diff --git a/modules/get-started/pages/cloud-overview.adoc b/modules/get-started/pages/cloud-overview.adoc index 20486ff3..4c40f2bc 100644 --- a/modules/get-started/pages/cloud-overview.adoc +++ b/modules/get-started/pages/cloud-overview.adoc @@ -15,7 +15,7 @@ Redpanda offers three types of fully-managed cloud clusters: * <>: Single-tenant clusters hosted in Redpanda Cloud. This provides more control over your deployment. * <>: Clusters hosted in your private cloud. This provides more control over your deployment and offers full data sovereignty. + -NOTE: With standard BYOC clusters, Redpanda manages security policies and resources for your VPC or VNet, including subnetworks, IAM roles, and storage buckets/accounts. For the highest level of security, you can manage these resources yourself with a customer-managed BYOVPC cluster. +NOTE: With standard BYOC clusters, Redpanda manages security policies and resources for your VPC or VNet, including subnetworks, IAM roles, and storage buckets/accounts. A Bring Your Own Virtual Private Cloud (BYOVPC) cluster allows you to deploy the Redpanda glossterm:data plane[] into your existing VPC/VNet and take full control of managing the networking lifecycle. Compared to a standard BYOC setup, this option provides more security. === Serverless diff --git a/modules/get-started/pages/cluster-types/byoc/aws/vpc-byo-aws.adoc b/modules/get-started/pages/cluster-types/byoc/aws/vpc-byo-aws.adoc index 1716fb64..d93eb7c5 100644 --- a/modules/get-started/pages/cluster-types/byoc/aws/vpc-byo-aws.adoc +++ b/modules/get-started/pages/cluster-types/byoc/aws/vpc-byo-aws.adoc @@ -6,7 +6,7 @@ include::shared:partial$feature-flag.adoc[] -With a standard BYOC cluster, Redpanda manages the VPC lifecycle. For additional security, you can deploy the Redpanda glossterm:data plane[] into your existing shared VPC and manage the VPC lifecycle yourself. +This topic explains how to create a Bring Your Own Virtual Private Cloud (BYOVPC) cluster. This setup allows you to deploy the Redpanda glossterm:data plane[] into your existing VPC and take full control of managing the networking lifecycle. Compared to a standard Bring Your Own Cluster (BYOC) setup, where Redpanda manages the networking lifecycle for you, this option provides more security. When you create a BYOCVPC cluster, you specify your VPC and service account. The Redpanda Cloud agent doesn't create any new resources or alter any settings in your account. With BYOVPC: @@ -14,7 +14,7 @@ When you create a BYOCVPC cluster, you specify your VPC and service account. The * You maintain more control over your account, because Redpanda requires fewer permissions than standard BYOC clusters. * You control your security resources and policies, including subnets, service accounts, IAM roles, firewall rules, and storage buckets. -The https://github.com/redpanda-data/cloud-examples/tree/main/customer-managed/aws[Redpanda repository^] contains the code that deploys the resources you must create for a BYOVPC cluster. You create these resources in advance and provide them to Redpanda during cluster creation. The code is provided in https://developer.hashicorp.com/terraform[Terraform^]. There may be resources in the repository that already exist in your environment that you don't want to create (for example, the VPC). Variables are provided for this purpose. +The https://github.com/redpanda-data/cloud-examples/tree/main/customer-managed/aws[Redpanda Cloud Examples repository^] contains https://developer.hashicorp.com/terraform[Terraform^] code that deploys the resources required for a BYOVPC cluster on AWS. You'll need to create these resources in advance and give them to Redpanda during cluster creation. Variables are provided in the code so you can exclude resources that already exist in your environment, such as the VPC. == Prerequisites @@ -45,7 +45,7 @@ The https://github.com/redpanda-data/cloud-examples/blob/main/customer-managed/a == Configure Terraform -NOTE: You may want to configure https://developer.hashicorp.com/terraform/language/state/remote[remote state^] for this Terraform. For simplicity, these instructions assume local state. +NOTE: For simplicity, these instructions assume that Terraform is configured to use local state. You may want to configure https://developer.hashicorp.com/terraform/language/state/remote[remote state^]. Define a JSON file called `byovnet.auto.tfvars.json` inside the Terraform directory that contains information about the VPC. Optionally, you can enable PrivateLink. For example: @@ -105,7 +105,7 @@ export REDPANDA_CLIENT_SECRET= == Authenticate with Redpanda Cloud -Get a