Agentic Data Plane

Create an Agentic Data Plane Environment

Create a Redpanda Agentic Data Plane environment to build and govern agents in your Amazon Web Services (AWS) account or Google Cloud Platform (GCP) project through BYOC.

After reading this page, you will be able to:

Configure an environment’s cloud provider, region, and network access
Provision the environment with the generated rpk command
Verify readiness, open the environment, and peer it with a VPC you own

Prerequisites

A Redpanda Cloud organization with a plan that includes Agentic Data Plane for your chosen cloud provider. The organization needs available quota for Agentic Data Plane environments, BYOC networks, and BYOC cores. Contact Redpanda Support to confirm access and quotas or request higher limits.
Permission to create clusters in the resource group you select. If you don’t have it, ask your organization administrator to grant it.
rpk installed on the machine where you run the apply command.
Credentials for the target AWS account or GCP project, with permission to provision BYOC infrastructure. Ask your cloud administrator to prepare this access. For credential setup, see the AWS credential configuration or Google Cloud authentication documentation. Redpanda Cloud authentication does not replace these cloud-provider credentials.
An IPv4 CIDR block that does not overlap any network you plan to connect to the environment. Review CIDR range guidelines.
If you plan to choose Private access, a network path from your computer to the environment’s virtual private cloud (VPC), such as a VPN, VPC peering, AWS PrivateLink, or Google Cloud Private Service Connect. Without one, you can’t open the environment in the Agentic Data Plane UI or use rpk ai against it. Plan the connection before you create the environment.

Configure the environment

The Cloud UI records your settings. You then run an rpk command to start provisioning in your cloud account.

Sign in to the Redpanda Cloud UI and select the organization where you want to create the environment.
In the navigation menu, click Agentic Data Planes, then click Create Agentic Data Plane.

In the Details section, configure these fields:

Field What to enter

Field	What to enter
`Name`	A name unique within your organization, such as `example-environment`. Use one to 63 lowercase letters, numbers, or hyphens. Start with a letter and end with a letter or number.
`Resource group`	Select a resource group where you have permission to create clusters, or confirm the preselected group if one is shown.
`Cloud provider`	`AWS` or `Google Cloud`. The form offers only providers included in your organization’s plan.
`Region`	An available region in your selected cloud provider.

Name

A name unique within your organization, such as example-environment. Use one to 63 lowercase letters, numbers, or hyphens. Start with a letter and end with a letter or number.

Resource group

Select a resource group where you have permission to create clusters, or confirm the preselected group if one is shown.

Cloud provider

AWS or Google Cloud. The form offers only providers included in your organization’s plan.

Region

An available region in your selected cloud provider.

Figure 1. The creation form with example AWS settings

In the Networking section, choose API gateway access:

Public (default): The Agentic Data Plane UI and rpk ai can reach the environment from the internet. Authentication and authorization apply.

Private: The Agentic Data Plane UI and rpk ai can reach the environment only from networks connected to the VPC.

Private means private. From any computer that isn’t connected to the environment’s VPC through a VPN, VPC peering, AWS PrivateLink, or Google Cloud Private Service Connect, the Agentic Data Plane UI at ai.redpanda.com can’t load the environment and rpk ai commands against it time out. Signing in to ai.redpanda.com and selecting the environment still work from anywhere. Everything after that needs the private network connection. Choose Private only if that connection is in place, or planned, for everyone who will use the environment. To connect a VPC you own after the environment is ready, see Peer your VPC with the environment.

You choose this setting when you create the environment. To change it later, an administrator edits API gateway access on the environment’s Dataplane settings page in the Redpanda Cloud UI. This option isn’t available to every organization, so choose carefully.

Set Redpanda Network IP CIDR block. The default is 10.0.0.0/16. Use an RFC 1918 private IPv4 network range with a prefix length from /16 to /20 on AWS, or /16 to /19 on GCP. The range must not overlap networks connected to the VPC, including any VPC you plan to peer with it. See Peer your VPC with the environment.
If you selected AWS and Private access and the form shows Egress Transit Gateway ID (optional), leave it empty to use the default NAT gateway path. To use an existing AWS Transit Gateway for outbound traffic instead, enter its ID.

The Transit Gateway must be in the same AWS account and region, accept VPC attachments, and have hub routes that do not overlap the environment’s CIDR block. This optional field is available only for organizations with Transit Gateway egress enabled. It does not configure client access to the environment.

