Skip to content

Redpanda Reference

Look-up facts for Redpanda (self-managed "Redpanda Streaming"): release and support matrix, license and Enterprise feature matrix, ports, key cluster and topic properties with their defaults, the rpk command map, sizing, tuning, cost drivers, security checklists, and CVE history. For how the pieces work see Explanation; for step-by-step tasks see How-to Guides.

Verification basis

Property names and defaults below were read from the Redpanda source tree (src/v/config/configuration.cc, src/v/features/enterprise_features.h, src/go/rpk/... on the dev branch, 2026-09-25). Defaults can change between feature releases; confirm against the cluster-properties page for your version or with rpk cluster config get <name>.

Release and Support Matrix

Redpanda ships a feature release roughly every four months (YY.1, YY.2, YY.3) with frequent patch releases. Each feature release is supported for about 12 months.

Series First GA patch (image push date) End of support (est.) Headline changes
26.2 v26.2.1 (2026-07-28) 2027-07-28 rpk sql for the Oxla SQL engine, stretch clusters with Operator dashboards, Operator Pipeline CRD for Redpanda Connect, Shadow Link role sync
26.1 v26.1.1 (2026-03-31) 2027-04-01 "R1" adaptable engine, Cloud Topics GA, Group-Based Access Control (GBAC), ranked rack preferences for Leader Pinning, Operator NodePool CRD
25.3 v25.3.1 (2025-11-19) 2026-11-19 Shadowing (cross-region DR), Cloud Topics beta, more Iceberg features, SQL Server CDC connector
25.2 v25.2.1 (2025-07-31) ~2026-07 (ended) Iceberg: JSON Schema support, AWS Glue / Unity Catalog / Snowflake Open Catalog integration
25.1 v25.1.1 (2025-04-07) ~2026-04 (ended) Iceberg Topics GA (announced 2025-04-07)
24.3 v24.3.1 (2024-12-03) ended Iceberg Topics beta; CPU core count can be decreased from 24.3
24.2 v24.2.1 (2024-08-08) ended --
24.1 2024 ended Data transforms (Wasm) GA, Rust SDK, multi-output transforms; rpk acl moved to rpk security acl

Latest patches seen on Docker Hub on 2026-09-25: v26.2.3 (2026-09-17, tagged latest), v26.1.18 (2026-09-24), v25.3.17 (2026-08-20).

Sources for this table

Dates are Docker Hub push dates for redpandadata/redpanda tags, cross-checked against the end-of-support column in the redpanda-operator README and the 25.1/25.3/26.1 announcements. Headline features come from the vendor announcements listed under Sources. The 24.2 row has no verified highlight list.

Product and Deployment Options

Offering Where it runs Notes
Redpanda Streaming, Community Edition Self-managed BSL 1.1 core features, free for production use except as a "Streaming or Queuing Service"
Redpanda Streaming, Enterprise Edition Self-managed Adds license-gated features (see next table); enterprise code is under the Redpanda Community License (RCL)
Redpanda Cloud BYOC Customer's AWS / GCP / Azure account, Redpanda-managed data plane User-controlled scaling and BYOVPC GA with 26.1
Redpanda Cloud Dedicated Redpanda-operated single-tenant cluster --
Redpanda Cloud Serverless Multi-tenant, pay-as-you-go GA on AWS (PrivateLink, 99.9% SLA); GCP beta announced with 25.3
Redpanda Connect Standalone binary, rpk connect, Cloud pipelines, Operator Pipeline CRD (26.2) Former Benthos; latest v4.111.0 (2026-09-24), weekly releases
Redpanda Console Web UI container v3.12.0 (Docker Hub, 2026-09-16)
Redpanda Agentic Data Plane (ADP) Redpanda Cloud Introduced October 2025; AI Gateway, MCP governance added 2026-02-18

License and Enterprise Feature Matrix

Component License
Redpanda core broker Redpanda BSL 1.1. Additional Use Grant: any use except offering a "Streaming or Queuing Service" to third parties. Each release converts to Apache-2.0 four years after its release date
Enterprise features in the broker Redpanda Community License (RCL) plus a valid license key
Redpanda Operator Helm chart Apache-2.0 (per chart annotation)
Redpanda Connect Community/Certified connectors Apache-2.0; Enterprise connectors under RCL with a license; the Benthos core engine stays MIT at redpanda-data/benthos

