Rpk Cloud

rpk cloud: Authenticate & Manage Redpanda Cloud

rpk cloud is the command group that connects rpk to Redpanda Cloud. It handles authentication (SSO and client credentials), profile creation, cluster selection, resource-group management, BYOC agent provisioning, and the MCP server integration for AI agents.

The seven top-level subgroups are:

Quickstart

# 1. Log in via SSO (opens browser automatically)
rpk cloud login

# 1b. Log in with client credentials (headless / CI)
rpk cloud login \
  --client-id "abc123" \
  --client-secret "secret456" \
  --save                        # persist to rpk.yaml for token refresh

# 1c. Same, via environment variables (no flags needed)
export RPK_CLOUD_CLIENT_ID=abc123
export RPK_CLOUD_CLIENT_SECRET=secret456
rpk cloud login --no-profile   # skip interactive cluster-select

# 2. Select a Cloud cluster — wires your rpk profile to it
rpk cloud cluster select                  # interactive prompt
rpk cloud cluster select my-cluster-name  # by name
rpk cloud cluster select my-cluster-name --serverless-network public

# 3. Verify the profile is active and talk to the cluster
rpk topic list   # uses the profile set by cluster select

# 4. Print the current bearer token (useful for API calls)
rpk cloud auth token

# 5. List all stored cloud authentications
rpk cloud auth list

# 6. Manage resource groups
rpk cloud resource-group list
rpk cloud resource-group create my-rg
rpk cloud resource-group delete my-rg --no-confirm

# 7. BYOC: install the plugin and apply for a cluster
rpk cloud byoc install --redpanda-id <cluster-id>
rpk cloud byoc aws apply --redpanda-id <cluster-id>
rpk cloud byoc gcp apply --redpanda-id <cluster-id>
rpk cloud byoc azure apply --redpanda-id <cluster-id>

# 8. MCP: install into Claude Code (so the AI can manage your cloud)
rpk cloud login --no-profile
rpk cloud mcp install --client claude-code

# 8b. MCP: run the stdio server directly (MCP client calls this)
rpk cloud mcp stdio
rpk cloud mcp stdio --allow-delete   # also expose destructive RPCs

Authentication Model

Redpanda Cloud uses Auth0 under the hood. rpk cloud login runs either:

• SSO flow (OAuth device-authorization flow): opens your browser to the Redpanda Cloud login page (Auth0 device flow). The CLI polls for the device code to be authorized; once approved, Auth0 issues a bearer token that is stored in rpk.yaml. When --no-browser is used, the URL and device code are printed to the terminal so you can complete the flow manually on another machine.
• Client credentials flow: exchanges a client_id + client_secret for a bearer token without a browser. Client credentials are created in the Clients tab of the Users section in the Redpanda Cloud UI.

Token and client ID are always persisted to rpk.yaml. The client secret is only persisted when you pass --save.

Priority order for client credentials (highest to lowest):

1. client_id / client_secret fields in the active rpk cloud auth entry in rpk.yaml
2. RPK_CLOUD_CLIENT_ID / RPK_CLOUD_CLIENT_SECRET environment variables
3. --client-id / --client-secret flags

When no credentials are provided, rpk falls back to SSO.

Flags Available on rpk cloud login

Cloud Auth Subcommands

rpk cloud auth stores multiple named authentications in rpk.yaml for users who have multiple Cloud organizations or want to switch between SSO and client-credential auth. Subcommands:

• list (ls) — list all cloud auths (current is marked with *)
• use <NAME> — switch the active cloud auth
• delete <NAME> — remove a cloud auth from rpk.yaml
• token — print the current bearer token to stdout

rpk cloud auth create, rpk cloud auth rename-to, and rpk cloud auth edit are deprecated/hidden no-ops; use rpk cloud login instead.

Cluster Select & Profile Wiring

rpk cloud cluster select [NAME] is equivalent to rpk profile create --from-cloud=NAME. It calls the Redpanda Cloud control-plane API, retrieves the cluster's data-plane URL, and writes the broker/admin/registry endpoints into the active rpk profile (default profile name: rpk-cloud). After this, plain rpk topic list (no flags) talks to the Cloud cluster.

For Serverless clusters that offer both public and private networking, use --serverless-network public|private to avoid an interactive prompt.

