Streaming

rpk k8s multicluster bootstrap

Bootstrap the TLS certificates and kubeconfig secrets that the multicluster operators of a Stretch Cluster need to communicate across Kubernetes clusters.

This command connects to each specified Kubernetes context, generates a shared CA certificate, and distributes per-cluster TLS certificates and kubeconfig secrets so that the multicluster operator can communicate across clusters.

If --kubeconfig is provided, all contexts in the file are used automatically and --context flags are not required. If both are provided, only the specified contexts from the kubeconfig file are used.

--loadbalancer provisions a standalone LoadBalancer Service on each cluster before signing certificates, waits for the cloud provider to assign an external address, and bakes that address into the cert SANs. This resolves the deploy/redeploy cycle that otherwise forces a first helm install just to learn each cluster’s external IP/hostname. The resulting peer list is printed on success for pasting into helm values.

--output=yaml skips applying anything and writes manifests as YAML. No cluster contact or kubeconfig is needed: cluster names are derived from --context flags (LB mode) or --dns-override keys (bootstrap mode).

When --output-dir <dir> is set, one file per cluster is written into the directory as <context>.yaml. This is required for the TLS bootstrap path because each cluster’s tls.key is per-cluster identity material that must not be applied to other clusters. The LoadBalancer-only step has no secrets and additionally allows streaming to stdout (split on '---' with comment headers). Use this for GitOps pipelines that commit manifests and apply them via Argo, Flux, or similar.

Two-step GitOps workflow:

  1. bootstrap --output=yaml --loadbalancer --context <ctx> …​ Emits only LoadBalancer Service manifests. Apply them, wait for the cloud provider to assign external addresses.

  2. bootstrap --output=yaml --output-dir <dir> --dns-override ctx=<address> …​ Emits Namespace and TLS Secret manifests into <dir>/<ctx>.yaml with the known addresses baked into the cert SANs.

When --loadbalancer is NOT set, --dns-override is required for every cluster; cluster names are derived from the override keys. ServiceAccount, SA token, and kubeconfig cache Secrets are not emitted because the operator regenerates them at runtime.

Usage

rpk k8s multicluster bootstrap [flags]

Examples

This section provides examples of how to use rpk k8s multicluster bootstrap.

Bootstrap all clusters from a kubeconfig file:

rpk k8s multicluster bootstrap \
  --kubeconfig /path/to/kubeconfig \
  --namespace redpanda

Bootstrap specific contexts (uses default kubeconfig loading rules):

rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b --context cluster-c \
  --namespace redpanda

Override the TLS secret prefix when Helm release names differ from context names:

rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b --context cluster-c \
  --name-override cluster-a=redpanda-operator \
  --name-override cluster-b=redpanda-operator \
  --name-override cluster-c=redpanda-operator \
  --namespace redpanda

Override DNS names for TLS SANs on specific clusters:

rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b \
  --dns-override cluster-a=cluster-a.example.com \
  --dns-override cluster-b=cluster-b.example.com \
  --namespace redpanda

Provision LoadBalancer Services and use their addresses for certificate SANs:

rpk k8s multicluster bootstrap \
  --kubeconfig /path/to/kubeconfig \
  --namespace redpanda \
  --loadbalancer

Bootstrap only TLS certificates:

rpk k8s multicluster bootstrap \
  --kubeconfig /path/to/kubeconfig \
  --namespace redpanda \
  --tls --kubeconfigs=false

GitOps step 1, emit LoadBalancer Service manifests (no kubeconfig needed):

rpk k8s multicluster bootstrap \
  --context cluster-a --context cluster-b \
  --namespace redpanda \
  --loadbalancer \
  --output=yaml > multicluster-services.yaml

GitOps step 2, emit Namespace and TLS Secret manifests (no kubeconfig needed):

rpk k8s multicluster bootstrap \
  --namespace redpanda \
  --dns-override cluster-a=cluster-a.example.com \
  --dns-override cluster-b=cluster-b.example.com \
  --output=yaml --output-dir ./multicluster-bootstrap

Flags

Value Type Description

--context

strings

Kubernetes contexts. Repeatable. If omitted with --kubeconfig, all contexts in the file are used.

--create-namespace

bool

Create the namespace if it does not exist (default true).

--dns-override

stringArray

DNS override for TLS SANs, in context=address format. Repeatable.

--kubeconfig

string

Path to a kubeconfig file (all contexts in the file are used unless --context is also specified).

--kubeconfigs

bool

Bootstrap kubeconfig secrets (default true).

--loadbalancer

bool

Provision a standalone LoadBalancer Service per cluster and use its external address for TLS SANs.

--loadbalancer-timeout

duration

Per-cluster timeout waiting for a LoadBalancer address (0 = default of 10m).

--name-override

stringArray

Override the TLS secret prefix for a context, in context=prefix format. Defaults to the context name. Repeatable.

--namespace

string

Namespace for operator resources (default redpanda).

--organization

string

Organization name for generated TLS certificates (default "Redpanda").

--output

string

Output mode. Empty (the default) applies resources to clusters. yaml emits manifests for GitOps and makes no cluster calls.

--output-dir

string

With --output=yaml, write one file per cluster (named <context>.yaml) into this directory. Required when emitting TLS Secrets; per-cluster routing prevents leaking peer identity keys across the trust boundary.

--service-name

string

Operator deployment label selector value (app.kubernetes.io/name) (default operator).

--tls

bool

Bootstrap TLS certificates (default true).

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/Library/Application Support/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.