Figure 2. AWS networking settings with private access selected and the optional egress field available
Click Create Agentic Data Plane.
Wait for State to show Apply required on the environment’s detail page. Creating the entry in the Cloud UI does not provision the environment by itself.

Apply the configuration

Run the generated command from a terminal with the cloud-provider credentials prepared in the prerequisites.

Sign in to the same Redpanda Cloud organization you used in the Cloud UI:
```
rpk cloud login
```
For authentication options, see rpk cloud login.
On the environment’s detail page, find the Apply command section. If you selected Google Cloud, enter your target project ID in GCP project ID to enable Copy command.
Click Copy command and run the copied command in your terminal. The Cloud UI fills in the environment ID. The commands have these forms:
AWS
```
rpk cloud byoc aws apply --redpanda-id <environment-id>
```
Google Cloud
```
rpk cloud byoc gcp apply --redpanda-id <environment-id> --project-id '<project-id>'
```
<environment-id> is the environment’s ID on the detail page. <project-id> is the GCP project where you want to provision it. Use the generated command rather than copying these placeholders unchanged.
Wait for the command to complete successfully. If it fails, resolve the reported error before continuing. Redpanda Cloud then provisions the infrastructure and installs the services. The environment shows Creating while provisioning continues.

Verify and open the environment

Return to the environment’s detail page and wait for State to show Ready.
Confirm that the Endpoints section lists AI Gateway URL and API URL.
If you selected Private access, connect your computer to the environment’s VPC first. From a browser outside that network, ai.redpanda.com can’t load the environment and instead asks you to connect to your private environment.
Click Open and confirm that the Agentic Data Plane UI loads for your environment. The Open button appears when the environment is Ready.

Peer your VPC with the environment

For an environment with Private access, VPC peering connects a VPC you own to the environment’s VPC over private IPv4 addresses. Clients in your VPC can then reach the environment’s endpoints, and agents and MCP servers in the environment can reach services in your VPC, such as a database.

You create and manage the peering in your own cloud account. Redpanda Cloud doesn’t create, track, or remove it.

Before you start:

Wait for the environment to show Ready. The Cloud UI shows Set up VPC peering only for an environment with Private access that is Ready.
On AWS, make sure your VPC is in the environment’s region.
Make sure your VPC’s CIDR block (AWS) or subnet ranges (Google Cloud) don’t overlap the environment’s CIDR block. Each peering connects one VPC to the environment. No two networks connected to the environment can have overlapping CIDR blocks.
Have credentials for the cloud account where you deployed the environment, and for the account that owns your VPC.

On the environment’s detail page in the Redpanda Cloud UI, the Networking section shows the environment’s VPC and CIDR. Click Set up VPC peering to open the VPC peering page, which shows these steps with the environment’s network ID, region, CIDR block, and AI Gateway URL filled in.

The AWS and Google Cloud commands refer to third-party products. For current syntax, see the vendor documentation linked in each tab.

AWS
Google Cloud

On AWS, the environment’s VPC carries the Name tag network-<network-id>, where <network-id> is the environment’s Redpanda network ID. With Private access, the endpoints accept connections only from addresses in 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 100.64.0.0/10.

Using credentials for the AWS account you deployed the environment into, request a peering connection from the environment’s VPC to your VPC:
```
ENV_VPC_ID=$(aws ec2 describe-vpcs --region <region> \
  --filters "Name=tag:Name,Values=network-<network-id>" \
  --query 'Vpcs[0].VpcId' --output text)
aws ec2 create-vpc-peering-connection --region <region> \
  --vpc-id "$ENV_VPC_ID" \
  --peer-vpc-id <peer-vpc-id>
```
Replace <region> with the environment’s region, <network-id> with its Redpanda network ID, and <peer-vpc-id> with the ID of the VPC to peer with. Your VPC must be in the same region. If it’s in another AWS account, add --peer-owner-id <peer-account-id>, where <peer-account-id> is the ID of the AWS account that owns your VPC.
Using credentials for the account that owns your VPC, accept the request. <peering-connection-id> is the ID that create-vpc-peering-connection returns, with a pcx- prefix. You use it again when you add routes.
```
aws ec2 accept-vpc-peering-connection --region <region> \
  --vpc-peering-connection-id <peering-connection-id>
```

