[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-configuring-ip-allowlists":3,"mdc--ihkcoy-key":39,"related-repo-cockroachdb-configuring-ip-allowlists":1702,"related-org-cockroachdb-configuring-ip-allowlists":1794},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"configuring-ip-allowlists","configure IP allowlists for CockroachDB","Configures and hardens IP allowlists for CockroachDB Cloud clusters to restrict network access to authorized CIDR ranges. Use when tightening network security, removing overly permissive allowlist entries like 0.0.0.0\u002F0, or setting up allowlists for a new cluster.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Operations","operations",{"name":20,"slug":21,"type":15},"Networking","networking",{"name":23,"slug":24,"type":15},"Database","database",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:56:56.267022",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fconfiguring-ip-allowlists","---\nname: configuring-ip-allowlists\ndescription: Configures and hardens IP allowlists for CockroachDB Cloud clusters to restrict network access to authorized CIDR ranges. Use when tightening network security, removing overly permissive allowlist entries like 0.0.0.0\u002F0, or setting up allowlists for a new cluster.\ncompatibility: Requires ccloud CLI with Cluster Admin or Cluster Operator role.\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Configuring IP Allowlists\n\nConfigures and hardens IP allowlists on CockroachDB Cloud clusters to restrict SQL and DB Console access to authorized CIDR ranges. Identifies overly permissive entries (such as `0.0.0.0\u002F0`) and replaces them with specific, narrow ranges.\n\n## When to Use This Skill\n\n- Removing `0.0.0.0\u002F0` (open to all) from the IP allowlist\n- Restricting network access after initial cluster setup\n- Adding office, VPN, or CI\u002FCD CIDR ranges to the allowlist\n- Reviewing and tightening existing allowlist entries\n- Responding to a security audit finding about overly broad network access\n\n## Prerequisites\n\n- **ccloud CLI** installed and authenticated (`ccloud auth login`)\n- **Cloud Console role:** Cluster Admin or Cluster Operator\n- **Known CIDR ranges:** Office IPs, VPN egress IPs, CI\u002FCD runner IPs, or other authorized sources\n- **Cluster ID:** Available from `ccloud cluster list`\n\n**Verify access:**\n```bash\nccloud auth whoami\nccloud cluster list\n```\n\n## Steps\n\n### 1. List Current Allowlist Entries\n\n```bash\n# List all IP allowlist entries for the cluster\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n```\n\nReview each entry. Flag any of these as overly permissive:\n- `0.0.0.0\u002F0` — Open to all IPv4 addresses\n- `\u002F8` ranges — 16 million+ addresses\n- `\u002F16` ranges — 65,000+ addresses\n- Unknown or undocumented entries\n\nSee [ccloud commands reference](references\u002Fccloud-commands.md) for full command syntax.\n\n### 2. Understand Allowlist Limits\n\nCockroachDB Cloud clusters have a maximum number of IP allowlist entries per cluster. If you need more entries than the limit allows:\n\n- **Consolidate entries:** Use broader CIDR ranges where security permits (e.g., combine several `\u002F32` entries into a `\u002F24`)\n- **Use private endpoints:** Switch to [private endpoints](..\u002Fconfiguring-private-connectivity\u002FSKILL.md) instead of allowlists for VPC-based access — private endpoints bypass the allowlist entirely\n- **Request a limit increase:** Contact CockroachDB Cloud support if consolidation and private endpoints are not sufficient\n\n### 3. Identify Required CIDR Ranges\n\nBefore modifying the allowlist, document all legitimate access sources:\n\n| Source | CIDR | SQL Access | UI Access |\n|--------|------|------------|-----------|\n| Office network | `203.0.113.0\u002F24` | Yes | Yes |\n| VPN egress | `198.51.100.0\u002F24` | Yes | Yes |\n| CI\u002FCD runners | `192.0.2.0\u002F28` | Yes | No |\n| Monitoring | `10.0.1.5\u002F32` | Yes | No |\n\n### 4. Add Specific CIDR Entries\n\n```bash\n# Add a specific CIDR range (CIDR is a positional argument)\nccloud cluster networking allowlist create \u003Ccluster-name> \u003Ccidr> \\\n  --sql \\\n  --ui \\\n  --name \"\u003Cdescription>\"\n```\n\n**Examples:**\n```bash\n# Office network — SQL and UI access\nccloud cluster networking allowlist create \u003Ccluster-name> 203.0.113.0\u002F24 \\\n  --sql \\\n  --ui \\\n  --name \"Office network\"\n\n# CI\u002FCD runners — SQL only\nccloud cluster networking allowlist create \u003Ccluster-name> 192.0.2.0\u002F28 \\\n  --sql \\\n  --name \"CI\u002FCD runners\"\n\n# Single IP — \u002F32 for maximum specificity\nccloud cluster networking allowlist create \u003Ccluster-name> 198.51.100.42\u002F32 \\\n  --sql \\\n  --ui \\\n  --name \"Developer workstation\"\n```\n\n### 5. Remove Overly Permissive Entries\n\n```bash\n# Delete the 0.0.0.0\u002F0 entry (or other overly broad entries)\nccloud cluster networking allowlist delete \u003Ccluster-name> 0.0.0.0\u002F0\n```\n\n**Important:** Only remove `0.0.0.0\u002F0` after confirming your specific CIDR entries are in place and tested.