From ffe578f29bf09c6c6a51c2e66f69c5cee8397222 Mon Sep 17 00:00:00 2001 From: JakeSCahill <45230295+JakeSCahill@users.noreply.github.com> Date: Mon, 3 Aug 2026 06:41:39 +0000 Subject: [PATCH] docs: update rpk CLI documentation for v26.2.1 --- docs-data/rpk-diff-v26.1.12_to_v26.2.1.json | 1111 + docs-data/rpk-overrides.json | 297 +- docs-data/rpk-v26.2.1.json | 23769 ++++++++++++++++ .../pages/release-notes/redpanda.adoc | 64 + .../rpk-connect/rpk-connect-agent-init.adoc | 9 + .../rpk-connect/rpk-connect-agent-run.adoc | 12 + .../rpk-connect/rpk-connect-blobl-server.adoc | 14 + .../rpk/rpk-connect/rpk-connect-blobl.adoc | 15 + .../rpk/rpk-connect/rpk-connect-create.adoc | 11 + .../rpk/rpk-connect/rpk-connect-dry-run.adoc | 12 + .../rpk/rpk-connect/rpk-connect-echo.adoc | 12 + .../rpk/rpk-connect/rpk-connect-lint.adoc | 15 + .../rpk/rpk-connect/rpk-connect-list.adoc | 11 + .../rpk-connect-mcp-server-lint.adoc | 14 + .../rpk-connect/rpk-connect-mcp-server.adoc | 16 + .../rpk-connect/rpk-connect-plugin-init.adoc | 10 + .../rpk/rpk-connect/rpk-connect-streams.adoc | 26 + .../rpk-connect-template-lint.adoc | 11 + .../rpk/rpk-connect/rpk-connect-test.adoc | 13 + .../pages/rpk/rpk-k8s/rpk-k8s-install.adoc | 4 +- .../rpk-k8s-multicluster-bootstrap.adoc | 63 +- .../rpk-k8s/rpk-k8s-multicluster-bundle.adoc | 44 +- .../rpk-k8s/rpk-k8s-multicluster-status.adoc | 32 +- .../rpk/rpk-k8s/rpk-k8s-multicluster.adoc | 26 +- .../pages/rpk/rpk-k8s/rpk-k8s-uninstall.adoc | 14 +- .../pages/rpk/rpk-k8s/rpk-k8s-upgrade.adoc | 4 +- .../pages/rpk/rpk-k8s/rpk-k8s-version.adoc | 10 +- .../reference/pages/rpk/rpk-k8s/rpk-k8s.adoc | 9 +- 28 files changed, 25511 insertions(+), 137 deletions(-) create mode 100644 docs-data/rpk-diff-v26.1.12_to_v26.2.1.json create mode 100644 docs-data/rpk-v26.2.1.json diff --git a/docs-data/rpk-diff-v26.1.12_to_v26.2.1.json b/docs-data/rpk-diff-v26.1.12_to_v26.2.1.json new file mode 100644 index 0000000000..4c2adafd49 --- /dev/null +++ b/docs-data/rpk-diff-v26.1.12_to_v26.2.1.json @@ -0,0 +1,1111 @@ +{ + "comparison": { + "oldVersion": "v26.1.12", + "newVersion": "v26.2.1", + "timestamp": "2026-08-03T06:41:37.763Z" + }, + "summary": { + "newCommands": 53, + "newlyDeprecatedCommands": 1, + "removedCommands": 21, + "newFlags": 23, + "removedFlags": 0, + "changedDefaults": 1, + "changedFlagTypes": 0, + "changedFlagRequirements": 0, + "changedFlagDescriptions": 1, + "descriptionChanges": 35, + "flagDataBackfilled": 50 + }, + "details": { + "newCommands": [ + { + "path": "rpk ai llm-provider", + "name": "llm-provider", + "description": "Manage LLM providers (create, get, list, update, delete)", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider apply", + "name": "apply", + "description": "Reconcile LLM providers from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider check", + "name": "check", + "description": "Runs a lightweight probe against the upstream to verify credentials and reachability.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider create", + "name": "create", + "description": "Create an LLM provider.\n\nChoose the provider-config by setting flags from one group; the group you use selects it: openai-config, anthropic-config, google-config, bedrock-config, openai-compatible-config.\nSetting flags from two groups is an error.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider delete", + "name": "delete", + "description": "Delete an LLM provider", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider diff", + "name": "diff", + "description": "Dry-run of apply for LLM providers. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider get", + "name": "get", + "description": "Get an LLM provider", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider list", + "name": "list", + "description": "List LLM providers", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm-provider update", + "name": "update", + "description": "Update an LLM provider", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server", + "name": "mcp-server", + "description": "Manage MCP servers (create, get, list, update, delete)", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server apply", + "name": "apply", + "description": "Reconcile MCP servers from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server create", + "name": "create", + "description": "Create an MCP server.\n\nChoose the backend by setting flags from one group; the group you use selects it: remote, managed.\nSetting flags from two groups is an error.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server delete", + "name": "delete", + "description": "Delete an MCP server", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server diff", + "name": "diff", + "description": "Dry-run of apply for MCP servers. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server get", + "name": "get", + "description": "Get an MCP server", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server list", + "name": "list", + "description": "List MCP servers", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server tools", + "name": "tools", + "description": "Interact with tools on an MCP server", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server tools call", + "name": "call", + "description": "Invoke a tool on an MCP server through the aigw MCP proxy.\n\nThe server's /mcp/v1/ endpoint is reached with the same bearer token\nused by the rest of rpai; aigw resolves user-delegated OAuth tokens from the\nvault when the MCP server is configured with --user-oauth-provider.\n\nArguments passed to the tool are a JSON object supplied via --args. Example:\n\n rpai mcp tools call gf-servicenow-sand2 listtablerecords \\\n --args '{\"tableName\":\"incident\",\"sysparm_limit\":3}'\n\nWith --code-mode the call targets the virtual code-mode sibling endpoint\n(/mcp/v1/-code). That endpoint exposes search (tool catalog for the\nprimary) and execute (runs JavaScript in a sandbox with call_tool bound to\nthe primary's tools). Example:\n\n rpai mcp tools call pg-garrett execute --code-mode \\\n --args '{\"code\":\"var r = call_tool({name:\\\"query\\\", arguments:{query:\\\"SELECT 1\\\"}}); JSON.stringify(r);\"}'\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server tools list", + "name": "list", + "description": "List tools on an MCP server by calling tools/list through the aigw MCP proxy.\n\nHits the server's /mcp/v1/ endpoint, so the same auth and token-vault\npath used by tools/call is exercised here. Useful for checking that a managed\nMCP's tool schema loaded correctly and that a user-delegated server is\nreachable with the caller's vault token.\n\nWith --code-mode the session targets the virtual code-mode sibling endpoint\n(/mcp/v1/-code), which exposes the sandbox meta-tools (search,\nexecute). To see the parent's tool catalog from the sandbox, invoke the\nsearch tool explicitly:\n\n rpai mcp tools call search --code-mode\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server types", + "name": "types", + "description": "List available managed MCP types", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp-server update", + "name": "update", + "description": "Update an MCP server", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai oauth-client update", + "name": "update", + "description": "Update an OAuth client", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy", + "name": "policy", + "description": "Manage Cedar authorization policies (create, get, list, update, delete)", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy apply", + "name": "apply", + "description": "Reconcile policies from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy create", + "name": "create", + "description": "Create a Cedar authorization policy: the allow/deny gate that\ndecides WHETHER a principal may call a tool.\n\nThe Cedar body must contain exactly one statement; scope the resource\nto your MCP server, e.g.:\n\n permit(principal, action == Action::\"dataplane_adp_mcpserver_tools_call\",\n resource == McpServer::\"servicenow\");\n\nData shaping (masking, dropping, row filtering) is NOT configured here.\nIt lives on the MCP server's data policies (rpai mcp ...), not in Cedar\ntext; the @redact_mask / @redact_drop annotations are gone.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy delete", + "name": "delete", + "description": "Delete a policy", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy diff", + "name": "diff", + "description": "Dry-run of apply for policies. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy get", + "name": "get", + "description": "Get a policy", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy list", + "name": "list", + "description": "List policies", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk ai policy update", + "name": "update", + "description": "Update a policy in place. Only the flags you pass are written; the\nfield mask is built from the flags actually set, so omitted fields are\nleft untouched.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk check", + "name": "check", + "description": "Run production readiness checks for a Redpanda deployment", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk check install", + "name": "install", + "description": "Install Redpanda Check\n\nThis command installs the latest version by default.\n\nAlternatively, you may specify a version using the --check-version flag.\n\nYou may force the installation using the --force flag.\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk check uninstall", + "name": "uninstall", + "description": "Uninstall the Redpanda Check plugin", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk check upgrade", + "name": "upgrade", + "description": "Upgrade to the latest Redpanda Check version", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster brokers", + "name": "brokers", + "description": "Manage Redpanda cluster brokers", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster brokers decommission", + "name": "decommission", + "description": "Decommission the given broker.\n\nDecommissioning a broker removes it from the cluster.\n\nA decommission request is sent to every broker in the cluster, only the cluster\nleader handles the request.\n\nFor safety on v22.x clusters, this command will not run if the requested\nbroker is in maintenance mode. As of v23.x, Redpanda supports\ndecommissioning a node that is currently in maintenance mode. If you are on\na v22.x cluster and need to bypass the maintenance mode check (perhaps your\ncluster is unreachable), use the --skip-liveness-check flag.\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster brokers decommission-status", + "name": "decommission-status", + "description": "Show the progress of a node decommissioning.\n\nWhen a node is being decommissioned, this command reports the decommissioning\nprogress as follows, where PARTITION-SIZE is in bytes. Using -H, it prints the\npartition size in a human-readable format.\n\n$ rpk cluster brokers decommission-status 4\nDECOMMISSION PROGRESS\n=====================\nPARTITION MOVING-TO COMPLETION-% PARTITION-SIZE\nkafka/test/0 3 9 1699470920\nkafka/test/4 3 0 1614258779\nkafka/test2/3 3 3 2722706514\nkafka/test2/4 3 4 2945518089\nkafka_internal/id_allocator/0 3 0 3562\n\nUsing --detailed / -d, it additionally prints granular reports.\n\n$ rpk cluster brokers decommission-status 4 -d\nDECOMMISSION PROGRESS\n=====================\nPARTITION MOVING-TO COMPLETION-% PARTITION-SIZE BYTES-MOVED BYTES-REMAINING\nkafka/test/0 3 13 1731773243 228114727 1503658516\nkafka/test/4 3 1 1645952961 18752660 1627200301\nkafka/test2/3 3 5 2752632301 140975805 2611656496\nkafka/test2/4 3 6 2975443783 181581219 2793862564\n\nIf a partition cannot be moved for some reason, the command reports the\nproblematic partition in the 'REALLOCATION FAILURE DETAILS' or 'ALLOCATION FAILURES'\nsection and decommission fails. Typical scenarios for failure include:\nthere are no brokers that have enough space to allocate a partition, or that can satisfy\nrack constraints, etc.\n\nREALLOCATION FAILURE DETAILS\n============================\nPARTITION REASON\nkafka/foo/1 Missing partition size information, all replicas may be offline\nkafka/foo/7 Missing partition size information, all replicas may be offline\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster brokers recommission", + "name": "recommission", + "description": "Recommission the given broker if it is still decommissioning.\n\nRecommissioning can stop an active decommission.\n\nOnce a broker is decommissioned, it cannot be recommissioned through this\ncommand.\n\nA recommission request is sent to every broker in the cluster, only\nthe cluster leader handles the request.\n\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster loggers", + "name": "loggers", + "description": "List and configure Redpanda broker loggers", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster loggers list", + "name": "list", + "description": "List loggers available on a Redpanda broker.\n\nLoggers are discovered by, in order:\n 1. Running the local redpanda binary with --help-loggers (Linux only).\n 2. Querying /v1/loggers on the Admin API.\n 3. Falling back to a hardcoded list compiled into rpk.\n\nWithout --node-id, the request is sent to any broker. Use --node-id to query\na specific broker.\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster loggers set", + "name": "set", + "description": "Set broker logger's log level.\n\nThis command temporarily changes a broker logger's log level. Each Redpanda\nbroker has many loggers, and each can be individually changed. Any change\nto a logger persists for a limited amount of time, so as to ensure you do\nnot accidentally enable debug logging permanently.\n\nIt is optional to specify a logger; if you do not, this command will prompt\nfrom the set of available loggers.\n\nThe special logger \"all\" enables all loggers. Alternatively, you can specify\nmany loggers at once.\n\nThis command accepts loggers that it does not know of to ensure you can\nindependently update your redpanda installations from rpk. The success or\nfailure of enabling each logger is individually printed.\n\nUse 'rpk cluster loggers list' to display available loggers.\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster upgrade", + "name": "upgrade", + "description": "Check and finalize major-version upgrades. When the cluster configuration\n'features_auto_finalization' is disabled, an upgrade stays pending after all\nbrokers are on the new version, so you can downgrade while soak-testing.\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster upgrade finalize", + "name": "finalize", + "description": "Finalize a deferred cluster upgrade.\n\nThis commits the cluster to the version all brokers report, activating\nversion-gated features and advancing the active cluster version. It is\nirreversible: the previous version is no longer available for downgrade.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk cluster upgrade status", + "name": "status", + "description": "Show the cluster upgrade finalization status.\n\nThis reports where the cluster sits in the upgrade-finalization lifecycle as\nseen by the controller leader: the high-level state (finalized, ready to\nfinalize, or upgrade in progress), the active and post-finalization logical\nversions, whether auto-finalization is enabled, and a per-broker breakdown of\nreported versions and liveness.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s", + "name": "k8s", + "description": "Interact with Redpanda clusters running on Kubernetes", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s install", + "name": "install", + "description": "Install the Redpanda Kubernetes plugin.\n\nThis command installs the latest version by default.\n\nAlternatively, you may specify a version using the --plugin-version flag.\n\nYou may force the installation using the --force flag.\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s multicluster", + "name": "multicluster", + "description": "Commands for bootstrapping and managing the multicluster operators that run\na Redpanda Stretch Cluster: a single logical Redpanda cluster distributed\nacross multiple Kubernetes clusters. One operator runs in each Kubernetes\ncluster, and the operators coordinate through Raft consensus to manage the\nStretch Cluster as a single unit.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s multicluster bootstrap", + "name": "bootstrap", + "description": "Bootstrap the TLS certificates and kubeconfig secrets that the multicluster\noperators of a Redpanda Stretch Cluster need to communicate across Kubernetes\nclusters.\n\nThis command connects to each specified Kubernetes context, generates a shared\nCA certificate, and distributes per-cluster TLS certificates and kubeconfig\nsecrets so that the multicluster operator can communicate across clusters.\n\nIf --kubeconfig is provided, all contexts in the file are used automatically\nand --context flags are not required. If both are provided, only the specified\ncontexts from the kubeconfig file are used.\n\n--loadbalancer provisions a standalone LoadBalancer Service on each cluster\nbefore signing certificates, waits for the cloud provider to assign an\nexternal address, and bakes that address into the cert SANs. This resolves\nthe deploy/redeploy cycle that otherwise forces a first helm install just\nto learn each cluster's external IP/hostname. The resulting peer list is\nprinted on success for pasting into helm values.\n\n--output=yaml skips applying anything and writes manifests as YAML. No\ncluster contact or kubeconfig is needed: cluster names are derived from\n--context flags (LB mode) or --dns-override keys (bootstrap mode).\n\nWhen --output-dir is set, one file per cluster is written into the\ndirectory as .yaml. This is required for the TLS bootstrap path\nbecause each cluster's tls.key is per-cluster identity material that\nmust not be applied to other clusters. The LoadBalancer-only step has\nno secrets and additionally allows streaming to stdout (split on '---'\nwith comment headers).\nUse this for GitOps pipelines that commit manifests and apply them via\nArgo, Flux, or similar.\n\nTwo-step GitOps workflow:\n\n 1. bootstrap --output=yaml --loadbalancer --context ...\n Emits only LoadBalancer Service manifests. Apply them, wait for the\n cloud provider to assign external addresses.\n\n 2. bootstrap --output=yaml --output-dir --dns-override ctx=
...\n Emits Namespace and TLS Secret manifests into /.yaml with\n the known addresses baked into the cert SANs.\n\nWhen --loadbalancer is NOT set, --dns-override is required for every\ncluster; cluster names are derived from the override keys.\nServiceAccount, SA token, and kubeconfig cache Secrets are not emitted\nbecause the operator regenerates them at runtime.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s multicluster bundle", + "name": "bundle", + "description": "Collects environment data from each Kubernetes cluster in a Redpanda Stretch\nCluster deployment and packages it into a ZIP file for support.\nThis is the operator-side counterpart to 'rpk debug bundle', which collects\ndata from the Redpanda brokers themselves.\n\nBy default, only one Kubernetes context is required. The bundle command\ndiscovers peer clusters from labelled cache Secrets stored by the operator's\nraft-bootstrap flow on the starting cluster, so the tool stays useful when\none of the peer clusters is down. Pass multiple --context flags to bypass\ndiscovery and diagnose exactly that set.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s multicluster status", + "name": "status", + "description": "Checks the health of the multicluster operators that run a Redpanda Stretch\nCluster: each cluster's operator pod health, raft consensus state, TLS\ncertificate validity, and cross-cluster consistency.\n\nConnects to each specified Kubernetes context, finds the multicluster operator\npod, port-forwards to its gRPC transport, and queries raft status. Also\ninspects Deployment configuration and TLS secrets for correctness.", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s uninstall", + "name": "uninstall", + "description": "Uninstall the Redpanda Kubernetes plugin.\n\nBy default this removes only the rpk-managed plugin binary\n(~/.local/bin/.rpk.managed-k8s). If the resolved plugin was not installed by\nrpk (a self-managed copy, e.g. one you downloaded or installed via a package\nmanager), rpk refuses to remove it unless you pass --force.\n\nIf the resolved plugin shadows other k8s plugin copies elsewhere on your PATH,\nthose are left in place unless you pass --include-shadowed.\n", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s upgrade", + "name": "upgrade", + "description": "Upgrade to the latest Redpanda Kubernetes plugin version", + "introducedInVersion": "v26.2.1" + }, + { + "path": "rpk k8s version", + "name": "version", + "description": "Print build information", + "introducedInVersion": "v26.2.1" + } + ], + "newlyDeprecatedCommands": [ + { + "path": "rpk redpanda admin", + "message": "use `rpk cluster` subcommands; see `rpk cluster brokers`, `rpk cluster info --detailed`, `rpk cluster config list --node-id`, and `rpk cluster loggers`", + "replacement": "Use xref:reference:rpk/rpk-cluster/rpk-cluster.adoc[`rpk cluster`] instead.", + "hidden": true, + "deprecatedInVersion": "v26.2.1", + "affectedSubcommands": [ + "rpk redpanda admin brokers", + "rpk redpanda admin brokers decommission", + "rpk redpanda admin brokers decommission-status", + "rpk redpanda admin brokers list", + "rpk redpanda admin brokers recommission", + "rpk redpanda admin config", + "rpk redpanda admin config log-level", + "rpk redpanda admin config log-level set", + "rpk redpanda admin config print", + "rpk redpanda admin partitions", + "rpk redpanda admin partitions list" + ] + } + ], + "removedCommands": [ + { + "path": "rpk ai llm", + "name": "llm", + "description": "Manage LLM providers registered with the Redpanda AI gateway.\n\nSupported provider types: openai, anthropic, google, bedrock.\n\nAliases: `llm-provider` (compat with aigwctl), `provider`, `lp`.", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm apply", + "name": "apply", + "description": "Reconcile LLM providers from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names — see `diff --help`.", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm check", + "name": "check", + "description": "Runs a lightweight probe against the upstream to verify credentials and reachability.", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm create", + "name": "create", + "description": "Create an LLM provider", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm delete", + "name": "delete", + "description": "Delete an LLM provider", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm diff", + "name": "diff", + "description": "Dry-run of apply for LLM providers. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm get", + "name": "get", + "description": "Get an LLM provider", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm list", + "name": "list", + "description": "List LLM providers", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai llm update", + "name": "update", + "description": "Update an LLM provider", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp", + "name": "mcp", + "description": "Manage MCP servers (create, get, list, update, delete, types)", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp apply", + "name": "apply", + "description": "Reconcile MCP servers from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names — see `diff --help`.", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp create", + "name": "create", + "description": "Create an MCP server", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp delete", + "name": "delete", + "description": "Delete an MCP server", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp diff", + "name": "diff", + "description": "Dry-run of apply for MCP servers. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp get", + "name": "get", + "description": "Get an MCP server", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp list", + "name": "list", + "description": "List MCP servers", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp tools", + "name": "tools", + "description": "Interact with tools on an MCP server", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp tools call", + "name": "call", + "description": "Invoke a tool on an MCP server through the aigw MCP proxy.\n\nThe server's /mcp/v1/ endpoint is reached with the same bearer token\nused by the rest of rpai; aigw resolves user-delegated OAuth tokens from the\nvault when the MCP server is configured with --user-oauth-provider.\n\nArguments passed to the tool are a JSON object supplied via --args. Example:\n\n rpai mcp tools call gf-servicenow-sand2 listtablerecords \\\n --args '{\"tableName\":\"incident\",\"sysparm_limit\":3}'\n\nWith --code-mode the call targets the virtual code-mode sibling endpoint\n(/mcp/v1/-code). That endpoint exposes search (tool catalog for the\nprimary) and execute (runs JavaScript in a sandbox with call_tool bound to\nthe primary's tools). Example:\n\n rpai mcp tools call pg-garrett execute --code-mode \\\n --args '{\"code\":\"var r = call_tool({name:\\\"query\\\", arguments:{query:\\\"SELECT 1\\\"}}); JSON.stringify(r);\"}'\n", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp tools list", + "name": "list", + "description": "List tools on an MCP server by calling tools/list through the aigw MCP proxy.\n\nHits the server's /mcp/v1/ endpoint, so the same auth and token-vault\npath used by tools/call is exercised here. Useful for checking that a managed\nMCP's tool schema loaded correctly and that a user-delegated server is\nreachable with the caller's vault token.\n\nWith --code-mode the session targets the virtual code-mode sibling endpoint\n(/mcp/v1/-code), which exposes the sandbox meta-tools (search,\nexecute). To see the parent's tool catalog from the sandbox, invoke the\nsearch tool explicitly:\n\n rpai mcp tools call search --code-mode\n", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp types", + "name": "types", + "description": "List available managed MCP types", + "removedInVersion": "v26.2.1" + }, + { + "path": "rpk ai mcp update", + "name": "update", + "description": "Update an MCP server", + "removedInVersion": "v26.2.1" + } + ], + "newFlags": [ + { + "commandPath": "rpk cloud auth list", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster config list", + "flagName": "node-id", + "type": "int", + "description": "If set, route the cluster configuration request to the given broker instead of any broker", + "default": 0, + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster config status", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster info", + "flagName": "detailed", + "type": "bool", + "description": "Augment the brokers section with Admin API metadata (cores, membership, liveness, version, UUID, and disk space)", + "default": false, + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster info", + "flagName": "include-decommissioned", + "type": "bool", + "description": "Append decommissioned nodes to the brokers section using their UUID", + "default": false, + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster logdirs describe", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster maintenance status", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster partitions balancer-status", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster partitions move-cancel", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk cluster partitions move-status", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk group delete", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk group list", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk group offset-delete", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk group seek", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk plugin list", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk profile list", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk security acl delete", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk security secret list", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk shadow describe", + "flagName": "print-role", + "type": "bool", + "description": "Print the detailed role sync configuration section", + "default": false, + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk shadow status", + "flagName": "print-registry", + "type": "bool", + "description": "Print the schema registry sync status section", + "default": false, + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk topic add-partitions", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk topic alter-config", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + }, + { + "commandPath": "rpk topic delete", + "flagName": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "introducedInVersion": "v26.2.1" + } + ], + "removedFlags": [], + "changedDefaults": [ + { + "commandPath": "rpk container start", + "flagName": "console-image", + "oldDefault": "redpandadata/console:v3.7.1", + "newDefault": "redpandadata/console:v3.8.0" + } + ], + "changedFlagTypes": [], + "changedFlagRequirements": [], + "changedFlagDescriptions": [ + { + "commandPath": "rpk cluster self-test status", + "flagName": "format", + "oldDescription": "Output format (text, json)", + "newDescription": "Output format (json,yaml,text,wide,help)" + } + ], + "descriptionChanges": [ + { + "path": "rpk ai agent a2a", + "type": "command", + "oldDescription": "Interact with an agent over the A2A (Agent-to-Agent) protocol.\n\nThe AGENT argument is either a registry agent name (resolved to the\nagent's A2A endpoint via its runtime status) or a full A2A endpoint URL\n(anything starting with http:// or https://).\n\nAuthentication: your profile's bearer token is attached when the target\nis a registry agent or an explicit URL on the profile's dataplane host.\nExplicit URLs on other hosts are called without credentials so your\ntoken never leaves the platform (a note on stderr says so when this\nhappens).\n\nOutput formats: table (default, human-readable) and -o json / -o yaml.\nStreams (--stream, task watch) emit one JSON event per line under both\njson and yaml.\n\nExit codes: 0 success (including tasks waiting for more input), 4 task\nended failed/canceled/rejected, 1 anything else.", + "newDescription": "Interact with an agent over the A2A (Agent-to-Agent) protocol.\n\nThe AGENT argument is either a registry agent name (resolved to the\nagent's A2A endpoint via its runtime status) or a full A2A endpoint URL\n(anything starting with http:// or https://).\n\nAuthentication: your environment's bearer token is attached when the target\nis a registry agent or an explicit URL on the environment's dataplane host.\nExplicit URLs on other hosts are called without credentials so your\ntoken never leaves the platform (a note on stderr says so when this\nhappens).\n\nOutput formats: table (default, human-readable) and -o json / -o yaml.\nStreams (--stream, task watch) emit one JSON event per line under both\njson and yaml.\n\nExit codes: 0 success (including tasks waiting for more input), 4 task\nended failed/canceled/rejected, 1 anything else." + }, + { + "path": "rpk ai agent a2a card", + "type": "command", + "oldDescription": "Fetch the A2A agent card — the JSON discovery document describing the\nagent's identity, skills, supported transports and capabilities.\n\nUse -o json to feed the raw card to other tools.", + "newDescription": "Fetch the A2A agent card: the JSON discovery document describing the\nagent's identity, skills, supported transports and capabilities.