# Deploy a Redpanda Cluster in Google Kubernetes Engine > For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [streaming-full.txt](https://docs.redpanda.com/streaming-full.txt) --- title: Deploy a Redpanda Cluster in Google Kubernetes Engine latest-redpanda-tag: v25.1.1 latest-console-tag: v3.7.3 latest-operator-version: v26.1.4 # EOL = End-of-Life (support lifecycle status) page-is-nearing-eol: "false" page-is-past-eol: "true" page-eol-date: April 7, 2026 latest-connect-version: 4.93.0 docname: deployment-option/self-hosted/kubernetes/gke-guide page-component-name: streaming page-version: "25.1" page-component-version: "25.1" page-component-title: Streaming page-relative-src-path: deployment-option/self-hosted/kubernetes/gke-guide.adoc page-edit-url: https://github.com/redpanda-data/docs/edit/v/25.1/modules/deploy/pages/deployment-option/self-hosted/kubernetes/gke-guide.adoc description: Deploy a secure Redpanda cluster and Redpanda Console in Google Kubernetes Engine (GKE). page-git-created-date: "2023-05-30" page-git-modified-date: "2025-07-01" support-status: past end-of-life --- Deploy a secure Redpanda cluster and Redpanda Console in Google Kubernetes Engine (GKE). Then, use `rpk` both as an internal client and an external client to interact with your Redpanda cluster from the command line. Your Redpanda cluster has the following security features: - SASL for authenticating users' connections. - TLS with self-signed certificates for secure communication between the cluster and clients. ## [](#prerequisites)Prerequisites - Complete the 'Before you begin' steps and the 'Launch Cloud Shell' steps of the [GKE quickstart](https://cloud.google.com/kubernetes-engine/docs/deploy-app-cluster#before-you-begin). Cloud Shell comes preinstalled with the Google Cloud CLI, the `kubectl` command-line tool, and the Helm package manager. - Ensure [`kubectl`](https://kubernetes.io/docs/tasks/tools/) is installed. Minimum required Kubernetes version: 1.27.0-0. ```bash kubectl version --short --client ``` - Ensure [Helm](https://helm.sh/docs/intro/install/) is installed. Minimum required Helm version: 3.10.0 ```bash helm version ``` ## [](#create-a-gke-cluster)Create a GKE cluster Your GKE cluster must have one worker node available for each Redpanda broker that you plan to deploy in your Redpanda cluster. You also need to run the worker nodes on a machine type that supports the [requirements and recommendations](https://docs.redpanda.com/streaming/25.1/deploy/deployment-option/self-hosted/kubernetes/k-requirements/) for production deployments. In this step, you create a GKE cluster with three nodes on [`c2d-standard-8` machine types](https://cloud.google.com/compute/docs/compute-optimized-machines#c2d_series). Deploying three nodes allows your GKE cluster to support a Redpanda cluster with three brokers. The `c2d-standard-8` instance type comes with: - 2 cores per worker node, which is a requirement for production. - Local NVMe disks, which is recommended for best performance. Create a GKE cluster. Replace the `` placeholder with your own region. ```bash gcloud container clusters create \ --machine-type c2d-standard-8 \ --num-nodes=3 \ --local-nvme-ssd-block count=2 \ --region= ``` > ❗ **IMPORTANT** > > Do not enable [node auto-upgrades](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades) (`--enable-autoupgrade`) on Google GKE clusters running Redpanda. > > Node auto-upgrades can trigger automatic reboots or node upgrades that disrupt Redpanda brokers, risking data loss or cluster instability. Redpanda requires manual control over node lifecycle events. > > For more details, see the [requirements and recommendations](https://docs.redpanda.com/streaming/25.1/deploy/deployment-option/self-hosted/kubernetes/k-requirements/#node-updates) for deploying Redpanda in Kubernetes. To see all options that you can specify when creating a cluster, see the [Cloud SDK reference](https://cloud.google.com/sdk/gcloud/reference/container/clusters/create). Or, for help creating a GKE cluster, see the [GKE documentation](https://cloud.google.com/kubernetes-engine/docs/deploy-app-cluster#create_cluster). ### [](#create-sc)Create a StorageClass for your local NVMe disks When you provisioned the Kubernetes cluster, you selected an instance type that comes with local NVMe disks. However, these disks are not automatically mounted or formatted upon creation. To use these local NVMe disks, you must mount and format them, and you must create the necessary PersistentVolumes (PVs). To automate this process, you can use a Container Storage Interface (CSI) driver. In this step, you install the recommended [local volume manager (LVM) CSI driver](https://github.com/metal-stack/csi-driver-lvm). Then, you create a StorageClass that references the LVM CSI driver and specifies the recommended XFS file system. 1. Install the LVM CSI driver: ```yaml helm repo add metal-stack https://helm.metal-stack.io helm repo update helm install csi-driver-lvm metal-stack/csi-driver-lvm \ --version 0.6.0 \ --namespace csi-driver-lvm \ --create-namespace \ --set lvm.devicePattern='/dev/nvme[0-9]n[0-9]' ``` The `lvm.devicePattern` property specifies the pattern that the CSI driver uses to identify available NVMe volumes on your worker nodes. > 📝 **NOTE** > > Version 0.6.0 is required to avoid volume-mounting issues caused by recent `mkfs.xfs` updates. Newer versions enable the `-i nrext64=1` option, triggering the following error on default GKE kernels: > > XFS (dm-0): Superblock has unknown incompatible features (0x20) enabled. 2. Create the StorageClass: `csi-driver-lvm-striped-xfs.yaml` ```yaml apiVersion: storage.k8s.io/v1 kind: StorageClass metadata: name: csi-driver-lvm-striped-xfs provisioner: lvm.csi.metal-stack.io reclaimPolicy: Retain volumeBindingMode: WaitForFirstConsumer allowVolumeExpansion: true parameters: type: "striped" csi.storage.k8s.io/fstype: xfs mkfsParams: "-i nrext64=0" ``` - `provisioner`: The LVM CSI driver responsible for provisioning the volume. - `reclaimPolicy`: The `Retain` policy ensures that the underlying volume is not deleted when the corresponding PVC is deleted. - `volumeBindingMode`: The `WaitForFirstConsumer` mode delays the binding and provisioning of a PersistentVolume until a Pod that uses the PVC is created. This mode is important for ensuring that the PV is created on the same node where the Pod will run because the PV will use the node’s local NVMe volumes. - `allowVolumeExpansion`: Allows the volume to be expanded after it has been provisioned. - `parameters.type`: Combines multiple physical volumes to create a single logical volume. In a striped setup, data is spread across the physical volumes in a way that distributes the I/O load evenly, improving performance by allowing parallel disk I/O operations. - `parameters.csi.storage.k8s.io/fstype`: Formats the volumes with the XFS file system. Redpanda Data recommends XFS for its enhanced performance with Redpanda workloads. - `parameters.mkfsParams`: Disables the nrext64 feature to ensure compatibility with older kernels. 