\n\n### 6. Verify the Updated Allowlist\n\n```bash\n# Confirm the final allowlist\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n```\n\nTest connectivity from each authorized source:\n```bash\n# Test SQL connection from an allowed IP\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT 1;\"\n\n# Test from a non-allowed IP (should fail)\n# Attempt connection from an IP not in the allowlist — expect connection refused\n```\n\n## Safety Considerations\n\n**Risk: Locking yourself out.** Removing `0.0.0.0\u002F0` before adding your current IP will immediately block your access.\n\n**Mitigation steps:**\n1. **Identify your current IP** before making changes: `curl -s https:\u002F\u002Fcheckip.amazonaws.com`\n2. **Add your IP first** as a `\u002F32` entry before removing broad ranges\n3. **Test connectivity** after adding specific entries but before removing `0.0.0.0\u002F0`\n4. **Keep Cloud Console access** — the Cloud Console UI can modify allowlists even if SQL access is blocked\n\n**Order of operations:**\n1. Add all specific CIDR entries\n2. Verify SQL connectivity from each allowed source\n3. Remove `0.0.0.0\u002F0` only after verifying all needed entries are in place\n4. Test again to confirm access still works\n\n## Rollback\n\nIf you lose access after removing a broad entry:\n\n1. **Cloud Console:** Log into the CockroachDB Cloud Console (web UI) — this does not use the IP allowlist\n2. **Re-add your IP:** Add your current IP as a `\u002F32` or re-add `0.0.0.0\u002F0` temporarily\n3. **Investigate:** Determine which CIDR was missing and add it\n\n```bash\n# Emergency: re-add 0.0.0.0\u002F0 via ccloud (if you still have ccloud access)\nccloud cluster networking allowlist create \u003Ccluster-name> 0.0.0.0\u002F0 \\\n  --sql \\\n  --ui \\\n  --name \"Emergency - temporary open access\"\n```\n\n## References\n\n**Skill references:**\n- [ccloud commands for IP allowlists](references\u002Fccloud-commands.md)\n\n**Related skills:**\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Run a full security posture audit\n- [configuring-private-connectivity](..\u002Fconfiguring-private-connectivity\u002FSKILL.md) — Private endpoints as an alternative to IP allowlists\n\n**Official CockroachDB Documentation:**\n- [Network Authorization](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html)\n- [Private Clusters](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fprivate-clusters.html)\n- [ccloud CLI Reference](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fccloud-get-started.html)\n",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"Requires ccloud CLI with Cluster Admin or Cluster Operator role.",{"author":8,"version":43},"1.0",{"type":45,"children":46},"root",[47,55,70,77,114,120,178,186,237,243,250,324,329,369,383,389,394,450,456,461,601,607,736,744,1059,1065,1125,1142,1148,1210,1215,1303,1309,1326,1334,1396,1404,1434,1440,1445,1492,1597,1603,1611,1622,1630,1654,1662,1696],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Configuring IP Allowlists",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59,61,68],{"type":53,"value":60},"Configures and hardens IP allowlists on CockroachDB Cloud clusters to restrict SQL and DB Console access to authorized CIDR ranges. Identifies overly permissive entries (such as ",{"type":48,"tag":62,"props":63,"children":65},"code",{"className":64},[],[66],{"type":53,"value":67},"0.0.0.0\u002F0",{"type":53,"value":69},") and replaces them with specific, narrow ranges.",{"type":48,"tag":71,"props":72,"children":74},"h2",{"id":73},"when-to-use-this-skill",[75],{"type":53,"value":76},"When to Use This Skill",{"type":48,"tag":78,"props":79,"children":80},"ul",{},[81,94,99,104,109],{"type":48,"tag":82,"props":83,"children":84},"li",{},[85,87,92],{"type":53,"value":86},"Removing ",{"type":48,"tag":62,"props":88,"children":90},{"className":89},[],[91],{"type":53,"value":67},{"type":53,"value":93}," (open to all) from the IP allowlist",{"type":48,"tag":82,"props":95,"children":96},{},[97],{"type":53,"value":98},"Restricting network access after initial cluster setup",{"type":48,"tag":82,"props":100,"children":101},{},[102],{"type":53,"value":103},"Adding office, VPN, or CI\u002FCD CIDR ranges to the allowlist",{"type":48,"tag":82,"props":105,"children":106},{},[107],{"type":53,"value":108},"Reviewing and tightening existing allowlist entries",{"type":48,"tag":82,"props":110,"children":111},{},[112],{"type":53,"value":113},"Responding to a security audit finding about overly broad network