DOC-2199, ENG-1063: Document Terraform redpanda_secret and cross-region AWS PrivateLink

[Feediver1]

Description

This PR documents two shipped Terraform provider features on the Redpanda Terraform Provider page:

1. redpanda_secret resource (ENG-1062, resolves DOC-2199)

The Redpanda Terraform provider v2.0.0 (released 2026-06-03) added the redpanda_secret resource for managing cluster secrets. Its secret_data attribute is write-only (Terraform 1.11+), so the plaintext never lands in state; rotation uses the secret_data_version counter.

• manage/terraform-provider.adoc:
  • Removed Secrets from the Limitations list — it has been incorrect on the live site since v2.0.0 shipped.
  • Added a new Manage cluster secrets section with a working example (from the provider repo's shipped example), the rotation pattern, scope behavior, and links to the registry doc and the Connect secret-management page.
  • Extended the write-only naming-exception NOTE and the Supported attributes table to cover redpanda_secret (secret_data/secret_data_version, no plaintext variant).
• develop/connect/configuration/secret-management.adoc: mentions Terraform as a management option (this was the originating customer use case: pipeline auth via SCOPE_REDPANDA_CONNECT).
• security/secrets.adoc: added a sentence listing the management interfaces for the cluster secret store, including the Terraform provider.

2. Cross-region AWS PrivateLink (ENG-1063)

Cross-region AWS PrivateLink was already documented for the UI and API on the AWS PrivateLink page but not for Terraform. The provider supports it via the optional supported_regions attribute of the aws_private_link block on redpanda_cluster (v2.0.0+, up to 50 unique regions, updates in place).

• manage/terraform-provider.adoc:
  • Added a new Configure cross-region AWS PrivateLink section with the requirements (multi-AZ cluster, BYOC agent IAM permissions), a working example including a service_name output for creating VPC endpoints, and links to the networking page for the cross-region VPC endpoint workflow.
  • Pointed the existing Dedicated cluster example (which already showed supported_regions inline) at the new section.
  • Added a learning objective for the new section.
• networking/aws-privatelink.adoc: the Configure cross-region PrivateLink section now links to the new Terraform section.

What's New

get-started/whats-new-cloud.adoc: added June 2026 entries (v2.0.0) for both features, grouped with the existing Terraform SQL entry, following the established Terraform What's New pattern.

For SME confirmation (@Gene): the registry doc says secret_data must be Base64-encoded, but the shipped provider example passes a plain sensitive variable without base64encode(). This PR mirrors the shipped example and states the Base64 requirement in the attribute list — please confirm which is authoritative.

Not covered here: redpanda_shadow_link (also v2.0.0) — assumed tracked separately; say the word if the What's New entry should cover both.

Resolves DOC-2199
Documents ENG-1063

Page previews

• Redpanda Terraform Provider: Manage cluster secrets (updated)
• Redpanda Terraform Provider: Configure cross-region AWS PrivateLink (updated)
• AWS PrivateLink (updated)
• What's New in Redpanda Cloud (updated)
• Manage Secrets (Connect) (updated)
• Secrets (security) (updated)

Checks

• New feature
• Content gap
• Support Follow-up
• Small fix (typos, links, copyedits, etc)

🤖 Generated with Claude Code

Preview pages

• Redpanda Terraform Provider (updated)
• What's New in Redpanda Cloud (updated)
• Configure AWS PrivateLink with the Cloud API (updated)
• Manage Secrets (updated)
• Secrets (updated)

[netlify]

✅ Deploy Preview for rp-cloud ready!

Name	Link
🔨 Latest commit	1157eae
🔍 Latest deploy log	https://app.netlify.com/projects/rp-cloud/deploys/6a5e51e153ac4f0008988046
😎 Deploy Preview	https://deploy-preview-635--rp-cloud.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 593ab063-8c1f-4491-beb3-66a4b0c69f50

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The documentation now covers cluster secret management with the redpanda_secret Terraform resource. It describes write-only secret values, version-based rotation, scopes, labels, and configuration constraints. Existing secret-management pages and the June 2026 Cloud release notes now reference Terraform alongside the Cloud UI and Data Plane API.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: mattschumpert, gene-redpanda

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main documentation change: adding Terraform redpanda_secret support and related PrivateLink docs.
Description check	✅ Passed	The description covers the main changes, page previews, and checks, but it omits the required review deadline and exact issue-resolution URL.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DOC-2199-terraform-redpanda-secret

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

modules/manage/pages/terraform-provider.adoc (1)

