Merge branch 'main' into bump-xref-cleanup

Author: kbatuigas

modules/ROOT/nav.adoc

@@ -405,6 +405,7 @@
 *** xref:manage:cluster-maintenance/config-cluster.adoc[]
 *** xref:manage:audit-logging.adoc[]
 **** xref:manage:audit-logging/audit-log-samples.adoc[]
+*** xref:manage:cluster-maintenance/manage-throughput.adoc[]
 ** xref:manage:monitor-cloud.adoc[]
 ** xref:manage:mountable-topics.adoc[]
 ** xref:manage:rpk/index.adoc[Redpanda CLI]
@@ -425,6 +426,7 @@
 *** xref:manage:schema-reg/schema-reg-overview.adoc[]
 *** xref:manage:schema-reg/schema-reg-ui.adoc[]
 *** xref:manage:schema-reg/schema-reg-api.adoc[]
+*** xref:manage:schema-reg/schema-reg-authorization.adoc[Schema Registry Authorization]
 *** xref:manage:schema-reg/record-deserialization.adoc[Deserialization]
 *** xref:manage:schema-reg/programmable-push-filters.adoc[Programmable Push Filters]
 *** xref:manage:schema-reg/edit-topic-configuration.adoc[Edit Topic Configuration]
@@ -493,6 +495,10 @@
 **** xref:reference:rpk/rpk-cluster/rpk-cluster-logdirs.adoc[]
 ***** xref:reference:rpk/rpk-cluster/rpk-cluster-logdirs-describe.adoc[]
 **** xref:reference:rpk/rpk-cluster/rpk-cluster-info.adoc[]
+**** xref:reference:rpk/rpk-cluster/rpk-cluster-quotas.adoc[]
+***** xref:reference:rpk/rpk-cluster/rpk-cluster-quotas-alter.adoc[]
+***** xref:reference:rpk/rpk-cluster/rpk-cluster-quotas-describe.adoc[]
+***** xref:reference:rpk/rpk-cluster/rpk-cluster-quotas-import.adoc[]
 **** xref:reference:rpk/rpk-cluster/rpk-cluster-storage.adoc[]
 ***** xref:reference:rpk/rpk-cluster/rpk-cluster-storage-cancel-mount.adoc[]
 ***** xref:reference:rpk/rpk-cluster/rpk-cluster-storage-list-mount.adoc[]

modules/get-started/pages/cloud-overview.adoc

@@ -45,14 +45,12 @@ include::get-started:partial$get-started-serverless.adoc[]
 
 === Bring Your Own Cloud (BYOC)
 
-With BYOC clusters, you deploy Redpanda in your own cloud (AWS, Azure, or GCP), and all data is
-contained in your own environment. This provides an additional layer of security and isolation. (See xref:get-started:byoc-arch.adoc[].) When you create a BYOC cluster, you select the supported xref:reference:tiers/byoc-tiers.adoc[tier] that meets your compute and storage needs. Redpanda handles provisioning, operations, and maintenance. 
+With BYOC clusters, you deploy the Redpanda glossterm:data plane[] into your existing VPC (for AWS and GCP) or VNet (for Azure), and all data is
+contained in your own environment. This provides an additional layer of security and isolation. (See xref:get-started:byoc-arch.adoc[].) Redpanda manages provisioning, monitoring, upgrades, and security policies, and it manages required resources in your VPC or VNet, including subnets (subnetworks in GCP), IAM roles, and object storage resources (for example, S3 buckets or Azure Storage accounts). 
 
-NOTE: With standard BYOC clusters, Redpanda manages security policies and resources for your VPC or VNet, including subnetworks, IAM roles, and storage buckets/accounts. 
+==== Bring Your Own VPC/VNet (BYOVPC/BYOVNet) 
 
-==== Bring Your Own Network (BYOVPC/BYOVNet) 
-
-BYOVPC or BYOVNet clusters allow you to deploy the Redpanda glossterm:data plane[] into your existing VPC (for AWS or GCP) or VNet (for Azure) and take full control of the networking lifecycle. Compared to standard BYOC, BYOVPC/BYOVNet provides more security, but the configuration is more complex. See <<Shared responsibility model>>.
+With BYOVPC/BYOVNet clusters, you take full control of the networking lifecycle. Compared to standard BYOC, BYOVPC/BYOVNet provides more security, but the configuration is more complex. See the xref:get-started:cloud-overview.adoc#shared-responsibility-model[shared responsibility model] to understand what you manage versus what Redpanda manages.
 