access",{"type":48,"tag":71,"props":115,"children":117},{"id":116},"prerequisites",[118],{"type":53,"value":119},"Prerequisites",{"type":48,"tag":78,"props":121,"children":122},{},[123,142,152,162],{"type":48,"tag":82,"props":124,"children":125},{},[126,132,134,140],{"type":48,"tag":127,"props":128,"children":129},"strong",{},[130],{"type":53,"value":131},"ccloud CLI",{"type":53,"value":133}," installed and authenticated (",{"type":48,"tag":62,"props":135,"children":137},{"className":136},[],[138],{"type":53,"value":139},"ccloud auth login",{"type":53,"value":141},")",{"type":48,"tag":82,"props":143,"children":144},{},[145,150],{"type":48,"tag":127,"props":146,"children":147},{},[148],{"type":53,"value":149},"Cloud Console role:",{"type":53,"value":151}," Cluster Admin or Cluster Operator",{"type":48,"tag":82,"props":153,"children":154},{},[155,160],{"type":48,"tag":127,"props":156,"children":157},{},[158],{"type":53,"value":159},"Known CIDR ranges:",{"type":53,"value":161}," Office IPs, VPN egress IPs, CI\u002FCD runner IPs, or other authorized sources",{"type":48,"tag":82,"props":163,"children":164},{},[165,170,172],{"type":48,"tag":127,"props":166,"children":167},{},[168],{"type":53,"value":169},"Cluster ID:",{"type":53,"value":171}," Available from ",{"type":48,"tag":62,"props":173,"children":175},{"className":174},[],[176],{"type":53,"value":177},"ccloud cluster list",{"type":48,"tag":56,"props":179,"children":180},{},[181],{"type":48,"tag":127,"props":182,"children":183},{},[184],{"type":53,"value":185},"Verify access:",{"type":48,"tag":187,"props":188,"children":193},"pre",{"className":189,"code":190,"language":191,"meta":192,"style":192},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","ccloud auth whoami\nccloud cluster list\n","bash","",[194],{"type":48,"tag":62,"props":195,"children":196},{"__ignoreMap":192},[197,220],{"type":48,"tag":198,"props":199,"children":202},"span",{"class":200,"line":201},"line",1,[203,209,215],{"type":48,"tag":198,"props":204,"children":206},{"style":205},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[207],{"type":53,"value":208},"ccloud",{"type":48,"tag":198,"props":210,"children":212},{"style":211},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[213],{"type":53,"value":214}," auth",{"type":48,"tag":198,"props":216,"children":217},{"style":211},[218],{"type":53,"value":219}," whoami\n",{"type":48,"tag":198,"props":221,"children":222},{"class":200,"line":29},[223,227,232],{"type":48,"tag":198,"props":224,"children":225},{"style":205},[226],{"type":53,"value":208},{"type":48,"tag":198,"props":228,"children":229},{"style":211},[230],{"type":53,"value":231}," cluster",{"type":48,"tag":198,"props":233,"children":234},{"style":211},[235],{"type":53,"value":236}," list\n",{"type":48,"tag":71,"props":238,"children":240},{"id":239},"steps",[241],{"type":53,"value":242},"Steps",{"type":48,"tag":244,"props":245,"children":247},"h3",{"id":246},"_1-list-current-allowlist-entries",[248],{"type":53,"value":249},"1. List Current Allowlist Entries",{"type":48,"tag":187,"props":251,"children":253},{"className":189,"code":252,"language":191,"meta":192,"style":192},"# List all IP allowlist entries for the cluster\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n",[254],{"type":48,"tag":62,"props":255,"children":256},{"__ignoreMap":192},[257,266],{"type":48,"tag":198,"props":258,"children":259},{"class":200,"line":201},[260],{"type":48,"tag":198,"props":261,"children":263},{"style":262},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[264],{"type":53,"value":265},"# List all IP allowlist entries for the cluster\n",{"type":48,"tag":198,"props":267,"children":268},{"class":200,"line":29},[269,273,277,282,287,292,298,303,309,314,319],{"type":48,"tag":198,"props":270,"children":271},{"style":205},[272],{"type":53,"value":208},{"type":48,"tag":198,"props":274,"children":275},{"style":211},[276],{"type":53,"value":231},{"type":48,"tag":198,"props":278,"children":279},{"style":211},[280],{"type":53,"value":281}," networking",{"type":48,"tag":198,"props":283,"children":284},{"style":211},[285],{"type":53,"value":286}," allowlist",{"type":48,"tag":198,"props":288,"children":289},{"style":211},[290],{"type":53,"value":291}," list",{"type":48,"tag":198,"props":293,"children":295},{"style":294},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[296],{"type":53,"value":297}," \u003C",{"type":48,"tag":198,"props":299,"children":300},{"style":211},[301],{"type":53,"value":302},"cluster-i",{"type":48,"tag":198,"props":304,"children":306},{"style":305},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[307],{"type":53,"value":308},"d",{"type":48,"tag":198,"props":310,"children":311},{"style":294},[312],{"type":53,"value":313},">",{"type":48,"tag":198,"props":315,"children":316},{"style":211},[317],{"type":53,"value":318}," -o",{"type":48,"tag":198,"props":320,"children":321},{"style":211},[322],{"type":53,"value":323}," json\n",{"type":48,"tag":56,"props":325,"children":326},{},[327],{"type":53,"value":328},"Review