Agentic Data Plane
Preview

rpk ai llm-provider create

Create an LLM provider.

Choose the provider-config by setting flags from one group; the group you use selects it: openai-config, anthropic-config, google-config, bedrock-config, openai-compatible-config. Setting flags from two groups is an error.

This command was introduced in ai version 0.2.28.

Usage

rpk ai llm-provider create [flags]

Examples

This section provides examples of how to use rpk ai llm-provider create.

rpk ai llm-provider create my-llm-provider \
  --openai-config.api-key-ref OPENAI_API_KEY

Flags

Value Type Description

--display-name

string

Human-readable name for display in the UI.

--provider-models

stringArray

Model identifiers available through this provider. Leave empty to allow all models. (repeatable; name (bare values comma-split) or protojson object; replaces the full list on update).

--enabled

bool

Whether this provider is active and accepting requests. (true when set; pass --enabled=false to disable).

--openai-config.base-url

string

Override the default API endpoint. Leave empty for the standard OpenAI API.

--openai-config.api-key-ref

string

Secret store reference for the API key. Leave empty for no-auth endpoints (Ollama, vLLM, local models).

--anthropic-config.base-url

string

Override the default API endpoint. Leave empty for the standard Anthropic API.

--anthropic-config.api-key-ref

string

Secret store reference for the API key. Leave empty when using authorization passthrough.

--anthropic-config.authorization-passthrough

bool

Forward the client’s Authorization header to Anthropic instead of using a server-side API key. Used for enterprise/Max plan OAuth passthrough. (true when set; pass --anthropic-config.authorization-passthrough=false to disable).

--google-config.base-url

string

Override the default API endpoint. Leave empty for the standard Google AI API.

--google-config.api-key-ref

string

Secret store reference for the Google AI API key.

--bedrock-config.region

string

AWS region where the Bedrock endpoint is deployed. (required in its group) (alias: --region).

--bedrock-config.base-url

string

Override the default Bedrock endpoint URL. Leave empty for the standard regional endpoint.

--bedrock-config.static-credentials.access-key-id-ref

string

Secret store reference for the AWS access key ID. (required in its group) (alias: --access-key-id-ref).

--bedrock-config.static-credentials.secret-access-key-ref

string

Secret store reference for the AWS secret access key. (required in its group) (alias: --secret-access-key-ref).

--bedrock-config.assume-role.role-arn

string

ARN of the IAM role to assume for Bedrock access. (required in its group) (alias: --role-arn).

--bedrock-config.assume-role.external-id

string

External ID for cross-account role assumption. Required when the role’s trust policy mandates it.

--bedrock-config.assume-role.session-name

string

Session name for CloudTrail audit logging.

--openai-compatible-config.base-url

string

Override the default API endpoint. Leave empty for the standard OpenAI API.

--openai-compatible-config.api-key-ref

string

Secret store reference for the API key. Leave empty for no-auth endpoints (Ollama, vLLM, local models).

--transcripts.record-input-messages

bool

Capture full request bodies (prompts) on observability traces. (true when set; pass --transcripts.record-input-messages=false to disable).

--transcripts.record-output-messages

bool

Capture full response bodies (completions) on observability traces. (true when set; pass --transcripts.record-output-messages=false to disable).

--guardrail

string

Name of a Guardrail to attach to this provider. Leave empty for no guardrail. For Bedrock provider the guardrail uses AWS Bedrock Guardrail directly. For all other providers the proxy evaluates user input against the Bedrock Guardrail’s standalone backend. In both cases a guardrail intervention short-circuits the request.

--tags

stringArray

Tags. (repeatable key=value; replaces the full map on update). (New in 0.2.33)

-f, --filename

string

manifest to create from (YAML or JSON; "-" for stdin); flags override file values.

--dry-run

bool

print the request that would be sent (with the computed update mask) and exit without calling the server.

--pricing

stringArray

per-model pricing override in USD per million tokens (repeatable). Keys: model (required), input, output, cached, cache_write_5m, cache_write_1h; for example, model=gpt-4o,input=2.50,output=10.00,cached=1.25. Omitted rates keep the catalog default; 0 means an explicit free rate. Merges into --provider-models by model name; on update it replaces the whole model list. (New in 0.2.41)

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.