docs: add rpk k8s command reference (26.2)

modules/ROOT/nav.adoc

@@ -419,6 +419,15 @@
 **** xref:reference:rpk/rpk-group/rpk-group-seek.adoc[]
 *** xref:reference:rpk/rpk-help.adoc[]
 *** xref:reference:rpk/rpk-iotune.adoc[]
+*** xref:reference:rpk/rpk-k8s/rpk-k8s.adoc[]
+**** xref:reference:rpk/rpk-k8s/rpk-k8s-install.adoc[]
+**** xref:reference:rpk/rpk-k8s/rpk-k8s-multicluster.adoc[]
+***** xref:reference:rpk/rpk-k8s/rpk-k8s-multicluster-bootstrap.adoc[]
+***** xref:reference:rpk/rpk-k8s/rpk-k8s-multicluster-bundle.adoc[]
+***** xref:reference:rpk/rpk-k8s/rpk-k8s-multicluster-status.adoc[]
+**** xref:reference:rpk/rpk-k8s/rpk-k8s-uninstall.adoc[]
+**** xref:reference:rpk/rpk-k8s/rpk-k8s-upgrade.adoc[]
+**** xref:reference:rpk/rpk-k8s/rpk-k8s-version.adoc[]
 *** xref:reference:rpk/rpk-plugin/rpk-plugin.adoc[]
 **** xref:reference:rpk/rpk-plugin/rpk-plugin-list.adoc[]
 **** xref:reference:rpk/rpk-plugin/rpk-plugin-uninstall.adoc[]

modules/reference/pages/rpk/rpk-k8s/rpk-k8s-install.adoc

@@ -0,0 +1,50 @@
+= rpk k8s install
+:description: Install the Redpanda Kubernetes plugin. This command installs the latest version by default.
+
+// This content is autogenerated. Do not edit manually. To customize content, see the writer's guide: https://github.com/redpanda-data/docs-extensions-and-macros/blob/main/docs-data/RPK_OVERRIDES_GUIDE.adoc
+
+// tag::single-source[]
+Install the Redpanda Kubernetes plugin.
+
+This command installs the latest version by default.
+
+Alternatively, you may specify a version using the `--plugin-version` flag.
+
+You may force the installation using the `--force` flag.
+
+NOTE: During the 26.2 beta, no plugin release is marked as latest, so running `rpk k8s install` without flags fails with `no latest Redpanda Kubernetes plugin release found`. Pin the beta version instead: `rpk k8s install --plugin-version {operator-beta-version}`.
+
+== Usage
+
+[,bash]
+----
+rpk k8s install [flags]
+----
+
+
+
+
+== Flags
+
+[cols="1m,1a,2a"]
+|===
+|Value |Type |Description
+
+|--force |bool |Force install of the Redpanda Kubernetes plugin.
+|--plugin-version |string |Plugin version to install (for example, 25.3.5).
+|===
+
+== Global flags
+
+[cols="1m,1a,2a"]
+|===
+|Value |Type |Description
+
+|--config |string |Redpanda or `rpk` config file; default search paths are `~/Library/Application Support/rpk/rpk.yaml`, `$PWD/redpanda.yaml`, and `/etc/redpanda/redpanda.yaml`.
+|-X, --config-opt |stringArray |Override `rpk` configuration settings; `-X help` for detail or `-X list` for terser detail.
+|--ignore-profile |bool |Ignore `rpk.yaml` and `redpanda.yaml`; use default settings.
+|--profile |string |`rpk` profile to use.
+|-v, --verbose |bool |Enable verbose logging.
+|===
+
+// end::single-source[]