each entry. Flag any of these as overly permissive:",{"type":48,"tag":78,"props":330,"children":331},{},[332,342,353,364],{"type":48,"tag":82,"props":333,"children":334},{},[335,340],{"type":48,"tag":62,"props":336,"children":338},{"className":337},[],[339],{"type":53,"value":67},{"type":53,"value":341}," — Open to all IPv4 addresses",{"type":48,"tag":82,"props":343,"children":344},{},[345,351],{"type":48,"tag":62,"props":346,"children":348},{"className":347},[],[349],{"type":53,"value":350},"\u002F8",{"type":53,"value":352}," ranges — 16 million+ addresses",{"type":48,"tag":82,"props":354,"children":355},{},[356,362],{"type":48,"tag":62,"props":357,"children":359},{"className":358},[],[360],{"type":53,"value":361},"\u002F16",{"type":53,"value":363}," ranges — 65,000+ addresses",{"type":48,"tag":82,"props":365,"children":366},{},[367],{"type":53,"value":368},"Unknown or undocumented entries",{"type":48,"tag":56,"props":370,"children":371},{},[372,374,381],{"type":53,"value":373},"See ",{"type":48,"tag":375,"props":376,"children":378},"a",{"href":377},"references\u002Fccloud-commands.md",[379],{"type":53,"value":380},"ccloud commands reference",{"type":53,"value":382}," for full command syntax.",{"type":48,"tag":244,"props":384,"children":386},{"id":385},"_2-understand-allowlist-limits",[387],{"type":53,"value":388},"2. Understand Allowlist Limits",{"type":48,"tag":56,"props":390,"children":391},{},[392],{"type":53,"value":393},"CockroachDB Cloud clusters have a maximum number of IP allowlist entries per cluster. If you need more entries than the limit allows:",{"type":48,"tag":78,"props":395,"children":396},{},[397,422,440],{"type":48,"tag":82,"props":398,"children":399},{},[400,405,407,413,415,421],{"type":48,"tag":127,"props":401,"children":402},{},[403],{"type":53,"value":404},"Consolidate entries:",{"type":53,"value":406}," Use broader CIDR ranges where security permits (e.g., combine several ",{"type":48,"tag":62,"props":408,"children":410},{"className":409},[],[411],{"type":53,"value":412},"\u002F32",{"type":53,"value":414}," entries into a ",{"type":48,"tag":62,"props":416,"children":418},{"className":417},[],[419],{"type":53,"value":420},"\u002F24",{"type":53,"value":141},{"type":48,"tag":82,"props":423,"children":424},{},[425,430,432,438],{"type":48,"tag":127,"props":426,"children":427},{},[428],{"type":53,"value":429},"Use private endpoints:",{"type":53,"value":431}," Switch to ",{"type":48,"tag":375,"props":433,"children":435},{"href":434},"..\u002Fconfiguring-private-connectivity\u002FSKILL.md",[436],{"type":53,"value":437},"private endpoints",{"type":53,"value":439}," instead of allowlists for VPC-based access — private endpoints bypass the allowlist entirely",{"type":48,"tag":82,"props":441,"children":442},{},[443,448],{"type":48,"tag":127,"props":444,"children":445},{},[446],{"type":53,"value":447},"Request a limit increase:",{"type":53,"value":449}," Contact CockroachDB Cloud support if consolidation and private endpoints are not sufficient",{"type":48,"tag":244,"props":451,"children":453},{"id":452},"_3-identify-required-cidr-ranges",[454],{"type":53,"value":455},"3. Identify Required CIDR Ranges",{"type":48,"tag":56,"props":457,"children":458},{},[459],{"type":53,"value":460},"Before modifying the allowlist, document all legitimate access sources:",{"type":48,"tag":462,"props":463,"children":464},"table",{},[465,494],{"type":48,"tag":466,"props":467,"children":468},"thead",{},[469],{"type":48,"tag":470,"props":471,"children":472},"tr",{},[473,479,484,489],{"type":48,"tag":474,"props":475,"children":476},"th",{},[477],{"type":53,"value":478},"Source",{"type":48,"tag":474,"props":480,"children":481},{},[482],{"type":53,"value":483},"CIDR",{"type":48,"tag":474,"props":485,"children":486},{},[487],{"type":53,"value":488},"SQL Access",{"type":48,"tag":474,"props":490,"children":491},{},[492],{"type":53,"value":493},"UI Access",{"type":48,"tag":495,"props":496,"children":497},"tbody",{},[498,525,550,576],{"type":48,"tag":470,"props":499,"children":500},{},[501,507,516,521],{"type":48,"tag":502,"props":503,"children":504},"td",{},[505],{"type":53,"value":506},"Office network",{"type":48,"tag":502,"props":508,"children":509},{},[510],{"type":48,"tag":62,"props":511,"children":513},{"className":512},[],[514],{"type":53,"value":515},"203.0.113.0\u002F24",{"type":48,"tag":502,"props":517,"children":518},{},[519],{"type":53,"value":520},"Yes",{"type":48,"tag":502,"props":522,"children":523},{},[524],{"type":53,"value":520},{"type":48,"tag":470,"props":526,"children":527},{},[528,533,542,546],{"type":48,"tag":502,"props":529,"children":530},{},[531],{"type":53,"value":532},"VPN