3. Apply the StorageClass: ```bash kubectl apply -f csi-driver-lvm-striped-xfs.yaml ``` After applying this StorageClass, any PVC that references it will attempt to provision storage using the LVM CSI driver and the provided parameters. ### [](#configure-external-access)Configure external access Add inbound firewall rules to your instances so that external traffic can reach the following node ports on all Kubernetes worker nodes in the cluster: - 31644 - 31092 - 30082 - 30081 For help creating firewall rules, see the [Google VPC documentation](https://cloud.google.com/vpc/docs/using-firewalls). ## [](#deploy-redpanda-and-redpanda-console)Deploy Redpanda and Redpanda Console In this step, you deploy Redpanda with SASL authentication and self-signed TLS certificates. Redpanda Console is included as a subchart in the Redpanda Helm chart. ### Operator 1. Make sure that you have permission to install custom resource definitions (CRDs): ```bash kubectl auth can-i create CustomResourceDefinition --all-namespaces ``` You should see `yes` in the output. You need these cluster-level permissions to install [cert-manager](https://cert-manager.io/docs/) and Redpanda Operator CRDs in the next steps. 2. Install [cert-manager](https://cert-manager.io/docs/installation/helm/) using Helm: ```bash helm repo add jetstack https://charts.jetstack.io helm repo update helm install cert-manager jetstack/cert-manager \ --set crds.enabled=true \ --namespace cert-manager \ --create-namespace ``` The Redpanda Helm chart uses cert-manager to enable TLS and manage TLS certificates by default. 3. Install the Redpanda Operator custom resource definitions (CRDs): ```bash kubectl kustomize "https://github.com/redpanda-data/redpanda-operator//operator/config/crd?ref=v26.1.4" \ | kubectl apply --server-side -f - ``` 4. Deploy the Redpanda Operator: ```bash helm repo add redpanda https://charts.redpanda.com helm repo update helm upgrade --install redpanda-controller redpanda/operator \ --namespace \ --create-namespace \ --timeout 1h \ --version v26.1.4 (1) ``` | 1 | This flag specifies the exact version of the Redpanda Operator Helm chart to use for deployment. By setting this value, you pin the chart to a specific version, which prevents automatic updates that might introduce breaking changes or new features that have not been tested in your environment. | | --- | --- | 5. Ensure that the Deployment is successfully rolled out: ```bash kubectl --namespace rollout status --watch deployment/redpanda-controller-operator ``` deployment "redpanda-controller-operator" successfully rolled out 6. Install a [Redpanda custom resource](https://docs.redpanda.com/streaming/25.1/reference/k-crd/) in the same namespace as the Redpanda Operator: `redpanda-cluster.yaml` ```yaml apiVersion: cluster.redpanda.com/v1alpha2 kind: Redpanda metadata: name: redpanda spec: clusterSpec: external: domain: customredpandadomain.local auth: sasl: enabled: true users: - name: superuser password: secretpassword storage: persistentVolume: enabled: true storageClass: csi-driver-lvm-striped-xfs ``` ```bash kubectl apply -f redpanda-cluster.yaml --namespace ``` - `external.domain`: The custom domain that each broker will advertise to clients externally. This domain is added to the internal and external TLS certificates so that you can connect to the cluster using this domain. - `auth.sasl.name`: Creates a superuser called `superuser` that can grant permissions to new users in your cluster using access control lists (ACLs). - `storage.persistentVolume.storageClass`: Points each PVC associated with the Redpanda brokers to the `csi-driver-lvm-striped-xfs` StorageClass. This StorageClass allows the LVM CSI driver to provision the appropriate local PersistentVolumes backed by NVMe disks for each Redpanda broker. 7. Wait for the Redpanda Operator to deploy Redpanda using the Helm chart: ```bash kubectl get redpanda --namespace --watch ``` NAME READY STATUS redpanda True Redpanda reconciliation succeeded This step may take a few minutes. You can watch for new Pods to make sure that the deployment is progressing: ```bash kubectl get pod --namespace ``` If it’s taking too long, see [Troubleshoot](#troubleshoot). ### Helm 1. Install cert-manager using Helm: ```bash helm repo add jetstack https://charts.jetstack.io helm repo update helm install cert-manager jetstack/cert-manager \ --set crds.enabled=true \ --namespace cert-manager \ --create-namespace ``` TLS is enabled by default. The Redpanda Helm chart uses cert-manager to manage TLS certificates by default. 2. Install Redpanda with SASL enabled: ```bash helm repo add redpanda https://charts.redpanda.com helm repo update helm install redpanda redpanda/redpanda \ --version 26.1.4 \ --namespace --create-namespace \ --set auth.sasl.enabled=true \ --set "auth.sasl.users[0].name=superuser" \ --set "auth.sasl.users[0].password=secretpassword" \ --set external.domain=customredpandadomain.local \ --set "storage.persistentVolume.storageClass=csi-driver-lvm-striped-xfs" \ --wait \ --timeout 1h ``` - `external.domain`: The custom domain that each broker advertises to clients externally. This domain is added to the internal and external TLS certificates so that you can connect to the cluster using this domain. - `auth.sasl.name`: Creates a superuser called `superuser` that can grant permissions to new users in your cluster using access control lists (ACLs). - `storage.persistentVolume.storageClass`: Points each PVC associated with the Redpanda brokers to the `csi-driver-lvm-striped-xfs` StorageClass. This StorageClass allows the LVM CSI driver to provision the appropriate local PersistentVolumes backed by NVMe disks for each Redpanda broker. The installation displays some tips for getting started. If the installation is taking a long time, see [Troubleshoot](#troubleshoot). ## [](#verify-the-deployment)Verify the deployment When the Redpanda Helm chart is deployed, you should have: - Three Redpanda brokers. Each Redpanda broker runs inside a separate Pod and is scheduled on a separate worker node. - One PVC bound to a PV for each Redpanda broker. These PVs are what the Redpanda brokers use to store the Redpanda data directory with all your topics and metadata. 