be assigned from different places

We can have both, so people don't have to run between commands and both call the same underlying method.

We do it with rpk cloud cluster select and rpk profile create --from-cloud, they are technically an alias, but they exist for discoverability

r-vasquez · 2026-02-27T23:09:01Z

+				out.Die("rpk security group is not yet available in Redpanda Cloud")
+			}
+
+			groupName := args[0]


Do we expect users to assign multiple roles to a single group? Or multiple groups with the same role?

This is to understand if the input role flag should accept a comma-separated list of roles, and we batch update the group OR allow multiple groups in the input and assign the same role to all of them.

I don't know if we have great research here, but I'd think one role to multiple groups (like principals) is probably the most likely case.

r-vasquez · 2026-02-27T23:12:07Z

+	cmd := &cobra.Command{
+		Use:     "describe [GROUP]",
+		Aliases: []string{"info"},
+		Short:   "Describe the roles assigned to an IDP group",


Doc question, in group assign we have

Short: "Assign an IDP group to a Redpanda role",

And here

roles assigned to an IDP group

Should we standardize and say that we assign roles to groups? Also, should we use 'Redpanda roles' in both places?

definitely with you on Redpanda roles, and I can make it uniform (groups assigned to a role?), but I think it's really a bidirectional thing, right?

edit: the more I try to think about wording, the more I'm convinced it's bidirectional. Do you have any ideas on the best way to get this across?

I would just say in the Short form: Describe the IDP Group.

In the long form, I would mention that we are describing the configuration between roles and IDP groups within Redpanda.

vbotbuildovich · 2026-03-09T20:14:25Z

CI test results

test results on build#81506

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason	test_history
CloudTopicsL0GCEpochLagTest	test_epoch_lag_and_catchup	{"cloud_storage_type": 1}	integration	https://buildkite.com/redpanda/redpanda/builds/81506#019cd407-264c-42a5-b3bd-475edc7d2424	FLAKY	19/21	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0094, p0=0.1727, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3917, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=CloudTopicsL0GCEpochLagTest&test_method=test_epoch_lag_and_catchup

test results on build#81626

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason	test_history
CloudTopicsL0GCNodeFailureTest	test_node_failure_mid_gc	{"cloud_storage_type": 2}	integration	https://buildkite.com/redpanda/redpanda/builds/81626#019cddc0-178a-4038-a310-8f1d55f7371c	FLAKY	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0389, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1123, p1=0.3038, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=CloudTopicsL0GCNodeFailureTest&test_method=test_node_failure_mid_gc
CloudTopicsL0GCNodeFailureTest	test_node_failure_mid_gc	{"cloud_storage_type": 1}	integration	https://buildkite.com/redpanda/redpanda/builds/81626#019cddbe-4f83-4115-a6ab-e4290843affa	FLAKY	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0389, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1123, p1=0.3038, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=CloudTopicsL0GCNodeFailureTest&test_method=test_node_failure_mid_gc
QuotaManagementUpgradeTest	test_upgrade	null	integration	https://buildkite.com/redpanda/redpanda/builds/81626#019cddc0-178a-45cc-8848-5b7a1650e412	FLAKY	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0385, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1112, p1=0.3075, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=QuotaManagementUpgradeTest&test_method=test_upgrade
VerifyConsumerOffsetsThruUpgrades	test_consumer_group_offsets	{"versions_to_upgrade": 1}	integration	https://buildkite.com/redpanda/redpanda/builds/81626#019cddc0-1787-4d57-ad8d-5e22477bcea9	FLAKY	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0058, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3487, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=VerifyConsumerOffsetsThruUpgrades&test_method=test_consumer_group_offsets
TxAtomicProduceConsumeTest	test_basic_tx_consumer_transform_produce	{"with_failures": true}	integration	https://buildkite.com/redpanda/redpanda/builds/81626#019cddbe-4f82-436a-a2d5-e3b25fe93ffc	FLAKY	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0052, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3487, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=TxAtomicProduceConsumeTest&test_method=test_basic_tx_consumer_transform_produce

Co-authored-by: Rogger Vasquez <59714880+r-vasquez@users.noreply.github.com>

* Add rpk security role un|assign --group ... * Reword descriptions a bit

dotnwat

Please try to keep the git commit history clean

https://github.com/redpanda-data/redpanda/blob/dev/CONTRIBUTING.md#commit-history

graham-rp · 2026-03-16T17:01:25Z

Please try to keep the git commit history clean

https://github.com/redpanda-data/redpanda/blob/dev/CONTRIBUTING.md#commit-history

ah! blanked on this one, sorry!

graham-rp self-assigned this Feb 27, 2026

graham-rp requested review from a team, kbatuigas and r-vasquez as code owners February 27, 2026 20:57

github-actions Bot added area/rpk area/build labels Feb 27, 2026

graham-rp mentioned this pull request Feb 27, 2026

[UX-838] Add SecurityService client fn redpanda-data/common-go#138

Merged

graham-rp marked this pull request as draft February 27, 2026 21:01

r-vasquez reviewed Feb 27, 2026

View reviewed changes

graham-rp force-pushed the UX-838/local-gbac branch 5 times, most recently from c5ad0fe to 96f244c Compare March 3, 2026 20:19

graham-rp requested a review from r-vasquez March 4, 2026 15:06

graham-rp force-pushed the UX-838/local-gbac branch from 1881887 to 8feaac6 Compare March 9, 2026 18:46

graham-rp marked this pull request as ready for review March 9, 2026 19:03

graham-rp force-pushed the UX-838/local-gbac branch from 8feaac6 to 9a00584 Compare March 11, 2026 16:19

r-vasquez previously approved these changes Mar 11, 2026

View reviewed changes

graham-rp and others added 10 commits March 11, 2026 16:30

[UX-838] Add rpk support for local gbac

75f501f

bump common-go/rpadmin

d3c4820

use CheckExitCloudAdmin instead of manually exiting

fb9566a

move rpk security group assign|unassign -> rpk security role

1fc547a

remove IDP mentions

535cd97

Apply PR updates

6781c04

Co-authored-by: Rogger Vasquez <59714880+r-vasquez@users.noreply.github.com>

fmt, fix type on test, bump rpadmin

fabaa01

move test fn

25cc635

bump buf.gen.yaml version

52021ef

Address PR comments

742e012

* Add rpk security role un|assign --group ... * Reword descriptions a bit

bump buf version

3450320

graham-rp dismissed r-vasquez’s stale review via 3450320 March 11, 2026 20:38

graham-rp force-pushed the UX-838/local-gbac branch from 9a00584 to 3450320 Compare March 11, 2026 20:38

r-vasquez approved these changes Mar 11, 2026

View reviewed changes

graham-rp merged commit 33de8c0 into redpanda-data:dev Mar 12, 2026
24 of 28 checks passed

dotnwat reviewed Mar 16, 2026

View reviewed changes

Conversation

graham-rp commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Backports Required

Release Notes

Features

Uh oh!

Uh oh!

Uh oh!

r-vasquez Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

graham-rp Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

r-vasquez Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

r-vasquez Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

graham-rp Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

r-vasquez Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

graham-rp Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

r-vasquez Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vbotbuildovich commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI test results

Uh oh!

Uh oh!

dotnwat left a comment

Choose a reason for hiding this comment

Uh oh!

graham-rp commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

graham-rp commented Feb 27, 2026 •

edited

Loading

graham-rp Mar 3, 2026 •

edited

Loading

vbotbuildovich commented Mar 9, 2026 •

edited

Loading