redpanda

Manages the lifecycle of the Redpanda AI CLI plugin (rpk ai: install, upgrade, uninstall) and injects cloud auth (RPAI_TOKEN/RPAI_ENDPOINT) before delegating subcommands to the downloaded rpai binary. Also exposes Redpanda cluster operations to AI agents via the Model Context Protocol (rpk cloud mcp). Use when: installing, upgrading, or uninstalling the rpk ai plugin; delegating subcommands to the rpai binary with auto-injected cloud credentials; setting up the MCP server so an AI agent like Claude can drive Redpanda Cloud; wiring rpk cloud mcp stdio or rpk cloud mcp install into a Claude Desktop or Claude Code config; configuring the MCP proxy to a remote dataplane MCP server; understanding which Redpanda APIs are exposed as MCP tools (control-plane clusters, IAM, dataplane topics/ACLs/pipelines/transforms, AI Gateway); passing RPAI_TOKEN or RPAI_ENDPOINT env vars to the AI plugin; resolving cloud auth errors for the AI Gateway; or choosing between rpk ai and rpk cloud mcp. Also covers the AI Gateway enterprise governance and security surfaces (guardrails / word and content filters, rate limits, spend limits, routing rules, model providers, access-control/RBAC policies, roles and teams, audit logging, SSO/OIDC/OAuth2 identity providers, FIPS) and the dataplane AI resources (AI Agents, MCP servers and their auth variants, Knowledge Bases) with their nested config keys. Redpanda Cloud is a managed Redpanda Enterprise Edition deployment; the self-managed analogues (Audit Logging, RBAC, OIDC/OAuthBearer/Kerberos auth, FIPS, schema ID validation) require an Enterprise license.

Provision and manage Redpanda Cloud BYOC (Bring Your Own Cloud) clusters via the Control Plane API (https://api.redpanda.com) and the rpk cloud byoc agent plugin. Covers OAuth2 client-credentials auth, creating Network resources per cloud provider (AWS VPC/subnets/IAM, GCP network/project/bucket, Azure VNet/subnets/identities), creating TYPE_BYOC clusters (network_id, throughput_tier, cloud_provider_tags, customer_managed_resources), polling long-running Operations until READY, and running the Terraform-backed rpk cloud byoc apply/destroy/validate flow with --redpanda-id. Use when: creating BYOC clusters in AWS/GCP/Azure via the public API; provisioning or tearing down BYOC networks; wiring customer-managed IAM roles/buckets/subnets into a Redpanda cluster; running `rpk cloud byoc apply`; understanding BYOC vs Serverless; or scripting the full BYOC provisioning lifecycle end-to-end. Also covers enabling Redpanda Enterprise features on a BYOC cluster (the enterprise license is included with the Cloud subscription) via cluster_configuration.custom_properties and topic properties: Tiered Storage (redpanda.remote.*), Cloud Topics (redpanda.cloud_topic.enabled / redpanda.storage.mode), Iceberg Topics (iceberg_enabled, redpanda.iceberg.mode/delete/partition.spec/target.lag.ms/invalid.record.action), Continuous Data Balancing (partition_autobalancing_mode=continuous and disk/availability thresholds), Shadow Linking cross-cluster DR (rpk shadow create/status/failover --for-cloud), Remote Read Replicas, Audit Logging (audit_enabled and audit_* keys), RBAC/GBAC, OIDC/OAuthBearer/Kerberos auth, FIPS, Server-Side Schema ID Validation, and Leadership Pinning (default_leaders_preference / redpanda.leaders.preference).