\n\nUse -o json to feed the raw card to other tools." + }, + { + "path": "rpk ai agent a2a task cancel", + "type": "command", + "oldDescription": "Ask the agent to cancel a running task and print the task's resulting\nstate. Cancellation is cooperative — the agent may already have\nfinished, in which case the terminal state is returned unchanged.", + "newDescription": "Ask the agent to cancel a running task and print the task's resulting\nstate. Cancellation is cooperative; the agent may already have\nfinished, in which case the terminal state is returned unchanged." + }, + { + "path": "rpk ai agent apply", + "type": "command", + "oldDescription": "Reconcile agents from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names — see `diff --help`.", + "newDescription": "Reconcile agents from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`." + }, + { + "path": "rpk ai agent credential create", + "type": "command", + "oldDescription": "Creates a client-id/secret pair for the agent. The client_secret is shown exactly once — save it now; it cannot be retrieved again.", + "newDescription": "Creates a client-id/secret pair for the agent. The client_secret is shown exactly once; save it now (it cannot be retrieved again)." + }, + { + "path": "rpk ai auth login", + "type": "command", + "oldDescription": "Run the OAuth 2.0 device authorization grant against Redpanda Cloud's\ncloud-api, persist the resulting credentials to the rpai credentials file\n(0600), and — for new profiles — prompt to pick an ADP environment whose AI\nGateway URL becomes the profile's dataplane_url.\n\nIf the active profile's stored credentials are still valid, login is a\nno-op and prints \"Already logged in ...\". Log out first (or delete the\ncredential entry) to force a re-auth.", + "newDescription": "Run the OAuth 2.0 device authorization grant against Redpanda Cloud's\ncloud-api, persist the resulting credentials to the rpai credentials file\n(0600, keyed by organization), then prompt to pick an ADP environment in that\norganization. The chosen environment becomes the current selection.\n\nA successful login rewrites the config in the current schema, so running\n'auth login' is also how you migrate a config left over from an older rpai.\n\nIf the current environment's organization still holds valid credentials,\nlogin is a no-op and prints \"Already logged in ...\". Run 'auth logout' first\nto re-authenticate, or 'auth logout --all' for a full clean slate." + }, + { + "path": "rpk ai auth logout", + "type": "command", + "oldDescription": "Delete stored credentials for the current profile (or all)", + "newDescription": "Delete stored credentials for the current organization (or --all for a full clean slate)" + }, + { + "path": "rpk ai auth status", + "type": "command", + "oldDescription": "Show the authentication state for the current profile", + "newDescription": "Show the authentication state for the current environment" + }, + { + "path": "rpk ai connection", + "type": "command", + "oldDescription": "Manage OAuth connections — coming soon", + "newDescription": "List and revoke the OAuth connections you hold to third-party providers.\n\nA connection is your personal grant to a provider (created by signing in through\nthe consent flow) that lets user_oauth MCP servers act on your behalf. Revoke is\nper user, per provider." + }, + { + "path": "rpk ai connection list", + "type": "command", + "oldDescription": "List OAuth connections — coming soon", + "newDescription": "List your OAuth connections" + }, + { + "path": "rpk ai connection revoke", + "type": "command", + "oldDescription": "Revoke an OAuth connection — coming soon", + "newDescription": "Revoke your connection to the named OAuth provider: the stored tokens are\ninvalidated and the provider's revocation endpoint is called best-effort. This\naffects only your own connection, not other users'." + }, + { + "path": "rpk ai env delete", + "type": "command", + "oldDescription": "Delete an environment from config and credentials files", + "newDescription": "Delete a manual environment" + }, + { + "path": "rpk ai env list", + "type": "command", + "oldDescription": "List environments (local + live ADP environments, merged)", + "newDescription": "List environments (current org's live ADP envs + local manual envs)" + }, + { + "path": "rpk ai env rename", + "type": "command", + "oldDescription": "Rename an environment in both config and credentials files", + "newDescription": "Rename a manual environment" + }, + { + "path": "rpk ai env use", + "type": "command", + "oldDescription": "Switch to a local environment, or select an ADP environment by name or id", + "newDescription": "Switch to a manual environment, or select an ADP environment by name or id" + }, + { + "path": "rpk ai model", + "type": "command", + "oldDescription": "Discover the models the Redpanda AI gateway exposes.\n\nThe catalog is read-only — `model list` and `model get` are the only verbs. The\ncatalog is populated from each LLM provider's metadata plus any extras the\noperator has pinned to a tenant.\n\nAliases: `models`, `m`.", + "newDescription": "Discover the models the Redpanda AI gateway exposes.\n\nThe catalog is read-only; `model list` and `model get` are the only verbs. The\ncatalog is populated from each LLM provider's metadata plus any extras the\noperator has pinned to a tenant.\n\nAliases: `models`, `m`." + }, + { + "path": "rpk ai oauth-client", + "type": "command", + "oldDescription": "Manage OAuth clients registered with the AI gateway's in-dataplane\nOAuth Authorization Server.\n\nAn OAuthClient is the external tool (Claude.ai, ChatGPT, Cursor, …) that\nrequests access tokens for an MCP. Create one per tool you want to allow\nin; the client_secret is returned exactly once on create and cannot be\nretrieved afterward. Rotate via delete + re-create until Phase 2 lands\na dedicated rotation RPC.\n\nAliases: `oauth-clients`, `oc`.", + "newDescription": "Manage OAuth clients (create, get, list, update, delete)" + }, + { + "path": "rpk ai oauth-client apply", + "type": "command", + "oldDescription": "Reconcile OAuth clients from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names — see `diff --help`.", + "newDescription": "Reconcile OAuth clients from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`." + }, + { + "path": "rpk ai oauth-client create", + "type": "command", + "oldDescription": "Register an OAuth client. The generated client_secret is printed\nonce to stderr with a \"copy this now\" banner — it cannot be retrieved\nafterward. Store it in whatever secret manager the external tool uses.", + "newDescription": "Create an OAuth client." + }, + { + "path": "rpk ai oauth-client dcr", + "type": "command", + "oldDescription": "Manage the tenant's Dynamic Client Registration policy.\n\nWhen DCR is enabled, spec-conformant MCP clients (Claude, Cursor, …)\nself-register at the public /oauth/idp/register endpoint — no admin\npre-provisioning. Admission is governed by the mode:\n\n open anyone may register (rate limit + client cap still apply)\n initial-access-token callers must present an admin-minted one-shot bearer\n software-statement reserved; not yet supported\n\nDCR is disabled per tenant by default; the gateway operator must also\nship the binary with the global ingress.idp.dcr.global_enabled flag.", + "newDescription": "Manage the tenant's Dynamic Client Registration policy.\n\nWhen DCR is enabled, spec-conformant MCP clients (Claude, Cursor, …)\nself-register at the public /oauth/idp/register endpoint; no admin\npre-provisioning. Admission is governed by the mode:\n\n open anyone may register (rate limit + client cap still apply)\n initial-access-token callers must present an admin-minted one-shot bearer\n software-statement reserved; not yet supported\n\nDCR is disabled per tenant by default; the gateway operator must also\nship the binary with the global ingress.idp.dcr.global_enabled flag." + }, + { + "path": "rpk ai oauth-client dcr iat", + "type": "command", + "oldDescription": "Manage Initial Access Tokens (IATs) — one-shot bearer credentials a\ncaller presents to the public registration endpoint when the tenant's\nadmission mode is initial-access-token. The plaintext is printed\nexactly once on mint; only a hash is stored.", + "newDescription": "Manage Initial Access Tokens (IATs): one-shot bearer credentials a\ncaller presents to the public registration endpoint when the tenant's\nadmission mode is initial-access-token. The plaintext is printed\nexactly once on mint; only a hash is stored." + }, + { + "path": "rpk ai oauth-client dcr iat revoke", + "type": "command", + "oldDescription": "Revoke an unconsumed Initial Access Token so it can no longer be\nexchanged at the registration endpoint. Idempotent — revoking an\nalready-revoked or consumed token returns 0.", + "newDescription": "Revoke an unconsumed Initial Access Token so it can no longer be\nexchanged at the registration endpoint. Idempotent: revoking an\nalready-revoked or consumed token returns 0." + }, + { + "path": "rpk ai oauth-provider", + "type": "command", + "oldDescription": "Manage OAuth authorization-server configurations registered with the Redpanda AI gateway.\n\nOAuth providers describe third-party authorization servers (GitHub, Google, Slack, ...)\nthat user-facing MCP servers can authenticate against via the device-consent flow.\n\nAliases: `oauth`, `op`.", + "newDescription": "Manage OAuth providers (create, get, list, update, delete)" + }, + { + "path": "rpk ai oauth-provider apply", + "type": "command", + "oldDescription": "Reconcile OAuth providers from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names — see `diff --help`.", + "newDescription": "Reconcile OAuth providers from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`." + }, + { + "path": "rpk ai oauth-provider create", + "type": "command", + "oldDescription": "Create an OAuth provider", + "newDescription": "Create an OAuth provider." + }, + { + "path": "rpk ai run", + "type": "command", + "oldDescription": "Launch a third-party coding agent configured to send its model traffic\nthrough the Redpanda AI gateway for the active profile, reusing rpai's\nlogin and auto-refreshing token.", + "newDescription": "Launch a third-party coding agent configured to send its model traffic\nthrough the Redpanda AI gateway for the current environment, reusing rpai's\nlogin and auto-refreshing token." + }, + { + "path": "rpk ai run claude", + "type": "command", + "oldDescription": "Launch Anthropic's Claude Code CLI with its model traffic\nrouted through the Redpanda AI gateway for the active rpai profile.\n\nrpai points ANTHROPIC_BASE_URL at the gateway's Anthropic Messages endpoint for\nthe chosen provider and wires the gateway auth for the life of the session. No\ntoken is ever written to disk.\n\nBoth auth modes run in your REAL Claude Code config home, so your workspace\ntrust, onboarding, theme, and MCP servers all apply. rpai writes nothing into\n~/.claude in either mode:\n\n - managed (api key): the gateway apiKeyHelper (`rpai auth token`, which Claude\n Code re-runs to refresh the bearer; aigw injects the upstream Anthropic key)\n is passed via `claude --settings` as a JSON string — off disk, merged on top\n of your settings, your ~/.claude/settings.json untouched.\n - passthrough (enterprise/Max subscription): your existing subscription login\n (stored under your config home) is used. rpai only sets the gateway base URL\n and the X-Redpanda-Cloud-Token header (minted fresh at launch) in the\n environment; your subscription OAuth flows through aigw to Anthropic untouched.\n\nPass --claude-config-dir to run against an isolated config home instead of your\nreal one (rpai still never writes into it).\n\nIn passthrough mode the X-Redpanda-Cloud-Token gateway JWT is set in the\nlaunched process environment, so Claude Code's tool subprocesses (Bash, hooks,\nMCP) inherit it — the same Redpanda Cloud token any process running as you can\nalready mint with `rpai auth token`, and Claude Code has no documented mechanism\nto scrub it from those subprocesses.\n\nBecause passthrough uses your real config home, any auth configured in your\n~/.claude/settings.json (an apiKeyHelper, or env.ANTHROPIC_AUTH_TOKEN) still\napplies and outranks the subscription OAuth aigw needs to relay — rpai scrubs\nonly the inherited shell env, not your on-disk settings.\n\nAnthropic and Bedrock providers are supported. A bedrock provider launches\nClaude Code in its native Bedrock mode pointed at the same gateway prefix; aigw\nsigns the upstream call with the provider's AWS credentials (SigV4), so no AWS\nkeys ever reach your machine and the managed apiKeyHelper auth works exactly as\nabove (passthrough does not apply — there is no Bedrock analog of a Claude\nsubscription). Pass -m an inference-profile id from the provider's model\nallowlist (Bedrock Anthropic models 4.6+ carry a us./eu./apac./global. prefix).\nClaude Code's background (small/fast) model defaults to a Haiku-class inference\nprofile in Bedrock mode; if the provider's allowlist doesn't include it, export\nANTHROPIC_SMALL_FAST_MODEL with an allowlisted id.\n\nPass Claude Code's own flags after a literal --:\n\n rpai run claude -L anthropic -m claude-sonnet-4-6 -- --permission-mode plan\n rpai run claude -L bedrock -m us.anthropic.claude-sonnet-4-6 -- -p \"hi\"", + "newDescription": "Launch Anthropic's Claude Code CLI with its model traffic\nrouted through the Redpanda AI gateway for the current rpai environment.\n\nrpai points ANTHROPIC_BASE_URL at the gateway's Anthropic Messages endpoint for\nthe chosen provider and wires the gateway auth for the life of the session. No\ntoken is ever written to disk.\n\nBoth auth modes run in your REAL Claude Code config home, so your workspace\ntrust, onboarding, theme, and MCP servers all apply. rpai writes nothing into\n~/.claude in either mode:\n\n - managed (api key): the gateway apiKeyHelper (`rpai auth token`, which Claude\n Code re-runs to refresh the bearer; aigw injects the upstream Anthropic key)\n is passed via `claude --settings` as a JSON string; off disk, merged on top\n of your settings, your ~/.claude/settings.json untouched.\n - passthrough (enterprise/Max subscription): your existing subscription login\n (stored under your config home) is used. rpai only sets the gateway base URL\n and the X-Redpanda-Cloud-Token header (minted fresh at launch) in the\n environment; your subscription OAuth flows through aigw to Anthropic untouched.\n\nPass --claude-config-dir to run against an isolated config home instead of your\nreal one (rpai still never writes into it).\n\nIn passthrough mode the X-Redpanda-Cloud-Token gateway JWT is set in the\nlaunched process environment, so Claude Code's tool subprocesses (Bash, hooks,\nMCP) inherit it; the same Redpanda Cloud token any process running as you can\nalready mint with `rpai auth token`, and Claude Code has no documented mechanism\nto scrub it from those subprocesses.\n\nBecause passthrough uses your real config home, any auth configured in your\n~/.claude/settings.json (an apiKeyHelper, or env.ANTHROPIC_AUTH_TOKEN) still\napplies and outranks the subscription OAuth aigw needs to relay; rpai scrubs\nonly the inherited shell env, not your on-disk settings.\n\nAnthropic and Bedrock providers are supported. A bedrock provider launches\nClaude Code in its native Bedrock mode pointed at the same gateway prefix; aigw\nsigns the upstream call with the provider's AWS credentials (SigV4), so no AWS\nkeys ever reach your machine and the managed apiKeyHelper auth works exactly as\nabove (passthrough does not apply; there is no Bedrock analog of a Claude\nsubscription). Pass -m an inference-profile id from the provider's model\nallowlist (Bedrock Anthropic models 4.6+ carry a us./eu./apac./global. prefix).\nClaude Code's background (small/fast) model defaults to a Haiku-class inference\nprofile in Bedrock mode; if the provider's allowlist doesn't include it, export\nANTHROPIC_SMALL_FAST_MODEL with an allowlisted id.\n\nPass Claude Code's own flags after a literal --:\n\n rpai run claude -L anthropic -m claude-sonnet-4-6 -- --permission-mode plan\n rpai run claude -L bedrock -m us.anthropic.claude-sonnet-4-6 -- -p \"hi\"" + }, + { + "path": "rpk ai run codex", + "type": "command", + "oldDescription": "Launch the OpenAI Codex CLI with its model traffic routed\nthrough the Redpanda AI gateway for the active rpai profile.\n\nrpai generates a throwaway Codex config in a temporary CODEX_HOME, points it at\nthe gateway's OpenAI-compatible Responses endpoint for the chosen provider, and\nwires Codex's bearer to `rpai auth token` so it refreshes itself for the\nlife of the session. Your own ~/.codex config is never read or modified, and no\ntoken is written to disk.\n\nThe launch directory is auto-trusted under a workspace-write sandbox\n(approval_policy=on-request) so the fresh CODEX_HOME doesn't prompt for trust on\nevery run; pass --no-auto-trust to keep Codex's normal first-run trust prompt.\n\nOnly openai / openai_compatible providers are supported (Codex speaks the OpenAI\nResponses API). Pass Codex's own flags after a literal --:\n\n rpai run codex -L openai -m gpt-5.3-codex -e high -- --ask-for-approval never", + "newDescription": "Launch the OpenAI Codex CLI with its model traffic routed\nthrough the Redpanda AI gateway for the current rpai environment.\n\nrpai generates a throwaway Codex config in a temporary CODEX_HOME, points it at\nthe gateway's OpenAI-compatible Responses endpoint for the chosen provider, and\nwires Codex's bearer to `rpai auth token` so it refreshes itself for the\nlife of the session. Your own ~/.codex config is never read or modified, and no\ntoken is written to disk.\n\nThe launch directory is auto-trusted under a workspace-write sandbox\n(approval_policy=on-request) so the fresh CODEX_HOME doesn't prompt for trust on\nevery run; pass --no-auto-trust to keep Codex's normal first-run trust prompt.\n\nOnly openai / openai_compatible providers are supported (Codex speaks the OpenAI\nResponses API). Pass Codex's own flags after a literal --:\n\n rpai run codex -L openai -m gpt-5.3-codex -e high -- --ask-for-approval never" + }, + { + "path": "rpk cluster config list", + "type": "command", + "oldDescription": "List cluster configuration properties.\n\nThis command lists all available cluster configuration properties. Use the 'get'\ncommand to retrieve specific property values, or 'edit' for interactive editing.\n\nUse the --filter flag with a regular expression to filter configuration keys.", + "newDescription": "List cluster configuration properties.\n\nThis command lists all available cluster configuration properties. Use the 'get'\ncommand to retrieve specific property values, or 'edit' for interactive editing.\n\nUse the --filter flag with a regular expression to filter configuration keys.\n\nBy default the request is routed to any broker. Use --node-id to route it to\na specific broker, which is useful when you suspect a broker is out of sync\nwith the controller. --node-id is not supported for cloud clusters." + }, + { + "path": "rpk cluster info", + "type": "command", + "oldDescription": "Request broker metadata information.\n\nThe Kafka protocol's metadata contains information about brokers, topics, and\nthe cluster as a whole.\n\nThis command only runs if specific sections of metadata are requested. There\nare currently three sections: the cluster, the list of brokers, and the topics.\nIf no section is specified, this defaults to printing all sections.\n\nIf the topic section is requested, all topics are requested by default unless\nsome are manually specified as arguments. Expanded per-partition information\ncan be printed with the -d flag, and internal topics can be printed with the -i\nflag.\n\nIn the broker section, the controller node is suffixed with *.\n\nUsing this command with --format json/yaml implies that all sections are \nincluded.\n", + "newDescription": "Request broker metadata information.\n\nThe Kafka protocol's metadata contains information about brokers, topics, and\nthe cluster as a whole.\n\nThis command only runs if specific sections of metadata are requested. There\nare currently three sections: the cluster, the list of brokers, and the topics.\nIf no section is specified, this defaults to printing all sections.\n\nIf the topic section is requested, all topics are requested by default unless\nsome are manually specified as arguments. Expanded per-partition information\ncan be printed with the -d flag, and internal topics can be printed with the -i\nflag.\n\nIn the broker section, the controller node is suffixed with *.\n\nUsing --detailed augments the broker section with Admin API metadata: the\nnumber of cores per broker, membership status, liveness, version, and broker\nUUID (when reported by the Admin API). It also prints a per-broker DISK SPACE\nsection.\n\nUsing --include-decommissioned additionally lists decommissioned nodes by\ntheir UUID at the end of the broker table.\n\nIf the Admin API is unreachable when --detailed or --include-decommissioned\nis set, the basic broker view is still printed; pass -v to see the underlying\nerror.\n\nUsing this command with --format json/yaml implies that all sections are\nincluded.\n" + }, + { + "path": "rpk cluster maintenance status", + "type": "command", + "oldDescription": "Report maintenance status.\n\nThis command reports maintenance status for each node in the cluster. The output\nis presented as a table with each row representing a node in the cluster. The\noutput can be used to monitor the progress of node draining.\n\n NODE-ID ENABLED FINISHED ERRORS PARTITIONS ELIGIBLE TRANSFERRING FAILED\n 1 false false false 0 0 0 0\n\nField descriptions:\n\n NODE-ID: the node ID\n ENABLED: true if the node is currently in maintenance mode\n FINISHED: leadership draining has completed\n ERRORS: errors have been encountered while draining\n PARTITIONS: number of partitions whose leadership has moved\n ELIGIBLE: number of partitions with leadership eligible to move\n TRANSFERRING: current active number of leadership transfers\n FAILED: number of failed leadership transfers\n\nNotes:\n\n - When errors are present further information will be available in the logs\n for the corresponding node.\n\n - Only partitions with more than one replica are eligible for leadership\n transfer.\n", + "newDescription": "Report maintenance status.\n\nThis command reports maintenance status for each node in the cluster. The output\nis presented as a table with each row representing a node in the cluster. The\noutput can be used to monitor the progress of node draining.\n\n NODE-ID ENABLED FINISHED ERRORS PARTITIONS ELIGIBLE TRANSFERRING FAILED\n 1 false false false 0 0 0 0\n\nField descriptions:\n\n NODE-ID: the node ID\n ENABLED: true if the node is currently in maintenance mode (draining)\n FINISHED: leadership draining has completed\n ERRORS: errors have been encountered while draining\n PARTITIONS: number of partitions whose leadership has moved\n ELIGIBLE: number of partitions with leadership eligible to move\n TRANSFERRING: current active number of leadership transfers\n FAILED: number of failed leadership transfers\n\nNotes:\n\n - When errors are present further information will be available in the logs\n for the corresponding node.\n\n - Only partitions with more than one replica are eligible for leadership\n transfer.\n\n - FINISHED, ERRORS, PARTITIONS, ELIGIBLE, TRANSFERRING, and FAILED are only\n populated while a node is in maintenance mode (ENABLED=true).\n" + }, + { + "path": "rpk cluster partitions move-cancel", + "type": "command", + "oldDescription": "Cancel ongoing partition movements.\n\nBy default, this command cancels all the partition movements in the cluster. \nTo ensure that you do not accidentally cancel all partition movements, this \ncommand prompts users for confirmation before issuing the cancellation request. \nYou can use \"--no-confirm\" to disable the confirmation prompt:\n\n rpk cluster partitions move-cancel --no-confirm\n\nIf \"--node\" is set, this command will only stop the partition movements \noccurring in the specified node:\n\n rpk cluster partitions move-cancel --node 1\n", + "newDescription": "Cancel ongoing partition movements.\n\nBy default, this command cancels all the partition movements in the cluster.\nTo ensure that you do not accidentally cancel all partition movements, this\ncommand prompts users for confirmation before issuing the cancellation request.\nYou can use \"--no-confirm\" to disable the confirmation prompt:\n\n rpk cluster partitions move-cancel --no-confirm\n\nIf \"--node\" is set, this command will only stop the partition movements\noccurring in the specified node:\n\n rpk cluster partitions move-cancel --node 1\n" + }, + { + "path": "rpk cluster partitions move-status", + "type": "command", + "oldDescription": "Show ongoing partition movements.\n\nBy default this command lists all ongoing partition movements in the cluster.\nTopics can be specified to print the move status of specific topics. By default,\nthis command assumes the \"kafka\" namespace, but you can use a \"namespace/\" to\nspecify internal namespaces.\n\n rpk cluster partitions move-status\n rpk cluster partitions move-status foo bar kafka_internal/tx\n\nThe \"--partition / -p\" flag can be used with topics to additional filter\nrequested partitions:\n\n rpk cluster partitions move-status foo bar --partition 0,1,2\n\nThe output contains the following columns with PARTITION-SIZE in bytes.\nUsing -H, it prints the partition size in a human-readable format\n\n NAMESPACE-TOPIC\n PARTITION\n MOVING-FROM\n MOVING-TO\n COMPLETION-%\n PARTITION-SIZE\n BYTES-MOVED\n BYTES-REMAINING\n\nUsing \"--print-all / -a\" the command additionally prints the column\n\"RECONCILIATION STATUSES\", which reveals the internal status of the ongoing\nreconciliations. Reported errors do not necessarily mean real problems.\n", + "newDescription": "Show ongoing partition movements.\n\nBy default this command lists all ongoing partition movements in the cluster.\nTopics can be specified to print the move status of specific topics. By default,\nthis command assumes the \"kafka\" namespace, but you can use a \"namespace/\" to\nspecify internal namespaces.\n\n rpk cluster partitions move-status\n rpk cluster partitions move-status foo bar kafka_internal/tx\n\nThe \"--partition / -p\" flag can be used with topics to additional filter\nrequested partitions:\n\n rpk cluster partitions move-status foo bar --partition 0,1,2\n\nThe output contains the following columns with PARTITION-SIZE in bytes.\nUsing -H, it prints the partition size in a human-readable format\n\n NAMESPACE-TOPIC\n PARTITION\n MOVING-FROM\n MOVING-TO\n COMPLETION-%\n PARTITION-SIZE\n BYTES-MOVED\n BYTES-REMAINING\n\nUsing \"--print-all / -a\" the command additionally prints the column\n\"RECONCILIATION STATUSES\", which reveals the internal status of the ongoing\nreconciliations. Reported errors do not necessarily mean real problems.\n\nThe --format flag controls the output format: text (default), json, yaml, or\nhelp (prints field descriptions).\n" + }, + { + "path": "rpk group", + "type": "command", + "oldDescription": "Describe, list, and delete consumer groups and manage their offsets.\n\nConsumer groups allow you to horizontally scale consuming from topics. A\nnon-group consumer consumes all records from all partitions you assign it. In\ncontrast, consumer groups allow many consumers to coordinate and divide work.\nIf you have two members in a group consuming topics A and B, each with three\npartitions, then both members consume three partitions. If you add another\nmember to the group, then each of the three members will consume two\npartitions. This allows you to horizontally scale consuming of topics.\n\nThe unit of scaling is a single partition. If you add more consumers to a group\nthan there are are total partitions to consume, then some consumers will be\nidle. More commonly, you have many more partitions than consumer group members\nand each member consumes a chunk of available partitions. One scenario where\nyou may want more members than partitions is if you want active standby's to\ntake over load immediately if any consuming member dies.\n\nHow group members divide work is entirely client driven (the \"partition\nassignment strategy\" or \"balancer\" depending on the client). Brokers know\nnothing about how consumers are assigning partitions. A broker's role in group\nconsuming is to choose which member is the leader of a group, forward that\nmember's assignment to every other member, and ensure all members are alive\nthrough heartbeats.\n\nConsumers periodically commit their progress when consuming partitions. Through\nthese commits, you can monitor just how far behind a consumer is from the\nlatest messages in a partition. This is called \"lag\". Large lag implies that\nthe client is having problems, which could be from the server being too slow,\nor the client being oversubscribed in the number of partitions it is consuming,\nor the server being in a bad state that requires restarting or removing from\nthe server pool, and so on.\n\nYou can manually manage offsets for a group, which allows you to rewind or\nforward commits. If you notice that a recent deploy of your consumers had a\nbug, you may want to stop all members, rewind the commits to before the latest\ndeploy, and restart the members with a patch.\n\nThis command allows you to list all groups, describe a group (to view the\nmembers and their lag), and manage offsets.\n", + "newDescription": "Describe, list, and delete consumer groups and manage their offsets.\n\nConsumer groups allow you to horizontally scale consuming from topics. A\nnon-group consumer consumes all records from all partitions you assign it. In\ncontrast, consumer groups allow many consumers to coordinate and divide work.\nIf you have two members in a group consuming topics A and B, each with three\npartitions, then both members consume three partitions. If you add another\nmember to the group, then each of the three members will consume two\npartitions. This allows you to horizontally scale consuming of topics.\n\nThe unit of scaling is a single partition. If you add more consumers to a group\nthan there are total partitions to consume, then some consumers will be\nidle. More commonly, you have many more partitions than consumer group members\nand each member consumes a chunk of available partitions. One scenario where\nyou may want more members than partitions is if you want active standby's to\ntake over load immediately if any consuming member dies.\n\nHow group members divide work is entirely client driven (the \"partition\nassignment strategy\" or \"balancer\" depending on the client). Brokers know\nnothing about how consumers are assigning partitions. A broker's role in group\nconsuming is to choose which member is the leader of a group, forward that\nmember's assignment to every other member, and ensure all members are alive\nthrough heartbeats.\n\nConsumers periodically commit their progress when consuming partitions. Through\nthese commits, you can monitor just how far behind a consumer is from the\nlatest messages in a partition. This is called \"lag\". Large lag implies that\nthe client is having problems, which could be from the server being too slow,\nor the client being oversubscribed in the number of partitions it is consuming,\nor the server being in a bad state that requires restarting or removing from\nthe server pool, and so on.\n\nYou can manually manage offsets for a group, which allows you to rewind or\nforward commits. If you notice that a recent deploy of your consumers had a\nbug, you may want to stop all members, rewind the commits to before the latest\ndeploy, and restart the members with a patch.\n\nThis command allows you to list all groups, describe a group (to view the\nmembers and their lag), and manage offsets.\n" + }, + { + "path": "rpk topic consume", + "type": "command", + "oldDescription": "Consume records from topics.\n\nConsuming records reads from any amount of input topics, formats each record\naccording to --format, and prints them to STDOUT. The output formatter\nunderstands a wide variety of formats.\n\nThe default output format \"--format json\" is a special format that outputs each\nrecord as JSON. There may be more single-word-no-escapes formats added later.\nOutside of these special formats, formatting follows the rules described below.\n\nFormatting output is based on percent escapes and modifiers. Slashes can be\nused for common escapes:\n\n \\t \\n \\r \\\\ \\xNN\n\nprints tabs, newlines, carriage returns, slashes, or hex encoded characters.p\n\nPercent encoding prints record fields, fetch partition fields, or extra values:\n\n %t topic\n %T topic length\n %k key\n %K key length\n %v value\n %V value length\n %h begin the header specification\n %H number of headers\n %p partition\n %o offset\n %e leader epoch\n %d timestamp (formatting described below)\n %a record attributes (formatting described below)\n %x producer id\n %y producer epoch\n\n %[ partition log start offset\n %| partition last stable offset\n %] partition high watermark\n\n %% percent sign\n %{ left brace\n %} right brace\n\n %i the number of records formatted\n\nMODIFIERS\n\nText and numbers can be formatted in many different ways, and the default\nformat can be changed within brace modifiers. %v prints a value, while %v{hex}\nprints the value hex encoded. %T prints the length of a topic in ascii, while\n%T{big8} prints the length of the topic as an eight byte big endian.