Deploy a Local Development Cluster with kind or minikube

Deploy a local Redpanda cluster with Redpanda Console using the Helm chart. Explore the essentials of how Redpanda works in Kubernetes and what components are deployed by default. Then, use rpk both as an internal client and an external client to interact with your Redpanda cluster from the command line.

Looking for the Redpanda Operator?

If you're an existing user of the Redpanda Operator, see the Redpanda Operator documentation.

warning

Redpanda recommends the Helm chart for new users and for those who are getting started. The Redpanda Operator is for experienced users. The Redpanda Operator was built for Redpanda Cloud and has unique features and workflows for that specific use case.

Prerequisites

Before you begin, make sure that you have the correct software for your Kubernetes platform:

All platforms

• kubectl. Minimum required Kubernetes version: 1.21

  kubectl version --short --client

• Helm. Minimum required Helm version: 3.6.0

  helm version

kind

• kind

• Docker

minikube

minikube

Create a Kubernetes cluster

In this step, you create one master and three worker nodes (one worker node for each Redpanda broker).

kind

1. Define a cluster in the kind.yaml configuration file:

   cat <<EOF >kind.yaml
   ---
   apiVersion: kind.x-k8s.io/v1alpha4
   kind: Cluster
   nodes:
     - role: control-plane
     - role: worker
     - role: worker
     - role: worker
   EOF

2. Create the Kubernetes cluster from the configuration file:

   kind create cluster --config kind.yaml

minikube

1. Create the Kubernetes cluster:

   minikube start --namespace redpanda --nodes 4

2. Prevent applications from being scheduled on the Kubernetes control plane node:

   kubectl taint node \
       -l node-role.kubernetes.io/control-plane="" \
       node-role.kubernetes.io/control-plane=:NoSchedule

Deploy Redpanda and Redpanda Console

In this step, you deploy Redpanda with self-signed TLS certificates. Redpanda Console is included as a subchart in the Redpanda Helm chart.

1. Add the Redpanda Helm chart repository and install cert-manager using Helm:

   helm repo add redpanda https://charts.redpanda.com
   helm repo add jetstack https://charts.jetstack.io
   helm repo updatehelm install cert-manager jetstack/cert-manager  --set installCRDs=true --namespace cert-manager  --create-namespace

   The Redpanda Helm chart uses cert-manager to manage TLS certificates.

2. Install Redpanda using Helm:

   export DOMAIN=customredpandadomain.local && \
   helm repo add redpanda https://charts.redpanda.com/
   helm repo update
   helm install redpanda redpanda/redpanda \
     --namespace redpanda \
     --create-namespace \
     --set external.domain=${DOMAIN}

   The installation displays some tips for getting started.

3. Wait for the Redpanda cluster to be ready:

   kubectl -n redpanda rollout status statefulset redpanda --watch

   When the Redpanda cluster is ready, the output should look similar to the following:

   statefulset rolling update complete 3 pods at revision redpanda-8654f645b4...

   If your cluster remains in a pending state, see Troubleshooting.

Start streaming

Each Redpanda broker comes with rpk, which is a CLI tool for connecting to and interacting with Redpanda brokers. You can use rpk inside one of the Redpanda broker's Docker containers to create a topic, produce messages to it, and consume messages from it.

1. Create an alias to simplify the rpk commands:

   alias rpk-topic="kubectl -n redpanda exec redpanda-0 -c redpanda -- rpk topic --brokers redpanda-0.redpanda.redpanda.svc.cluster.local.:9093,redpanda-1.redpanda.redpanda.svc.cluster.local.:9093,redpanda-2.redpanda.redpanda.svc.cluster.local.:9093 --tls-truststore /etc/tls/certs/default/ca.crt --tls-enabled"