 The BYOC infrastructure that Redpanda manages should not be used to deploy any other workloads.
 

modules/get-started/pages/cluster-types/byoc/gcp/enable-rpcn-byovpc-gcp.adoc

@@ -1,6 +1,11 @@
 = Enable Redpanda Connect on an Existing BYOVPC Cluster on GCP
 :description: Add Redpanda Connect to your existing BYOVPC cluster.
 
+[IMPORTANT]
+====
+BYOVPC is an add-on feature that may require an additional purchase. To unlock this feature for your account, contact your Redpanda account team or https://www.redpanda.com/price-estimator[Redpanda Sales^].
+==== 
+
 
 To enable Redpanda Connect on an existing BYOVPC cluster, you must update your configuration. You can also create xref:get-started:cluster-types/byoc/gcp/vpc-byo-gcp.adoc[a new BYOVPC cluster] with Redpanda Connect already enabled.
 

modules/get-started/pages/cluster-types/byoc/index.adoc

@@ -1,4 +1,16 @@
 = BYOC
-:description: Learn how to create a Bring Your Own Cloud (BYOC) or Bring Your Own Virtual Private Cloud (BYOVPC) cluster.
+:description: Learn how to create a Bring Your Own Cloud (BYOC), Bring Your Own Virtual Private Cloud (BYOVPC), or Bring Your Own Virtual Network (BYOVNet) cluster.
 :page-layout: index
-:page-aliases: deploy:deployment-option/cloud/provision-a-byoc-cluster/index.adoc
+:page-aliases: deploy:deployment-option/cloud/provision-a-byoc-cluster/index.adoc
+
+
+Bring Your Own Cloud (BYOC) lets you run Redpanda in your own cloud environment while using managed services provided by Redpanda. With BYOC clusters, Redpanda deploys into your existing cloud network:
+
+* AWS and GCP: Virtual Private Cloud (VPC)
+* Azure: Virtual Network (VNet)
+
+Your data never leaves your environment, giving you extra security and control. See xref:get-started:byoc-arch.adoc[BYOC architecture] for details. Redpanda manages provisioning, monitoring, upgrades, and security policies, and it manages required resources in your VPC or VNet, including subnets (subnetworks in GCP), IAM roles, and object storage resources (for example, S3 buckets or Azure Storage accounts). You get hands-off operations with a 99.99% uptime guarantee while keeping full control of your data. 
+
+If you want to manage the networking infrastructure yourself, create a Bring Your Own Virtual Private Cloud (BYOVPC) or Bring Your Own Virtual Network (BYOVNet) cluster. With BYOVPC/BYOVNet, the Redpanda agent does not create or change resources in your account. This is ideal for organizations with stringent compliance requirements or existing network configurations, when you need full control over the network lifecycle. Compared to standard BYOC, BYOVPC/BYOVNet provides more security, but the configuration is more complex. See the xref:get-started:cloud-overview.adoc#shared-responsibility-model[shared responsibility model] to understand what you manage versus what Redpanda manages.
+
+IMPORTANT: Don't deploy other workloads on the BYOC infrastructure that Redpanda manages.

modules/get-started/pages/whats-new-cloud.adoc

@@ -15,6 +15,10 @@ A new xref:manage:iceberg/iceberg-topics-aws-glue.adoc[integration with AWS Glue
 
 See xref:manage:iceberg/rest-catalog/index.adoc[] for supported Iceberg REST catalog integrations.
 
+=== Manage throughput
+
+Redpanda Cloud now lets you xref:manage:cluster-maintenance/manage-throughput.adoc[manage throughput] configuration at the broker and client levels. You can manage client quotas with xref:reference:rpk/rpk-cluster/rpk-cluster-quotas.adoc[`rpk cluster quotas`] or with the Kafka API. When no quotas apply, the client has unlimited throughput.
+
 == July 2025
 
 === Iceberg topics in Redpanda Cloud: GA
@@ -25,6 +29,11 @@ xref:manage:iceberg/about-iceberg-topics.adoc[Iceberg topics] are now generally
 
 xref:get-started:cluster-types/byoc/azure/create-byoc-cluster-azure.adoc[BYOC for Azure] is now generally available (GA).
 