1. Verify that each Redpanda broker is scheduled on only one Kubernetes node: ```bash kubectl get pod --namespace \ -o=custom-columns=NODE:.spec.nodeName,POD_NAME:.metadata.name -l \ app.kubernetes.io/component=redpanda-statefulset ``` Example output: NODE POD\_NAME example-worker3 redpanda-0 example-worker2 redpanda-1 example-worker redpanda-2 2. Verify that each Redpanda broker has a bound PVC: ```bash kubectl get persistentvolumeclaim \ --namespace \ -o custom-columns=NAME:.metadata.name,STATUS:.status.phase,STORAGECLASS:.spec.storageClassName ``` Example output: NAME STATUS STORAGECLASS datadir-redpanda-0 Bound csi-driver-lvm-striped-xfs datadir-redpanda-1 Bound csi-driver-lvm-striped-xfs datadir-redpanda-2 Bound csi-driver-lvm-striped-xfs ## [](#create-a-user)Create a user In this step, you use `rpk` to create a new user. Then, you authenticate to Redpanda with the superuser to grant permissions to the new user. You’ll authenticate to Redpanda with this new user to create a topic in the next steps. > 💡 **TIP** > > As a security best practice, you should use the superuser only to grant permissions to new users through ACLs. Never delete the superuser. You need the superuser to grant permissions to new users. 1. Create a new user called `redpanda-twitch-account` with the password `changethispassword`: ```bash kubectl --namespace exec -ti redpanda-0 -c redpanda -- \ rpk security user create redpanda-twitch-account \ -p changethispassword ``` Example output: Created user "redpanda-twitch-account". 2. Use the superuser to grant the `redpanda-twitch-account` user permission to execute all operations only for a topic called `twitch-chat`. ```bash kubectl exec --namespace -c redpanda redpanda-0 -- \ rpk security acl create --allow-principal User:redpanda-twitch-account \ --operation all \ --topic twitch-chat \ -X user=superuser -X pass=secretpassword -X sasl.mechanism=SCRAM-SHA-512 ``` Example output: PRINCIPAL RESOURCE-TYPE RESOURCE-NAME OPERATION PERMISSION User:redpanda TOPIC twitch-chat ALL ALLOW ## [](#start-streaming)Start streaming In this step, you authenticate to Redpanda with the `redpanda-twitch-account` user to create a topic called `twitch-chat`. This topic is the only one that the `redpanda-twitch-account` user has permission to access. Then, you produce messages to the topic, and consume messages from it. 1. Create an alias to simplify the `rpk` commands: ```bash alias internal-rpk="kubectl --namespace exec -i -t redpanda-0 -c redpanda -- rpk -X user=redpanda-twitch-account -X pass=changethispassword -X sasl.mechanism=SCRAM-SHA-256" ``` 2. Create a topic called `twitch-chat`: ### Operator 1. Create a Secret in which to store your user’s password: ```bash kubectl create secret generic redpanda-secret --from-literal=password='changethispassword' --namespace ``` 2. Create a [Topic resource](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/k-manage-topics/): `topic.yaml` ```yaml apiVersion: cluster.redpanda.com/v1alpha2 kind: Topic metadata: name: twitch-chat spec: kafkaApiSpec: brokers: - "redpanda-0.redpanda..svc.cluster.local:9093" - "redpanda-1.redpanda..svc.cluster.local:9093" - "redpanda-2.redpanda..svc.cluster.local:9093" tls: caCertSecretRef: name: "redpanda-default-cert" key: "ca.crt" sasl: username: redpanda-twitch-account mechanism: SCRAM-SHA-256 passwordSecretRef: name: redpanda-secret key: password ``` 3. Apply the Topic resource in the same namespace as your Redpanda cluster: ```bash kubectl apply -f topic.yaml --namespace ``` 4. Check the logs of the Redpanda Operator to confirm that the topic was created: ```bash kubectl logs -l app.kubernetes.io/name=operator -c manager --namespace ``` You should see that the Redpanda Operator reconciled the Topic resource. For example: Example output ```json { "level":"info", "ts":"2023-09-25T16:20:09.538Z", "logger":"TopicReconciler.Reconcile", "msg":"Starting reconcile loop", "controller":"topic", "controllerGroup":"cluster.redpanda.com", "controllerKind":"Topic", "Topic": { "name":"twitch-chat", "namespace":"" }, "namespace":"", "name":"twitch-chat", "reconcileID":"c0cf9abc-a553-48b7-9b6e-2de3cdfb4432" } { "level":"info", "ts":"2023-09-25T16:20:09.581Z", "logger":"TopicReconciler.Reconcile", "msg":"reconciliation finished in 43.436125ms, next run in 3s", "controller":"topic", "controllerGroup":"cluster.redpanda.com", "controllerKind":"Topic", "Topic": { "name":"twitch-chat", "namespace":"" }, "namespace":"", "name":"twitch-chat", "reconcileID":"c0cf9abc-a553-48b7-9b6e-2de3cdfb4432", "result": { "Requeue":false, "RequeueAfter":3000000000 } } ``` ### Helm ```bash internal-rpk topic create twitch-chat ``` Example output: TOPIC STATUS twitch-chat OK 3. Describe the topic: ```bash internal-rpk topic describe twitch-chat ``` Expected output: ```none SUMMARY ======= NAME twitch-chat PARTITIONS 1 REPLICAS 1 CONFIGS ======= KEY VALUE SOURCE cleanup.policy delete DYNAMIC_TOPIC_CONFIG compression.type producer DEFAULT_CONFIG message.timestamp.type CreateTime DEFAULT_CONFIG partition_count 1 DYNAMIC_TOPIC_CONFIG redpanda.datapolicy function_name: script_name: DEFAULT_CONFIG redpanda.remote.read false DEFAULT_CONFIG redpanda.remote.write false DEFAULT_CONFIG replication_factor 1 DYNAMIC_TOPIC_CONFIG retention.bytes -1 DEFAULT_CONFIG retention.ms 604800000 DEFAULT_CONFIG segment.bytes 1073741824 DEFAULT_CONFIG ``` 4. Produce a message to the topic: ```bash internal-rpk topic produce twitch-chat ``` 5. Type a message, then press Enter: Pandas are fabulous! Example output: Produced to partition 0 at offset 0 with timestamp 1663282629789. 6. Press Ctrl+C to finish producing messages to the topic. 