\n\nAll modifiers go within braces following a percent-escape.\n\nNUMBERS\n\nFormatting number values can have the following modifiers:\n\n ascii print the number as ascii (default)\n\n hex64 sixteen hex characters\n hex32 eight hex characters\n hex16 four hex characters\n hex8 two hex characters\n hex4 one hex character\n\n big64 eight byte big endian number\n big32 four byte big endian number\n big16 two byte big endian number\n big8 alias for byte\n\n little64 eight byte little endian number\n little32 four byte little endian number\n little16 two byte little endian number\n little8 alias for byte\n\n byte one byte number\n bool \"true\" if the number is non-zero, \"false\" if the number is zero\n\nAll numbers are truncated as necessary per the modifier. Printing %V{byte} for\na length 256 value will print a single null, whereas printing %V{big8} would\nprint the bytes 1 and 0.\n\nWhen writing number sizes, the size corresponds to the size of the raw values,\nnot the size of encoded values. \"%T% t{hex}\" for the topic \"foo\" will print\n\"3 666f6f\", not \"6 666f6f\".\n\nTIMESTAMPS\n\nBy default, the timestamp field is printed as a millisecond number value. In\naddition to the number modifiers above, timestamps can be printed with either\nGo formatting or strftime formatting:\n\n %d{go[2006-01-02T15:04:05Z07:00]}\n %d{strftime[%F]}\n\nAn arbitrary amount of brackets (or braces, or # symbols) can wrap your date\nformatting:\n\n %d{strftime### [%F] ###}\n\nThe above will print \" [YYYY-MM-DD] \", while the surrounding three # on each\nside are used to wrap the formatting. Further details on Go time formatting can\nbe found at https://pkg.go.dev/time, while further details on strftime\nformatting can be read by checking \"man strftime\".\n\nATTRIBUTES\n\nEach record (or batch of records) has a set of possible attributes. Internally,\nthese are packed into bit flags. Printing an attribute requires first selecting\nwhich attribute you want to print, and then optionally specifying how you want\nit to be printed:\n\n %a{compression}\n %a{compression;number}\n %a{compression;big64}\n %a{compression;hex8}\n\nCompression is by default printed as text (\"none\", \"gzip\", ...). Compression\ncan be printed as a number with \";number\", where number is any number\nformatting option described above. No compression is 0, gzip is 1, etc.\n\n %a{timestamp-type}\n %a{timestamp-type;big64}\n\nThe record's timestamp type is printed as -1 for very old records (before\ntimestamps existed), 0 for client generated timestamps, and 1 for broker\ngenerated timestamps. Number formatting can be controlled with \";number\".\n\n %a{transactional-bit}\n %a{transactional-bit;bool}\n\nPrints 1 if the record a part of a transaction or 0 if it is not.\nNumber formatting can be controlled with \";number\".\n\n %a{control-bit}\n %a{control-bit;bool}\n\nPrints 1 if the record is a commit marker or 0 if it is not.\nNumber formatting can be controlled with \";number\".\n\nTEXT\n\nText fields without modifiers default to writing the raw bytes. Alternatively,\nthere are the following modifiers:\n\n %t{hex}\n %k{base64}\n %v{base64raw}\n %v{unpack[iIqQc.$]}\n\nThe hex modifier hex encodes the text, the base64 modifier base64 encodes the\ntext with standard encoding, and the base64raw modifier encodes the text with\nraw standard encoding. The unpack modifier has a further internal\nspecification, similar to timestamps above:\n\n x pad character (does not parse input)\n < switch what follows to little endian\n > switch what follows to big endian\n\n b signed byte\n B unsigned byte\n h int16 (\"half word\")\n H uint16 (\"half word\")\n i int32\n I uint32\n q int64 (\"quad word\")\n Q uint64 (\"quad word\")\n\n c any character\n . alias for c\n s consume the rest of the input as a string\n $ match the end of the line (append error string if anything remains)\n\nUnpacking text can allow translating binary input into readable output. If a\nvalue is a big-endian uint32, %v will print the raw four bytes, while\n%v{unpack[>I]} will print the number in as ascii. If unpacking exhausts the\ninput before something is unpacked fully, an error message is appended to the\noutput.\n\nHEADERS\n\nHeaders are formatted with percent encoding inside of the modifier:\n\n %h{ %k=%v{hex} }\n\nwill print all headers with a space before the key and after the value, an\nequals sign between the key and value, and with the value hex encoded. Header\nformatting actually just parses the internal format as a record format, so all\nof the above rules about %K, %V, text, and numbers apply.\n\nVALUES\n\nValues for consumed records can be omitted by using the '--meta-only' flag.\nTombstone records (records with a 'null' value) have their value omitted\nfrom the JSON output by default. All other records, including those with\nan empty-string value (\"\"), will have their values printed.\n\nEXAMPLES\n\nA key and value, separated by a space and ending in newline:\n -f '%k %v\\n'\nA key length as four big endian bytes, and the key as hex:\n -f '%K{big32}%k{hex}'\nA little endian uint32 and a string unpacked from a value:\n -f '%v{unpack[is$]}'\n\nOFFSETS\n\nThe --offset flag allows for specifying where to begin consuming, and\noptionally, where to stop consuming. The literal words \"start\" and \"end\"\nspecify consuming from the start and the end.\n\n start consume from the beginning\n end consume from the end\n :end consume until the current end\n +oo consume oo after the current start offset\n -oo consume oo before the current end offset\n oo consume after an exact offset\n oo: alias for oo\n :oo consume until an exact offset\n o1:o2 consume from exact offset o1 until exact offset o2\n @t consume starting from a given timestamp\n @t: alias for @t\n @:t consume until a given timestamp\n @t1:t2 consume from timestamp t1 until timestamp t2\n\nThere are a few options for timestamps, with each option being evaluated\nuntil one succeeds:\n\n 13 digits parsed as a unix millisecond\n 9 digits parsed as a unix second\n YYYY-MM-DD parsed as a day, UTC\n YYYY-MM-DDTHH:MM:SSZ parsed as RFC3339, UTC; fractional seconds optional (.MMM)\n end for t2 in @t1:t2, the current end of the partition\n -dur a negative duration from now or from a timestamp\n dur a positive duration from now or from a timestamp\n\nDurations can be relative to the current time or relative to a timestamp.\nIf a duration is used for t1, that duration is relative to now.\nIf a duration is used for t2, if t1 is a timestamp, then t2 is relative to t1.\nIf a duration is used for t2, if t1 is a duration, then t2 is relative to now.\n\nDurations are parsed simply:\n\n 3ms three milliseconds\n 10s ten seconds\n 9m nine minutes\n 1h one hour\n 1m3ms one minute and three milliseconds\n\nFor example,\n\n -o @2022-02-14:1h consume 1h of time on Valentine's Day 2022\n -o @-48h:-24h consume from 2 days ago to 1 day ago\n -o @-1m:end consume from 1m ago until now\n -o @:-1hr consume from the start until an hour ago\n", + "newDescription": "Consume records from topics.\n\nConsuming records reads from any amount of input topics, formats each record\naccording to --format, and prints them to STDOUT. The output formatter\nunderstands a wide variety of formats.\n\n--format json is the default, and outputs each record as a JSON object. There\nmay be more single-word-no-escapes formats added later. Outside of these special\nformats, formatting follows the rules described below.\n\nFormatting output is based on percent escapes and modifiers. Slashes can be\nused for common escapes:\n\n \\t \\n \\r \\\\ \\xNN\n\nprints tabs, newlines, carriage returns, slashes, or hex encoded characters.p\n\nPercent encoding prints record fields, fetch partition fields, or extra values:\n\n %t topic\n %T topic length\n %k key\n %K key length\n %v value\n %V value length\n %h begin the header specification\n %H number of headers\n %p partition\n %o offset\n %e leader epoch\n %d timestamp (formatting described below)\n %a record attributes (formatting described below)\n %x producer id\n %y producer epoch\n\n %[ partition log start offset\n %| partition last stable offset\n %] partition high watermark\n\n %% percent sign\n %{ left brace\n %} right brace\n\n %i the number of records formatted\n\nMODIFIERS\n\nText and numbers can be formatted in many different ways, and the default\nformat can be changed within brace modifiers. %v prints a value, while %v{hex}\nprints the value hex encoded. %T prints the length of a topic in ascii, while\n%T{big8} prints the length of the topic as an eight byte big endian.\n\nAll modifiers go within braces following a percent-escape.\n\nNUMBERS\n\nFormatting number values can have the following modifiers:\n\n ascii print the number as ascii (default)\n\n hex64 sixteen hex characters\n hex32 eight hex characters\n hex16 four hex characters\n hex8 two hex characters\n hex4 one hex character\n\n big64 eight byte big endian number\n big32 four byte big endian number\n big16 two byte big endian number\n big8 alias for byte\n\n little64 eight byte little endian number\n little32 four byte little endian number\n little16 two byte little endian number\n little8 alias for byte\n\n byte one byte number\n bool \"true\" if the number is non-zero, \"false\" if the number is zero\n\nAll numbers are truncated as necessary per the modifier. Printing %V{byte} for\na length 256 value will print a single null, whereas printing %V{big8} would\nprint the bytes 1 and 0.\n\nWhen writing number sizes, the size corresponds to the size of the raw values,\nnot the size of encoded values. \"%T% t{hex}\" for the topic \"foo\" will print\n\"3 666f6f\", not \"6 666f6f\".\n\nTIMESTAMPS\n\nBy default, the timestamp field is printed as a millisecond number value. In\naddition to the number modifiers above, timestamps can be printed with either\nGo formatting or strftime formatting:\n\n %d{go[2006-01-02T15:04:05Z07:00]}\n %d{strftime[%F]}\n\nAn arbitrary amount of brackets (or braces, or # symbols) can wrap your date\nformatting:\n\n %d{strftime### [%F] ###}\n\nThe above will print \" [YYYY-MM-DD] \", while the surrounding three # on each\nside are used to wrap the formatting. Further details on Go time formatting can\nbe found at https://pkg.go.dev/time, while further details on strftime\nformatting can be read by checking \"man strftime\".\n\nATTRIBUTES\n\nEach record (or batch of records) has a set of possible attributes. Internally,\nthese are packed into bit flags. Printing an attribute requires first selecting\nwhich attribute you want to print, and then optionally specifying how you want\nit to be printed:\n\n %a{compression}\n %a{compression;number}\n %a{compression;big64}\n %a{compression;hex8}\n\nCompression is by default printed as text (\"none\", \"gzip\", ...). Compression\ncan be printed as a number with \";number\", where number is any number\nformatting option described above. No compression is 0, gzip is 1, etc.\n\n %a{timestamp-type}\n %a{timestamp-type;big64}\n\nThe record's timestamp type is printed as -1 for very old records (before\ntimestamps existed), 0 for client generated timestamps, and 1 for broker\ngenerated timestamps. Number formatting can be controlled with \";number\".\n\n %a{transactional-bit}\n %a{transactional-bit;bool}\n\nPrints 1 if the record a part of a transaction or 0 if it is not.\nNumber formatting can be controlled with \";number\".\n\n %a{control-bit}\n %a{control-bit;bool}\n\nPrints 1 if the record is a commit marker or 0 if it is not.\nNumber formatting can be controlled with \";number\".\n\nTEXT\n\nText fields without modifiers default to writing the raw bytes. Alternatively,\nthere are the following modifiers:\n\n %t{hex}\n %k{base64}\n %v{base64raw}\n %v{unpack[iIqQc.$]}\n\nThe hex modifier hex encodes the text, the base64 modifier base64 encodes the\ntext with standard encoding, and the base64raw modifier encodes the text with\nraw standard encoding. The unpack modifier has a further internal\nspecification, similar to timestamps above:\n\n x pad character (does not parse input)\n < switch what follows to little endian\n > switch what follows to big endian\n\n b signed byte\n B unsigned byte\n h int16 (\"half word\")\n H uint16 (\"half word\")\n i int32\n I uint32\n q int64 (\"quad word\")\n Q uint64 (\"quad word\")\n\n c any character\n . alias for c\n s consume the rest of the input as a string\n $ match the end of the line (append error string if anything remains)\n\nUnpacking text can allow translating binary input into readable output. If a\nvalue is a big-endian uint32, %v will print the raw four bytes, while\n%v{unpack[>I]} will print the number as ASCII. If unpacking exhausts the\ninput before something is unpacked fully, an error message is appended to the\noutput.\n\nHEADERS\n\nHeaders are formatted with percent encoding inside of the modifier:\n\n %h{ %k=%v{hex} }\n\nwill print all headers with a space before the key and after the value, an\nequals sign between the key and value, and with the value hex encoded. Header\nformatting actually just parses the internal format as a record format, so all\nof the above rules about %K, %V, text, and numbers apply.\n\nVALUES\n\nValues for consumed records can be omitted by using the '--meta-only' flag.\n\nTombstone records (records with a 'null' value) have their value omitted\nfrom the JSON output by default. All other records, including those with\nan empty-string value (\"\"), have their values printed.\n\nEXAMPLES\n\nA key and value, separated by a space and ending in newline:\n -f '%k %v\\n'\nA key length as four big endian bytes, and the key as hex:\n -f '%K{big32}%k{hex}'\nA little endian uint32 and a string unpacked from a value:\n -f '%v{unpack[is$]}'\n\nOFFSETS\n\nThe --offset flag allows for specifying where to begin consuming, and\noptionally, where to stop consuming. The literal words \"start\" and \"end\"\nspecify consuming from the start and the end.\n\n start consume from the beginning\n end consume from the end\n :end consume until the current end\n +oo consume oo after the current start offset\n -oo consume oo before the current end offset\n oo consume after an exact offset\n oo: alias for oo\n :oo consume until an exact offset\n o1:o2 consume from exact offset o1 until exact offset o2\n @t consume starting from a given timestamp\n @t: alias for @t\n @:t consume until a given timestamp\n @t1:t2 consume from timestamp t1 until timestamp t2\n\nThere are a few options for timestamps, with each option being evaluated\nuntil one succeeds:\n\n 13 digits parsed as a unix millisecond\n 9 digits parsed as a unix second\n YYYY-MM-DD parsed as a day, UTC\n YYYY-MM-DDTHH:MM:SSZ parsed as RFC3339, UTC; fractional seconds optional (.MMM)\n end for t2 in @t1:t2, the current end of the partition\n -dur a negative duration from now or from a timestamp\n dur a positive duration from now or from a timestamp\n\nDurations can be relative to the current time or relative to a timestamp.\nIf a duration is used for t1, that duration is relative to now.\nIf a duration is used for t2, if t1 is a timestamp, then t2 is relative to t1.\nIf a duration is used for t2, if t1 is a duration, then t2 is relative to now.\n\nDurations are parsed simply:\n\n 3ms three milliseconds\n 10s ten seconds\n 9m nine minutes\n 1h one hour\n 1m3ms one minute and three milliseconds\n\nFor example,\n\n -o @2022-02-14:1h consume 1h of time on Valentine's Day 2022\n -o @-48h:-24h consume from 2 days ago to 1 day ago\n -o @-1m:end consume from 1m ago until now\n -o @:-1hr consume from the start until an hour ago\n\nCONNECTION BEHAVIOR\n\nBy default, 'rpk topic consume' runs continuously, waiting for new records to\narrive. It does not exit after consuming existing records. To stop consuming,\npress Ctrl+C. You can also use '--num' to exit after a fixed number of records,\nor use '--offset' to define a stop point (for example, '-o :end' stops at the\ncurrent log end).\n" + } + ], + "flagDataBackfilled": [ + { + "commandPath": "rpk ai agent a2a card", + "flagCount": 1 + }, + { + "commandPath": "rpk ai agent a2a send", + "flagCount": 5 + }, + { + "commandPath": "rpk ai agent a2a task cancel", + "flagCount": 1 + }, + { + "commandPath": "rpk ai agent a2a task get", + "flagCount": 2 + }, + { + "commandPath": "rpk ai agent a2a task watch", + "flagCount": 1 + }, + { + "commandPath": "rpk ai agent apply", + "flagCount": 1 + }, + { + "commandPath": "rpk ai agent create", + "flagCount": 10 + }, + { + "commandPath": "rpk ai agent credential create", + "flagCount": 2 + }, + { + "commandPath": "rpk ai agent diff", + "flagCount": 1 + }, + { + "commandPath": "rpk ai agent list", + "flagCount": 1 + }, + { + "commandPath": "rpk ai agent transcript list", + "flagCount": 5 + }, + { + "commandPath": "rpk ai agent update", + "flagCount": 8 + }, + { + "commandPath": "rpk ai auth login", + "flagCount": 1 + }, + { + "commandPath": "rpk ai auth logout", + "flagCount": 1 + }, + { + "commandPath": "rpk ai auth status", + "flagCount": 1 + }, + { + "commandPath": "rpk ai auth token", + "flagCount": 1 + }, + { + "commandPath": "rpk ai env add", + "flagCount": 5 + }, + { + "commandPath": "rpk ai env delete", + "flagCount": 1 + }, + { + "commandPath": "rpk ai env list", + "flagCount": 1 + }, + { + "commandPath": "rpk ai model get", + "flagCount": 1 + }, + { + "commandPath": "rpk ai model list", + "flagCount": 1 + }, + { + "commandPath": "rpk ai oauth-client apply", + "flagCount": 1 + }, + { + "commandPath": "rpk ai oauth-client create", + "flagCount": 10 + }, + { + "commandPath": "rpk ai oauth-client dcr iat mint", + "flagCount": 2 + }, + { + "commandPath": "rpk ai oauth-client dcr update", + "flagCount": 6 + }, + { + "commandPath": "rpk ai oauth-client diff", + "flagCount": 1 + }, + { + "commandPath": "rpk ai oauth-client list", + "flagCount": 5 + }, + { + "commandPath": "rpk ai oauth-provider apply", + "flagCount": 1 + }, + { + "commandPath": "rpk ai oauth-provider create", + "flagCount": 16 + }, + { + "commandPath": "rpk ai oauth-provider diff", + "flagCount": 1 + }, + { + "commandPath": "rpk ai oauth-provider list", + "flagCount": 5 + }, + { + "commandPath": "rpk ai oauth-provider update", + "flagCount": 16 + }, + { + "commandPath": "rpk ai run claude", + "flagCount": 6 + }, + { + "commandPath": "rpk ai run codex", + "flagCount": 6 + }, + { + "commandPath": "rpk connect agent init", + "flagCount": 1 + }, + { + "commandPath": "rpk connect agent run", + "flagCount": 4 + }, + { + "commandPath": "rpk connect blobl", + "flagCount": 7 + }, + { + "commandPath": "rpk connect blobl server", + "flagCount": 6 + }, + { + "commandPath": "rpk connect create", + "flagCount": 3 + }, + { + "commandPath": "rpk connect dry-run", + "flagCount": 4 + }, + { + "commandPath": "rpk connect echo", + "flagCount": 4 + }, + { + "commandPath": "rpk connect lint", + "flagCount": 7 + }, + { + "commandPath": "rpk connect list", + "flagCount": 3 + }, + { + "commandPath": "rpk connect mcp-server", + "flagCount": 8 + }, + { + "commandPath": "rpk connect mcp-server lint", + "flagCount": 6 + }, + { + "commandPath": "rpk connect plugin init", + "flagCount": 2 + }, + { + "commandPath": "rpk connect run", + "flagCount": 15 + }, + { + "commandPath": "rpk connect streams", + "flagCount": 18 + }, + { + "commandPath": "rpk connect template lint", + "flagCount": 3 + }, + { + "commandPath": "rpk connect test", + "flagCount": 5 + } + ] + } +} \ No newline at end of file diff --git a/docs-data/rpk-overrides.json b/docs-data/rpk-overrides.json index 44d4850e0d..d6d9d154a0 100644 --- a/docs-data/rpk-overrides.json +++ b/docs-data/rpk-overrides.json @@ -338,7 +338,7 @@ "flags": "g" }, { - "description": "Wrap bare flag with adjacent format/value word as inline code before auto-backtick step splits them (e.g. -f json -> `\u200c-f json`, --format yaml -> `--format yaml`)", + "description": "Wrap bare flag with adjacent format/value word as inline code before auto-backtick step splits them (e.g. -f json -> `‌-f json`, --format yaml -> `--format yaml`)", "pattern": "(? endpoint is reached with the same bearer token\nused by the rest of rpai; aigw resolves user-delegated OAuth tokens from the\nvault when the MCP server is configured with --user-oauth-provider.\n\nArguments passed to the tool are a JSON object supplied via --args. Example:\n\n rpai mcp tools call gf-servicenow-sand2 listtablerecords \\\n --args '{\"tableName\":\"incident\",\"sysparm_limit\":3}'\n\nWith --code-mode the call targets the virtual code-mode sibling endpoint\n(/mcp/v1/-code). That endpoint exposes search (tool catalog for the\nprimary) and execute (runs JavaScript in a sandbox with call_tool bound to\nthe primary's tools). Example:\n\n rpai mcp tools call pg-garrett execute --code-mode \\\n --args '{\"code\":\"var r = call_tool({name:\\\"query\\\", arguments:{query:\\\"SELECT 1\\\"}}); JSON.stringify(r);\"}'\n", + "usage": "rpk ai mcp-server tools call [flags]", + "aliases": [], + "flags": [ + { + "name": "args", + "type": "string", + "description": "JSON object of tool arguments, e.g. '{\"foo\":\"bar\"}'. Empty means no arguments." + }, + { + "name": "code-mode", + "type": "bool", + "description": "Target the virtual code-mode sibling endpoint (-code) instead of the primary." + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List tools on an MCP server by calling tools/list through the aigw MCP proxy.\n\nHits the server's /mcp/v1/ endpoint, so the same auth and token-vault\npath used by tools/call is exercised here. Useful for checking that a managed\nMCP's tool schema loaded correctly and that a user-delegated server is\nreachable with the caller's vault token.\n\nWith --code-mode the session targets the virtual code-mode sibling endpoint\n(/mcp/v1/-code), which exposes the sandbox meta-tools (search,\nexecute). To see the parent's tool catalog from the sandbox, invoke the\nsearch tool explicitly:\n\n rpai mcp tools call search --code-mode\n", + "usage": "rpk ai mcp-server tools list [flags]", + "aliases": [], + "flags": [ + { + "name": "code-mode", + "type": "bool", + "description": "Target the virtual code-mode sibling endpoint (-code) instead of the primary." + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "types", + "description": "List available managed MCP types", + "usage": "rpk ai mcp-server types [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "update", + "description": "Update an MCP server", + "usage": "rpk ai mcp-server update [flags]", + "aliases": [], + "flags": [ + { + "name": "enabled", + "type": "bool", + "description": "Whether this server is active and discoverable. (true when set; pass --enabled=false to disable)" + }, + { + "name": "description", + "type": "string", + "description": "Human-readable description shown in help text and UIs." + }, + { + "name": "code-mode", + "type": "bool", + "description": "Enable code mode: adds {name}_search and {name}_execute tools alongside existing tools. (true when set; pass --code-mode=false to disable)" + }, + { + "name": "data-policies", + "type": "stringArray", + "description": "Data policies shaping this server's tool calls (see MCPServer.data_policies). (repeatable; protojson object; replaces the full list on update)" + }, + { + "name": "response-format", + "type": "string", + "description": "Output format for tool results (token optimization). (one of: jton, toon)" + }, + { + "name": "remote.url", + "type": "string", + "description": "Endpoint URL of the remote MCP server. (required in its group) (alias: --url)" + }, + { + "name": "remote.transport", + "type": "string", + "description": "MCP transport protocol. SSE for server-sent events, Streamable HTTP for newer bidirectional protocol. (one of: sse, streamable-http; required in its group) (alias: --transport)" + }, + { + "name": "remote.none", + "type": "bool", + "description": "None. (selects this auth mode; takes no value)" + }, + { + "name": "remote.token-passthrough", + "type": "bool", + "description": "Token passthrough. (selects this auth mode; takes no value)" + }, + { + "name": "remote.static-key.key-secret-ref", + "type": "string", + "description": "Secret store reference for the API key. (required in its group)" + }, + { + "name": "remote.static-key.header-name", + "type": "string", + "description": "HTTP header name for the API key. Defaults to 'Authorization'." + }, + { + "name": "remote.service-account-oauth.client-id", + "type": "string", + "description": "OAuth client ID from the provider's developer console. (required in its group)" + }, + { + "name": "remote.service-account-oauth.client-secret-ref", + "type": "string", + "description": "Secret store reference for the OAuth client secret. (required in its group)" + }, + { + "name": "remote.service-account-oauth.token-url", + "type": "string", + "description": "OAuth token endpoint URL for exchanging credentials. (required in its group)" + }, + { + "name": "remote.service-account-oauth.scopes", + "type": "strings", + "description": "OAuth scopes to request when obtaining tokens. (repeatable; replaces the full list on update)" + }, + { + "name": "remote.user-oauth.provider-name", + "type": "string", + "description": "OAuth provider that manages tokens for this server's users. Leave empty to set OAuth up automatically from the server URL." + }, + { + "name": "remote.user-oauth.required-scopes", + "type": "strings", + "description": "Minimum OAuth scopes a user's connection must have. Insufficient scopes return a scope_upgrade_required error. (repeatable; replaces the full list on update)" + }, + { + "name": "remote.user-oauth.injection.header-name", + "type": "string", + "description": "HTTP header name for the token. Defaults to 'Authorization'." + }, + { + "name": "remote.user-oauth.injection.header-prefix", + "type": "string", + "description": "Value prefix before the token. Defaults to 'Bearer'. Set empty for no prefix." + }, + { + "name": "remote.user-oauth.client-id", + "type": "string", + "description": "OAuth client ID from the vendor console. Only for automatic setup of a server without dynamic client registration; leave empty otherwise." + }, + { + "name": "remote.user-oauth.client-secret-ref", + "type": "string", + "description": "Secret-store reference for the OAuth client secret (confidential apps only). Leave empty for public PKCE clients." + }, + { + "name": "remote.user-oauth.automatic-setup", + "type": "bool", + "description": "Ask the gateway to set OAuth up for this server instead of attaching an existing provider. (true when set; pass --remote.user-oauth.automatic-setup=false to disable)" + }, + { + "name": "managed.config", + "type": "types", + "description": "Type-specific configuration for the managed MCP server. (protojson with an \"@type\": a short type name (run the resource's types command) or a full type URL)" + }, + { + "name": "filename", + "type": "string", + "description": "manifest to update from (YAML or JSON; \"-\" for stdin); flags override file values", + "shorthand": "f" + }, + { + "name": "dry-run", + "type": "bool", + "description": "print the request that would be sent (with the computed update mask) and exit without calling the server" + }, + { + "name": "clear", + "type": "strings", + "description": "field paths to clear (added to the update mask with the field unset), e.g. --clear guardrail" + }, + { + "name": "update-mask", + "type": "strings", + "description": "override the inferred update mask with exactly these paths" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "model", + "description": "Discover the models the Redpanda AI gateway exposes.\n\nThe catalog is read-only; `model list` and `model get` are the only verbs. The\ncatalog is populated from each LLM provider's metadata plus any extras the\noperator has pinned to a tenant.\n\nAliases: `models`, `m`.\n\n\n\nThe catalog is read-only. The catalog is populated from each LLM provider's metadata plus any extras the operator has pinned to a tenant.", + "usage": "rpk ai model [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "get", + "description": "Get model details from the catalog", + "usage": "rpk ai model get [flags]", + "aliases": [], + "flags": [ + { + "name": "provider-type", + "type": "string", + "description": "provider type (for disambiguation when a model is exposed by multiple providers)" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List available models in the catalog", + "usage": "rpk ai model list [flags]", + "aliases": [], + "flags": [ + { + "name": "provider-type", + "type": "string", + "description": "filter by provider type (openai, openai-compatible, anthropic, google, bedrock)" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "oauth-client", + "description": "Manage OAuth clients registered with the AI gateway's OAuth Authorization Server. An OAuth client is an external tool (such as Claude AI, ChatGPT, or Cursor) that requests access tokens for an MCP server.", + "usage": "rpk ai oauth-client [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "apply", + "description": "Reconcile OAuth clients from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`.", + "usage": "rpk ai oauth-client apply [flags]", + "aliases": [], + "flags": [ + { + "name": "filename", + "type": "strings", + "description": "manifest file, directory, or - for stdin (repeatable)", + "shorthand": "f" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "create", + "description": "Register an OAuth client with the AI gateway. The generated client secret is printed once and cannot be retrieved afterward. Save it immediately in a secret manager.", + "usage": "rpk ai oauth-client create [flags]", + "aliases": [], + "flags": [ + { + "name": "display-name", + "type": "string", + "description": "Shown on the user consent page. Use the external tool's brand name." + }, + { + "name": "logo-uri", + "type": "string", + "description": "Logo URL displayed alongside the client name on the consent page. HTTPS only." + }, + { + "name": "redirect-uris", + "type": "strings", + "description": "Allowed redirect URIs (exact match, RFC 3986 normalized). No query or fragment components. (repeatable; replaces the full list on update)" + }, + { + "name": "allowed-resources", + "type": "strings", + "description": "MCP URLs this client may request tokens for. Use \"*\" to allow any MCP on this gateway. (repeatable; replaces the full list on update)" + }, + { + "name": "grant-types", + "type": "strings", + "description": "OAuth grant types this client may use. Authorization Code + Refresh Token is the standard combination. (one of: oauth-client-grant-type-authorization-code, oauth-client-grant-type-refresh-token; repeatable; replaces the full list on update)" + }, + { + "name": "token-endpoint-auth-method", + "type": "string", + "description": "How the client authenticates to the token endpoint. Phase 1 supports client_secret_basic and client_secret_post. (one of: oauth-client-token-endpoint-auth-method-client-secret-basic, oauth-client-token-endpoint-auth-method-client-secret-post, oauth-client-token-endpoint-auth-method-none)" + }, + { + "name": "pkce-required", + "type": "bool", + "description": "Require PKCE (RFC 7636) on authorization requests. Strongly recommended and enforced by default. (true when set; pass --pkce-required=false to disable)" + }, + { + "name": "enabled", + "type": "bool", + "description": "Whether this client may request new tokens. Disabled clients are rejected at the authorize endpoint. (true when set; pass --enabled=false to disable)" + }, + { + "name": "filename", + "type": "string", + "description": "manifest to create from (YAML or JSON; \"-\" for stdin); flags override file values", + "shorthand": "f" + }, + { + "name": "dry-run", + "type": "bool", + "description": "print the request that would be sent (with the computed update mask) and exit without calling the server" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "dcr", + "description": "Manage Dynamic Client Registration (DCR) settings for the AI gateway. DCR allows OAuth clients to register themselves programmatically at a public endpoint.", + "usage": "rpk ai oauth-client dcr [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "get", + "description": "Show the Dynamic Client Registration (DCR) settings for the current tenant, including whether DCR is enabled and the configured admission mode.", + "usage": "rpk ai oauth-client dcr get [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "iat", + "description": "Manage Initial Access Tokens (IATs): one-shot bearer credentials a\ncaller presents to the public registration endpoint when the tenant's\nadmission mode is initial-access-token. The plaintext is printed\nexactly once on mint; only a hash is stored.", + "usage": "rpk ai oauth-client dcr iat [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "list", + "description": "List Initial Access Tokens (plaintext is never shown)", + "usage": "rpk ai oauth-client dcr iat list [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "mint", + "description": "Mint a one-shot Initial Access Token for use at the OAuth client registration endpoint. The token plaintext is printed once and only a hash is stored.", + "usage": "rpk ai oauth-client dcr iat mint [flags]", + "aliases": [], + "flags": [ + { + "name": "label", + "type": "string", + "description": "human-readable label shown in the IAT list (recommended)" + }, + { + "name": "ttl", + "type": "duration", + "description": "validity window, e.g. 1h, 24h, 168h (0 = server default of 1h; ceiling 720h)" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "revoke", + "description": "Revoke an unconsumed Initial Access Token so it can no longer be\nexchanged at the registration endpoint. Idempotent: revoking an\nalready-revoked or consumed token returns 0.", + "usage": "rpk ai oauth-client dcr iat revoke [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "update", + "description": "Update the tenant's DCR settings. Only the flags you pass change;\neverything else keeps its current value (the CLI reads the current\nsettings and writes back the merged result).