Using credentials for the AWS account you deployed the environment into, add a route to your VPC’s CIDR block, <peer-vpc-cidr>, in each private route table of the environment’s VPC:

for route_table_id in $(aws ec2 describe-route-tables --region <region> \
    --filters "Name=tag:Name,Values=network-<network-id>" "Name=tag:purpose,Values=private" \
    --query 'RouteTables[].RouteTableId' --output text); do
  aws ec2 create-route --region <region> \
    --route-table-id "$route_table_id" \
    --destination-cidr-block <peer-vpc-cidr> \
    --vpc-peering-connection-id <peering-connection-id>
done

Using credentials for the account that owns your VPC, add a route to the environment’s CIDR block in each route table of the subnets your clients run in:
```
aws ec2 create-route --region <region> \
  --route-table-id <client-route-table-id> \
  --destination-cidr-block <environment-cidr> \
  --vpc-peering-connection-id <peering-connection-id>
```
Replace <client-route-table-id> with the ID of one of those route tables, and <environment-cidr> with the environment’s CIDR. Run the command once for each route table.
For agents and MCP servers to reach services in your VPC, allow inbound traffic from the environment’s CIDR block in those services' security groups.

For more about peering connections, see the AWS VPC peering documentation.

On Google Cloud, the environment’s VPC is the network redpanda-<network-id> in the project you deployed the environment into, where <network-id> is the environment’s Redpanda network ID. You create a peering from each side. With Private access, the endpoints use a regional internal load balancer, so clients must run in the environment’s region.

Using credentials for your VPC’s project, create a peering from your VPC to the environment’s VPC:
```
gcloud compute networks peerings create <peering-name> \
  --project=<peer-project-id> \
  --network=<peer-vpc-name> \
  --peer-project=<environment-project-id> \
  --peer-network=redpanda-<network-id>
```
Replace <peering-name> with a name for the peering, <peer-project-id> and <peer-vpc-name> with your VPC’s project and network name, and <environment-project-id> with the project you deployed the environment into.
Using credentials for the project you deployed the environment into, create the reverse peering from the environment’s VPC to your VPC. Google Cloud exchanges the subnet routes after both peerings are active.
```
gcloud compute networks peerings create <peering-name> \
  --project=<environment-project-id> \
  --network=redpanda-<network-id> \
  --peer-project=<peer-project-id> \
  --peer-network=<peer-vpc-name>
```
For agents and MCP servers to reach services in your VPC, allow ingress from the environment’s CIDR block in your VPC’s firewall rules.

For more about peering, see the Google Cloud VPC Network Peering documentation.

To test the connection, send a request to the environment’s AI Gateway URL from a machine in your VPC:

curl -sS -o /dev/null -w '%{http_code}\n' <ai-gateway-url>

Replace <ai-gateway-url> with the AI Gateway URL from the environment’s Endpoints section. Any HTTP status code means the network path works. A timeout means traffic doesn’t reach the environment.

To add another VPC, repeat these steps. Before you delete the environment, delete its peering connections.

Troubleshooting

Symptom Action

Symptom	Action
The navigation menu has no Agentic Data Planes entry, or the page shows `Agentic Data Planes unavailable`.	Confirm that you selected the intended organization. Contact Redpanda Support to check that its plan includes Agentic Data Plane for your cloud provider.
The page shows `Creation unavailable`.	Read the accompanying message. Creation may not be enabled, or the organization may have reached its limit. Contact Redpanda Support to enable creation or raise the limit.
Create Agentic Data Plane is disabled.	Complete the required fields and resolve validation errors. If the page reports a loading error, use its retry control. Confirm that you have permission to create clusters in the selected resource group. Ask your organization administrator to grant access if needed.
The creation form shows `Creation timed out` or `Creation not confirmed`.	Keep the form open and submit the same values again without reloading the page. Creation may still be in progress. Submitting unchanged values from the same form reuses the original request rather than allocating a duplicate.
The page shows `Creation progress unavailable`.	On the creation form, click Retry. On the environment’s detail page, click Retry progress. These controls retry the progress lookup without allocating another environment. If progress remains unavailable, contact Redpanda Support with the environment name and its ID if available.
The creation form shows `Creation failed` before the environment’s detail page opens.	Read the accompanying message and resolve any reported name or Transit Gateway conflict. For other allocation errors, contact Redpanda Support with the environment name and region, and ask them to check the organization’s Agentic Data Plane, BYOC network, and BYOC core quotas.
The environment remains in `Apply required`.	Run the command from its Apply command section with credentials for the target cloud account. Check the terminal output for errors. If it reports that the agent token is not provisioned yet, wait briefly and retry the same command.
The environment remains in `Creating` after the apply command completes.	Allow provisioning to finish. If the state does not progress to `Ready`, contact Redpanda Support with the environment ID and displayed status. Do not create a replacement environment to retry provisioning.
The environment shows `Failed`.	Contact Redpanda Support with the environment ID and the error shown. Cloud resources may remain after failed provisioning. Do not assume the failure removed them.
The environment is `Ready`, but ai.redpanda.com asks you to connect to your private environment, `rpk ai` warns that the environment is private, or an endpoint times out.	Your computer isn’t on a network connected to the environment’s VPC. Connect through your organization’s VPN, VPC peering, or private endpoint service, then click Reload page in ai.redpanda.com or rerun the `rpk ai` command. Test from the intended client network, not an unrelated internet connection. If access still fails, contact Redpanda Support with the environment ID.
After you peer a VPC, requests from it to the environment time out.	Confirm that the peering is active (on Google Cloud, both peerings). On AWS, confirm that both route directions exist. The environment’s private route tables must route to your VPC’s CIDR block, and your clients' route tables must route to the environment’s CIDR block. Also confirm that your clients use an address in one of the ranges listed for AWS, or run in the environment’s region on Google Cloud.
After you peer a VPC, agents or MCP servers can’t reach a service in it.	Allow inbound traffic from the environment’s CIDR block in the service’s security group (AWS) or your VPC’s firewall rules (Google Cloud).

