Problem

rpk cloud byoc <aws|gcp|azure> apply runs Terraform to provision your BYOC infrastructure. By default, the command applies changes without asking for confirmation, and it does not show the Terraform plan.

If you set TF_LOG=DEBUG or TF_LOG_PATH in your shell, nothing changes. The BYOC plugin starts Terraform through a library that resets these environment variables on every Terraform command.

Solution

Review the plan before you apply it (AWS and GCP)

Add --no-confirm=false to the command:

rpk cloud byoc aws apply --redpanda-id <redpanda-id> --no-confirm=false

rpk cloud byoc gcp apply --redpanda-id <redpanda-id> --project-id <project-id> --no-confirm=false

The plugin runs Terraform in separate stages (provisioners), one after the other. Before it applies a stage, it plans that stage. If the plan has changes, the plugin:

1. Prints the planned resource changes as JSON to stderr. Each entry shows the resource address and the actions, for example create, update or delete.

2. Asks Apply this plan for provisioner <name>?

If you answer No, the command stops before it applies that stage. Stages that you approved before are already applied.

Notes:

• The JSON output is a summary of resource changes. It is not the full text output of terraform plan.

• The stages run in sequence, so the plugin shows one plan at a time. It cannot show all the plans before it applies the first stage.

• Azure does not support this prompt. On Azure, the plugin always applies without confirmation.

• apply has no plan-only mode. --validate-only checks prerequisites only. It does not run a Terraform plan.

Without --no-confirm=false, the plugin still runs a plan before each stage. It stops with an error if the plan deletes a protected resource. It does not show you this plan.

Capture Terraform logs

Use --tf-log-level together with --tf-log-path:

rpk cloud byoc aws apply --redpanda-id <redpanda-id> \
  --tf-log-level DEBUG --tf-log-path $PWD/terraform.log

• You must set both flags. If you set --tf-log-level without --tf-log-path, the plugin does not write Terraform logs.

• Use an absolute path for --tf-log-path, for example $PWD/terraform.log. Terraform runs in a working directory that the plugin creates, so Terraform resolves a relative path such as ./terraform.log from that directory, not from the directory where you run rpk.

• Terraform writes its logs to the file. They do not appear in the terminal.

• The valid levels are the same as for TF_LOG: TRACE, DEBUG, INFO, WARN and ERROR.

To also get debug logs from the BYOC plugin itself, add --debug (or -d). This flag also logs the Terraform commands that the plugin runs.

Send logs to Redpanda Support

When you open a support ticket about a failed apply, run the command again with these flags and attach the files:

rpk cloud byoc aws apply --redpanda-id <redpanda-id> \
  --debug --tf-log-level DEBUG --tf-log-path $PWD/terraform.log 2>&1 | tee ./byoc-apply.log

Attach terraform.log and byoc-apply.log to the ticket. Before you send the files, review them and redact any values that you do not want to share.