Deploy a Stretch Cluster on Kubernetes

helm repo add jetstack https://charts.jetstack.io
helm repo update

for ctx in <cluster-1-context> <cluster-2-context> <cluster-3-context>; do
  helm install cert-manager jetstack/cert-manager \
    --kube-context "$ctx" \
    --namespace cert-manager \
    --create-namespace \
    --set crds.enabled=true
done

for ctx in <cluster-1-context> <cluster-2-context> <cluster-3-context>; do
  kubectl create namespace redpanda --context "$ctx" --dry-run=client -o yaml \
    | kubectl apply --context "$ctx" -f -

  kubectl create secret generic redpanda-license \
    --namespace redpanda \
    --context "$ctx" \
    --from-file=license.key=<path-to-license-file>
done

rpk k8s multicluster bootstrap \
  --context <cluster-1-context> \
  --context <cluster-2-context> \
  --context <cluster-3-context> \
  --namespace redpanda \
  --loadbalancer

for ctx in <cluster-1-context> <cluster-2-context> <cluster-3-context>; do
  kubectl get service "<cluster-name>-multicluster-peer" \
    --namespace redpanda \
    --context "$ctx" \
    -o jsonpath='{.status.loadBalancer.ingress[0].ip}{.status.loadBalancer.ingress[0].hostname}{"\n"}'
done

kubectl cluster-info --context <cluster-context>

helm repo add redpanda https://charts.redpanda.com
helm repo update

helm install <cluster-1-name> redpanda/operator \
  --kube-context <cluster-1-context> \
  --namespace redpanda \
  --version v26.1.9 \
  --set fullnameOverride=<cluster-1-name> \
  --set crds.enabled=true \
  --set multicluster.enabled=true \
  --set multicluster.name=<cluster-1-name> \
  --set multicluster.apiServerExternalAddress=<cluster-1-api-server> \
  --set-json 'multicluster.peers=[{"name":"<cluster-1-name>","address":"<cluster-1-peer-address>"},{"name":"<cluster-2-name>","address":"<cluster-2-peer-address>"},{"name":"<cluster-3-name>","address":"<cluster-3-peer-address>"}]' \
  --set enterprise.licenseSecretRef.name=redpanda-license \
  --set enterprise.licenseSecretRef.key=license.key

for ctx in <cluster-1-context> <cluster-2-context> <cluster-3-context>; do
  kubectl get pods --namespace redpanda --context "$ctx"
done

ADMIN_PASSWORD=$(openssl rand -base64 24)
echo "Save this password: ${ADMIN_PASSWORD}"

for ctx in <cluster-1-context> <cluster-2-context> <cluster-3-context>; do
  kubectl create secret generic redpanda-users \
    --namespace redpanda \
    --context "$ctx" \
    --from-literal=users.txt="admin:${ADMIN_PASSWORD}:SCRAM-SHA-256" \
    --from-literal=password="${ADMIN_PASSWORD}"
done

apiVersion: cluster.redpanda.com/v1alpha2
kind: StretchCluster
metadata:
  name: cluster
  namespace: redpanda
spec:
  networking:
    crossClusterMode: mesh (1)
  auth: (2)
    sasl:
      enabled: true
      mechanism: SCRAM-SHA-256
      secretRef: redpanda-users
  storage:
    persistentVolume:
      enabled: true
      size: 100Gi
  resources:
    cpu:
      cores: "4"
    memory:
      container:
        max: 8Gi
  enterprise:
    licenseSecretRef:
      name: redpanda-license
      key: license.key
  config:
    cluster:
      # Five replicas spread over three locations keep a Raft majority
      # through the loss of any one location.
      default_topic_replications: 5
      # Wait 10 min before relocating replicas off an unavailable broker
      # to avoid cross-region rebalancing on brief network blips.
      partition_autobalancing_node_availability_timeout_sec: 600
      # Increase the liveness probe interval to accommodate WAN latency.
      node_status_interval: 1000
      # Increase Raft timeouts for WAN latency.
      raft_heartbeat_timeout_ms: 5000
      replicate_append_timeout_ms: 5000
      # Cache health metadata longer to reduce cross-cluster API calls.
      health_monitor_max_metadata_age: 60000

apiVersion: cluster.redpanda.com/v1alpha2
kind: RedpandaBrokerPool
metadata:
  name: pool-<cluster-1-name>
  namespace: redpanda
spec:
  clusterRef: (1)
    group: cluster.redpanda.com
    kind: StretchCluster
    name: cluster
  replicas: 2 # 2/2/1 across the three clusters
  image: (2)
    repository: docker.redpanda.com/redpandadata/redpanda
    tag: v26.2.1
  tls: (3)
    enabled: true
    certs:
      default:
        caEnabled: true
  services:
    perPod: (4)
      local:
        annotations:
          service.cilium.io/global: "true"
      remote:
        annotations:
          service.cilium.io/global: "true"

kubectl get stretchcluster --namespace redpanda --context <cluster-1-context>
kubectl get redpandabrokerpool --namespace redpanda --context <cluster-1-context>

apiVersion: cluster.redpanda.com/v1alpha2
kind: User
metadata:
  name: admin
  namespace: redpanda
spec:
  cluster:
    clusterRef:
      group: cluster.redpanda.com
      kind: StretchCluster
      name: cluster
  authentication:
    type: scram-sha-256
    password:
      valueFrom:
        secretKeyRef:
          name: redpanda-users
          key: password

kubectl apply -f user-admin.yaml --context <cluster-1-context>

kubectl get user --namespace redpanda --context <cluster-1-context>

kubectl exec --namespace redpanda --context <cluster-1-context> -it <pod-name> -- \
  rpk cluster info -X user=admin -X pass=<admin-password> -X sasl.mechanism=SCRAM-SHA-256

rpk k8s multicluster status \
  --context <cluster-1-context> \
  --context <cluster-2-context> \
  --context <cluster-3-context> \
  --namespace redpanda