The broker treats a feature as "enterprise" when one of these settings is active. The list comes from enterprise_features.h:

Feature Trigger (config = value)
Audit logging audit_enabled = true
Tiered Storage, Remote Read Replicas, Cloud Topics (object storage) cloud_storage_enabled = true
Continuous Data Balancing partition_autobalancing_mode = continuous
Continuous intra-broker core balancing core_balancing_continuous = true
Kerberos sasl_mechanisms includes GSSAPI
OIDC for Kafka API sasl_mechanisms includes OAUTHBEARER
OIDC for HTTP APIs http_authentication includes OIDC
Server-side schema ID validation enable_schema_id_validation = redpanda or compat
Role-based access control any non-default role in the role store
Iceberg Topics iceberg_enabled = true
Shadowing (Shadow Links) enable_shadow_linking = true
Leader pinning a leaders preference set (default_leaders_preference or the topic-level override)
Topic-deletion protection delete_topic_enable = false
FIPS mode node fips_mode = enabled or permissive

Tiered Storage is not a Community feature

Anything that writes to object storage, including Tiered Storage and Cloud Topics, needs an Enterprise license in self-managed deployments. New clusters get a built-in 30-day trial license. rpk generate license can extend it once by another 30 days. Without a valid license the broker warns, and its "sanctioning" logic can fall back to non-enterprise values for gated settings; check the licensing docs for the exact behaviour of your version.

Free in Community Edition: the Kafka API, Raft replication, Schema Registry, HTTP Proxy (Pandaproxy), SASL/SCRAM and PLAIN, mTLS, ACLs, Wasm data transforms, rpk, and node-add partition balancing.

Ports

Port Listener Notes
9092 Kafka API Per-listener TLS and SASL
9644 Admin API (HTTP) rpk cluster admin, /public_metrics, /metrics
8081 Schema Registry Confluent-compatible REST API
8082 HTTP Proxy (Pandaproxy) Kafka REST-style HTTP API
33145 Internal RPC Broker-to-broker Raft traffic
9645 (Helm default) External Admin API Helm chart listeners.admin.external.default.port

Key Cluster Properties

Set these with rpk cluster config set or rpk cluster config edit. Cluster properties in redpanda.yaml are ignored after the cluster bootstraps; use .bootstrap.yaml for first boot.

Property Default Restart Purpose
log_segment_size 128 MiB no Default segment size when a topic does not set segment.bytes
kafka_request_max_bytes 100 MiB no Max size of a single Kafka API request
topic_partitions_per_shard 5000 no Topic creation fails if the partition-replica-to-shard ratio would exceed this
enable_idempotence true -- Idempotent producers
enable_transactions true -- Kafka transactions (EOS)
enable_sasl false no Require SASL on Kafka listeners (see also kafka_enable_authorization)
kafka_enable_authorization null no Explicit authorization toggle; null follows enable_sasl
sasl_mechanisms SCRAM no Accepts SCRAM, GSSAPI, OAUTHBEARER, PLAIN (PLAIN requires SCRAM enabled too)
superusers [] no Users that bypass ACLs
tls_min_version v1.2 yes Minimum negotiated TLS version (v1.0 to v1.3)
cloud_storage_enabled false yes Enables object storage for Tiered Storage, Remote Read Replicas and Cloud Topics
cloud_storage_enable_remote_write false no Default redpanda.remote.write for new topics
cloud_storage_enable_remote_read false no Default redpanda.remote.read for new topics
default_redpanda_storage_mode unset no Default storage mode for new topics: local, tiered, cloud (Cloud Topics) or unset (legacy remote.read/write)
cloud_storage_credentials_source config_file yes config_file, aws_instance_metadata, sts, gcp_instance_metadata, azure_vm_instance_metadata, azure_aks_oidc_federation
cloud_storage_max_connections 20 -- Max simultaneous object-storage connections per shard
cloud_storage_segment_max_upload_interval_sec 1h no Max time a segment stays local before upload
iceberg_enabled false yes Cluster switch for Iceberg Topics (each topic also needs redpanda.iceberg.mode)
iceberg_catalog_type object_storage yes object_storage (file-based catalog) or rest (REST catalog)
data_transforms_enabled false yes Enables Wasm transforms and reserves memory for them
partition_autobalancing_mode node_add no off, node_add, continuous (Enterprise)
core_balancing_continuous true in source (Enterprise-gated) no Move partitions between cores at runtime
audit_enabled false no Writes audit events to _redpanda.audit_log
enable_schema_id_validation none -- none, redpanda, compat
default_leaders_preference none no none or racks:<rack1>,<rack2> (Leader Pinning)

