DOC-1743 Document feature Private Networking Phase 1 #453
Conversation
✅ Deploy Preview for rp-cloud ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the
📝 WalkthroughWalkthroughThis PR adds documentation for Serverless private networking support on AWS. It introduces new navigation entries under the Serverless subsection, creates documentation pages for configuring AWS PrivateLink with the Cloud API, updates the cluster overview to indicate Serverless now supports private networking, and adds a January 2026 changelog entry. Additionally, it updates references from "Networks page" to "Networking page" across multiple networking documentation files and replaces the "Metrics endpoints" feature with "Ability to export metrics to third-party monitoring systems" in the Serverless cluster documentation. Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
micheleRP
force-pushed
the
DOC-1743-Document-feature-Private-Networking-Phase-1
branch
from
a404c31 to
7bb176b
Compare
micheleRP
force-pushed
the
DOC-1743-Document-feature-Private-Networking-Phase-1
branch
from
4cedd95 to
8875289
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In `@modules/get-started/pages/cluster-types/serverless.adoc`:
- Line 96: The docs contradict each other about metrics export: update
modules/get-started/pages/cluster-types/serverless.adoc by removing or moving
the bullet "Ability to export metrics to a third-party monitoring system" out of
the "Unsupported features" list and instead include it under the
supported/features or capabilities section (or add a note that Serverless now
supports exporting metrics) so it aligns with the announcement in
modules/get-started/pages/whats-new-cloud.adoc; ensure the wording matches the
What's New statement about the January 2026 GA release and keep the exact phrase
so cross-references remain clear.
In `@modules/networking/pages/serverless/aws/privatelink.adoc`:
- Around line 1-2: The file privatelink.adoc currently contains only a title and
description with no setup instructions; add full AWS PrivateLink documentation
or convert it to a placeholder index page. Either (A) add sections similar to
transit-gateway.adoc/vpc-peering-aws.adoc: prerequisites, required IAM
permissions, Cloud API resource names and examples, step-by-step configuration
commands, endpoint service and VPC endpoint setup, testing/verification steps,
and usage notes/FAQ; or (B) replace the body with a clear placeholder section
indicating the page is intentionally empty and linking to related Serverless AWS
pages (e.g., transit-gateway.adoc, vpc-peering-aws.adoc) and a TODO to add
detailed PrivateLink configuration later. Include explicit examples and resource
identifiers in the content you add (API call examples, CLI snippets, and sample
YAML/JSON), so reviewers can validate correctness.
In `@modules/ROOT/nav.adoc`:
- Around line 29-31: Update the incorrect navigation xref in
modules/ROOT/nav.adoc: replace the reference
xref:networking:byoc/aws/index.adoc[AWS] with
xref:networking:serverless/aws/index.adoc[AWS] so the "Serverless" section
points to the correct serverless/aws index; ensure the third-level entry that
currently reads xref:networking:serverless/aws/privatelink.adoc[...] remains
unchanged.
🧹 Nitpick comments (1)
modules/networking/pages/serverless/aws/index.adoc (1)
1-3: Consider adding introductory content for the index page.While index pages with
page-layout: indexcan be minimal, adding a brief introduction would help users understand what private networking options are available for Serverless clusters on AWS and provide context before they navigate to child pages.For example, a paragraph explaining AWS PrivateLink support, its benefits, and linking to configuration steps would improve the user experience.
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (10)
modules/ROOT/nav.adocmodules/get-started/pages/cloud-overview.adocmodules/get-started/pages/cluster-types/serverless.adocmodules/get-started/pages/whats-new-cloud.adocmodules/networking/pages/dedicated/aws/vpc-peering.adocmodules/networking/pages/dedicated/gcp/vpc-peering-gcp.adocmodules/networking/pages/serverless/aws/index.adocmodules/networking/pages/serverless/aws/privatelink.adocmodules/networking/pages/serverless/index.adocmodules/networking/partials/vnet-peering.adoc
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: micheleRP
Repo: redpanda-data/cloud-docs PR: 377
File: modules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc:35-71
Timestamp: 2025-08-07T16:36:45.111Z
Learning: In Redpanda Cloud documentation, NAT subnet and firewall rule creation commands for GCP Private Service Connect are producer-side infrastructure steps that only BYOC (Bring Your Own Cloud) customers need to perform, since they manage their own VPC. Dedicated cluster customers don't need these steps because Redpanda manages the infrastructure for them. The ifdef::env-byoc[] guard correctly hides these commands from Dedicated users.
