[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-configuring-cockroachdb-helm-tls":3,"mdc-u44fg0-key":33,"related-org-cockroachdb-configuring-cockroachdb-helm-tls":3635,"related-repo-cockroachdb-configuring-cockroachdb-helm-tls":3791},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":28,"sourceUrl":31,"mdContent":32},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Encryption","encryption",{"name":20,"slug":21,"type":15},"Deployment","deployment",105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:56:37.675396",null,153,[],{"repoUrl":23,"stars":22,"forks":26,"topics":29,"description":30},[],"Helm charts for cockroachdb","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-operations-and-lifecycle\u002Fconfiguring-cockroachdb-helm-tls","---\nname: configuring-cockroachdb-helm-tls\ndescription: Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.\ncompatibility: CockroachDB Helm v2 charts. Requires Kubernetes Secret or cert-manager access for externally managed certificates. TLS mode must be chosen before initial cluster creation.\nmetadata:\n  author: cockroachdb\n  version: \"1.1\"\n---\n\n# Configuring CockroachDB Helm TLS\n\nGuides TLS configuration for operator-managed CockroachDB clusters installed with the Helm v2 charts. The operator API receives `externalCertificates`; the Helm chart is responsible for translating self-signer, cert-manager, or external certificate values into the `CrdbCluster` spec.\n\n## When to Use This Skill\n\n- A customer asks which TLS mode to use with CockroachDB Helm charts\n- A values file needs a secure `cockroachdb.tls` block\n- The install fails with chart TLS validation errors\n- The customer already has cert-manager or externally generated certificates\n- The customer needs to understand which Secrets and ConfigMaps the chart expects\n\n## Safety Considerations\n\n- Do not change `cockroachdb.tls.enabled` on a running cluster.\n- Enable exactly one of `selfSigner.enabled`, `certManager.enabled`, or `externalCertificates.enabled` when `cockroachdb.tls.enabled=true`.\n- Disable all three certificate providers when `cockroachdb.tls.enabled=false`.\n- For production, confirm the certificate rotation owner before install. Self-signer can rotate node\u002Fclient certs, but a customer-provided CA remains the customer's responsibility.\n- Do not print private key contents. Only reference Secret names and required keys.\n- For certificate rotation or trust failures on a running operator-managed cluster, collect certificate metadata and cert-reloader logs before changing Secrets, ConfigMaps, or cert-manager resources.\n\n## Execution Discipline\n\n- Execute one step at a time and inspect the output before moving on. Certificate mode, Secret names, and issuer state determine which later checks are relevant.\n- Do not change TLS mode, replace Secrets, patch cert-manager resources, run debug containers, or perform Helm upgrades unless the user explicitly approves the action for the target cluster.\n- Never print private key data. Use metadata checks for expiry, issuer, subject, SANs, and required key presence.\n- In production or when certificate ownership is unclear, involve TSE or the operator team before rotation, regeneration, debug containers, or restart actions.\n\n## Step 1: Choose the TLS Mode\n\n| Mode | Use When | Required Inputs |\n|---|---|---|\n| Self-signer | Fastest secure install, dev\u002Ftest, or customer accepts chart-managed cert generation | Optional CA Secret if customer provides CA |\n| Cert-manager | Customer already runs cert-manager and wants Kubernetes-native renewal | Issuer or ClusterIssuer, CA ConfigMap, node Secret, root client Secret |\n| External certificates | Customer PKI owns all certificates and rotation | CA ConfigMap, node Secret, HTTP Secret, root SQL client Secret |\n| Insecure | Non-production test only | Explicit user confirmation |\n\nIf the user is unsure, default to self-signer for a first secure non-production deployment and recommend cert-manager or external certificates for production environments with existing PKI.\n\n## Self-Signer Values\n\nChart-managed CA, node certs, and root client certs:\n\n```yaml\ncockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: true\n      rotateCerts: true\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: false\n```\n\nCustomer-provided CA with chart-generated node and client certs:\n\n```yaml\ncockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: true\n      caProvided: true\n      caSecret: custom-ca-secret\n      rotateCerts: true\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: false\n```\n\nThe CA Secret must contain `ca.crt` and `ca.key` in the CockroachDB namespace before install.\n\nValidate:\n\n```bash\nkubectl -n \u003Cnamespace> get secret custom-ca-secret\nhelm template crdb .\u002Fcockroachdb-parent\u002Fcharts\u002Fcockroachdb -n \u003Cnamespace> -f values.yaml >\u002Ftmp\u002Fcrdb-rendered.yaml\n```\n\n## Cert-Manager Values\n\nUse cert-manager when an Issuer or ClusterIssuer can issue CockroachDB node and root client certificates.\n\n```yaml\ncockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: false\n    certManager:\n      enabled: true\n      caConfigMap: cockroachdb-ca\n      nodeSecret: cockroachdb-node\n      clientRootSecret: cockroachdb-root\n      issuer:\n        group: cert-manager.io\n        kind: Issuer\n        name: cockroachdb\n    externalCertificates:\n      enabled: false\n```\n\nPreflight:\n\n```bash\nkubectl -n \u003Cnamespace> get issuer cockroachdb\nkubectl -n \u003Cnamespace> get configmap cockroachdb-ca || true\nkubectl -n \u003Cnamespace> get secret cockroachdb-node cockroachdb-root || true\nkubectl get crd certificates.cert-manager.io issuers.cert-manager.io\n```\n\nIf cert-manager stores CA material in a Secret but the chart needs a ConfigMap, configure trust-manager or another approved process to publish `ca.crt` into the namespace.\n\n## External Certificate Values\n\nUse external certificates when the customer has already generated Kubernetes resources with the names the operator expects:\n\n```yaml\ncockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: false\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: true\n      certificates:\n        caConfigMapName: cockroachdb-ca\n        nodeSecretName: cockroachdb-node\n        httpSecretName: cockroachdb-node\n        rootSqlClientSecretName: cockroachdb-root\n```\n\nExpected data keys:\n\n| Resource | Required Keys |\n|---|---|\n| CA ConfigMap | `ca.crt` |\n| Node TLS Secret | `tls.crt`, `tls.key` |\n| HTTP TLS Secret | `tls.crt`, `tls.key` |\n| Root SQL client Secret | `tls.crt`, `tls.key` or chart-compatible root client cert keys |\n\nValidate names and keys without printing secret values:\n\n```bash\nkubectl -n \u003Cnamespace> get configmap cockroachdb-ca -o jsonpath='{.data.ca\\.crt}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-node -o jsonpath='{.data.tls\\.crt}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-node -o jsonpath='{.data.tls\\.key}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-root -o jsonpath='{.data.tls\\.crt}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-root -o jsonpath='{.data.tls\\.key}' >\u002Fdev\u002Fnull\n```\n\n## Insecure Non-Production Values\n\nOnly use for local testing or temporary non-production validation:\n\n```yaml\ncockroachdb:\n  tls:\n    enabled: false\n    selfSigner:\n      enabled: false\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: false\n```\n\nState clearly that insecure mode has no TLS or authentication protections and is not suitable for production.\n\n## Post-Install Verification\n\n```bash\nkubectl -n \u003Cnamespace> get crdbcluster \u003Crelease-name> -o yaml | grep -A12 certificates\nkubectl -n \u003Cnamespace> get secret,configmap | grep -E 'cockroach|crdb'\nkubectl -n \u003Cnamespace> get pods\n```\n\nFor self-signer, confirm the self-signer job ran and the generated CA, node, and client resources exist. For cert-manager, confirm `Certificate` resources are Ready. For external certificates, confirm the `CrdbCluster` references the expected names.\n\n## Certificate Debugging and Rotation Evidence\n\nUse this section when pods report `x509` errors, certificate rotation is not reflected in pods, the `cert-reloader` sidecar fails, or TSC asks for certificate evidence. Collect metadata only; do not print private keys.\n\n```bash\nkubectl -n \u003Cnamespace> get crdbcluster \u003Crelease-name> -o yaml | grep -A20 certificates\nkubectl -n \u003Cnamespace> get secret,configmap | grep -E 'ca|node|client|tls|cert|cockroach|crdb'\nkubectl -n \u003Cnamespace> get pod \u003Cpod-name> -o jsonpath='{.spec.containers[*].name}{\"\\n\"}'\nkubectl -n \u003Cnamespace> logs \u003Cpod-name> -c cert-reloader --tail=100\n```\n\nInspect the node certificate:\n\n```bash\nkubectl -n \u003Cnamespace> get secret \u003Cnode-tls-secret> -o jsonpath='{.data.tls\\.crt}' | base64 -d | \\\n  openssl x509 -noout -dates -subject -issuer -ext subjectAltName\n```\n\nInspect cert-manager resources, if cert-manager is used:\n\n```bash\nkubectl -n \u003Cnamespace> get certificate,issuer -o wide\nkubectl get clusterissuer -o wide 2>\u002Fdev\u002Fnull || true\nkubectl -n \u003Cnamespace> describe certificate \u003Ccertificate-name>\nkubectl -n \u003Cnamespace> describe issuer \u003Cissuer-name>\n```\n\nIf the CockroachDB image does not include network or OpenSSL tooling, use an approved debug image according to the customer's policy. In air-gapped environments, mirror the approved image into the customer's registry and use that registry path instead of pulling a public image directly.\n\n```bash\nkubectl -n \u003Cnamespace> debug \u003Cpod-name> --image=\u003Capproved-network-debug-image> --target=cockroachdb -it -- \\\n  openssl s_client -connect \u003Cpod-ip>:26257 \\\n    -CAfile \u002Fcockroach\u002Fcockroach-certs\u002Fca.crt \\\n    -cert \u002Fcockroach\u002Fcockroach-certs\u002Fnode.crt \\\n    -key \u002Fcockroach\u002Fcockroach-certs\u002Fnode.key\n```\n\nFor full in-pod certificate metadata:\n\n```bash\nkubectl -n \u003Cnamespace> debug \u003Cpod-name> --image=\u003Capproved-network-debug-image> --target=cockroachdb -it -- bash -c '\nfor DIR in \u002Fcockroach\u002Fcockroach-certs \u002Fcerts \u002Fcockroach-certs; do\n  if [ -d \"$DIR\" ]; then\n    echo \"=== Cert directory: $DIR ===\"\n    ls -la \"$DIR\" 2>\u002Fdev\u002Fnull\n    for CERT in \"$DIR\"\u002F*.crt; do\n      if [ -f \"$CERT\" ]; then\n        echo \"--- $CERT ---\"\n        openssl x509 -in \"$CERT\" -noout -subject -issuer -dates -ext subjectAltName 2>&1\n      fi\n    done\n  fi\ndone'\n```\n\nEscalate with [collecting-cockroachdb-operator-escalation-packet](..\u002F..\u002Fcockroachdb-observability-and-diagnostics\u002Fcollecting-cockroachdb-operator-escalation-packet\u002FSKILL.md) if certificates look correct but pods still cannot join, rotate, or become Ready.\n\n## Common TLS Failures\n\n| Symptom | Likely Cause | Action |\n|---|---|---|\n| `Exactly one of selfSigner, certManager or externalCertificates must be enabled when TLS is on` | Multiple or zero providers enabled | Set exactly one provider true |\n| `selfSigner, certManager and externalCertificates must all be disabled when TLS is off` | Provider enabled while TLS disabled | Disable all providers or enable TLS |\n| `caProvided` with empty `caSecret` | Customer CA mode missing Secret name | Set `cockroachdb.tls.selfSigner.caSecret` |\n| Pods fail with certificate trust errors | CA and issued certs do not match | Verify CA ConfigMap\u002FSecret and regenerate certs from the same CA |\n| Cert rotation does not take effect | cert-reloader sidecar issue, stale mounted Secret, or cert-manager failure | Check cert-reloader logs, cert-manager `Certificate` status, and node cert expiry\u002FSAN metadata |\n| Pods fail after migration with TLS errors | Migrated cert resources or CA names do not match operator references | Use the migration debugging skill and verify the `CrdbCluster` certificate references |\n\n## References\n\n- [Self-signer certificate management](..\u002F..\u002F..\u002Fdocs\u002Fcertificate-management\u002Fself-signer.md)\n- [cert-manager certificate management](..\u002F..\u002F..\u002Fdocs\u002Fcertificate-management\u002Fcert-manager.md)\n- [CockroachDB Helm Chart README](..\u002F..\u002F..\u002Fcockroachdb-parent\u002Fcharts\u002Fcockroachdb\u002FREADME.md)\n- [CockroachDB Docs: Authentication](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fauthentication.html)\n- [Operator escalation packet collection](..\u002F..\u002Fcockroachdb-observability-and-diagnostics\u002Fcollecting-cockroachdb-operator-escalation-packet\u002FSKILL.md)\n",{"data":34,"body":38},{"name":4,"description":6,"compatibility":35,"metadata":36},"CockroachDB Helm v2 charts. Requires Kubernetes Secret or cert-manager access for externally managed certificates. TLS mode must be chosen before initial cluster creation.",{"author":8,"version":37},"1.1",{"type":39,"children":40},"root",[41,49,72,79,117,123,203,209,232,238,343,348,354,359,526,531,704,725,730,851,857,862,1102,1107,1284,1296,1302,1307,1505,1510,1618,1623,1972,1978,1983,2105,2110,2116,2305,2325,2331,2352,2632,2637,2783,2788,2990,2995,3178,3183,3379,3393,3399,3574,3580,3629],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Configuring CockroachDB Helm TLS",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53,55,62,64,70],{"type":47,"value":54},"Guides TLS configuration for operator-managed CockroachDB clusters installed with the Helm v2 charts. The operator API receives ",{"type":42,"tag":56,"props":57,"children":59},"code",{"className":58},[],[60],{"type":47,"value":61},"externalCertificates",{"type":47,"value":63},"; the Helm chart is responsible for translating self-signer, cert-manager, or external certificate values into the ",{"type":42,"tag":56,"props":65,"children":67},{"className":66},[],[68],{"type":47,"value":69},"CrdbCluster",{"type":47,"value":71}," spec.",{"type":42,"tag":73,"props":74,"children":76},"h2",{"id":75},"when-to-use-this-skill",[77],{"type":47,"value":78},"When to Use This Skill",{"type":42,"tag":80,"props":81,"children":82},"ul",{},[83,89,102,107,112],{"type":42,"tag":84,"props":85,"children":86},"li",{},[87],{"type":47,"value":88},"A customer asks which TLS mode to use with CockroachDB Helm charts",{"type":42,"tag":84,"props":90,"children":91},{},[92,94,100],{"type":47,"value":93},"A values file needs a secure ",{"type":42,"tag":56,"props":95,"children":97},{"className":96},[],[98],{"type":47,"value":99},"cockroachdb.tls",{"type":47,"value":101}," block",{"type":42,"tag":84,"props":103,"children":104},{},[105],{"type":47,"value":106},"The install fails with chart TLS validation errors",{"type":42,"tag":84,"props":108,"children":109},{},[110],{"type":47,"value":111},"The customer already has cert-manager or externally generated certificates",{"type":42,"tag":84,"props":113,"children":114},{},[115],{"type":47,"value":116},"The customer needs to understand which Secrets and ConfigMaps the chart expects",{"type":42,"tag":73,"props":118,"children":120},{"id":119},"safety-considerations",[121],{"type":47,"value":122},"Safety Considerations",{"type":42,"tag":80,"props":124,"children":125},{},[126,139,176,188,193,198],{"type":42,"tag":84,"props":127,"children":128},{},[129,131,137],{"type":47,"value":130},"Do not change ",{"type":42,"tag":56,"props":132,"children":134},{"className":133},[],[135],{"type":47,"value":136},"cockroachdb.tls.enabled",{"type":47,"value":138}," on a running cluster.",{"type":42,"tag":84,"props":140,"children":141},{},[142,144,150,152,158,160,166,168,174],{"type":47,"value":143},"Enable exactly one of ",{"type":42,"tag":56,"props":145,"children":147},{"className":146},[],[148],{"type":47,"value":149},"selfSigner.enabled",{"type":47,"value":151},", ",{"type":42,"tag":56,"props":153,"children":155},{"className":154},[],[156],{"type":47,"value":157},"certManager.enabled",{"type":47,"value":159},", or ",{"type":42,"tag":56,"props":161,"children":163},{"className":162},[],[164],{"type":47,"value":165},"externalCertificates.enabled",{"type":47,"value":167}," when ",{"type":42,"tag":56,"props":169,"children":171},{"className":170},[],[172],{"type":47,"value":173},"cockroachdb.tls.enabled=true",{"type":47,"value":175},".",{"type":42,"tag":84,"props":177,"children":178},{},[179,181,187],{"type":47,"value":180},"Disable all three certificate providers when ",{"type":42,"tag":56,"props":182,"children":184},{"className":183},[],[185],{"type":47,"value":186},"cockroachdb.tls.enabled=false",{"type":47,"value":175},{"type":42,"tag":84,"props":189,"children":190},{},[191],{"type":47,"value":192},"For production, confirm the certificate rotation owner before install. Self-signer can rotate node\u002Fclient certs, but a customer-provided CA remains the customer's responsibility.",{"type":42,"tag":84,"props":194,"children":195},{},[196],{"type":47,"value":197},"Do not print private key contents. Only reference Secret names and required keys.",{"type":42,"tag":84,"props":199,"children":200},{},[201],{"type":47,"value":202},"For certificate rotation or trust failures on a running operator-managed cluster, collect certificate metadata and cert-reloader logs before changing Secrets, ConfigMaps, or cert-manager resources.",{"type":42,"tag":73,"props":204,"children":206},{"id":205},"execution-discipline",[207],{"type":47,"value":208},"Execution Discipline",{"type":42,"tag":80,"props":210,"children":211},{},[212,217,222,227],{"type":42,"tag":84,"props":213,"children":214},{},[215],{"type":47,"value":216},"Execute one step at a time and inspect the output before moving on. Certificate mode, Secret names, and issuer state determine which later checks are relevant.",{"type":42,"tag":84,"props":218,"children":219},{},[220],{"type":47,"value":221},"Do not change TLS mode, replace Secrets, patch cert-manager resources, run debug containers, or perform Helm upgrades unless the user explicitly approves the action for the target cluster.",{"type":42,"tag":84,"props":223,"children":224},{},[225],{"type":47,"value":226},"Never print private key data. Use metadata checks for expiry, issuer, subject, SANs, and required key presence.",{"type":42,"tag":84,"props":228,"children":229},{},[230],{"type":47,"value":231},"In production or when certificate ownership is unclear, involve TSE or the operator team before rotation, regeneration, debug containers, or restart actions.",{"type":42,"tag":73,"props":233,"children":235},{"id":234},"step-1-choose-the-tls-mode",[236],{"type":47,"value":237},"Step 1: Choose the TLS Mode",{"type":42,"tag":239,"props":240,"children":241},"table",{},[242,266],{"type":42,"tag":243,"props":244,"children":245},"thead",{},[246],{"type":42,"tag":247,"props":248,"children":249},"tr",{},[250,256,261],{"type":42,"tag":251,"props":252,"children":253},"th",{},[254],{"type":47,"value":255},"Mode",{"type":42,"tag":251,"props":257,"children":258},{},[259],{"type":47,"value":260},"Use When",{"type":42,"tag":251,"props":262,"children":263},{},[264],{"type":47,"value":265},"Required Inputs",{"type":42,"tag":267,"props":268,"children":269},"tbody",{},[270,289,307,325],{"type":42,"tag":247,"props":271,"children":272},{},[273,279,284],{"type":42,"tag":274,"props":275,"children":276},"td",{},[277],{"type":47,"value":278},"Self-signer",{"type":42,"tag":274,"props":280,"children":281},{},[282],{"type":47,"value":283},"Fastest secure install, dev\u002Ftest, or customer accepts chart-managed cert generation",{"type":42,"tag":274,"props":285,"children":286},{},[287],{"type":47,"value":288},"Optional CA Secret if customer provides CA",{"type":42,"tag":247,"props":290,"children":291},{},[292,297,302],{"type":42,"tag":274,"props":293,"children":294},{},[295],{"type":47,"value":296},"Cert-manager",{"type":42,"tag":274,"props":298,"children":299},{},[300],{"type":47,"value":301},"Customer already runs cert-manager and wants Kubernetes-native renewal",{"type":42,"tag":274,"props":303,"children":304},{},[305],{"type":47,"value":306},"Issuer or ClusterIssuer, CA ConfigMap, node Secret, root client Secret",{"type":42,"tag":247,"props":308,"children":309},{},[310,315,320],{"type":42,"tag":274,"props":311,"children":312},{},[313],{"type":47,"value":314},"External certificates",{"type":42,"tag":274,"props":316,"children":317},{},[318],{"type":47,"value":319},"Customer PKI owns all certificates and rotation",{"type":42,"tag":274,"props":321,"children":322},{},[323],{"type":47,"value":324},"CA ConfigMap, node Secret, HTTP Secret, root SQL client Secret",{"type":42,"tag":247,"props":326,"children":327},{},[328,333,338],{"type":42,"tag":274,"props":329,"children":330},{},[331],{"type":47,"value":332},"Insecure",{"type":42,"tag":274,"props":334,"children":335},{},[336],{"type":47,"value":337},"Non-production test only",{"type":42,"tag":274,"props":339,"children":340},{},[341],{"type":47,"value":342},"Explicit user confirmation",{"type":42,"tag":50,"props":344,"children":345},{},[346],{"type":47,"value":347},"If the user is unsure, default to self-signer for a first secure non-production deployment and recommend cert-manager or external certificates for production environments with existing PKI.",{"type":42,"tag":73,"props":349,"children":351},{"id":350},"self-signer-values",[352],{"type":47,"value":353},"Self-Signer Values",{"type":42,"tag":50,"props":355,"children":356},{},[357],{"type":47,"value":358},"Chart-managed CA, node certs, and root client certs:",{"type":42,"tag":360,"props":361,"children":366},"pre",{"className":362,"code":363,"language":364,"meta":365,"style":365},"language-yaml shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","cockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: true\n      rotateCerts: true\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: false\n","yaml","",[367],{"type":42,"tag":56,"props":368,"children":369},{"__ignoreMap":365},[370,387,400,420,433,450,467,480,497,510],{"type":42,"tag":371,"props":372,"children":375},"span",{"class":373,"line":374},"line",1,[376,381],{"type":42,"tag":371,"props":377,"children":379},{"style":378},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[380],{"type":47,"value":8},{"type":42,"tag":371,"props":382,"children":384},{"style":383},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[385],{"type":47,"value":386},":\n",{"type":42,"tag":371,"props":388,"children":390},{"class":373,"line":389},2,[391,396],{"type":42,"tag":371,"props":392,"children":393},{"style":378},[394],{"type":47,"value":395},"  tls",{"type":42,"tag":371,"props":397,"children":398},{"style":383},[399],{"type":47,"value":386},{"type":42,"tag":371,"props":401,"children":403},{"class":373,"line":402},3,[404,409,414],{"type":42,"tag":371,"props":405,"children":406},{"style":378},[407],{"type":47,"value":408},"    enabled",{"type":42,"tag":371,"props":410,"children":411},{"style":383},[412],{"type":47,"value":413},":",{"type":42,"tag":371,"props":415,"children":417},{"style":416},"--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC",[418],{"type":47,"value":419}," true\n",{"type":42,"tag":371,"props":421,"children":423},{"class":373,"line":422},4,[424,429],{"type":42,"tag":371,"props":425,"children":426},{"style":378},[427],{"type":47,"value":428},"    selfSigner",{"type":42,"tag":371,"props":430,"children":431},{"style":383},[432],{"type":47,"value":386},{"type":42,"tag":371,"props":434,"children":436},{"class":373,"line":435},5,[437,442,446],{"type":42,"tag":371,"props":438,"children":439},{"style":378},[440],{"type":47,"value":441},"      enabled",{"type":42,"tag":371,"props":443,"children":444},{"style":383},[445],{"type":47,"value":413},{"type":42,"tag":371,"props":447,"children":448},{"style":416},[449],{"type":47,"value":419},{"type":42,"tag":371,"props":451,"children":453},{"class":373,"line":452},6,[454,459,463],{"type":42,"tag":371,"props":455,"children":456},{"style":378},[457],{"type":47,"value":458},"      rotateCerts",{"type":42,"tag":371,"props":460,"children":461},{"style":383},[462],{"type":47,"value":413},{"type":42,"tag":371,"props":464,"children":465},{"style":416},[466],{"type":47,"value":419},{"type":42,"tag":371,"props":468,"children":470},{"class":373,"line":469},7,[471,476],{"type":42,"tag":371,"props":472,"children":473},{"style":378},[474],{"type":47,"value":475},"    certManager",{"type":42,"tag":371,"props":477,"children":478},{"style":383},[479],{"type":47,"value":386},{"type":42,"tag":371,"props":481,"children":483},{"class":373,"line":482},8,[484,488,492],{"type":42,"tag":371,"props":485,"children":486},{"style":378},[487],{"type":47,"value":441},{"type":42,"tag":371,"props":489,"children":490},{"style":383},[491],{"type":47,"value":413},{"type":42,"tag":371,"props":493,"children":494},{"style":416},[495],{"type":47,"value":496}," false\n",{"type":42,"tag":371,"props":498,"children":500},{"class":373,"line":499},9,[501,506],{"type":42,"tag":371,"props":502,"children":503},{"style":378},[504],{"type":47,"value":505},"    externalCertificates",{"type":42,"tag":371,"props":507,"children":508},{"style":383},[509],{"type":47,"value":386},{"type":42,"tag":371,"props":511,"children":513},{"class":373,"line":512},10,[514,518,522],{"type":42,"tag":371,"props":515,"children":516},{"style":378},[517],{"type":47,"value":441},{"type":42,"tag":371,"props":519,"children":520},{"style":383},[521],{"type":47,"value":413},{"type":42,"tag":371,"props":523,"children":524},{"style":416},[525],{"type":47,"value":496},{"type":42,"tag":50,"props":527,"children":528},{},[529],{"type":47,"value":530},"Customer-provided CA with chart-generated node and client certs:",{"type":42,"tag":360,"props":532,"children":534},{"className":362,"code":533,"language":364,"meta":365,"style":365},"cockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: true\n      caProvided: true\n      caSecret: custom-ca-secret\n      rotateCerts: true\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: false\n",[535],{"type":42,"tag":56,"props":536,"children":537},{"__ignoreMap":365},[538,549,560,575,586,601,617,635,650,661,676,688],{"type":42,"tag":371,"props":539,"children":540},{"class":373,"line":374},[541,545],{"type":42,"tag":371,"props":542,"children":543},{"style":378},[544],{"type":47,"value":8},{"type":42,"tag":371,"props":546,"children":547},{"style":383},[548],{"type":47,"value":386},{"type":42,"tag":371,"props":550,"children":551},{"class":373,"line":389},[552,556],{"type":42,"tag":371,"props":553,"children":554},{"style":378},[555],{"type":47,"value":395},{"type":42,"tag":371,"props":557,"children":558},{"style":383},[559],{"type":47,"value":386},{"type":42,"tag":371,"props":561,"children":562},{"class":373,"line":402},[563,567,571],{"type":42,"tag":371,"props":564,"children":565},{"style":378},[566],{"type":47,"value":408},{"type":42,"tag":371,"props":568,"children":569},{"style":383},[570],{"type":47,"value":413},{"type":42,"tag":371,"props":572,"children":573},{"style":416},[574],{"type":47,"value":419},{"type":42,"tag":371,"props":576,"children":577},{"class":373,"line":422},[578,582],{"type":42,"tag":371,"props":579,"children":580},{"style":378},[581],{"type":47,"value":428},{"type":42,"tag":371,"props":583,"children":584},{"style":383},[585],{"type":47,"value":386},{"type":42,"tag":371,"props":587,"children":588},{"class":373,"line":435},[589,593,597],{"type":42,"tag":371,"props":590,"children":591},{"style":378},[592],{"type":47,"value":441},{"type":42,"tag":371,"props":594,"children":595},{"style":383},[596],{"type":47,"value":413},{"type":42,"tag":371,"props":598,"children":599},{"style":416},[600],{"type":47,"value":419},{"type":42,"tag":371,"props":602,"children":603},{"class":373,"line":452},[604,609,613],{"type":42,"tag":371,"props":605,"children":606},{"style":378},[607],{"type":47,"value":608},"      caProvided",{"type":42,"tag":371,"props":610,"children":611},{"style":383},[612],{"type":47,"value":413},{"type":42,"tag":371,"props":614,"children":615},{"style":416},[616],{"type":47,"value":419},{"type":42,"tag":371,"props":618,"children":619},{"class":373,"line":469},[620,625,629],{"type":42,"tag":371,"props":621,"children":622},{"style":378},[623],{"type":47,"value":624},"      caSecret",{"type":42,"tag":371,"props":626,"children":627},{"style":383},[628],{"type":47,"value":413},{"type":42,"tag":371,"props":630,"children":632},{"style":631},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[633],{"type":47,"value":634}," custom-ca-secret\n",{"type":42,"tag":371,"props":636,"children":637},{"class":373,"line":482},[638,642,646],{"type":42,"tag":371,"props":639,"children":640},{"style":378},[641],{"type":47,"value":458},{"type":42,"tag":371,"props":643,"children":644},{"style":383},[645],{"type":47,"value":413},{"type":42,"tag":371,"props":647,"children":648},{"style":416},[649],{"type":47,"value":419},{"type":42,"tag":371,"props":651,"children":652},{"class":373,"line":499},[653,657],{"type":42,"tag":371,"props":654,"children":655},{"style":378},[656],{"type":47,"value":475},{"type":42,"tag":371,"props":658,"children":659},{"style":383},[660],{"type":47,"value":386},{"type":42,"tag":371,"props":662,"children":663},{"class":373,"line":512},[664,668,672],{"type":42,"tag":371,"props":665,"children":666},{"style":378},[667],{"type":47,"value":441},{"type":42,"tag":371,"props":669,"children":670},{"style":383},[671],{"type":47,"value":413},{"type":42,"tag":371,"props":673,"children":674},{"style":416},[675],{"type":47,"value":496},{"type":42,"tag":371,"props":677,"children":679},{"class":373,"line":678},11,[680,684],{"type":42,"tag":371,"props":681,"children":682},{"style":378},[683],{"type":47,"value":505},{"type":42,"tag":371,"props":685,"children":686},{"style":383},[687],{"type":47,"value":386},{"type":42,"tag":371,"props":689,"children":691},{"class":373,"line":690},12,[692,696,700],{"type":42,"tag":371,"props":693,"children":694},{"style":378},[695],{"type":47,"value":441},{"type":42,"tag":371,"props":697,"children":698},{"style":383},[699],{"type":47,"value":413},{"type":42,"tag":371,"props":701,"children":702},{"style":416},[703],{"type":47,"value":496},{"type":42,"tag":50,"props":705,"children":706},{},[707,709,715,717,723],{"type":47,"value":708},"The CA Secret must contain ",{"type":42,"tag":56,"props":710,"children":712},{"className":711},[],[713],{"type":47,"value":714},"ca.crt",{"type":47,"value":716}," and ",{"type":42,"tag":56,"props":718,"children":720},{"className":719},[],[721],{"type":47,"value":722},"ca.key",{"type":47,"value":724}," in the CockroachDB namespace before install.",{"type":42,"tag":50,"props":726,"children":727},{},[728],{"type":47,"value":729},"Validate:",{"type":42,"tag":360,"props":731,"children":735},{"className":732,"code":733,"language":734,"meta":365,"style":365},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","kubectl -n \u003Cnamespace> get secret custom-ca-secret\nhelm template crdb .\u002Fcockroachdb-parent\u002Fcharts\u002Fcockroachdb -n \u003Cnamespace> -f values.yaml >\u002Ftmp\u002Fcrdb-rendered.yaml\n","bash",[736],{"type":42,"tag":56,"props":737,"children":738},{"__ignoreMap":365},[739,788],{"type":42,"tag":371,"props":740,"children":741},{"class":373,"line":374},[742,748,753,758,763,769,774,779,784],{"type":42,"tag":371,"props":743,"children":745},{"style":744},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[746],{"type":47,"value":747},"kubectl",{"type":42,"tag":371,"props":749,"children":750},{"style":631},[751],{"type":47,"value":752}," -n",{"type":42,"tag":371,"props":754,"children":755},{"style":383},[756],{"type":47,"value":757}," \u003C",{"type":42,"tag":371,"props":759,"children":760},{"style":631},[761],{"type":47,"value":762},"namespac",{"type":42,"tag":371,"props":764,"children":766},{"style":765},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[767],{"type":47,"value":768},"e",{"type":42,"tag":371,"props":770,"children":771},{"style":383},[772],{"type":47,"value":773},">",{"type":42,"tag":371,"props":775,"children":776},{"style":631},[777],{"type":47,"value":778}," get",{"type":42,"tag":371,"props":780,"children":781},{"style":631},[782],{"type":47,"value":783}," secret",{"type":42,"tag":371,"props":785,"children":786},{"style":631},[787],{"type":47,"value":634},{"type":42,"tag":371,"props":789,"children":790},{"class":373,"line":389},[791,796,801,806,811,815,819,823,827,831,836,841,846],{"type":42,"tag":371,"props":792,"children":793},{"style":744},[794],{"type":47,"value":795},"helm",{"type":42,"tag":371,"props":797,"children":798},{"style":631},[799],{"type":47,"value":800}," template",{"type":42,"tag":371,"props":802,"children":803},{"style":631},[804],{"type":47,"value":805}," crdb",{"type":42,"tag":371,"props":807,"children":808},{"style":631},[809],{"type":47,"value":810}," .\u002Fcockroachdb-parent\u002Fcharts\u002Fcockroachdb",{"type":42,"tag":371,"props":812,"children":813},{"style":631},[814],{"type":47,"value":752},{"type":42,"tag":371,"props":816,"children":817},{"style":383},[818],{"type":47,"value":757},{"type":42,"tag":371,"props":820,"children":821},{"style":631},[822],{"type":47,"value":762},{"type":42,"tag":371,"props":824,"children":825},{"style":765},[826],{"type":47,"value":768},{"type":42,"tag":371,"props":828,"children":829},{"style":383},[830],{"type":47,"value":773},{"type":42,"tag":371,"props":832,"children":833},{"style":631},[834],{"type":47,"value":835}," -f",{"type":42,"tag":371,"props":837,"children":838},{"style":631},[839],{"type":47,"value":840}," values.yaml",{"type":42,"tag":371,"props":842,"children":843},{"style":383},[844],{"type":47,"value":845}," >",{"type":42,"tag":371,"props":847,"children":848},{"style":631},[849],{"type":47,"value":850},"\u002Ftmp\u002Fcrdb-rendered.yaml\n",{"type":42,"tag":73,"props":852,"children":854},{"id":853},"cert-manager-values",[855],{"type":47,"value":856},"Cert-Manager Values",{"type":42,"tag":50,"props":858,"children":859},{},[860],{"type":47,"value":861},"Use cert-manager when an Issuer or ClusterIssuer can issue CockroachDB node and root client certificates.",{"type":42,"tag":360,"props":863,"children":865},{"className":362,"code":864,"language":364,"meta":365,"style":365},"cockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: false\n    certManager:\n      enabled: true\n      caConfigMap: cockroachdb-ca\n      nodeSecret: cockroachdb-node\n      clientRootSecret: cockroachdb-root\n      issuer:\n        group: cert-manager.io\n        kind: Issuer\n        name: cockroachdb\n    externalCertificates:\n      enabled: false\n",[866],{"type":42,"tag":56,"props":867,"children":868},{"__ignoreMap":365},[869,880,891,906,917,932,943,958,975,992,1009,1021,1038,1056,1074,1086],{"type":42,"tag":371,"props":870,"children":871},{"class":373,"line":374},[872,876],{"type":42,"tag":371,"props":873,"children":874},{"style":378},[875],{"type":47,"value":8},{"type":42,"tag":371,"props":877,"children":878},{"style":383},[879],{"type":47,"value":386},{"type":42,"tag":371,"props":881,"children":882},{"class":373,"line":389},[883,887],{"type":42,"tag":371,"props":884,"children":885},{"style":378},[886],{"type":47,"value":395},{"type":42,"tag":371,"props":888,"children":889},{"style":383},[890],{"type":47,"value":386},{"type":42,"tag":371,"props":892,"children":893},{"class":373,"line":402},[894,898,902],{"type":42,"tag":371,"props":895,"children":896},{"style":378},[897],{"type":47,"value":408},{"type":42,"tag":371,"props":899,"children":900},{"style":383},[901],{"type":47,"value":413},{"type":42,"tag":371,"props":903,"children":904},{"style":416},[905],{"type":47,"value":419},{"type":42,"tag":371,"props":907,"children":908},{"class":373,"line":422},[909,913],{"type":42,"tag":371,"props":910,"children":911},{"style":378},[912],{"type":47,"value":428},{"type":42,"tag":371,"props":914,"children":915},{"style":383},[916],{"type":47,"value":386},{"type":42,"tag":371,"props":918,"children":919},{"class":373,"line":435},[920,924,928],{"type":42,"tag":371,"props":921,"children":922},{"style":378},[923],{"type":47,"value":441},{"type":42,"tag":371,"props":925,"children":926},{"style":383},[927],{"type":47,"value":413},{"type":42,"tag":371,"props":929,"children":930},{"style":416},[931],{"type":47,"value":496},{"type":42,"tag":371,"props":933,"children":934},{"class":373,"line":452},[935,939],{"type":42,"tag":371,"props":936,"children":937},{"style":378},[938],{"type":47,"value":475},{"type":42,"tag":371,"props":940,"children":941},{"style":383},[942],{"type":47,"value":386},{"type":42,"tag":371,"props":944,"children":945},{"class":373,"line":469},[946,950,954],{"type":42,"tag":371,"props":947,"children":948},{"style":378},[949],{"type":47,"value":441},{"type":42,"tag":371,"props":951,"children":952},{"style":383},[953],{"type":47,"value":413},{"type":42,"tag":371,"props":955,"children":956},{"style":416},[957],{"type":47,"value":419},{"type":42,"tag":371,"props":959,"children":960},{"class":373,"line":482},[961,966,970],{"type":42,"tag":371,"props":962,"children":963},{"style":378},[964],{"type":47,"value":965},"      caConfigMap",{"type":42,"tag":371,"props":967,"children":968},{"style":383},[969],{"type":47,"value":413},{"type":42,"tag":371,"props":971,"children":972},{"style":631},[973],{"type":47,"value":974}," cockroachdb-ca\n",{"type":42,"tag":371,"props":976,"children":977},{"class":373,"line":499},[978,983,987],{"type":42,"tag":371,"props":979,"children":980},{"style":378},[981],{"type":47,"value":982},"      nodeSecret",{"type":42,"tag":371,"props":984,"children":985},{"style":383},[986],{"type":47,"value":413},{"type":42,"tag":371,"props":988,"children":989},{"style":631},[990],{"type":47,"value":991}," cockroachdb-node\n",{"type":42,"tag":371,"props":993,"children":994},{"class":373,"line":512},[995,1000,1004],{"type":42,"tag":371,"props":996,"children":997},{"style":378},[998],{"type":47,"value":999},"      clientRootSecret",{"type":42,"tag":371,"props":1001,"children":1002},{"style":383},[1003],{"type":47,"value":413},{"type":42,"tag":371,"props":1005,"children":1006},{"style":631},[1007],{"type":47,"value":1008}," cockroachdb-root\n",{"type":42,"tag":371,"props":1010,"children":1011},{"class":373,"line":678},[1012,1017],{"type":42,"tag":371,"props":1013,"children":1014},{"style":378},[1015],{"type":47,"value":1016},"      issuer",{"type":42,"tag":371,"props":1018,"children":1019},{"style":383},[1020],{"type":47,"value":386},{"type":42,"tag":371,"props":1022,"children":1023},{"class":373,"line":690},[1024,1029,1033],{"type":42,"tag":371,"props":1025,"children":1026},{"style":378},[1027],{"type":47,"value":1028},"        group",{"type":42,"tag":371,"props":1030,"children":1031},{"style":383},[1032],{"type":47,"value":413},{"type":42,"tag":371,"props":1034,"children":1035},{"style":631},[1036],{"type":47,"value":1037}," cert-manager.io\n",{"type":42,"tag":371,"props":1039,"children":1041},{"class":373,"line":1040},13,[1042,1047,1051],{"type":42,"tag":371,"props":1043,"children":1044},{"style":378},[1045],{"type":47,"value":1046},"        kind",{"type":42,"tag":371,"props":1048,"children":1049},{"style":383},[1050],{"type":47,"value":413},{"type":42,"tag":371,"props":1052,"children":1053},{"style":631},[1054],{"type":47,"value":1055}," Issuer\n",{"type":42,"tag":371,"props":1057,"children":1059},{"class":373,"line":1058},14,[1060,1065,1069],{"type":42,"tag":371,"props":1061,"children":1062},{"style":378},[1063],{"type":47,"value":1064},"        name",{"type":42,"tag":371,"props":1066,"children":1067},{"style":383},[1068],{"type":47,"value":413},{"type":42,"tag":371,"props":1070,"children":1071},{"style":631},[1072],{"type":47,"value":1073}," cockroachdb\n",{"type":42,"tag":371,"props":1075,"children":1077},{"class":373,"line":1076},15,[1078,1082],{"type":42,"tag":371,"props":1079,"children":1080},{"style":378},[1081],{"type":47,"value":505},{"type":42,"tag":371,"props":1083,"children":1084},{"style":383},[1085],{"type":47,"value":386},{"type":42,"tag":371,"props":1087,"children":1089},{"class":373,"line":1088},16,[1090,1094,1098],{"type":42,"tag":371,"props":1091,"children":1092},{"style":378},[1093],{"type":47,"value":441},{"type":42,"tag":371,"props":1095,"children":1096},{"style":383},[1097],{"type":47,"value":413},{"type":42,"tag":371,"props":1099,"children":1100},{"style":416},[1101],{"type":47,"value":496},{"type":42,"tag":50,"props":1103,"children":1104},{},[1105],{"type":47,"value":1106},"Preflight:",{"type":42,"tag":360,"props":1108,"children":1110},{"className":732,"code":1109,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> get issuer cockroachdb\nkubectl -n \u003Cnamespace> get configmap cockroachdb-ca || true\nkubectl -n \u003Cnamespace> get secret cockroachdb-node cockroachdb-root || true\nkubectl get crd certificates.cert-manager.io issuers.cert-manager.io\n",[1111],{"type":42,"tag":56,"props":1112,"children":1113},{"__ignoreMap":365},[1114,1154,1205,1258],{"type":42,"tag":371,"props":1115,"children":1116},{"class":373,"line":374},[1117,1121,1125,1129,1133,1137,1141,1145,1150],{"type":42,"tag":371,"props":1118,"children":1119},{"style":744},[1120],{"type":47,"value":747},{"type":42,"tag":371,"props":1122,"children":1123},{"style":631},[1124],{"type":47,"value":752},{"type":42,"tag":371,"props":1126,"children":1127},{"style":383},[1128],{"type":47,"value":757},{"type":42,"tag":371,"props":1130,"children":1131},{"style":631},[1132],{"type":47,"value":762},{"type":42,"tag":371,"props":1134,"children":1135},{"style":765},[1136],{"type":47,"value":768},{"type":42,"tag":371,"props":1138,"children":1139},{"style":383},[1140],{"type":47,"value":773},{"type":42,"tag":371,"props":1142,"children":1143},{"style":631},[1144],{"type":47,"value":778},{"type":42,"tag":371,"props":1146,"children":1147},{"style":631},[1148],{"type":47,"value":1149}," issuer",{"type":42,"tag":371,"props":1151,"children":1152},{"style":631},[1153],{"type":47,"value":1073},{"type":42,"tag":371,"props":1155,"children":1156},{"class":373,"line":389},[1157,1161,1165,1169,1173,1177,1181,1185,1190,1195,1200],{"type":42,"tag":371,"props":1158,"children":1159},{"style":744},[1160],{"type":47,"value":747},{"type":42,"tag":371,"props":1162,"children":1163},{"style":631},[1164],{"type":47,"value":752},{"type":42,"tag":371,"props":1166,"children":1167},{"style":383},[1168],{"type":47,"value":757},{"type":42,"tag":371,"props":1170,"children":1171},{"style":631},[1172],{"type":47,"value":762},{"type":42,"tag":371,"props":1174,"children":1175},{"style":765},[1176],{"type":47,"value":768},{"type":42,"tag":371,"props":1178,"children":1179},{"style":383},[1180],{"type":47,"value":773},{"type":42,"tag":371,"props":1182,"children":1183},{"style":631},[1184],{"type":47,"value":778},{"type":42,"tag":371,"props":1186,"children":1187},{"style":631},[1188],{"type":47,"value":1189}," configmap",{"type":42,"tag":371,"props":1191,"children":1192},{"style":631},[1193],{"type":47,"value":1194}," cockroachdb-ca",{"type":42,"tag":371,"props":1196,"children":1197},{"style":383},[1198],{"type":47,"value":1199}," ||",{"type":42,"tag":371,"props":1201,"children":1203},{"style":1202},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[1204],{"type":47,"value":419},{"type":42,"tag":371,"props":1206,"children":1207},{"class":373,"line":402},[1208,1212,1216,1220,1224,1228,1232,1236,1240,1245,1250,1254],{"type":42,"tag":371,"props":1209,"children":1210},{"style":744},[1211],{"type":47,"value":747},{"type":42,"tag":371,"props":1213,"children":1214},{"style":631},[1215],{"type":47,"value":752},{"type":42,"tag":371,"props":1217,"children":1218},{"style":383},[1219],{"type":47,"value":757},{"type":42,"tag":371,"props":1221,"children":1222},{"style":631},[1223],{"type":47,"value":762},{"type":42,"tag":371,"props":1225,"children":1226},{"style":765},[1227],{"type":47,"value":768},{"type":42,"tag":371,"props":1229,"children":1230},{"style":383},[1231],{"type":47,"value":773},{"type":42,"tag":371,"props":1233,"children":1234},{"style":631},[1235],{"type":47,"value":778},{"type":42,"tag":371,"props":1237,"children":1238},{"style":631},[1239],{"type":47,"value":783},{"type":42,"tag":371,"props":1241,"children":1242},{"style":631},[1243],{"type":47,"value":1244}," cockroachdb-node",{"type":42,"tag":371,"props":1246,"children":1247},{"style":631},[1248],{"type":47,"value":1249}," cockroachdb-root",{"type":42,"tag":371,"props":1251,"children":1252},{"style":383},[1253],{"type":47,"value":1199},{"type":42,"tag":371,"props":1255,"children":1256},{"style":1202},[1257],{"type":47,"value":419},{"type":42,"tag":371,"props":1259,"children":1260},{"class":373,"line":422},[1261,1265,1269,1274,1279],{"type":42,"tag":371,"props":1262,"children":1263},{"style":744},[1264],{"type":47,"value":747},{"type":42,"tag":371,"props":1266,"children":1267},{"style":631},[1268],{"type":47,"value":778},{"type":42,"tag":371,"props":1270,"children":1271},{"style":631},[1272],{"type":47,"value":1273}," crd",{"type":42,"tag":371,"props":1275,"children":1276},{"style":631},[1277],{"type":47,"value":1278}," certificates.cert-manager.io",{"type":42,"tag":371,"props":1280,"children":1281},{"style":631},[1282],{"type":47,"value":1283}," issuers.cert-manager.io\n",{"type":42,"tag":50,"props":1285,"children":1286},{},[1287,1289,1294],{"type":47,"value":1288},"If cert-manager stores CA material in a Secret but the chart needs a ConfigMap, configure trust-manager or another approved process to publish ",{"type":42,"tag":56,"props":1290,"children":1292},{"className":1291},[],[1293],{"type":47,"value":714},{"type":47,"value":1295}," into the namespace.",{"type":42,"tag":73,"props":1297,"children":1299},{"id":1298},"external-certificate-values",[1300],{"type":47,"value":1301},"External Certificate Values",{"type":42,"tag":50,"props":1303,"children":1304},{},[1305],{"type":47,"value":1306},"Use external certificates when the customer has already generated Kubernetes resources with the names the operator expects:",{"type":42,"tag":360,"props":1308,"children":1310},{"className":362,"code":1309,"language":364,"meta":365,"style":365},"cockroachdb:\n  tls:\n    enabled: true\n    selfSigner:\n      enabled: false\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: true\n      certificates:\n        caConfigMapName: cockroachdb-ca\n        nodeSecretName: cockroachdb-node\n        httpSecretName: cockroachdb-node\n        rootSqlClientSecretName: cockroachdb-root\n",[1311],{"type":42,"tag":56,"props":1312,"children":1313},{"__ignoreMap":365},[1314,1325,1336,1351,1362,1377,1388,1403,1414,1429,1441,1457,1473,1489],{"type":42,"tag":371,"props":1315,"children":1316},{"class":373,"line":374},[1317,1321],{"type":42,"tag":371,"props":1318,"children":1319},{"style":378},[1320],{"type":47,"value":8},{"type":42,"tag":371,"props":1322,"children":1323},{"style":383},[1324],{"type":47,"value":386},{"type":42,"tag":371,"props":1326,"children":1327},{"class":373,"line":389},[1328,1332],{"type":42,"tag":371,"props":1329,"children":1330},{"style":378},[1331],{"type":47,"value":395},{"type":42,"tag":371,"props":1333,"children":1334},{"style":383},[1335],{"type":47,"value":386},{"type":42,"tag":371,"props":1337,"children":1338},{"class":373,"line":402},[1339,1343,1347],{"type":42,"tag":371,"props":1340,"children":1341},{"style":378},[1342],{"type":47,"value":408},{"type":42,"tag":371,"props":1344,"children":1345},{"style":383},[1346],{"type":47,"value":413},{"type":42,"tag":371,"props":1348,"children":1349},{"style":416},[1350],{"type":47,"value":419},{"type":42,"tag":371,"props":1352,"children":1353},{"class":373,"line":422},[1354,1358],{"type":42,"tag":371,"props":1355,"children":1356},{"style":378},[1357],{"type":47,"value":428},{"type":42,"tag":371,"props":1359,"children":1360},{"style":383},[1361],{"type":47,"value":386},{"type":42,"tag":371,"props":1363,"children":1364},{"class":373,"line":435},[1365,1369,1373],{"type":42,"tag":371,"props":1366,"children":1367},{"style":378},[1368],{"type":47,"value":441},{"type":42,"tag":371,"props":1370,"children":1371},{"style":383},[1372],{"type":47,"value":413},{"type":42,"tag":371,"props":1374,"children":1375},{"style":416},[1376],{"type":47,"value":496},{"type":42,"tag":371,"props":1378,"children":1379},{"class":373,"line":452},[1380,1384],{"type":42,"tag":371,"props":1381,"children":1382},{"style":378},[1383],{"type":47,"value":475},{"type":42,"tag":371,"props":1385,"children":1386},{"style":383},[1387],{"type":47,"value":386},{"type":42,"tag":371,"props":1389,"children":1390},{"class":373,"line":469},[1391,1395,1399],{"type":42,"tag":371,"props":1392,"children":1393},{"style":378},[1394],{"type":47,"value":441},{"type":42,"tag":371,"props":1396,"children":1397},{"style":383},[1398],{"type":47,"value":413},{"type":42,"tag":371,"props":1400,"children":1401},{"style":416},[1402],{"type":47,"value":496},{"type":42,"tag":371,"props":1404,"children":1405},{"class":373,"line":482},[1406,1410],{"type":42,"tag":371,"props":1407,"children":1408},{"style":378},[1409],{"type":47,"value":505},{"type":42,"tag":371,"props":1411,"children":1412},{"style":383},[1413],{"type":47,"value":386},{"type":42,"tag":371,"props":1415,"children":1416},{"class":373,"line":499},[1417,1421,1425],{"type":42,"tag":371,"props":1418,"children":1419},{"style":378},[1420],{"type":47,"value":441},{"type":42,"tag":371,"props":1422,"children":1423},{"style":383},[1424],{"type":47,"value":413},{"type":42,"tag":371,"props":1426,"children":1427},{"style":416},[1428],{"type":47,"value":419},{"type":42,"tag":371,"props":1430,"children":1431},{"class":373,"line":512},[1432,1437],{"type":42,"tag":371,"props":1433,"children":1434},{"style":378},[1435],{"type":47,"value":1436},"      certificates",{"type":42,"tag":371,"props":1438,"children":1439},{"style":383},[1440],{"type":47,"value":386},{"type":42,"tag":371,"props":1442,"children":1443},{"class":373,"line":678},[1444,1449,1453],{"type":42,"tag":371,"props":1445,"children":1446},{"style":378},[1447],{"type":47,"value":1448},"        caConfigMapName",{"type":42,"tag":371,"props":1450,"children":1451},{"style":383},[1452],{"type":47,"value":413},{"type":42,"tag":371,"props":1454,"children":1455},{"style":631},[1456],{"type":47,"value":974},{"type":42,"tag":371,"props":1458,"children":1459},{"class":373,"line":690},[1460,1465,1469],{"type":42,"tag":371,"props":1461,"children":1462},{"style":378},[1463],{"type":47,"value":1464},"        nodeSecretName",{"type":42,"tag":371,"props":1466,"children":1467},{"style":383},[1468],{"type":47,"value":413},{"type":42,"tag":371,"props":1470,"children":1471},{"style":631},[1472],{"type":47,"value":991},{"type":42,"tag":371,"props":1474,"children":1475},{"class":373,"line":1040},[1476,1481,1485],{"type":42,"tag":371,"props":1477,"children":1478},{"style":378},[1479],{"type":47,"value":1480},"        httpSecretName",{"type":42,"tag":371,"props":1482,"children":1483},{"style":383},[1484],{"type":47,"value":413},{"type":42,"tag":371,"props":1486,"children":1487},{"style":631},[1488],{"type":47,"value":991},{"type":42,"tag":371,"props":1490,"children":1491},{"class":373,"line":1058},[1492,1497,1501],{"type":42,"tag":371,"props":1493,"children":1494},{"style":378},[1495],{"type":47,"value":1496},"        rootSqlClientSecretName",{"type":42,"tag":371,"props":1498,"children":1499},{"style":383},[1500],{"type":47,"value":413},{"type":42,"tag":371,"props":1502,"children":1503},{"style":631},[1504],{"type":47,"value":1008},{"type":42,"tag":50,"props":1506,"children":1507},{},[1508],{"type":47,"value":1509},"Expected data keys:",{"type":42,"tag":239,"props":1511,"children":1512},{},[1513,1529],{"type":42,"tag":243,"props":1514,"children":1515},{},[1516],{"type":42,"tag":247,"props":1517,"children":1518},{},[1519,1524],{"type":42,"tag":251,"props":1520,"children":1521},{},[1522],{"type":47,"value":1523},"Resource",{"type":42,"tag":251,"props":1525,"children":1526},{},[1527],{"type":47,"value":1528},"Required Keys",{"type":42,"tag":267,"props":1530,"children":1531},{},[1532,1548,1572,1594],{"type":42,"tag":247,"props":1533,"children":1534},{},[1535,1540],{"type":42,"tag":274,"props":1536,"children":1537},{},[1538],{"type":47,"value":1539},"CA ConfigMap",{"type":42,"tag":274,"props":1541,"children":1542},{},[1543],{"type":42,"tag":56,"props":1544,"children":1546},{"className":1545},[],[1547],{"type":47,"value":714},{"type":42,"tag":247,"props":1549,"children":1550},{},[1551,1556],{"type":42,"tag":274,"props":1552,"children":1553},{},[1554],{"type":47,"value":1555},"Node TLS Secret",{"type":42,"tag":274,"props":1557,"children":1558},{},[1559,1565,1566],{"type":42,"tag":56,"props":1560,"children":1562},{"className":1561},[],[1563],{"type":47,"value":1564},"tls.crt",{"type":47,"value":151},{"type":42,"tag":56,"props":1567,"children":1569},{"className":1568},[],[1570],{"type":47,"value":1571},"tls.key",{"type":42,"tag":247,"props":1573,"children":1574},{},[1575,1580],{"type":42,"tag":274,"props":1576,"children":1577},{},[1578],{"type":47,"value":1579},"HTTP TLS Secret",{"type":42,"tag":274,"props":1581,"children":1582},{},[1583,1588,1589],{"type":42,"tag":56,"props":1584,"children":1586},{"className":1585},[],[1587],{"type":47,"value":1564},{"type":47,"value":151},{"type":42,"tag":56,"props":1590,"children":1592},{"className":1591},[],[1593],{"type":47,"value":1571},{"type":42,"tag":247,"props":1595,"children":1596},{},[1597,1602],{"type":42,"tag":274,"props":1598,"children":1599},{},[1600],{"type":47,"value":1601},"Root SQL client Secret",{"type":42,"tag":274,"props":1603,"children":1604},{},[1605,1610,1611,1616],{"type":42,"tag":56,"props":1606,"children":1608},{"className":1607},[],[1609],{"type":47,"value":1564},{"type":47,"value":151},{"type":42,"tag":56,"props":1612,"children":1614},{"className":1613},[],[1615],{"type":47,"value":1571},{"type":47,"value":1617}," or chart-compatible root client cert keys",{"type":42,"tag":50,"props":1619,"children":1620},{},[1621],{"type":47,"value":1622},"Validate names and keys without printing secret values:",{"type":42,"tag":360,"props":1624,"children":1626},{"className":732,"code":1625,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> get configmap cockroachdb-ca -o jsonpath='{.data.ca\\.crt}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-node -o jsonpath='{.data.tls\\.crt}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-node -o jsonpath='{.data.tls\\.key}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-root -o jsonpath='{.data.tls\\.crt}' >\u002Fdev\u002Fnull\nkubectl -n \u003Cnamespace> get secret cockroachdb-root -o jsonpath='{.data.tls\\.key}' >\u002Fdev\u002Fnull\n",[1627],{"type":42,"tag":56,"props":1628,"children":1629},{"__ignoreMap":365},[1630,1702,1770,1838,1905],{"type":42,"tag":371,"props":1631,"children":1632},{"class":373,"line":374},[1633,1637,1641,1645,1649,1653,1657,1661,1665,1669,1674,1679,1684,1689,1693,1697],{"type":42,"tag":371,"props":1634,"children":1635},{"style":744},[1636],{"type":47,"value":747},{"type":42,"tag":371,"props":1638,"children":1639},{"style":631},[1640],{"type":47,"value":752},{"type":42,"tag":371,"props":1642,"children":1643},{"style":383},[1644],{"type":47,"value":757},{"type":42,"tag":371,"props":1646,"children":1647},{"style":631},[1648],{"type":47,"value":762},{"type":42,"tag":371,"props":1650,"children":1651},{"style":765},[1652],{"type":47,"value":768},{"type":42,"tag":371,"props":1654,"children":1655},{"style":383},[1656],{"type":47,"value":773},{"type":42,"tag":371,"props":1658,"children":1659},{"style":631},[1660],{"type":47,"value":778},{"type":42,"tag":371,"props":1662,"children":1663},{"style":631},[1664],{"type":47,"value":1189},{"type":42,"tag":371,"props":1666,"children":1667},{"style":631},[1668],{"type":47,"value":1194},{"type":42,"tag":371,"props":1670,"children":1671},{"style":631},[1672],{"type":47,"value":1673}," -o",{"type":42,"tag":371,"props":1675,"children":1676},{"style":631},[1677],{"type":47,"value":1678}," jsonpath=",{"type":42,"tag":371,"props":1680,"children":1681},{"style":383},[1682],{"type":47,"value":1683},"'",{"type":42,"tag":371,"props":1685,"children":1686},{"style":631},[1687],{"type":47,"value":1688},"{.data.ca\\.crt}",{"type":42,"tag":371,"props":1690,"children":1691},{"style":383},[1692],{"type":47,"value":1683},{"type":42,"tag":371,"props":1694,"children":1695},{"style":383},[1696],{"type":47,"value":845},{"type":42,"tag":371,"props":1698,"children":1699},{"style":631},[1700],{"type":47,"value":1701},"\u002Fdev\u002Fnull\n",{"type":42,"tag":371,"props":1703,"children":1704},{"class":373,"line":389},[1705,1709,1713,1717,1721,1725,1729,1733,1737,1741,1745,1749,1753,1758,1762,1766],{"type":42,"tag":371,"props":1706,"children":1707},{"style":744},[1708],{"type":47,"value":747},{"type":42,"tag":371,"props":1710,"children":1711},{"style":631},[1712],{"type":47,"value":752},{"type":42,"tag":371,"props":1714,"children":1715},{"style":383},[1716],{"type":47,"value":757},{"type":42,"tag":371,"props":1718,"children":1719},{"style":631},[1720],{"type":47,"value":762},{"type":42,"tag":371,"props":1722,"children":1723},{"style":765},[1724],{"type":47,"value":768},{"type":42,"tag":371,"props":1726,"children":1727},{"style":383},[1728],{"type":47,"value":773},{"type":42,"tag":371,"props":1730,"children":1731},{"style":631},[1732],{"type":47,"value":778},{"type":42,"tag":371,"props":1734,"children":1735},{"style":631},[1736],{"type":47,"value":783},{"type":42,"tag":371,"props":1738,"children":1739},{"style":631},[1740],{"type":47,"value":1244},{"type":42,"tag":371,"props":1742,"children":1743},{"style":631},[1744],{"type":47,"value":1673},{"type":42,"tag":371,"props":1746,"children":1747},{"style":631},[1748],{"type":47,"value":1678},{"type":42,"tag":371,"props":1750,"children":1751},{"style":383},[1752],{"type":47,"value":1683},{"type":42,"tag":371,"props":1754,"children":1755},{"style":631},[1756],{"type":47,"value":1757},"{.data.tls\\.crt}",{"type":42,"tag":371,"props":1759,"children":1760},{"style":383},[1761],{"type":47,"value":1683},{"type":42,"tag":371,"props":1763,"children":1764},{"style":383},[1765],{"type":47,"value":845},{"type":42,"tag":371,"props":1767,"children":1768},{"style":631},[1769],{"type":47,"value":1701},{"type":42,"tag":371,"props":1771,"children":1772},{"class":373,"line":402},[1773,1777,1781,1785,1789,1793,1797,1801,1805,1809,1813,1817,1821,1826,1830,1834],{"type":42,"tag":371,"props":1774,"children":1775},{"style":744},[1776],{"type":47,"value":747},{"type":42,"tag":371,"props":1778,"children":1779},{"style":631},[1780],{"type":47,"value":752},{"type":42,"tag":371,"props":1782,"children":1783},{"style":383},[1784],{"type":47,"value":757},{"type":42,"tag":371,"props":1786,"children":1787},{"style":631},[1788],{"type":47,"value":762},{"type":42,"tag":371,"props":1790,"children":1791},{"style":765},[1792],{"type":47,"value":768},{"type":42,"tag":371,"props":1794,"children":1795},{"style":383},[1796],{"type":47,"value":773},{"type":42,"tag":371,"props":1798,"children":1799},{"style":631},[1800],{"type":47,"value":778},{"type":42,"tag":371,"props":1802,"children":1803},{"style":631},[1804],{"type":47,"value":783},{"type":42,"tag":371,"props":1806,"children":1807},{"style":631},[1808],{"type":47,"value":1244},{"type":42,"tag":371,"props":1810,"children":1811},{"style":631},[1812],{"type":47,"value":1673},{"type":42,"tag":371,"props":1814,"children":1815},{"style":631},[1816],{"type":47,"value":1678},{"type":42,"tag":371,"props":1818,"children":1819},{"style":383},[1820],{"type":47,"value":1683},{"type":42,"tag":371,"props":1822,"children":1823},{"style":631},[1824],{"type":47,"value":1825},"{.data.tls\\.key}",{"type":42,"tag":371,"props":1827,"children":1828},{"style":383},[1829],{"type":47,"value":1683},{"type":42,"tag":371,"props":1831,"children":1832},{"style":383},[1833],{"type":47,"value":845},{"type":42,"tag":371,"props":1835,"children":1836},{"style":631},[1837],{"type":47,"value":1701},{"type":42,"tag":371,"props":1839,"children":1840},{"class":373,"line":422},[1841,1845,1849,1853,1857,1861,1865,1869,1873,1877,1881,1885,1889,1893,1897,1901],{"type":42,"tag":371,"props":1842,"children":1843},{"style":744},[1844],{"type":47,"value":747},{"type":42,"tag":371,"props":1846,"children":1847},{"style":631},[1848],{"type":47,"value":752},{"type":42,"tag":371,"props":1850,"children":1851},{"style":383},[1852],{"type":47,"value":757},{"type":42,"tag":371,"props":1854,"children":1855},{"style":631},[1856],{"type":47,"value":762},{"type":42,"tag":371,"props":1858,"children":1859},{"style":765},[1860],{"type":47,"value":768},{"type":42,"tag":371,"props":1862,"children":1863},{"style":383},[1864],{"type":47,"value":773},{"type":42,"tag":371,"props":1866,"children":1867},{"style":631},[1868],{"type":47,"value":778},{"type":42,"tag":371,"props":1870,"children":1871},{"style":631},[1872],{"type":47,"value":783},{"type":42,"tag":371,"props":1874,"children":1875},{"style":631},[1876],{"type":47,"value":1249},{"type":42,"tag":371,"props":1878,"children":1879},{"style":631},[1880],{"type":47,"value":1673},{"type":42,"tag":371,"props":1882,"children":1883},{"style":631},[1884],{"type":47,"value":1678},{"type":42,"tag":371,"props":1886,"children":1887},{"style":383},[1888],{"type":47,"value":1683},{"type":42,"tag":371,"props":1890,"children":1891},{"style":631},[1892],{"type":47,"value":1757},{"type":42,"tag":371,"props":1894,"children":1895},{"style":383},[1896],{"type":47,"value":1683},{"type":42,"tag":371,"props":1898,"children":1899},{"style":383},[1900],{"type":47,"value":845},{"type":42,"tag":371,"props":1902,"children":1903},{"style":631},[1904],{"type":47,"value":1701},{"type":42,"tag":371,"props":1906,"children":1907},{"class":373,"line":435},[1908,1912,1916,1920,1924,1928,1932,1936,1940,1944,1948,1952,1956,1960,1964,1968],{"type":42,"tag":371,"props":1909,"children":1910},{"style":744},[1911],{"type":47,"value":747},{"type":42,"tag":371,"props":1913,"children":1914},{"style":631},[1915],{"type":47,"value":752},{"type":42,"tag":371,"props":1917,"children":1918},{"style":383},[1919],{"type":47,"value":757},{"type":42,"tag":371,"props":1921,"children":1922},{"style":631},[1923],{"type":47,"value":762},{"type":42,"tag":371,"props":1925,"children":1926},{"style":765},[1927],{"type":47,"value":768},{"type":42,"tag":371,"props":1929,"children":1930},{"style":383},[1931],{"type":47,"value":773},{"type":42,"tag":371,"props":1933,"children":1934},{"style":631},[1935],{"type":47,"value":778},{"type":42,"tag":371,"props":1937,"children":1938},{"style":631},[1939],{"type":47,"value":783},{"type":42,"tag":371,"props":1941,"children":1942},{"style":631},[1943],{"type":47,"value":1249},{"type":42,"tag":371,"props":1945,"children":1946},{"style":631},[1947],{"type":47,"value":1673},{"type":42,"tag":371,"props":1949,"children":1950},{"style":631},[1951],{"type":47,"value":1678},{"type":42,"tag":371,"props":1953,"children":1954},{"style":383},[1955],{"type":47,"value":1683},{"type":42,"tag":371,"props":1957,"children":1958},{"style":631},[1959],{"type":47,"value":1825},{"type":42,"tag":371,"props":1961,"children":1962},{"style":383},[1963],{"type":47,"value":1683},{"type":42,"tag":371,"props":1965,"children":1966},{"style":383},[1967],{"type":47,"value":845},{"type":42,"tag":371,"props":1969,"children":1970},{"style":631},[1971],{"type":47,"value":1701},{"type":42,"tag":73,"props":1973,"children":1975},{"id":1974},"insecure-non-production-values",[1976],{"type":47,"value":1977},"Insecure Non-Production Values",{"type":42,"tag":50,"props":1979,"children":1980},{},[1981],{"type":47,"value":1982},"Only use for local testing or temporary non-production validation:",{"type":42,"tag":360,"props":1984,"children":1986},{"className":362,"code":1985,"language":364,"meta":365,"style":365},"cockroachdb:\n  tls:\n    enabled: false\n    selfSigner:\n      enabled: false\n    certManager:\n      enabled: false\n    externalCertificates:\n      enabled: false\n",[1987],{"type":42,"tag":56,"props":1988,"children":1989},{"__ignoreMap":365},[1990,2001,2012,2027,2038,2053,2064,2079,2090],{"type":42,"tag":371,"props":1991,"children":1992},{"class":373,"line":374},[1993,1997],{"type":42,"tag":371,"props":1994,"children":1995},{"style":378},[1996],{"type":47,"value":8},{"type":42,"tag":371,"props":1998,"children":1999},{"style":383},[2000],{"type":47,"value":386},{"type":42,"tag":371,"props":2002,"children":2003},{"class":373,"line":389},[2004,2008],{"type":42,"tag":371,"props":2005,"children":2006},{"style":378},[2007],{"type":47,"value":395},{"type":42,"tag":371,"props":2009,"children":2010},{"style":383},[2011],{"type":47,"value":386},{"type":42,"tag":371,"props":2013,"children":2014},{"class":373,"line":402},[2015,2019,2023],{"type":42,"tag":371,"props":2016,"children":2017},{"style":378},[2018],{"type":47,"value":408},{"type":42,"tag":371,"props":2020,"children":2021},{"style":383},[2022],{"type":47,"value":413},{"type":42,"tag":371,"props":2024,"children":2025},{"style":416},[2026],{"type":47,"value":496},{"type":42,"tag":371,"props":2028,"children":2029},{"class":373,"line":422},[2030,2034],{"type":42,"tag":371,"props":2031,"children":2032},{"style":378},[2033],{"type":47,"value":428},{"type":42,"tag":371,"props":2035,"children":2036},{"style":383},[2037],{"type":47,"value":386},{"type":42,"tag":371,"props":2039,"children":2040},{"class":373,"line":435},[2041,2045,2049],{"type":42,"tag":371,"props":2042,"children":2043},{"style":378},[2044],{"type":47,"value":441},{"type":42,"tag":371,"props":2046,"children":2047},{"style":383},[2048],{"type":47,"value":413},{"type":42,"tag":371,"props":2050,"children":2051},{"style":416},[2052],{"type":47,"value":496},{"type":42,"tag":371,"props":2054,"children":2055},{"class":373,"line":452},[2056,2060],{"type":42,"tag":371,"props":2057,"children":2058},{"style":378},[2059],{"type":47,"value":475},{"type":42,"tag":371,"props":2061,"children":2062},{"style":383},[2063],{"type":47,"value":386},{"type":42,"tag":371,"props":2065,"children":2066},{"class":373,"line":469},[2067,2071,2075],{"type":42,"tag":371,"props":2068,"children":2069},{"style":378},[2070],{"type":47,"value":441},{"type":42,"tag":371,"props":2072,"children":2073},{"style":383},[2074],{"type":47,"value":413},{"type":42,"tag":371,"props":2076,"children":2077},{"style":416},[2078],{"type":47,"value":496},{"type":42,"tag":371,"props":2080,"children":2081},{"class":373,"line":482},[2082,2086],{"type":42,"tag":371,"props":2083,"children":2084},{"style":378},[2085],{"type":47,"value":505},{"type":42,"tag":371,"props":2087,"children":2088},{"style":383},[2089],{"type":47,"value":386},{"type":42,"tag":371,"props":2091,"children":2092},{"class":373,"line":499},[2093,2097,2101],{"type":42,"tag":371,"props":2094,"children":2095},{"style":378},[2096],{"type":47,"value":441},{"type":42,"tag":371,"props":2098,"children":2099},{"style":383},[2100],{"type":47,"value":413},{"type":42,"tag":371,"props":2102,"children":2103},{"style":416},[2104],{"type":47,"value":496},{"type":42,"tag":50,"props":2106,"children":2107},{},[2108],{"type":47,"value":2109},"State clearly that insecure mode has no TLS or authentication protections and is not suitable for production.",{"type":42,"tag":73,"props":2111,"children":2113},{"id":2112},"post-install-verification",[2114],{"type":47,"value":2115},"Post-Install Verification",{"type":42,"tag":360,"props":2117,"children":2119},{"className":732,"code":2118,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> get crdbcluster \u003Crelease-name> -o yaml | grep -A12 certificates\nkubectl -n \u003Cnamespace> get secret,configmap | grep -E 'cockroach|crdb'\nkubectl -n \u003Cnamespace> get pods\n",[2120],{"type":42,"tag":56,"props":2121,"children":2122},{"__ignoreMap":365},[2123,2205,2269],{"type":42,"tag":371,"props":2124,"children":2125},{"class":373,"line":374},[2126,2130,2134,2138,2142,2146,2150,2154,2159,2163,2168,2172,2176,2180,2185,2190,2195,2200],{"type":42,"tag":371,"props":2127,"children":2128},{"style":744},[2129],{"type":47,"value":747},{"type":42,"tag":371,"props":2131,"children":2132},{"style":631},[2133],{"type":47,"value":752},{"type":42,"tag":371,"props":2135,"children":2136},{"style":383},[2137],{"type":47,"value":757},{"type":42,"tag":371,"props":2139,"children":2140},{"style":631},[2141],{"type":47,"value":762},{"type":42,"tag":371,"props":2143,"children":2144},{"style":765},[2145],{"type":47,"value":768},{"type":42,"tag":371,"props":2147,"children":2148},{"style":383},[2149],{"type":47,"value":773},{"type":42,"tag":371,"props":2151,"children":2152},{"style":631},[2153],{"type":47,"value":778},{"type":42,"tag":371,"props":2155,"children":2156},{"style":631},[2157],{"type":47,"value":2158}," crdbcluster",{"type":42,"tag":371,"props":2160,"children":2161},{"style":383},[2162],{"type":47,"value":757},{"type":42,"tag":371,"props":2164,"children":2165},{"style":631},[2166],{"type":47,"value":2167},"release-nam",{"type":42,"tag":371,"props":2169,"children":2170},{"style":765},[2171],{"type":47,"value":768},{"type":42,"tag":371,"props":2173,"children":2174},{"style":383},[2175],{"type":47,"value":773},{"type":42,"tag":371,"props":2177,"children":2178},{"style":631},[2179],{"type":47,"value":1673},{"type":42,"tag":371,"props":2181,"children":2182},{"style":631},[2183],{"type":47,"value":2184}," yaml",{"type":42,"tag":371,"props":2186,"children":2187},{"style":383},[2188],{"type":47,"value":2189}," |",{"type":42,"tag":371,"props":2191,"children":2192},{"style":744},[2193],{"type":47,"value":2194}," grep",{"type":42,"tag":371,"props":2196,"children":2197},{"style":631},[2198],{"type":47,"value":2199}," -A12",{"type":42,"tag":371,"props":2201,"children":2202},{"style":631},[2203],{"type":47,"value":2204}," certificates\n",{"type":42,"tag":371,"props":2206,"children":2207},{"class":373,"line":389},[2208,2212,2216,2220,2224,2228,2232,2236,2241,2245,2249,2254,2259,2264],{"type":42,"tag":371,"props":2209,"children":2210},{"style":744},[2211],{"type":47,"value":747},{"type":42,"tag":371,"props":2213,"children":2214},{"style":631},[2215],{"type":47,"value":752},{"type":42,"tag":371,"props":2217,"children":2218},{"style":383},[2219],{"type":47,"value":757},{"type":42,"tag":371,"props":2221,"children":2222},{"style":631},[2223],{"type":47,"value":762},{"type":42,"tag":371,"props":2225,"children":2226},{"style":765},[2227],{"type":47,"value":768},{"type":42,"tag":371,"props":2229,"children":2230},{"style":383},[2231],{"type":47,"value":773},{"type":42,"tag":371,"props":2233,"children":2234},{"style":631},[2235],{"type":47,"value":778},{"type":42,"tag":371,"props":2237,"children":2238},{"style":631},[2239],{"type":47,"value":2240}," secret,configmap",{"type":42,"tag":371,"props":2242,"children":2243},{"style":383},[2244],{"type":47,"value":2189},{"type":42,"tag":371,"props":2246,"children":2247},{"style":744},[2248],{"type":47,"value":2194},{"type":42,"tag":371,"props":2250,"children":2251},{"style":631},[2252],{"type":47,"value":2253}," -E",{"type":42,"tag":371,"props":2255,"children":2256},{"style":383},[2257],{"type":47,"value":2258}," '",{"type":42,"tag":371,"props":2260,"children":2261},{"style":631},[2262],{"type":47,"value":2263},"cockroach|crdb",{"type":42,"tag":371,"props":2265,"children":2266},{"style":383},[2267],{"type":47,"value":2268},"'\n",{"type":42,"tag":371,"props":2270,"children":2271},{"class":373,"line":402},[2272,2276,2280,2284,2288,2292,2296,2300],{"type":42,"tag":371,"props":2273,"children":2274},{"style":744},[2275],{"type":47,"value":747},{"type":42,"tag":371,"props":2277,"children":2278},{"style":631},[2279],{"type":47,"value":752},{"type":42,"tag":371,"props":2281,"children":2282},{"style":383},[2283],{"type":47,"value":757},{"type":42,"tag":371,"props":2285,"children":2286},{"style":631},[2287],{"type":47,"value":762},{"type":42,"tag":371,"props":2289,"children":2290},{"style":765},[2291],{"type":47,"value":768},{"type":42,"tag":371,"props":2293,"children":2294},{"style":383},[2295],{"type":47,"value":773},{"type":42,"tag":371,"props":2297,"children":2298},{"style":631},[2299],{"type":47,"value":778},{"type":42,"tag":371,"props":2301,"children":2302},{"style":631},[2303],{"type":47,"value":2304}," pods\n",{"type":42,"tag":50,"props":2306,"children":2307},{},[2308,2310,2316,2318,2323],{"type":47,"value":2309},"For self-signer, confirm the self-signer job ran and the generated CA, node, and client resources exist. For cert-manager, confirm ",{"type":42,"tag":56,"props":2311,"children":2313},{"className":2312},[],[2314],{"type":47,"value":2315},"Certificate",{"type":47,"value":2317}," resources are Ready. For external certificates, confirm the ",{"type":42,"tag":56,"props":2319,"children":2321},{"className":2320},[],[2322],{"type":47,"value":69},{"type":47,"value":2324}," references the expected names.",{"type":42,"tag":73,"props":2326,"children":2328},{"id":2327},"certificate-debugging-and-rotation-evidence",[2329],{"type":47,"value":2330},"Certificate Debugging and Rotation Evidence",{"type":42,"tag":50,"props":2332,"children":2333},{},[2334,2336,2342,2344,2350],{"type":47,"value":2335},"Use this section when pods report ",{"type":42,"tag":56,"props":2337,"children":2339},{"className":2338},[],[2340],{"type":47,"value":2341},"x509",{"type":47,"value":2343}," errors, certificate rotation is not reflected in pods, the ",{"type":42,"tag":56,"props":2345,"children":2347},{"className":2346},[],[2348],{"type":47,"value":2349},"cert-reloader",{"type":47,"value":2351}," sidecar fails, or TSC asks for certificate evidence. Collect metadata only; do not print private keys.",{"type":42,"tag":360,"props":2353,"children":2355},{"className":732,"code":2354,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> get crdbcluster \u003Crelease-name> -o yaml | grep -A20 certificates\nkubectl -n \u003Cnamespace> get secret,configmap | grep -E 'ca|node|client|tls|cert|cockroach|crdb'\nkubectl -n \u003Cnamespace> get pod \u003Cpod-name> -o jsonpath='{.spec.containers[*].name}{\"\\n\"}'\nkubectl -n \u003Cnamespace> logs \u003Cpod-name> -c cert-reloader --tail=100\n",[2356],{"type":42,"tag":56,"props":2357,"children":2358},{"__ignoreMap":365},[2359,2435,2495,2569],{"type":42,"tag":371,"props":2360,"children":2361},{"class":373,"line":374},[2362,2366,2370,2374,2378,2382,2386,2390,2394,2398,2402,2406,2410,2414,2418,2422,2426,2431],{"type":42,"tag":371,"props":2363,"children":2364},{"style":744},[2365],{"type":47,"value":747},{"type":42,"tag":371,"props":2367,"children":2368},{"style":631},[2369],{"type":47,"value":752},{"type":42,"tag":371,"props":2371,"children":2372},{"style":383},[2373],{"type":47,"value":757},{"type":42,"tag":371,"props":2375,"children":2376},{"style":631},[2377],{"type":47,"value":762},{"type":42,"tag":371,"props":2379,"children":2380},{"style":765},[2381],{"type":47,"value":768},{"type":42,"tag":371,"props":2383,"children":2384},{"style":383},[2385],{"type":47,"value":773},{"type":42,"tag":371,"props":2387,"children":2388},{"style":631},[2389],{"type":47,"value":778},{"type":42,"tag":371,"props":2391,"children":2392},{"style":631},[2393],{"type":47,"value":2158},{"type":42,"tag":371,"props":2395,"children":2396},{"style":383},[2397],{"type":47,"value":757},{"type":42,"tag":371,"props":2399,"children":2400},{"style":631},[2401],{"type":47,"value":2167},{"type":42,"tag":371,"props":2403,"children":2404},{"style":765},[2405],{"type":47,"value":768},{"type":42,"tag":371,"props":2407,"children":2408},{"style":383},[2409],{"type":47,"value":773},{"type":42,"tag":371,"props":2411,"children":2412},{"style":631},[2413],{"type":47,"value":1673},{"type":42,"tag":371,"props":2415,"children":2416},{"style":631},[2417],{"type":47,"value":2184},{"type":42,"tag":371,"props":2419,"children":2420},{"style":383},[2421],{"type":47,"value":2189},{"type":42,"tag":371,"props":2423,"children":2424},{"style":744},[2425],{"type":47,"value":2194},{"type":42,"tag":371,"props":2427,"children":2428},{"style":631},[2429],{"type":47,"value":2430}," -A20",{"type":42,"tag":371,"props":2432,"children":2433},{"style":631},[2434],{"type":47,"value":2204},{"type":42,"tag":371,"props":2436,"children":2437},{"class":373,"line":389},[2438,2442,2446,2450,2454,2458,2462,2466,2470,2474,2478,2482,2486,2491],{"type":42,"tag":371,"props":2439,"children":2440},{"style":744},[2441],{"type":47,"value":747},{"type":42,"tag":371,"props":2443,"children":2444},{"style":631},[2445],{"type":47,"value":752},{"type":42,"tag":371,"props":2447,"children":2448},{"style":383},[2449],{"type":47,"value":757},{"type":42,"tag":371,"props":2451,"children":2452},{"style":631},[2453],{"type":47,"value":762},{"type":42,"tag":371,"props":2455,"children":2456},{"style":765},[2457],{"type":47,"value":768},{"type":42,"tag":371,"props":2459,"children":2460},{"style":383},[2461],{"type":47,"value":773},{"type":42,"tag":371,"props":2463,"children":2464},{"style":631},[2465],{"type":47,"value":778},{"type":42,"tag":371,"props":2467,"children":2468},{"style":631},[2469],{"type":47,"value":2240},{"type":42,"tag":371,"props":2471,"children":2472},{"style":383},[2473],{"type":47,"value":2189},{"type":42,"tag":371,"props":2475,"children":2476},{"style":744},[2477],{"type":47,"value":2194},{"type":42,"tag":371,"props":2479,"children":2480},{"style":631},[2481],{"type":47,"value":2253},{"type":42,"tag":371,"props":2483,"children":2484},{"style":383},[2485],{"type":47,"value":2258},{"type":42,"tag":371,"props":2487,"children":2488},{"style":631},[2489],{"type":47,"value":2490},"ca|node|client|tls|cert|cockroach|crdb",{"type":42,"tag":371,"props":2492,"children":2493},{"style":383},[2494],{"type":47,"value":2268},{"type":42,"tag":371,"props":2496,"children":2497},{"class":373,"line":402},[2498,2502,2506,2510,2514,2518,2522,2526,2531,2535,2540,2544,2548,2552,2556,2560,2565],{"type":42,"tag":371,"props":2499,"children":2500},{"style":744},[2501],{"type":47,"value":747},{"type":42,"tag":371,"props":2503,"children":2504},{"style":631},[2505],{"type":47,"value":752},{"type":42,"tag":371,"props":2507,"children":2508},{"style":383},[2509],{"type":47,"value":757},{"type":42,"tag":371,"props":2511,"children":2512},{"style":631},[2513],{"type":47,"value":762},{"type":42,"tag":371,"props":2515,"children":2516},{"style":765},[2517],{"type":47,"value":768},{"type":42,"tag":371,"props":2519,"children":2520},{"style":383},[2521],{"type":47,"value":773},{"type":42,"tag":371,"props":2523,"children":2524},{"style":631},[2525],{"type":47,"value":778},{"type":42,"tag":371,"props":2527,"children":2528},{"style":631},[2529],{"type":47,"value":2530}," pod",{"type":42,"tag":371,"props":2532,"children":2533},{"style":383},[2534],{"type":47,"value":757},{"type":42,"tag":371,"props":2536,"children":2537},{"style":631},[2538],{"type":47,"value":2539},"pod-nam",{"type":42,"tag":371,"props":2541,"children":2542},{"style":765},[2543],{"type":47,"value":768},{"type":42,"tag":371,"props":2545,"children":2546},{"style":383},[2547],{"type":47,"value":773},{"type":42,"tag":371,"props":2549,"children":2550},{"style":631},[2551],{"type":47,"value":1673},{"type":42,"tag":371,"props":2553,"children":2554},{"style":631},[2555],{"type":47,"value":1678},{"type":42,"tag":371,"props":2557,"children":2558},{"style":383},[2559],{"type":47,"value":1683},{"type":42,"tag":371,"props":2561,"children":2562},{"style":631},[2563],{"type":47,"value":2564},"{.spec.containers[*].name}{\"\\n\"}",{"type":42,"tag":371,"props":2566,"children":2567},{"style":383},[2568],{"type":47,"value":2268},{"type":42,"tag":371,"props":2570,"children":2571},{"class":373,"line":422},[2572,2576,2580,2584,2588,2592,2596,2601,2605,2609,2613,2617,2622,2627],{"type":42,"tag":371,"props":2573,"children":2574},{"style":744},[2575],{"type":47,"value":747},{"type":42,"tag":371,"props":2577,"children":2578},{"style":631},[2579],{"type":47,"value":752},{"type":42,"tag":371,"props":2581,"children":2582},{"style":383},[2583],{"type":47,"value":757},{"type":42,"tag":371,"props":2585,"children":2586},{"style":631},[2587],{"type":47,"value":762},{"type":42,"tag":371,"props":2589,"children":2590},{"style":765},[2591],{"type":47,"value":768},{"type":42,"tag":371,"props":2593,"children":2594},{"style":383},[2595],{"type":47,"value":773},{"type":42,"tag":371,"props":2597,"children":2598},{"style":631},[2599],{"type":47,"value":2600}," logs",{"type":42,"tag":371,"props":2602,"children":2603},{"style":383},[2604],{"type":47,"value":757},{"type":42,"tag":371,"props":2606,"children":2607},{"style":631},[2608],{"type":47,"value":2539},{"type":42,"tag":371,"props":2610,"children":2611},{"style":765},[2612],{"type":47,"value":768},{"type":42,"tag":371,"props":2614,"children":2615},{"style":383},[2616],{"type":47,"value":773},{"type":42,"tag":371,"props":2618,"children":2619},{"style":631},[2620],{"type":47,"value":2621}," -c",{"type":42,"tag":371,"props":2623,"children":2624},{"style":631},[2625],{"type":47,"value":2626}," cert-reloader",{"type":42,"tag":371,"props":2628,"children":2629},{"style":631},[2630],{"type":47,"value":2631}," --tail=100\n",{"type":42,"tag":50,"props":2633,"children":2634},{},[2635],{"type":47,"value":2636},"Inspect the node certificate:",{"type":42,"tag":360,"props":2638,"children":2640},{"className":732,"code":2639,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> get secret \u003Cnode-tls-secret> -o jsonpath='{.data.tls\\.crt}' | base64 -d | \\\n  openssl x509 -noout -dates -subject -issuer -ext subjectAltName\n",[2641],{"type":42,"tag":56,"props":2642,"children":2643},{"__ignoreMap":365},[2644,2740],{"type":42,"tag":371,"props":2645,"children":2646},{"class":373,"line":374},[2647,2651,2655,2659,2663,2667,2671,2675,2679,2683,2688,2693,2697,2701,2705,2709,2713,2717,2721,2726,2731,2735],{"type":42,"tag":371,"props":2648,"children":2649},{"style":744},[2650],{"type":47,"value":747},{"type":42,"tag":371,"props":2652,"children":2653},{"style":631},[2654],{"type":47,"value":752},{"type":42,"tag":371,"props":2656,"children":2657},{"style":383},[2658],{"type":47,"value":757},{"type":42,"tag":371,"props":2660,"children":2661},{"style":631},[2662],{"type":47,"value":762},{"type":42,"tag":371,"props":2664,"children":2665},{"style":765},[2666],{"type":47,"value":768},{"type":42,"tag":371,"props":2668,"children":2669},{"style":383},[2670],{"type":47,"value":773},{"type":42,"tag":371,"props":2672,"children":2673},{"style":631},[2674],{"type":47,"value":778},{"type":42,"tag":371,"props":2676,"children":2677},{"style":631},[2678],{"type":47,"value":783},{"type":42,"tag":371,"props":2680,"children":2681},{"style":383},[2682],{"type":47,"value":757},{"type":42,"tag":371,"props":2684,"children":2685},{"style":631},[2686],{"type":47,"value":2687},"node-tls-secre",{"type":42,"tag":371,"props":2689,"children":2690},{"style":765},[2691],{"type":47,"value":2692},"t",{"type":42,"tag":371,"props":2694,"children":2695},{"style":383},[2696],{"type":47,"value":773},{"type":42,"tag":371,"props":2698,"children":2699},{"style":631},[2700],{"type":47,"value":1673},{"type":42,"tag":371,"props":2702,"children":2703},{"style":631},[2704],{"type":47,"value":1678},{"type":42,"tag":371,"props":2706,"children":2707},{"style":383},[2708],{"type":47,"value":1683},{"type":42,"tag":371,"props":2710,"children":2711},{"style":631},[2712],{"type":47,"value":1757},{"type":42,"tag":371,"props":2714,"children":2715},{"style":383},[2716],{"type":47,"value":1683},{"type":42,"tag":371,"props":2718,"children":2719},{"style":383},[2720],{"type":47,"value":2189},{"type":42,"tag":371,"props":2722,"children":2723},{"style":744},[2724],{"type":47,"value":2725}," base64",{"type":42,"tag":371,"props":2727,"children":2728},{"style":631},[2729],{"type":47,"value":2730}," -d",{"type":42,"tag":371,"props":2732,"children":2733},{"style":383},[2734],{"type":47,"value":2189},{"type":42,"tag":371,"props":2736,"children":2737},{"style":765},[2738],{"type":47,"value":2739}," \\\n",{"type":42,"tag":371,"props":2741,"children":2742},{"class":373,"line":389},[2743,2748,2753,2758,2763,2768,2773,2778],{"type":42,"tag":371,"props":2744,"children":2745},{"style":744},[2746],{"type":47,"value":2747},"  openssl",{"type":42,"tag":371,"props":2749,"children":2750},{"style":631},[2751],{"type":47,"value":2752}," x509",{"type":42,"tag":371,"props":2754,"children":2755},{"style":631},[2756],{"type":47,"value":2757}," -noout",{"type":42,"tag":371,"props":2759,"children":2760},{"style":631},[2761],{"type":47,"value":2762}," -dates",{"type":42,"tag":371,"props":2764,"children":2765},{"style":631},[2766],{"type":47,"value":2767}," -subject",{"type":42,"tag":371,"props":2769,"children":2770},{"style":631},[2771],{"type":47,"value":2772}," -issuer",{"type":42,"tag":371,"props":2774,"children":2775},{"style":631},[2776],{"type":47,"value":2777}," -ext",{"type":42,"tag":371,"props":2779,"children":2780},{"style":631},[2781],{"type":47,"value":2782}," subjectAltName\n",{"type":42,"tag":50,"props":2784,"children":2785},{},[2786],{"type":47,"value":2787},"Inspect cert-manager resources, if cert-manager is used:",{"type":42,"tag":360,"props":2789,"children":2791},{"className":732,"code":2790,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> get certificate,issuer -o wide\nkubectl get clusterissuer -o wide 2>\u002Fdev\u002Fnull || true\nkubectl -n \u003Cnamespace> describe certificate \u003Ccertificate-name>\nkubectl -n \u003Cnamespace> describe issuer \u003Cissuer-name>\n",[2792],{"type":42,"tag":56,"props":2793,"children":2794},{"__ignoreMap":365},[2795,2840,2883,2938],{"type":42,"tag":371,"props":2796,"children":2797},{"class":373,"line":374},[2798,2802,2806,2810,2814,2818,2822,2826,2831,2835],{"type":42,"tag":371,"props":2799,"children":2800},{"style":744},[2801],{"type":47,"value":747},{"type":42,"tag":371,"props":2803,"children":2804},{"style":631},[2805],{"type":47,"value":752},{"type":42,"tag":371,"props":2807,"children":2808},{"style":383},[2809],{"type":47,"value":757},{"type":42,"tag":371,"props":2811,"children":2812},{"style":631},[2813],{"type":47,"value":762},{"type":42,"tag":371,"props":2815,"children":2816},{"style":765},[2817],{"type":47,"value":768},{"type":42,"tag":371,"props":2819,"children":2820},{"style":383},[2821],{"type":47,"value":773},{"type":42,"tag":371,"props":2823,"children":2824},{"style":631},[2825],{"type":47,"value":778},{"type":42,"tag":371,"props":2827,"children":2828},{"style":631},[2829],{"type":47,"value":2830}," certificate,issuer",{"type":42,"tag":371,"props":2832,"children":2833},{"style":631},[2834],{"type":47,"value":1673},{"type":42,"tag":371,"props":2836,"children":2837},{"style":631},[2838],{"type":47,"value":2839}," wide\n",{"type":42,"tag":371,"props":2841,"children":2842},{"class":373,"line":389},[2843,2847,2851,2856,2860,2865,2870,2875,2879],{"type":42,"tag":371,"props":2844,"children":2845},{"style":744},[2846],{"type":47,"value":747},{"type":42,"tag":371,"props":2848,"children":2849},{"style":631},[2850],{"type":47,"value":778},{"type":42,"tag":371,"props":2852,"children":2853},{"style":631},[2854],{"type":47,"value":2855}," clusterissuer",{"type":42,"tag":371,"props":2857,"children":2858},{"style":631},[2859],{"type":47,"value":1673},{"type":42,"tag":371,"props":2861,"children":2862},{"style":631},[2863],{"type":47,"value":2864}," wide",{"type":42,"tag":371,"props":2866,"children":2867},{"style":383},[2868],{"type":47,"value":2869}," 2>",{"type":42,"tag":371,"props":2871,"children":2872},{"style":631},[2873],{"type":47,"value":2874},"\u002Fdev\u002Fnull",{"type":42,"tag":371,"props":2876,"children":2877},{"style":383},[2878],{"type":47,"value":1199},{"type":42,"tag":371,"props":2880,"children":2881},{"style":1202},[2882],{"type":47,"value":419},{"type":42,"tag":371,"props":2884,"children":2885},{"class":373,"line":402},[2886,2890,2894,2898,2902,2906,2910,2915,2920,2924,2929,2933],{"type":42,"tag":371,"props":2887,"children":2888},{"style":744},[2889],{"type":47,"value":747},{"type":42,"tag":371,"props":2891,"children":2892},{"style":631},[2893],{"type":47,"value":752},{"type":42,"tag":371,"props":2895,"children":2896},{"style":383},[2897],{"type":47,"value":757},{"type":42,"tag":371,"props":2899,"children":2900},{"style":631},[2901],{"type":47,"value":762},{"type":42,"tag":371,"props":2903,"children":2904},{"style":765},[2905],{"type":47,"value":768},{"type":42,"tag":371,"props":2907,"children":2908},{"style":383},[2909],{"type":47,"value":773},{"type":42,"tag":371,"props":2911,"children":2912},{"style":631},[2913],{"type":47,"value":2914}," describe",{"type":42,"tag":371,"props":2916,"children":2917},{"style":631},[2918],{"type":47,"value":2919}," certificate",{"type":42,"tag":371,"props":2921,"children":2922},{"style":383},[2923],{"type":47,"value":757},{"type":42,"tag":371,"props":2925,"children":2926},{"style":631},[2927],{"type":47,"value":2928},"certificate-nam",{"type":42,"tag":371,"props":2930,"children":2931},{"style":765},[2932],{"type":47,"value":768},{"type":42,"tag":371,"props":2934,"children":2935},{"style":383},[2936],{"type":47,"value":2937},">\n",{"type":42,"tag":371,"props":2939,"children":2940},{"class":373,"line":422},[2941,2945,2949,2953,2957,2961,2965,2969,2973,2977,2982,2986],{"type":42,"tag":371,"props":2942,"children":2943},{"style":744},[2944],{"type":47,"value":747},{"type":42,"tag":371,"props":2946,"children":2947},{"style":631},[2948],{"type":47,"value":752},{"type":42,"tag":371,"props":2950,"children":2951},{"style":383},[2952],{"type":47,"value":757},{"type":42,"tag":371,"props":2954,"children":2955},{"style":631},[2956],{"type":47,"value":762},{"type":42,"tag":371,"props":2958,"children":2959},{"style":765},[2960],{"type":47,"value":768},{"type":42,"tag":371,"props":2962,"children":2963},{"style":383},[2964],{"type":47,"value":773},{"type":42,"tag":371,"props":2966,"children":2967},{"style":631},[2968],{"type":47,"value":2914},{"type":42,"tag":371,"props":2970,"children":2971},{"style":631},[2972],{"type":47,"value":1149},{"type":42,"tag":371,"props":2974,"children":2975},{"style":383},[2976],{"type":47,"value":757},{"type":42,"tag":371,"props":2978,"children":2979},{"style":631},[2980],{"type":47,"value":2981},"issuer-nam",{"type":42,"tag":371,"props":2983,"children":2984},{"style":765},[2985],{"type":47,"value":768},{"type":42,"tag":371,"props":2987,"children":2988},{"style":383},[2989],{"type":47,"value":2937},{"type":42,"tag":50,"props":2991,"children":2992},{},[2993],{"type":47,"value":2994},"If the CockroachDB image does not include network or OpenSSL tooling, use an approved debug image according to the customer's policy. In air-gapped environments, mirror the approved image into the customer's registry and use that registry path instead of pulling a public image directly.",{"type":42,"tag":360,"props":2996,"children":2998},{"className":732,"code":2997,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> debug \u003Cpod-name> --image=\u003Capproved-network-debug-image> --target=cockroachdb -it -- \\\n  openssl s_client -connect \u003Cpod-ip>:26257 \\\n    -CAfile \u002Fcockroach\u002Fcockroach-certs\u002Fca.crt \\\n    -cert \u002Fcockroach\u002Fcockroach-certs\u002Fnode.crt \\\n    -key \u002Fcockroach\u002Fcockroach-certs\u002Fnode.key\n",[2999],{"type":42,"tag":56,"props":3000,"children":3001},{"__ignoreMap":365},[3002,3088,3131,3148,3165],{"type":42,"tag":371,"props":3003,"children":3004},{"class":373,"line":374},[3005,3009,3013,3017,3021,3025,3029,3034,3038,3042,3046,3050,3055,3060,3065,3069,3074,3079,3084],{"type":42,"tag":371,"props":3006,"children":3007},{"style":744},[3008],{"type":47,"value":747},{"type":42,"tag":371,"props":3010,"children":3011},{"style":631},[3012],{"type":47,"value":752},{"type":42,"tag":371,"props":3014,"children":3015},{"style":383},[3016],{"type":47,"value":757},{"type":42,"tag":371,"props":3018,"children":3019},{"style":631},[3020],{"type":47,"value":762},{"type":42,"tag":371,"props":3022,"children":3023},{"style":765},[3024],{"type":47,"value":768},{"type":42,"tag":371,"props":3026,"children":3027},{"style":383},[3028],{"type":47,"value":773},{"type":42,"tag":371,"props":3030,"children":3031},{"style":631},[3032],{"type":47,"value":3033}," debug",{"type":42,"tag":371,"props":3035,"children":3036},{"style":383},[3037],{"type":47,"value":757},{"type":42,"tag":371,"props":3039,"children":3040},{"style":631},[3041],{"type":47,"value":2539},{"type":42,"tag":371,"props":3043,"children":3044},{"style":765},[3045],{"type":47,"value":768},{"type":42,"tag":371,"props":3047,"children":3048},{"style":383},[3049],{"type":47,"value":773},{"type":42,"tag":371,"props":3051,"children":3052},{"style":631},[3053],{"type":47,"value":3054}," --image=",{"type":42,"tag":371,"props":3056,"children":3057},{"style":383},[3058],{"type":47,"value":3059},"\u003C",{"type":42,"tag":371,"props":3061,"children":3062},{"style":631},[3063],{"type":47,"value":3064},"approved-network-debug-image",{"type":42,"tag":371,"props":3066,"children":3067},{"style":383},[3068],{"type":47,"value":773},{"type":42,"tag":371,"props":3070,"children":3071},{"style":631},[3072],{"type":47,"value":3073}," --target=cockroachdb",{"type":42,"tag":371,"props":3075,"children":3076},{"style":631},[3077],{"type":47,"value":3078}," -it",{"type":42,"tag":371,"props":3080,"children":3081},{"style":631},[3082],{"type":47,"value":3083}," --",{"type":42,"tag":371,"props":3085,"children":3086},{"style":765},[3087],{"type":47,"value":2739},{"type":42,"tag":371,"props":3089,"children":3090},{"class":373,"line":389},[3091,3095,3100,3105,3109,3114,3118,3122,3127],{"type":42,"tag":371,"props":3092,"children":3093},{"style":631},[3094],{"type":47,"value":2747},{"type":42,"tag":371,"props":3096,"children":3097},{"style":631},[3098],{"type":47,"value":3099}," s_client",{"type":42,"tag":371,"props":3101,"children":3102},{"style":631},[3103],{"type":47,"value":3104}," -connect",{"type":42,"tag":371,"props":3106,"children":3107},{"style":383},[3108],{"type":47,"value":757},{"type":42,"tag":371,"props":3110,"children":3111},{"style":631},[3112],{"type":47,"value":3113},"pod-i",{"type":42,"tag":371,"props":3115,"children":3116},{"style":765},[3117],{"type":47,"value":50},{"type":42,"tag":371,"props":3119,"children":3120},{"style":383},[3121],{"type":47,"value":773},{"type":42,"tag":371,"props":3123,"children":3124},{"style":631},[3125],{"type":47,"value":3126},":26257",{"type":42,"tag":371,"props":3128,"children":3129},{"style":765},[3130],{"type":47,"value":2739},{"type":42,"tag":371,"props":3132,"children":3133},{"class":373,"line":402},[3134,3139,3144],{"type":42,"tag":371,"props":3135,"children":3136},{"style":631},[3137],{"type":47,"value":3138},"    -CAfile",{"type":42,"tag":371,"props":3140,"children":3141},{"style":631},[3142],{"type":47,"value":3143}," \u002Fcockroach\u002Fcockroach-certs\u002Fca.crt",{"type":42,"tag":371,"props":3145,"children":3146},{"style":765},[3147],{"type":47,"value":2739},{"type":42,"tag":371,"props":3149,"children":3150},{"class":373,"line":422},[3151,3156,3161],{"type":42,"tag":371,"props":3152,"children":3153},{"style":631},[3154],{"type":47,"value":3155},"    -cert",{"type":42,"tag":371,"props":3157,"children":3158},{"style":631},[3159],{"type":47,"value":3160}," \u002Fcockroach\u002Fcockroach-certs\u002Fnode.crt",{"type":42,"tag":371,"props":3162,"children":3163},{"style":765},[3164],{"type":47,"value":2739},{"type":42,"tag":371,"props":3166,"children":3167},{"class":373,"line":435},[3168,3173],{"type":42,"tag":371,"props":3169,"children":3170},{"style":631},[3171],{"type":47,"value":3172},"    -key",{"type":42,"tag":371,"props":3174,"children":3175},{"style":631},[3176],{"type":47,"value":3177}," \u002Fcockroach\u002Fcockroach-certs\u002Fnode.key\n",{"type":42,"tag":50,"props":3179,"children":3180},{},[3181],{"type":47,"value":3182},"For full in-pod certificate metadata:",{"type":42,"tag":360,"props":3184,"children":3186},{"className":732,"code":3185,"language":734,"meta":365,"style":365},"kubectl -n \u003Cnamespace> debug \u003Cpod-name> --image=\u003Capproved-network-debug-image> --target=cockroachdb -it -- bash -c '\nfor DIR in \u002Fcockroach\u002Fcockroach-certs \u002Fcerts \u002Fcockroach-certs; do\n  if [ -d \"$DIR\" ]; then\n    echo \"=== Cert directory: $DIR ===\"\n    ls -la \"$DIR\" 2>\u002Fdev\u002Fnull\n    for CERT in \"$DIR\"\u002F*.crt; do\n      if [ -f \"$CERT\" ]; then\n        echo \"--- $CERT ---\"\n        openssl x509 -in \"$CERT\" -noout -subject -issuer -dates -ext subjectAltName 2>&1\n      fi\n    done\n  fi\ndone'\n",[3187],{"type":42,"tag":56,"props":3188,"children":3189},{"__ignoreMap":365},[3190,3279,3287,3295,3303,3311,3319,3327,3335,3343,3351,3359,3367],{"type":42,"tag":371,"props":3191,"children":3192},{"class":373,"line":374},[3193,3197,3201,3205,3209,3213,3217,3221,3225,3229,3233,3237,3241,3245,3249,3253,3257,3261,3265,3270,3274],{"type":42,"tag":371,"props":3194,"children":3195},{"style":744},[3196],{"type":47,"value":747},{"type":42,"tag":371,"props":3198,"children":3199},{"style":631},[3200],{"type":47,"value":752},{"type":42,"tag":371,"props":3202,"children":3203},{"style":383},[3204],{"type":47,"value":757},{"type":42,"tag":371,"props":3206,"children":3207},{"style":631},[3208],{"type":47,"value":762},{"type":42,"tag":371,"props":3210,"children":3211},{"style":765},[3212],{"type":47,"value":768},{"type":42,"tag":371,"props":3214,"children":3215},{"style":383},[3216],{"type":47,"value":773},{"type":42,"tag":371,"props":3218,"children":3219},{"style":631},[3220],{"type":47,"value":3033},{"type":42,"tag":371,"props":3222,"children":3223},{"style":383},[3224],{"type":47,"value":757},{"type":42,"tag":371,"props":3226,"children":3227},{"style":631},[3228],{"type":47,"value":2539},{"type":42,"tag":371,"props":3230,"children":3231},{"style":765},[3232],{"type":47,"value":768},{"type":42,"tag":371,"props":3234,"children":3235},{"style":383},[3236],{"type":47,"value":773},{"type":42,"tag":371,"props":3238,"children":3239},{"style":631},[3240],{"type":47,"value":3054},{"type":42,"tag":371,"props":3242,"children":3243},{"style":383},[3244],{"type":47,"value":3059},{"type":42,"tag":371,"props":3246,"children":3247},{"style":631},[3248],{"type":47,"value":3064},{"type":42,"tag":371,"props":3250,"children":3251},{"style":383},[3252],{"type":47,"value":773},{"type":42,"tag":371,"props":3254,"children":3255},{"style":631},[3256],{"type":47,"value":3073},{"type":42,"tag":371,"props":3258,"children":3259},{"style":631},[3260],{"type":47,"value":3078},{"type":42,"tag":371,"props":3262,"children":3263},{"style":631},[3264],{"type":47,"value":3083},{"type":42,"tag":371,"props":3266,"children":3267},{"style":631},[3268],{"type":47,"value":3269}," bash",{"type":42,"tag":371,"props":3271,"children":3272},{"style":631},[3273],{"type":47,"value":2621},{"type":42,"tag":371,"props":3275,"children":3276},{"style":383},[3277],{"type":47,"value":3278}," '\n",{"type":42,"tag":371,"props":3280,"children":3281},{"class":373,"line":389},[3282],{"type":42,"tag":371,"props":3283,"children":3284},{"style":631},[3285],{"type":47,"value":3286},"for DIR in \u002Fcockroach\u002Fcockroach-certs \u002Fcerts \u002Fcockroach-certs; do\n",{"type":42,"tag":371,"props":3288,"children":3289},{"class":373,"line":402},[3290],{"type":42,"tag":371,"props":3291,"children":3292},{"style":631},[3293],{"type":47,"value":3294},"  if [ -d \"$DIR\" ]; then\n",{"type":42,"tag":371,"props":3296,"children":3297},{"class":373,"line":422},[3298],{"type":42,"tag":371,"props":3299,"children":3300},{"style":631},[3301],{"type":47,"value":3302},"    echo \"=== Cert directory: $DIR ===\"\n",{"type":42,"tag":371,"props":3304,"children":3305},{"class":373,"line":435},[3306],{"type":42,"tag":371,"props":3307,"children":3308},{"style":631},[3309],{"type":47,"value":3310},"    ls -la \"$DIR\" 2>\u002Fdev\u002Fnull\n",{"type":42,"tag":371,"props":3312,"children":3313},{"class":373,"line":452},[3314],{"type":42,"tag":371,"props":3315,"children":3316},{"style":631},[3317],{"type":47,"value":3318},"    for CERT in \"$DIR\"\u002F*.crt; do\n",{"type":42,"tag":371,"props":3320,"children":3321},{"class":373,"line":469},[3322],{"type":42,"tag":371,"props":3323,"children":3324},{"style":631},[3325],{"type":47,"value":3326},"      if [ -f \"$CERT\" ]; then\n",{"type":42,"tag":371,"props":3328,"children":3329},{"class":373,"line":482},[3330],{"type":42,"tag":371,"props":3331,"children":3332},{"style":631},[3333],{"type":47,"value":3334},"        echo \"--- $CERT ---\"\n",{"type":42,"tag":371,"props":3336,"children":3337},{"class":373,"line":499},[3338],{"type":42,"tag":371,"props":3339,"children":3340},{"style":631},[3341],{"type":47,"value":3342},"        openssl x509 -in \"$CERT\" -noout -subject -issuer -dates -ext subjectAltName 2>&1\n",{"type":42,"tag":371,"props":3344,"children":3345},{"class":373,"line":512},[3346],{"type":42,"tag":371,"props":3347,"children":3348},{"style":631},[3349],{"type":47,"value":3350},"      fi\n",{"type":42,"tag":371,"props":3352,"children":3353},{"class":373,"line":678},[3354],{"type":42,"tag":371,"props":3355,"children":3356},{"style":631},[3357],{"type":47,"value":3358},"    done\n",{"type":42,"tag":371,"props":3360,"children":3361},{"class":373,"line":690},[3362],{"type":42,"tag":371,"props":3363,"children":3364},{"style":631},[3365],{"type":47,"value":3366},"  fi\n",{"type":42,"tag":371,"props":3368,"children":3369},{"class":373,"line":1040},[3370,3375],{"type":42,"tag":371,"props":3371,"children":3372},{"style":631},[3373],{"type":47,"value":3374},"done",{"type":42,"tag":371,"props":3376,"children":3377},{"style":383},[3378],{"type":47,"value":2268},{"type":42,"tag":50,"props":3380,"children":3381},{},[3382,3384,3391],{"type":47,"value":3383},"Escalate with ",{"type":42,"tag":3385,"props":3386,"children":3388},"a",{"href":3387},"..\u002F..\u002Fcockroachdb-observability-and-diagnostics\u002Fcollecting-cockroachdb-operator-escalation-packet\u002FSKILL.md",[3389],{"type":47,"value":3390},"collecting-cockroachdb-operator-escalation-packet",{"type":47,"value":3392}," if certificates look correct but pods still cannot join, rotate, or become Ready.",{"type":42,"tag":73,"props":3394,"children":3396},{"id":3395},"common-tls-failures",[3397],{"type":47,"value":3398},"Common TLS Failures",{"type":42,"tag":239,"props":3400,"children":3401},{},[3402,3423],{"type":42,"tag":243,"props":3403,"children":3404},{},[3405],{"type":42,"tag":247,"props":3406,"children":3407},{},[3408,3413,3418],{"type":42,"tag":251,"props":3409,"children":3410},{},[3411],{"type":47,"value":3412},"Symptom",{"type":42,"tag":251,"props":3414,"children":3415},{},[3416],{"type":47,"value":3417},"Likely Cause",{"type":42,"tag":251,"props":3419,"children":3420},{},[3421],{"type":47,"value":3422},"Action",{"type":42,"tag":267,"props":3424,"children":3425},{},[3426,3448,3470,3506,3524,3549],{"type":42,"tag":247,"props":3427,"children":3428},{},[3429,3438,3443],{"type":42,"tag":274,"props":3430,"children":3431},{},[3432],{"type":42,"tag":56,"props":3433,"children":3435},{"className":3434},[],[3436],{"type":47,"value":3437},"Exactly one of selfSigner, certManager or externalCertificates must be enabled when TLS is on",{"type":42,"tag":274,"props":3439,"children":3440},{},[3441],{"type":47,"value":3442},"Multiple or zero providers enabled",{"type":42,"tag":274,"props":3444,"children":3445},{},[3446],{"type":47,"value":3447},"Set exactly one provider true",{"type":42,"tag":247,"props":3449,"children":3450},{},[3451,3460,3465],{"type":42,"tag":274,"props":3452,"children":3453},{},[3454],{"type":42,"tag":56,"props":3455,"children":3457},{"className":3456},[],[3458],{"type":47,"value":3459},"selfSigner, certManager and externalCertificates must all be disabled when TLS is off",{"type":42,"tag":274,"props":3461,"children":3462},{},[3463],{"type":47,"value":3464},"Provider enabled while TLS disabled",{"type":42,"tag":274,"props":3466,"children":3467},{},[3468],{"type":47,"value":3469},"Disable all providers or enable TLS",{"type":42,"tag":247,"props":3471,"children":3472},{},[3473,3490,3495],{"type":42,"tag":274,"props":3474,"children":3475},{},[3476,3482,3484],{"type":42,"tag":56,"props":3477,"children":3479},{"className":3478},[],[3480],{"type":47,"value":3481},"caProvided",{"type":47,"value":3483}," with empty ",{"type":42,"tag":56,"props":3485,"children":3487},{"className":3486},[],[3488],{"type":47,"value":3489},"caSecret",{"type":42,"tag":274,"props":3491,"children":3492},{},[3493],{"type":47,"value":3494},"Customer CA mode missing Secret name",{"type":42,"tag":274,"props":3496,"children":3497},{},[3498,3500],{"type":47,"value":3499},"Set ",{"type":42,"tag":56,"props":3501,"children":3503},{"className":3502},[],[3504],{"type":47,"value":3505},"cockroachdb.tls.selfSigner.caSecret",{"type":42,"tag":247,"props":3507,"children":3508},{},[3509,3514,3519],{"type":42,"tag":274,"props":3510,"children":3511},{},[3512],{"type":47,"value":3513},"Pods fail with certificate trust errors",{"type":42,"tag":274,"props":3515,"children":3516},{},[3517],{"type":47,"value":3518},"CA and issued certs do not match",{"type":42,"tag":274,"props":3520,"children":3521},{},[3522],{"type":47,"value":3523},"Verify CA ConfigMap\u002FSecret and regenerate certs from the same CA",{"type":42,"tag":247,"props":3525,"children":3526},{},[3527,3532,3537],{"type":42,"tag":274,"props":3528,"children":3529},{},[3530],{"type":47,"value":3531},"Cert rotation does not take effect",{"type":42,"tag":274,"props":3533,"children":3534},{},[3535],{"type":47,"value":3536},"cert-reloader sidecar issue, stale mounted Secret, or cert-manager failure",{"type":42,"tag":274,"props":3538,"children":3539},{},[3540,3542,3547],{"type":47,"value":3541},"Check cert-reloader logs, cert-manager ",{"type":42,"tag":56,"props":3543,"children":3545},{"className":3544},[],[3546],{"type":47,"value":2315},{"type":47,"value":3548}," status, and node cert expiry\u002FSAN metadata",{"type":42,"tag":247,"props":3550,"children":3551},{},[3552,3557,3562],{"type":42,"tag":274,"props":3553,"children":3554},{},[3555],{"type":47,"value":3556},"Pods fail after migration with TLS errors",{"type":42,"tag":274,"props":3558,"children":3559},{},[3560],{"type":47,"value":3561},"Migrated cert resources or CA names do not match operator references",{"type":42,"tag":274,"props":3563,"children":3564},{},[3565,3567,3572],{"type":47,"value":3566},"Use the migration debugging skill and verify the ",{"type":42,"tag":56,"props":3568,"children":3570},{"className":3569},[],[3571],{"type":47,"value":69},{"type":47,"value":3573}," certificate references",{"type":42,"tag":73,"props":3575,"children":3577},{"id":3576},"references",[3578],{"type":47,"value":3579},"References",{"type":42,"tag":80,"props":3581,"children":3582},{},[3583,3592,3601,3610,3621],{"type":42,"tag":84,"props":3584,"children":3585},{},[3586],{"type":42,"tag":3385,"props":3587,"children":3589},{"href":3588},"..\u002F..\u002F..\u002Fdocs\u002Fcertificate-management\u002Fself-signer.md",[3590],{"type":47,"value":3591},"Self-signer certificate management",{"type":42,"tag":84,"props":3593,"children":3594},{},[3595],{"type":42,"tag":3385,"props":3596,"children":3598},{"href":3597},"..\u002F..\u002F..\u002Fdocs\u002Fcertificate-management\u002Fcert-manager.md",[3599],{"type":47,"value":3600},"cert-manager certificate management",{"type":42,"tag":84,"props":3602,"children":3603},{},[3604],{"type":42,"tag":3385,"props":3605,"children":3607},{"href":3606},"..\u002F..\u002F..\u002Fcockroachdb-parent\u002Fcharts\u002Fcockroachdb\u002FREADME.md",[3608],{"type":47,"value":3609},"CockroachDB Helm Chart README",{"type":42,"tag":84,"props":3611,"children":3612},{},[3613],{"type":42,"tag":3385,"props":3614,"children":3618},{"href":3615,"rel":3616},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fauthentication.html",[3617],"nofollow",[3619],{"type":47,"value":3620},"CockroachDB Docs: Authentication",{"type":42,"tag":84,"props":3622,"children":3623},{},[3624],{"type":42,"tag":3385,"props":3625,"children":3626},{"href":3387},[3627],{"type":47,"value":3628},"Operator escalation packet collection",{"type":42,"tag":3630,"props":3631,"children":3632},"style",{},[3633],{"type":47,"value":3634},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3636,"total":3790},[3637,3655,3661,3676,3687,3697,3710,3723,3738,3753,3764,3777],{"slug":3390,"name":3390,"fn":3638,"description":3639,"org":3640,"tags":3641,"stars":22,"repoUrl":23,"updatedAt":3654},"collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3642,3645,3648,3651],{"name":3643,"slug":3644,"type":15},"Database","database",{"name":3646,"slug":3647,"type":15},"Incident Response","incident-response",{"name":3649,"slug":3650,"type":15},"Kubernetes","kubernetes",{"name":3652,"slug":3653,"type":15},"Monitoring","monitoring","2026-07-12T07:57:25.288146",{"slug":4,"name":4,"fn":5,"description":6,"org":3656,"tags":3657,"stars":22,"repoUrl":23,"updatedAt":24},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3658,3659,3660],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":3662,"name":3662,"fn":3663,"description":3664,"org":3665,"tags":3666,"stars":22,"repoUrl":23,"updatedAt":3675},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3667,3668,3671,3672],{"name":3643,"slug":3644,"type":15},{"name":3669,"slug":3670,"type":15},"Debugging","debugging",{"name":3649,"slug":3650,"type":15},{"name":3673,"slug":3674,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":3677,"name":3677,"fn":3678,"description":3679,"org":3680,"tags":3681,"stars":22,"repoUrl":23,"updatedAt":3686},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3682,3683,3684,3685],{"name":3643,"slug":3644,"type":15},{"name":3669,"slug":3670,"type":15},{"name":20,"slug":21,"type":15},{"name":3649,"slug":3650,"type":15},"2026-07-12T07:57:24.018818",{"slug":3688,"name":3688,"fn":3689,"description":3690,"org":3691,"tags":3692,"stars":22,"repoUrl":23,"updatedAt":3696},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3693,3694,3695],{"name":3643,"slug":3644,"type":15},{"name":20,"slug":21,"type":15},{"name":3649,"slug":3650,"type":15},"2026-07-12T07:56:45.777567",{"slug":3698,"name":3698,"fn":3699,"description":3700,"org":3701,"tags":3702,"stars":22,"repoUrl":23,"updatedAt":3709},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3703,3704,3705,3706],{"name":3643,"slug":3644,"type":15},{"name":20,"slug":21,"type":15},{"name":3649,"slug":3650,"type":15},{"name":3707,"slug":3708,"type":15},"Operations","operations","2026-07-12T07:56:47.082609",{"slug":3711,"name":3711,"fn":3712,"description":3713,"org":3714,"tags":3715,"stars":402,"repoUrl":3721,"updatedAt":3722},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3716,3717,3718],{"name":3643,"slug":3644,"type":15},{"name":3652,"slug":3653,"type":15},{"name":3719,"slug":3720,"type":15},"Performance","performance","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:57:18.753533",{"slug":3724,"name":3724,"fn":3725,"description":3726,"org":3727,"tags":3728,"stars":402,"repoUrl":3721,"updatedAt":3737},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3729,3732,3733,3734],{"name":3730,"slug":3731,"type":15},"Data Modeling","data-modeling",{"name":3643,"slug":3644,"type":15},{"name":3719,"slug":3720,"type":15},{"name":3735,"slug":3736,"type":15},"SQL","sql","2026-07-12T07:57:22.763788",{"slug":3739,"name":3739,"fn":3740,"description":3741,"org":3742,"tags":3743,"stars":402,"repoUrl":3721,"updatedAt":3752},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3744,3747,3750,3751],{"name":3745,"slug":3746,"type":15},"Audit","audit",{"name":3748,"slug":3749,"type":15},"Compliance","compliance",{"name":3643,"slug":3644,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":3754,"name":3754,"fn":3755,"description":3756,"org":3757,"tags":3758,"stars":402,"repoUrl":3721,"updatedAt":3763},"auditing-cloud-cluster-security","audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3759,3760,3761,3762],{"name":3745,"slug":3746,"type":15},{"name":3643,"slug":3644,"type":15},{"name":3707,"slug":3708,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":3765,"name":3765,"fn":3766,"description":3767,"org":3768,"tags":3769,"stars":402,"repoUrl":3721,"updatedAt":3776},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3770,3771,3774,3775],{"name":3745,"slug":3746,"type":15},{"name":3772,"slug":3773,"type":15},"Data Analysis","data-analysis",{"name":3643,"slug":3644,"type":15},{"name":3719,"slug":3720,"type":15},"2026-07-12T07:57:16.190081",{"slug":3778,"name":3778,"fn":3779,"description":3780,"org":3781,"tags":3782,"stars":402,"repoUrl":3721,"updatedAt":3789},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3783,3784,3787,3788],{"name":3643,"slug":3644,"type":15},{"name":3785,"slug":3786,"type":15},"Engineering","engineering",{"name":3719,"slug":3720,"type":15},{"name":3735,"slug":3736,"type":15},"2026-07-12T07:57:26.543278",40,{"items":3792,"total":452},[3793,3800,3806,3813,3820,3826],{"slug":3390,"name":3390,"fn":3638,"description":3639,"org":3794,"tags":3795,"stars":22,"repoUrl":23,"updatedAt":3654},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3796,3797,3798,3799],{"name":3643,"slug":3644,"type":15},{"name":3646,"slug":3647,"type":15},{"name":3649,"slug":3650,"type":15},{"name":3652,"slug":3653,"type":15},{"slug":4,"name":4,"fn":5,"description":6,"org":3801,"tags":3802,"stars":22,"repoUrl":23,"updatedAt":24},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3803,3804,3805],{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":3662,"name":3662,"fn":3663,"description":3664,"org":3807,"tags":3808,"stars":22,"repoUrl":23,"updatedAt":3675},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3809,3810,3811,3812],{"name":3643,"slug":3644,"type":15},{"name":3669,"slug":3670,"type":15},{"name":3649,"slug":3650,"type":15},{"name":3673,"slug":3674,"type":15},{"slug":3677,"name":3677,"fn":3678,"description":3679,"org":3814,"tags":3815,"stars":22,"repoUrl":23,"updatedAt":3686},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3816,3817,3818,3819],{"name":3643,"slug":3644,"type":15},{"name":3669,"slug":3670,"type":15},{"name":20,"slug":21,"type":15},{"name":3649,"slug":3650,"type":15},{"slug":3688,"name":3688,"fn":3689,"description":3690,"org":3821,"tags":3822,"stars":22,"repoUrl":23,"updatedAt":3696},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3823,3824,3825],{"name":3643,"slug":3644,"type":15},{"name":20,"slug":21,"type":15},{"name":3649,"slug":3650,"type":15},{"slug":3698,"name":3698,"fn":3699,"description":3700,"org":3827,"tags":3828,"stars":22,"repoUrl":23,"updatedAt":3709},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3829,3830,3831,3832],{"name":3643,"slug":3644,"type":15},{"name":20,"slug":21,"type":15},{"name":3649,"slug":3650,"type":15},{"name":3707,"slug":3708,"type":15}]