# Deploy for Production: Manual > For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [streaming-full.txt](https://docs.redpanda.com/streaming-full.txt) --- title: "Deploy for Production: Manual" latest-redpanda-tag: v25.2.1 latest-console-tag: v3.7.3 latest-operator-version: v26.1.4 # EOL = End-of-Life (support lifecycle status) page-is-nearing-eol: "true" page-is-past-eol: "false" page-eol-date: July 31, 2026 latest-connect-version: 4.93.0 docname: redpanda/manual/production/production-deployment page-component-name: streaming page-version: "25.2" page-component-version: "25.2" page-component-title: Streaming page-relative-src-path: redpanda/manual/production/production-deployment.adoc page-edit-url: https://github.com/redpanda-data/docs/edit/v/25.2/modules/deploy/pages/redpanda/manual/production/production-deployment.adoc description: Steps to deploy a Redpanda production cluster. page-git-created-date: "2025-08-15" page-git-modified-date: "2025-08-15" support-status: nearing end-of-life --- You can deploy Redpanda for production with a default deployment, which uses recommended deployment tools, or with a custom deployment, which uses unsupported deployment tools. > 📝 **NOTE** > > - See [Deploy for Production: Automated](https://docs.redpanda.com/streaming/25.2/deploy/redpanda/manual/production/production-deployment-automation/) to use Terraform and Ansible to deploy Redpanda. > > - See [Redpanda Quickstart](https://docs.redpanda.com/streaming/25.2/get-started/quick-start/) to try out Redpanda in Docker or [Deploy for Development](https://docs.redpanda.com/streaming/25.2/deploy/redpanda/manual/production/dev-deployment/). ## [](#prerequisites)Prerequisites Make sure you meet the [hardware and software requirements](https://docs.redpanda.com/streaming/25.2/deploy/redpanda/manual/production/requirements/). ### [](#tcpip-ports)TCP/IP ports Redpanda uses the following default ports: | Port | Purpose | | --- | --- | | 9092 | Kafka API | | 8082 | HTTP Proxy | | 8081 | Schema Registry | | 9644 | Admin API and Prometheus | | 33145 | internal RPC | ## [](#select-deployment-type)Select deployment type To start deploying Redpanda for production, choose your deployment type: - [Default deployment](#default-deployment): Use recommended deployment tools. - [Custom deployment](#custom-deployment): Use unsupported deployment tools. ## [](#default-deployment)Default deployment This section describes how to set up a production cluster of Redpanda. ### [](#install-redpanda)Install Redpanda Install Redpanda on each system you want to be part of your cluster. There are binaries available for Fedora/RedHat or Debian systems. Unless you intend to run Redpanda in FIPS-compliance mode, the following packages should accommodate your needs (for both Debian and Redhat based systems): `redpanda` - Contains the Redpanda application and all supporting libraries - Depends on `redpanda-tuner` and either `redpanda-rpk` or `redpanda-rpk-fips` `redpanda-rpk` - Contains the pure GoLang compiled `rpk` application - If you wish to use `rpk` only, then this is the only required install package `redpanda-tuner` - Contains the files used to run Redpanda tuners - Depends on `redpanda-rpk` or `redpanda-rpk-fips` #### Fedora/RedHat ```bash curl -1sLf 'https://dl.redpanda.com/nzc4ZYQK3WRGd9sy/redpanda/cfg/setup/bash.rpm.sh' | \ sudo -E bash && sudo yum install redpanda -y ``` > ❗ **IMPORTANT** > > To install a version of Redpanda that is older than the latest available version, you must also specify each dependency. For example, if installing `24.3.1~rc1-1` and you fail to specify each package and its version, you may encounter the following error: > > ```bash > yum install redpanda=24.3.1~rc1-1 > Reading package lists... Done > Building dependency tree... Done > Reading state information... Done > Some packages could not be installed. This may mean that you have > requested an impossible situation or if you are using the unstable > distribution that some required packages have not yet been created > or been moved out of Incoming. > The following information may help to resolve the situation: > > The following packages have unmet dependencies: > redpanda : Depends: redpanda-rpk (= 24.3.1~rc1-1) but it is not going to be installed or > redpanda-rpk-fips (= 24.3.1~rc1-1) but it is not going to be installed > Depends: redpanda-tuner (= 24.3.1~rc1-1) but it is not going to be installed > E: Unable to correct problems, you have held broken packages. > ``` > > To troubleshoot this error, specify the full list of versions for each package. In this case: > > ```bash > yum install \ > redpanda-tuner=24.3.1~rc1-1 \ > redpanda-rpk=24.3.1~rc1-1 \ > redpanda=24.3.1~rc1-1 > ``` #### Debian/Ubuntu ```bash curl -1sLf 'https://dl.redpanda.com/nzc4ZYQK3WRGd9sy/redpanda/cfg/setup/bash.deb.sh' | \ sudo -E bash && sudo apt install redpanda -y ``` > ❗ **IMPORTANT** > > To install a version of Redpanda that is older than the latest available version, you must also specify each dependency. For example, if installing `24.3.1~rc1-1` and you fail to specify each package and its version, you may encounter the following error: > > ```bash > apt install redpanda=24.3.1~rc1-1 > Reading package lists... Done > Building dependency tree... Done > Reading state information... Done > Some packages could not be installed. This may mean that you have > requested an impossible situation or if you are using the unstable > distribution that some required packages have not yet been created > or been moved out of Incoming. > The following information may help to resolve the situation: > > The following packages have unmet dependencies: > redpanda : Depends: redpanda-rpk (= 24.3.1~rc1-1) but it is not going to be installed or > redpanda-rpk-fips (= 24.3.1~rc1-1) but it is not going to be installed > Depends: redpanda-tuner (= 24.3.1~rc1-1) but it is not going to be installed > E: Unable to correct problems, you have held broken packages. > ``` > > To troubleshoot this error, specify the full list of versions for each package. In this case: > > ```bash > apt install \ > redpanda-tuner=24.3.1~rc1-1 \ > redpanda-rpk=24.3.1~rc1-1 \ > redpanda=24.3.1~rc1-1 > ``` ### [](#install-redpanda-for-fips-compliance)Install Redpanda for FIPS compliance > 📝 **NOTE** > > This feature requires an [enterprise license](https://docs.redpanda.com/streaming/25.2/get-started/licensing/). To get a trial license key or extend your trial period, [generate a new trial license key](https://redpanda.com/try-enterprise). To purchase a license, contact [Redpanda Sales](https://redpanda.com/upgrade). > > If Redpanda has enterprise features enabled and it cannot find a valid license, [restrictions](https://docs.redpanda.com/streaming/25.2/get-started/licensing/#self-managed) apply. To install Redpanda for FIPS compliance, install the packages `redpanda-fips` and `redpanda-rpk-fips`, which automatically pull in all required dependencies. `redpanda-fips` - Contains the OpenSSL FIPS-approved module and scripts required to set up and run Redpanda in FIPS-compliance mode. - Depends upon the successful installation of the `redpanda` package. - Includes the `fips.so` cryptographic provider (built from OpenSSL v3.0.9, which is the latest FIPS 140-2 approved module) and a copy of the OpenSSL application. - Executes `openssl fipsinstall` against the `fips.so` module, which generates a `fipsmodule.cnf` file that is used during the module’s POST (power-on-self-test) to validate the integrity of the module. `redpanda-rpk-fips` - Contains a version of `rpk` built with the [Microsoft GoLang compiler](https://github.com/microsoft/go) and [Microsoft’s Go Crypto OpenSSL package](https://github.com/microsoft/go-crypto-openssl) to which `rpk` is linked, and uses the FIPS-approved version of OpenSSL. #### RHEL To install Redpanda for FIPS compliance, run: ```bash curl -1sLf 'https://dl.redpanda.com/nzc4ZYQK3WRGd9sy/redpanda/cfg/setup/bash.rpm.sh' | \ sudo -E bash && sudo yum install redpanda -y ``` > 📝 **NOTE** > > Alternatively, you could run `sudo yum install -y redpanda-fips`, which also picks up and includes the `redpanda` install package. If you wish to only use `rpk` on a FIPS host, run: ```bash sudo yum install -y redpanda-fips redpanda-rpk-fips ``` #### Debian/Ubuntu To install Redpanda for FIPS compliance, run: ```bash sudo apt install redpanda-fips redpanda-rpk-fips ``` > 📝 **NOTE** > > Alternatively, you could run `sudo apt install redpanda-fips`, which also picks up and includes the `redpanda` install package. If you wish to only use `rpk` on a FIPS host, run: ```bash sudo apt install -y redpanda-rpk-fips ``` See also: [Configure Redpanda for FIPS](https://docs.redpanda.com/streaming/25.2/manage/security/fips-compliance/) ### [](#install-redpanda-console)Install Redpanda Console For comprehensive installation and configuration instructions, see [Deploy Redpanda Console on Linux](https://docs.redpanda.com/streaming/25.2/deploy/console/linux/deploy/). ### [](#tune-the-linux-kernel-for-production)Tune the Linux kernel for production To get the best performance from your hardware, set Redpanda to production mode on each node and run the autotuner tool. The autotuner identifies the hardware configuration of your node and optimizes the Linux kernel to give you the best performance. By default, Redpanda is installed in development mode, which turns off hardware optimization. 1. Make sure that your current Linux user has root privileges. The autotuner requires privileged access to the Linux kernel settings. 2. Set Redpanda to run in [production mode](https://docs.redpanda.com/streaming/25.2/reference/rpk/rpk-redpanda/rpk-redpanda-mode/#production-mode): ```bash sudo rpk redpanda mode production ``` 3. Tune the Linux kernel: ```bash sudo rpk redpanda tune all ``` Changes to the Linux kernel are not persisted. If a node restarts, make sure to run the autotuner again. To automatically tune the Linux kernel on a Redpanda broker after the node restarts, enable the `redpanda-tuner` service, which runs `rpk redpanda tune all`: - For RHEL, after installing the rpm package, run `systemctl` to both start and enable the `redpanda-tuner` service: ```bash sudo systemctl start redpanda-tuner sudo systemctl enable redpanda-tuner ``` - For Ubuntu, after installing the apt package, run `systemctl` to start the `redpanda-tuner` service (which is already enabled): ```bash sudo systemctl start redpanda-tuner ``` For more details, see the [autotuner reference](https://docs.redpanda.com/streaming/25.2/reference/rpk/rpk-redpanda/rpk-redpanda-tune/). ### [](#generate-optimal-io-configuration-settings)Generate optimal I/O configuration settings After tuning the Linux kernel, you can optimize Redpanda for the I/O capabilities of your worker node by using `rpk` to run benchmarks that capture its read/write IOPS and bandwidth capabilities. After running the benchmarks `rpk` saves the results to an I/O configuration file (`io-config.yaml`) that Redpanda reads upon startup to optimize itself for the node. > 📝 **NOTE** > > Unlike the autotuner, it isn’t necessary to run `rpk iotune` each time Redpanda is started, as its I/O output configuration file can be reused for each node that runs on the same type of hardware. Run [rpk iotune](https://docs.redpanda.com/streaming/25.2/reference/rpk/rpk-iotune/): ```bash sudo rpk iotune # takes 10mins ``` For reference, a local NVMe SSD should yield around 1 GB/s sustained writes. `rpk iotune` captures SSD wear and tear and gives accurate measurements of what your hardware is capable of delivering. Run this before benchmarking. If you’re on AWS, GCP, or Azure, creating a new instance and upgrading to an image with a recent Linux kernel version is often the easiest way to work around bad devices. ### [](#bootstrapping)Bootstrap broker configurations Each broker requires a set of broker configurations that determine how all brokers communicate with each other and with clients. Bootstrapping a cluster configures the [listener](https://docs.redpanda.com/streaming/25.2/reference/glossary/#listener), seed servers, and [advertised listeners](https://docs.redpanda.com/streaming/25.2/reference/glossary/#advertised-listener), which ensure proper network connectivity and accessibility. Starting in version 23.3.8, `rpk` enhances the bootstrapping process with additional flags for configuring advertised listener addresses directly. Use the [`rpk redpanda config bootstrap`](https://docs.redpanda.com/streaming/25.2/reference/rpk/rpk-redpanda/rpk-redpanda-config-bootstrap/) command to bootstrap Redpanda: ```bash sudo rpk redpanda config bootstrap --self --advertised-kafka --ips ,, && \ sudo rpk redpanda config set redpanda.empty_seed_starts_cluster false ``` Replace the following placeholders: - ``: The `--self` flag tells Redpanda the interfaces to bind to for the Kafka API, the RPC API, and the Admin API. These addresses determine on which network interface and port Redpanda listens for incoming connections. - Set the listener address to `0.0.0.0` to listen on all network interfaces available on the machine. - Set the listener address to a specific IP address to bind the listener to that address, restricting connections to that interface. - ``: The `--advertised-kafka` flag sets a different advertised Kafka address, which is useful for scenarios where the accessible address differs from the bind address. > ❗ **IMPORTANT** > > Redpanda does not allow advertised addresses set to `0.0.0.0`. If you set any advertised addresses to `0.0.0.0`, Redpanda will output startup validation errors. - ``: The `--ips` flag lists all the seed servers in the cluster, including the one being started. > 📝 **NOTE** > > The `--ips` flag must be set _identically_ (with nodes listed in identical order) on each node. Bootstrapping Redpanda updates your `/etc/redpanda/redpanda.yaml` configuration file: `/etc/redpanda/redpanda.yaml` ```yaml redpanda: data_directory: /var/lib/redpanda/data empty_seed_starts_cluster: false seed_servers: - host: address: port: 33145 - host: address: port: 33145 - host: address: port: 33145 rpc_server: address: port: 33145 kafka_api: - address: port: 9092 admin: - address: port: 9644 advertised_rpc_api: address: port: 33145 advertised_kafka_api: - address: port: 9092 ``` #### [](#recommendations)Recommendations - Redpanda Data strongly recommends at least three seed servers when forming a cluster. A larger number of seed servers increases the robustness of consensus and minimizes any chance that new clusters get spuriously formed after brokers are lost or restarted without any data. - It’s important to have one or more seed servers in each fault domain (for example, in each rack or cloud AZ). A higher number provides a stronger guarantee that clusters don’t fracture unintentionally. - It’s possible to change the seed servers for a short period of time after a cluster has been created. For example, you may want to designate one additional broker as a seed server to increase availability. To do this without cluster downtime, add the new broker to the [`seed_servers`](https://docs.redpanda.com/streaming/25.2/reference/properties/broker-properties/) property and restart Redpanda to apply the change on a broker-by-broker basis. #### [](#listeners-for-mixed-environments)Listeners for mixed environments For clusters serving both internal and external clients, configure multiple listeners for the Kafka API to separate internal from external traffic. For more details, see [Configure Listeners](https://docs.redpanda.com/streaming/25.2/manage/security/listener-configuration/). ### [](#start-redpanda)Start Redpanda To start Redpanda: ```bash sudo systemctl start redpanda-tuner redpanda ``` When a Redpanda cluster starts, it instantiates a controller Raft group with all the seed servers specified in the `--ips` flag. After all seed servers complete their startup procedure and become accessible, the cluster is then available. After that, non-seed servers start up and are added to the cluster. ### [](#start-redpanda-console)Start Redpanda Console For instructions on starting and managing Redpanda Console, see [Deploy Redpanda Console on Linux](https://docs.redpanda.com/streaming/25.2/deploy/console/linux/deploy/). ### [](#verify-the-installation)Verify the installation To verify that the Redpanda cluster is up and running, use `rpk` to get information about the cluster: ```bash rpk cluster info ``` You should see a list of advertised addresses. To create a topic: ```bash rpk topic create ``` If topics were initially created in a test environment with a replication factor of `1`, use `rpk topic alter-config` to change the topic replication factor: ```bash rpk topic alter-config --set replication.factor=3 ``` ### [](#enable-monitoring)Enable monitoring [Monitor Redpanda](https://docs.redpanda.com/streaming/25.2/manage/monitoring/). Observability is essential in production environments. ## [](#custom-deployment)Custom deployment This section provides information for creating your own automation for deploying Redpanda clusters without using any of the tools that Redpanda supports for setting up a cluster, such as Ansible Playbook, Helm Chart, or Kubernetes Operator. > 💡 **TIP** > > Redpanda strongly recommends using one of these supported deployment tools. See [Automate Deploying for Production](https://docs.redpanda.com/streaming/25.2/deploy/redpanda/manual/production/production-deployment-automation/). ### [](#configure-a-bootstrap-file)Configure a bootstrap file Redpanda cluster configuration is written with the Admin API and the `rpk cluster config` CLIs. In the special case where you want to provide configuration to Redpanda before it starts for the first time, you can write a `.bootstrap.yaml` file in the same directory as `redpanda.yaml`. This file is only read on the first startup of the cluster. Any subsequent changes to `.bootstrap.yaml` are ignored, so changes to cluster configuration must be done with the Admin API. The content format is a YAML dictionary of cluster configuration properties. For example, to initialize a cluster with Admin API authentication enabled and a single superuser, the `.bootstrap.yaml` file would contain the following: ```yaml admin_api_require_auth: true superusers: - alice ``` With this configuration, the Admin API is not accessible until you bootstrap a user account. ### [](#bootstrap-a-user-account)Bootstrap a user account When using username/password authentication, it’s helpful to be able to create one user before the cluster starts for the first time. Do this by setting the `RP_BOOTSTRAP_USER` environment variable when starting Redpanda for the first time. The value has the format `RP_BOOTSTRAP_USER=username:password[:mechanism]`. The only supported values for `mechanism` are `SCRAM-SHA-512` or `SCRAM-SHA-256`; if it is omitted, Redpanda defaults to `SCRAM-SHA-256`. For example: `RP_BOOTSTRAP_USER=alice:letmein:SCRAM-SHA-512`. > 📝 **NOTE** > > `RP_BOOTSTRAP_USER` only creates a user account. You must still set up authentication using cluster configuration. ### [](#secure-the-admin-api)Secure the Admin API The Admin API is used to create SASL user accounts and ACLs, so it’s important to think about how you secure it when creating a cluster. - No authentication, but listening only on 127.0.0.1: This may be appropriate if your Redpanda processes are running in an environment where only administrators can access the host. - mTLS authentication: You can generate client and server x509 certificates before starting Redpanda for the first time, refer to them in `redpanda.yaml`, and use the client certificate when accessing the Admin API. - Username/password authentication: Use the combination of `admin_api_require_auth`, `superusers`, and `RP_BOOTSTRAP_USER` to access the Admin API username/password authentication. You probably still want to enable TLS on the Admin API endpoint to protect credentials in flight. ### [](#configure-the-seed-servers)Configure the seed servers Seed servers help new brokers join a cluster by directing requests from newly-started brokers to an existing cluster. The [`seed_servers`](https://docs.redpanda.com/streaming/25.2/reference/properties/broker-properties/#seed_servers) broker property controls how Redpanda finds its peers when initially forming a cluster. It is dependent on the [`empty_seed_starts_cluster`](https://docs.redpanda.com/streaming/25.2/reference/properties/broker-properties/#empty_seed_starts_cluster) broker property. Starting with Redpanda version 22.3, you should explicitly set `empty_seed_starts_cluster` to `false` on every broker, and every broker in the cluster should have the same value set for `seed_servers`. With this set of configurations, Redpanda clusters form with these guidelines: - When a broker starts and it is a seed server (its address is in the `seed_servers` list), it waits for all other seed servers to start up, and it forms a cluster with all seed servers as members. - When a broker starts and it is not a seed server, it sends requests to the seed servers to join the cluster. It is essential that all seed servers have identical values for the `seed_servers` list. Redpanda strongly recommends at least three seed servers when forming a cluster. Each seed server decreases the likelihood of unintentionally forming a split brain cluster. To ensure brokers can always discover the cluster, at least one seed server should be available at all times. By default, for backward compatibility, `empty_seed_starts_cluster` is set to `true`, and Redpanda clusters form with the guidelines used prior to version 22.3: - When a broker starts with an empty `seed_servers` list, it creates a single broker cluster with itself as the only member. - When a broker starts with a non-empty `seed_servers` list, it sends requests to the brokers in that list to join the cluster. You should never have more than one broker with an empty `seed_servers` list, which would result in the creation of multiple clusters. > ❗ **IMPORTANT** > > Redpanda expects its storage to be persistent, and it’s an error to erase a broker’s drive and restart it. However, in some environments (like when migrating to a different Node pool on Kubernetes), truly persistent storage is unavailable, and brokers may find their data volumes erased. For such environments, Redpanda recommends setting `empty_seed_starts_cluster` to false and designating a set of seed servers such that they couldn’t lose their storage simultaneously. ### [](#do-not-configure-broker-ids)Do not configure broker IDs Redpanda automatically generates unique broker IDs for each new broker and assigns it to the [`node_id`](https://docs.redpanda.com/streaming/25.2/reference/properties/broker-properties/) field in the broker configuration. This ensures safe and consistent cluster operations without requiring manual configuration. > ⚠️ **WARNING: Do not set node_id manually.** > > Do not set `node_id` manually. > > Redpanda assigns unique IDs automatically to prevent issues such as: > > - Brokers with empty disks rejoining the cluster. > > - Conflicts during recovery or scaling. > > > Manually setting or reusing `node_id` values, even for decommissioned brokers, can cause cluster inconsistencies and operational failures. ## [](#perform-a-self-test)Perform a self test To understand the performance capabilities of your Redpanda cluster, Redpanda offers built-in self-test features that evaluate the performance of both disk and network operations. For more information, see [Disk and network self-test benchmarks](https://docs.redpanda.com/streaming/25.2/troubleshoot/cluster-diagnostics/diagnose-issues/#self-test). When using the storage bandwidth test, ensure that your results show at least 16,000 IOPS (Input/Output Operations Per Second) for production environments. If your test results are below this threshold, your storage may not be suitable for production Redpanda workloads. ### [](#upgrade-considerations)Upgrade considerations Deployment automation should place each broker into maintenance mode and wait for it to drain leadership before restarting it with a newer version of Redpanda. For more information, see [Upgrade](https://docs.redpanda.com/streaming/25.2/upgrade/rolling-upgrade/). If upgrading multiple [feature release versions of Redpanda](https://docs.redpanda.com/streaming/25.2/upgrade/k-rolling-upgrade/#find-a-new-version) in succession, make sure to verify that each version upgrades to completion before proceeding to the next version. You can verify by reading the `/v1/features` Admin API endpoint and checking that `cluster_version` has increased. Starting with Redpanda version 23.1, the `/v1/features` endpoint also includes a `node_latest_version` attribute, and installers can verify that the cluster has activated any new functionality from a previous upgrade by checking for `cluster_version` == `node_latest_version`. ## [](#next-steps)Next steps - If clients connect from a different subnet, see [Configure Listeners](https://docs.redpanda.com/streaming/25.2/manage/security/listener-configuration/). - Observability is essential in production environments. See [Monitor Redpanda](https://docs.redpanda.com/streaming/25.2/manage/monitoring/). ## [](#suggested-reading)Suggested reading - [Configure Cluster Properties](https://docs.redpanda.com/streaming/25.2/manage/cluster-maintenance/cluster-property-configuration/) - [Redpanda Console Configuration](https://docs.redpanda.com/streaming/25.2/console/config/configure-console/) ## Suggested labs - [Disaster Recovery with Envoy and Shadowing](https://docs.redpanda.com/labs/docker-compose/envoy-shadowing/) - [Redpanda Iceberg Docker Compose Example](https://docs.redpanda.com/labs/docker-compose/iceberg/) - [Stream Jira Issues to Redpanda for Real-Time Metrics](https://docs.redpanda.com/labs/docker-compose/jira-metrics-pipeline/) - [Migrate Data with Redpanda Migrator](https://docs.redpanda.com/labs/docker-compose/redpanda-migrator/) - [Start a Single Redpanda Broker with Redpanda Console in Docker](https://docs.redpanda.com/labs/docker-compose/single-broker/) - [Start a Cluster of Redpanda Brokers with Redpanda Console in Docker](https://docs.redpanda.com/labs/docker-compose/three-brokers/) - [Set Up GitOps for the Redpanda Helm Chart](https://docs.redpanda.com/labs/kubernetes/gitops-helm/) - [Iceberg Streaming on Kubernetes with Redpanda, MinIO, and Spark](https://docs.redpanda.com/labs/kubernetes/iceberg/) - [Set Up MySQL CDC with Debezium and Redpanda](https://docs.redpanda.com/labs/docker-compose/cdc-mysql-json/) - [Set Up Postgres CDC with Debezium and Redpanda](https://docs.redpanda.com/labs/docker-compose/cdc-postgres-json/) See more [Search all labs](https://docs.redpanda.com/labs)