diff --git a/docker-compose.yml b/docker-compose.yml
index 889d674e5..f76c2b6a9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -49,7 +49,7 @@ services:
       - ./scripts/security:/etc/kafka/secrets
 
   tools:
-    image: cnfldemos/tools:0.2
+    image: cnfldemos/tools:0.3
     hostname: tools
     container_name: tools
     depends_on:
diff --git a/docs/hybrid-cloud.rst b/docs/hybrid-cloud.rst
index fd68da737..10a1bcdd9 100644
--- a/docs/hybrid-cloud.rst
+++ b/docs/hybrid-cloud.rst
@@ -40,13 +40,13 @@ Setup |ccloud| and CLI
 
 #. Setup a payment method for your |ccloud| account and optionally enter the promo code ``CPDEMO50`` in the |ccloud| UI `Billing and payment` section to receive an additional $50 free usage.
 
-#. Install `Confluent Cloud CLI <https://docs.confluent.io/ccloud-cli/current/install.html>`__ v1.25.0 or later.
+#. Install `Confluent CLI <https://docs.confluent.io/confluent-cli/current/install.html>`__ v2.2.0 or later. Do not confuse this Confluent CLI binary v2 that is used to manage |ccloud| with the Confluent CLI binary v1 that is used to manage |cp| |release|.  See `documentation <https://docs.confluent.io/confluent-cli/current/migrate.html>`__ for more information on the CLI migration and running the CLIs in parallel.
 
-#. Using the CLI, log in to |ccloud| with the command ``ccloud login``, and use your |ccloud| username and password. The ``--save`` argument saves your |ccloud| user login credentials or refresh token (in the case of SSO) to the local ``netrc`` file.
+#. Using the CLI, log in to |ccloud| with the command ``confluent login``, and use your |ccloud| username and password. The ``--save`` argument saves your |ccloud| user login credentials or refresh token (in the case of SSO) to the local ``netrc`` file.
 
    .. code:: shell
 
-      ccloud login --save
+      confluent login --save
 
 #. The remainder of the |ccloud| portion of this tutorial must be completed sequentially. We recommend that you manually complete all the steps in the following sections. However, you may also run the script :devx-cp-demo:`scripts/ccloud/create-ccloud-workflow.sh|scripts/ccloud/create-ccloud-workflow.sh` which automates those steps. This option is recommended for users who have run this tutorial before and want to quickly bring it up.
 
@@ -125,7 +125,7 @@ Enable :ref:`telemetry_reporter` on the on-prem cluster, and configure it to sen
 
    .. code:: shell
 
-      ccloud api-key create --resource cloud -o json
+      confluent api-key create --resource cloud -o json
 
 #. Verify your output resembles:
 
@@ -203,7 +203,7 @@ The Replicator instance is running on the existing Connect worker in the on-prem
 
    .. code-block:: text
 
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:connectorSubmitter \
           --role ResourceOwner \
           --resource Connector:replicate-topic-to-ccloud \
@@ -301,7 +301,7 @@ Metrics API
 
    .. code-block:: text
 
-      CCLOUD_CLUSTER_ID=$(ccloud kafka cluster list -o json | jq -c -r '.[] | select (.name == "'"demo-kafka-cluster-${SERVICE_ACCOUNT_ID}"'")' | jq -r .id)
+      CCLOUD_CLUSTER_ID=$(confluent kafka cluster list -o json | jq -c -r '.[] | select (.name == "'"demo-kafka-cluster-${SERVICE_ACCOUNT_ID}"'")' | jq -r .id)
 
 #. Substitute values into the query json file. For this substitution to work, you must have set the following parameters in your environment:
 
@@ -358,19 +358,19 @@ You must have completed :ref:`cp-demo-ccloud-stack` before proceeding.
 
    .. code-block:: text
 
-      ksqlDBAppId=$(ccloud ksql app list | grep "$KSQLDB_ENDPOINT" | awk '{print $1}')
+      ksqlDBAppId=$(confluent ksql app list | grep "$KSQLDB_ENDPOINT" | awk '{print $1}')
 
 #. Verify the |ccloud| ksqlDB application has transitioned from ``PROVISIONING`` to ``UP`` state. This may take a few minutes.
 