The navigation menu has no Agentic Data Planes entry, or the page shows Agentic Data Planes unavailable.

Confirm that you selected the intended organization. Contact Redpanda Support to check that its plan includes Agentic Data Plane for your cloud provider.

The page shows Creation unavailable.

Read the accompanying message. Creation may not be enabled, or the organization may have reached its limit. Contact Redpanda Support to enable creation or raise the limit.

Create Agentic Data Plane is disabled.

Complete the required fields and resolve validation errors. If the page reports a loading error, use its retry control. Confirm that you have permission to create clusters in the selected resource group. Ask your organization administrator to grant access if needed.

The creation form shows Creation timed out or Creation not confirmed.

Keep the form open and submit the same values again without reloading the page. Creation may still be in progress. Submitting unchanged values from the same form reuses the original request rather than allocating a duplicate.

The page shows Creation progress unavailable.

On the creation form, click Retry. On the environment’s detail page, click Retry progress. These controls retry the progress lookup without allocating another environment. If progress remains unavailable, contact Redpanda Support with the environment name and its ID if available.

The creation form shows Creation failed before the environment’s detail page opens.

Read the accompanying message and resolve any reported name or Transit Gateway conflict. For other allocation errors, contact Redpanda Support with the environment name and region, and ask them to check the organization’s Agentic Data Plane, BYOC network, and BYOC core quotas.

The environment remains in Apply required.

Run the command from its Apply command section with credentials for the target cloud account. Check the terminal output for errors. If it reports that the agent token is not provisioned yet, wait briefly and retry the same command.

The environment remains in Creating after the apply command completes.

Allow provisioning to finish. If the state does not progress to Ready, contact Redpanda Support with the environment ID and displayed status. Do not create a replacement environment to retry provisioning.

The environment shows Failed.

Contact Redpanda Support with the environment ID and the error shown. Cloud resources may remain after failed provisioning. Do not assume the failure removed them.

The environment is Ready, but ai.redpanda.com asks you to connect to your private environment, rpk ai warns that the environment is private, or an endpoint times out.

Your computer isn’t on a network connected to the environment’s VPC. Connect through your organization’s VPN, VPC peering, or private endpoint service, then click Reload page in ai.redpanda.com or rerun the rpk ai command. Test from the intended client network, not an unrelated internet connection. If access still fails, contact Redpanda Support with the environment ID.

After you peer a VPC, requests from it to the environment time out.

Confirm that the peering is active (on Google Cloud, both peerings). On AWS, confirm that both route directions exist. The environment’s private route tables must route to your VPC’s CIDR block, and your clients' route tables must route to the environment’s CIDR block. Also confirm that your clients use an address in one of the ranges listed for AWS, or run in the environment’s region on Google Cloud.

After you peer a VPC, agents or MCP servers can’t reach a service in it.

Allow inbound traffic from the environment’s CIDR block in the service’s security group (AWS) or your VPC’s firewall rules (Google Cloud).

Next steps

Agentic Data Plane Quickstart for Administrators: Configure a large language model (LLM) provider and grant your builders access.
Agentic Data Plane Learning Path: Follow the ordered path from platform concepts to production integration.

Was this helpful?

group Ask in the community

mail Share your feedback