7. Consume one message from the topic: ```bash internal-rpk topic consume twitch-chat --num 1 ``` Expected output: ```none { "topic": "twitch-chat", "value": "Pandas are fabulous!", "timestamp": 1663282629789, "partition": 0, "offset": 0 } ``` ## [](#explore-your-topic-in-redpanda-console)Explore your topic in Redpanda Console Redpanda Console is a developer-friendly web UI for managing and debugging your Redpanda cluster and your applications. In this step, you use port-forwarding to access Redpanda Console on your local network. > 💡 **TIP** > > Because you’re using the Community Edition of Redpanda Console, you should not expose Redpanda Console outside your local network. The Community Edition of Redpanda Console does not provide authentication, and it connects to the Redpanda cluster as superuser. To use the Enterprise Edition, you need a license key, see [Redpanda Licensing](https://docs.redpanda.com/streaming/25.1/get-started/licensing/overview/). 1. Expose Redpanda Console to your localhost: ```bash kubectl --namespace port-forward svc/redpanda-console 8080:8080 ``` The `kubectl port-forward` command actively runs in the command-line window. To execute other commands while the command is running, open another command-line window. 2. Open Redpanda Console on [http://localhost:8080](http://localhost:8080). All your Redpanda brokers are listed along with their IP addresses and IDs. 3. Go to **Topics** > **twitch-chat**. The message that you produced to the topic is displayed along with some other details about the topic. 4. Press Ctrl+C in the command-line to stop the port-forwarding process. ## [](#configure-external-access-to-redpanda)Configure external access to Redpanda If you want to connect to the Redpanda cluster with external clients, Redpanda brokers must advertise an externally accessible address that external clients can connect to. External clients are common in Internet of Things (IoT) environments, or if you use external services that do not implement VPC peering in your network. When you created the cluster, you set the `external.domain` configuration to `customredpandadomain.local`, which means that your Redpanda brokers are advertising the following addresses: - `redpanda-0.customredpandadomain.local` - `redpanda-1.customredpandadomain.local` - `redpanda-2.customredpandadomain.local` To access your Redpanda brokers externally, you can map your worker nodes' IP addresses to these domains. > ⚠️ **CAUTION** > > IP addresses can change. If the IP addresses of your worker nodes change, you must update your `/etc/hosts` file with the new mappings. > > In a production environment, it’s a best practice to use ExternalDNS to manage DNS records for your brokers. See [Use ExternalDNS for external access](https://docs.redpanda.com/streaming/25.1/deploy/deployment-option/self-hosted/kubernetes/k-requirements/#use-externaldns-for-external-access). 1. Add mappings in your `/etc/hosts` file between your worker nodes' IP addresses and their custom domain names: ```bash sudo true && kubectl --namespace get endpoints,node -A -o go-template='{{ range $_ := .items }}{{ if and (eq .kind "Endpoints") (eq .metadata.name "redpanda-external") }}{{ range $_ := (index .subsets 0).addresses }}{{ $nodeName := .nodeName }}{{ $podName := .targetRef.name }}{{ range $node := $.items }}{{ if and (eq .kind "Node") (eq .metadata.name $nodeName) }}{{ range $_ := .status.addresses }}{{ if eq .type "ExternalIP" }}{{ .address }} {{ $podName }}.customredpandadomain.local{{ "\n" }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}' | envsubst | sudo tee -a /etc/hosts ``` `/etc/hosts` 203.0.113.3 redpanda-0.customredpandadomain.local 203.0.113.5 redpanda-1.customredpandadomain.local 203.0.113.7 redpanda-2.customredpandadomain.local 2. Save the root certificate authority (CA) to your local file system outside Kubernetes: ```bash kubectl --namespace get secret redpanda-external-root-certificate -o go-template='{{ index .data "ca.crt" | base64decode }}' > ca.crt ``` 3. Install `rpk` on your local machine, not on a Pod: ### Linux > 💡 **TIP** > > You can use `rpk` on Windows only with [WSL](https://learn.microsoft.com/windows/wsl/install). However, commands that require Redpanda to be installed on your machine are not supported, such as [`rpk container`](https://docs.redpanda.com/streaming/current/reference/rpk/rpk-container/rpk-container/) commands, [`rpk iotune`](https://docs.redpanda.com/streaming/current/reference/rpk/rpk-iotune/), and [`rpk redpanda`](https://docs.redpanda.com/streaming/current/reference/rpk/rpk-redpanda/rpk-redpanda/) commands. #### amd64 ```bash curl -LO https://github.com/redpanda-data/redpanda/releases/latest/download/rpk-linux-amd64.zip && mkdir -p ~/.local/bin && export PATH="~/.local/bin:$PATH" && unzip rpk-linux-amd64.zip -d ~/.local/bin/ ``` #### arm64 ```bash curl -LO https://github.com/redpanda-data/redpanda/releases/latest/download/rpk-linux-arm64.zip && mkdir -p ~/.local/bin && export PATH="~/.local/bin:$PATH" && unzip rpk-linux-arm64.zip -d ~/.local/bin/ ``` ### macOS 1. If you don’t have Homebrew installed, [install it](https://brew.sh/). 2. To install or update `rpk`, run: ```bash brew install redpanda-data/tap/redpanda ``` 4. Configure `rpk` to connect to your cluster using the [pre-configured profile](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/networking/k-connect-to-redpanda/#rpk-profile): ```bash rpk profile create --from-profile <(kubectl get configmap --namespace redpanda-rpk -o go-template='{{ .data.profile }}') ``` Replace `` with the name that you want to give this `rpk` profile. 5. Test the connection: ```bash rpk cluster info -X user=redpanda-twitch-account -X pass=changethispassword -X sasl.mechanism=SCRAM-SHA-256 ``` ## [](#explore-the-default-kubernetes-components)Explore the default Kubernetes components By default, the Redpanda Helm chart deploys the following Kubernetes components: - [A StatefulSet](#statefulset) with three Pods. - [One PersistentVolumeClaim](#persistentvolumeclaim) for each Pod, each with a capacity of 20Gi. - [A headless ClusterIP Service and a NodePort Service](#service) for each Kubernetes node that runs a Redpanda broker. - [Self-Signed TLS Certificates](#tls-certificates). ### [](#statefulset)StatefulSet Redpanda is a stateful application. Each Redpanda broker needs to store its own state (topic partitions) in its own storage volume. As a result, the Helm chart deploys a StatefulSet to manage the Pods in which the Redpanda brokers are running. ```bash kubectl get statefulset --namespace ``` Example output: NAME READY AGE redpanda 3/3 3m11s StatefulSets ensure that the state associated with a particular Pod replica is always the same, no matter how often the Pod is recreated. Each Pod is also given a unique ordinal number in its name such as `redpanda-0`. A Pod with a