Download the latest binary from GitHub on Windows, Linux or MacOS.In the Assets list, download the build that corresponds to your machine (for Apple Silicon use darwin-arm64).
There are two types of API keys: admin and Self-service application.
Admin API key
Self-service Application API key
Admin API keys grant the maximum permissions in Console.
CLI
UI
Generate an admin key named 'my-admin-key'
Copy
Ask AI
conduktor token create admin my-admin-key
Go to Settings > API Keys and select New API Key:
Self-service Application API key permissions are limited to the scope of the ApplicationInstance for which they have been generated. Find out more about Self-service.
CLI
UI
Generate an application API key named 'my-admin-key' for the application 'my-app-instance'
You can simply set the username and password of the local or LDAP user and use the CLI, or create an associated short-lived API key. This type of API key will have the permissions of the user who created it.This kind of authentication will be valid for the same duration as the configured session timeout.
Authenticate to Console using external authentication
By default, the Conduktor CLI authenticates with Console using a Console API key, or generates one based on the given credentials. This is the console authentication mode (CDK_AUTH_MODE is console or empty).Alternatively, you can use the external authentication mode to bypass token generation and use credentials from your identity provider or the API proxy instead. For that, set the CDK_AUTH_MODE environment variable to external:
Set up external authentication with a bearer token
The CLI offers a set of commands to manage Conduktor resources. You can use it to create, update, delete and get resources.
Copy
Ask AI
Usage: conduktor [flags] conduktor [command]Available commands: apply Upsert a resource on Conduktor completion Generate the autocompletion script for the specified shell delete Delete resource of a given kind and name get Get resource of a given kind help Help about any command login Login user using username password to get a JWT token run run an action sql template Get a .yaml example for a given kind token Manage Admin and Application Instance tokens version Display the version of ConduktorFlags: -h, --help help for Conduktor --permissive permissive mode, allow undefined environment variables -v, --verbose show more information for debuggingUse "conduktor [command] --help" for more information about a command.
The apply command allows you to deploy any resource.
Copy
Ask AI
Usage: conduktor apply [flags]Flags: --dry-run Test potential changes without the effects being applied -f, --file stringArray Specify the files or folders to apply. For folders, all .yaml or .yml files within the folder will be applied, while files in subfolders will be ignored. -h, --help help for apply --parallelism int Run each apply in parallel, useful when applying a large number of resources. Must be less than 100. (default 1) -r, --recursive Apply all .yaml or .yml files in the specified folder and its subfolders. If not set, only files in the specified folder will be applied.Global Flags: --permissive Permissive mode, allow undefined environment variables -v, --verbose Show more information for debugging
The --parallelism flag allows you to run multiple applies at the same time, in parallel. This is useful when applying a large number of resources. Be careful not to set it too high, as it may overload the Console/Gateway API.
Examples:
Apply all resources in multiple directories
Copy
Ask AI
conduktor apply -f ./directory1 -f ./directory2
Apply a specific file
Copy
Ask AI
conduktor apply -f file.yaml
Apply all resources in the current directory and its subfolders
The get command allows you to retrieve resources. You can specify a kind, a name, or list all the resources.
Copy
Ask AI
conduktor get user --helpIf name not provided it will list all resourceUsage: conduktor get User [name] [flags]Aliases: User, userFlags: -h, --help help for UserGlobal Flags: -o, --output output Output format. One of: json|yaml|name (default yaml) --permissive Permissive mode, allow undefined environment variables -v, --verbose Show more information for debugging
Examples:
Get all users
Copy
Ask AI
conduktor get user
Get a specific Kafka connect cluster
Copy
Ask AI
conduktor get KafkaConnectCluster --cluster my-kafka-cluster
Get all the Console resources with a 'name' output format
Usage: conduktor run [flags] conduktor run [command]Available Commands: generateServiceAccountToken Generate a token for a service account on a virtual cluster partnerZoneGenerateCredentials generate a token for a partner zone service account whoami Return information about the credentials configured in the CLIFlags: -h, --help help for runGlobal Flags: --permissive Permissive mode, allow undefined environment variables -v, --verbose Show more information for debugging
Examples:
Generate a service account password for a virtual cluster
Copy
Ask AI
conduktor run generateServiceAccountToken --v-cluster my-vcluster --username my-service-account
Generate a Partner Zone service account password
Copy
Ask AI
conduktor run partnerZoneGenerateCredentials --partner-zone-name my-partner-zone
Get information about the credentials configured in the CLI
Conduktor CLI can be easily integrated to a CI/CD pipeline. This example presents two pipelines:
The first one triggers on each new PR and launches the CLI using the --dry-run flag, generating a report confirming that the resources can be successfully created or modified.
The second one triggers on a push to the main branch, making the changes live.
Consider the following folder structure:
Copy
Ask AI
├── resources/ ├── topics.yml # Your topics are there ├── permissions.yml # Your permissions to other apps are there
The Conduktor CLI automatically substitutes environment variables in YAML manifests using ${ENV_VAR} patterns. This keeps sensitive data like credentials out of configuration files.You can set a default value using POSIX notation ${ENV:-default}.By default, the CLI fails if an environment variable is undefined or empty, ensuring all required variables are properly configured.
Use the --permissive flag to replace missing or empty variables with empty strings instead of failing.
When you use environment variables in Gateway Interceptor configurations, you have to escape dollar signs with double dollar signs $$ for secured templates.This applies to:
Encryption keys
Passwords
API tokens
Any secret values in Interceptor config blocks
Example:
Copy
Ask AI
apiVersion: gateway/v2kind: Interceptormetadata: name: my-encryption-interceptorspec: pluginClass: io.conduktor.gateway.interceptor.EncryptPlugin config: # Use $$ to escape environment variables in Interceptor configs encryptionKey: $${ENCRYPTION_KEY} apiToken: $${API_TOKEN}
Without the $$ escape sequence, the CLI will not correctly substitute the environment variable in the Interceptor configuration.