rpk EOF Error When Connecting to Redpanda Cloud — TLS Not Enabled
Last updated: August 10, 2026
Summary
When using rpk to manage topics on a Redpanda Cloud cluster (e.g., adding partitions), an EOF error is returned if TLS is not enabled in the rpk client configuration. This article explains how to enable TLS to resolve the issue.
Symptoms
- Running
rpkcommands against a Redpanda Cloud cluster returns anEOFerror - Topic creation or other operations may intermittently succeed or fail depending on how the command connects
- The rpk profile or command-line flags do not include
tls.enabled=true - The Redpanda Cloud console does not show an option to add partitions to existing topics
Root Cause
Redpanda Cloud clusters require TLS-encrypted connections on all Kafka API listeners. When rpk attempts to connect without TLS enabled, the broker immediately closes the connection because it expects a TLS handshake. This manifests as an EOF error on the client side — the TCP connection is established, but the broker terminates it when it receives a plaintext Kafka protocol request instead of a TLS ClientHello.
The tls.enabled setting in rpk defaults to false, so users who manually configure their rpk profile or pass broker addresses without also enabling TLS will encounter this error.
Resolution
-
If using an rpk profile, enable TLS permanently:
rpk profile set tls.enabled=true -
Alternatively, pass TLS as a one-time flag on the command line:
rpk topic list -X tls.enabled=true -
If creating a new profile from scratch, include TLS from the start:
rpk profile create \ --set brokers= \ --set user= \ --set pass= \ --set sasl.mechanism=SCRAM-SHA-256 \ --set tls.enabled=true -
You can also set TLS via environment variable for automation or scripting:
export RPK_TLS_ENABLED=true
Verification
Run a simple command to confirm connectivity:
rpk topic listExpected output: a list of your cluster's topics with no EOF error.
Related Resources
Questions? If you have any questions, or need further guidance, please contact Redpanda Support.