egress",{"type":48,"tag":502,"props":534,"children":535},{},[536],{"type":48,"tag":62,"props":537,"children":539},{"className":538},[],[540],{"type":53,"value":541},"198.51.100.0\u002F24",{"type":48,"tag":502,"props":543,"children":544},{},[545],{"type":53,"value":520},{"type":48,"tag":502,"props":547,"children":548},{},[549],{"type":53,"value":520},{"type":48,"tag":470,"props":551,"children":552},{},[553,558,567,571],{"type":48,"tag":502,"props":554,"children":555},{},[556],{"type":53,"value":557},"CI\u002FCD runners",{"type":48,"tag":502,"props":559,"children":560},{},[561],{"type":48,"tag":62,"props":562,"children":564},{"className":563},[],[565],{"type":53,"value":566},"192.0.2.0\u002F28",{"type":48,"tag":502,"props":568,"children":569},{},[570],{"type":53,"value":520},{"type":48,"tag":502,"props":572,"children":573},{},[574],{"type":53,"value":575},"No",{"type":48,"tag":470,"props":577,"children":578},{},[579,584,593,597],{"type":48,"tag":502,"props":580,"children":581},{},[582],{"type":53,"value":583},"Monitoring",{"type":48,"tag":502,"props":585,"children":586},{},[587],{"type":48,"tag":62,"props":588,"children":590},{"className":589},[],[591],{"type":53,"value":592},"10.0.1.5\u002F32",{"type":48,"tag":502,"props":594,"children":595},{},[596],{"type":53,"value":520},{"type":48,"tag":502,"props":598,"children":599},{},[600],{"type":53,"value":575},{"type":48,"tag":244,"props":602,"children":604},{"id":603},"_4-add-specific-cidr-entries",[605],{"type":53,"value":606},"4. Add Specific CIDR Entries",{"type":48,"tag":187,"props":608,"children":610},{"className":189,"code":609,"language":191,"meta":192,"style":192},"# Add a specific CIDR range (CIDR is a positional argument)\nccloud cluster networking allowlist create \u003Ccluster-name> \u003Ccidr> \\\n  --sql \\\n  --ui \\\n  --name \"\u003Cdescription>\"\n",[611],{"type":48,"tag":62,"props":612,"children":613},{"__ignoreMap":192},[614,622,687,699,712],{"type":48,"tag":198,"props":615,"children":616},{"class":200,"line":201},[617],{"type":48,"tag":198,"props":618,"children":619},{"style":262},[620],{"type":53,"value":621},"# Add a specific CIDR range (CIDR is a positional argument)\n",{"type":48,"tag":198,"props":623,"children":624},{"class":200,"line":29},[625,629,633,637,641,646,650,655,660,664,668,673,678,682],{"type":48,"tag":198,"props":626,"children":627},{"style":205},[628],{"type":53,"value":208},{"type":48,"tag":198,"props":630,"children":631},{"style":211},[632],{"type":53,"value":231},{"type":48,"tag":198,"props":634,"children":635},{"style":211},[636],{"type":53,"value":281},{"type":48,"tag":198,"props":638,"children":639},{"style":211},[640],{"type":53,"value":286},{"type":48,"tag":198,"props":642,"children":643},{"style":211},[644],{"type":53,"value":645}," create",{"type":48,"tag":198,"props":647,"children":648},{"style":294},[649],{"type":53,"value":297},{"type":48,"tag":198,"props":651,"children":652},{"style":211},[653],{"type":53,"value":654},"cluster-nam",{"type":48,"tag":198,"props":656,"children":657},{"style":305},[658],{"type":53,"value":659},"e",{"type":48,"tag":198,"props":661,"children":662},{"style":294},[663],{"type":53,"value":313},{"type":48,"tag":198,"props":665,"children":666},{"style":294},[667],{"type":53,"value":297},{"type":48,"tag":198,"props":669,"children":670},{"style":211},[671],{"type":53,"value":672},"cid",{"type":48,"tag":198,"props":674,"children":675},{"style":305},[676],{"type":53,"value":677},"r",{"type":48,"tag":198,"props":679,"children":680},{"style":294},[681],{"type":53,"value":313},{"type":48,"tag":198,"props":683,"children":684},{"style":305},[685],{"type":53,"value":686}," \\\n",{"type":48,"tag":198,"props":688,"children":689},{"class":200,"line":25},[690,695],{"type":48,"tag":198,"props":691,"children":692},{"style":211},[693],{"type":53,"value":694},"  --sql",{"type":48,"tag":198,"props":696,"children":697},{"style":305},[698],{"type":53,"value":686},{"type":48,"tag":198,"props":700,"children":702},{"class":200,"line":701},4,[703,708],{"type":48,"tag":198,"props":704,"children":705},{"style":211},[706],{"type":53,"value":707},"  --ui",{"type":48,"tag":198,"props":709,"children":710},{"style":305},[711],{"type":53,"value":686},{"type":48,"tag":198,"props":713,"children":715},{"class":200,"line":714},5,[716,721,726,731],{"type":48,"tag":198,"props":717,"children":718},{"style":211},[719],{"type":53,"value":720},"  --name",{"type":48,"tag":198,"props":722,"children":723},{"style":294},[724],{"type":53,"value":725}," \"",{"type":48,"tag":198,"props":727,"children":728},{"style":211},[729],{"type":53,"value":730},"\u003Cdescription>",{"type":48,"tag":198,"props":732,"children":733},{"style":294},[734],{"type":53,"value":735},"\"\n",{"type":48,"tag":56,"props":737,"children":738},{},[739],{"type":48,"tag":127,"props":740,"children":741},{},[742],{"type":53,"value":743},"Examples:",{"type":48,"tag":187,"props":745,"children":747},{"className":189,"code":746,"language":191,"meta":192,"style":192},"# Office