+
+=== Schema Registry Authorization
+
+You can now use xref:manage:schema-reg/schema-reg-authorization.adoc[Schema Registry Authorization] to control access to Schema Registry subjects and operations. Schema Registry Authorization offers more granular control over who can do what with your Redpanda Schema Registry resources. ACLs used for Schema Registry access also support RBAC roles.
+
 === Kafka Connect disabled on new clusters
 
 xref:develop:managed-connectors/index.adoc[Kafka Connect] is now disabled by default on all new clusters. To unlock this feature for your account, contact https://support.redpanda.com/hc/en-us/requests/new[Redpanda Support^]. If you previously enabled Kafka Connect on a cluster and want to xref:develop:managed-connectors/disable-kc.adoc[disable it], you can use the Cloud API.

modules/manage/pages/cluster-maintenance/manage-throughput.adoc

@@ -0,0 +1,4 @@
+= Manage Throughput
+:description: Manage the throughput of Kafka traffic with configurable properties.
+
+include::ROOT:manage:cluster-maintenance/manage-throughput.adoc[tag=single-source]

modules/manage/pages/schema-reg/schema-reg-authorization.adoc

@@ -0,0 +1,4 @@
+= Schema Registry Authorization
+:description: Learn how to set up and manage Schema Registry Authorization using ACL definitions that control user access to specific Schema Registry operations.
+
+include::ROOT:manage:schema-reg/schema-reg-authorization.adoc[tag=single-source]

modules/networking/pages/byoc/gcp/vpc-peering-gcp.adoc

@@ -6,7 +6,7 @@ To start sending data to the Redpanda cluster, you must configure the VPC networ
 
 == Prerequisites
 
-* A GCP account
+* A GCP account.
 * A running BYOC cluster in GCP. See xref:get-started:cluster-types/byoc/gcp/create-byoc-cluster-gcp.adoc[Create a BYOC Cluster on GCP].
 * Your Redpanda cluster and VPC must be in the same region.
 

modules/reference/pages/properties/cluster-properties.adoc

@@ -8,4 +8,4 @@ NOTE: Some properties require a cluster restart for updates to take effect. This
 
 == Cluster configuration
 
-include::ROOT:reference:properties/cluster-properties.adoc[tags=audit_enabled;audit_excluded_principals;audit_excluded_topics;data_transforms_enabled;data_transforms_logging_line_max_bytes;iceberg_catalog_type;iceberg_delete;iceberg_enabled;iceberg_rest_catalog_client_id;iceberg_rest_catalog_client_secret;iceberg_rest_catalog_token;iceberg_rest_catalog_authentication_mode;iceberg_rest_catalog_base_location;iceberg_rest_catalog_endpoint;iceberg_rest_catalog_oauth2_server_uri;iceberg_rest_catalog_warehouse;iceberg_rest_catalog_request_timeout_ms;iceberg_default_partition_spec;iceberg_invalid_record_action;iceberg_target_lag_ms;iceberg_rest_catalog_trust;iceberg_rest_catalog_crl;data_transforms_per_function_memory_limit;data_transforms_binary_max_size;log_segment_ms;http_authentication;iceberg_catalog_base_location;default_topic_replications;minimum_topic_replications;oidc_discovery_url;oidc_principal_mapping;oidc_token_audience;sasl_mechanisms;tls_min_version;audit_log_num_partitions;data_transforms_per_core_memory_reservation;iceberg_disable_snapshot_tagging;enable_consumer_group_metrics]
+include::ROOT:reference:properties/cluster-properties.adoc[tags=audit_enabled;audit_excluded_principals;audit_excluded_topics;data_transforms_enabled;data_transforms_logging_line_max_bytes;iceberg_catalog_type;iceberg_delete;iceberg_enabled;iceberg_rest_catalog_client_id;iceberg_rest_catalog_client_secret;iceberg_rest_catalog_token;iceberg_rest_catalog_authentication_mode;iceberg_rest_catalog_base_location;iceberg_rest_catalog_endpoint;iceberg_rest_catalog_oauth2_server_uri;iceberg_rest_catalog_warehouse;iceberg_rest_catalog_request_timeout_ms;iceberg_default_partition_spec;iceberg_invalid_record_action;iceberg_target_lag_ms;iceberg_rest_catalog_trust;iceberg_rest_catalog_crl;data_transforms_per_function_memory_limit;data_transforms_binary_max_size;log_segment_ms;http_authentication;iceberg_catalog_base_location;default_topic_replications;minimum_topic_replications;oidc_discovery_url;oidc_principal_mapping;oidc_token_audience;sasl_mechanisms;tls_min_version;audit_log_num_partitions;data_transforms_per_core_memory_reservation;iceberg_disable_snapshot_tagging;enable_consumer_group_metrics;schema_registry_enable_authorization]

modules/reference/pages/rpk/rpk-cluster/rpk-cluster-quotas-alter.adoc

@@ -0,0 +1,3 @@
+= rpk cluster quotas alter
+
+include::ROOT:reference:rpk/rpk-cluster/rpk-cluster-quotas-alter.adoc[tag=single-source]