particular ordinal number is always associated with a PersistentVolumeClaim with the same number. When a Pod in the StatefulSet is deleted and recreated, it is given the same ordinal number and so it mounts the same storage volume as the deleted Pod that it replaced. ```bash kubectl get pod --namespace ``` Expected output: ```none NAME READY STATUS RESTARTS AGE redpanda-0 1/1 Running 0 6m9s redpanda-1 1/1 Running 0 6m9s redpanda-2 1/1 Running 0 6m9s redpanda-console-5ff45cdb9b-6z2vs 1/1 Running 0 5m redpanda-configuration-smqv7 0/1 Completed 0 6m9s ``` > 📝 **NOTE** > > The `redpanda-configuration` job updates the Redpanda runtime configuration. ### [](#persistentvolumeclaim)PersistentVolumeClaim Redpanda brokers must be able to store their data on disk. By default, the Helm chart uses the default StorageClass in the Kubernetes cluster to create a PersistentVolumeClaim for each Pod. The default StorageClass in your Kubernetes cluster depends on the Kubernetes platform that you are using. ```bash kubectl get persistentvolumeclaims --namespace ``` Expected output: ```none NAME STATUS VOLUME CAPACITY ACCESS MODES STORAGECLASS AGE datadir-redpanda-0 Bound pvc-3311ade3-de84-4027-80c6-3d8347302962 20Gi RWO standard 75s datadir-redpanda-1 Bound pvc-4ea8bc03-89a6-41e4-b985-99f074995f08 20Gi RWO standard 75s datadir-redpanda-2 Bound pvc-45c3555f-43bc-48c2-b209-c284c8091c45 20Gi RWO standard 75s ``` ### [](#service)Service The clients writing to or reading from a given partition have to connect directly to the leader broker that hosts the partition. As a result, clients need to be able to connect directly to each Pod. To allow internal and external clients to connect to each Pod that hosts a Redpanda broker, the Helm chart configures two Services: - Internal using the [Headless ClusterIP](#headless-clusterip-service) - External using the [NodePort](#nodeport-service) ```bash kubectl get service --namespace ``` Expected output: ```none NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE redpanda ClusterIP None 5m37s redpanda-console ClusterIP 10.0.251.204 8080 5m redpanda-external NodePort 10.96.137.220 9644:31644/TCP,9094:31092/TCP,8083:30082/TCP,8080:30081/TCP 5m37s ``` #### [](#headless-clusterip-service)Headless ClusterIP Service The headless Service associated with a StatefulSet gives the Pods their network identity in the form of a fully qualified domain name (FQDN). Both Redpanda brokers in the same Redpanda cluster and clients within the same Kubernetes cluster use this FQDN to communicate with each other. An important requirement of distributed applications such as Redpanda is peer discovery: The ability for each broker to find other brokers in the same cluster. When each Pod is rolled out, its `seed_servers` field is updated with the FQDN of each Pod in the cluster so that they can discover each other. ```bash kubectl --namespace exec redpanda-0 -c redpanda -- cat etc/redpanda/redpanda.yaml ``` ```yaml redpanda: data_directory: /var/lib/redpanda/data empty_seed_starts_cluster: false seed_servers: - host: address: redpanda-0.redpanda..svc.cluster.local. port: 33145 - host: address: redpanda-1.redpanda..svc.cluster.local. port: 33145 - host: address: redpanda-2.redpanda..svc.cluster.local. port: 33145 ``` #### [](#nodeport-service)NodePort Service External access is made available by a NodePort service that opens the following ports by default: | Listener | Node Port | Container Port | | --- | --- | --- | | Schema Registry | 30081 | 8081 | | HTTP Proxy | 30082 | 8083 | | Kafka API | 31092 | 9094 | | Admin API | 31644 | 9644 | To learn more, see [Networking and Connectivity in Kubernetes](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/networking/k-networking-and-connectivity/). ### [](#tls-certificates)TLS Certificates By default, TLS is enabled in the Redpanda Helm chart. The Helm chart uses [cert-manager](https://cert-manager.io/docs/) to generate four Certificate resources that provide Redpanda with self-signed certificates for internal and external connections. Having separate certificates for internal and external connections provides security isolation. If an external certificate or its corresponding private key is compromised, it doesn’t affect the security of internal communications. ```bash kubectl get certificate --namespace ``` NAME READY redpanda-default-cert True redpanda-default-root-certificate True redpanda-external-cert True redpanda-external-root-certificate True - `redpanda-default-cert`: Self-signed certificate for internal communications. - `redpanda-default-root-certificate`: Root certificate authority for the internal certificate. - `redpanda-external-cert`: Self-signed certificate for external communications. - `redpanda-external-root-certificate`: Root certificate authority for the external certificate. By default, all listeners are configured with the same certificate. To configure separate TLS certificates for different listeners, see [TLS for Redpanda in Kubernetes](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/security/tls/). > 📝 **NOTE** > > The Redpanda Helm chart provides self-signed certificates for convenience. In a production environment, it’s best to use certificates from a trusted Certificate Authority (CA) or integrate with your existing CA infrastructure. ## [](#uninstall-redpanda)Uninstall Redpanda When you’ve finished testing Redpanda, you can uninstall it from your cluster and delete any Kubernetes resources that the Helm chart created. ### Operator ```bash kubectl delete -f redpanda-cluster.yaml --namespace helm uninstall redpanda-controller --namespace kubectl delete pod --all --namespace kubectl delete pvc --all --namespace kubectl delete secret --all --namespace ``` ### Helm ```bash helm uninstall redpanda --namespace kubectl delete pod --all --namespace kubectl delete pvc --all --namespace kubectl delete secret --all --namespace ``` To remove the `internal-rpk` alias: ```bash unalias internal-rpk ``` ## [](#delete-the-cluster)Delete the cluster To delete your Kubernetes cluster: ```bash gcloud container clusters delete \ --region= ``` ## [](#troubleshoot)Troubleshoot Before troubleshooting your cluster, make sure that you have all the [prerequisites](#prerequisites). ### [](#helmrelease-is-not-ready)HelmRelease is not ready If you are using the Redpanda Operator, you may see the following message while waiting for a Redpanda custom resource to be deployed: ```bash NAME READY STATUS