network — SQL and UI access\nccloud cluster networking allowlist create \u003Ccluster-name> 203.0.113.0\u002F24 \\\n  --sql \\\n  --ui \\\n  --name \"Office network\"\n\n# CI\u002FCD runners — SQL only\nccloud cluster networking allowlist create \u003Ccluster-name> 192.0.2.0\u002F28 \\\n  --sql \\\n  --name \"CI\u002FCD runners\"\n\n# Single IP — \u002F32 for maximum specificity\nccloud cluster networking allowlist create \u003Ccluster-name> 198.51.100.42\u002F32 \\\n  --sql \\\n  --ui \\\n  --name \"Developer workstation\"\n",[748],{"type":48,"tag":62,"props":749,"children":750},{"__ignoreMap":192},[751,759,807,818,829,848,858,867,916,928,948,956,965,1014,1026,1038],{"type":48,"tag":198,"props":752,"children":753},{"class":200,"line":201},[754],{"type":48,"tag":198,"props":755,"children":756},{"style":262},[757],{"type":53,"value":758},"# Office network — SQL and UI access\n",{"type":48,"tag":198,"props":760,"children":761},{"class":200,"line":29},[762,766,770,774,778,782,786,790,794,798,803],{"type":48,"tag":198,"props":763,"children":764},{"style":205},[765],{"type":53,"value":208},{"type":48,"tag":198,"props":767,"children":768},{"style":211},[769],{"type":53,"value":231},{"type":48,"tag":198,"props":771,"children":772},{"style":211},[773],{"type":53,"value":281},{"type":48,"tag":198,"props":775,"children":776},{"style":211},[777],{"type":53,"value":286},{"type":48,"tag":198,"props":779,"children":780},{"style":211},[781],{"type":53,"value":645},{"type":48,"tag":198,"props":783,"children":784},{"style":294},[785],{"type":53,"value":297},{"type":48,"tag":198,"props":787,"children":788},{"style":211},[789],{"type":53,"value":654},{"type":48,"tag":198,"props":791,"children":792},{"style":305},[793],{"type":53,"value":659},{"type":48,"tag":198,"props":795,"children":796},{"style":294},[797],{"type":53,"value":313},{"type":48,"tag":198,"props":799,"children":800},{"style":211},[801],{"type":53,"value":802}," 203.0.113.0\u002F24",{"type":48,"tag":198,"props":804,"children":805},{"style":305},[806],{"type":53,"value":686},{"type":48,"tag":198,"props":808,"children":809},{"class":200,"line":25},[810,814],{"type":48,"tag":198,"props":811,"children":812},{"style":211},[813],{"type":53,"value":694},{"type":48,"tag":198,"props":815,"children":816},{"style":305},[817],{"type":53,"value":686},{"type":48,"tag":198,"props":819,"children":820},{"class":200,"line":701},[821,825],{"type":48,"tag":198,"props":822,"children":823},{"style":211},[824],{"type":53,"value":707},{"type":48,"tag":198,"props":826,"children":827},{"style":305},[828],{"type":53,"value":686},{"type":48,"tag":198,"props":830,"children":831},{"class":200,"line":714},[832,836,840,844],{"type":48,"tag":198,"props":833,"children":834},{"style":211},[835],{"type":53,"value":720},{"type":48,"tag":198,"props":837,"children":838},{"style":294},[839],{"type":53,"value":725},{"type":48,"tag":198,"props":841,"children":842},{"style":211},[843],{"type":53,"value":506},{"type":48,"tag":198,"props":845,"children":846},{"style":294},[847],{"type":53,"value":735},{"type":48,"tag":198,"props":849,"children":851},{"class":200,"line":850},6,[852],{"type":48,"tag":198,"props":853,"children":855},{"emptyLinePlaceholder":854},true,[856],{"type":53,"value":857},"\n",{"type":48,"tag":198,"props":859,"children":861},{"class":200,"line":860},7,[862],{"type":48,"tag":198,"props":863,"children":864},{"style":262},[865],{"type":53,"value":866},"# CI\u002FCD runners — SQL only\n",{"type":48,"tag":198,"props":868,"children":870},{"class":200,"line":869},8,[871,875,879,883,887,891,895,899,903,907,912],{"type":48,"tag":198,"props":872,"children":873},{"style":205},[874],{"type":53,"value":208},{"type":48,"tag":198,"props":876,"children":877},{"style":211},[878],{"type":53,"value":231},{"type":48,"tag":198,"props":880,"children":881},{"style":211},[882],{"type":53,"value":281},{"type":48,"tag":198,"props":884,"children":885},{"style":211},[886],{"type":53,"value":286},{"type":48,"tag":198,"props":888,"children":889},{"style":211},[890],{"type":53,"value":645},{"type":48,"tag":198,"props":892,"children":893},{"style":294},[894],{"type":53,"value":297},{"type":48,"tag":198,"props":896,"children":897},{"style":211},[898],{"type":53,"value":654},{"type":48,"tag":198,"props":900,"children":901},{"style":305},[902],{"type":53,"value":659},{"type":48,"tag":198,"props":904,"children":905},{"style":294},[906],{"type":53,"value":313},{"type":48,"tag":198,"props":908,"children":909},{"style":211},[910],{"type":53,"value":911}," 