modules/reference/pages/rpk/rpk-k8s/rpk-k8s-multicluster-bootstrap.adoc

@@ -0,0 +1,185 @@
+= rpk k8s multicluster bootstrap
+:description: Bootstrap TLS certificates and kubeconfig secrets across multiple Kubernetes clusters for a Redpanda multicluster deployment. This command connects to each specified Kubernetes context, generates a shared CA certificate, and distributes per-cluster TLS certificates and kubeconfig secrets so that the multicluster operator can communicate across clusters.
+
+// This content is autogenerated. Do not edit manually. To customize content, see the writer's guide: https://github.com/redpanda-data/docs-extensions-and-macros/blob/main/docs-data/RPK_OVERRIDES_GUIDE.adoc
+
+// tag::single-source[]
+Bootstrap TLS certificates and kubeconfig secrets across multiple
+Kubernetes clusters for a Redpanda multicluster deployment.
+
+This command connects to each specified Kubernetes context, generates a shared
+CA certificate, and distributes per-cluster TLS certificates and kubeconfig
+secrets so that the multicluster operator can communicate across clusters.
+
+If `--kubeconfig` is provided, all contexts in the file are used automatically
+and `--context` flags are not required. If both are provided, only the specified
+contexts from the kubeconfig file are used.
+
+`--loadbalancer` provisions a standalone LoadBalancer Service on each cluster
+before signing certificates, waits for the cloud provider to assign an
+external address, and bakes that address into the cert SANs. This resolves
+the deploy/redeploy cycle that otherwise forces a first helm install just
+to learn each cluster's external IP/hostname. The resulting peer list is
+printed on success for pasting into helm values.
+
+`--output=yaml` skips applying anything and writes manifests as YAML. No
+cluster contact or kubeconfig is needed: cluster names are derived from
+`--context` flags (LB mode) or `--dns-override` keys (bootstrap mode).
+
+When `--output-dir` <dir> is set, one file per cluster is written into the
+directory as `<context>.yaml`. This is required for the TLS bootstrap path
+because each cluster's tls.key is per-cluster identity material that
+must not be applied to other clusters. The LoadBalancer-only step has
+no secrets and additionally allows streaming to stdout (split on '---'
+with comment headers).
+Use this for GitOps pipelines that commit manifests and apply them via
+Argo, Flux, or similar.
+
+Two-step GitOps workflow:
+
+1. bootstrap `--output=yaml` `--loadbalancer` `--context` <ctx> ...
+     Emits only LoadBalancer Service manifests. Apply them, wait for the
+     cloud provider to assign external addresses.
+
+2. bootstrap `--output=yaml` `--output-dir` <dir> `--dns-override` ctx=<address> ...
+     Emits Namespace and TLS Secret manifests into `<dir>/<ctx>.yaml` with
+     the known addresses baked into the cert SANs.
+
+When `--loadbalancer` is NOT set, `--dns-override` is required for every
+cluster; cluster names are derived from the override keys.
+ServiceAccount, SA token, and kubeconfig cache Secrets are not emitted
+because the operator regenerates them at runtime.
+
+== Usage
+
+[,bash]
+----
+rpk k8s multicluster bootstrap [flags]
+----
+
+
+
+
+== Examples
+
+This section provides examples of how to use `rpk k8s multicluster bootstrap`.
+
+Bootstrap all clusters from a kubeconfig file:
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --kubeconfig /path/to/kubeconfig \
+  --namespace redpanda
+----
+
+Bootstrap specific contexts (uses default kubeconfig loading rules):
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --context cluster-a --context cluster-b --context cluster-c \
+  --namespace redpanda
+----
+
+Override the TLS secret prefix when Helm release names differ from context names:
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --context cluster-a --context cluster-b --context cluster-c \
+  --name-override cluster-a=redpanda-operator \
+  --name-override cluster-b=redpanda-operator \
+  --name-override cluster-c=redpanda-operator \
+  --namespace redpanda
+----
+
+Override DNS names for TLS SANs on specific clusters:
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --context cluster-a --context cluster-b \
+  --dns-override cluster-a=cluster-a.example.com \
+  --dns-override cluster-b=cluster-b.example.com \
+  --namespace redpanda
+----
+
+Provision LoadBalancer Services and use their addresses for certificate SANs:
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --kubeconfig /path/to/kubeconfig \
+  --namespace redpanda \
+  --loadbalancer
+----
+
+Bootstrap only TLS certificates:
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --kubeconfig /path/to/kubeconfig \
+  --namespace redpanda \
+  --tls --kubeconfigs=false
+----
+
+GitOps step 1, emit LoadBalancer Service manifests (no kubeconfig needed):
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --context cluster-a --context cluster-b \
+  --namespace redpanda \
+  --loadbalancer \
+  --output=yaml > multicluster-services.yaml
+----
+
+GitOps step 2, emit Namespace and TLS Secret manifests (no kubeconfig needed):
+
+[,bash]
+----
+rpk k8s multicluster bootstrap \
+  --namespace redpanda \
+  --dns-override cluster-a=cluster-a.example.com \
+  --dns-override cluster-b=cluster-b.example.com \
+  --output=yaml --output-dir ./multicluster-bootstrap
+----
+
+== Flags
+
+[cols="1m,1a,2a"]
+|===
+|Value |Type |Description
+
+|--context |strings |Kubernetes contexts. Repeatable. If omitted with `--kubeconfig`, all contexts in the file are used.
+|--create-namespace |bool |Create the namespace if it does not exist (default true).
+|--dns-override |stringArray |DNS override for TLS SANs, in `context=address` format. Repeatable.
+|--kubeconfig |string |Path to a kubeconfig file (all contexts in the file are used unless `--context` is also specified).
+|--kubeconfigs |bool |Bootstrap kubeconfig secrets (default true).
+|--loadbalancer |bool |Provision a standalone LoadBalancer Service per cluster and use its external address for TLS SANs.
+|--loadbalancer-timeout |duration |Per-cluster timeout waiting for a LoadBalancer address (0 = default of 10m).
+|--name-override |stringArray |Override the TLS secret prefix for a context, in `context=prefix` format. Defaults to the context name. Repeatable.
+|--namespace |string |Namespace for operator resources (default `redpanda`).
+|--organization |string |Organization name for generated TLS certificates (default "Redpanda").
+|--output |string |Output mode. Empty (the default) applies resources to clusters. `yaml` emits manifests for GitOps and makes no cluster calls.
+|--output-dir |string |With `--output=yaml`, write one file per cluster (named `<context>.yaml`) into this directory. Required when emitting TLS Secrets; per-cluster routing prevents leaking peer identity keys across the trust boundary.
+|--service-name |string |Operator deployment label selector value (`app.kubernetes.io/name`) (default `operator`).
+|--tls |bool |Bootstrap TLS certificates (default true).
+|===
+
+== Global flags
+
+[cols="1m,1a,2a"]
+|===
+|Value |Type |Description
+
+|--config |string |Redpanda or `rpk` config file; default search paths are `~/Library/Application Support/rpk/rpk.yaml`, `$PWD/redpanda.yaml`, and `/etc/redpanda/redpanda.yaml`.
+|-X, --config-opt |stringArray |Override `rpk` configuration settings; `-X help` for detail or `-X list` for terser detail.
+|--ignore-profile |bool |Ignore `rpk.yaml` and `redpanda.yaml`; use default settings.
+|--profile |string |`rpk` profile to use.
+|-v, --verbose |bool |Enable verbose logging.
+|===
+
+// end::single-source[]