\n\nEnable open self-registration:\n\n rpai oauth-client dcr update --enabled --admission-mode open\n\nRequire admin-minted Initial Access Tokens instead:\n\n rpai oauth-client dcr update --admission-mode initial-access-token\n\nTurn the endpoint off again:\n\n rpai oauth-client dcr update --enabled=false", + "usage": "rpk ai oauth-client dcr update [flags]", + "aliases": [], + "flags": [ + { + "name": "admission-mode", + "type": "string", + "description": "how callers are admitted: open, initial-access-token" + }, + { + "name": "allowed-resource", + "type": "strings", + "description": "MCP URL every DCR-issued client may request tokens for; \"*\" = any. repeatable" + }, + { + "name": "client-cap", + "type": "int32", + "description": "max concurrent DCR-issued clients (0 = runtime default)" + }, + { + "name": "enabled", + "type": "bool", + "description": "whether the public registration endpoint accepts requests" + }, + { + "name": "inactive-ttl-days", + "type": "int32", + "description": "days of inactivity before a DCR client is removed (0 = never)" + }, + { + "name": "rate-per-hour", + "type": "int32", + "description": "max registrations per hour (0 = runtime default)" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "delete", + "description": "Delete an OAuth client", + "usage": "rpk ai oauth-client delete [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "diff", + "description": "Dry-run of apply for OAuth clients. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "usage": "rpk ai oauth-client diff [flags]", + "aliases": [], + "flags": [ + { + "name": "filename", + "type": "strings", + "description": "manifest file, directory, or - for stdin (repeatable)", + "shorthand": "f" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "get", + "description": "Get an OAuth client", + "usage": "rpk ai oauth-client get [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List OAuth clients", + "usage": "rpk ai oauth-client list [flags]", + "aliases": [], + "flags": [ + { + "name": "name-contains", + "type": "string", + "description": "Name contains." + }, + { + "name": "filter", + "type": "string", + "description": "AIP-160 filter expression (https://google.aip.dev/160)." + }, + { + "name": "page-size", + "type": "int32", + "description": "Page size." + }, + { + "name": "page-token", + "type": "string", + "description": "Page token." + }, + { + "name": "order-by", + "type": "string", + "description": "AIP-132 order: a comma-separated list of fields, each optionally suffixed with \" desc\" (default ascending), e.g." + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "revoke-tokens", + "description": "Revoke every refresh token the AI gateway has issued for the named OAuth client. Forces all users who connected this client to sign in again.", + "usage": "rpk ai oauth-client revoke-tokens [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "update", + "description": "Update an OAuth client", + "usage": "rpk ai oauth-client update [flags]", + "aliases": [], + "flags": [ + { + "name": "display-name", + "type": "string", + "description": "Shown on the user consent page. Use the external tool's brand name." + }, + { + "name": "logo-uri", + "type": "string", + "description": "Logo URL displayed alongside the client name on the consent page. HTTPS only." + }, + { + "name": "redirect-uris", + "type": "strings", + "description": "Allowed redirect URIs (exact match, RFC 3986 normalized). No query or fragment components. (repeatable; replaces the full list on update)" + }, + { + "name": "allowed-resources", + "type": "strings", + "description": "MCP URLs this client may request tokens for. Use \"*\" to allow any MCP on this gateway. (repeatable; replaces the full list on update)" + }, + { + "name": "grant-types", + "type": "strings", + "description": "OAuth grant types this client may use. Authorization Code + Refresh Token is the standard combination. (one of: oauth-client-grant-type-authorization-code, oauth-client-grant-type-refresh-token; repeatable; replaces the full list on update)" + }, + { + "name": "token-endpoint-auth-method", + "type": "string", + "description": "How the client authenticates to the token endpoint. Phase 1 supports client_secret_basic and client_secret_post. (one of: oauth-client-token-endpoint-auth-method-client-secret-basic, oauth-client-token-endpoint-auth-method-client-secret-post, oauth-client-token-endpoint-auth-method-none)" + }, + { + "name": "pkce-required", + "type": "bool", + "description": "Require PKCE (RFC 7636) on authorization requests. Strongly recommended and enforced by default. (true when set; pass --pkce-required=false to disable)" + }, + { + "name": "enabled", + "type": "bool", + "description": "Whether this client may request new tokens. Disabled clients are rejected at the authorize endpoint. (true when set; pass --enabled=false to disable)" + }, + { + "name": "filename", + "type": "string", + "description": "manifest to update from (YAML or JSON; \"-\" for stdin); flags override file values", + "shorthand": "f" + }, + { + "name": "dry-run", + "type": "bool", + "description": "print the request that would be sent (with the computed update mask) and exit without calling the server" + }, + { + "name": "clear", + "type": "strings", + "description": "field paths to clear (added to the update mask with the field unset), e.g. --clear guardrail" + }, + { + "name": "update-mask", + "type": "strings", + "description": "override the inferred update mask with exactly these paths" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "oauth-provider", + "description": "Manage OAuth authorization-server configurations registered with the Redpanda AI gateway. OAuth providers describe third-party authorization servers that user-facing MCP servers can authenticate against via the device-consent flow.", + "usage": "rpk ai oauth-provider [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "apply", + "description": "Reconcile OAuth providers from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`.", + "usage": "rpk ai oauth-provider apply [flags]", + "aliases": [], + "flags": [ + { + "name": "filename", + "type": "strings", + "description": "manifest file, directory, or - for stdin (repeatable)", + "shorthand": "f" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "create", + "description": "Create an OAuth provider.", + "usage": "rpk ai oauth-provider create [flags]", + "aliases": [], + "flags": [ + { + "name": "display-name", + "type": "string", + "description": "Shown to users when selecting this provider. Use the provider's brand name." + }, + { + "name": "authorization-endpoint", + "type": "string", + "description": "The URL where users are redirected to grant consent. Found in your provider's OAuth documentation." + }, + { + "name": "token-endpoint", + "type": "string", + "description": "The URL where the gateway exchanges authorization codes for access tokens." + }, + { + "name": "revocation-endpoint", + "type": "string", + "description": "Optional. Called when a user disconnects. Not all providers support token revocation." + }, + { + "name": "client-id", + "type": "string", + "description": "OAuth client ID from the provider's developer console. Omit when using register_from_url (it is discovered and registered automatically)." + }, + { + "name": "client-secret-ref", + "type": "string", + "description": "Reference to a secret stored in the secret store. Not required for public clients using PKCE." + }, + { + "name": "scopes", + "type": "strings", + "description": "OAuth scopes determine what data and actions the token grants access to. Set to the union of all scopes needed across MCP servers to avoid re-consent. (repeatable; replaces the full list on update)" + }, + { + "name": "grant-types", + "type": "strings", + "description": "Select at least one grant type. Browser Consent is the standard OAuth 2.0 flow. Token Exchange enables server-to-server delegation. (one of: oauth-grant-type-browser-consent, oauth-grant-type-token-exchange; repeatable; replaces the full list on update)" + }, + { + "name": "pkce-required", + "type": "bool", + "description": "Proof Key for Code Exchange adds a challenge to the authorization flow, preventing code interception attacks. Recommended for all providers. (true when set; pass --pkce-required=false to disable)" + }, + { + "name": "token-endpoint-auth-method", + "type": "string", + "description": "How the gateway authenticates when exchanging codes for tokens. Check your provider's documentation for the supported method. (one of: oauth-token-endpoint-auth-method-client-secret-basic, oauth-token-endpoint-auth-method-client-secret-post, oauth-token-endpoint-auth-method-none)" + }, + { + "name": "extra-auth-params", + "type": "stringArray", + "description": "Additional query parameters appended to the authorization URL. (repeatable key=value; replaces the full map on update)" + }, + { + "name": "extra-token-params", + "type": "stringArray", + "description": "Additional parameters sent in the token exchange request body. (repeatable key=value; replaces the full map on update)" + }, + { + "name": "enabled", + "type": "bool", + "description": "Whether this provider accepts new connections. (true when set; pass --enabled=false to disable)" + }, + { + "name": "register-from-url", + "type": "string", + "description": "Remote MCP server URL to auto-detect OAuth from. The gateway discovers endpoints and registers a client automatically." + }, + { + "name": "filename", + "type": "string", + "description": "manifest to create from (YAML or JSON; \"-\" for stdin); flags override file values", + "shorthand": "f" + }, + { + "name": "dry-run", + "type": "bool", + "description": "print the request that would be sent (with the computed update mask) and exit without calling the server" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "delete", + "description": "Delete an OAuth provider", + "usage": "rpk ai oauth-provider delete [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "diff", + "description": "Dry-run of apply for OAuth providers. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "usage": "rpk ai oauth-provider diff [flags]", + "aliases": [], + "flags": [ + { + "name": "filename", + "type": "strings", + "description": "manifest file, directory, or - for stdin (repeatable)", + "shorthand": "f" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "get", + "description": "Get an OAuth provider", + "usage": "rpk ai oauth-provider get [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List OAuth providers", + "usage": "rpk ai oauth-provider list [flags]", + "aliases": [], + "flags": [ + { + "name": "name-contains", + "type": "string", + "description": "Name contains." + }, + { + "name": "filter", + "type": "string", + "description": "AIP-160 filter expression (https://google.aip.dev/160)." + }, + { + "name": "page-size", + "type": "int32", + "description": "Page size." + }, + { + "name": "page-token", + "type": "string", + "description": "Page token." + }, + { + "name": "order-by", + "type": "string", + "description": "AIP-132 order: a comma-separated list of fields, each optionally suffixed with \" desc\" (default ascending), e.g." + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "update", + "description": "Update an OAuth provider", + "usage": "rpk ai oauth-provider update [flags]", + "aliases": [], + "flags": [ + { + "name": "display-name", + "type": "string", + "description": "Shown to users when selecting this provider. Use the provider's brand name." + }, + { + "name": "authorization-endpoint", + "type": "string", + "description": "The URL where users are redirected to grant consent. Found in your provider's OAuth documentation." + }, + { + "name": "token-endpoint", + "type": "string", + "description": "The URL where the gateway exchanges authorization codes for access tokens." + }, + { + "name": "revocation-endpoint", + "type": "string", + "description": "Optional. Called when a user disconnects. Not all providers support token revocation." + }, + { + "name": "client-secret-ref", + "type": "string", + "description": "Reference to a secret stored in the secret store. Not required for public clients using PKCE." + }, + { + "name": "scopes", + "type": "strings", + "description": "OAuth scopes determine what data and actions the token grants access to. Set to the union of all scopes needed across MCP servers to avoid re-consent. (repeatable; replaces the full list on update)" + }, + { + "name": "grant-types", + "type": "strings", + "description": "Select at least one grant type. Browser Consent is the standard OAuth 2.0 flow. Token Exchange enables server-to-server delegation. (one of: oauth-grant-type-browser-consent, oauth-grant-type-token-exchange; repeatable; replaces the full list on update)" + }, + { + "name": "pkce-required", + "type": "bool", + "description": "Proof Key for Code Exchange adds a challenge to the authorization flow, preventing code interception attacks. Recommended for all providers. (true when set; pass --pkce-required=false to disable)" + }, + { + "name": "token-endpoint-auth-method", + "type": "string", + "description": "How the gateway authenticates when exchanging codes for tokens. Check your provider's documentation for the supported method. (one of: oauth-token-endpoint-auth-method-client-secret-basic, oauth-token-endpoint-auth-method-client-secret-post, oauth-token-endpoint-auth-method-none)" + }, + { + "name": "extra-auth-params", + "type": "stringArray", + "description": "Additional query parameters appended to the authorization URL. (repeatable key=value; replaces the full map on update)" + }, + { + "name": "extra-token-params", + "type": "stringArray", + "description": "Additional parameters sent in the token exchange request body. (repeatable key=value; replaces the full map on update)" + }, + { + "name": "enabled", + "type": "bool", + "description": "Whether this provider accepts new connections. (true when set; pass --enabled=false to disable)" + }, + { + "name": "filename", + "type": "string", + "description": "manifest to update from (YAML or JSON; \"-\" for stdin); flags override file values", + "shorthand": "f" + }, + { + "name": "dry-run", + "type": "bool", + "description": "print the request that would be sent (with the computed update mask) and exit without calling the server" + }, + { + "name": "clear", + "type": "strings", + "description": "field paths to clear (added to the update mask with the field unset), e.g. --clear guardrail" + }, + { + "name": "update-mask", + "type": "strings", + "description": "override the inferred update mask with exactly these paths" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "policy", + "description": "Manage Cedar authorization policies (create, get, list, update, delete)", + "usage": "rpk ai policy [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "apply", + "description": "Reconcile policies from one or more YAML manifests.\n\nFor each manifest: create the resource if absent, otherwise update only the\nfields that are present in the manifest AND differ from the live resource.\nFields you omit are left untouched; to clear a field, write it explicitly.\nLists, maps and oneof variants replace wholesale. Fields that can only be set\nat creation time are immutable; changing one is an error.\n\nManifests round-trip with `get -o yaml` for this resource. Pass -f - to\nread stdin.\n\nThis does not delete resources absent from the manifests (no prune), and drift\nis detected only for the fields a manifest names; see `diff --help`.", + "usage": "rpk ai policy apply [flags]", + "aliases": [], + "flags": [ + { + "name": "filename", + "type": "strings", + "description": "manifest file, directory, or - for stdin (repeatable)", + "shorthand": "f" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "create", + "description": "Create a Cedar authorization policy: the allow/deny gate that\ndecides WHETHER a principal may call a tool.\n\nThe Cedar body must contain exactly one statement; scope the resource\nto your MCP server, e.g.:\n\n permit(principal, action == Action::\"dataplane_adp_mcpserver_tools_call\",\n resource == McpServer::\"servicenow\");\n\nData shaping (masking, dropping, row filtering) is NOT configured here.\nIt lives on the MCP server's data policies (rpai mcp ...), not in Cedar\ntext; the @redact_mask / @redact_drop annotations are gone.", + "usage": "rpk ai policy create [flags]", + "aliases": [], + "flags": [ + { + "name": "cedar", + "type": "string", + "description": "inline Cedar policy text. Mutually exclusive with --cedar-file." + }, + { + "name": "cedar-file", + "type": "string", + "description": "path to a file containing the Cedar policy text (.cedar). Mutually exclusive with --cedar." + }, + { + "name": "description", + "type": "string", + "description": "human-readable description" + }, + { + "name": "display-name", + "type": "string", + "description": "human-readable display name" + }, + { + "name": "name", + "type": "string", + "description": "policy id (required; lowercase letters, numbers, hyphens)" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "delete", + "description": "Delete a policy", + "usage": "rpk ai policy delete [flags]", + "aliases": [], + "flags": [ + { + "name": "etag", + "type": "string", + "description": "optional etag for optimistic concurrency; delete fails if it no longer matches" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "diff", + "description": "Dry-run of apply for policies. Prints, per manifest, whether apply would\ncreate, update (and which fields), or leave the resource unchanged. Exits\nnon-zero when any change is pending, so CI can gate on \"no drift\".\n\nNote: diff proves only that the fields a manifest names match live. It does not\ndetect resources that exist live but are absent from the manifests (no prune),\nnor drift in fields a manifest omits.", + "usage": "rpk ai policy diff [flags]", + "aliases": [], + "flags": [ + { + "name": "filename", + "type": "strings", + "description": "manifest file, directory, or - for stdin (repeatable)", + "shorthand": "f" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "get", + "description": "Get a policy", + "usage": "rpk ai policy get [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List policies", + "usage": "rpk ai policy list [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "update", + "description": "Update a policy in place. Only the flags you pass are written; the\nfield mask is built from the flags actually set, so omitted fields are\nleft untouched.", + "usage": "rpk ai policy update [flags]", + "aliases": [], + "flags": [ + { + "name": "cedar", + "type": "string", + "description": "inline Cedar policy text. Mutually exclusive with --cedar-file." + }, + { + "name": "cedar-file", + "type": "string", + "description": "path to a file containing the Cedar policy text (.cedar). Mutually exclusive with --cedar." + }, + { + "name": "description", + "type": "string", + "description": "new description" + }, + { + "name": "display-name", + "type": "string", + "description": "new display name" + }, + { + "name": "etag", + "type": "string", + "description": "optional etag for optimistic concurrency" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "run", + "description": "Launch a third-party coding agent configured to send its model traffic\nthrough the Redpanda AI gateway for the current environment, reusing rpai's\nlogin and auto-refreshing token.", + "usage": "rpk ai run [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "claude", + "description": "Launch Anthropic's Claude Code CLI with its model traffic\nrouted through the Redpanda AI gateway for the current rpai environment.\n\nrpai points ANTHROPIC_BASE_URL at the gateway's Anthropic Messages endpoint for\nthe chosen provider and wires the gateway auth for the life of the session. No\ntoken is ever written to disk.\n\nBoth auth modes run in your REAL Claude Code config home, so your workspace\ntrust, onboarding, theme, and MCP servers all apply. rpai writes nothing into\n~/.claude in either mode:\n\n - managed (api key): the gateway apiKeyHelper (`rpai auth token`, which Claude\n Code re-runs to refresh the bearer; aigw injects the upstream Anthropic key)\n is passed via `claude --settings` as a JSON string; off disk, merged on top\n of your settings, your ~/.claude/settings.json untouched.\n - passthrough (enterprise/Max subscription): your existing subscription login\n (stored under your config home) is used. rpai only sets the gateway base URL\n and the X-Redpanda-Cloud-Token header (minted fresh at launch) in the\n environment; your subscription OAuth flows through aigw to Anthropic untouched.\n\nPass --claude-config-dir to run against an isolated config home instead of your\nreal one (rpai still never writes into it).\n\nIn passthrough mode the X-Redpanda-Cloud-Token gateway JWT is set in the\nlaunched process environment, so Claude Code's tool subprocesses (Bash, hooks,\nMCP) inherit it; the same Redpanda Cloud token any process running as you can\nalready mint with `rpai auth token`, and Claude Code has no documented mechanism\nto scrub it from those subprocesses.\n\nBecause passthrough uses your real config home, any auth configured in your\n~/.claude/settings.json (an apiKeyHelper, or env.ANTHROPIC_AUTH_TOKEN) still\napplies and outranks the subscription OAuth aigw needs to relay; rpai scrubs\nonly the inherited shell env, not your on-disk settings.\n\nAnthropic and Bedrock providers are supported. A bedrock provider launches\nClaude Code in its native Bedrock mode pointed at the same gateway prefix; aigw\nsigns the upstream call with the provider's AWS credentials (SigV4), so no AWS\nkeys ever reach your machine and the managed apiKeyHelper auth works exactly as\nabove (passthrough does not apply; there is no Bedrock analog of a Claude\nsubscription). Pass -m an inference-profile id from the provider's model\nallowlist (Bedrock Anthropic models 4.6+ carry a us./eu./apac./global. prefix).\nClaude Code's background (small/fast) model defaults to a Haiku-class inference\nprofile in Bedrock mode; if the provider's allowlist doesn't include it, export\nANTHROPIC_SMALL_FAST_MODEL with an allowlisted id.\n\nPass Claude Code's own flags after a literal --:\n\n rpai run claude -L anthropic -m claude-sonnet-4-6 -- --permission-mode plan\n rpai run claude -L bedrock -m us.anthropic.claude-sonnet-4-6 -- -p \"hi\"", + "usage": "rpk ai run claude [flags]", + "aliases": [], + "flags": [ + { + "name": "bedrock", + "type": "bool", + "description": "force bedrock mode. Only needed when you have invoke-only access and rpai can't read the provider to detect its type; when the provider can be read, its own type wins" + }, + { + "name": "claude-config-dir", + "type": "string", + "description": "run against this CLAUDE_CONFIG_DIR instead of your real/inherited config home (rpai never writes into it; the managed apiKeyHelper rides in --settings). Default: your real home, so trust/onboarding/theme/MCP all apply" + }, + { + "name": "llmprovider", + "type": "string", + "description": "aigw LLM provider name to route through (an anthropic or bedrock provider)", + "shorthand": "L" + }, + { + "name": "model", + "type": "string", + "description": "model id to use (must be in the provider's allowlist; for bedrock providers an inference-profile id like us.anthropic.claude-sonnet-4-6); omit to let Claude Code pick its default", + "shorthand": "m" + }, + { + "name": "passthrough", + "type": "bool", + "description": "force passthrough (enterprise/subscription) auth mode. Only needed when you have invoke-only access and rpai can't read the provider to detect the mode; when the provider can be read, its own setting wins" + }, + { + "name": "print-settings", + "type": "bool", + "description": "print the generated Claude Code settings.json plus launch env, then exit (no claude needed; the provider type/mode resolve via a best-effort gateway lookup; offline the dump falls back to the managed anthropic shape, or bedrock with --bedrock)" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "codex", + "description": "Launch the OpenAI Codex CLI with its model traffic routed\nthrough the Redpanda AI gateway for the current rpai environment.\n\nrpai generates a throwaway Codex config in a temporary CODEX_HOME, points it at\nthe gateway's OpenAI-compatible Responses endpoint for the chosen provider, and\nwires Codex's bearer to `rpai auth token` so it refreshes itself for the\nlife of the session. Your own ~/.codex config is never read or modified, and no\ntoken is written to disk.\n\nThe launch directory is auto-trusted under a workspace-write sandbox\n(approval_policy=on-request) so the fresh CODEX_HOME doesn't prompt for trust on\nevery run; pass --no-auto-trust to keep Codex's normal first-run trust prompt.\n\nOnly openai / openai_compatible providers are supported (Codex speaks the OpenAI\nResponses API). Pass Codex's own flags after a literal --:\n\n rpai run codex -L openai -m gpt-5.3-codex -e high -- --ask-for-approval never", + "usage": "rpk ai run codex [flags]", + "aliases": [], + "flags": [ + { + "name": "codex-home", + "type": "string", + "description": "persistent CODEX_HOME dir (default: a throwaway temp dir); its config.toml is regenerated each run and the dir is tightened to 0700; your real ~/.codex is refused" + }, + { + "name": "effort", + "type": "string", + "description": "model reasoning effort: minimal|low|medium|high (omit to let Codex use its default)", + "shorthand": "e" + }, + { + "name": "llmprovider", + "type": "string", + "description": "aigw LLM provider name to route through (must be openai/openai_compatible)", + "shorthand": "L" + }, + { + "name": "model", + "type": "string", + "description": "model id to use (must be in the provider's allowlist); omit to let Codex pick its default", + "shorthand": "m" + }, + { + "name": "no-auto-trust", + "type": "bool", + "description": "do not pre-trust the launch directory; let Codex show its normal first-run trust prompt instead (default: the launch dir is auto-trusted under a workspace-write sandbox)" + }, + { + "name": "print-config", + "type": "bool", + "description": "print the generated Codex config.toml and exit (no gateway call, no codex needed)" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "uninstall", + "description": "Uninstall the Redpanda AI CLI", + "usage": "rpk ai uninstall [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "upgrade", + "description": "Upgrade to the latest Redpanda AI CLI version", + "usage": "rpk ai upgrade [flags]", + "aliases": [], + "flags": [ + { + "name": "no-confirm", + "type": "bool", + "description": "Disable confirmation prompt for major version upgrades", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "version", + "description": "Print rpai version and commit", + "usage": "rpk ai version [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "agentic-cluster-note", + "position": "after_header", + "content": "include::partial$rpk-ai-agentic-cluster.adoc[]" + } + ] + }, + { + "name": "check", + "description": "Run production readiness checks for a Redpanda deployment", + "usage": "rpk check [flags]", + "aliases": [], + "flags": [ + { + "name": "version", + "type": "bool", + "description": "Print the installed redpanda-check plugin version", + "default": false, + "required": false + } + ], + "commands": [ + { + "name": "install", + "description": "Install Redpanda Check.\n\nThis command installs the latest version by default.\n\nAlternatively, you may specify a version using the `--check-version` flag.\n\nYou may force the installation using the `--force` flag.", + "usage": "rpk check install [flags]", + "aliases": [], + "flags": [ + { + "name": "check-version", + "type": "string", + "description": "Redpanda Check version to install (e.g. 0.1.0)", + "default": "latest", + "required": false + }, + { + "name": "force", + "type": "bool", + "description": "Force install of Redpanda Check", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "uninstall", + "description": "Uninstall the Redpanda Check plugin", + "usage": "rpk check uninstall [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "upgrade", + "description": "Upgrade to the latest Redpanda Check version", + "usage": "rpk check upgrade [flags]", + "aliases": [], + "flags": [ + { + "name": "no-confirm", + "type": "bool", + "description": "Disable confirmation prompt for major version upgrades", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "cloud", + "description": "Interact with Redpanda cloud", + "usage": "rpk cloud [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "auth", + "description": "Manage rpk cloud authentications.\n\nAn rpk cloud authentication allows you to talk to Redpanda Cloud. Most likely,\nyou will only ever need to use a single SSO based login and you will not need\nthis command space. Multiple authentications can be useful if you have multiple\nRedpanda Cloud accounts for different organizations and want to swap between\nthem, or if you use SSO as well as client credentials. It is recommended to\nonly use a single SSO based login.\n", + "usage": "rpk cloud auth [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "delete", + "description": "Delete an rpk cloud authentication.\n\nDeleting a cloud authentication removes it from the rpk.yaml file. If the\ndeleted auth was the current authentication, rpk will use a default SSO auth the\nnext time you try to login and save that auth.\n\nIf you delete an authentication that is used by profiles, affected profiles have\ntheir authentication cleared and you will only be able to access the profile's\ncluster using SASL credentials.\n", + "usage": "rpk cloud auth delete [NAME] [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List rpk cloud authentications", + "usage": "rpk cloud auth list [flags]", + "aliases": [ + "ls" + ], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "token", + "description": "Print the cloud auth token of the current profile.\n\nThis command prints the auth token for the currently selected cloud\nauthentication to stdout. This is useful for piping the token into other\ncommands or scripts that need to authenticate with Redpanda Cloud.", + "usage": "rpk cloud auth token [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "use", + "description": "Select the rpk cloud authentication to use.\n\nThis swaps the current cloud authentication to the specified cloud\nauthentication. If your current profile is a cloud profile, this unsets the\ncurrent profile (since the authentication is now different). If your current\nprofile is for a self hosted cluster, the profile is kept.\n", + "usage": "rpk cloud auth use [NAME] [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "byoc", + "description": "Manage a Redpanda cloud BYOC agent\n\nFor BYOC, Redpanda installs an agent service in your owned cluster. The agent\nthen proceeds to provision further infrastructure and eventually, a full\nRedpanda cluster.