192.0.2.0\u002F28",{"type":48,"tag":198,"props":913,"children":914},{"style":305},[915],{"type":53,"value":686},{"type":48,"tag":198,"props":917,"children":919},{"class":200,"line":918},9,[920,924],{"type":48,"tag":198,"props":921,"children":922},{"style":211},[923],{"type":53,"value":694},{"type":48,"tag":198,"props":925,"children":926},{"style":305},[927],{"type":53,"value":686},{"type":48,"tag":198,"props":929,"children":931},{"class":200,"line":930},10,[932,936,940,944],{"type":48,"tag":198,"props":933,"children":934},{"style":211},[935],{"type":53,"value":720},{"type":48,"tag":198,"props":937,"children":938},{"style":294},[939],{"type":53,"value":725},{"type":48,"tag":198,"props":941,"children":942},{"style":211},[943],{"type":53,"value":557},{"type":48,"tag":198,"props":945,"children":946},{"style":294},[947],{"type":53,"value":735},{"type":48,"tag":198,"props":949,"children":951},{"class":200,"line":950},11,[952],{"type":48,"tag":198,"props":953,"children":954},{"emptyLinePlaceholder":854},[955],{"type":53,"value":857},{"type":48,"tag":198,"props":957,"children":959},{"class":200,"line":958},12,[960],{"type":48,"tag":198,"props":961,"children":962},{"style":262},[963],{"type":53,"value":964},"# Single IP — \u002F32 for maximum specificity\n",{"type":48,"tag":198,"props":966,"children":968},{"class":200,"line":967},13,[969,973,977,981,985,989,993,997,1001,1005,1010],{"type":48,"tag":198,"props":970,"children":971},{"style":205},[972],{"type":53,"value":208},{"type":48,"tag":198,"props":974,"children":975},{"style":211},[976],{"type":53,"value":231},{"type":48,"tag":198,"props":978,"children":979},{"style":211},[980],{"type":53,"value":281},{"type":48,"tag":198,"props":982,"children":983},{"style":211},[984],{"type":53,"value":286},{"type":48,"tag":198,"props":986,"children":987},{"style":211},[988],{"type":53,"value":645},{"type":48,"tag":198,"props":990,"children":991},{"style":294},[992],{"type":53,"value":297},{"type":48,"tag":198,"props":994,"children":995},{"style":211},[996],{"type":53,"value":654},{"type":48,"tag":198,"props":998,"children":999},{"style":305},[1000],{"type":53,"value":659},{"type":48,"tag":198,"props":1002,"children":1003},{"style":294},[1004],{"type":53,"value":313},{"type":48,"tag":198,"props":1006,"children":1007},{"style":211},[1008],{"type":53,"value":1009}," 198.51.100.42\u002F32",{"type":48,"tag":198,"props":1011,"children":1012},{"style":305},[1013],{"type":53,"value":686},{"type":48,"tag":198,"props":1015,"children":1017},{"class":200,"line":1016},14,[1018,1022],{"type":48,"tag":198,"props":1019,"children":1020},{"style":211},[1021],{"type":53,"value":694},{"type":48,"tag":198,"props":1023,"children":1024},{"style":305},[1025],{"type":53,"value":686},{"type":48,"tag":198,"props":1027,"children":1029},{"class":200,"line":1028},15,[1030,1034],{"type":48,"tag":198,"props":1031,"children":1032},{"style":211},[1033],{"type":53,"value":707},{"type":48,"tag":198,"props":1035,"children":1036},{"style":305},[1037],{"type":53,"value":686},{"type":48,"tag":198,"props":1039,"children":1041},{"class":200,"line":1040},16,[1042,1046,1050,1055],{"type":48,"tag":198,"props":1043,"children":1044},{"style":211},[1045],{"type":53,"value":720},{"type":48,"tag":198,"props":1047,"children":1048},{"style":294},[1049],{"type":53,"value":725},{"type":48,"tag":198,"props":1051,"children":1052},{"style":211},[1053],{"type":53,"value":1054},"Developer workstation",{"type":48,"tag":198,"props":1056,"children":1057},{"style":294},[1058],{"type":53,"value":735},{"type":48,"tag":244,"props":1060,"children":1062},{"id":1061},"_5-remove-overly-permissive-entries",[1063],{"type":53,"value":1064},"5. Remove Overly Permissive Entries",{"type":48,"tag":187,"props":1066,"children":1068},{"className":189,"code":1067,"language":191,"meta":192,"style":192},"# Delete the 0.0.0.0\u002F0 entry (or other overly broad entries)\nccloud cluster networking allowlist delete \u003Ccluster-name> 0.0.0.0\u002F0\n",[1069],{"type":48,"tag":62,"props":1070,"children":1071},{"__ignoreMap":192},[1072,1080],{"type":48,"tag":198,"props":1073,"children":1074},{"class":200,"line":201},[1075],{"type":48,"tag":198,"props":1076,"children":1077},{"style":262},[1078],{"type":53,"value":1079},"# Delete the 0.0.0.0\u002F0 entry (or other overly broad entries)\n",{"type":48,"tag":198,"props":1081,"children":1082},{"class":200,"line":29},[1083,1087,1091,1095,1099,1104,1108,1112,1116,1120],{"type":48,"tag":198,"props":1084,"children":1085},{"style":205},[1086],{"type":53,"value":208},{"type":48,"tag":198,"props":1088,"children":1089},{"style":211},[1090],{"type":53,"value":231},{"type":48,"tag":198,"props":1092,"children":1093},{"style":211},[1094],{"type":53,"value":281},{"type":48,"tag":198,"props":1096,"children":1097},{"style":211},[1098],{"type":53,"value":286},{"type":48,"tag":198,"props":1100,"children":1101},{"style":211},[1102],{"type":53,"value":1103}," delete",{"type":48,"tag":198,"props":1105,"children":1106},{"style":294},[1107],{"type":53,"value":297},{"type":48,"tag":198,"props":1109,"children":1110},{"style":211},[1111],{"type":53,"value":654},{"type":48,"tag":198,"props":1113,"children":1114},{"style":305},[1115],{"type":53,"value":659},{"type":48,"tag":198,"props":1117,"children":1118},{"style":294},[1119],{"type":53,"value":313},{"type":48,"tag":198,"props":1121,"children":1122},{"style":211},[1123],{"type":53,"value":1124}," 