    .. code-block:: text
 
-      ccloud ksql app describe $ksqlDBAppId -o json
+      confluent ksql app describe $ksqlDBAppId -o json
 
 #. Configure ksqlDB ACLs to permit the ksqlDB application to read from ``wikipedia.parsed.ccloud.replica``.
 
    .. code-block:: text
 
-      ccloud ksql app configure-acls $ksqlDBAppId wikipedia.parsed.ccloud.replica
+      confluent ksql app configure-acls $ksqlDBAppId wikipedia.parsed.ccloud.replica
 
 #. Create new ksqlDB queries in |ccloud| from the :devx-cp-demo:`scripts/ccloud/statements.sql|scripts/ccloud/statements.sql` file. Note: depending on which folder you are in, you may need to modify the relative path to the ``statements.sql`` file.
 
diff --git a/docs/on-prem.rst b/docs/on-prem.rst
index e35f95a06..e2b376f2e 100644
--- a/docs/on-prem.rst
+++ b/docs/on-prem.rst
@@ -681,21 +681,21 @@ Authorization with RBAC
    .. code-block:: text
 
       # Create the role binding for the topic ``wikipedia.parsed``
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:badapp \
           --role ResourceOwner \
           --resource Topic:wikipedia.parsed \
           --kafka-cluster-id $KAFKA_CLUSTER_ID"
 
       # Create the role binding for the group ``wikipedia.test``
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:badapp \
           --role ResourceOwner \
           --resource Group:wikipedia.test \
           --kafka-cluster-id $KAFKA_CLUSTER_ID"
 
       # Create the role binding for the subject ``wikipedia.parsed-value``, i.e., the topic-value (versus the topic-key)
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:badapp \
           --role ResourceOwner \
           --resource Subject:wikipedia.parsed-value \
@@ -819,7 +819,7 @@ The security in place between |sr| and the end clients, e.g. ``appSA``, is as fo
    .. code-block:: text
 
       # Create the role binding for the subject ``users-value``, i.e., the topic-value (versus the topic-key)
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:appSA \
           --role ResourceOwner \
           --resource Subject:users-value \
@@ -981,7 +981,7 @@ For the next few steps, use the |crest| that is running as a standalone service.
    .. code-block:: text
 
       # Create the role binding for the topic ``users``
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:appSA \
           --role DeveloperWrite \
           --resource Topic:users \
@@ -1072,7 +1072,7 @@ For the next few steps, use the |crest| that is running as a standalone service.
    .. code-block:: text
 
       # Create the role binding for the group ``my_avro_consumer``
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:appSA \
           --role ResourceOwner \
           --resource Group:my_avro_consumer \
@@ -1118,7 +1118,7 @@ For the next few steps, use the |crest| that is running as a standalone service.
    .. code-block:: text
 
       # Create the role binding for the group my_avro_consumer
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:appSA \
           --role DeveloperRead \
           --resource Topic:users \
@@ -1182,7 +1182,7 @@ For the next few steps, use the |crest| that is embedded on the |ak| brokers. On
    .. code-block:: text
 
       # Create the role binding for the topic ``dev_users``
-      docker-compose exec tools bash -c "confluent iam rolebinding create \
+      docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
           --principal User:appSA \
           --role ResourceOwner \
           --resource Topic:dev_users \
diff --git a/docs/teardown.rst b/docs/teardown.rst
index 6b705da73..ad1e2d147 100644
--- a/docs/teardown.rst
+++ b/docs/teardown.rst
@@ -59,7 +59,7 @@ If you ran the :ref:`cp-demo-hybrid` portion of this tutorial, which included cr
 
    .. code-block:: text
 
-      ccloud api-key delete ${METRICS_API_KEY}
+      confluent api-key delete ${METRICS_API_KEY}
 
 #. Destroy your |ccloud| environment. Even if you stop ``cp-demo``, the resources in |ccloud| continue to incur charges until you destroy all the resources.
 