📚 Learning: 2025-08-07T16:36:45.111Z
Learnt from: micheleRP
Repo: redpanda-data/cloud-docs PR: 377
File: modules/networking/pages/dedicated/gcp/configure-psc-in-ui.adoc:35-71
Timestamp: 2025-08-07T16:36:45.111Z
Learning: In Redpanda Cloud documentation, NAT subnet and firewall rule creation commands for GCP Private Service Connect are producer-side infrastructure steps that only BYOC (Bring Your Own Cloud) customers need to perform, since they manage their own VPC. Dedicated cluster customers don't need these steps because Redpanda manages the infrastructure for them. The ifdef::env-byoc[] guard correctly hides these commands from Dedicated users.
Applied to files:
modules/networking/pages/dedicated/gcp/vpc-peering-gcp.adocmodules/get-started/pages/whats-new-cloud.adocmodules/networking/partials/vnet-peering.adocmodules/get-started/pages/cloud-overview.adocmodules/networking/pages/dedicated/aws/vpc-peering.adoc
📚 Learning: 2025-07-21T21:53:37.731Z
Learnt from: micheleRP
Repo: redpanda-data/cloud-docs PR: 361
File: modules/networking/pages/cloud-security-network.adoc:193-196
Timestamp: 2025-07-21T21:53:37.731Z
Learning: In Redpanda Cloud documentation, field names and labels should match exactly what appears in the UI, even if the terminology might seem technically inconsistent. For example, the NAT gateway IP address field is labeled "Internet gateway" in the UI, so documentation should use "Internet gateway" to help users locate the correct field.
Applied to files:
modules/networking/pages/dedicated/gcp/vpc-peering-gcp.adoc
📚 Learning: 2025-07-21T21:52:17.061Z
Learnt from: micheleRP
Repo: redpanda-data/cloud-docs PR: 361
File: modules/networking/pages/cloud-security-network.adoc:176-179
Timestamp: 2025-07-21T21:52:17.061Z
Learning: In Redpanda Cloud documentation, BYOVPC and BYOVNet are different product names for different cloud providers: BYOVPC is used for AWS and GCP, while BYOVNet is used for Azure. When documentation sections cover multiple cloud providers, the combined notation "BYOVPC/BYOVNet" is correct and should not be changed to use only one term.
Applied to files:
modules/networking/pages/dedicated/gcp/vpc-peering-gcp.adocmodules/ROOT/nav.adoc
📚 Learning: 2025-04-25T01:41:57.162Z
Learnt from: micheleRP
Repo: redpanda-data/cloud-docs PR: 267
File: modules/manage/pages/maintenance.adoc:91-92
Timestamp: 2025-04-25T01:41:57.162Z
Learning: The notification timeline for Redpanda Cloud deprecations has been deliberately removed from the documentation, even though the PR summary mentioned a 180-day advance notice period.
Applied to files:
modules/get-started/pages/whats-new-cloud.adoc
📚 Learning: 2025-04-25T01:42:09.318Z
Learnt from: micheleRP
Repo: redpanda-data/cloud-docs PR: 267
File: modules/manage/pages/maintenance.adoc:63-64
Timestamp: 2025-04-25T01:42:09.318Z
Learning: The timeline for major upgrade notifications (180 days in advance) was intentionally removed from the Redpanda Cloud maintenance documentation, even though it was mentioned in the PR objectives.
Applied to files:
modules/get-started/pages/whats-new-cloud.adoc
🔇 Additional comments (9)
modules/get-started/pages/cloud-overview.adoc (1)
62-62: LGTM! Private networking correctly enabled for Serverless.The update accurately reflects that Serverless clusters now support private networking via AWS PrivateLink, which aligns with the PR objectives for documenting Private Networking Phase 1.
modules/networking/pages/dedicated/gcp/vpc-peering-gcp.adoc (1)
24-24: LGTM! UI reference updated for consistency.The navigation reference correctly reflects the current UI terminology by changing "Networks page" to "Networking page."
modules/networking/partials/vnet-peering.adoc (1)
30-30: LGTM! UI reference updated for consistency.The navigation reference correctly uses "Networking page" to match the current UI and align with similar updates across other networking documentation files.
modules/networking/pages/dedicated/aws/vpc-peering.adoc (2)
25-25: LGTM! Terminology update aligns with current UI.The change from "Networks page" to "Networking page" correctly reflects the current UI terminology.
