[APIE-693] Add support for pool scoped role bindings

[sgagniere]

Release Notes

Breaking Changes

• PLACEHOLDER

New Features

• Add the --flink-region flag for confluent iam rbac role-binding [create | delete | list] to manage FlinkDeveloper bindings with compute pool resources

Bug Fixes

• PLACEHOLDER

Checklist

• I have successfully built and used a custom CLI binary, without linter issues from this PR.
• I have clearly specified in the What section below whether this PR applies to Confluent Cloud, Confluent Platform, or both.
• I have verified this PR in Confluent Cloud pre-prod or production environment, if applicable.
• I have verified this PR in Confluent Platform on-premises environment, if applicable.
• I have attached manual CLI verification results or screenshots in the Test & Review section below.
• I have added appropriate CLI integration or unit tests for any new or updated commands and functionality.
• I confirm that this PR introduces no breaking changes or backward compatibility issues.
• I have indicated the potential customer impact if something goes wrong in the Blast Radius section below.
• I have put checkmarks below confirming that the feature associated with this PR is enabled in:
  • Confluent Cloud prod
  • Confluent Cloud stag
  • Confluent Platform
  • Check this box if the feature is enabled for certain organizations only

What

Add Cloud support for binding the FlinkDeveloper role to compute pools. The CRN pattern for this binding requires the Flink region, so this PR adds a new --flink-region flag taking arguments of the form cloud.region (e.g. aws.us-east-1) so that the CLI is able to include this in the CRN.

Blast Radius

This is an additive change so the blast radius is minimal.

References

Test & Review

https://docs.google.com/document/d/1G3BfuxE8fj11VfpIMC7U5ZR_UvllEYuNK6poMzPQdgc/edit?usp=sharing

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[sonarqube-confluent]

Quality Gate passed

Issues
2 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
90.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[Copilot]

Pull request overview

This PR adds support for managing FlinkDeveloper role bindings scoped to Flink compute pools by introducing a new --flink-region flag. The flag accepts values in the format cloud.region (e.g., aws.us-east-1) and incorporates this into the CRN pattern for pool-scoped role bindings.

Key Changes:

• Added --flink-region flag to iam rbac role-binding commands (create, delete, list)
• Updated CRN pattern parsing logic to include flink-region when specified
• Added test coverage for the new FlinkDeveloper compute pool binding functionality

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
internal/iam/command_rbac_role_binding.go	Added flink-region flag and CRN pattern parsing logic
internal/iam/command_rbac_role_binding_create.go	Added example usage for FlinkDeveloper with compute pool
internal/iam/command_rbac_role_binding_list.go	Added flink-region flag to list command
test/test-server/iam_handlers.go	Added test data for FlinkDeveloper compute pool binding
test/iam_test.go	Added integration tests for create and list operations
test/fixtures/output/iam/rbac/role-binding/*.golden	Updated help text and added expected outputs for new functionality

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.