diff --git a/scripts/ccloud/create-ccloud-workflow.sh b/scripts/ccloud/create-ccloud-workflow.sh
index 69240d177..c47d8c594 100755
--- a/scripts/ccloud/create-ccloud-workflow.sh
+++ b/scripts/ccloud/create-ccloud-workflow.sh
@@ -6,15 +6,15 @@ source ${VALIDATE_DIR}/../helper/functions.sh
 source ${VALIDATE_DIR}/../../.env
 source ${VALIDATE_DIR}/../env.sh
 
-verify_installed ccloud || exit 1
+verify_installed confluent || exit 1
 
 curl -sS -o ccloud_library.sh https://raw.githubusercontent.com/confluentinc/examples/latest/utils/ccloud_library.sh
 source ./ccloud_library.sh
 ccloud::prompt_continue_ccloud_demo || exit 1
 
-# Log into Confluent Cloud CLI
+# Log into Confluent CLI
 echo
-ccloud login --save || exit 1
+confluent login --save || exit 1
 
 # Create a new ccloud-stack
 echo
@@ -24,9 +24,9 @@ echo
 
 export EXAMPLE="cp-demo"
 ccloud::create_ccloud_stack true || exit 1
-export SERVICE_ACCOUNT_ID=$(ccloud kafka cluster list -o json | jq -r '.[0].name' | awk -F'-' '{print $4;}')
+export SERVICE_ACCOUNT_ID=$(confluent kafka cluster list -o json | jq -r '.[0].name' | awk -F'-' '{print $4 "-" $5;}')
 CONFIG_FILE=stack-configs/java-service-account-$SERVICE_ACCOUNT_ID.config
-CCLOUD_CLUSTER_ID=$(ccloud kafka cluster list -o json | jq -c -r '.[] | select (.name == "'"demo-kafka-cluster-$SERVICE_ACCOUNT_ID"'")' | jq -r .id)
+CCLOUD_CLUSTER_ID=$(confluent kafka cluster list -o json | jq -c -r '.[] | select (.name == "'"demo-kafka-cluster-$SERVICE_ACCOUNT_ID"'")' | jq -r .id)
 
 # Create parameters customized for Confluent Cloud instance created above
 ccloud::generate_configs $CONFIG_FILE
@@ -41,7 +41,7 @@ CONNECTOR_SUBMITTER="User:connectorSubmitter"
 KAFKA_CLUSTER_ID=$(curl -s https://localhost:8091/v1/metadata/id --tlsv1.2 --cacert ${VALIDATE_DIR}/../security/snakeoil-ca-1.crt | jq -r ".id")
 CONNECT=connect-cluster
 ${VALIDATE_DIR}/../helper/refresh_mds_login.sh
-docker-compose exec tools bash -c "confluent iam rolebinding create \
+docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_SUBMITTER \
     --role ResourceOwner \
     --resource Connector:replicate-topic-to-ccloud \
@@ -59,7 +59,7 @@ echo "Replicator started!"
 
 # Create credentials for the cloud resource
 echo
-CREDENTIALS=$(ccloud api-key create --resource cloud -o json) || exit 1
+CREDENTIALS=$(confluent api-key create --resource cloud -o json) || exit 1
 export METRICS_API_KEY=$(echo "$CREDENTIALS" | jq -r .key)
 export METRICS_API_SECRET=$(echo "$CREDENTIALS" | jq -r .secret)
 
@@ -117,9 +117,9 @@ retry $MAX_WAIT ccloud::validate_ccloud_ksqldb_endpoint_ready $KSQLDB_ENDPOINT
 
 echo 
 echo "Writing ksqlDB queries in Confluent Cloud"
-ksqlDBAppId=$(ccloud ksql app list | grep "$KSQLDB_ENDPOINT" | awk '{print $1}')
-ccloud ksql app describe $ksqlDBAppId -o json
-ccloud ksql app configure-acls $ksqlDBAppId wikipedia.parsed.ccloud.replica
+ksqlDBAppId=$(confluent ksql app list | grep "$KSQLDB_ENDPOINT" | awk '{print $1}')
+confluent ksql app describe $ksqlDBAppId -o json
+confluent ksql app configure-acls $ksqlDBAppId wikipedia.parsed.ccloud.replica
 while read ksqlCmd; do
   echo -e "\n$ksqlCmd\n"
   curl -X POST $KSQLDB_ENDPOINT/ksql \
diff --git a/scripts/ccloud/destroy-ccloud-workflow.sh b/scripts/ccloud/destroy-ccloud-workflow.sh
index 7e30d6df0..6aa886a58 100755
--- a/scripts/ccloud/destroy-ccloud-workflow.sh
+++ b/scripts/ccloud/destroy-ccloud-workflow.sh
@@ -4,7 +4,7 @@ VALIDATE_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
 