Bearer token from Redpanda's authentication endpoint using the Redpanda credentials: +Get a glossterm:bearer token[] from the Cloud API authentication endpoint using your Redpanda credentials: ```bash export BEARER_TOKEN=$(curl --request POST \ @@ -281,7 +281,7 @@ Finished apply {"provisioner": "redpanda-agent"} The Redpanda cluster is deploying. This can take up to 45 minutes. View status at https://cloud.redpanda.com/clusters/${REDPANDA_ID}/overview. ``` -The agent VM now is running and handles the remaining provisioning steps. This can take up to 45 minutes. When provisioning completes, the cluster status updates to `Running`. If the cluster remains in `Creating` status after 45 minutes, contact https://support.redpanda.com/hc/en-us/requests/new[Redpanda support^]. +The Redpanda Cloud agent now is running and handles the remaining steps. This can take up to 45 minutes. When provisioning completes, the cluster status updates to `Running`. If the cluster remains in `Creating` status after 45 minutes, contact https://support.redpanda.com/hc/en-us/requests/new[Redpanda Support^]. === Validation checks @@ -324,7 +324,7 @@ curl -X GET "https://api.redpanda.com/v1beta2/clusters/${REDPANDA_ID}" \ == Delete cluster -To delete the Redpanda cluster with the Cloud API, run: +To delete the cluster, first send a DELETE request to the Cloud API, and retrieve the `resource_id` of the DELETE operation. Then run the `rpk` command to destroy the cluster identified by the `resource_id`. ```bash export REDPANDA_ID=$(curl -X DELETE "https://api.redpanda.com/v1beta2/clusters/${REDPANDA_ID}" \ diff --git a/modules/get-started/pages/cluster-types/byoc/azure/create-byoc-cluster-azure.adoc b/modules/get-started/pages/cluster-types/byoc/azure/create-byoc-cluster-azure.adoc index 9ecc30aa..b0474cc1 100644 --- a/modules/get-started/pages/cluster-types/byoc/azure/create-byoc-cluster-azure.adoc +++ b/modules/get-started/pages/cluster-types/byoc/azure/create-byoc-cluster-azure.adoc @@ -4,7 +4,7 @@ include::shared:partial$feature-flag.adoc[] -NOTE: With standard BYOC clusters, Redpanda manages security policies and resources for your virtual network (VNet), including subnetworks, managed identities, IAM roles, security groups, and storage accounts. For the most security, you can manage these resources yourself with a xref:get-started:cluster-types/byoc/azure/vnet-azure.adoc[customer-managed VNet on Azure]. +NOTE: With standard BYOC clusters, Redpanda manages security policies and resources for your virtual network (VNet), including subnetworks, managed identities, IAM roles, security groups, and storage accounts. For the most security, you can manage these resources yourself with a xref:get-started:cluster-types/byoc/azure/vnet-azure.adoc[BYOVPC cluster on Azure]. == Prerequisites diff --git a/modules/get-started/pages/cluster-types/byoc/azure/vnet-azure.adoc b/modules/get-started/pages/cluster-types/byoc/azure/vnet-azure.adoc index bee31eb8..26ae51f3 100644 --- a/modules/get-started/pages/cluster-types/byoc/azure/vnet-azure.adoc +++ b/modules/get-started/pages/cluster-types/byoc/azure/vnet-azure.adoc @@ -1,15 +1,17 @@ -= Create a Customer-Managed VNet on Azure += Create a BYOVPC Cluster on Azure :description: Connect Redpanda Cloud to your existing VNet for additional security. include::shared:partial$feature-flag.adoc[] -With a standard BYOC cluster, Redpanda manages the networking lifecycle. For additional security, you can deploy the Redpanda glossterm:data plane[] into your existing virtual network (VNet) and manage the lifecycle yourself. When you create a customer-managed VNet cluster, you specify your VNet and managed identities. The Redpanda Cloud agent doesn't create any new resources or alter any settings in your account. With a *customer-managed* VNet: +This topic explains how to create a Bring Your Own Virtual Private Cloud (BYOVPC) cluster. This setup allows you to deploy the Redpanda glossterm:data plane[] into your existing virtual network (VNet) and take full control of managing the networking lifecycle. Compared to a standard Bring Your Own Cluster (BYOC) setup, where Redpanda manages the networking lifecycle for you, this option provides more security. + +When you create a BYOVPC cluster, you specify your VNet and managed identities. The Redpanda Cloud agent doesn't create any new resources or alter any settings in your account. With a customer-managed VNet: * You provide your own VNet in your Azure account. * You maintain more control over your account, because Redpanda requires fewer permissions than standard BYOC clusters. * You control your security resources and