redpanda False HelmRepository 'redpanda/redpanda-repository' is not ready redpanda False HelmRelease 'redpanda/redpanda' is not ready ``` While the deployment process can sometimes take a few minutes, a prolonged 'not ready' status may indicate an issue. Follow the steps below to investigate: 1. Check the status of the HelmRelease: ```bash kubectl describe helmrelease --namespace ``` 2. Review the Redpanda Operator logs: ```bash kubectl logs -l app.kubernetes.io/name=operator -c manager --namespace ``` ### [](#helmrelease-retries-exhausted)HelmRelease retries exhausted If you are running the operator in **Flux-managed mode** (`chartRef.useFlux: true`), the `HelmRelease retries exhausted` error may occur when the Helm Controller has tried to reconcile the HelmRelease a number of times, but these attempts have failed consistently. The Helm Controller watches for changes in HelmRelease objects. When changes are detected, it tries to reconcile the state defined in the HelmRelease with the state in the cluster. The process of reconciliation includes installation, upgrade, testing, rollback or uninstallation of Helm releases. You may see this error due to: - Incorrect configuration in the HelmRelease. - Issues with the chart, such as a non-existent chart version or the chart repository not being accessible. - Missing dependencies or prerequisites required by the chart. - Issues with the underlying Kubernetes cluster, such as insufficient resources or connectivity issues. To debug this error do the following: 1. Check the status of the HelmRelease: ```bash kubectl describe helmrelease --namespace ``` 2. Review the Redpanda Operator logs: ```bash kubectl logs -l app.kubernetes.io/name=operator -c manager --namespace ``` When you find and fix the error, you must use the Flux CLI, `fluxctl`, to suspend and resume the reconciliation process: 1. [Install Flux CLI](https://fluxcd.io/flux/installation/#install-the-flux-cli). 2. Suspend the HelmRelease: ```bash flux suspend helmrelease --namespace ``` 3. Resume the HelmRelease: ```bash flux resume helmrelease --namespace ``` ### [](#statefulset-never-rolls-out)StatefulSet never rolls out If the StatefulSet Pods remain in a pending state, they are waiting for resources to become available. To identify the Pods that are pending, use the following command: ```bash kubectl get pod --namespace ``` The response includes a list of Pods in the StatefulSet and their status. To view logs for a specific Pod, use the following command. ```bash kubectl logs -f --namespace ``` You can use the output to debug your deployment. ### [](#didnt-match-pod-anti-affinity-rules)Didn’t match pod anti-affinity rules If you see this error, your cluster does not have enough nodes to satisfy the anti-affinity rules: Warning FailedScheduling 18m default-scheduler 0/1 nodes are available: 1 node(s) didn't match pod anti-affinity rules. preemption: 0/1 nodes are available: 1 No preemption victims found for incoming pod. The Helm chart configures default `podAntiAffinity` rules to make sure that only one Pod running a Redpanda broker is scheduled on each worker node. To learn why, see [Number of workers](https://docs.redpanda.com/streaming/25.1/deploy/deployment-option/self-hosted/kubernetes/k-requirements/#number-of-workers). To resolve this issue, do one of the following: - Create additional worker nodes. - Modify the anti-affinity rules (for development purposes only). If adding nodes is not an option, you can modify the `podAntiAffinity` rules in your StatefulSet to be less strict. #### Operator `redpanda-cluster.yaml` ```yaml apiVersion: cluster.redpanda.com/v1alpha2 kind: Redpanda metadata: name: redpanda spec: chartRef: {} clusterSpec: statefulset: podAntiAffinity: type: soft ``` ```bash kubectl apply -f redpanda-cluster.yaml --namespace ``` #### Helm ##### --values `docker-repo.yaml` ```yaml statefulset: podAntiAffinity: type: soft ``` ```bash helm upgrade --install redpanda redpanda/redpanda --namespace --create-namespace \ --values docker-repo.yaml --reuse-values ``` ##### --set ```bash helm upgrade --install redpanda redpanda/redpanda --namespace --create-namespace \ --set statefulset.podAntiAffinity.type=soft ``` ### [](#unable-to-mount-volume)Unable to mount volume If you see volume mounting errors in the Pod events or in the Redpanda logs, ensure that each of your Pods has a volume available in which to store data. - If you’re using StorageClasses with dynamic provisioners (default), ensure they exist: ```bash kubectl get storageclass ``` - If you’re using PersistentVolumes, ensure that you have one PersistentVolume available for each Redpanda broker, and that each one has the storage capacity that’s set in `storage.persistentVolume.size`: ```bash kubectl get persistentvolume --namespace ``` To learn how to configure different storage volumes, see [Configure Storage](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/storage/k-configure-storage/). ### [](#failed-to-pull-image)Failed to pull image When deploying the Redpanda Helm chart, you may encounter Docker rate limit issues because the default registry URL is not recognized as a Docker Hub URL. The domain `docker.redpanda.com` is used for statistical purposes, such as tracking the number of downloads. It mirrors Docker Hub’s content while providing specific analytics for Redpanda. Failed to pull image "docker.redpanda.com/redpandadata/redpanda:v": rpc error: code = Unknown desc = failed to pull and unpack image "docker.redpanda.com/redpandadata/redpanda:v": failed to copy: httpReadSeeker: failed open: unexpected status code 429 Too Many Requests - Server message: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit To fix this error, do one of the following: - Replace the `image.repository` value in the Helm chart with `docker.io/redpandadata/redpanda`. Switching to Docker Hub avoids the rate limit issues associated with `docker.redpanda.com`. #### Operator `redpanda-cluster.yaml` ```yaml apiVersion: cluster.redpanda.com/v1alpha2 kind: Redpanda metadata: name: redpanda spec: chartRef: {} clusterSpec: image: repository: docker.io/redpandadata/redpanda ``` ```bash kubectl apply -f redpanda-cluster.yaml --namespace ``` #### Helm ##### --values `docker-repo.yaml` ```yaml image: repository: docker.io/redpandadata/redpanda ``` ```bash helm upgrade --install redpanda redpanda/redpanda --namespace --create-namespace \ --values docker-repo.yaml --reuse-values ``` ##### --set ```bash helm upgrade --install redpanda redpanda/redpanda --namespace --create-namespace \ --set image.repository=docker.io/redpandadata/redpanda ``` - Authenticate to Docker Hub by logging in with your Docker Hub credentials. The `docker.redpanda.com` site acts as a reflector for Docker Hub. As a result, when you log in with your Docker Hub credentials, you will bypass the rate limit issues. ### [](#dig-not-defined)Dig not defined This error means that you are using an unsupported version of [Helm](https://helm.sh/docs/intro/install/): Error: parse error at (redpanda/templates/statefulset.yaml:203): function "dig" not defined To fix this error, ensure that you are using the minimum required version: 3.10.0. ```bash helm version ``` ### [](#repository-name-already-exists)Repository name already exists If you see this error, remove the `redpanda` chart repository, then try installing it again. ```bash helm repo remove redpanda helm repo add redpanda https://charts.redpanda.com helm repo update ``` ### [](#redpanda-rpk-debug-bundle-is-forbidden)redpanda-rpk-debug-bundle is forbidden If you see this error, your Redpanda Operator’s RBAC settings are out of sync with the Pod-level RBAC in the Redpanda resource: … forbidden: user "…-operator" … attempting to grant RBAC permissions not currently held … To fix this error, make sure you haven’t disabled [`rbac.createRPKBundleCRs`](https://docs.redpanda.com/streaming/25.1/reference/k-operator-helm-spec/#rbac-createrpkbundlecrs) in the Redpanda Operator chart while still leaving [`spec.clusterSpec.rbac.rpkDebugBundle`](https://docs.redpanda.com/streaming/25.1/reference/k-crd/#k8s-api-github-com-redpanda-data-redpanda-operator-operator-api-redpanda-v1alpha2-rbac) enabled in your Redpanda resource. Either enable both or disable both. ### [](#fatal-error-during-checker-data-directory-is-writable-execution)Fatal error during checker "Data directory is writable" execution This error appears when Redpanda does not have write access to your configured storage volume under `storage` in the Helm chart. Error: fatal error during checker "Data directory is writable" execution: open /var/lib/redpanda/data/test\_file: permission denied To fix this error, set `statefulset.initContainers.setDataDirOwnership.enabled` to `true` so that the initContainer can set the correct permissions on the data directories. ### [](#cannot-patch-redpanda-with-kind-statefulset)Cannot patch "redpanda" with kind StatefulSet This error appears when you run `helm upgrade` with the `--values` flag but do not include all your previous overrides. Error: UPGRADE FAILED: cannot patch "redpanda" with kind StatefulSet: StatefulSet.apps "redpanda" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'template', 'updateStrategy', 'persistentVolumeClaimRetentionPolicy' and 'minReadySeconds' are forbidden To fix this error, do one of the following: - Include all the value overrides from the previous installation or upgrade using either the `--set` or the `--values` flags. - Use the `--reuse-values` flag. > ⚠️ **WARNING** > > Do not use the `--reuse-values` flag to upgrade from one version of the Helm chart to another. This flag stops Helm from using any new values in the upgraded chart. ### [](#cannot-patch-redpanda-console-with-kind-deployment)Cannot patch "redpanda-console" with kind Deployment This error appears if you try to upgrade your deployment and you already have `console.enabled` set to `true`. Error: UPGRADE FAILED: cannot patch "redpanda-console" with kind Deployment: Deployment.apps "redpanda-console" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map\[string\]string{"app.kubernetes.io/instance":"redpanda", "app.kubernetes.io/name":"console"}, MatchExpressions:\[\]v1.LabelSelectorRequirement(nil)}: field is immutable To fix this error, set `console.enabled` to `false` so that Helm doesn’t try to deploy Redpanda Console again. ### [](#helm-is-in-a-pending-rollback-state)Helm is in a pending-rollback state An interrupted Helm upgrade process can leave your Helm release in a `pending-rollback` state. This state prevents further actions like upgrades, rollbacks, or deletions through standard Helm commands. To fix this: 1. Identify the Helm release that’s in a `pending-rollback` state: ```bash helm list --namespace --all ``` Look for releases with a status of `pending-rollback`. These are the ones that need intervention. 2. Verify the Secret’s status to avoid affecting the wrong resource: ```bash kubectl --namespace get secret --show-labels ``` Identify the Secret associated with your Helm release by its `pending-rollback` status in the labels. > ⚠️ **WARNING** > > Ensure you have correctly identified the Secret to avoid unintended consequences. Deleting the wrong Secret could impact other deployments or services. 3. Delete the Secret to clear the `pending-rollback` state: ```bash kubectl --namespace delete secret -l status=pending-rollback ``` After clearing the `pending-rollback` state: - **Retry the upgrade**: Restart the upgrade process. You should investigate the initial failure to avoid getting into the `pending-rollback` state again. - **Perform a rollback**: If you need to roll back to a previous release, use `helm rollback ` to revert to a specific, stable release version. ### [](#crash-loop-backoffs)Crash loop backoffs If a broker crashes after startup, or gets stuck in a crash loop, it can accumulate an increasing amount of stored state. This accumulated state not only consumes additional disk space but also prolongs the time required for each subsequent restart to process it. To prevent infinite crash loops, the Redpanda Helm chart sets the [`crash_loop_limit`](https://docs.redpanda.com/streaming/25.1/reference/properties/broker-properties/#crash_loop_limit) broker configuration property to `5`. The crash loop limit is the number of consecutive crashes that can happen within one hour of each other. By default, the broker terminates immediately after hitting the `crash_loop_limit`. The Pod running Redpanda remains in a `CrashLoopBackoff` state until its internal consecutive crash counter is reset to zero. To facilitate debugging in environments where a broker is stuck in a crash loop, you can also set the [`crash_loop_sleep_sec`](https://docs.redpanda.com/streaming/25.1/reference/properties/broker-properties/#crash_loop_sleep_sec) broker configuration property. This setting determines how long the broker sleeps before terminating the process after reaching the crash loop limit. By providing a window during which the Pod remains available, you can SSH into it and troubleshoot the issue. Example configuration: ```yaml config: node: crash_loop_limit: 5 crash_loop_sleep_sec: 60 ``` In this example, when the broker hits the `crash_loop_limit` of 5, it will sleep for 60 seconds before terminating the process. This delay allows administrators to access the Pod and troubleshoot. To troubleshoot a crash loop backoff: 1. Check the Redpanda logs from the most recent crashes: ```bash kubectl logs --namespace ``` > 📝 **NOTE** > > Kubernetes retains logs only for the current and the previous instance of a container. This limitation makes it difficult to access logs from earlier crashes, which may contain vital clues about the root cause of the issue. Given these log retention limitations, setting up a centralized logging system is crucial. Systems such as [Loki](https://grafana.com/docs/loki/latest/) or [Datadog](https://www.datadoghq.com/product/log-management/) can capture and store logs from all containers, ensuring you have access to historical data. 2. Resolve the issue that led to the crash loop backoff. 3. Reset the crash counter to zero to allow Redpanda to restart. You can do any of the following to reset the counter: - Make changes to any of the following sections in the Redpanda Helm chart to trigger an update: - `config.node` - `config.tunable` For example: ```yaml config: node: crash_loop_limit: ``` - Delete the `startup_log` file in the broker’s data directory. ```bash kubectl exec --namespace -- rm /var/lib/redpanda/data/startup_log ``` > 📝 **NOTE** > > It might be challenging to execute this command within a Pod that is in a `CrashLoopBackoff` state due to the limited time during which the Pod is available before it restarts. Wrapping the command in a loop might work. - Wait one hour since the last crash. The crash counter resets after one hour. To avoid future crash loop backoffs and manage the accumulation of small segments effectively: - [Monitor](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/monitoring/k-monitor-redpanda/) the size and number of segments regularly. - Optimize your Redpanda configuration for segment management. - Consider implementing [Tiered Storage](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/tiered-storage/k-tiered-storage/) to manage data more efficiently. ### [](#a-redpanda-enterprise-edition-license-is-required)A Redpanda Enterprise Edition license is required During a Redpanda upgrade, if enterprise features are enabled and a valid Enterprise Edition license is missing, Redpanda logs a warning and aborts the upgrade process on the first broker. This issue prevents a successful upgrade. A Redpanda Enterprise Edition license is required to use the currently enabled features. To apply your license, downgrade this broker to the pre-upgrade version and provide a valid license key via rpk using 'rpk cluster license set ', or via Redpanda Console. To request an enterprise license, please visit . To try Redpanda Enterprise for 30 days, visit . For more information, see . If you encounter this message, follow these steps to recover: 1. [Roll back the affected broker to the original version](https://docs.redpanda.com/streaming/25.1/upgrade/k-rolling-upgrade/#roll-back). 2. Do one of the following: - [Apply a valid Redpanda Enterprise Edition license](https://docs.redpanda.com/streaming/25.1/get-started/licensing/add-license-redpanda/) to the cluster. - Disable enterprise features. If you do not have a valid license and want to proceed without using enterprise features, you can disable the enterprise features in your Redpanda configuration. 3. Retry the upgrade. For more troubleshooting steps, see [Troubleshoot Redpanda in Kubernetes](https://docs.redpanda.com/streaming/25.1/troubleshoot/errors-solutions/k-resolve-errors/). ## [](#next-steps)Next steps - [Try an example in Redpanda Labs](https://docs.redpanda.com/labs/) - [Learn more about Redpanda Console](https://docs.redpanda.com/streaming/25.1/manage/console/) - [Learn more about rpk](https://docs.redpanda.com/streaming/25.1/get-started/rpk-install/) > 💡 **TIP** > > When you’re ready to use a registered domain, make sure to remove your entries from the `/etc/hosts` file, and see [Configure External Access through a NodePort Service](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/networking/external/k-nodeport/#use-the-default-redpanda-subdomains). ## [](#suggested-reading)Suggested reading - [Networking and Connectivity in Kubernetes](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/networking/k-networking-and-connectivity/) - [Configure TLS for Redpanda in Kubernetes](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/security/tls/) - [Configure SASL for Redpanda in Kubernetes](https://docs.redpanda.com/streaming/25.1/manage/kubernetes/security/authentication/k-authentication/) - [Redpanda Helm Specification](https://docs.redpanda.com/streaming/25.1/reference/k-redpanda-helm-spec/) - [Redpanda CRD Reference](https://docs.redpanda.com/streaming/25.1/reference/k-crd/) - [Redpanda Console README](https://github.com/redpanda-data/console) on GitHub ## Suggested labs - [Disaster Recovery with Envoy and Shadowing](https://docs.redpanda.com/labs/docker-compose/envoy-shadowing/) - [Redpanda Iceberg Docker Compose Example](https://docs.redpanda.com/labs/docker-compose/iceberg/) - [Stream Jira Issues to Redpanda for Real-Time Metrics](https://docs.redpanda.com/labs/docker-compose/jira-metrics-pipeline/) - [Migrate Data with Redpanda Migrator](https://docs.redpanda.com/labs/docker-compose/redpanda-migrator/) - [Start a Single Redpanda Broker with Redpanda Console in Docker](https://docs.redpanda.com/labs/docker-compose/single-broker/) - [Start a Cluster of Redpanda Brokers with Redpanda Console in Docker](https://docs.redpanda.com/labs/docker-compose/three-brokers/) - [Set Up GitOps for the Redpanda Helm Chart](https://docs.redpanda.com/labs/kubernetes/gitops-helm/) - [Iceberg Streaming on Kubernetes with Redpanda, MinIO, and Spark](https://docs.redpanda.com/labs/kubernetes/iceberg/) - [Set Up MySQL CDC with Debezium and Redpanda](https://docs.redpanda.com/labs/docker-compose/cdc-mysql-json/) - [Set Up Postgres CDC with Debezium and Redpanda](https://docs.redpanda.com/labs/docker-compose/cdc-postgres-json/) See more [Search all labs](https://docs.redpanda.com/labs)