Key Topic Properties

Property Values / meaning
redpanda.remote.write / redpanda.remote.read Upload to and read back from Tiered Storage
redpanda.remote.delete Delete objects in the bucket when the topic is deleted
retention.local.target.ms / retention.local.target.bytes How much of a tiered topic to keep on local disk (cluster defaults retention_local_target_ms_default / _bytes_default)
redpanda.storage.mode Per-topic storage mode: local, tiered or cloud (name per current source; newer releases only; supersedes the legacy remote.* flags)
redpanda.iceberg.mode disabled, key_value, value_schema_id_prefix, value_schema_latest
redpanda.iceberg.partition.spec Iceberg partition spec for the table
redpanda.iceberg.delete Drop the Iceberg table when the topic is deleted
redpanda.iceberg.invalid.record.action What to do with records that fail translation (for example, send them to a dead-letter table)
redpanda.iceberg.target.lag.ms Target lag between the topic and table commits
redpanda.key.schema.id.validation / redpanda.value.schema.id.validation Server-side schema ID validation (Enterprise)
write.caching Acknowledge after in-memory replication instead of fsync (relaxed durability)
cleanup.policy, retention.ms, retention.bytes, segment.bytes, segment.ms Kafka-standard semantics

rpk Command Map

rpk is bundled with Redpanda. Top-level commands in current source: cluster, topic, group, security, registry, transform, connect, shadow, sql, cloud, container, debug, generate, benchmark, ai, k8s, profile, plugin, redpanda, version.

Area Commands
Cluster health and info rpk cluster health [--watch --exit-when-healthy], rpk cluster info, rpk cluster logdirs
Cluster config rpk cluster config get / set / edit / status
License rpk cluster license info, rpk cluster license set, rpk generate license (trial)
Maintenance rpk cluster maintenance enable <broker-id>, disable, status
Partitions rpk cluster partitions list / move / transfer-leadership / balancer-status / enable / disable, plus an unsafe-recovery subcommand
Security rpk security user create/list/delete, rpk security acl create/list/delete, rpk security role create/assign/list
Topics and groups rpk topic create/describe/list/produce/consume/delete/alter-config, rpk group list/describe/seek
Schema Registry rpk registry subject list, rpk registry schema create, rpk registry compatibility-level get/set, rpk registry mode
Data transforms rpk transform init/build/deploy/list/logs/pause/resume/delete
Redpanda Connect rpk connect install/upgrade/run/lint/mcp-server
Shadowing rpk shadow create/describe/status/list/update/failover/delete
Local dev rpk container start -n 3, rpk container purge
Node tuning rpk redpanda mode production, rpk redpanda tune all, rpk iotune
Diagnostics rpk debug bundle -o <file>, rpk cluster self-test start
Observability rpk generate grafana-dashboard --dashboard <name> (26.2 adds operations-stretch and load-factor)

Renamed commands

rpk acl ... became rpk security acl ... and rpk acl user ... became rpk security user ... in 24.1. rpk cluster offsets is deprecated in favour of rpk group describe.

Sizing

Resource Guidance
CPU Cores = number of Seastar shards. Helm chart comment: use 4 or more cores in production and give Redpanda whole cores. Increasing cores always works; decreasing is supported from 24.3.
Memory 2 GB per core minimum. 4 GB+ for hot working sets.
Disk NVMe local for data_directory. Size to retain hot tier (working set).
Object storage S3 / GCS / Azure ADLS for Tiered Storage or Cloud Topics. Size to full retention.
Network 10 GbE+ between brokers. Lower-latency NICs improve tail latency.
Partitions Up to topic_partitions_per_shard (default 5000) partition replicas per core.

Performance Tuning

Tunable Effect
kafka_request_max_bytes Maximum request size (default 100 MiB). Raise for large-batch producers.
kafka_batch_max_bytes Maximum (compressed) batch size accepted.
group_min_session_timeout_ms / group_max_session_timeout_ms Bounds for consumer-group session timeouts (max default 300s).
cloud_storage_segment_max_upload_interval_sec Max time before a local segment is uploaded (default 1h).
cloud_storage_max_connections Object-storage concurrency per shard (default 20). Raise for higher upload throughput.
log_segment_size Default 128 MiB. Smaller segments tier more often (more object-store ops). Larger segments keep more data locally.
log_compaction_interval_ms How often background compaction runs (default 10s).
write.caching (topic) Lower latency at the cost of fsync-on-ack durability.
tls_min_version Set to v1.3 to force TLS 1.3.