 source ${VALIDATE_DIR}/../helper/functions.sh
 
-verify_installed ccloud || exit 1
+verify_installed confluent || exit 1
 
 if [ -z "$SERVICE_ACCOUNT_ID" ]; then
   echo "ERROR: Must export parameter SERVICE_ACCOUNT_ID before running this script to destroy Confluent Cloud resources associated to that service account."
@@ -18,9 +18,9 @@ fi
 curl -sS -o ccloud_library.sh https://raw.githubusercontent.com/confluentinc/examples/latest/utils/ccloud_library.sh
 source ./ccloud_library.sh
 
-# Log into Confluent Cloud CLI
+# Log into Confluent CLI
 echo
-ccloud login --save || exit 1
+confluent login --save || exit 1
 
 #### Teardown ####
 
@@ -48,7 +48,7 @@ docker-compose exec kafka1 kafka-configs \
   --delete-config confluent.telemetry.enabled,confluent.telemetry.api.key,confluent.telemetry.api.secret
 
 echo "Destroying all Confluent Cloud resources"
-ccloud api-key delete $METRICS_API_KEY
+confluent api-key delete $METRICS_API_KEY
 source "delta_configs/env.delta"
 ccloud::destroy_ccloud_stack $SERVICE_ACCOUNT_ID
 
diff --git a/scripts/helper/create-role-bindings.sh b/scripts/helper/create-role-bindings.sh
index d9ca31a9c..580237b52 100755
--- a/scripts/helper/create-role-bindings.sh
+++ b/scripts/helper/create-role-bindings.sh
@@ -36,24 +36,24 @@ mds_login $MDS_URL ${SUPER_USER} ${SUPER_USER_PASSWORD} || exit 1
 ################################### SUPERUSER ###################################
 echo "Creating role bindings for Super User"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $SUPER_USER_PRINCIPAL  \
     --role SystemAdmin \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $SUPER_USER_PRINCIPAL \
     --role SystemAdmin \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --schema-registry-cluster-id $SR
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $SUPER_USER_PRINCIPAL \
     --role SystemAdmin \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --connect-cluster-id $CONNECT
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $SUPER_USER_PRINCIPAL \
     --role SystemAdmin \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
@@ -63,7 +63,7 @@ confluent iam rolebinding create \
 echo "Creating role bindings for Schema Registry"
 
 # SecurityAdmin on SR cluster itself
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $SR_PRINCIPAL \
     --role SecurityAdmin \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
@@ -72,7 +72,7 @@ confluent iam rolebinding create \
 # ResourceOwner for groups and topics on broker
 for resource in Topic:_schemas Group:schema-registry
 do
-    confluent iam rolebinding create \
+    confluent-v1 iam rolebinding create \
         --principal $SR_PRINCIPAL \
         --role ResourceOwner \
         --resource $resource \
@@ -81,7 +81,7 @@ done
 
 for role in DeveloperRead DeveloperWrite
 do
-    confluent iam rolebinding create \
+    confluent-v1 iam rolebinding create \
         --principal $SR_PRINCIPAL \
         --role $role \
         --resource $LICENSE_RESOURCE \
@@ -92,7 +92,7 @@ done
 echo "Creating role bindings for Connect Admin"
 
 # SecurityAdmin on the connect cluster itself
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECT_ADMIN \
     --role SecurityAdmin \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
@@ -110,7 +110,7 @@ declare -a ConnectResources=(
 )
 for resource in ${ConnectResources[@]}
 do
-    confluent iam rolebinding create \
+    confluent-v1 iam rolebinding create \
         --principal $CONNECT_ADMIN \
         --role ResourceOwner \
         --resource $resource \
@@ -120,21 +120,21 @@ done
 ################################### Connectors ###################################
 echo "Creating role bindings for wikipedia-sse connector"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_SUBMITTER \
     --role ResourceOwner \
     --resource Connector:wikipedia-sse \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --connect-cluster-id $CONNECT
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:wikipedia \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role ResourceOwner \
     --resource Subject:wikipedia \
@@ -143,7 +143,7 @@ confluent iam rolebinding create \
     --schema-registry-cluster-id $SR
 