40-46: LGTM! Helpful clarifications added.The additions provide clearer guidance on the peering connection acceptance process, including the expected status and route table configuration steps.
modules/networking/pages/serverless/index.adoc (1)
1-3: LGTM! Clean index page for the new Serverless networking section.The index page follows standard documentation conventions and appropriately introduces the AWS PrivateLink configuration topic.
modules/get-started/pages/cluster-types/serverless.adoc (2)
53-56: LGTM! Clear documentation of AWS PrivateLink support.The added text effectively explains private networking capabilities for Serverless clusters on AWS, including the billing implications and management options.
57-57: LGTM! Helpful step addition.The explicit "Click Create cluster" step improves the clarity of the cluster creation workflow.
modules/get-started/pages/whats-new-cloud.adoc (1)
9-13: Verify consistency with Serverless feature documentation.The announcement states that the GA release includes "the ability to view and export metrics from Serverless clusters to third-party monitoring systems", but modules/get-started/pages/cluster-types/serverless.adoc (line 96) still lists this as an unsupported feature. Please ensure both documents accurately reflect the current feature availability.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
|
|
||
| After you have enabled PrivateLink for your cluster, your connection URLs are available in the *How to Connect* section of the cluster overview in the Redpanda Cloud Console. | ||
|
|
||
| include::networking:partial$private-links-access-rp-services-through-vpc.adoc[] |
There was a problem hiding this comment.
Same comments on this page as I made in the UI doc
# Conflicts: # modules/get-started/pages/cluster-types/serverless.adoc
Linux build servers are case-sensitive, so the xref paths in nav.adoc need to match the actual file paths exactly. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
# Conflicts: # modules/get-started/pages/whats-new-cloud.adoc
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
…rverless.adoc Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Co-authored-by: Sarah Haskins <sarahhaskins@gmail.com>
Add PrivateLink resource creation API example, improve JSON formatting, add rpk cluster select documentation, and clean up whitespace. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
| Do not configure forwarding rules to target the VPC's Amazon-provided DNS resolver (VPC base CIDR + 2). Rules must target the IP addresses of Route 53 Resolver endpoints. | ||
| ==== | ||
|
|
||
| == Enable endpoint service for existing clusters |
There was a problem hiding this comment.
These steps require the PL to already exist. Should we add something for actually creating the PL via the UI?
There was a problem hiding this comment.
added an intro line for this!
…-Phase-1 Resolved merge conflict in whats-new-cloud.adoc by keeping both updates: - Serverless on AWS GA announcement - Redpanda Connect OTLP component updates Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
| Serverless clusters are not guaranteed to be pinned to a particular availability zone within the selected region. | ||
| Clusters on AWS can enable private access between their VPC and Redpanda, so data does not traverse the public internet. Private connectivity is implemented using AWS PrivateLink for secure ingress traffic. | ||
| + | ||
| ** A Serverless cluster can have both public and private access enabled. |
There was a problem hiding this comment.
I see that you can check both, but nothing in the UI or doc here explains to me how it works when I've selected both. Does one take precedence over the other? I see that when I select Private access, I then must select either an existing private link or create a new private link. So, after I've done that, how does have both private and public access get reconciled?
| + | ||
| NOTE: After private access is disabled, attempts to reach the private endpoints will fail. However, the PrivateLink endpoint in your AWS account and the PrivateLink resource in Redpanda Cloud both remain provisioned and continue to incur charges until you explicitly delete them. | ||
|
|
||
| . Click **Create cluster**. |
There was a problem hiding this comment.
I must be looking at the wrong instance (It's just Create in https://cloud.redpanda.com/clusters/create/serverless)--what is the correct env to test this in? Cloud UI (main)? Prod? Dev?
There was a problem hiding this comment.
Checked--it's not main or preprod, and I could not successfully log into dev.
There was a problem hiding this comment.
@Feediver1 it's prod, and I'll edit to Create. It must have changed, so I'll also update for BYOC & Dedicated
| . Click **Create cluster**. | ||
|
|
||
| . Add team members and grant them access with glossterm:ACL[,access control lists (ACLs)] on the *Security* page. | ||
| . To start working with your cluster, go to the *Topics* page to create a topic. Under the *Actions* dropdown, you can produce messages to it. Add team members and grant them access with ACLs on the *Security* page. |
There was a problem hiding this comment.
Not seeing an Actions dropdown anywhere.
