# rpk k8s multicluster bootstrap

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [streaming-full.txt](https://docs.redpanda.com/streaming-full.txt)

---
title: rpk k8s multicluster bootstrap
latest-redpanda-tag: v26.2.1
latest-console-tag: v3.10.0
latest-operator-version: v26.2.1
# EOL = End-of-Life (support lifecycle status)
page-is-nearing-eol: "false"
page-is-past-eol: "false"
page-eol-date: July 28, 2027
latest-connect-version: 4.105.0
docname: rpk/rpk-k8s/rpk-k8s-multicluster-bootstrap
page-component-name: streaming
page-version: "26.2"
page-component-version: "26.2"
page-component-title: Streaming
page-relative-src-path: rpk/rpk-k8s/rpk-k8s-multicluster-bootstrap.adoc
page-edit-url: https://github.com/redpanda-data/docs/edit/main/modules/reference/pages/rpk/rpk-k8s/rpk-k8s-multicluster-bootstrap.adoc
description: Bootstrap the TLS certificates and kubeconfig secrets that the multicluster operators of a Redpanda Stretch Cluster need to communicate across Kubernetes clusters. This command connects to each specified Kubernetes context, generates a shared CA certificate, and distributes per-cluster TLS certificates and kubeconfig secrets so that the multicluster operator can communicate across clusters.
page-git-created-date: "2026-07-22"
page-git-modified-date: "2026-08-03"
support-status: supported
---

<!-- Source: https://docs.redpanda.com/streaming/current/reference/rpk/rpk-k8s/rpk-k8s-multicluster-bootstrap.md -->

Bootstrap the TLS certificates and kubeconfig secrets that the multicluster operators of a Redpanda Stretch Cluster need to communicate across Kubernetes clusters.

This command connects to each specified Kubernetes context, generates a shared CA certificate, and distributes per-cluster TLS certificates and kubeconfig secrets so that the multicluster operator can communicate across clusters.

If `--kubeconfig` is provided, all contexts in the file are used automatically and `--context` flags are not required. If both are provided, only the specified contexts from the kubeconfig file are used.

`--loadbalancer` provisions a standalone LoadBalancer Service on each cluster before signing certificates, waits for the cloud provider to assign an external address, and bakes that address into the cert SANs. This resolves the deploy/redeploy cycle that otherwise forces a first helm install just to learn each cluster’s external IP/hostname. The resulting peer list is printed on success for pasting into helm values.

`--output=yaml` skips applying anything and writes manifests as YAML. No cluster contact or kubeconfig is needed: cluster names are derived from `--context` flags (LB mode) or `--dns-override` keys (bootstrap mode).

When `--output-dir` <dir> is set, one file per cluster is written into the directory as <context>\`.yaml\`. This is required for the TLS bootstrap path because each cluster’s tls.key is per-cluster identity material that must not be applied to other clusters. The LoadBalancer-only step has no secrets and additionally allows streaming to stdout (split on '---' with comment headers). Use this for GitOps pipelines that commit manifests and apply them via Argo, Flux, or similar.

Two-step GitOps workflow:

1.  bootstrap `--output=yaml` `--loadbalancer` `--context` <ctx> …​ Emits only LoadBalancer Service manifests. Apply them, wait for the cloud provider to assign external addresses.

2.  bootstrap `--output=yaml` `--output-dir` <dir> `--dns-override` ctx=<address> …​ Emits Namespace and TLS Secret manifests into <dir>/<ctx>\`.yaml\` with the known addresses baked into the cert SANs.


When `--loadbalancer` is NOT set, `--dns-override` is required for every cluster; cluster names are derived from the override keys. ServiceAccount, SA token, and kubeconfig cache Secrets are not emitted because the operator regenerates them at runtime.

> 📝 **NOTE**
>
> This command was introduced in k8s version 26.2.1.