 # enable.idempotence=true requires IdempotentWrite
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role DeveloperWrite \
     --resource Cluster:kafka-cluster \
@@ -151,21 +151,21 @@ confluent iam rolebinding create \
 
 echo "Creating role bindings for replicate-topic connector"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_SUBMITTER \
     --role ResourceOwner \
     --resource Connector:replicate-topic \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --connect-cluster-id $CONNECT
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:_confluent \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role ResourceOwner \
     --resource Group:connect-replicator \
@@ -173,27 +173,27 @@ confluent iam rolebinding create \
 
 echo "Creating role bindings for elasticsearch-ksqldb connector"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_SUBMITTER \
     --role ResourceOwner \
     --resource Connector:elasticsearch-ksqldb \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --connect-cluster-id $CONNECT
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role ResourceOwner \
     --resource Group:connect-elasticsearch-ksqldb \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:WIKIPEDIA \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CONNECTOR_PRINCIPAL \
     --role ResourceOwner \
     --resource Subject:WIKIPEDIA \
@@ -204,28 +204,28 @@ confluent iam rolebinding create \
 ################################### ksqlDB Admin ###################################
 echo "Creating role bindings for ksqlDB Admin"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource KsqlCluster:$KSQLDB \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --ksql-cluster-id $KSQLDB
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role DeveloperRead \
     --resource Group:_confluent-ksql-${KSQLDB} \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Topic:_confluent-ksql-${KSQLDB} \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Subject:_confluent-ksql-${KSQLDB} \
@@ -233,38 +233,38 @@ confluent iam rolebinding create \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --schema-registry-cluster-id $SR
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Topic:_confluent-monitoring \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Topic:${KSQLDB}ksql_processing_log \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role DeveloperRead \
     --resource Topic:wikipedia.parsed \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Topic:WIKIPEDIA \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource TransactionalId:${KSQLDB} \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Subject:wikipedia \
@@ -272,7 +272,7 @@ confluent iam rolebinding create \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --schema-registry-cluster-id $SR
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Subject:WIKIPEDIA \
@@ -280,7 +280,7 @@ confluent iam rolebinding create \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --schema-registry-cluster-id $SR
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role ResourceOwner \
     --resource Subject:WIKIPEDIA \
@@ -289,7 +289,7 @@ confluent iam rolebinding create \
     --schema-registry-cluster-id $SR
 
 # enable.idempotence=true requires IdempotentWrite
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_ADMIN \
     --role DeveloperWrite \
     --resource Cluster:kafka-cluster \
@@ -298,28 +298,28 @@ confluent iam rolebinding create \
 ################################### ksqlDB User ###################################
 echo "Creating role bindings for ksqlDB User"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role DeveloperWrite \
     --resource KsqlCluster:$KSQLDB \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --ksql-cluster-id $KSQLDB
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role DeveloperRead \
     --resource Group:_confluent-ksql-${KSQLDB} \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role ResourceOwner \
     --resource Topic:_confluent-ksql-${KSQLDB} \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role ResourceOwner \
     --resource Subject:_confluent-ksql-${KSQLDB} \
@@ -327,19 +327,19 @@ confluent iam rolebinding create \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --schema-registry-cluster-id $SR
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role DeveloperRead \
     --resource Topic:${KSQLDB}ksql_processing_log \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role DeveloperRead \
     --resource Topic:wikipedia.parsed \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role ResourceOwner \
     --resource Subject:wikipedia \
@@ -347,14 +347,14 @@ confluent iam rolebinding create \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --schema-registry-cluster-id $SR
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role ResourceOwner \
     --resource Topic:WIKIPEDIA \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role ResourceOwner \
     --resource Subject:WIKIPEDIA \
@@ -363,7 +363,7 @@ confluent iam rolebinding create \
     --schema-registry-cluster-id $SR
 
