Skip to content

Add support for Global API Key in Cli #3253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Taohao Wang (taohaowang) wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Add support for Global API Key in Cli #3253

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5cfeea5
Add support for Global API Key in Cli
taohaowang Jan 29, 2026
b35f2e2
update test for global key
taohaowang Jan 29, 2026
4882a3d
Add integration test
taohaowang Feb 26, 2026
ae3b696
Merge remote-tracking branch 'origin/main' into identity-5922-global-…
taohaowang Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions internal/api-key/command.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ func New(prerunner pcmd.PreRunner) *cobra.Command {
func (c *command) addResourceFlag(cmd *cobra.Command, isStore bool) {
description := "The ID of the resource the API key is for."
if !isStore {
description += ` Use "cloud" for a Cloud API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.`
description += ` Use "cloud" for a Cloud API key, "global" for a Global API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.`
}

cmd.Flags().String("resource", "", description)
Expand Down Expand Up @@ -108,9 +108,9 @@ func (c *command) addResourceFlag(cmd *cobra.Command, isStore bool) {
i++
}

// TODO: update the suggestions when the suggestions[i] related with Tableflow is ready
if !isStore {
suggestions = append(suggestions, "cloud")
suggestions = append(suggestions, "global")
suggestions = append(suggestions, "flink")
suggestions = append(suggestions, "tableflow")
}
Expand Down Expand Up @@ -192,7 +192,7 @@ func (c *command) resolveResourceId(cmd *cobra.Command, v2Client *ccloudv2.Clien
var apiKey string

switch resourceType {
case presource.Cloud, presource.Flink, presource.Tableflow:
case presource.Cloud, presource.Flink, presource.Tableflow, presource.Global:
break
case presource.KafkaCluster:
cluster, err := kafka.FindCluster(c.V2Client, c.Context, resource)
Expand Down Expand Up @@ -232,6 +232,8 @@ func getResourceType(resource apikeysv2.ObjectReference) string {
switch resource.GetKind() {
case "Cloud":
return "cloud"
case "Global":
return "global"
case "Cluster":
if getResourceApi(resource) == "cmk" {
return "kafka"
Expand Down
6 changes: 6 additions & 0 deletions internal/api-key/command_create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,10 @@ func (c *command) newCreateCommand() *cobra.Command {
Text: "Create a Cloud API key:",
Code: "confluent api-key create --resource cloud",
},
examples.Example{
Copy link
Contributor

@channingdong Channing Dong (channingdong) Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we create the dedicated integration test in api_key_test.go to verify the global API key?

Something like:

{args: "api-key create --description human-output --resource global", fixture: "api-key/xxx.golden"},

Text: "Create a Global API key:",
Code: "confluent api-key create --resource global",
},
examples.Example{
Text: `Create a Flink API key for region "N. Virginia (us-east-1)":`,
Code: "confluent api-key create --resource flink --cloud aws --region us-east-1",
Expand Down Expand Up @@ -115,6 +119,8 @@ func (c *command) create(cmd *cobra.Command, _ []string) error {
switch resourceType {
case resource.Cloud:
key.Spec.Resource.Id = resource.Cloud
case resource.Global:
key.Spec.Resource.Id = resource.Global
case resource.Flink:
environmentId, err := c.Context.EnvironmentId()
if err != nil {
Expand Down
4 changes: 2 additions & 2 deletions internal/api-key/command_list.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,14 +44,14 @@
return cmd
}

func (c *command) list(cmd *cobra.Command, _ []string) error {

Check failure on line 47 in internal/api-key/command_list.go

View check run for this annotation

SonarQube-Confluent / SonarQube Code Analysis

Refactor this method to reduce its Cognitive Complexity from 26 to the 15 allowed. 