modules/reference/pages/rpk/rpk-k8s/rpk-k8s-multicluster-bundle.adoc

@@ -0,0 +1,95 @@
+= rpk k8s multicluster bundle
+:description: pass:q[Collects environment data from each Kubernetes cluster running the Redpanda multicluster operator and packages it into a ZIP file for support. This is the operator-side counterpart to `rpk debug bundle`, which collects data from the Redpanda brokers themselves.]
+
+// This content is autogenerated. Do not edit manually. To customize content, see the writer's guide: https://github.com/redpanda-data/docs-extensions-and-macros/blob/main/docs-data/RPK_OVERRIDES_GUIDE.adoc
+
+// tag::single-source[]
+Collects environment data from each Kubernetes cluster running the
+Redpanda multicluster operator and packages it into a ZIP file for support.
+This is the operator-side counterpart to `rpk debug bundle`, which collects
+data from the Redpanda brokers themselves.
+
+By default, only one Kubernetes context is required. The bundle command
+discovers peer clusters from labelled cache Secrets stored by the operator's
+raft-bootstrap flow on the starting cluster, so the tool stays useful when
+one of the peer clusters is down. Pass multiple `--context` flags to bypass
+discovery and diagnose exactly that set.
+
+== Usage
+
+[,bash]
+----
+rpk k8s multicluster bundle [flags]
+----
+
+
+
+
+== Examples
+
+This section provides examples of how to use `rpk k8s multicluster bundle`.
+
+Use a single context and discover peers from the starting cluster:
+
+[,bash]
+----
+rpk k8s multicluster bundle --kubeconfig /path/to/kubeconfig
+----
+
+Start from a specific cluster in the default kubeconfig:
+
+[,bash]
+----
+rpk k8s multicluster bundle --context cluster-a
+----
+
+Bypass discovery and bundle the listed clusters directly:
+
+[,bash]
+----
+rpk k8s multicluster bundle --context cluster-a --context cluster-b --context cluster-c
+----
+
+Write the bundle to a specific path:
+
+[,bash]
+----
+rpk k8s multicluster bundle --context cluster-a -o /tmp/operator-bundle.zip
+----
+
+== Flags
+
+[cols="1m,1a,2a"]
+|===
+|Value |Type |Description
+
+|--context |strings |Kubernetes contexts. Repeatable. If omitted with `--kubeconfig`, all contexts in the file are used.
+|--include-private-keys |bool |Include TLS private keys and cached peer kubeconfigs in serialised Secrets. Off by default.
+|--kubeconfig |string |Path to a kubeconfig file (all contexts in the file are used unless `--context` is also specified).
+|--logs-size-limit |string |Per-container log byte cap (`human-readable`, for example, "5M", "10MiB", "1G"; "0" disables the cap) (default "5M").
+|--logs-tail-lines |int |Per-container log tail-line cap (0 disables the cap) (default 5000).
+|--metrics-interval |duration |Interval between successive `/metrics` samples (for example, 10s, 1m). Must be > 0. (default 10s).
+|--metrics-samples |int |Number of `/metrics` samples taken per cluster (>= 2). Lets investigators compute counter rates post-hoc. (default 2).
+|--name-override |stringArray |Override the TLS secret prefix for a context, in `context=prefix` format. Defaults to the context name. Repeatable.
+|--namespace |string |Namespace for operator resources (default `redpanda`).
+|-o, --output |string |Output mode. Empty (the default) applies resources to clusters. `yaml` emits manifests for GitOps and makes no cluster calls.
+|--service-name |string |Operator deployment label selector value (`app.kubernetes.io/name`) (default `operator`).
+|--skip-logs |bool |Skip operator pod log collection.
+|--skip-metrics |bool |Skip operator `/metrics` scrape.
+|-v, --verbose |bool |Print per-step progress to stderr (use to diagnose slow runs / hangs).
+|===
+
+== Global flags
+
+[cols="1m,1a,2a"]
+|===
+|Value |Type |Description
+
+|--config |string |Redpanda or `rpk` config file; default search paths are `~/Library/Application Support/rpk/rpk.yaml`, `$PWD/redpanda.yaml`, and `/etc/redpanda/redpanda.yaml`.
+|-X, --config-opt |stringArray |Override `rpk` configuration settings; `-X help` for detail or `-X list` for terser detail.
+|--ignore-profile |bool |Ignore `rpk.yaml` and `redpanda.yaml`; use default settings.
+|--profile |string |`rpk` profile to use.
+|-v, --verbose |bool |Enable verbose logging.
+|===
+
+// end::single-source[]