\n\nThe BYOC command runs Terraform to create and start the agent. You first need\na redpanda-id (or cluster ID); this is used to get the details of how your\nagent should be provisioned. You can create a BYOC cluster in our cloud UI\nand then come back to this command to complete the process.\n", + "usage": "rpk cloud byoc [flags]", + "aliases": [], + "flags": [ + { + "name": "client-id", + "type": "string", + "description": "The client ID of the organization in Redpanda Cloud", + "default": "", + "required": false + }, + { + "name": "client-secret", + "type": "string", + "description": "The client secret of the organization in Redpanda Cloud", + "default": "", + "required": false + }, + { + "name": "redpanda-id", + "type": "string", + "description": "The redpanda ID of the cluster you are creating", + "default": "", + "required": false + } + ], + "commands": [ + { + "name": "install", + "description": "Install the BYOC plugin\n\nThis command downloads the BYOC managed plugin if necessary. The plugin is\ninstalled by default if you try to run a non-install command, but this command\nexists if you want to download the plugin ahead of time.\n", + "usage": "rpk cloud byoc install [flags]", + "aliases": [], + "flags": [ + { + "name": "redpanda-id", + "type": "string", + "description": "The redpanda ID of the cluster you are creating", + "default": "", + "required": true + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "example", + "title": "Example", + "position": "after_description", + "headingLevel": 2, + "content": "[,bash]\n----\nrpk cloud byoc install -X cloud.client_id= -X cloud.client_secret=\n----" + } + ] + }, + { + "name": "uninstall", + "description": "Uninstall the BYOC plugin\n\nThis command deletes your locally downloaded BYOC managed plugin if it exists.\nOften, you only need to download the plugin to create your cluster once, and\nthen you never need the plugin again. You can uninstall to save a small bit of\ndisk space.\n", + "usage": "rpk cloud byoc uninstall [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "cluster", + "description": "Manage rpk cloud clusters.\n\nThis command allows you to manage cloud clusters, as well as easily switch\nbetween which cluster you are talking to.\n", + "usage": "rpk cloud cluster [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "select", + "description": "Update your rpk profile to talk to the requested cluster.\n\nThis command is essentially an alias for the following command:\n\n rpk profile create --from-cloud=${NAME}\n\nIf you want to name this profile rather than creating or updating values in\nthe default cloud-dedicated profile, you can use the --profile flag.\n\nFor serverless clusters that support both public and private networking, you\nwill be prompted to select a network type unless you specify --serverless-network.\nTo avoid prompts in automation, explicitly set --serverless-network to 'public'\nor 'private'.\n", + "usage": "rpk cloud cluster select [NAME] [flags]", + "aliases": [ + "use" + ], + "flags": [ + { + "name": "profile", + "type": "string", + "description": "Name of a profile to create or update (avoids updating `rpk-cloud`).", + "default": "", + "required": false + }, + { + "name": "serverless-network", + "type": "string", + "description": "Networking type for serverless clusters: 'public' or 'private' (if not specified, will prompt if both are available)", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "login", + "description": "Log in to the Redpanda cloud\n\nThis command checks for an existing Redpanda Cloud API token and, if present, \nensures it is still valid. If no token is found or the token is no longer valid, \nthis command will login and save your token along with the client ID used to \nrequest the token.\n\nYou may use either SSO or client credentials to log in.\n\nSSO\n\nThis will automatically launch your default web browser and prompt you to \nauthenticate via our Redpanda Cloud page. Once you have successfully \nauthenticated, you will be ready to use rpk cloud commands.\n\nYou may opt out of auto-opening the browser by passing the '--no-browser' flag.\n\nCLIENT CREDENTIALS\n\nCloud client credentials can be used to login to Redpanda, they can be created \nin the Clients tab of the Users section in the Redpanda Cloud online interface. \nclient credentials can be provided in three ways, in order of preference:\n\n* In your rpk cloud auth, 'client_id' and 'client_secret' fields\n* Through RPK_CLOUD_CLIENT_ID and RPK_CLOUD_CLIENT_SECRET environment variables\n* Through the --client-id and --client-secret flags\n\nIf none of these are provided, rpk will use the SSO method to login. \nIf you specify environment variables or flags, they will not be synced to the\nrpk.yaml file unless the --save flag is passed. The cloud authorization \ntoken and client ID is always synced.\n", + "usage": "rpk cloud login [flags]", + "aliases": [], + "flags": [ + { + "name": "client-id", + "type": "string", + "description": "The client ID of the organization in Redpanda Cloud", + "default": "", + "required": false + }, + { + "name": "client-secret", + "type": "string", + "description": "The client secret of the organization in Redpanda Cloud", + "default": "", + "required": false + }, + { + "name": "no-browser", + "type": "bool", + "description": "Opt out of auto-opening authentication URL", + "default": false, + "required": false + }, + { + "name": "no-profile", + "type": "bool", + "description": "Skip automatic profile creation and any associated prompts", + "default": false, + "required": false + }, + { + "name": "save", + "type": "bool", + "description": "Save environment or flag specified client ID and client secret to the configuration file", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "logout", + "description": "Log out from Redpanda cloud\n\nThis command deletes your cloud auth token. If you want to log out entirely and\nswitch to a different organization, you can use the --clear-credentials flag to\nadditionally clear your client ID and client secret.\n\nYou can use the --all flag to log out of all organizations you may be logged\ninto.\n", + "usage": "rpk cloud logout [flags]", + "aliases": [], + "flags": [ + { + "name": "all", + "shorthand": "a", + "type": "bool", + "description": "Log out of all organizations you may be logged into, rather than just the current auth's organization", + "default": false, + "required": false + }, + { + "name": "clear-credentials", + "shorthand": "c", + "type": "bool", + "description": "Clear the client ID and client secret in addition to the auth token", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "mcp", + "description": "Manage Redpanda Cloud MCP server", + "usage": "rpk cloud mcp [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "install", + "description": "Install the MCP client configuration to connect your AI assistant to the local MCP server for Redpanda Cloud.\n\nThis command generates and installs the necessary configuration files for your MCP client (like Claude Code) to automatically connect to the local MCP server for Redpanda Cloud. The local MCP server provides your AI assistant with tools to manage your Redpanda Cloud account and clusters.\n\nSupports Claude Desktop and Claude Code.", + "usage": "rpk cloud mcp install [flags]", + "aliases": [], + "flags": [ + { + "name": "allow-delete", + "type": "bool", + "description": "Allow delete RPCs", + "default": false, + "required": false + }, + { + "name": "client", + "type": "string", + "description": "Name of the MCP client to configure. Supported values: `claude` or `claude-code`.", + "default": "claude", + "required": true + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:cloud-data-platform:develop:cloud-mcp/quickstart.adoc[]", + "xref:reference:rpk/rpk-cloud/rpk-cloud-mcp-stdio.adoc[]" + ], + "content": [ + { + "type": "section", + "id": "mcp-install-example", + "title": "Examples", + "position": "after_description", + "headingLevel": 2, + "content": "Install configuration for Claude Code:\n\n[,bash]\n----\nrpk cloud mcp install --client claude-code\n----" + } + ] + }, + { + "name": "proxy", + "description": "Proxy MCP requests to a remote Redpanda Cloud MCP server.\n\nThis command connects to a specific cluster and MCP server running in that cluster,\nthen proxies MCP requests from stdio to the remote MCP server over HTTP.\n\nUse --install to configure the MCP client instead of serving stdio.", + "usage": "rpk cloud mcp proxy [flags]", + "aliases": [], + "flags": [ + { + "name": "client", + "type": "string", + "description": "Name of the MCP client to configure (required with --install)", + "default": "", + "required": false + }, + { + "name": "cluster-id", + "type": "string", + "description": "Cluster ID to connect to", + "default": "", + "required": false + }, + { + "name": "install", + "type": "bool", + "description": "Install MCP proxy configuration instead of serving stdio", + "default": false, + "required": false + }, + { + "name": "mcp-server-id", + "type": "string", + "description": "MCP Server ID to proxy to", + "default": "", + "required": true + }, + { + "name": "serverless-cluster-id", + "type": "string", + "description": "Serverless cluster ID to connect to", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "stdio", + "description": "Communicate with the local MCP server for Redpanda Cloud using the stdio protocol.\n\nThis command provides a direct stdio interface for communicating with the local MCP server for Redpanda Cloud. The local MCP server runs on your machine and provides tools for managing your Redpanda Cloud account and clusters. It's typically used as the transport mechanism when your MCP client is configured to use `rpk` as the stdio server process.\n\nMost users should use xref:reference:rpk/rpk-cloud/rpk-cloud-mcp-install.adoc[`rpk cloud mcp install`] instead, which automatically configures your MCP client.", + "usage": "rpk cloud mcp stdio [flags]", + "aliases": [], + "flags": [ + { + "name": "allow-delete", + "type": "bool", + "description": "Allow delete RPCs. Off by default", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:reference:rpk/rpk-cloud/rpk-cloud-mcp-install.adoc[]", + "xref:cloud-data-platform:develop:cloud-mcp/overview.adoc[]" + ], + "content": [ + { + "type": "section", + "id": "mcp-stdio-example", + "title": "Examples", + "position": "after_description", + "headingLevel": 2, + "content": "Start the local MCP server for Redpanda Cloud using the stdio protocol:\n\n[,bash]\n----\nrpk cloud mcp stdio\n----" + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "cluster", + "description": "Manage and inspect Redpanda cluster configuration, health, and maintenance operations.", + "usage": "rpk cluster [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "brokers", + "description": "Manage Redpanda cluster brokers", + "usage": "rpk cluster brokers [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "decommission", + "description": "Decommission the given broker.\n\nDecommissioning a broker removes it from the cluster.\n\nA decommission request is sent to every broker in the cluster, only the cluster\nleader handles the request.\n\nFor safety on v22.x clusters, this command will not run if the requested\nbroker is in maintenance mode. As of v23.x, Redpanda supports\ndecommissioning a node that is currently in maintenance mode. If you are on\na v22.x cluster and need to bypass the maintenance mode check (perhaps your\ncluster is unreachable), use the --skip-liveness-check flag.\n", + "usage": "rpk cluster brokers decommission [BROKER ID] [flags]", + "aliases": [], + "flags": [ + { + "name": "skip-liveness-check", + "type": "bool", + "description": "If enabled, rpk will issue the decommission request without checking if the broker is in maintenance mode", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-brokers-decommission.adoc" + }, + { + "name": "decommission-status", + "description": "Show the progress of a node decommissioning.\n\nWhen a node is being decommissioned, this command reports the decommissioning\nprogress as follows, where PARTITION-SIZE is in bytes. Using -H, it prints the\npartition size in a human-readable format.\n\n$ rpk cluster brokers decommission-status 4\nDECOMMISSION PROGRESS\n=====================\nPARTITION MOVING-TO COMPLETION-% PARTITION-SIZE\nkafka/test/0 3 9 1699470920\nkafka/test/4 3 0 1614258779\nkafka/test2/3 3 3 2722706514\nkafka/test2/4 3 4 2945518089\nkafka_internal/id_allocator/0 3 0 3562\n\nUsing --detailed / -d, it additionally prints granular reports.\n\n$ rpk cluster brokers decommission-status 4 -d\nDECOMMISSION PROGRESS\n=====================\nPARTITION MOVING-TO COMPLETION-% PARTITION-SIZE BYTES-MOVED BYTES-REMAINING\nkafka/test/0 3 13 1731773243 228114727 1503658516\nkafka/test/4 3 1 1645952961 18752660 1627200301\nkafka/test2/3 3 5 2752632301 140975805 2611656496\nkafka/test2/4 3 6 2975443783 181581219 2793862564\n\nIf a partition cannot be moved for some reason, the command reports the\nproblematic partition in the 'REALLOCATION FAILURE DETAILS' or 'ALLOCATION FAILURES'\nsection and decommission fails. Typical scenarios for failure include:\nthere are no brokers that have enough space to allocate a partition, or that can satisfy\nrack constraints, etc.\n\nREALLOCATION FAILURE DETAILS\n============================\nPARTITION REASON\nkafka/foo/1 Missing partition size information, all replicas may be offline\nkafka/foo/7 Missing partition size information, all replicas may be offline\n", + "usage": "rpk cluster brokers decommission-status [BROKER ID] [flags]", + "aliases": [], + "flags": [ + { + "name": "detailed", + "shorthand": "d", + "type": "bool", + "description": "Print how much data moved and remaining in bytes", + "default": false, + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "human-readable", + "shorthand": "H", + "type": "bool", + "description": "Print the partition size in a human-readable form", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-brokers-decommission-status.adoc" + }, + { + "name": "recommission", + "description": "Recommission the given broker if it is still decommissioning.\n\nRecommissioning can stop an active decommission.\n\nOnce a broker is decommissioned, it cannot be recommissioned through this\ncommand.\n\nA recommission request is sent to every broker in the cluster, only\nthe cluster leader handles the request.\n\n", + "usage": "rpk cluster brokers recommission [BROKER ID] [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-brokers-recommission.adoc" + } + ], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-brokers.adoc" + }, + { + "name": "config", + "description": "View and modify cluster-wide configuration properties. Changes take effect across all brokers.", + "usage": "rpk cluster config [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "edit", + "description": "Edit cluster-wide configuration properties.\n\nThis command opens a text editor to modify the cluster's configuration.\n\nCluster properties are redpanda settings which apply to all nodes in\nthe cluster. These are separate to node properties, which are set with\n'rpk redpanda config'.\n\nModified values are written back when the file is saved and the editor\nis closed. Properties which are deleted are reset to their default\nvalues.\n\nBy default, low level tunables are excluded: use the '--all' flag\nto edit all properties including these tunables.\n", + "usage": "rpk cluster config edit [flags]", + "aliases": [], + "flags": [ + { + "name": "all", + "type": "bool", + "description": "Include all properties, including tunables", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "export", + "description": "Export cluster configuration.\n\nWrites out a YAML representation of the cluster configuration to a file,\nsuitable for editing and later applying with the corresponding 'import'\ncommand.\n\nBy default, low level tunables are excluded: use the '--all' flag\nto include all properties including these low level tunables.\n", + "usage": "rpk cluster config export [flags]", + "aliases": [], + "flags": [ + { + "name": "all", + "type": "bool", + "description": "Include all properties, including tunables", + "default": false, + "required": false + }, + { + "name": "filename", + "shorthand": "f", + "type": "string", + "description": "path to file to export to, e.g. './config.yml'", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "force-reset", + "description": "Forcibly clear a cluster configuration property on this node.\n\nThis command is not for general changes to cluster configuration: use this only\nwhen redpanda will not start due to a configuration issue.\n\nIf your cluster is working properly and you would like to reset a property\nto its default, you may use the 'set' command with an empty string, or\nuse the 'edit' command and delete the property's line.\n\nThis command erases a named property from an internal cache of the cluster\nconfiguration on the local node, so that on next startup redpanda will treat\nthe setting as if it was set to the default.\n\nWARNING: this should only be used when redpanda is not running.\n", + "usage": "rpk cluster config force-reset [PROPERTY...] [flags]", + "aliases": [], + "flags": [ + { + "name": "cache-file", + "type": "string", + "description": "Location of the configuration cache file. Defaults to the Redpanda data directory.", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "get", + "description": "Get a cluster configuration property.", + "usage": "rpk cluster config get [KEY] [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "self-hosted", + "position": "after_description", + "content": "This command is provided for use in scripts. For interactive editing, or bulk\noutput, use the `edit` and `export` commands respectively." + } + ] + }, + { + "name": "import", + "description": "Import cluster configuration from a file.\n\nImport configuration from a YAML file, usually generated with\ncorresponding 'export' command. This downloads the current cluster\nconfiguration, calculates the difference with the YAML file, and\nupdates any properties that were changed. If a property is removed\nfrom the YAML file, it is reset to its default value. ", + "usage": "rpk cluster config import [flags]", + "aliases": [], + "flags": [ + { + "name": "all", + "type": "bool", + "description": "Include all properties, including tunables", + "default": false, + "required": false + }, + { + "name": "filename", + "shorthand": "f", + "type": "string", + "description": "Full path to the configuration file to import, for example, `/tmp/config.yml`.", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "lint", + "description": "Identify any Redpanda configuration properties that are not recognized. These may be properties that were valid in earlier versions of Redpanda but are now managed via the central configuration store.", + "usage": "rpk cluster config lint [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List cluster configuration properties.\n\nThis command lists all available cluster configuration properties. Use the 'get'\ncommand to retrieve specific property values, or 'edit' for interactive editing.\n\nUse the --filter flag with a regular expression to filter configuration keys.\n\nBy default the request is routed to any broker. Use --node-id to route it to\na specific broker, which is useful when you suspect a broker is out of sync\nwith the controller. --node-id is not supported for cloud clusters.", + "usage": "rpk cluster config list [flags]", + "aliases": [], + "examples": "\nList all cluster configuration properties:\n rpk cluster config list\n\nList configuration properties matching a filter:\n rpk cluster config list --filter=\"kafka.*\"\n\nList configuration properties in JSON format:\n rpk cluster config list --format=json\n\nList configuration properties in YAML format:\n rpk cluster config list --format=yaml\n\nQuery broker 1 for its view of the cluster configuration:\n rpk cluster config list --node-id 1", + "flags": [ + { + "name": "filter", + "type": "string", + "description": "Filter configuration keys using regular expression", + "default": "", + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "node-id", + "type": "int", + "description": "If set, route the cluster configuration request to the given broker instead of any broker", + "default": 0, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:reference:rpk/rpk-cluster/rpk-cluster-config-get.adoc[`rpk cluster config get`]" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-config-print.adoc", + "content": [ + { + "type": "self-hosted", + "position": "after_description", + "content": "Use xref:reference:rpk/rpk-cluster/rpk-cluster-config-edit.adoc[`rpk cluster config edit`] for interactive editing." + }, + { + "type": "section", + "id": "examples", + "title": "Examples", + "position": "after_aliases", + "headingLevel": 2, + "subsections": [ + { + "title": "Filtering with regex", + "items": [ + { + "description": "List properties matching a pattern", + "code": "rpk cluster config list --filter=\"kafka.*\"" + }, + { + "description": "Filter properties containing 'log'", + "code": "rpk cluster config list --filter=\".*log.*\"" + } + ] + }, + { + "title": "Output formats", + "items": [ + { + "description": "List in JSON format", + "code": "rpk cluster config list --format=json" + }, + { + "description": "List in YAML format", + "code": "rpk cluster config list --format=yaml" + } + ] + } + ] + } + ] + }, + { + "name": "set", + "description": "Set a single cluster configuration property.\n\nThis command is provided for use in scripts. For interactive editing, or bulk\nchanges, use the 'edit' and 'import' commands respectively.\n\nYou may also use = notation for setting configuration properties:\n\n rpk cluster config set log_retention_ms=-1\n\nIf an empty string is given as the value, the property is reset to its default.\nUse the flag '--no-confirm' to avoid the confirmation prompt.", + "usage": "rpk cluster config set [KEY] [VALUE] [flags]", + "aliases": [], + "flags": [ + { + "name": "no-confirm", + "type": "bool", + "description": "Disable confirmation prompt", + "default": false, + "required": false + }, + { + "name": "timeout", + "type": "duration", + "description": "Maximum time to poll for operation completion before displaying operation ID for manual status checking (e.g. 300ms, 1.5s, 30s)", + "default": "10s", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:reference:properties/cluster-properties.adoc[Cluster Properties]" + ], + "content": [ + { + "type": "self-hosted", + "position": "after_description", + "content": "If you set the cluster property value to an empty string, the property is reset to its default.\n\nThis command is provided for use in scripts. For interactive editing, or bulk\nchanges, use the `edit` and `import` commands respectively." + }, + { + "type": "cloud-only", + "position": "after_description", + "content": "The output returns an operation ID. Use the xref:reference:rpk/rpk-cluster/rpk-cluster-config-status.adoc[`status`] command to check the progress of the configuration change." + }, + { + "type": "note", + "position": "after_flags", + "content": "Setting properties to non-number values (such as setting string values with `-`) can be problematic for some terminals due to how POSIX flags are parsed. For example, the following command may not work from some terminals:\n\n[,bash]\n----\nrpk cluster config set delete_retention_ms -1\n----\n\nWorkaround: Use `--` to disable parsing for all subsequent characters. For example:\n\n[,bash]\n----\nrpk cluster config set -- delete_retention_ms -1\n----" + }, + { + "type": "section", + "id": "examples", + "title": "Examples", + "position": "after_aliases", + "headingLevel": 2, + "subsections": [ + { + "title": "Set a single property", + "items": [ + { + "description": "Enable auditing", + "code": "rpk cluster config set audit_enabled true" + } + ] + }, + { + "title": "Set multiple properties", + "items": [ + { + "description": "Enable Iceberg with REST catalog type (use `key=value` notation)", + "code": "rpk cluster config set iceberg_enabled=true iceberg_catalog_type=rest" + } + ] + } + ] + } + ] + }, + { + "name": "status", + "description": "Get the configuration status of Redpanda brokers.\n\nFor each broker, the command output shows:\n\n- Whether you need to restart the broker to apply the new settings\n- Any settings that the broker has flagged as invalid or unknown\n\nThe command also returns the version of cluster configuration that each broker\nhas applied. The version should be the same across all brokers, and\nit is incremented each time a configuration change is applied to the\ncluster. If a broker is using an earlier version as indicated by a lower number,\nit may be out of sync with the rest of the cluster. This can happen if a broker\nis offline or if it has not yet applied the latest configuration changes. The cluster configuration version number is not the same as the Redpanda version number.", + "usage": "rpk cluster config status [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "descriptionScope": "self-hosted", + "content": [ + { + "type": "cloud-only", + "position": "after_description", + "content": "Check the progress of a cluster configuration change.\n\nSome cluster properties require a rolling restart when updated, and it can take several minutes for the update to complete. This command lists the long-running operations run by the update and their status:\n\n- In progress (running)\n- Completed\n- Failed\n\n[,bash,role=no-copy]\n----\nOPERATION-ID STATUS STARTED COMPLETED\nd0ec1obmpnr7lv17bfpg RUNNING 2025-05-08 14:34:09\nd0ec0sor49uba166af3g RUNNING 2025-05-08 14:32:20\n----" + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-config.adoc", + "content": [ + { + "type": "cloud-only", + "position": "after_description", + "content": "Cluster properties are Redpanda settings that apply to all brokers in\nthe cluster." + }, + { + "type": "self-hosted", + "position": "after_description", + "content": "Cluster properties are Redpanda settings that apply to all brokers in\nthe cluster. These are separate from broker properties, which apply to only that broker and are set with\n`rpk redpanda config`.\n\nUse the `edit` subcommand to interactively modify the cluster configuration, or\n`export` and `import` to write the configuration to a file that can be edited and\nread back later.\n\nThese commands take an optional `--all` flag to include all properties such as\nlow-level tunables (for example, internal buffer sizes) that do not usually need\nto be changed during normal operations. These properties generally require\nsome expertise to set safely, so if in doubt, avoid using `--all`." + } + ] + }, + { + "name": "connections", + "description": "Manage and monitor cluster connections.", + "usage": "rpk cluster connections [flags]", + "aliases": [ + "connection" + ], + "flags": [], + "commands": [ + { + "name": "list", + "description": "Display statistics about current Kafka connections. This command displays a table of active and recently closed connections within the cluster. Use filtering and sorting to identify the connections of the client applications that you are interested in. See `--help` for the list of filtering arguments and sorting arguments. By default only a subset of the per-connection data is printed. To see all of the available data, use `--format=json`.", + "usage": "rpk cluster connections list [flags]", + "aliases": [], + "examples": "\nList connections ordered by their recent produce throughput:\n\trpk cluster connections list --order-by=\"recent_request_statistics.produce_bytes desc\"\n\nList connections ordered by their recent fetch throughput:\n\trpk cluster connections list --order-by=\"recent_request_statistics.fetch_bytes desc\"\n\nList connections ordered by the time that they've been idle:\n\trpk cluster connections list --order-by=\"idle_duration desc\"\n\nList connections ordered by those that have made the least requests:\n\trpk cluster connections list --order-by=\"total_request_statistics.request_count asc\"\n\nList extended output for open connections in json format:\n\trpk cluster connections list --format=json --state=\"OPEN\"", + "flags": [ + { + "name": "client-id", + "type": "string", + "description": "Filter results by the client ID", + "default": "", + "required": false + }, + { + "name": "client-software-name", + "type": "string", + "description": "Filter results by the client software name", + "default": "", + "required": false + }, + { + "name": "client-software-version", + "type": "string", + "description": "Filter results by the client software version", + "default": "", + "required": false + }, + { + "name": "filter-raw", + "type": "string", + "description": "Filter connections based on a raw query (overrides other filters)", + "default": "", + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "group-id", + "shorthand": "g", + "type": "string", + "description": "Filter by client group ID", + "default": "", + "required": false + }, + { + "name": "idle-ms", + "shorthand": "i", + "type": "int64", + "description": "Show connections idle for more than i milliseconds", + "default": 0, + "required": false + }, + { + "name": "ip-address", + "type": "string", + "description": "Filter results by the client ip address", + "default": "", + "required": false + }, + { + "name": "limit", + "type": "int32", + "description": "Limit how many records can be returned", + "default": 20, + "required": false + }, + { + "name": "order-by", + "type": "string", + "description": "Order the results by their values. See Examples above", + "default": "", + "required": false + }, + { + "name": "state", + "shorthand": "s", + "type": "string", + "description": "Filter results by state. Acceptable values: `OPEN`, `CLOSED`.", + "default": "", + "required": false + }, + { + "name": "user", + "shorthand": "u", + "type": "string", + "description": "Filter results by a specific user principal", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "self-hosted", + "position": "after_description", + "content": "In addition to filtering shorthand CLI arguments (For example, `--client-id`, `--state`), you can also use the `--filter-raw` and `--order-by` arguments that take string expressions. To understand the syntax of these arguments, refer to the Admin API docs of the filter and order-by fields of the link:/api/doc/admin/v2/operation/operation-redpanda-core-admin-v2-clusterservice-listkafkaconnections[ListKafkaConnections endpoint]." + }, + { + "type": "cloud-only", + "position": "after_description", + "content": "In addition to filtering shorthand CLI arguments (For example, `--client-id`, `--state`), you can also use the `--filter-raw` and `--order-by` arguments that take string expressions. To understand the syntax of these arguments, refer to the Admin API docs of the filter and order-by fields of the link:/api/doc/cloud-dataplane/operation/operation-monitoringservice_listkafkaconnections[`GET /v1/monitoring/kafka/connections`] Data Plane API endpoint." + }, + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "List connections ordered by their recent produce throughput", + "code": "rpk cluster connections list --order-by=\"recent_request_statistics.produce_bytes desc\"" + }, + { + "description": "List connections ordered by their recent fetch throughput", + "code": "rpk cluster connections list --order-by=\"recent_request_statistics.fetch_bytes desc\"" + }, + { + "description": "List connections ordered by the time that they've been idle", + "code": "rpk cluster connections list --order-by=\"idle_duration desc\"" + }, + { + "description": "List connections ordered by those that have made the least requests", + "code": "rpk cluster connections list --order-by=\"total_request_statistics.request_count asc\"" + }, + { + "description": "List extended output for open connections in JSON format", + "code": "rpk cluster connections list --format=json --state=\"OPEN\"" + } + ] + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "health", + "description": "Query cluster health and display the overall health status of the cluster. Redpanda collects health reports periodically from all nodes and aggregates them into a health overview.", + "usage": "rpk cluster health [flags]", + "aliases": [], + "examples": "\nBasic usage, get cluster health information:\n rpk cluster health\n\nGet cluster health information and watch for changes:\n rpk cluster health --watch\n\nGet cluster health information and exit when the cluster is healthy:\n rpk cluster health --exit-when-healthy\n", + "flags": [ + { + "name": "exit-when-healthy", + "shorthand": "e", + "type": "bool", + "description": "Exit with status 0 when the cluster becomes healthy. Useful for scripts waiting for cluster readiness.", + "default": false, + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "watch", + "shorthand": "w", + "type": "bool", + "description": "Continuously monitor health status, refreshing periodically.", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "health-criteria", + "title": null, + "position": "after_description", + "content": "A cluster is considered healthy when the following conditions are met:\n\n* All cluster nodes are responding\n* All partitions have leaders\n* The cluster controller is present" + } + ] + }, + { + "name": "info", + "description": "Request broker metadata information.