## [](#usage)Usage

```bash
rpk k8s multicluster bootstrap [flags]
```

## [](#examples)Examples

This section provides examples of how to use `rpk k8s multicluster bootstrap`.

Bootstrap all clusters from a kubeconfig file

```bash
rpk k8s multicluster bootstrap \
  --kubeconfig /path/to/kubeconfig \
  --namespace redpanda
```

Bootstrap specific contexts (uses default kubeconfig loading rules)

```bash
rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b --context cluster-c \
  --namespace redpanda
```

Override the TLS secret prefix when helm release names differ from context names

```bash
rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b --context cluster-c \
  --name-override cluster-a=redpanda-operator \
  --name-override cluster-b=redpanda-operator \
  --name-override cluster-c=redpanda-operator \
  --namespace redpanda
```

Override DNS names for TLS SANs on specific clusters

```bash
rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b \
  --dns-override cluster-a=cluster-a.example.com \
  --dns-override cluster-b=cluster-b.example.com \
  --namespace redpanda
```

Provision LoadBalancer Services and use their addresses for cert SANs

```bash
rpk k8s multicluster bootstrap \
  --kubeconfig /path/to/kubeconfig \
  --namespace redpanda \
  --loadbalancer
```

Bootstrap only TLS certificates

```bash
rpk k8s multicluster bootstrap \
  --kubeconfig /path/to/kubeconfig \
  --namespace redpanda \
  --tls --kubeconfigs=false
```

GitOps step 1: emit LoadBalancer Services (no kubeconfig needed)

```bash
rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b \
  --namespace redpanda \
  --loadbalancer \
  --output=yaml > multicluster-services.yaml
```

GitOps step 2: emit Namespace + TLS Secrets (no kubeconfig needed)

```bash
rpk k8s multicluster bootstrap \
  --namespace redpanda \
  --dns-override cluster-a=cluster-a.example.com \
  --dns-override cluster-b=cluster-b.example.com \
  --output=yaml --output-dir ./multicluster-bootstrap
```

## [](#flags)Flags

| Value | Type | Description |
| --- | --- | --- |
| --context | strings | Kubernetes contexts (repeatable; if omitted with --kubeconfig, all contexts in the file are used). |
| --create-namespace | bool | Create the namespace if it does not exist. |
| --dns-override | stringArray | DNS override for TLS SANs in context=address format (repeatable). |
| --kubeconfig | string | Path to a kubeconfig file (all contexts in the file are used unless --context is also specified). |
| --kubeconfigs | bool | Bootstrap kubeconfig secrets. |
| --loadbalancer | bool | Provision a standalone LoadBalancer Service per cluster and use its external address for TLS SANs. |
| --loadbalancer-timeout | duration | Per-cluster timeout waiting for a LoadBalancer address (0 = default of 10m). |
| --name-override | stringArray | Override the TLS secret prefix for a context in context=prefix format (repeatable; defaults to the context name). |
| --namespace | string | Namespace for operator resources. |
| --organization | string | Organization name for generated TLS certificates. |
| --output | string | Output mode. Empty (default) applies resources to clusters. yaml emits manifests for GitOps and makes no cluster calls. |
| --output-dir | string | With --output=yaml, write one file per cluster (<context>`.yaml`) into this directory. Required when emitting TLS Secrets; per-cluster routing prevents leaking peer identity keys across the trust boundary. |
| --service-name | string | Operator deployment label selector value (app.kubernetes.io/name). |
| --tls | bool | Bootstrap TLS certificates. |

## [](#global-flags)Global flags

| Value | Type | Description |
| --- | --- | --- |
| --config | string | Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml. |
| -X, --config-opt | stringArray | Override rpk configuration settings; -X help for detail or -X list for terser detail. |
| --ignore-profile | bool | Ignore rpk.yaml and redpanda.yaml; use default settings. |
| --profile | string | rpk profile to use. |
| -v, --verbose | bool | Enable verbose logging. |