2. Create a topic called twitch_chat:

   rpk-topic create twitch_chat
   Example output

   TOPIC       STATUS
   twitch_chat  OK

3. Describe the topic:

   rpk-topic describe twitch_chat
   Example output

   SUMMARY
   =======
   NAME        twitch_chat
   PARTITIONS  1
   REPLICAS    1
   
   CONFIGS
   =======
   KEY                     VALUE                          SOURCE
   cleanup.policy          delete                         DYNAMIC_TOPIC_CONFIG
   compression.type        producer                       DEFAULT_CONFIG
   message.timestamp.type  CreateTime                     DEFAULT_CONFIG
   partition_count         1                              DYNAMIC_TOPIC_CONFIG
   redpanda.datapolicy     function_name:  script_name:   DEFAULT_CONFIG
   redpanda.remote.read    false                          DEFAULT_CONFIG
   redpanda.remote.write   false                          DEFAULT_CONFIG
   replication_factor      1                              DYNAMIC_TOPIC_CONFIG
   retention.bytes         -1                             DEFAULT_CONFIG
   retention.ms            604800000                      DEFAULT_CONFIG
   segment.bytes           1073741824                     DEFAULT_CONFIG

4. Produce a message to the topic:

   rpk-topic produce twitch_chat

5. Type a message, then press Enter:

   Pandas are fabulous!
   Example output

   Produced to partition 0 at offset 0 with timestamp 1663282629789.

6. Press Ctrl+C to finish producing messages to the topic.

7. Consume one message from the topic:

   rpk-topic consume twitch_chat --num 1
   Example output

   Your message is displayed along with its metadata,:

   {
     "topic": "twitch_chat",
     "value": "Pandas are fabulous!",
     "timestamp": 1663282629789,
     "partition": 0,
     "offset": 0
   }

Explore your topic in Redpanda Console

Redpanda Console is a developer-friendly web UI for managing and debugging your Redpanda cluster and your applications.

In this step, you use port-forwarding to access Redpanda Console on your local network.

important

Because you're using the Community Edition of Redpanda Console, you should not expose Redpanda Console outside your local network. The Community Edition of Redpanda Console does not provide authentication, and it connects to the Redpanda cluster as superuser. To use the Enterprise Edition, you need a license key, see Redpanda Licensing.

1. Expose Redpanda Console to your localhost:

   kubectl -n redpanda port-forward svc/redpanda-console 8080:8080
   Example output

   Forwarding from 127.0.0.1:8080 -> 8080
   Forwarding from [::1]:8080 -> 8080

   The kubectl port-forward command actively runs in the command-line window. To execute other commands while the command is running, open another command-line window.

2. Open Redpanda Console on localhost:8080.

   All your Redpanda brokers are listed along with their IP addresses and IDs.

3. Go to Topics > twitch_chat.

   The message that you produced to the topic is displayed along with some other details about the topic.

4. Press Ctrl + C in the command-line to stop the port-forwarding process.

Configure external access to the Redpanda brokers

Because external clients are not in the Kubernetes cluster where the Redpanda brokers are running, they cannot resolve the internal addresses of the headless ClusterIP Service. Instead, Redpanda brokers must also advertise an externally accessible address that external clients can connect to.

When you created the cluster, you set the external.domain configuration to customredpandadomain.local, which means that your Redpanda brokers are advertising the following addresses:

• redpanda-0.customredpandadomain.local
• redpanda-1.customredpandadomain.local
• redpanda-2.customredpandadomain.local

To access your Redpanda brokers externally, you can map your worker nodes' IP addresses to these domains.

note

IP addresses can change. If the IP addresses of your worker nodes change, you must update your /etc/hosts file with the new mappings.

Linux

1. Add mappings in your /etc/hosts file between your worker nodes' IP addresses and their custom domain names:

   sudo true && kubectl -n redpanda get endpoints,node -A -o go-template='{{ range $_ := .items }}{{ if and (eq .kind "Endpoints") (eq .metadata.name "redpanda-external") }}{{ range $_ := (index .subsets 0).addresses }}{{ $nodeName := .nodeName }}{{ $podName := .targetRef.name }}{{ range $node := $.items }}{{ if and (eq .kind "Node") (eq .metadata.name $nodeName) }}{{ range $_ := .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }} {{ $podName }}.${DOMAIN}{{ "\n" }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}' | envsubst | sudo tee -a /etc/hosts
   /etc/hosts

   203.0.113.3 redpanda-0.customredpandadomain.local
   203.0.113.5 redpanda-1.customredpandadomain.local
   203.0.113.7 redpanda-2.customredpandadomain.local