\n\nThe Kafka protocol's metadata contains information about brokers, topics, and\nthe cluster as a whole.\n\nThis command only runs if specific sections of metadata are requested. There\nare currently three sections: the cluster, the list of brokers, and the topics.\nIf no section is specified, this defaults to printing all sections.\n\nIf the topic section is requested, all topics are requested by default unless\nsome are manually specified as arguments. Expanded per-partition information\ncan be printed with the -d flag, and internal topics can be printed with the -i\nflag.\n\nIn the broker section, the controller node is suffixed with *.\n\nUsing --detailed augments the broker section with Admin API metadata: the\nnumber of cores per broker, membership status, liveness, version, and broker\nUUID (when reported by the Admin API). It also prints a per-broker DISK SPACE\nsection.\n\nUsing --include-decommissioned additionally lists decommissioned nodes by\ntheir UUID at the end of the broker table.\n\nIf the Admin API is unreachable when --detailed or --include-decommissioned\nis set, the basic broker view is still printed; pass -v to see the underlying\nerror.\n\nUsing this command with --format json/yaml implies that all sections are\nincluded.\n", + "usage": "rpk cluster info [flags]", + "aliases": [ + "status", + "metadata" + ], + "flags": [ + { + "name": "detailed", + "type": "bool", + "description": "Augment the brokers section with Admin API metadata (cores, membership, liveness, version, UUID, and disk space)", + "default": false, + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "include-decommissioned", + "type": "bool", + "description": "Append decommissioned nodes to the brokers section using their UUID", + "default": false, + "required": false + }, + { + "name": "print-brokers", + "shorthand": "b", + "type": "bool", + "description": "Print brokers section", + "default": false, + "required": false + }, + { + "name": "print-cluster", + "shorthand": "c", + "type": "bool", + "description": "Print cluster section", + "default": false, + "required": false + }, + { + "name": "print-detailed-topics", + "shorthand": "d", + "type": "bool", + "description": "Print per-partition information for topics (implies -t)", + "default": false, + "required": false + }, + { + "name": "print-internal-topics", + "shorthand": "i", + "type": "bool", + "description": "Print internal topics (if all topics requested, implies -t)", + "default": false, + "required": false + }, + { + "name": "print-topics", + "shorthand": "t", + "type": "bool", + "description": "Print topics section (implied if any topics are specified)", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-cluster/rpk-cluster-metadata.adoc, reference:rpk/rpk-redpanda/rpk-redpanda-admin-brokers-list.adoc" + }, + { + "name": "license", + "description": "Manage cluster license", + "usage": "rpk cluster license [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "info", + "description": "Retrieve license information:\n\n Organization: Organization the license was generated for.\n Type: Type of license: free, enterprise, etc.\n Expires: Expiration date of the license.\n License Status: Status of the loaded license (valid, expired, not_present).\n Violation: Whether the cluster is using enterprise features without\n a valid license.\n", + "usage": "rpk cluster license info [flags]", + "aliases": [ + "status" + ], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "set", + "description": "Upload a license to the cluster using a file path, inline string, or default location.", + "usage": "rpk cluster license set [flags]", + "aliases": [], + "flags": [ + { + "name": "path", + "type": "string", + "description": "Path to the license file", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "logdirs", + "description": "Describe log directories on Redpanda brokers", + "usage": "rpk cluster logdirs [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "describe", + "description": "Describe log directories on Redpanda brokers.\n\nThis command prints information about log directories on brokers, as well as the number of records in those log directories. The information is sorted first by topic, then by partition, and last by broker.\n\nThe directory returned is the root directory for partitions. Within Redpanda, the partition data lives underneath the returned root directory in `+kafka/{topic}/{partition}_{revision}/+`, where `revision` is a Redpanda internal concept.", + "usage": "rpk cluster logdirs describe [flags]", + "aliases": [], + "flags": [ + { + "name": "aggregate-into", + "type": "string", + "description": "Aggregate results into the specified column starting from the partition column. Valid values: `broker`, `dir`, `topic`.", + "default": "", + "required": false + }, + { + "name": "broker", + "shorthand": "b", + "type": "int32", + "description": "If non-negative, the specific broker to describe", + "default": -1, + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "human-readable", + "shorthand": "H", + "type": "bool", + "description": "Print the logdirs size in a human-readable form", + "default": false, + "required": false + }, + { + "name": "sort-by-size", + "type": "bool", + "description": "If true, sort by size", + "default": false, + "required": false + }, + { + "name": "topics", + "type": "stringSlice", + "description": "Specific topics to describe", + "default": [], + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "loggers", + "description": "List and configure Redpanda broker loggers", + "usage": "rpk cluster loggers [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "list", + "description": "List loggers available on a Redpanda broker.\n\nLoggers are discovered by, in order:\n 1. Running the local redpanda binary with --help-loggers (Linux only).\n 2. Querying /v1/loggers on the Admin API.\n 3. Falling back to a hardcoded list compiled into rpk.\n\nWithout --node-id, the request is sent to any broker. Use --node-id to query\na specific broker.\n", + "usage": "rpk cluster loggers list [flags]", + "aliases": [], + "flags": [ + { + "name": "node-id", + "type": "int", + "description": "If set, query the given broker instead of any broker", + "default": 0, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "set", + "description": "Set broker logger's log level.\n\nThis command temporarily changes a broker logger's log level. Each Redpanda\nbroker has many loggers, and each can be individually changed. Any change\nto a logger persists for a limited amount of time, so as to ensure you do\nnot accidentally enable debug logging permanently.\n\nIt is optional to specify a logger; if you do not, this command will prompt\nfrom the set of available loggers.\n\nThe special logger \"all\" enables all loggers. Alternatively, you can specify\nmany loggers at once.\n\nThis command accepts loggers that it does not know of to ensure you can\nindependently update your redpanda installations from rpk. The success or\nfailure of enabling each logger is individually printed.\n\nUse 'rpk cluster loggers list' to display available loggers.\n", + "usage": "rpk cluster loggers set [LOGGERS...] [flags]", + "aliases": [], + "flags": [ + { + "name": "expiry-seconds", + "shorthand": "e", + "type": "int", + "description": "Seconds to persist this log level override before redpanda reverts to its previous settings (if 0, persist until shutdown)", + "default": 300, + "required": false + }, + { + "name": "level", + "shorthand": "l", + "type": "string", + "description": "Log level to set (error, warn, info, debug, trace)", + "default": "debug", + "required": false + }, + { + "name": "node-id", + "type": "int", + "description": "Broker to apply the log level change on", + "default": 0, + "required": true + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-config-log-level-set.adoc" + } + ], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-config-log-level.adoc" + }, + { + "name": "maintenance", + "description": "Manage cluster maintenance mode for performing rolling upgrades and other maintenance operations.", + "usage": "rpk cluster maintenance [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "disable", + "description": "Disable maintenance mode on a broker, allowing it to resume normal operations and accept partition assignments.", + "usage": "rpk cluster maintenance disable [BROKER-ID] [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "enable", + "description": "Enable maintenance mode on a broker. While in maintenance mode, the broker drains partition leadership to other brokers. Use this command before performing broker upgrades or hardware maintenance. After maintenance is complete, run `rpk cluster maintenance disable ` to restore normal operation.", + "usage": "rpk cluster maintenance enable [BROKER-ID] [flags]", + "aliases": [], + "flags": [ + { + "name": "wait", + "shorthand": "w", + "type": "bool", + "description": "Wait for the node to finish draining before returning. Useful for scripted rolling operations.", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "status", + "description": "Report maintenance status.\n\nThis command reports maintenance status for each broker in the cluster. The output is presented as a table with each row representing a broker in the cluster. The output can be used to monitor the progress of node draining.", + "usage": "rpk cluster maintenance status [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "status-fields", + "title": null, + "position": "after_description", + "content": "For example:\n\n----\nNODE-ID ENABLED FINISHED ERRORS PARTITIONS ELIGIBLE TRANSFERRING FAILED\n1 false false false 0 0 0 0\n----\n\n[cols=\"1m,2a\"]\n|===\n|Field |Description\n\n|NODE-ID |The node ID.\n|ENABLED |`true` if the broker is currently in maintenance mode.\n|FINISHED |Leadership draining has completed.\n|ERRORS |Errors have been encountered while draining.\n|PARTITIONS |Number of partitions whose leadership has moved.\n|ELIGIBLE |Number of partitions with leadership eligible to move.\n|TRANSFERRING |Current active number of leadership transfers.\n|FAILED |Number of failed leadership transfers.\n|===\n\n[NOTE]\n====\n* When errors are present, further information is available in the logs for the corresponding broker.\n* Only partitions with more than one replica are eligible for leadership transfer.\n====" + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "partitions", + "description": "Manage cluster partitions", + "usage": "rpk cluster partitions [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "balance", + "description": "Trigger on-demand partition balancing to redistribute partitions evenly across brokers. Redpanda automatically balances partitions when it detects imbalance; run this command to trigger balancing manually.", + "usage": "rpk cluster partitions balance [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "balancer-status", + "description": "Queries cluster for partition balancer status:\n\nIf continuous partition balancing is enabled, redpanda will continuously\nreassign partitions from both unavailable nodes and from nodes using more disk\nspace than the configured limit.\n\nUse this command to monitor the partition balancer status and\nthe partition distribution across brokers in the cluster.\n\nFIELDS\n\n Status: Either off, ready, starting, in progress, or\n stalled.\n Seconds Since Last Tick: The last time the partition balancer ran.\n Current Reassignments Count: Current number of partition reassignments in\n progress.\n Unavailable Nodes: The nodes that have been unavailable after a\n time set by the\n \"partition_autobalancing_node_availability_timeout_sec\"\n cluster property.\n Over Disk Limit Nodes: The nodes that surpassed the threshold of\n used disk percentage specified in the\n \"partition_autobalancing_max_disk_usage_percent\"\n cluster property.\n\nBALANCER STATUS\n\n off: The balancer is disabled.\n ready: The balancer is active but there is nothing to do.\n starting: The balancer is starting but has not run yet.\n in_progress: The balancer is active and is in the process of scheduling\n partition movements.\n stalled: Violations have been detected and the balancer cannot correct\n them.\n\nSTALLED BALANCER\n\nA stalled balancer can occur for a few reasons and requires a bit of manual\ninvestigation. A few areas to investigate:\n\n* Are there are enough healthy nodes to which to move partitions? For example,\n in a three node cluster, no movements are possible for partitions with three\n replicas. You will see a stall every time there is a violation.\n\n* Does the cluster have sufficient space? If all nodes in the cluster are\n utilizing more than 80% of their disk space, rebalancing cannot proceed.\n\n* Do all partitions have quorum? If the majority of a partition's replicas are\n down, the partition cannot be moved.\n\n* Are any nodes in maintenance mode? Partitions are not moved if any node is in\n maintenance mode.\n", + "usage": "rpk cluster partitions balancer-status [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "disable", + "description": "Disable partitions of a topic\n\nYou may disable all partitions of a topic using the --all flag or you may select \na set of topic/partitions to disable with the '--partitions/-p' flag.\n\nThe partition flag accepts the format {namespace}/{topic}/[partitions...]\nwhere namespace and topic are optional parameters. If the namespace is not\nprovided, rpk will assume 'kafka'. If the topic is not provided in the flag, rpk\nwill use the topic provided as an argument to this command.\n\nDISABLED PARTITIONS\n\nDisabling a partition in Redpanda involves prohibiting any data consumption or\nproduction to and from it. All internal processes associated with the partition\nare stopped, and it remains unloaded during system startup. This measure aims to\nmaintain cluster health by preventing issues caused by specific corrupted\npartitions that may lead to Redpanda crashes. Although the data remains stored\non disk, Redpanda ceases interaction with the disabled partitions to ensure\nsystem stability.\n\nEXAMPLES\n\nDisable all partitions in topic 'foo'\n rpk cluster partitions disable foo --all\n\nDisable partitions 1,2 and 3 of topic 'bar' in the namespace 'internal'\n rpk cluster partitions disable internal/bar --partitions 1,2,3\n\nDisable partition 1, and 2 of topic 'foo', and partition 5 of topic 'bar' in the \n'internal' namespace' \n rpk cluster partitions disable -p foo/1,2 -p internal/bar/5\n", + "usage": "rpk cluster partitions disable [TOPIC] [flags]", + "aliases": [], + "flags": [ + { + "name": "all", + "shorthand": "a", + "type": "bool", + "description": "If true, disable all partitions for the specified topic", + "default": false, + "required": false + }, + { + "name": "partitions", + "shorthand": "p", + "type": "stringArray", + "description": "Comma-separated list of partitions you want to disable. Use --help for additional information", + "default": [], + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "enable", + "description": "Enable partitions of a topic\n\nYou may enable all partitions of a topic using the --all flag or you may select \na set of topic/partitions to enable with the '--partitions/-p' flag.\n\nThe partition flag accepts the format {namespace}/{topic}/[partitions...]\nwhere namespace and topic are optional parameters. If the namespace is not\nprovided, rpk will assume 'kafka'. If the topic is not provided in the flag, rpk\nwill use the topic provided as an argument to this command.\n\nEXAMPLES\n\nEnable all partitions in topic 'foo'\n rpk cluster partitions enable foo --all\n\nEnable partitions 1,2 and 3 of topic 'bar' in the namespace 'internal'\n rpk cluster partitions enable internal/bar --partitions 1,2,3\n\nEnable partition 1, and 2 of topic 'foo', and partition 5 of topic 'bar' in the \n'internal' namespace'\n rpk cluster partitions enable -p foo/1,2 -p internal/bar/5\n", + "usage": "rpk cluster partitions enable [TOPIC] [flags]", + "aliases": [], + "flags": [ + { + "name": "all", + "shorthand": "a", + "type": "bool", + "description": "If true, enable all partitions for the specified topic", + "default": false, + "required": false + }, + { + "name": "partitions", + "shorthand": "p", + "type": "stringArray", + "description": "Comma-separated list of partitions you want to enable. Check help for extended usage", + "default": [], + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List partitions in the cluster. This command lists the cluster-level metadata of all partitions, including current replica assignments on brokers and CPU cores for given topics.", + "usage": "rpk cluster partitions list [TOPICS...] [flags]", + "aliases": [ + "ls", + "describe" + ], + "flags": [ + { + "name": "all", + "shorthand": "a", + "type": "bool", + "description": "List all partitions in the cluster.", + "default": false, + "required": false + }, + { + "name": "disabled-only", + "type": "bool", + "description": "List disabled partitions only.", + "default": false, + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "node-ids", + "shorthand": "n", + "type": "intSlice", + "description": "List of comma-separated broker IDs that you wish to filter the results with", + "default": [], + "required": false + }, + { + "name": "partition", + "shorthand": "p", + "type": "intSlice", + "description": "List of comma-separated partitions IDs that you wish to filter the results with", + "default": [], + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-partitions-list.adoc", + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "List all partitions in the cluster", + "code": "rpk cluster partitions list --all" + }, + { + "description": "List all partitions in the cluster, filtering for topic foo and bar", + "code": "rpk cluster partitions list foo bar" + }, + { + "description": "List partitions with replicas that are assigned to brokers 1 and 2.", + "code": "rpk cluster partitions list foo --node-ids 1,2" + }, + { + "description": "List only the disabled partitions", + "code": "rpk cluster partitions list -a --disabled-only" + }, + { + "description": "List all in JSON format", + "code": "rpk cluster partitions list -a --format json" + } + ] + }, + { + "type": "section", + "id": "enabled-disabled", + "title": "Enabled/Disabled", + "position": "after_description", + "headingLevel": 2, + "content": "Disabling a partition in Redpanda involves prohibiting any data consumption or production to and from it. All internal processes associated with the partition are stopped, and it remains unloaded during system startup. This measure aims to maintain cluster health by preventing issues caused by specific corrupted partitions that may lead to Redpanda crashes. Although the data remains stored on disk, Redpanda ceases interaction with the disabled partitions to ensure system stability. You may disable/enable partitions using `rpk cluster partitions enable/disable`." + } + ] + }, + { + "name": "move", + "description": "Move partition replicas across nodes / cores.\n\nThis command changes replica assignments for given partitions. By default, it\nassumes the `kafka` namespace, but you can specify an internal namespace using\nthe `{namespace}/` prefix.", + "usage": "rpk cluster partitions move [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "partition", + "shorthand": "p", + "type": "stringArray", + "description": "Topic partitions to move and new replica locations (repeatable)", + "default": [], + "required": true + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-cluster/rpk-cluster-partitions-movement.adoc", + "content": [ + { + "type": "section", + "id": "examples", + "title": "Examples", + "position": "after_aliases", + "headingLevel": 2, + "subsections": [ + { + "title": "Basic replica movement", + "items": [ + { + "description": "Move partition 0 to brokers 1,2,3 and partition 1 to brokers 2,3,4 for topic foo", + "code": "rpk cluster partitions move foo --partition 0:1,2,3 -p 1:2,3,4" + } + ] + }, + { + "title": "Specifying cores", + "items": [ + { + "description": "Move replicas to specific cores on brokers", + "code": "rpk cluster partitions move foo -p 0:1-0,2-0,3-0" + } + ] + }, + { + "title": "Multi-topic movement", + "items": [ + { + "description": "Move partitions across different topics and namespaces", + "code": "rpk cluster partitions move -p foo/0:1,2,3 -p kafka_internal/tx/0:1-0,2-0,3-0" + } + ] + } + ] + } + ] + }, + { + "name": "move-cancel", + "description": "Cancel ongoing partition movements.\n\nBy default, this command cancels all the partition movements in the cluster.\nTo ensure that you do not accidentally cancel all partition movements, this\ncommand prompts users for confirmation before issuing the cancellation request.\nYou can use \"--no-confirm\" to disable the confirmation prompt:\n\n rpk cluster partitions move-cancel --no-confirm\n\nIf \"--node\" is set, this command will only stop the partition movements\noccurring in the specified node:\n\n rpk cluster partitions move-cancel --node 1\n", + "usage": "rpk cluster partitions move-cancel [flags]", + "aliases": [ + "alter-cancel" + ], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "no-confirm", + "type": "bool", + "description": "Disable confirmation prompt", + "default": false, + "required": false + }, + { + "name": "node", + "type": "int", + "description": "ID of a specific node on which to cancel ongoing partition movements", + "default": -1, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-cluster/rpk-cluster-partitions-movement-cancel.adoc" + }, + { + "name": "move-status", + "description": "Show ongoing partition movements.\n\nBy default this command lists all ongoing partition movements in the cluster.\nTopics can be specified to print the move status of specific topics. By default,\nthis command assumes the \"kafka\" namespace, but you can use a \"namespace/\" to\nspecify internal namespaces.\n\n rpk cluster partitions move-status\n rpk cluster partitions move-status foo bar kafka_internal/tx\n\nThe \"--partition / -p\" flag can be used with topics to additional filter\nrequested partitions:\n\n rpk cluster partitions move-status foo bar --partition 0,1,2\n\nThe output contains the following columns with PARTITION-SIZE in bytes.\nUsing -H, it prints the partition size in a human-readable format\n\n NAMESPACE-TOPIC\n PARTITION\n MOVING-FROM\n MOVING-TO\n COMPLETION-%\n PARTITION-SIZE\n BYTES-MOVED\n BYTES-REMAINING\n\nUsing \"--print-all / -a\" the command additionally prints the column\n\"RECONCILIATION STATUSES\", which reveals the internal status of the ongoing\nreconciliations. Reported errors do not necessarily mean real problems.\n\nThe --format flag controls the output format: text (default), json, yaml, or\nhelp (prints field descriptions).\n", + "usage": "rpk cluster partitions move-status [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "human-readable", + "shorthand": "H", + "type": "bool", + "description": "Print the partition size in a human-readable form", + "default": false, + "required": false + }, + { + "name": "partition", + "shorthand": "p", + "type": "stringSlice", + "description": "Partitions to filter ongoing movements status (repeatable)", + "default": [], + "required": false + }, + { + "name": "print-all", + "shorthand": "a", + "type": "bool", + "description": "Print internal states about movements for debugging", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-cluster/rpk-cluster-partitions-movement-status.adoc" + }, + { + "name": "transfer-leadership", + "description": "Transfer partition leadership between brokers.\n\nThis command allows you to transfer partition leadership.\nYou can transfer only one partition leader at a time.\n\nTo transfer partition leadership, use the following syntax:\n\trpk cluster partitions transfer-leadership foo --partition 0:2\n\nHere, the command transfers leadership for the partition \"kafka/foo/0\"\nto broker 2. By default, it assumes the \"kafka\" namespace, but you can specify\nan internal namespace using the \"{namespace}/\" prefix.\n\nHere is an equivalent command using different syntax:\n\trpk cluster partitions transfer-leadership --partition foo/0:2\n\nWarning: Redpanda tries to balance leadership distribution across brokers by default.\nIf the distribution of leaders becomes uneven as a result of transferring leadership\nacross brokers, the cluster may move leadership back to the original\nbrokers automatically.\n", + "usage": "rpk cluster partitions transfer-leadership [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "partition", + "shorthand": "p", + "type": "string", + "description": "Topic-partition and target leader in the format `:`, for example `0:2` or `test-topic/0:2`. Use the `/` prefix for internal namespaces.", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "To transfer partition leadership for a partition `0` to a broker ID `2`, run", + "code": "rpk cluster partitions transfer-leadership foo --partition 0:2" + }, + { + "description": "The `--partition` flag accepts a value `:`, where `A` is a topic-partition and `B` is the ID of the broker to which you want to transfer leadership. To specify a topic-partition, you can use just the partition ID (`0`) or also use the topic name together with the partition using the following syntax", + "code": "rpk cluster partitions transfer-leadership --partition test-topic/0:2" + } + ] + } + ] + }, + { + "name": "unsafe-recover", + "description": "Recover unsafely from partitions that have lost majority.\n\nThis command allows you to unsafely recover all data adversely affected by the\nloss of the nodes specified in the '--from-nodes' flag. This operation is unsafe \nbecause it allows you to bulk move all partitions that have lost majority when \nnodes are gone and irrecoverable; this may result in data loss.\n\nYou can perform a dry run and verify the partitions that will be recovered by \nusing the '--dry' flag.\n", + "usage": "rpk cluster partitions unsafe-recover [flags]", + "aliases": [], + "flags": [ + { + "name": "dry", + "type": "bool", + "description": "Dry run: print the partition movement plan. Does not execute it", + "default": false, + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + }, + { + "name": "from-nodes", + "type": "intSlice", + "description": "Comma-separated list of node IDs from which to recover the partitions", + "default": [], + "required": true + }, + { + "name": "no-confirm", + "type": "bool", + "description": "Disable confirmation prompt", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "important", + "position": "after_description", + "content": "This operation is unsafe because it allows the forced leader election of the partitions that have lost majority when nodes are gone and irrecoverable; this may result in data loss." + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin-partitions.adoc" + }, + { + "name": "quotas", + "description": "Manage Redpanda client quotas", + "usage": "rpk cluster quotas [flags]", + "aliases": [ + "quota" + ], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [ + { + "name": "alter", + "description": "Add or delete a client quota\n\nThis command allows you to add or delete a client quota.\n\nA client quota consists of an entity (to whom the quota is applied) and a quota \ntype (what is being applied).\n\nThere are three entity types supported by Redpanda: user, client ID, and \nclient ID prefix.\n\nAssigning quotas to default entity types is possible using the '--default' flag.\n\nYou can perform a dry run using the '--dry' flag.\n", + "usage": "rpk cluster quotas alter [flags]", + "aliases": [], + "examples": "\nAdd quota (consumer_byte_rate) to client ID 'foo':\n rpk cluster quotas alter --add consumer_byte_rate=200000 \\\n --name client-id=foo\n\nAdd quota (consumer_byte_rate) to client ID starting with 'bar-':\n rpk cluster quotas alter --add consumer_byte_rate=200000 \\\n --name client-id-prefix=bar-\n\nAdd quota (producer_byte_rate) to default client ID:\n rpk cluster quotas alter --add producer_byte_rate=180000 --default client-id\n\nRemove quota (producer_byte_rate) from client ID 'foo':\n rpk cluster quotas alter --delete producer_byte_rate \\\n --name client-id=foo\n", + "flags": [ + { + "name": "add", + "type": "stringSlice", + "description": "Key=value quota to add, where the value is a float number (repeatable)", + "default": [], + "required": false + }, + { + "name": "default", + "type": "stringSlice", + "description": "Entity type for default matching, where type is client-id or client-id-prefix (repeatable)", + "default": [], + "required": false + }, + { + "name": "delete", + "type": "stringSlice", + "description": "Key of the quota to delete (repeatable)", + "default": [], + "required": false + }, + { + "name": "dry", + "type": "bool", + "description": "Dry run: validate the request without altering the quotas", + "default": false, + "required": false + }, + { + "name": "name", + "type": "stringSlice", + "description": "Entity for exact matching. Format type=name where type is client-id or client-id-prefix (repeatable)", + "default": [], + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Add quota (consumer_byte_rate) to client ID ``", + "code": "rpk cluster quotas alter --add consumer_byte_rate=200000 --name client-id=" + }, + { + "description": "Add quota (consumer_byte_rate) to client ID starting with `-`", + "code": "rpk cluster quotas alter --add consumer_byte_rate=200000 --name client-id-prefix=-" + }, + { + "description": "Add quota (producer_byte_rate) to default client ID", + "code": "rpk cluster quotas alter --add producer_byte_rate=180000 --default client-id" + }, + { + "description": "Remove quota (producer_byte_rate) from client ID `foo`", + "code": "rpk cluster quotas alter --delete producer_byte_rate --name client-id=" + } + ] + } + ] + }, + { + "name": "describe", + "description": "Describe client quotas.\n\nThis command describes client quotas that match the provided filtering criteria.\nRunning the command without filters returns all client quotas. Use the \n'--strict' flag for strict matching, which means that the only quotas returned \nexactly match the filters.\n\nFilters can be provided in terms of entities. An entity consists of either a \nclient ID or a client ID prefix.\n", + "usage": "rpk cluster quotas describe [flags]", + "aliases": [], + "examples": "\nDescribe all client quotas:\n rpk cluster quotas describe\n\nDescribe all client quota with client ID foo:\n rpk cluster quotas describe --name client-id=foo\n\nDescribe client quotas for a given client ID prefix 'bar.':\n rpk cluster quotas describe --name client-id=bar.\n", + "flags": [ + { + "name": "any", + "type": "stringSlice", + "description": "Entity type for any matching (names or default). Valid type values: `client-id` or `client-id-prefix`. Repeatable.", + "default": [], + "required": false + }, + { + "name": "default", + "type": "stringSlice", + "description": "Entity type for default matching. Valid type values: `client-id` or `client-id-prefix`. Repeatable.", + "default": [], + "required": false + }, + { + "name": "name", + "type": "stringSlice", + "description": "Entity type and name pair for exact name matching. Valid type values: `client-id` or `client-id-prefix`. Repeatable.", + "default": [], + "required": false + }, + { + "name": "strict", + "type": "bool", + "description": "Use strict matching: exclude entities with unspecified entity types.", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Describe all client quotas", + "code": "rpk cluster quotas describe" + }, + { + "description": "Describe all client quota with client ID ``", + "code": "rpk cluster quotas describe --name client-id=" + }, + { + "description": "Describe client quotas for a given client ID prefix `.