 # enable.idempotence=true requires IdempotentWrite
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_USER \
     --role DeveloperWrite \
     --resource Cluster:kafka-cluster \
@@ -371,7 +371,7 @@ confluent iam rolebinding create \
 
 ################################### KSQLDB Server #############################
 echo "Creating role bindings for ksqlDB Server (used for ksqlDB Processing Log)"
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $KSQLDB_SERVER \
     --role ResourceOwner \
     --resource Topic:${KSQLDB}ksql_processing_log \
@@ -381,7 +381,7 @@ confluent iam rolebinding create \
 echo "Creating role bindings for Control Center"
 
 # C3 only needs SystemAdmin on the kafka cluster itself
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $C3_ADMIN \
     --role SystemAdmin \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
@@ -390,7 +390,7 @@ confluent iam rolebinding create \
 echo "Creating role bindings for Rest Proxy"
 for role in DeveloperRead DeveloperWrite
 do
-    confluent iam rolebinding create \
+    confluent-v1 iam rolebinding create \
         --principal $REST_ADMIN \
         --role $role \
         --resource $LICENSE_RESOURCE \
@@ -400,40 +400,40 @@ done
 ################################### Client ###################################
 echo "Creating role bindings for the streams-demo application"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Group:wikipedia \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Group:app \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:wikipedia \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:users \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:_confluent-monitoring \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Subject:wikipedia \
@@ -444,28 +444,28 @@ confluent iam rolebinding create \
 ################################### Listen Client ###################################
 echo "Creating role bindings for the listen client application"
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $LISTEN_PRINCIPAL \
     --role ResourceOwner \
     --resource Group:listen-consumer \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $LISTEN_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:wikipedia \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $LISTEN_PRINCIPAL \
     --role ResourceOwner \
     --resource Topic:WIKIPEDIA \
     --prefix \
     --kafka-cluster-id $KAFKA_CLUSTER_ID
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $LISTEN_PRINCIPAL \
     --role ResourceOwner \
     --resource Subject:wikipedia \
@@ -473,7 +473,7 @@ confluent iam rolebinding create \
     --kafka-cluster-id $KAFKA_CLUSTER_ID \
     --schema-registry-cluster-id $SR
 
-confluent iam rolebinding create \
+confluent-v1 iam rolebinding create \
     --principal $LISTEN_PRINCIPAL \
     --role ResourceOwner \
     --resource Subject:WIKIPEDIA \
diff --git a/scripts/helper/functions.sh b/scripts/helper/functions.sh
index 89134f4a7..0aef94a32 100755
--- a/scripts/helper/functions.sh
+++ b/scripts/helper/functions.sh
@@ -268,19 +268,19 @@ mds_login()
   OUTPUT=$(
   expect <<END
     log_user 1
-    spawn confluent login --ca-cert-path /etc/kafka/secrets/snakeoil-ca-1.crt --url $MDS_URL
+    spawn confluent-v1 login --ca-cert-path /etc/kafka/secrets/snakeoil-ca-1.crt --url $MDS_URL
     expect "Username: "
     send "${SUPER_USER}\r";
     expect "Password: "
     send "${SUPER_USER_PASSWORD}\r";
-    expect "Logged in as "
-    set result $expect_out(buffer)
+    expect EOF
+    catch wait result
+    exit [lindex \$result 3]
 END
   )
-  echo "$OUTPUT"
-  if [[ ! "$OUTPUT" =~ "Logged in as" ]]; then
-    echo "Failed to log into MDS.  Please check all parameters and run again"
-    exit 1
+  if [ $? -ne 0 ]; then
+    echo "Failed to log into MDS. Please check all parameters and run again."
+    exit
   fi
 }
 