Cost Analysis

Cost Driver
Compute Per-core. Thread-per-core means scaling cores roughly scales throughput.
Local disk Only the hot tier needs to live on NVMe. Size to working set plus safety margin.
Object storage Cold tier (Tiered Storage) or primary store (Cloud Topics). Cost dominated by GB stored plus request counts.
Cross-AZ network The main cost of three-AZ replication. Cloud Topics avoid it for latency-tolerant topics (vendor claims more than 90% reduction).
Enterprise license Required for Tiered Storage, Cloud Topics, Iceberg, Shadowing, audit logs, continuous balancing, RBAC, OIDC.
Redpanda Cloud Per-cluster (Dedicated, BYOC) or consumption-based (Serverless).

Performance Characteristics

Workload Numbers (Redpanda blog claims, unverified; verify locally)
Single-broker NVMe sustained 1+ GB/s producer throughput
3-broker cluster R3 sustained 4-5 GB/s aggregate
p99 produce latency sub-10 ms typical, sub-1 ms achievable on well-tuned NVMe
Tiered Storage upload throughput Bound by object-store PUT rate and cloud_storage_max_connections (per-partition figures unverified)
Wasm transform overhead TBD: no verified per-record figure

Vendor benchmarks

Redpanda's published numbers are vendor-controlled, and Confluent has published counter-benchmarks. Run OpenMessaging Benchmark or rpk benchmark with your real workload before sizing.

Authentication Mechanisms

Mechanism Use case Edition
SASL/SCRAM-SHA-256, SCRAM-SHA-512 Salted-hash passwords. Default mechanism Community
SASL/PLAIN Simple username/password, only over TLS; requires SCRAM to be enabled too Community
mTLS (x509) Certificate-based; principal mapped from the cert Community
OAUTHBEARER (OIDC) Tokens from an OIDC IdP (Keycloak, Okta and others) Enterprise
GSSAPI (Kerberos) Active Directory / Kerberos environments Enterprise
HTTP Basic / OIDC Admin API, Schema Registry, HTTP Proxy (OIDC is Enterprise) Mixed

Compliance

Redpanda Cloud advertises SOC 2 Type II, ISO 27001, HIPAA (with a BAA), PCI-DSS and GDPR support. These are vendor claims, unverified as of 2026-09. Check the current list on the Redpanda trust / security page. Self-managed Redpanda inherits whatever compliance you build around it. A FIPS build (-fips image tags) and fips_mode exist for regulated environments (Enterprise).

CVE History (selected)

CVE Year Affected Summary
CVE-2023-50976 2023 Redpanda < 23.1.21 and 23.2.x < 23.2.18 Missing authorization checks in the Transactions API
-- (see vendor list) 2023 Redpanda < 22.3.12 (fixed 22.3.12, 22.2.10, 22.1.12) rpk import logged AWS access key and secret in cleartext

The canonical lists are the GitHub security advisories for redpanda-data/redpanda and the CVEdetails vendor page. Report vulnerabilities to [email protected].

Hardening Checklist

  • SASL enabled (SCRAM-SHA-512, or OIDC/Kerberos with Enterprise).
  • TLS on Kafka API, Admin API, Schema Registry, HTTP Proxy and internal RPC; require_client_auth where mTLS is wanted.
  • tls_min_version: v1.3 where all clients support it.
  • Object-storage bucket encrypted (bucket-default SSE-S3 or SSE-KMS with a CMK) and block-public-access set.
  • superusers limited to break-glass accounts, reviewed quarterly.
  • OIDC integrated with the corporate IdP for Console (Enterprise).
  • audit_enabled: true and the _redpanda.audit_log topic shipped to a SIEM (Enterprise).
  • Wasm transform deployment restricted to trusted operators.
  • delete_topic_enable: false on clusters where accidental deletes are unacceptable (Enterprise).
  • Watching Redpanda security advisories; patch releases applied within the support window.
  • Helm chart and Operator pinned to a version that matches the Redpanda feature release.

Sources