2. Save the root certificate authority (CA) to your local file system outside Kubernetes:

   kubectl -n redpanda get secret redpanda-default-root-certificate -o go-template='{{ index .data "ca.crt" | base64decode }}' > ca.crt

3. Install rpk on your local machine, not on a Pod:

   1. Download the rpk archive for Linux:

      curl -LO https://github.com/redpanda-data/redpanda/releases/latest/download/rpk-linux-amd64.zip

   2. Ensure that you have the folder ~/.local/bin:

      mkdir -p ~/.local/bin

   3. Add it to your $PATH:

      export PATH="~/.local/bin:$PATH"

   4. Unzip the rpk files to your ~/.local/bin/ directory:

      unzip rpk-linux-amd64.zip -d ~/.local/bin/

   5. Run rpk version to display the rpk binary version:

      rpk version
      Example output

      v22.3.11 (rev 9eefb907c)

4. Set the REDPANDA_BROKERS environment variable to the custom domains of your Redpanda brokers:

   export REDPANDA_BROKERS=redpanda-0.customredpandadomain.local:31092,redpanda-1.customredpandadomain.local:31092,redpanda-2.customredpandadomain.local:31092
   note

   31092 is the Kafka API port that's exposed by the default NodePort Service.

5. Describe the topic:

   rpk topic describe twitch_chat --tls-enabled --tls-truststore=ca.crt
   Example output

   SUMMARY
   =======
   NAME        twitch_chat
   PARTITIONS  1
   REPLICAS    1
   
   CONFIGS
   =======
   KEY                     VALUE                          SOURCE
   cleanup.policy          delete                         DYNAMIC_TOPIC_CONFIG
   compression.type        producer                       DEFAULT_CONFIG
   message.timestamp.type  CreateTime                     DEFAULT_CONFIG
   partition_count         1                              DYNAMIC_TOPIC_CONFIG
   redpanda.datapolicy     function_name:  script_name:   DEFAULT_CONFIG
   redpanda.remote.read    false                          DEFAULT_CONFIG
   redpanda.remote.write   false                          DEFAULT_CONFIG
   replication_factor      1                              DYNAMIC_TOPIC_CONFIG
   retention.bytes         -1                             DEFAULT_CONFIG
   retention.ms            604800000                      DEFAULT_CONFIG
   segment.bytes           1073741824                     DEFAULT_CONFIG

macOS

On macOS, the kind tool is meant for local testing. To test external access, use GKE, EKS, or AKS.

Windows

On Windows, the kind tool is meant for local testing. To test external access, use GKE, EKS, or AKS.

Explore the default Kubernetes components

By default, the Redpanda Helm chart deploys the following Kubernetes components:

• A StatefulSet with three Pods.
• One PersistentVolumeClaim for each Pod, each with a capacity of 20Gi.
• A headless ClusterIP Service and a NodePort Service for each Kubernetes node that runs a Redpanda broker.
• Self-Signed TLS Certificates.

StatefulSet

Redpanda is a stateful application. Each Redpanda broker needs to store its own state (topic partitions) in its own storage volume. As a result, the Helm chart deploys a StatefulSet to manage the Pods in which the Redpanda brokers are running.

kubectl get statefulset -n redpanda

Example output

NAME       READY   AGE
redpanda   3/3     3m11s

StatefulSets ensure that the state associated with a particular Pod replica is always the same, no matter how often the Pod is recreated. Each Pod is also given a unique ordinal number in its name such as redpanda-0. A Pod with a particular ordinal number is always associated with a PersistentVolumeClaim with the same number. When a Pod in the StatefulSet is deleted and recreated, it is given the same ordinal number and so it mounts the same storage volume as the deleted Pod that it replaced.

kubectl get pod -n redpanda

Example output

NAME                              READY   STATUS      RESTARTS        AGE
redpanda-0                        1/1     Running     0               6m9s
redpanda-1                        1/1     Running     0               6m9s
redpanda-2                        1/1     Running     0               6m9s
redpanda-console-5ff45cdb9b-6z2vs 1/1     Running     0               5m
redpanda-configuration-smqv7      0/1     Completed   0               6m9s

note

The redpanda-configuration Job updates the Redpanda runtime configuration.