[S3776] Cognitive Complexity of functions should not be too high
 See more on https://sonarqube.confluent.io/project/issues?id=cli&pullRequest=3253&issues=24309024-f8c6-4015-b304-0f2f54ddb8c3&open=24309024-f8c6-4015-b304-0f2f54ddb8c3
c.setKeyStoreIfNil()

resourceType, clusterId, currentKey, err := c.resolveResourceId(cmd, c.V2Client)
if err != nil {
return err
}
if resourceType == presource.Cloud || resourceType == presource.Tableflow {
if resourceType == presource.Cloud || resourceType == presource.Tableflow || resourceType == presource.Global {
clusterId = resourceType
}

Expand Down Expand Up @@ -185,7 +185,7 @@
}

func getResourceId(id string) string {
if id == presource.Cloud || id == presource.Tableflow {
if id == presource.Cloud || id == presource.Tableflow || id == presource.Global {
return ""
}
return id
Expand Down
1 change: 1 addition & 0 deletions internal/api-key/command_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (

func TestGetResourceType(t *testing.T) {
require.Equal(t, "cloud", getResourceType(apikeysv2.ObjectReference{Kind: apikeysv2.PtrString("Cloud")}))
require.Equal(t, "global", getResourceType(apikeysv2.ObjectReference{Kind: apikeysv2.PtrString("Global")}))
require.Equal(t, "flink-region", getResourceType(apikeysv2.ObjectReference{ApiVersion: apikeysv2.PtrString("fcpm/v2"), Kind: apikeysv2.PtrString("Region")}))
require.Equal(t, "kafka", getResourceType(apikeysv2.ObjectReference{ApiVersion: apikeysv2.PtrString("cmk/v2"), Kind: apikeysv2.PtrString("Cluster")}))
require.Equal(t, "ksql", getResourceType(apikeysv2.ObjectReference{Kind: apikeysv2.PtrString("ksqlDB")}))
Expand Down
2 changes: 2 additions & 0 deletions internal/local/dir/etc/confluent-control-center/control-center-local.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
confluent.controlcenter.alertmanager.config.file=abc
confluent.controlcenter.prometheus.rules.file=def
3 changes: 2 additions & 1 deletion pkg/resource/resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ const (
FlinkStatement = "Flink SQL statement"
FlinkConnection = "Flink connection"
Gateway = "gateway"
Global = "global"
IdentityPool = "identity pool"
IdentityProvider = "identity provider"
IpGroup = "IP group"
Expand Down Expand Up @@ -144,7 +145,7 @@ var resourceToPrefix = map[string]string{
}

func LookupType(id string) string {
if id == Cloud || id == Flink || id == Tableflow {
if id == Cloud || id == Flink || id == Tableflow || id == Global {
return id
}

Expand Down
5 changes: 3 additions & 2 deletions test/api_key_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,7 @@ func (s *CLITestSuite) TestApiKeyCreate() {
tests := []CLITest{
{args: "api-key create --resource flink --cloud aws --region us-east-1", fixture: "api-key/create-flink.golden"},
{args: "api-key create --resource lkc-ab123 --service-account sa-123456", fixture: "api-key/55.golden", exitCode: 1},
{args: "api-key create --description human-output --resource global", fixture: "api-key/create-global.golden"},
}

for _, test := range tests {
Expand All @@ -186,8 +187,8 @@ func (s *CLITestSuite) TestApiKeyDescribe() {
func (s *CLITestSuite) TestApiKeyDelete() {
tests := []CLITest{
// delete multiple API keys
{args: "api-key delete MYKEY7 MYKEY8 MYKEY19", fixture: "api-key/delete/multiple-fail.golden", exitCode: 1},
{args: "api-key delete MYKEY6 MYKEY18 MYKEY19", fixture: "api-key/delete/multiple-fail-plural.golden", exitCode: 1},
{args: "api-key delete MYKEY7 MYKEY8 MYKEY20", fixture: "api-key/delete/multiple-fail.golden", exitCode: 1},
{args: "api-key delete MYKEY6 MYKEY18 MYKEY20", fixture: "api-key/delete/multiple-fail-plural.golden", exitCode: 1},
{args: "api-key delete MYKEY7 MYKEY8", input: "n\n", fixture: "api-key/delete/multiple-refuse.golden"},
{args: "api-key delete MYKEY7 MYKEY8", input: "y\n", fixture: "api-key/delete/multiple-success.golden"},
}
Expand Down
6 changes: 5 additions & 1 deletion test/fixtures/output/api-key/54.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ Create a Cloud API key:

$ confluent api-key create --resource cloud

Create a Global API key:

$ confluent api-key create --resource global

Create a Flink API key for region "N. Virginia (us-east-1)":

$ confluent api-key create --resource flink --cloud aws --region us-east-1
Expand All @@ -32,7 +36,7 @@ Create a Tableflow API key:
$ confluent api-key create --resource tableflow

Flags:
--resource string REQUIRED: The ID of the resource the API key is for. Use "cloud" for a Cloud API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.
--resource string REQUIRED: The ID of the resource the API key is for. Use "cloud" for a Cloud API key, "global" for a Global API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.
--description string Description of API key.
--cloud string Specify the cloud provider as "aws", "azure", or "gcp".
--region string Cloud region for Flink (use "confluent flink region list" to see all).
Expand Down
6 changes: 6 additions & 0 deletions test/fixtures/output/api-key/create-global.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
It may take a couple of minutes for the API key to be ready.
Save the API key and secret. The secret is not retrievable later.
+------------+------------+
| API Key | MYKEY19 |
| API Secret | MYSECRET19 |
+------------+------------+
6 changes: 5 additions & 1 deletion test/fixtures/output/api-key/create-help.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@ Create a Cloud API key:

$ confluent api-key create --resource cloud

Create a Global API key:

$ confluent api-key create --resource global

Create a Flink API key for region "N. Virginia (us-east-1)":

$ confluent api-key create --resource flink --cloud aws --region us-east-1
Expand All @@ -33,7 +37,7 @@ Create a Tableflow API key:
$ confluent api-key create --resource tableflow

Flags:
--resource string REQUIRED: The ID of the resource the API key is for. Use "cloud" for a Cloud API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.
--resource string REQUIRED: The ID of the resource the API key is for. Use "cloud" for a Cloud API key, "global" for a Global API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.
--description string Description of API key.
--cloud string Specify the cloud provider as "aws", "azure", or "gcp".
--region string Cloud region for Flink (use "confluent flink region list" to see all).
Expand Down
1 change: 1 addition & 0 deletions test/fixtures/output/api-key/create-resource-autocomplete.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ lsrc-1234 account schema-registry
lksqlc-ksql5 account ksql
lksqlc-woooo kay cee queue elle
cloud
global
flink
tableflow
:4
Expand Down
2 changes: 1 addition & 1 deletion test/fixtures/output/api-key/delete/multiple-fail-plural.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Error: API key "MYKEY19" not found
Error: API key "MYKEY20" not found

Suggestions:
List available API keys with `confluent api-key list`.
2 changes: 1 addition & 1 deletion test/fixtures/output/api-key/delete/multiple-fail.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
Error: API key "MYKEY19" not found
Error: API key "MYKEY20" not found

Suggestions:
List available API keys with `confluent api-key list`.
1 change: 1 addition & 0 deletions test/fixtures/output/api-key/describe-autocomplete.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ MYKEY15 yaml-output
MYKEY16 my-cool-app
MYKEY17
MYKEY18
MYKEY19 human-output
MYKEY2
MYKEY3
MYKEY4 my-cool-app
Expand Down
2 changes: 1 addition & 1 deletion test/fixtures/output/api-key/list-help.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ List the API keys that belong to service account "sa-123456" on cluster "lkc-123
$ confluent api-key list --resource lkc-123456 --service-account sa-123456

Flags:
--resource string The ID of the resource the API key is for. Use "cloud" for a Cloud API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.
--resource string The ID of the resource the API key is for. Use "cloud" for a Cloud API key, "global" for a Global API key, "flink" for a Flink API key, or "tableflow" for a Tableflow API key.
--current-user Show only API keys belonging to current user.
--environment string Environment ID.
--service-account string Service account ID.
Expand Down
3 changes: 3 additions & 0 deletions test/test-server/iam_handlers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,9 @@ func getKind(id string) string {
if id == "cloud" {
return "Cloud"
}
if id == "global" {
return "Global"
}
if id == "tableflow" {
return "Tableflow"
}
Expand Down