policies, including subnets, user-assigned identities, IAM roles and assignments, security groups, storage accounts, and key vaults. -The https://github.com/redpanda-data/cloud-examples/tree/main/customer-managed/azure[Redpanda repository^] contains the code that deploys the resources you must create for a customer-managed Azure cluster. You create these resources in advance and provide them to Redpanda during cluster creation. The code is provided in https://developer.hashicorp.com/terraform[Terraform^]. There may be resources in the repository that already exist in your environment that you don't want to create (for example, the VNet). Variables are provided for this purpose. +The https://github.com/redpanda-data/cloud-examples/tree/main/customer-managed/azure/README.md[Redpanda Cloud Examples repository^] contains https://developer.hashicorp.com/terraform[Terraform^] code that deploys the resources required for a BYOVPC cluster on Azure. You'll need to create these resources in advance and give them to Redpanda during cluster creation. Variables are provided in the code so you can exclude resources that already exist in your environment, such as the VNet. See the code for the complete list of resources required to create and deploy Redpanda cluster. Customer-managed resources can be broken down into the following groups: @@ -26,81 +28,180 @@ See the code for the complete list of resources required to create and deploy Re * Knowledge of your internal VNet and subnet configuration * Permission to call the xref:manage:api/cloud-api-overview.adoc[Redpanda Cloud API] * Permission to create, modify, and delete the resources described by Terraform -* https://developer.hashicorp.com/terraform/install[Terraform version 1.8.5 or later^] +* https://developer.hashicorp.com/terraform/install[Terraform^] version 1.8.5 or later == Limitations -* You cannot move existing clusters to a customer-managed VNet. -* You cannot change to a different VNet after creating a cluster with a customer-managed VNet. +* Existing clusters cannot be moved to a BYOVPC cluster. +* After creating a BYOVPC cluster, you cannot change to a different VNet. -== Deploy customer-managed resources With Terraform +== Set environment variables -You may want to configure https://developer.hashicorp.com/terraform/language/state/remote[remote state^] for this Terraform. For simplicity, these instructions assume local state. +Set environment variables for the resource group, VNet name, and Azure region. For example: -=== Configure the variables +```bash +export AZURE_RESOURCE_GROUP_NAME=sample-redpanda-rg +export AZURE_VNET_NAME="sample-vnet" +export AZURE_REGION=eastus +``` -Create a JSON file called `byovnet.auto.tfvars.json` inside the Terraform directory to configure variables for your specific needs: +== Create Azure resource group and VNet +. Create a resource group to contain all resources, and then create a VNet with your address and subnet prefixes. ++ +The following example uses the environment variables to create the `sample-redpanda-rg` resource group and the `sample-vnet` virtual network with an address space of `10.0.0.0/16` and a subnet named `default` with a smaller range of `10.0.0.0/24`. ++ +```bash +az group create --name ${AZURE_RESOURCE_GROUP_NAME} --location ${AZURE_REGION} + +az network vnet create \ + --name ${AZURE_VNET_NAME} \ + --resource-group $AZURE_RESOURCE_GROUP_NAME \ + --location ${AZURE_REGION} \ + --address-prefix 10.0.0.0/16 \ + --subnet-name default \ + --subnet-prefixes 10.0.0.0/24 ``` + +. Set additional environment variables for Azure resources. For example: ++ +```bash +export AZURE_SUBSCRIPTION_ID= +export AZURE_TENANT_ID= +export AZURE_ZONES=["eastus-az2"] +export AZURE_RESOURCE_PREFIX=sample- +``` + +== Configure Terraform + +NOTE: For simplicity, these instructions assume that Terraform is configured to use local state. You may want to configure https://developer.hashicorp.com/terraform/language/state/remote[remote state^]. + +Create a JSON file called `byovnet.auto.tfvars.json` inside the Terraform directory to configure variables for your specific needs: + +.Show script +[%collapsible] +==== +```bash +cat > byovnet.auto.tfvars.json < redpanda-network.json < redpanda-cluster.json <" \ -H "accept: application/json"\ -H "content-type: application/json" \ - -H "authorization: Bearer $YOUR_TOKEN" + -H "authorization: Bearer ${BEARER_TOKEN}" ``` Example retrieving cluster: @@ -282,5 +435,22 @@ Example retrieving cluster: curl -X GET "https://api.redpanda.com/v1beta2/clusters/" \ -H "accept: application/json"\ -H "content-type: application/json" \ - -H "authorization: Bearer $YOUR_TOKEN" + -H "authorization: Bearer ${BEARER_TOKEN}" +``` + +== Delete cluster + +To delete the cluster, first send a DELETE request to the Cloud API, and retrieve the `resource_id` of the DELETE operation. Then run the `rpk` command to destroy the cluster identified by the `resource_id`. + +```bash +export REDPANDA_ID=$(curl -X DELETE "https://api.redpanda.com/v1beta2/clusters/${REDPANDA_ID}" \ + -H "accept: application/json"\ + -H "content-type: application/json" \ + -H "authorization: Bearer ${BEARER_TOKEN}" | jq -r '.operation.resource_id') +``` + +After that completes, run: + +```bash +rpk cloud byoc azure destroy --redpanda-id ${REDPANDA_ID} ``` \ No newline at end of file diff --git a/modules/get-started/pages/cluster-types/byoc/gcp/create-byoc-cluster-gcp.adoc b/modules/get-started/pages/cluster-types/byoc/gcp/create-byoc-cluster-gcp.adoc index 01541eff..63a4f13c 100644 --- a/modules/get-started/pages/cluster-types/byoc/gcp/create-byoc-cluster-gcp.adoc +++ b/modules/get-started/pages/cluster-types/byoc/gcp/create-byoc-cluster-gcp.adoc @@ -4,7 +4,7 @@ To create a Redpanda cluster in your virtual private cloud (VPC), follow the instructions in the Redpanda Cloud UI. The UI contains the parameters necessary to successfully run `rpk cloud byoc apply`. -NOTE: With standard BYOC clusters, Redpanda manages security policies and resources for your VPC, including subnetworks, service accounts, IAM roles, firewall rules, and storage buckets. For the highest level of security, you can manage these resources yourself with a xref:get-started:cluster-types/byoc/gcp/vpc-byo-gcp.adoc[customer-managed VPC on GCP]. +NOTE: With standard BYOC clusters, Redpanda manages security policies and resources for your VPC, including subnetworks, service accounts, IAM roles, firewall rules, and storage buckets. For the highest level of security, you can manage these resources yourself with a xref:get-started:cluster-types/byoc/gcp/vpc-byo-gcp.adoc[BYOVPC cluster on GCP]. See also: xref:get-started:cloud-overview.adoc#redpanda-cloud-architecture[Redpanda Cloud architecture]. diff --git a/modules/get-started/pages/cluster-types/byoc/gcp/vpc-byo-gcp.adoc b/modules/get-started/pages/cluster-types/byoc/gcp/vpc-byo-gcp.adoc index c9be356b..f622970e 100644 --- a/modules/get-started/pages/cluster-types/byoc/gcp/vpc-byo-gcp.adoc +++ b/modules/get-started/pages/cluster-types/byoc/gcp/vpc-byo-gcp.adoc @@ -1,10 +1,12 @@ -= Create a Customer-Managed VPC on GCP += Create a BYOVPC Cluster on GCP :description: Connect Redpanda Cloud to your existing VPC for additional security. :page-aliases: deploy:deployment-option/cloud/vpc-byo-gcp.adoc, get-started:cluster-types/byoc/vpc-byo-gcp.adoc include::shared:partial$feature-flag.adoc[] -With a standard BYOC cluster, Redpanda manages the VPC lifecycle. For additional security, you can deploy the Redpanda data plane into your existing shared VPC and manage the VPC lifecycle yourself. When you create a BYOC cluster, you specify your VPC and service account. The Redpanda Cloud agent does not create a VPC or network resources. With a *customer-managed* VPC: +This topic explains how to create a Bring Your Own Virtual Private Cloud (BYOVPC) cluster. This setup allows you to deploy the Redpanda glossterm:data plane[] into your existing VPC and take full control of managing the networking lifecycle. Compared to a standard Bring Your Own Cluster (BYOC) setup, where Redpanda manages the networking lifecycle for you, this option provides more security. + +When you create a BYOCVPC cluster, you specify your VPC and service account. The Redpanda Cloud agent doesn't create any new resources or alter any settings in your account. With BYOVPC: * You provide your own VPC in your Google Cloud account. * You maintain more control of your Google Cloud account, because Redpanda requires fewer permissions than standard BYOC clusters. @@ -18,8 +20,8 @@ With a standard BYOC cluster, Redpanda manages the VPC lifecycle. For additional == Limitations -* Existing clusters cannot be moved to a customer-managed VPC. -* After creating a cluster with a customer-managed VPC, you cannot change to a different VPC. +* Existing clusters cannot be moved to a BYOVPC cluster. +* After creating a BYOVPC cluster, you cannot change to a different VPC. == Configure your VPC @@ -152,7 +154,7 @@ gcloud storage buckets update gs:// --versioning . Create service accounts with necessary permissions and roles. -* Redpanda agent service account +* Redpanda Cloud agent service account + .Show commands [%collapsible] @@ -469,13 +471,13 @@ gcloud iam service-accounts add-iam-policy-binding @