diff --git a/.gitignore b/.gitignore
index 5811be0..5855691 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,4 +10,5 @@ cover.out
 
 # ignore IDE folders
 .vscode/
-.idea/
\ No newline at end of file
+.idea/
+kubeconfig
diff --git a/Makefile b/Makefile
index b9afdb2..76f198f 100644
--- a/Makefile
+++ b/Makefile
@@ -183,13 +183,28 @@ CROSSPLANE_NAMESPACE = upbound-system
 # - UPTEST_DATASOURCE_PATH (optional), see https://github.com/upbound/uptest#injecting-dynamic-values-and-datasource
 uptest: $(UPTEST) $(KUBECTL) $(KUTTL)
 	@$(INFO) running automated tests
-	@KUBECTL=$(KUBECTL) KUTTL=$(KUTTL) $(UPTEST) e2e "${UPTEST_EXAMPLE_LIST}" --data-source="${UPTEST_DATASOURCE_PATH}" --setup-script=cluster/test/setup.sh --default-conditions="Test" || $(FAIL)
+	@if [[ -n "$${UPTEST_CONFLUENT_KAFKA_CLUSTER_ID:-}" && -n "$${UPTEST_CONFLUENT_PRINCIPAL:-}" ]]; then \
+		{ \
+			echo "confluent_kafka_cluster_id: $${UPTEST_CONFLUENT_KAFKA_CLUSTER_ID}"; \
+			echo "confluent_principal: $${UPTEST_CONFLUENT_PRINCIPAL}"; \
+		} > "$(OUTPUT_DIR)/datasource.yaml"; \
+		if [[ -n "$${UPTEST_DATASOURCE_PATH:-}" ]]; then \
+			echo "" >> "$(OUTPUT_DIR)/datasource.yaml"; \
+			cat "$${UPTEST_DATASOURCE_PATH}" >> "$(OUTPUT_DIR)/datasource.yaml"; \
+		fi; \
+		export UPTEST_DATASOURCE_PATH="$(OUTPUT_DIR)/datasource.yaml"; \
+	fi; \
+	KUBECTL=$(KUBECTL) KUTTL=$(KUTTL) CROSSPLANE_NAMESPACE=$(CROSSPLANE_NAMESPACE) \
+		$(UPTEST) e2e "$${UPTEST_EXAMPLE_LIST}" \
+			--data-source="$${UPTEST_DATASOURCE_PATH}" \
+			--setup-script=cluster/test/setup.sh \
+			--default-conditions="Test" || $(FAIL)
 	@$(OK) running automated tests
 
 local-deploy: build controlplane.up local.xpkg.deploy.provider.$(PROJECT_NAME)
 	@$(INFO) running locally built provider
 	@$(KUBECTL) wait provider.pkg $(PROJECT_NAME) --for condition=Healthy --timeout 5m
-	@$(KUBECTL) -n upbound-system wait --for=condition=Available deployment --all --timeout=5m
+	@$(KUBECTL) -n $(CROSSPLANE_NAMESPACE) wait --for=condition=Available deployment --all --timeout=5m
 	@$(OK) running locally built provider
 
 e2e: local-deploy uptest
diff --git a/cluster/test/setup.sh b/cluster/test/setup.sh
index 7e9b8ef..3e0e72e 100755
--- a/cluster/test/setup.sh
+++ b/cluster/test/setup.sh
@@ -13,7 +13,7 @@ ${KUBECTL} -n upbound-system wait --for=condition=Available deployment --all --t
 