There was a problem hiding this comment.
This is the Topics page for a Serverless cluster (existing). There is no Actions pulldown.
| Or, Redpanda can generate a sample application to interact with your cluster. Run xref:reference:rpk/rpk-generate/rpk-generate-app.adoc[`rpk generate app`], and select Go as the language. Follow the commands in the terminal to run the application, create a demo topic, produce to the topic, and consume the data back. | ||
|
|
||
| Follow the steps in the UI to use `rpk` to interact with your cluster from the command line. Here are some helpful commands: | ||
| Follow the steps in the Console to use `rpk` to interact with your cluster from the command line. Here are some helpful commands: |
There was a problem hiding this comment.
So are we now calling the Cloud UI "Console"? Find that confusing because we already have Console in Cloud. Not seeing Console anywhere, so feeling confused given that I cannot find any of these updates in all the Cloud envs I'm trying.
There was a problem hiding this comment.
Yes, we're calling the UI Console now.
|
|
||
| * Redpanda Serverless supports the Kafka API. Serverless clusters work with all Kafka clients. See xref:develop:kafka-clients.adoc[]. | ||
| * Serverless clusters support all major Apache Kafka messages for managing topics, producing/consuming data (including transactions), managing groups, managing offsets, and managing ACLs. (User management is available in the Redpanda Cloud UI or with `rpk security acl`.) | ||
| * Serverless clusters support all major Apache Kafka messages for managing topics, producing/consuming data (including transactions), managing groups, managing offsets, and managing ACLs. (User management is available in the Redpanda Cloud Console or with `rpk security acl`.) |
There was a problem hiding this comment.
Please provide a link to the Redpanda Cloud Console here.
|
|
||
| PrivateLink changes how DNS resolution works for your cluster. When you query cluster hostnames outside the VPC that contains your PrivateLink endpoint, DNS may return private IP addresses that aren't reachable from your location. | ||
|
|
||
| To resolve cluster hostnames from other VPCs or on-premise networks, set up DNS forwarding using Route 53 Resolver: |
There was a problem hiding this comment.
Might it help users to link to https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html?
| . In each other VPC that must resolve the cluster domain, create a Resolver outbound endpoint and a forwarding rule for `<cluster_domain>` that targets the inbound endpoint IPs from the previous step. Associate the rule to those VPCs. | ||
| + | ||
| The cluster domain is the suffix after the seed hostname. For example, if your bootstrap server URL is: `cki01qgth38kk81ard3g.any.us-east-1.aw.priv.prd.cloud.redpanda.com:9092`, then `cluster_domain` is: `cki01qgth38kk81ard3g.any.us-east-1.aw.priv.prd.cloud.redpanda.com`. | ||
| . For on-premises DNS, create a conditional forwarder for `<cluster_domain>` that forwards to the inbound endpoint IPs from the earlier step (over VPN/Direct Connect). |
There was a problem hiding this comment.
| . For on-premises DNS, create a conditional forwarder for `<cluster_domain>` that forwards to the inbound endpoint IPs from the earlier step (over VPN/Direct Connect). | |
| . For on-premise DNS, create a conditional forwarder for `<cluster_domain>` that forwards to the inbound endpoint IPs from the earlier step (over VPN/Direct Connect). |
Co-authored-by: Joyce Fee <102751339+Feediver1@users.noreply.github.com>
Co-authored-by: Joyce Fee <102751339+Feediver1@users.noreply.github.com>
Co-authored-by: Joyce Fee <102751339+Feediver1@users.noreply.github.com>
Co-authored-by: Joyce Fee <102751339+Feediver1@users.noreply.github.com>
Co-authored-by: Joyce Fee <102751339+Feediver1@users.noreply.github.com>
Description
This pull request introduces several important updates to the Redpanda Cloud documentation, focusing on the general availability (GA) of Serverless on AWS, the addition of private networking support for Serverless clusters, and a terminology update to refer to the "Cloud Console" instead of the "Cloud UI."
Key changes include:
Serverless on AWS: General Availability and Feature Updates
Documentation and Navigation Improvements
Clarifications and Corrections
These updates ensure that users have accurate, up-to-date guidance on deploying and managing Serverless clusters, especially with respect to private networking and the transition to the new Cloud Console interface.
Resolves https://redpandadata.atlassian.net/browse/DOC-1743, https://redpandadata.atlassian.net/browse/DOC-1508
Review deadline:
Page previews
Checks