Provision and manage Redpanda Cloud Dedicated clusters via the Control Plane API (https://api.redpanda.com). Covers OAuth2 client-credentials auth (Auth0, audience cloudv2-production.redpanda.cloud), creating a Network resource (cluster_type TYPE_DEDICATED, Redpanda-managed VPC, cidr_block), creating a TYPE_DEDICATED cluster (cloud_provider, region, zones, throughput_tier, connection_type, redpanda_version, tags), polling long-running Operations (STATE_IN_PROGRESS -> STATE_COMPLETED), and using the per-cluster Data Plane API URL returned by GetCluster for Topic/ACL/User/ Secret management. Use when: creating, listing, updating, or deleting Redpanda Cloud Dedicated clusters via the public API; choosing a region, zones, or throughput tier for a Dedicated cluster; configuring connectivity (CONNECTION_TYPE_PUBLIC, CONNECTION_TYPE_PRIVATE, or PrivateLink on AWS/GCP/ Azure); comparing Dedicated vs BYOC vs Serverless; scripting the full provisioning lifecycle end-to-end with curl; or using rpk cloud with a Dedicated cluster (rpk cloud login, rpk cloud cluster select). Also covers the Enterprise differentiators included on Dedicated and their nested config keys: Tiered Storage (redpanda.storage.mode, redpanda.remote.read/write/ recovery), Cloud Topics (cloud_topics_enabled), Iceberg Topics (redpanda.iceberg.mode/delete/partition.spec/target.lag.ms, iceberg_enabled), Continuous Data Balancing (partition_autobalancing_mode=continuous + disk/ availability thresholds), Shadow Linking cross-cluster DR (rpk shadow, ShadowLinkConfig, /v1/shadow-links, failover), Remote Read Replicas (redpanda.remote.readreplica), Mountable Topics, Leadership Pinning (redpanda.leaders.preference, default_leaders_preference), Server-side Schema ID Validation (enable_schema_id_validation), Audit Logging (audit_* keys), RBAC/GBAC, OIDC/OAuthBearer/Kerberos auth, and FIPS mode.

Provision and manage Redpanda Cloud Serverless clusters via the public Control Plane API (https://api.redpanda.com). Covers OAuth2 client-credentials authentication, ResourceGroup management, ServerlessRegion discovery, ServerlessCluster lifecycle (create/get/list/update/delete), the async Operation state machine (STATE_PLACING → STATE_CREATING → STATE_READY), and calling the per-cluster Data Plane API for topics, ACLs, users, secrets, and pipelines. Also covers the Enterprise differentiators configurable on Serverless via topic configs and roles: Iceberg Topics (redpanda.iceberg.mode/target.lag.ms/partition.spec/invalid.record.action/delete), Server-Side Schema ID Validation (redpanda.key|value.schema.id.validation, subject.name.strategy), Leadership Pinning (redpanda.leaders.preference), and Role-Based Access Control (/v1/roles) — all Enterprise-licensed (license included on Cloud). Use when: creating, listing, updating, or deleting Redpanda Cloud Serverless clusters via the public API; authenticating with OAuth client credentials for api.redpanda.com; choosing a serverless region; tracking a create/delete Operation until it completes; calling the data-plane URL returned by GetServerlessCluster to manage topics, ACLs, users, or secrets; enabling Iceberg Topics, schema ID validation, leader pinning, or RBAC on a Serverless cluster; or distinguishing Serverless from BYOC provisioning.

Guides setup and operation of the aws_dynamodb_cdc Redpanda Connect input for streaming change data capture from AWS DynamoDB into Redpanda or Kafka using DynamoDB Streams. Covers enabling DynamoDB Streams, IAM policy setup, checkpointing, snapshot modes, multi-table discovery, and the full pipeline YAML. Use when: capturing INSERT/MODIFY/REMOVE changes from DynamoDB into Redpanda or Kafka, configuring aws_dynamodb_cdc, enabling DynamoDB Streams, setting up the checkpoint table, using snapshot_and_cdc or snapshot_only, auto-discovering tables by tag, routing DynamoDB CDC events per table, troubleshooting DynamoDB stream retention or shard handling. Also covers the Redpanda Enterprise features the CDC destination topic and cluster can use: Iceberg Topics (redpanda.iceberg.mode/delete/partition.spec/target.lag.ms/ invalid.record.action), Tiered Storage (redpanda.remote.read/write) to outlive the 24h stream window, Remote Read Replicas, Shadow Linking (rpk shadow cross-cluster DR), server-side Schema ID Validation, RBAC, Audit Logging, and OIDC/Kerberos auth on the landed topic.