`", + "code": "rpk cluster quotas describe --name client-id=." + } + ] + } + ] + }, + { + "name": "import", + "description": "Use this command to import client quotas in the format produced by `rpk cluster quotas describe --format json/yaml`.", + "usage": "rpk cluster quotas import [flags]", + "aliases": [], + "examples": "\nImport client quotas from a file:\n rpk cluster quotas import --from /path/to/file\n\nImport client quotas from a string:\n rpk cluster quotas import --from '{\"quotas\":...}'\n", + "flags": [ + { + "name": "from", + "type": "string", + "description": "Either the quotas or a path to a file containing the quotas to import; check help text for more information", + "default": "", + "required": true + }, + { + "name": "no-confirm", + "type": "bool", + "description": "Disable confirmation prompt", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "quotas-schema", + "title": "", + "position": "after_description", + "headingLevel": 2, + "content": "The schema of the import string matches the schema from `rpk cluster quotas describe --format help`:\n\n[tabs]\n======\nYAML::\n+\n[,yaml]\n----\nquotas:\n - entity:\n - name: string\n - type: string\n values:\n - key: string\n - values: string\n----\nJSON::\n+\n[,yaml]\n----\n{\n \"quotas\": [\n {\n \"entity\": [\n {\n \"name\": \"string\",\n \"type\": \"string\"\n }\n ],\n \"values\": [\n {\n \"key\": \"string\",\n \"values\": \"string\"\n }\n ]\n }\n ]\n}\n----\n======\n\nUse the `--no-confirm` flag to avoid the confirmation prompt." + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "self-test", + "description": "Start, stop and query runs of Redpanda self-test through the Admin API listener", + "usage": "rpk cluster self-test [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "start", + "description": "Starts one or more benchmark tests on one or more nodes of the cluster.", + "usage": "rpk cluster self-test start [flags]", + "aliases": [], + "flags": [ + { + "name": "cloud-backoff-ms", + "type": "uint", + "description": "The backoff in milliseconds for a cloud storage request", + "default": 100, + "required": false + }, + { + "name": "cloud-timeout-ms", + "type": "uint", + "description": "The timeout in milliseconds for a cloud storage request", + "default": 10000, + "required": false + }, + { + "name": "disk-duration-ms", + "type": "uint", + "description": "The duration in milliseconds of individual disk test runs", + "default": 30000, + "required": false + }, + { + "name": "network-duration-ms", + "type": "uint", + "description": "The duration in milliseconds of individual network test runs", + "default": 30000, + "required": false + }, + { + "name": "no-confirm", + "type": "bool", + "description": "Acknowledge warning prompt skipping read from stdin", + "default": false, + "required": false + }, + { + "name": "only-cloud-test", + "type": "bool", + "description": "Runs only cloud storage verification", + "default": false, + "required": false + }, + { + "name": "only-disk-test", + "type": "bool", + "description": "Runs only the disk benchmarks", + "default": false, + "required": false + }, + { + "name": "only-network-test", + "type": "bool", + "description": "Runs only network benchmarks", + "default": false, + "required": false + }, + { + "name": "participant-node-ids", + "type": "intSlice", + "description": "Comma-separated list of broker IDs that the tests will run on. If not set, tests will run for all node IDs.", + "default": [], + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-status.adoc[`rpk cluster self-test status`]" + ], + "content": [ + { + "type": "note", + "position": "after_description", + "content": "Redpanda self-test runs benchmarks that consume significant system resources. Do not start self-test if large workloads are already running on the system." + }, + { + "type": "section", + "id": "available-tests", + "title": null, + "position": "after_description", + "content": "Available tests to run:\n\n* *Disk tests*\n** Throughput test: 512 KB messages, sequential read/write\n*** Uses larger request message sizes and deeper I/O queue depth to write/read more bytes in a shorter amount of time, at the cost of IOPS/latency.\n** Latency test: 4 KB messages, sequential read/write\n*** Uses smaller request message sizes and lower levels of parallelism to achieve higher IOPS and lower latency.\n* *Network tests*\n** Throughput test: 8192-bit messages\n*** Unique pairs of Redpanda nodes each act as a client and a server.\n*** The test pushes as much data over the wire, within the test parameters.\n* *Cloud storage tests*\n** Configuration/latency test: 1024-byte object.\n** If cloud storage is enabled (xref:reference:properties/object-storage-properties.adoc#cloud_storage_enabled[`cloud_storage_enabled`]), a series of remote operations are performed:\n+\n--\ninclude::reference:partial$rpk-self-test-cloud-tests.adoc[]\n--\n\nThis command prompts users for confirmation (unless the flag `--no-confirm` is specified), then returns a test identifier ID, and runs the tests.\n\nTo view the test status, poll xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-status.adoc[`rpk cluster self-test status`]. Once the tests end, the cached results will be available with `rpk cluster self-test status`." + } + ] + }, + { + "name": "status", + "description": "Returns the status of the current running tests or the cached results of the last completed run.\n\nUse this command after invoking 'self-test start' to determine the status of\nthe jobs launched. Possible results are:\n\n* One or more jobs still running\n * Returns the IDs of Redpanda brokers (nodes) still running self-tests.\n\n* No jobs running:\n * Returns the cached results for all brokers of the last completed test.\n\nTest results are grouped by broker ID. Each test returns the following:\n\n* Name: Description of the test.\n* Info: Details about the test run attached by Redpanda.\n* Type: Either 'disk', 'network', or 'cloud' test.\n* Test Id: Unique identifier given to jobs of a run. All IDs in a test should match. If they don't match, then newer and/or older test results have been included erroneously.\n* Timeouts: Number of timeouts incurred during the test.\n* Start time: Time that the test started, in UTC.\n* End time: Time that the test ended, in UTC.\n* Avg Duration: Duration of the test.\n* IOPS: Number of operations per second. For disk, it's 'seastar::dma_read' and 'seastar::dma_write'. For network, it's 'rpc.send()'.\n* Throughput: For disk, throughput rate is in bytes per second. For network, throughput rate is in bits per second. Note that GiB vs. Gib is the correct notation displayed by the UI.\n* Latency: 50th, 90th, etc. percentiles of operation latency, reported in microseconds (μs). Represented as P50, P90, P99, P999, and MAX respectively.\nIf Tiered Storage is not enabled, the cloud storage tests won't run and a warning will be displayed showing \"Cloud storage is not enabled.\". All results will be shown as 0.\n", + "usage": "rpk cluster self-test status [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (`text`, `json`).", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-start.adoc[`rpk cluster self-test start`]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-stop.adoc[`rpk cluster self-test stop`]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test.adoc[`rpk cluster self-test`]", + "xref:manage:cluster-maintenance/cluster-diagnostics.adoc#disk-and-network-self-test-benchmarks[Disk and network self-test benchmarks]" + ], + "content": [ + { + "type": "include", + "position": "after_description", + "path": "reference:partial$rpk-self-test-descriptions.adoc" + }, + { + "type": "examples", + "title": "Example", + "position": "after_aliases", + "items": [ + { + "description": "Example input", + "code": "rpk cluster self-test status" + } + ] + } + ] + }, + { + "name": "stop", + "description": "Stops all self-test tests.\n\nThis command stops all currently running self-tests. The command is synchronous and returns\nsuccess when all jobs have been stopped or reports errors if broker timeouts have expired.\n", + "usage": "rpk cluster self-test stop [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:manage:cluster-maintenance/cluster-diagnostics.adoc#disk-and-network-self-test-benchmarks[Guide for running self-test for cluster diagnostics]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test.adoc[rpk cluster self-test]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-start.adoc[rpk cluster self-test start]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-status.adoc[`rpk cluster self-test status`]" + ], + "content": [ + { + "type": "section", + "id": "example-output", + "title": "Example output", + "position": "after_aliases", + "headingLevel": 2, + "content": "$ rpk cluster self-test stop\n All self-test jobs have been stopped" + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:manage:cluster-maintenance/cluster-diagnostics.adoc#disk-and-network-self-test-benchmarks[Guide for running self-test for cluster diagnostics]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-start.adoc[rpk cluster self-test start]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-status.adoc[rpk cluster self-test status]", + "xref:reference:rpk/rpk-cluster/rpk-cluster-self-test-stop.adoc[rpk cluster self-test stop]" + ] + }, + { + "name": "storage", + "description": "Manage cluster storage, including mounting and unmounting topics from Tiered Storage.", + "usage": "rpk cluster storage [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "cancel-mount", + "description": "Cancels a mount/unmount operation on a topic.\n\nUse the migration ID that is emitted when the mount or unmount operation is executed. \nYou can also get the migration ID by listing the mount/unmount operations.", + "usage": "rpk cluster storage cancel-mount [MIGRATION ID] [flags]", + "aliases": [ + "cancel-unmount" + ], + "examples": "\nCancel a mount/unmount operation\n rpk cluster storage cancel-mount 123\n", + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "cloud-only", + "position": "after_description", + "content": "NOTE: This command is only supported in BYOC and Dedicated clusters." + }, + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Cancel a mount/unmount operation", + "code": "rpk cluster storage cancel-mount 123" + } + ] + } + ] + }, + { + "name": "list-mount", + "description": "List mount/unmount operations on a topic to the Redpanda cluster from Tiered Storage.\n\nYou can also filter the list by state using the --filter flag. The possible states are:\n- planned\n- prepared\n- executed\n- finished\n\nIf no filter is provided, all migrations will be listed.", + "usage": "rpk cluster storage list-mount [flags]", + "aliases": [ + "list-unmount" + ], + "examples": "\nLists mount/unmount operations\n\trpk cluster storage list-mount\n\nUse filter to list only migrations in a specific state\n\trpk cluster storage list-mount --filter planned\n", + "flags": [ + { + "name": "filter", + "shorthand": "f", + "type": "string", + "description": "Filter the list of migrations by state. Only valid for text", + "default": "all", + "required": false + }, + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "cloud-only", + "position": "after_description", + "content": "NOTE: This command is only supported in BYOC and Dedicated clusters." + }, + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Lists mount/unmount operations", + "code": "rpk cluster storage list-mount" + }, + { + "description": "Use a filter to list only migrations in a specific state", + "code": "rpk cluster storage list-mount --filter planned" + } + ] + } + ] + }, + { + "name": "list-mountable", + "description": "List topics that are available to mount from object storage.\n\nThis command displays topics that exist in object storage and can be mounted\nto your Redpanda cluster. Each topic includes its location in object storage\nand namespace information if applicable.", + "usage": "rpk cluster storage list-mountable [flags]", + "aliases": [], + "examples": "\nList all mountable topics:\n rpk cluster storage list-mountable\n", + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "cloud-only", + "position": "after_description", + "content": "NOTE: This command is only supported in BYOC and Dedicated clusters." + }, + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "List all mountable topics", + "code": "rpk cluster storage list-mountable" + } + ] + } + ] + }, + { + "name": "mount", + "description": "Mount a topic from Tiered Storage, making it available for reads.", + "usage": "rpk cluster storage mount [TOPIC] [flags]", + "aliases": [], + "examples": "\nMounts topic my-typic from Tiered Storage to the cluster in the my-namespace\n\trpk cluster storage mount my-topic\n\nMount topic my-topic from Tiered Storage to the cluster in the my-namespace \nwith my-new-topic as the new topic name\n\trpk cluster storage mount my-namespace/my-topic --to my-namespace/my-new-topic\n", + "flags": [ + { + "name": "to", + "type": "string", + "description": "New namespace/topic name for the mounted topic (optional)", + "default": "", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "self-hosted", + "position": "after_description", + "content": "xref:manage:tiered-storage.adoc#enable-tiered-storage[Tiered Storage must be enabled]." + }, + { + "type": "cloud-only", + "position": "after_header", + "content": "NOTE: This command is only supported in BYOC and Dedicated clusters." + }, + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Mounts topic `` from Tiered Storage to the cluster in the ``", + "code": "rpk cluster storage mount " + }, + { + "description": "Mount topic `` from Tiered Storage to the cluster in the `` with `` as the new topic name", + "code": "rpk cluster storage mount / --to /" + } + ] + } + ] + }, + { + "name": "restore", + "description": "Interact with the topic restoration process.\n\t\t\nThis command is used to restore topics from the archival bucket, which can be \nuseful for disaster recovery or if a topic was accidentally deleted.\n\nTo begin the recovery process, use the \"restore start\" command. Note that this \nprocess can take a while to complete, so the command will exit after starting \nit. If you want the command to wait for the process to finish, use the \"--wait\"\nor \"-w\" flag.\n\nYou can check the status of the recovery process with the \"restore status\" \ncommand after it has been started.\n", + "usage": "rpk cluster storage restore [flags]", + "aliases": [ + "recovery" + ], + "flags": [], + "commands": [ + { + "name": "start", + "description": "Start the cluster restoration process. This command starts the process of restoring data from a failed cluster with Tiered Storage enabled, including its metadata, onto a new cluster. If the wait flag (`--wait`/`-w`) is set, the command will poll the status of the recovery process until it's finished. Use `--cluster-uuid-override` if you want to specify an explicit cluster UUID to restore from.", + "usage": "rpk cluster storage restore start [flags]", + "aliases": [], + "flags": [ + { + "name": "cluster-uuid-override", + "type": "string", + "description": "Explicit cluster UUID to restore from; uses the latest if unset", + "default": "", + "required": false + }, + { + "name": "polling-interval", + "type": "duration", + "description": "The status check interval (e.g. '30s', '1.5m'); ignored if --wait is not used", + "default": "5s", + "required": false + }, + { + "name": "wait", + "shorthand": "w", + "type": "bool", + "description": "Wait until auto-restore is complete", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:manage:whole-cluster-restore.adoc[Whole-Cluster Restore]" + ], + "pageAliases": "reference:rpk/rpk-cluster/rpk-cluster-storage-recovery-start.adoc" + }, + { + "name": "status", + "description": "Fetch the status of the topic restoration process.\n\t\t\nThis command fetches the status of the process of restoring topics from the \narchival bucket.", + "usage": "rpk cluster storage restore status [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:manage:whole-cluster-restore.adoc[Whole-Cluster Restore]" + ], + "pageAliases": "reference:rpk/rpk-cluster/rpk-cluster-storage-recovery-status.adoc" + } + ], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:manage:whole-cluster-restore.adoc[Whole-Cluster Restore]" + ], + "pageAliases": "reference:rpk/rpk-cluster/rpk-cluster-storage-recovery.adoc" + }, + { + "name": "status-mount", + "description": "Check the status of a mount or unmount operation for a topic in Tiered Storage.", + "usage": "rpk cluster storage status-mount [MIGRATION ID] [flags]", + "aliases": [ + "status-unmount" + ], + "examples": "\nStatus for a mount/unmount operation\n\trpk cluster storage status-mount 123\n", + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "cloud-only", + "position": "after_description", + "content": "NOTE: This command is only supported in BYOC and Dedicated clusters." + }, + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Status for a mount/unmount operation", + "code": "rpk cluster storage status-mount 123" + } + ] + } + ] + }, + { + "name": "unmount", + "description": "Unmount a topic, removing it from local storage while preserving data in Tiered Storage.", + "usage": "rpk cluster storage unmount [TOPIC] [flags]", + "aliases": [], + "examples": "\nUnmount topic 'my-topic' from the cluster in the 'my-namespace'\n rpk cluster storage unmount my-namespace/my-topic\n", + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "cloud-only", + "position": "after_header", + "content": "NOTE: This command is only supported in BYOC and Dedicated clusters." + }, + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Unmount topic '' from the cluster in the ''", + "code": "rpk cluster storage unmount /" + } + ] + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "cloud-only", + "position": "after_header", + "content": "NOTE: This command is only supported in BYOC and Dedicated clusters." + } + ] + }, + { + "name": "txn", + "description": "Information about transactions and transactional producers.\n\nTransactions allow producing, or consume-modifying-producing, to Redpanda.\nThe consume-modify-produce loop is also referred to as EOS (exactly once\nsemantics). Transactions involve a lot of technical complexity that is largely\nhidden within clients. This command space helps shed a light on what is\nactually happening in clients and brokers while transactions are in use.\n\nTRANSACTIONAL ID\n\nThe transactional ID is the string you define in clients when actually using\ntransactions.\n\nPRODUCER ID & EPOCH\n\nThe producer ID is generated within clients when you transactionally produce.\nThe producer ID is a number that maps to your transactional ID, allowing\nrequests to be smaller when producing, and allowing some optimizations within\nbrokers when managing transactions.\n\nSome clients expose the producer ID, allowing you to track the transactional ID\nthat a producer ID maps to. If possible, it is recommended to monitor the\nproducer ID used in your applications.\n\nThe producer epoch is a number that somewhat \"counts\" the number of times your\ntransaction has been initialized or expired. If you have one client that uses\na transactional ID, it may receive producer ID 3 epoch 0. Another client that\nuses that same transactional ID will receive producer ID 3 epoch 1. If the\nclient starts a transaction but does not finish it in time, the cluster will\ninternally bump the epoch to 2. The epoch allows the cluster to \"fence\"\nclients: if a client attempts to use a producer ID with an old epoch, the\ncluster will reject the client's produce request as stale.\n\nTRANSACTION STATE\n\nThe state of a transaction indicates what is currently happening with a\ntransaction. A high level overview of transactional states:\n\n * Empty: the transactional ID is ready but there are no partitions\n nor groups added to it -- there is no active transaction\n * Ongoing: the transactional ID is being used in a began transaction\n * PrepareCommit: a commit is in progress\n * PrepareAbort: an abort is in progress\n * PrepareEpochFence: the transactional ID is timing out\n * Dead: the transactional ID has expired and/or is not in use\n\nLAST STABLE OFFSET\n\nThe last stable offset is the offset at which a transaction has begun and\nclients cannot consume past, if the client is configured to read only committed\noffsets. The last stable offset can be seen when describing active transactional\nproducers by looking for the earliest transaction start offset per partition.\n", + "usage": "rpk cluster txn [flags]", + "aliases": [ + "transaction" + ], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [ + { + "name": "describe", + "description": "Describe transactional IDs.\n\nThis command, in comparison to 'list', is a more detailed per-transaction view\nof transactional IDs. In addition to the state and producer ID, this command\nalso outputs when a transaction started, the epoch of the producer ID, how long\nuntil the transaction times out, and the partitions currently a part of the\ntransaction. For information on what the columns in the output mean, see\n'rpk cluster txn --help'.\n\nBy default, all topics in a transaction are merged into one line. To print a\nrow per topic, use --format=long. To include partitions with topics, use\n--print-partitions; --format=json/yaml will return the equivalent of the long\nformat with print partitions included.\n\nIf no transactional IDs are requested, all transactional IDs are printed.\n", + "usage": "rpk cluster txn describe [TXN-IDS...] [flags]", + "aliases": [], + "flags": [ + { + "name": "print-partitions", + "shorthand": "p", + "type": "bool", + "description": "Include per-topic partitions that are in the transaction", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "describe-producers", + "description": "Describe transactional producers to partitions.\n\nThis command describes partitions that active transactional producers are\nproducing to. For more information on the producer ID and epoch columns, see\n'rpk cluster txn --help'.\n\nThe last timestamp corresponds to the timestamp of the last record that was\nwritten by the client. The transaction start offset corresponds to the offset\nthat the transaction is began at. All consumers configured to read only\ncommitted records cannot read past the transaction start offset.\n\nThe output includes a few advanced fields that can be used for sanity checking:\nthe last sequence is the last sequence number that the producer has written,\nand the coordinator epoch is the epoch of the broker that is being written to.\nThe last sequence should always go up and then wrap back to 0 at MaxInt32. The\ncoordinator epoch should remain fixed, or rarely, increase.\n\nYou can query all topics and partitions that have active producers with --all.\nTo filter for specific topics, use --topics. You can additionally filter by\npartitions with --partitions.\n", + "usage": "rpk cluster txn describe-producers [flags]", + "aliases": [], + "flags": [ + { + "name": "all", + "shorthand": "a", + "type": "bool", + "description": "Query all producer IDs on any topic", + "default": false, + "required": false + }, + { + "name": "partitions", + "shorthand": "p", + "type": "int32Slice", + "description": "Partitions to describe producers for (repeatable)", + "default": [], + "required": false + }, + { + "name": "topics", + "shorthand": "t", + "type": "stringSlice", + "description": "Topic to describe producers for (repeatable)", + "default": [], + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "list", + "description": "List transactions and their current states\n\nThis command lists all known transactions in the cluster, the producer ID for\nthe transactional ID, and the and the state of the transaction. For information\non what the columns in the output mean, see 'rpk cluster txn --help'.\n", + "usage": "rpk cluster txn list [flags]", + "aliases": [ + "ls" + ], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "upgrade", + "description": "Check and finalize major-version upgrades. When the cluster configuration\n'features_auto_finalization' is disabled, an upgrade stays pending after all\nbrokers are on the new version, so you can downgrade while soak-testing.\n", + "usage": "rpk cluster upgrade [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "finalize", + "description": "Finalize a deferred cluster upgrade.\n\nThis commits the cluster to the version all brokers report, activating\nversion-gated features and advancing the active cluster version. It is\nirreversible: the previous version is no longer available for downgrade.", + "usage": "rpk cluster upgrade finalize [flags]", + "aliases": [], + "flags": [ + { + "name": "no-confirm", + "type": "bool", + "description": "Disable the confirmation prompt", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "status", + "description": "Show the cluster upgrade finalization status.\n\nThis reports where the cluster sits in the upgrade-finalization lifecycle as\nseen by the controller leader: the high-level state (finalized, ready to\nfinalize, or upgrade in progress), the active and post-finalization logical\nversions, whether auto-finalization is enabled, and a per-broker breakdown of\nreported versions and liveness.", + "usage": "rpk cluster upgrade status [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "type": "string", + "description": "Output format (json,yaml,text,wide,help)", + "default": "text", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "pageAliases": "reference:rpk/rpk-redpanda/rpk-redpanda-admin.adoc" + }, + { + "name": "connect", + "description": "Run and manage Redpanda Connect streaming pipelines. Redpanda Connect is a high-performance stream processor for mundane data engineering tasks.", + "usage": "rpk connect [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "agent", + "description": "Manage Redpanda Connect agents. Agents allow you to build AI-powered workflows using Redpanda Connect resources.", + "usage": "rpk connect agent [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "init", + "description": "Initialize a template for building a Redpanda Connect agent.", + "usage": "rpk connect agent init [flags]", + "aliases": [], + "flags": [ + { + "name": "name", + "description": "", + "type": "string" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Example", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect agent init ./repo" + } + ] + }, + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + }, + { + "name": "run", + "description": "Run a Redpanda Connect agent from a repository directory. Each resource in the mcp subdirectory will create tools that can be used, then the redpanda_agents.yaml file along with Python agent modules will be invoked.", + "usage": "rpk connect agent run [flags]", + "aliases": [], + "flags": [ + { + "name": "secrets", + "description": "Attempt to load secrets from a provided URN. If more than one entry is specified they will be attempted in order until a value is found. Environment variable lookups are specified with the URN env:, which by default is the only entry. In order to disable all secret lookups specify a single entry of `none:`.", + "type": "strings", + "default": "\"env:\"" + }, + { + "name": "redpanda-license", + "description": "Provide an explicit Redpanda License, which enables enterprise functionality. By default licenses found at the path /etc/redpanda/redpanda.license are applied.", + "type": "string" + }, + { + "name": "chroot", + "description": "Chroot into the provided directory after parsing configuration. Common /etc/ files are copied to the chroot directory, and the directory is made read-only. This flag is only supported on Linux.", + "type": "string" + }, + { + "name": "chroot-passthrough", + "description": "Specify additional files to be copied into the chroot directory. This flag can be used multiple times. It is only supported when --chroot is used.", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Example", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect agent run ./repo" + }, + { + "description": "To disable all secret lookups", + "code": "rpk connect agent run --secrets none: ./repo" + } + ] + }, + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:reference:rpk/rpk-connect/rpk-connect-agent-init.adoc[rpk connect agent init]", + "xref:reference:rpk/rpk-connect/rpk-connect-agent-run.adoc[rpk connect agent run]" + ], + "content": [ + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + }, + { + "name": "blobl", + "description": "Execute Bloblang mappings from the command line. Provides a convenient tool for mapping JSON documents.", + "usage": "rpk connect blobl [flags]", + "aliases": [], + "flags": [ + { + "name": "threads", + "description": "the number of processing threads to use, when >1 ordering is no longer guaranteed.", + "shorthand": "t", + "type": "string", + "default": "1" + }, + { + "name": "raw", + "description": "consume raw strings.", + "shorthand": "r", + "type": "bool", + "default": "false" + }, + { + "name": "pretty", + "description": "pretty-print output.", + "shorthand": "p", + "type": "bool", + "default": "false" + }, + { + "name": "file", + "description": "execute a mapping from a file.", + "shorthand": "f", + "type": "string" + }, + { + "name": "input", + "description": "read input from a file instead of stdin.", + "shorthand": "i", + "type": "string" + }, + { + "name": "max-token-length", + "description": "Set the buffer size for document lines.", + "type": "string", + "default": "65536" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + } + ], + "commands": [ + { + "name": "server", + "description": "Run a web server that provides an interactive application for writing and testing Bloblang mappings.", + "usage": "rpk connect blobl server [flags]", + "aliases": [], + "flags": [ + { + "name": "host", + "description": "the host to bind to.", + "type": "string", + "default": "\"localhost\"" + }, + { + "name": "port", + "description": "the port to bind to.", + "shorthand": "p", + "type": "string", + "default": "\"4195\"" + }, + { + "name": "no-open", + "description": "do not open the app in the browser automatically.", + "shorthand": "n", + "type": "bool", + "default": "false" + }, + { + "name": "mapping-file", + "description": "an optional path to a mapping file to load as the initial mapping within the app.", + "shorthand": "m", + "type": "string" + }, + { + "name": "input-file", + "description": "an optional path to an input file to load as the initial input to the mapping within the app.", + "shorthand": "i", + "type": "string" + }, + { + "name": "write", + "description": "when editing a mapping and/or input file write changes made back to the respective source file, if the file does not exist it will be created.", + "shorthand": "w", + "type": "bool", + "default": "false" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "warning", + "position": "after_description", + "content": "This server is intended for local debugging and experimentation purposes only. Do NOT expose it to the internet." + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:connect:guides:bloblang/about.adoc[Bloblang]" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Map JSON documents from stdin", + "code": "cat documents.jsonl | rpk connect blobl 'foo.bar.map_each(this.uppercase())'" + }, + { + "description": "Use a mapping file", + "code": "echo '{\"foo\":\"bar\"}' | rpk connect blobl -f ./mapping.blobl" + }, + { + "description": "Process input from a file", + "code": "rpk connect blobl -i input.jsonl -f ./mapping.blobl" + } + ] + } + ] + }, + { + "name": "create", + "description": "Prints a new Redpanda Connect config to stdout containing specified components\naccording to an expression. The expression must take the form of three\ncomma-separated lists of inputs, processors and outputs, divided by\nforward slashes:\n\n redpanda-connect create stdin/bloblang,awk/nats\n redpanda-connect create file,http_server/protobuf/http_client\n\nIf the expression is omitted a default config is created.", + "usage": "rpk connect create [flags]", + "aliases": [], + "flags": [ + { + "name": "small", + "description": "Print only the main components of a Redpanda Connect config (input, pipeline, output) and omit all fields marked as advanced.", + "shorthand": "s", + "type": "bool", + "default": "false" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "position": "after_aliases", + "title": "Examples", + "items": [ + { + "description": "Create a config with stdin input, bloblang/awk processor, and nats output", + "code": "rpk connect create stdin/bloblang,awk/nats" + }, + { + "description": "Create a config with file/http_server inputs, protobuf processor, and http_client output", + "code": "rpk connect create file,http_server/protobuf/http_client" + } + ] + } + ] + }, + { + "name": "dry-run", + "description": "Test pipeline configurations by performing a dry run. Exits with a status code 1 if any connection errors are detected in a directory.", + "usage": "rpk connect dry-run [flags]", + "aliases": [], + "flags": [ + { + "name": "verbose", + "description": "Print the lint result for each target file.", + "type": "bool", + "default": "false" + }, + { + "name": "secrets", + "description": "Attempt to load secrets from a provided URN. If more than one entry is specified they will be attempted in order until a value is found. Environment variable lookups are specified with the URN env:, which by default is the only entry. In order to disable all secret lookups specify a single entry of `none:`.", + "type": "strings", + "default": "\"env:\"" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "redpanda-license", + "description": "Provide an explicit Redpanda License, which enables enterprise functionality. By default licenses found at the path /etc/redpanda/redpanda.license are applied.", + "type": "string" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Example", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect dry-run ./pipeline.yaml" + }, + { + "description": "To disable all secret lookups", + "code": "rpk connect dry-run --secrets none: ./pipeline.yaml" + } + ] + } + ] + }, + { + "name": "echo", + "description": "Parse a config file and echo back a normalized version. This command is useful for sanity checking a config if it isn't behaving as expected, as it shows you a normalised version after environment variables have been resolved.", + "usage": "rpk connect echo [flags]", + "aliases": [], + "flags": [ + { + "name": "set", + "description": "set a field (identified by a dot path) in the main configuration file, e.g. \"metrics.type=prometheus\"", + "shorthand": "s", + "type": "strings" + }, + { + "name": "resources", + "description": "pull in extra resources from a file, which can be referenced the same as resources defined in the main config, supports glob patterns (requires quotes)", + "shorthand": "r", + "type": "strings" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "help", + "description": "Shows a list of commands or help for one command", + "usage": "rpk connect help [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "install", + "description": "Install Redpanda Connect. This command installs the latest version by default. Use the `--connect-version` flag to specify a version.", + "usage": "rpk connect install [flags]", + "aliases": [], + "flags": [ + { + "name": "connect-version", + "type": "string", + "description": "Redpanda Connect version to install. (e.g. 4.32.0)", + "default": "latest", + "required": false + }, + { + "name": "force", + "type": "bool", + "description": "Force install of Redpanda Connect", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "lint", + "description": "Check a Redpanda Connect configuration file for syntax errors and potential issues without running it.", + "usage": "rpk connect lint [flags]", + "aliases": [], + "flags": [ + { + "name": "deprecated", + "description": "Print linting errors for the presence of deprecated fields.", + "type": "bool", + "default": "false" + }, + { + "name": "labels", + "description": "Print linting errors when components do not have labels.", + "type": "bool", + "default": "false" + }, + { + "name": "skip-env-var-check", + "description": "Do not produce lint errors when environment interpolations exist without defaults within configs but aren't defined.", + "type": "bool", + "default": "false" + }, + { + "name": "verbose", + "description": "Print the lint result for each target file.", + "type": "bool", + "default": "false" + }, + { + "name": "resources", + "description": "pull in extra resources from a file, which can be referenced the same as resources defined in the main config, supports glob patterns (requires quotes)", + "shorthand": "r", + "type": "strings" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "position": "after_aliases", + "title": "Examples", + "items": [ + { + "description": "Lint a specific file", + "code": "rpk connect lint target.yaml" + }, + { + "description": "Lint all YAML files in a directory", + "code": "rpk connect lint ./configs/*.yaml" + }, + { + "description": "Lint with resource imports", + "code": "rpk connect lint -r ./foo.yaml ./bar.yaml" + }, + { + "description": "Lint all files in a directory tree", + "code": "rpk connect lint ./configs/..." + } + ] + } + ] + }, + { + "name": "list", + "description": "List available Redpanda Connect components. Shows inputs, outputs, processors, caches, rate limits, buffers, metrics, and tracers that can be used in pipelines.", + "usage": "rpk connect list [flags]", + "aliases": [], + "flags": [ + { + "name": "format", + "description": "Output format: `text` (human-readable table), `json` (machine-readable), `cue` (CUE schema). Default is `text`.", + "type": "string", + "default": "\"text\"" + }, + { + "name": "status", + "description": "Filter the component list to only those matching the given status. Options are stable, beta or experimental.", + "type": "string" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect list" + }, + { + "description": "Example", + "code": "rpk connect list --format json inputs output" + }, + { + "description": "Example", + "code": "rpk connect list rate-limits buffers" + } + ] + } + ] + }, + { + "name": "mcp-server", + "description": "Execute an MCP server against a suite of Redpanda Connect resources. Each resource will be exposed as a tool that AI can interact with.", + "usage": "rpk connect mcp-server [flags]", + "aliases": [], + "flags": [ + { + "name": "address", + "description": "An optional address to bind the MCP server to instead of running in stdio mode.", + "type": "string" + }, + { + "name": "observability-address", + "description": "Address to bind the observability server (metrics, pprof) to. If not set, observability server is disabled. Only applies when --address is set.", + "type": "string" + }, + { + "name": "tag", + "description": "Optionally limit the resources that this command runs by providing one or more regular expressions. Resources that do not contain a match within the field meta.tags for each tag regular expression specified will be ignored.", + "type": "strings" + }, + { + "name": "secrets", + "description": "Attempt to load secrets from a provided URN. If more than one entry is specified they will be attempted in order until a value is found. Environment variable lookups are specified with the URN env:, which by default is the only entry. In order to disable all secret lookups specify a single entry of `none:`.", + "type": "strings", + "default": "\"env:\"" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "redpanda-license", + "description": "Provide an explicit Redpanda License, which enables enterprise functionality. By default licenses found at the path /etc/redpanda/redpanda.license are applied.", + "type": "string" + }, + { + "name": "chroot", + "description": "Chroot into the provided directory after parsing configuration. Common /etc/ files are copied to the chroot directory, and the directory is made read-only. This flag is only supported on Linux.", + "type": "string" + }, + { + "name": "chroot-passthrough", + "description": "Specify additional files to be copied into the chroot directory. This flag can be used multiple times. It is only supported when --chroot is used.", + "type": "strings" + } + ], + "commands": [ + { + "name": "init", + "description": "Initialize an MCP server project. Files that already exist will not be overwritten.", + "usage": "rpk connect mcp-server init [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + }, + { + "name": "lint", + "description": "Lint MCP server resources. Exits with a status code 1 if any linting errors are detected in the specified directory.", + "usage": "rpk connect mcp-server lint [flags]", + "aliases": [], + "flags": [ + { + "name": "deprecated", + "description": "Print linting errors for the presence of deprecated fields.", + "type": "bool", + "default": "false" + }, + { + "name": "labels", + "description": "Print linting errors when components do not have labels.", + "type": "bool", + "default": "false" + }, + { + "name": "skip-env-var-check", + "description": "Do not produce lint errors when environment interpolations exist without defaults within configs but aren't defined.", + "type": "bool", + "default": "false" + }, + { + "name": "verbose", + "description": "Print the lint result for each target file.", + "type": "bool", + "default": "false" + }, + { + "name": "secrets", + "description": "Attempt to load secrets from a provided URN. If more than one entry is specified they will be attempted in order until a value is found. Environment variable lookups are specified with the URN env:, which by default is the only entry. In order to disable all secret lookups specify a single entry of `none:`.", + "type": "strings", + "default": "\"env:\"" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + }, + { + "name": "plugin", + "description": "Manage custom Redpanda Connect plugins. Use these commands to create and initialize plugin projects for extending Redpanda Connect with custom components.", + "usage": "rpk connect plugin [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "init", + "description": "Generate a project on the local filesystem that can be used as a starting point for building a custom component for Redpanda Connect. It will overwrite all files in the specified directory (or the current directory if none is specified).", + "usage": "rpk connect plugin init [flags]", + "aliases": [], + "flags": [ + { + "name": "language", + "description": "The programming language to use for the plugin. Supported languages are: golang, python.", + "type": "string", + "default": "\"python\"" + }, + { + "name": "component", + "description": "The type of component to generate. Supported components are: input, output, processor.", + "type": "string", + "default": "\"processor\"" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Example", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect plugin init example-plugin" + } + ] + }, + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:reference:rpk/rpk-connect/rpk-connect-plugin-init.adoc[rpk connect plugin init]" + ], + "content": [ + { + "type": "important", + "position": "after_description", + "content": "This command is experimental and subject to change." + } + ] + }, + { + "name": "run", + "description": "Run a Redpanda Connect pipeline from a configuration file. The pipeline streams data between inputs and outputs with optional processing.", + "usage": "rpk connect run [flags]", + "aliases": [], + "flags": [ + { + "name": "log.level", + "description": "Logging level: `OFF`, `FATAL`, `ERROR`, `WARN`, `INFO`, `DEBUG`, `TRACE`, `ALL`. Default is `INFO`.", + "type": "string" + }, + { + "name": "set", + "description": "Override a configuration field. Format: `path=value`. Can be used multiple times.", + "shorthand": "s", + "type": "strings" + }, + { + "name": "resources", + "description": "Additional resource configuration files containing caches, rate limits, or other shared components.", + "shorthand": "r", + "type": "strings" + }, + { + "name": "chilled", + "description": "continue to execute a config containing linter errors", + "type": "bool", + "default": "false" + }, + { + "name": "watcher", + "description": "EXPERIMENTAL: watch config files for changes and automatically apply them", + "shorthand": "w", + "type": "bool", + "default": "false" + }, + { + "name": "secrets", + "description": "Attempt to load secrets from a provided URN. If more than one entry is specified they will be attempted in order until a value is found. Environment variable lookups are specified with the URN env:, which by default is the only entry. In order to disable all secret lookups specify a single entry of `none:`.", + "type": "strings", + "default": "\"env:\"" + }, + { + "name": "redpanda-license", + "description": "Provide an explicit Redpanda License, which enables enterprise functionality. By default licenses found at the path /etc/redpanda/redpanda.license are applied.", + "type": "string" + }, + { + "name": "chroot", + "description": "Chroot into the provided directory after parsing configuration. Common /etc/ files are copied to the chroot directory, and the directory is made read-only. This flag is only supported on Linux.", + "type": "string" + }, + { + "name": "chroot-passthrough", + "description": "Specify additional files to be copied into the chroot directory. This flag can be used multiple times. It is only supported when --chroot is used.", + "type": "strings" + }, + { + "name": "disable-telemetry", + "description": "Disable anonymous telemetry from being emitted by this Connect instance.", + "type": "bool", + "default": "false" + }, + { + "name": "telemetry-deployment-type", + "description": "Tags telemetry payloads with the deployment type. Expected values: self-hosted, byoc, serverless. When unset the field is omitted from the payload.", + "type": "string" + }, + { + "name": "telemetry-tenant-id", + "description": "Tags telemetry payloads with an opaque tenant identifier (typically the Redpanda Cloud organization ID for cloud-managed deployments). When unset the field is omitted from the payload.", + "type": "string" + }, + { + "name": "rpc-plugins", + "description": "Plugins to load over the RPC interface. This flag should point to manifest files containing the plugin definitions. Globs are also supported.", + "type": "strings" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "connect-flags", + "title": "Flags", + "position": "after_description", + "headingLevel": 2, + "content": "[cols=\"1m,1a,2a\"]\n|===\n|Value |Type |Description\n\n|--log.level |string |Override the configured log level. Acceptable values: `off`, `error`, `warn`, `info`, `debug`, `trace`.\n|--set |stringArray |Set a field (identified by a dot path) in the main configuration file. For example: `metrics.type=prometheus`.\n|--resources, -r |stringArray |Pull in extra resources from a file, which can be referenced the same as resources defined in the main config. This supports glob patterns (requires quotes).\n|--chilled |bool |Continue to execute a config containing linter errors (default: false).\n|--watcher, -w |bool |EXPERIMENTAL: Watch config files for changes and automatically apply them (default: false).\n|--env-file, -e |string |Import environment variables from a dotenv file.\n|--templates, -t |stringArray |EXPERIMENTAL: Import Redpanda Connect templates. This supports glob patterns (requires quotes).\n|===" + } + ] + }, + { + "name": "streams", + "description": "Run Redpanda Connect in streams mode, where multiple pipelines can be executed in a single process and can be created, updated, and removed via REST HTTP endpoints. The config field specified with the `--observability`/`-o` flag is known as the root config and should only contain observability and service-wide config fields such as http, metrics, logger, resources, and so on.", + "usage": "rpk connect streams [flags]", + "aliases": [], + "flags": [ + { + "name": "no-api", + "description": "Disable the HTTP API for streams mode", + "type": "bool", + "default": "false" + }, + { + "name": "prefix-stream-endpoints", + "description": "Whether HTTP endpoints registered by stream configs should be prefixed with the stream ID", + "type": "bool", + "default": "true" + }, + { + "name": "observability", + "description": "a path to a configuration file containing general service-wide fields such as http, logger, and so on", + "shorthand": "o", + "type": "string" + }, + { + "name": "log.level", + "description": "override the configured log level, options are: off, error, warn, info, debug, trace", + "type": "string" + }, + { + "name": "set", + "description": "set a field (identified by a dot path) in the main configuration file, e.g. \"metrics.type=prometheus\"", + "shorthand": "s", + "type": "strings" + }, + { + "name": "resources", + "description": "pull in extra resources from a file, which can be referenced the same as resources defined in the main config, supports glob patterns (requires quotes)", + "shorthand": "r", + "type": "strings" + }, + { + "name": "chilled", + "description": "continue to execute a config containing linter errors", + "type": "bool", + "default": "false" + }, + { + "name": "watcher", + "description": "EXPERIMENTAL: watch config files for changes and automatically apply them", + "shorthand": "w", + "type": "bool", + "default": "false" + }, + { + "name": "secrets", + "description": "Attempt to load secrets from a provided URN. If more than one entry is specified they will be attempted in order until a value is found. Environment variable lookups are specified with the URN env:, which by default is the only entry. In order to disable all secret lookups specify a single entry of `none:`.", + "type": "strings", + "default": "\"env:\"" + }, + { + "name": "redpanda-license", + "description": "Provide an explicit Redpanda License, which enables enterprise functionality. By default licenses found at the path /etc/redpanda/redpanda.license are applied.", + "type": "string" + }, + { + "name": "chroot", + "description": "Chroot into the provided directory after parsing configuration. Common /etc/ files are copied to the chroot directory, and the directory is made read-only. This flag is only supported on Linux.", + "type": "string" + }, + { + "name": "chroot-passthrough", + "description": "Specify additional files to be copied into the chroot directory. This flag can be used multiple times. It is only supported when --chroot is used.", + "type": "strings" + }, + { + "name": "disable-telemetry", + "description": "Disable anonymous telemetry from being emitted by this Connect instance.", + "type": "bool", + "default": "false" + }, + { + "name": "telemetry-deployment-type", + "description": "Tags telemetry payloads with the deployment type. Expected values: self-hosted, byoc, serverless. When unset the field is omitted from the payload.", + "type": "string" + }, + { + "name": "telemetry-tenant-id", + "description": "Tags telemetry payloads with an opaque tenant identifier (typically the Redpanda Cloud organization ID for cloud-managed deployments). When unset the field is omitted from the payload.", + "type": "string" + }, + { + "name": "rpc-plugins", + "description": "Plugins to load over the RPC interface. This flag should point to manifest files containing the plugin definitions. Globs are also supported.", + "type": "strings" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:connect:guides:streams_mode/about.adoc[Streams Mode]" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect streams" + }, + { + "description": "Example", + "code": "rpk connect streams -o ./root_config.yaml" + }, + { + "description": "Example", + "code": "rpk connect streams ./path/to/stream/configs ./and/some/more" + }, + { + "description": "Example", + "code": "rpk connect streams -o ./root_config.yaml ./streams/*.yaml" + } + ] + } + ] + }, + { + "name": "template", + "description": "Work with Redpanda Connect templates. Templates allow you to define reusable configuration patterns.", + "usage": "rpk connect template [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "lint", + "description": "Lint Redpanda Connect template files. Exits with a status code 1 if any linting errors are detected. If a path ends with '...' then Redpanda Connect will walk the target and lint any files with the .yaml or .yml extension.", + "usage": "rpk connect template lint [flags]", + "aliases": [], + "flags": [ + { + "name": "verbose", + "description": "Print the lint result for each target file.", + "type": "bool", + "default": "false" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect template lint" + }, + { + "description": "Example", + "code": "rpk connect template lint ./templates/*.yaml" + }, + { + "description": "Example", + "code": "rpk connect template lint ./foo.yaml ./bar.yaml" + }, + { + "description": "Example", + "code": "rpk connect template lint ./templates/..." + } + ] + } + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:connect:configuration:templating.adoc[Templating]" + ], + "content": [ + { + "type": "important", + "position": "after_description", + "content": "This subcommand, and templates in general, are experimental and subject to change outside of major version releases." + } + ] + }, + { + "name": "test", + "description": "Run unit tests defined in Redpanda Connect configuration files to verify pipeline behavior.", + "usage": "rpk connect test [flags]", + "aliases": [], + "flags": [ + { + "name": "log", + "description": "allow components to write logs at a provided level to stdout.", + "type": "string" + }, + { + "name": "verbose", + "description": "print all test case names before they are executed.", + "shorthand": "v", + "type": "bool", + "default": "false" + }, + { + "name": "resources", + "description": "pull in extra resources from a file, which can be referenced the same as resources defined in the main config, supports glob patterns (requires quotes)", + "shorthand": "r", + "type": "strings" + }, + { + "name": "env-file", + "description": "import environment variables from a dotenv file", + "shorthand": "e", + "type": "strings" + }, + { + "name": "templates", + "description": "EXPERIMENTAL: import Redpanda Connect templates, supports glob patterns (requires quotes)", + "shorthand": "t", + "type": "strings" + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "xref:connect:configuration:unit_testing.adoc[Unit Testing]" + ], + "content": [ + { + "type": "examples", + "title": "Examples", + "position": "after_aliases", + "items": [ + { + "description": "Example", + "code": "rpk connect test ./path/to/configs/..." + }, + { + "description": "Example", + "code": "rpk connect test ./foo_configs/*.yaml ./bar_configs/*.yaml" + }, + { + "description": "Example", + "code": "rpk connect test ./foo.yaml" + } + ] + } + ] + }, + { + "name": "uninstall", + "description": "Uninstall the Redpanda Connect plugin", + "usage": "rpk connect uninstall [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "upgrade", + "description": "Upgrade to the latest Redpanda Connect version", + "usage": "rpk connect upgrade [flags]", + "aliases": [], + "flags": [ + { + "name": "no-confirm", + "type": "bool", + "description": "Disable confirmation prompt for major version upgrades", + "default": false, + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "connect-docs-link", + "title": null, + "position": "after_description", + "content": "For full details, see the xref:connect:streaming:about.adoc[Redpanda Connect documentation]." + } + ] + }, + { + "name": "container", + "description": "Manage a local Redpanda container cluster for development and testing. Creates containers using Docker or Podman.", + "usage": "rpk container [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "purge", + "description": "Stop and remove an existing local container cluster's data", + "usage": "rpk container purge [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + }, + { + "name": "start", + "description": "Start a local container cluster.\n\nThis command uses Docker to initiate a local Redpanda container cluster,\nincluding Redpanda Console. Use the '--nodes'/'-n' flag to specify the number of\nbrokers.\n\nThe initial broker starts on default ports, with subsequent brokers' ports\noffset by 1000. You can use the listeners flag to specify ports:\n\n * --kafka-ports\n * --admin-ports\n * --rpc-ports\n * --schema-registry-ports\n * --proxy-ports\n * --console-port\n\nEach flag accepts a comma-separated list of ports for your listeners. Use the\n'--any-port' flag to let rpk select random available ports for every listener on\nthe host machine.\n\nBy default, this command uses the redpandadata/redpanda:latest and \nredpandadata/console:latest container images. You can specify a container image \nby using the '--image' flag.\n\nIn case of IP address pool conflict, you may specify a custom subnet and gateway\nusing the '--subnet' and '--gateway' flags respectively.\n", + "usage": "rpk container start [flags]", + "aliases": [], + "examples": "\nStart a three-broker cluster:\n rpk container start -n 3\n\nStart a single-broker cluster, selecting random ports for every listener:\n rpk container start --any-port\n\nStart a three-broker cluster, selecting the seed Kafka and Redpanda Console \nports only:\n rpk container start --kafka-ports 9092 --console-port 8080\n\nStart a three-broker cluster, selecting the Admin API port for each broker:\n rpk container start --admin-ports 9644,9645,9646\n", + "flags": [ + { + "name": "admin-ports", + "type": "stringSlice", + "description": "Redpanda Admin API ports to listen on; check help text for more information", + "default": [], + "required": false + }, + { + "name": "any-port", + "type": "bool", + "description": "Opt in for any (random) ports in all listeners", + "default": false, + "required": false + }, + { + "name": "console-image", + "type": "string", + "description": "An arbitrary Redpanda Console container image to use", + "default": "redpandadata/console:v3.8.0", + "required": false + }, + { + "name": "console-port", + "type": "string", + "description": "Redpanda console ports to listen on; check help text for more information", + "default": "8080", + "required": false + }, + { + "name": "gateway", + "type": "string", + "description": "Gateway IP address for the subnet. Must be in the subnet address range", + "default": "172.24.1.1", + "required": false + }, + { + "name": "image", + "type": "string", + "description": "An arbitrary Redpanda container image to use", + "default": "redpandadata/redpanda:latest", + "required": false + }, + { + "name": "kafka-ports", + "type": "stringSlice", + "description": "Kafka protocol ports to listen on; check help text for more information", + "default": [], + "required": false + }, + { + "name": "no-profile", + "type": "bool", + "description": "If true, rpk will not create an rpk profile after creating a cluster", + "default": false, + "required": false + }, + { + "name": "nodes", + "shorthand": "n", + "type": "uint", + "description": "The number of brokers (nodes) to start", + "default": 1, + "required": false + }, + { + "name": "proxy-ports", + "type": "stringSlice", + "description": "HTTP Proxy ports to listen on; check help text for more information", + "default": [], + "required": false + }, + { + "name": "pull", + "type": "bool", + "description": "Force pull the container image used", + "default": false, + "required": false + }, + { + "name": "retries", + "type": "uint", + "description": "The number of times to check for the cluster before considering it unstable and exiting.", + "default": 10, + "required": false + }, + { + "name": "rpc-ports", + "type": "stringSlice", + "description": "RPC ports to listen on; check help text for more information", + "default": [], + "required": false + }, + { + "name": "schema-registry-ports", + "type": "stringSlice", + "description": "Schema Registry ports to listen on; check help text for more information", + "default": [], + "required": false + }, + { + "name": "set", + "type": "string", + "description": "Redpanda configuration property to set upon start. Follows 'rpk redpanda config set' format", + "default": "", + "required": false + }, + { + "name": "subnet", + "type": "string", + "description": "Subnet to create the cluster network on", + "default": "172.24.1.0/24", + "required": false + } + ], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "seeAlso": [ + "https://hub.docker.com/r/redpandadata/redpanda/tags[Docker Hub]", + { + "content": "xref:get-started:quick-start.adoc#tabs-1-single-brokers[QuickStart - Deploy Redpanda to Docker with a Single Broker]", + "selfHostedOnly": true + }, + { + "content": "xref:get-started:quick-start.adoc#tabs-1-three-brokers[QuickStart - Deploy Redpanda to Docker with Three Nodes]", + "selfHostedOnly": true + } + ], + "content": [ + { + "type": "examples", + "position": "after_aliases", + "title": "Examples", + "items": [ + { + "description": "Start a three-broker cluster", + "code": "rpk container start -n 3" + }, + { + "description": "Start a single-broker cluster, selecting random ports for every listener", + "code": "rpk container start --any-port" + }, + { + "description": "Start a 3-broker cluster, selecting the seed kafka and console port only", + "code": "rpk container start --kafka-ports 9092 --console-port 8080" + }, + { + "description": "Start a three-broker cluster, specifying the Admin API port for each broker", + "code": "rpk container start --admin-ports 9644,9645,9646" + } + ] + } + ] + }, + { + "name": "status", + "description": "Get the status of a local container cluster, including the node IDs, ports, and running state of each broker.", + "usage": "rpk container status [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ], + "content": [ + { + "type": "section", + "id": "example", + "title": "Example", + "position": "end", + "headingLevel": 2, + "content": "[,bash]\n----\nrpk container status\nNODE-ID STATUS KAFKA-ADDRESS ADMIN-ADDRESS PROXY-ADDRESS SCHEMA-REGISTRY-ADDRESS\n0 running 127.0.0.1:9092 127.0.0.1:9644 127.0.0.1:8082 127.0.0.1:8081\n\nRedpanda Console started in: http://localhost:8080\n\nYou can use rpk to interact with this cluster. E.g:\n\n rpk cluster info\n rpk cluster health\n\nYou may also set an environment variable with the comma-separated list of\nbroker addresses:\n\n export RPK_BROKERS=\"127.0.0.1:34189,127.0.0.1:45523,127.0.0.1:37223\"\n rpk cluster info\n----" + }, + { + "type": "self-hosted", + "position": "after_flags", + "content": "== Example\n\nIf you're following xref:get-started:quick-start.adoc#tabs-1-three-brokers[Quick Start - Deploy Redpanda to Docker with Three Nodes], you can run `rpk container status` to see more information about your containers." + } + ] + }, + { + "name": "stop", + "description": "Stop an existing local container cluster", + "usage": "rpk container stop [flags]", + "aliases": [], + "flags": [], + "commands": [], + "platforms": [ + "linux", + "darwin" + ] + } + ], + "platforms": [ + "linux", + "darwin" + ], + "prerequisites": [ + "Docker or Podman must be installed and running", + "The current user must have permission to run containers" + ], + "seeAlso": [ + "xref:get-started:intro-to-rpk.adoc[Introduction to rpk]", + "xref:get-started:quick-start.adoc[Quick Start Guide]" + ], + "pageAliases": "features:guide-rpk-container.adoc, deployment:guide-rpk-container.adoc", + "content": [ + { + "type": "note", + "position": "after_description", + "content": "Container clusters are intended for development and testing only. Do not use for production workloads." + } + ] + }, + { + "name": "debug", + "description": "Debug the local Redpanda process", + "usage": "rpk debug [flags]", + "aliases": [], + "flags": [], + "commands": [ + { + "name": "bundle", + "description": "The `rpk debug bundle` command collects environment data that can help debug and diagnose issues with a Redpanda cluster, a broker, or the machine it's running on. It then bundles the collected data into a ZIP file, called a diagnostics bundle.", + "usage": "rpk debug bundle [flags]", + "aliases": [], + "flags": [ + { + "name": "controller-logs-size-limit", + "type": "string", + "description": "The size limit of the controller logs that can be stored in the bundle. For example: 3MB, 1GiB", + "default": "132MB", + "required": false + }, + { + "name": "cpu-profiler-wait", + "type": "duration", + "description": "How long to collect samples for the CPU profiler. For example: 30s, 1.5m. Must be higher than 15s", + "default": "30s", + "required": false + }, + { + "name": "kafka-connections-limit", + "type": "int", + "description": "The maximum number of Kafka connections to store in the bundle.", + "default": 256, + "required": false + }, + { + "name": "label-selector", + "shorthand": "l", + "type": "stringArray", + "description": "Comma-separated label selectors to filter your resources. For example: