# Environment Variables

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [streaming-full.txt](https://docs.redpanda.com/streaming-full.txt)

---
title: Environment Variables
latest-redpanda-tag: v26.2.2
latest-console-tag: v3.11.0
latest-operator-version: v26.2.3
# EOL = End-of-Life (support lifecycle status)
page-is-nearing-eol: "false"
page-is-past-eol: "false"
page-eol-date: July 28, 2027
latest-connect-version: 4.108.0
docname: environment-variables
page-component-name: streaming
page-version: "26.2"
page-component-version: "26.2"
page-component-title: Streaming
page-relative-src-path: environment-variables.adoc
page-edit-url: https://github.com/redpanda-data/docs/edit/main/modules/reference/pages/environment-variables.adoc
description: Reference of environment variables that the Redpanda broker and <code>rpk</code> read.
page-topic-type: reference
page-git-created-date: "2026-08-16"
page-git-modified-date: "2026-08-16"
support-status: supported
---

<!-- Source: https://docs.redpanda.com/streaming/current/reference/environment-variables.md -->

This reference documents the environment variables that the Redpanda broker and `rpk` read.

Two different programs read these variables, and the variable prefix does not tell you which: names starting with `REDPANDA_` appear in both. Check the section, not the prefix:

-   [Redpanda broker](#redpanda-broker) variables are read by the `redpanda` process itself.

-   [`rpk`](#rpk) variables are read by the `rpk` CLI on the machine where you run it. This includes the `REDPANDA_*` variables that `rpk redpanda start` uses to configure a broker, and the legacy `REDPANDA_*` aliases for connection settings.


## [](#redpanda-broker)Redpanda broker

The Redpanda broker reads the following environment variables from its process environment at startup.

| Variable | Description | Accepted values |
| --- | --- | --- |
| RP_BOOTSTRAP_USER | Creates a bootstrap superuser with SASL/SCRAM credentials when the cluster first starts. Use it to provision the initial user for a new cluster. If the value is malformed, Redpanda logs a warning and starts without creating the user. See Authentication. | <username>:<password>[:<mechanism>], where <mechanism> is SCRAM-SHA-256 (default) or SCRAM-SHA-512 |
| REDPANDA_ENVIRONMENT | Free-form label describing the deployment environment. Included in the usage and telemetry snapshot that Redpanda reports. | Any string (truncated if too long) |
| REDPANDA_FALLBACK_ENTERPRISE_LICENSE | Enterprise license to use as a fallback when no license is installed in the cluster. If the value is not a valid license, Redpanda logs a warning and continues without it. See Redpanda Licensing. | A valid Redpanda Enterprise license string |
| NOTIFY_SOCKET | Path to the systemd notification socket. systemd sets this variable automatically so that Redpanda can signal service readiness. Do not set it manually. | Set by systemd |
| AWS_ROLE_ARN | ARN of the IAM role to assume when Redpanda fetches temporary credentials through AWS STS web identity federation, such as with IAM Roles for Service Accounts (IRSA) on EKS. Required when the cluster is configured to use STS credentials for Tiered Storage. | An IAM role ARN |
| AWS_WEB_IDENTITY_TOKEN_FILE | Path to the projected web identity token file used with AWS_ROLE_ARN. Redpanda re-reads the file on each credential refresh. | A file path |
| AZURE_CLIENT_ID | Client ID of the Azure managed identity used for workload identity federation on AKS. | An Azure client ID |
| AZURE_TENANT_ID | Tenant ID for Azure workload identity federation on AKS. | An Azure tenant ID |
| AZURE_FEDERATED_TOKEN_FILE | Path to the federated token file used for Azure workload identity federation on AKS. | A file path |
| AZURE_AUTHORITY_HOST | Microsoft Entra ID (Azure AD) authority host used for Azure workload identity federation on AKS. | A URL |

> 📝 **NOTE**
>
> In Kubernetes deployments, the Redpanda Helm chart and Redpanda Operator set additional `REDPANDA_METRICS_K8S_*` environment variables on the broker container, such as the chart version and Kubernetes version. Redpanda includes these values in its telemetry reports. You don’t set these variables yourself.

## [](#rpk)`rpk`

### [](#rpk-x-env-vars)RPK_\* environment variables

Every `-X` option has a corresponding `RPK_*` environment variable. Convert by prefixing with `RPK_` and replacing dots with underscores:

| -X Option | Environment Variable |
| --- | --- |
| brokers | RPK_BROKERS |
| tls.enabled | RPK_TLS_ENABLED |
| tls.insecure_skip_verify | RPK_TLS_INSECURE_SKIP_VERIFY |
| tls.ca | RPK_TLS_CA |
| tls.cert | RPK_TLS_CERT |
| tls.key | RPK_TLS_KEY |
| sasl.mechanism | RPK_SASL_MECHANISM |
| user | RPK_USER |
| pass | RPK_PASS |
| admin.hosts | RPK_ADMIN_HOSTS |
| admin.tls.enabled | RPK_ADMIN_TLS_ENABLED |
| admin.tls.insecure_skip_verify | RPK_ADMIN_TLS_INSECURE_SKIP_VERIFY |
| admin.tls.ca | RPK_ADMIN_TLS_CA |
| admin.tls.cert | RPK_ADMIN_TLS_CERT |
| admin.tls.key | RPK_ADMIN_TLS_KEY |
| registry.hosts | RPK_REGISTRY_HOSTS |
| registry.tls.enabled | RPK_REGISTRY_TLS_ENABLED |
| registry.tls.insecure_skip_verify | RPK_REGISTRY_TLS_INSECURE_SKIP_VERIFY |
| registry.tls.ca | RPK_REGISTRY_TLS_CA |
| registry.tls.cert | RPK_REGISTRY_TLS_CERT |
| registry.tls.key | RPK_REGISTRY_TLS_KEY |
| cloud.client_id | RPK_CLOUD_CLIENT_ID |
| cloud.client_secret | RPK_CLOUD_CLIENT_SECRET |
| globals.prompt | RPK_GLOBALS_PROMPT |
| globals.no_default_cluster | RPK_GLOBALS_NO_DEFAULT_CLUSTER |
| globals.command_timeout | RPK_GLOBALS_COMMAND_TIMEOUT |
| globals.dial_timeout | RPK_GLOBALS_DIAL_TIMEOUT |
| globals.request_timeout_overhead | RPK_GLOBALS_REQUEST_TIMEOUT_OVERHEAD |
| globals.retry_timeout | RPK_GLOBALS_RETRY_TIMEOUT |
| globals.fetch_max_wait | RPK_GLOBALS_FETCH_MAX_WAIT |
| globals.kafka_protocol_request_client_id | RPK_GLOBALS_KAFKA_PROTOCOL_REQUEST_CLIENT_ID |

For details about each option and how environment variables fit into the configuration priority order, see [`rpk -X`](https://docs.redpanda.com/streaming/current/reference/rpk/rpk-x-options/).

### [](#other-rpk-environment-variables)Other `rpk` environment variables

The following variables are not derived from `-X` options:

| Variable | Description | Accepted values |
| --- | --- | --- |
| RPK_PROFILE | Selects the rpk profile to use for the current command, overriding the profile selected in rpk.yaml. | The name of an existing profile |
| RPK_PLUGIN_REPOSITORY | Overrides the repository URL that rpk plugin uses to discover and download plugins. | A URL |
| RPK_PLUGIN_DOWNLOAD_TIMEOUT | Overrides the timeout for plugin downloads. | A duration, such as 30s or 2m |

### [](#rpk-redpanda-start-variables)`rpk redpanda start` variables

The `rpk redpanda start` command reads the following environment variables as defaults for broker configuration, which is useful in containerized deployments. Equivalent command-line flags take precedence. Although these variables use the `REDPANDA_` prefix, they are read by `rpk` when it starts the broker, not by the broker process itself.

| Variable | Description | Accepted values |
| --- | --- | --- |
| REDPANDA_SEEDS | Seed servers for cluster discovery. Equivalent to the --seeds flag. | Comma-separated list of host:port pairs |
| REDPANDA_KAFKA_ADDRESS | Kafka API listener address. Equivalent to the --kafka-addr flag. | [name://]host:port |
| REDPANDA_PANDAPROXY_ADDRESS | HTTP Proxy listener address. Equivalent to the --pandaproxy-addr flag. | [name://]host:port |
| REDPANDA_SCHEMA_REGISTRY_ADDRESS | Schema Registry listener address. Equivalent to the --schema-registry-addr flag. | [name://]host:port |
| REDPANDA_RPC_ADDRESS | RPC server listener address. Equivalent to the --rpc-addr flag. | host:port |
| REDPANDA_ADVERTISE_KAFKA_ADDRESS | Advertised Kafka API address. Equivalent to the --advertise-kafka-addr flag. | [name://]host:port |
| REDPANDA_ADVERTISE_PANDAPROXY_ADDRESS | Advertised HTTP Proxy address. Equivalent to the --advertise-pandaproxy-addr flag. | [name://]host:port |
| REDPANDA_ADVERTISE_RPC_ADDRESS | Advertised RPC address. Equivalent to the --advertise-rpc-addr flag. | host:port |

See also [`rpk redpanda start`](https://docs.redpanda.com/streaming/current/reference/rpk/rpk-redpanda/rpk-redpanda-start/).

### [](#legacy-redpanda_-variables)Legacy REDPANDA_\* variables

Earlier versions of `rpk` used `REDPANDA_*` environment variables for connection settings. These variables still work, but the `RPK_*` equivalents take precedence when both are set. Use the `RPK_*` variables in new configurations.

| Legacy variable | Equivalent -X option |
| --- | --- |
| REDPANDA_BROKERS | brokers |
| REDPANDA_TLS_TRUSTSTORE | tls.ca |
| REDPANDA_TLS_CA | tls.ca |
| REDPANDA_TLS_CERT | tls.cert |
| REDPANDA_TLS_KEY | tls.key |
| REDPANDA_SASL_MECHANISM | sasl.mechanism |
| REDPANDA_SASL_USERNAME | user |
| REDPANDA_SASL_PASSWORD | pass |
| REDPANDA_API_ADMIN_ADDRS | admin.hosts |
| REDPANDA_ADMIN_TLS_TRUSTSTORE | admin.tls.ca |
| REDPANDA_ADMIN_TLS_CA | admin.tls.ca |
| REDPANDA_ADMIN_TLS_CERT | admin.tls.cert |
| REDPANDA_ADMIN_TLS_KEY | admin.tls.key |

## [](#see-also)See also

-   [`rpk -X`](https://docs.redpanda.com/streaming/current/reference/rpk/rpk-x-options/)

-   [`rpk` profiles](https://docs.redpanda.com/streaming/current/get-started/config-rpk-profile/)

-   [Authentication](https://docs.redpanda.com/streaming/current/manage/security/authentication/)