Resource Groups

Resource groups are organizational containers (the billing/account boundary) in Redpanda Cloud. The rpk cloud resource-group command (aliases: namespace, ns) lets you manage them:

rpk cloud resource-group create prod-rg staging-rg   # create multiple
rpk cloud resource-group list
rpk cloud resource-group delete prod-rg --no-confirm  # --no-confirm skips the interactive prompt

BYOC Agent Provisioning

For BYOC clusters, Redpanda runs an agent in your cloud account that provisions the full cluster via Terraform. The rpk cloud byoc plugin wraps that Terraform invocation:

1. Create the cluster in the Redpanda Cloud UI → get a --redpanda-id
2. rpk cloud byoc install --redpanda-id <id> — download the pinned plugin version
3. rpk cloud byoc <aws|gcp|azure> apply --redpanda-id <id> — run Terraform to create the agent
4. rpk cloud byoc <aws|gcp|azure> destroy --redpanda-id <id> — tear it down
5. rpk cloud byoc validate — validate credentials/prerequisites (uses latest plugin)

The plugin version is pinned to what the control plane specifies for your cluster. Set RPK_CLOUD_SKIP_VERSION_CHECK=1 to skip the version enforcement (development use only).

MCP Server for AI Agents

rpk cloud mcp runs an MCP (Model Context Protocol) server that exposes Redpanda Cloud management tools to AI assistants such as Claude Desktop and Claude Code.

Three subcommands:

The stdio server exposes tools across the full Redpanda Cloud API surface:

• Control Plane: clusters, serverless clusters, networks, resource groups, regions, IAM (roles, role bindings, service accounts, users)
• Data Plane (per cluster): topics, ACLs, users, secrets, pipelines, quotas, transforms, AI agents, MCP servers, knowledge bases
• AI Gateway (the legacy aigateway/v1 control-plane surface): gateways, backend pools, models, model providers, guardrails, rate limits, spend limits, routing rules, OAuth2 clients and keys, SSO, access control, MCP tools, organizations, teams, roles, audit, analytics, and workspace management. The current Agentic Data Plane data-plane gateway (budgets instead of spend limits, no routing/rate-limit surface) is covered by /redpanda:adp.

By default, delete operations are disabled. Pass --allow-delete to enable them.

Quick install to Claude Code:

rpk cloud login --no-profile      # authenticate first
rpk cloud mcp install --client claude-code
# writes to ~/.claude.json

Quick install to Claude Desktop:

rpk cloud mcp install --client claude
# writes to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)

Enterprise Data Features on Cloud Clusters

Redpanda Cloud is a managed deployment of Redpanda Enterprise Edition — the license is supplied by the platform, so the enterprise differentiators are available without applying your own key. After rpk cloud cluster select wires a profile to the cluster, you drive these enterprise data-plane features with the normal rpk topic, rpk cluster config, and rpk cluster storage commands:

All of the above are Enterprise features (licensed by the Cloud platform). The MCP server (rpk cloud mcp) exposes the same CloudStorageService, TopicService, IAM RoleService/RoleBindingService, and data-plane SecurityService/ACLService RPCs to AI agents; delete RPCs require --allow-delete. See enterprise-data-features.md and rbac-and-iam.md.

Reference Directory

• login-and-auth.md: rpk cloud login flags, SSO vs client-credentials flow, rpk cloud auth subcommands (list/use/delete/token), RPK_CLOUD_CLIENT_ID/SECRET env vars, and token storage in rpk.yaml.
• clusters-and-resourcegroups.md: rpk cloud cluster select mechanics, how the profile is wired, --serverless-network flag, and full rpk cloud resource-group subcommand reference.
• byoc.md: BYOC plugin install/apply/destroy/validate lifecycle, --redpanda-id, provider subcommands (aws/gcp/azure), RPK_CLOUD_SKIP_VERSION_CHECK, and how the plugin downloads and pins to the cluster's Terraform version.
• enterprise-data-features.md: Enterprise data-plane features driven against a Cloud cluster — Mountable Topics (rpk cluster storage mount/unmount/list-mountable/list-mount/status-mount/cancel-mount, Cloud CloudStorageService, kafka-namespace restriction, migration IDs), Iceberg Topics (iceberg_enabled, redpanda.iceberg.mode/delete/partition.spec/target.lag.ms/invalid.record.action with values and defaults), Cloud Topics (cluster prerequisite cloud_topics_enabled=true, topic-level redpanda.cloud_topic.enabled, redpanda.storage.mode), and Tiered Storage topic-level retention (redpanda.remote.read/write/delete, initial.retention.local.target.*). All Enterprise features, licensed by the Cloud platform.
• rbac-and-iam.md: RBAC on Cloud — control-plane IAM (OrganizationService, PermissionService, RoleService, RoleBindingService, ServiceAccountService, UserService, UserInviteService) vs data-plane security (SecurityService cluster roles, ACLService, UserService; rpk security role/acl/user), how RBAC relates to rpk cloud login / auth token, and the MCP --allow-delete requirement for delete RPCs. Enterprise feature.