 echo "Creating a default provider config..."
 cat <<EOF | ${KUBECTL} apply -f -
-apiVersion: confluent.upbound.io/v1beta1
+apiVersion: confluent.crossplane.io/v1beta1
 kind: ProviderConfig
 metadata:
   name: default
@@ -24,3 +24,4 @@ spec:
       name: provider-secret
       namespace: upbound-system
       key: credentials
+EOF
diff --git a/examples/kafkaacl/kafkaacl.yaml b/examples/kafkaacl/kafkaacl.yaml
new file mode 100644
index 0000000..e60c604
--- /dev/null
+++ b/examples/kafkaacl/kafkaacl.yaml
@@ -0,0 +1,18 @@
+apiVersion: confluent.crossplane.io/v1alpha1
+kind: KafkaACL
+metadata:
+  name: kafka-acl-confluent-cloud
+spec:
+  deletionPolicy: Delete
+  forProvider:
+    host: '*'
+    kafkaCluster:
+      - id: ${data.confluent_kafka_cluster_id}
+    operation: READ
+    patternType: PREFIXED
+    permission: ALLOW
+    principal: ${data.confluent_principal}
+    resourceName: test-
+    resourceType: TOPIC
+  providerConfigRef:
+    name: default
diff --git a/examples/providerconfig/providerconfig.yaml b/examples/providerconfig/providerconfig.yaml
index 687eb44..a03c603 100644
--- a/examples/providerconfig/providerconfig.yaml
+++ b/examples/providerconfig/providerconfig.yaml
@@ -21,5 +21,8 @@ stringData:
   credentials: |
     {
       "cloud_api_key": "<confluent_api_key_id>",
-      "cloud_api_secret": "<confluent_api_key_secret>
+      "cloud_api_secret": "<confluent_api_key_secret>",
+      "kafka_api_key": "<schema_registry_api_key>",
+      "kafka_api_secret": "<schema_registry_api_secret>",
+      "kafka_rest_endpoint": "<schema_registry_rest_endpoint>"
     }
diff --git a/examples/providerconfig/secret.yaml.tmpl b/examples/providerconfig/secret.yaml.tmpl
index 6dfa5c8..9c2d153 100644
--- a/examples/providerconfig/secret.yaml.tmpl
+++ b/examples/providerconfig/secret.yaml.tmpl
@@ -7,6 +7,9 @@ type: Opaque
 stringData:
   credentials: |
     {
-      "username": "admin",
-      "password": "t0ps3cr3t11"
+      "cloud_api_key": "admin",
+      "cloud_api_secret": "t0ps3cr3t11",
+      "kafka_api_key": "kafka_admin",
+      "kafka_api_secret": "P@55w0rd",
+      "kafka_rest_endpoint": "https://abc-12345z.region.provider.confluent.cloud:443"
     }
diff --git a/internal/clients/confluent.go b/internal/clients/confluent.go
index cd2609b..7ed160a 100644
--- a/internal/clients/confluent.go
+++ b/internal/clients/confluent.go
@@ -18,8 +18,11 @@ import (
 
 const (
 	// ProviderConfig secret keys
-	cloudAPIKey    = "cloud_api_key"
-	cloudAPISecret = "cloud_api_secret"
+	cloudAPIKey       = "cloud_api_key"
+	cloudAPISecret    = "cloud_api_secret"
+	kafkaAPIKey       = "kafka_api_key"
+	kafkaAPISecret    = "kafka_api_secret"
+	kafkaRESTEndpoint = "kafka_rest_endpoint"
 
 	// error messages
 	errNoProviderConfig     = "no providerConfigRef provided"
@@ -69,8 +72,11 @@ func TerraformSetupBuilder(version, providerSource, providerVersion string, sche
 
 		// Set credentials in Terraform provider configuration.
 		ps.Configuration = map[string]any{
-			cloudAPIKey:    creds[cloudAPIKey],
-			cloudAPISecret: creds[cloudAPISecret],
+			cloudAPIKey:       creds[cloudAPIKey],
+			cloudAPISecret:    creds[cloudAPISecret],
+			kafkaAPIKey:       creds[kafkaAPIKey],
+			kafkaAPISecret:    creds[kafkaAPISecret],
+			kafkaRESTEndpoint: creds[kafkaRESTEndpoint],
 		}
 		return ps, nil
 	}