185-190: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Bump the provider constraint in the secret-management setup example modules/manage/pages/terraform-provider.adoc:185-190 — the redpanda_secret section requires provider v2.0.0+, but this snippet still pins ~> 1.0, which prevents users from using the documented resource.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@modules/manage/pages/terraform-provider.adoc` around lines 185 - 190, Update
the provider version constraint in the Terraform configuration for the
redpanda_secret example within terraform-provider.adoc from ~> 1.0 to a
constraint supporting provider v2.0.0 or later, such as ~> 2.0.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@modules/manage/pages/terraform-provider.adoc`:
- Around line 326-328: Add redpanda_secret to the introductory
supported-resources list near the top of the terraform-provider documentation,
linking it to the resource’s existing documentation section or anchor. Ensure
the list reflects the newly documented resource and no longer omits secret
management.
- Around line 339-345: The Terraform example’s redpanda_secret.example
references an undefined redpanda_cluster.example. Replace cluster_api_url with
the existing data.redpanda_cluster.byoc.cluster_api_url pattern, or define a
matching redpanda_cluster.example resource before this example.
- Around line 334-350: Update the redpanda_secret example’s secret_data
assignment to pass base64encode(var.secret_value), or explicitly document that
secret_value must already be Base64-encoded; keep the surrounding variable and
resource documentation consistent with the chosen behavior.

---

Outside diff comments:
In `@modules/manage/pages/terraform-provider.adoc`:
- Around line 185-190: Update the provider version constraint in the Terraform
configuration for the redpanda_secret example within terraform-provider.adoc
from ~> 1.0 to a constraint supporting provider v2.0.0 or later, such as ~> 2.0.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c8a7312f-35e3-4126-8fdd-70d97383d234

📥 Commits

Reviewing files that changed from the base of the PR and between 4a44aec and 4c4f8e3.

📒 Files selected for processing (4)

• modules/develop/pages/connect/configuration/secret-management.adoc
• modules/get-started/pages/whats-new-cloud.adoc
• modules/manage/pages/terraform-provider.adoc
• modules/security/pages/secrets.adoc

[david-yu]

Thanks for doing this, I'll also add cross-region private link a commit as well.

[david-yu]

Reviewed against the terraform-provider-redpanda source. The content is largely accurate, but three things need fixing before merge:

1. Cross-region PrivateLink is v1.7.0+, not v2.0.0+

supported_regions on aws_private_link first shipped in provider v1.7.0 (released 2026-02-26) — it's present in redpanda/resources/cluster/schema_resource.go at that tag. The PR says "v2.0.0+" in three places: the new Configure cross-region AWS PrivateLink section in terraform-provider.adoc, and the What's New entry (which also files it under June 2026). The version should be v1.7.0+, and the What's New placement may want a rethink since the feature actually shipped in February.

2. "You cannot change labels after you create the secret" is incorrect

As of provider v2.1.0 (released 2026-06-24), labels on redpanda_secret update in place — there is no RequiresReplace on the attribute (see commit 4a7c080 "fix(secret): make labels mutable in place instead of forcing replace"). Even in v2.0.0 the behavior was "changing labels replaces the secret," not "cannot change." Suggest dropping the sentence or changing it to say labels can be updated.

3. Base64 (the open SME question): the shipped example is authoritative — drop "Base64-encoded"

The provider sends the raw string bytes with no Base64 encode/decode anywhere (redpanda/resources/secret/resource_secret.go: SecretData: []byte(cfg.SecretData.ValueString())). Proof it's stored and consumed raw: the live-tested examples/shadow_link/main.tf stores a raw SCRAM password as secret_data and the shadow link authenticates with it via ${secrets.<NAME>} — that only works if the stored value is the literal password. The "Must be Base64-encoded" text in the provider's registry docs is itself a bug (copied from the REST/JSON representation of the proto bytes field, where Base64 is just wire encoding) and will be fixed provider-side. The attribute bullet here should just say "The secret value."

[Feediver1]

@david-yu Thanks for the source-level review — all three items are applied in 86005d7:

1. v1.7.0+: Corrected in the Configure cross-region AWS PrivateLink section. For the What's New placement, the February 2026 section already had a Cross-region AWS PrivateLink entry (Cloud UI + Cloud API), so I removed the standalone June entry and added the Terraform provider (v1.7.0+) as a third method there. The June Secrets management entry stays, since redpanda_secret did ship in v2.0.0 in June.
2. Labels: Now reads "You can update labels on an existing secret (provider v2.1.0+)."
3. Base64: The secret_data bullet now says just "The secret value." Also dismissed CodeRabbit's suggestion to wrap the example in base64encode(), which cited the registry doc note you identified as a provider-doc bug.

[micheleRP]

lgtm, just minor suggestions