PersistentVolumeClaim

Redpanda brokers must be able to store their data on disk. By default, the Helm chart uses the default StorageClass in the Kubernetes cluster to create a PersistentVolumeClaim for each Pod. The default StorageClass in your Kubernetes cluster depends on the Kubernetes platform that you are using.

kubectl get persistentvolumeclaims -n redpanda

Example output

NAME                 STATUS   VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
datadir-redpanda-0   Bound    pvc-3311ade3-de84-4027-80c6-3d8347302962   20Gi       RWO            standard       75s
datadir-redpanda-1   Bound    pvc-4ea8bc03-89a6-41e4-b985-99f074995f08   20Gi       RWO            standard       75s
datadir-redpanda-2   Bound    pvc-45c3555f-43bc-48c2-b209-c284c8091c45   20Gi       RWO            standard       75s

Service

The clients writing to or reading from a given partition have to connect directly to the leader broker that hosts the partition. As a result, clients needs to be able to connect directly to each Pod. To allow internal and external clients to connect to each Pod that hosts a Redpanda broker, the Helm chart configures two Services:

• Internal using the Headless ClusterIP
• External using the NodePort

kubectl get service -n redpanda

Example output

NAME                TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                       AGE
redpanda            ClusterIP   None            <none>        <none>                                                        5m37s
redpanda-console    ClusterIP   10.0.251.204    <none>        8080                                                          5m
redpanda-external   NodePort    10.96.137.220   <none>        9644:31644/TCP,9094:31092/TCP,8083:30082/TCP,8080:30081/TCP   5m37s

Headless ClusterIP Service

The headless Service associated with a StatefulSet gives the Pods their network identity in the form of a fully qualified domain name (FQDN). Both Redpanda brokers in the same Redpanda cluster and clients within the same Kubernetes cluster use this FQDN to communicate with each other.

note

An important requirement of distributed applications such as Redpanda is peer discovery: The ability for each broker to find other brokers in the same cluster. When each Pod is rolled out, its seed_servers field is updated with the FQDN of each Pod in the cluster so that they can discover each other.

kubectl -n redpanda exec redpanda-0 -c redpanda -- cat etc/redpanda/redpanda.yaml

redpanda:
    data_directory: /var/lib/redpanda/data
    empty_seed_starts_cluster: false
    
    seed_servers:
        - host:
            address: redpanda-0.redpanda.redpanda.svc.cluster.local.
            port: 33145
        - host:
            address: redpanda-1.redpanda.redpanda.svc.cluster.local.
            port: 33145
        - host:
            address: redpanda-2.redpanda.redpanda.svc.cluster.local.
            port: 33145

NodePort Service

External access is made available by a NodePort service that opens the following ports by default for the listeners:

Node port	Pod port	Listener
30081	8081	Schema Registry
30082	8083	HTTP Proxy
31092	9094	Kafka API
31644	9644	Admin API

To learn more, see Networking and Connectivity in Kubernetes.

TLS Certificates

By default, TLS is enabled in the Redpanda Helm chart. The Helm chart uses cert-manager to generate two Certificate resources that provide Redpanda with self-signed certificates:

• The redpanda-default-cert Certificate is the TLS certificate that is used by all listeners.
• The redpanda-default-root-certificate Certificate is the root certificate authority for the TLS certificates.

kubectl get certificate -n redpanda

NAME                                 READY   SECRET                               AGE
redpanda-default-cert                True    redpanda-default-cert                10m
redpanda-default-root-certificate    True    redpanda-default-root-certificate    10m

Troubleshooting

Before troubleshooting your cluster, make sure that you have all the prerequisites.

For troubleshooting steps, see Troubleshoot Redpanda in Kubernetes.

Next steps

• Build a sample application
• Learn more about Redpanda Console
• Learn more about rpk

tip

When you're ready to use a registered domain, make sure to remove your entries from the /etc/hosts file, and see Configure External Access through a NodePort Service

Suggested reading

• Networking and Connectivity in Kubernetes.

• Configure TLS for Redpanda in Kubernetes

• Configure SASL for Redpanda in Kubernetes

• See the Redpanda Console README on GitHub.

• Explore the Redpanda Helm chart's values.yaml file to learn what else you can configure.

• Explore the Redpanda Console Helm chart's values.yaml file to learn what else you can configure.