diff --git a/scripts/validate/validate_bindings.sh b/scripts/validate/validate_bindings.sh
index 860a51a25..29abfa22a 100755
--- a/scripts/validate/validate_bindings.sh
+++ b/scripts/validate/validate_bindings.sh
@@ -40,7 +40,7 @@ for p in $SUPER_USER_PRINCIPAL $CONNECT_ADMIN $CONNECTOR_SUBMITTER $CONNECTOR_PR
   for c in " " " --schema-registry-cluster-id $SR" " --connect-cluster-id $CONNECT" " --ksql-cluster-id $KSQLDB"; do
     echo
     echo "Showing bindings for principal $p and --kafka-cluster-id $KAFKA_CLUSTER_ID $c"
-    docker-compose exec tools confluent iam rolebinding list --principal $p --kafka-cluster-id $KAFKA_CLUSTER_ID $c -o json
+    docker-compose exec tools confluent-v1 iam rolebinding list --principal $p --kafka-cluster-id $KAFKA_CLUSTER_ID $c -o json
     echo
   done
 done
diff --git a/scripts/validate/validate_rest_proxy.sh b/scripts/validate/validate_rest_proxy.sh
index 66ace1caf..914698324 100755
--- a/scripts/validate/validate_rest_proxy.sh
+++ b/scripts/validate/validate_rest_proxy.sh
@@ -35,7 +35,7 @@ topic="users"
 subject="$topic-value"
 group="my_avro_consumer"
 
-docker-compose exec tools bash -c "confluent iam rolebinding create \
+docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Subject:$subject \
@@ -50,7 +50,7 @@ schemaid=$(docker-compose exec schemaregistry curl -X GET --tlsv1.2 --cacert /et
 
 # Go through steps at https://docs.confluent.io/platform/current/tutorials/cp-demo/docs/index.html#crest-long?utm_source=github&utm_medium=demo&utm_campaign=ch.cp-demo_type.community_content.cp-demo#confluent-rest-proxy
 
-docker-compose exec tools bash -c "confluent iam rolebinding create \
+docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role DeveloperWrite \
     --resource Topic:$topic \
@@ -62,13 +62,13 @@ docker-compose exec restproxy curl -X POST -H "Content-Type: application/vnd.kaf
 
 docker-compose exec restproxy curl -X POST -H "Content-Type: application/vnd.kafka.v2+json" --cert /etc/kafka/secrets/restproxy.certificate.pem --key /etc/kafka/secrets/restproxy.key --tlsv1.2 --cacert /etc/kafka/secrets/snakeoil-ca-1.crt --data '{"topics":["users"]}' -u $CLIENT_NAME:$CLIENT_NAME https://restproxy:8086/consumers/$group/instances/my_consumer_instance/subscription
 
-docker-compose exec tools bash -c "confluent iam rolebinding create \
+docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role ResourceOwner \
     --resource Group:$group \
     --kafka-cluster-id $KAFKA_CLUSTER_ID"
 
-docker-compose exec tools bash -c "confluent iam rolebinding create \
+docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
     --principal $CLIENT_PRINCIPAL \
     --role DeveloperRead \
     --resource Topic:$topic \
@@ -90,7 +90,7 @@ docker-compose exec restproxy curl -X DELETE -H "Content-Type: application/vnd.k
 
 echo -e "\n\n\nValidating the embedded REST Proxy...\n"
 
-docker-compose exec tools bash -c "confluent iam rolebinding create \
+docker-compose exec tools bash -c "confluent-v1 iam rolebinding create \
     --principal User:appSA \
     --role ResourceOwner \
     --resource Topic:dev_users \
diff --git a/tools/Dockerfile-tools b/tools/Dockerfile-tools
index a55c065ab..2203d998b 100644
--- a/tools/Dockerfile-tools
+++ b/tools/Dockerfile-tools
@@ -14,6 +14,9 @@ RUN apt-get update \
         peco \
         vim \
         expect \
-    && curl --http1.1 -L https://cnfl.io/cli | sh -s -- -b /usr/bin v1.18.0 \
-    && curl --http1.1 -L https://cnfl.io/ccloud-cli | sh -s -- -b /usr/bin \
+    && mkdir ~/confluent-v1 \
+    && curl --http1.1 -L https://cnfl.io/cli | sh -s -- -b ~/confluent-v1 v1.43.1 \
+    && echo '#!/bin/bash\nHOME=~/confluent-v1 ~/confluent-v1/confluent "$@"' > /usr/bin/confluent-v1 \
+    && chmod +x /usr/bin/confluent-v1 \
+    && curl --http1.1 -L https://cnfl.io/cli | sh -s -- -b /usr/bin \
     && rm -rf /var/lib/apt/lists/*