0.0.0.0\u002F0\n",{"type":48,"tag":56,"props":1126,"children":1127},{},[1128,1133,1135,1140],{"type":48,"tag":127,"props":1129,"children":1130},{},[1131],{"type":53,"value":1132},"Important:",{"type":53,"value":1134}," Only remove ",{"type":48,"tag":62,"props":1136,"children":1138},{"className":1137},[],[1139],{"type":53,"value":67},{"type":53,"value":1141}," after confirming your specific CIDR entries are in place and tested.",{"type":48,"tag":244,"props":1143,"children":1145},{"id":1144},"_6-verify-the-updated-allowlist",[1146],{"type":53,"value":1147},"6. Verify the Updated Allowlist",{"type":48,"tag":187,"props":1149,"children":1151},{"className":189,"code":1150,"language":191,"meta":192,"style":192},"# Confirm the final allowlist\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n",[1152],{"type":48,"tag":62,"props":1153,"children":1154},{"__ignoreMap":192},[1155,1163],{"type":48,"tag":198,"props":1156,"children":1157},{"class":200,"line":201},[1158],{"type":48,"tag":198,"props":1159,"children":1160},{"style":262},[1161],{"type":53,"value":1162},"# Confirm the final allowlist\n",{"type":48,"tag":198,"props":1164,"children":1165},{"class":200,"line":29},[1166,1170,1174,1178,1182,1186,1190,1194,1198,1202,1206],{"type":48,"tag":198,"props":1167,"children":1168},{"style":205},[1169],{"type":53,"value":208},{"type":48,"tag":198,"props":1171,"children":1172},{"style":211},[1173],{"type":53,"value":231},{"type":48,"tag":198,"props":1175,"children":1176},{"style":211},[1177],{"type":53,"value":281},{"type":48,"tag":198,"props":1179,"children":1180},{"style":211},[1181],{"type":53,"value":286},{"type":48,"tag":198,"props":1183,"children":1184},{"style":211},[1185],{"type":53,"value":291},{"type":48,"tag":198,"props":1187,"children":1188},{"style":294},[1189],{"type":53,"value":297},{"type":48,"tag":198,"props":1191,"children":1192},{"style":211},[1193],{"type":53,"value":302},{"type":48,"tag":198,"props":1195,"children":1196},{"style":305},[1197],{"type":53,"value":308},{"type":48,"tag":198,"props":1199,"children":1200},{"style":294},[1201],{"type":53,"value":313},{"type":48,"tag":198,"props":1203,"children":1204},{"style":211},[1205],{"type":53,"value":318},{"type":48,"tag":198,"props":1207,"children":1208},{"style":211},[1209],{"type":53,"value":323},{"type":48,"tag":56,"props":1211,"children":1212},{},[1213],{"type":53,"value":1214},"Test connectivity from each authorized source:",{"type":48,"tag":187,"props":1216,"children":1218},{"className":189,"code":1217,"language":191,"meta":192,"style":192},"# Test SQL connection from an allowed IP\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT 1;\"\n\n# Test from a non-allowed IP (should fail)\n# Attempt connection from an IP not in the allowlist — expect connection refused\n",[1219],{"type":48,"tag":62,"props":1220,"children":1221},{"__ignoreMap":192},[1222,1230,1280,1287,1295],{"type":48,"tag":198,"props":1223,"children":1224},{"class":200,"line":201},[1225],{"type":48,"tag":198,"props":1226,"children":1227},{"style":262},[1228],{"type":53,"value":1229},"# Test SQL connection from an allowed IP\n",{"type":48,"tag":198,"props":1231,"children":1232},{"class":200,"line":29},[1233,1238,1243,1248,1252,1257,1262,1267,1271,1276],{"type":48,"tag":198,"props":1234,"children":1235},{"style":205},[1236],{"type":53,"value":1237},"cockroach",{"type":48,"tag":198,"props":1239,"children":1240},{"style":211},[1241],{"type":53,"value":1242}," sql",{"type":48,"tag":198,"props":1244,"children":1245},{"style":211},[1246],{"type":53,"value":1247}," --url",{"type":48,"tag":198,"props":1249,"children":1250},{"style":294},[1251],{"type":53,"value":725},{"type":48,"tag":198,"props":1253,"children":1254},{"style":211},[1255],{"type":53,"value":1256},"\u003Cconnection-string>",{"type":48,"tag":198,"props":1258,"children":1259},{"style":294},[1260],{"type":53,"value":1261},"\"",{"type":48,"tag":198,"props":1263,"children":1264},{"style":211},[1265],{"type":53,"value":1266}," -e",{"type":48,"tag":198,"props":1268,"children":1269},{"style":294},[1270],{"type":53,"value":725},{"type":48,"tag":198,"props":1272,"children":1273},{"style":211},[1274],{"type":53,"value":1275},"SELECT 1;",{"type":48,"tag":198,"props":1277,"children":1278},{"style":294},[1279],{"type":53,"value":735},{"type":48,"tag":198,"props":1281,"children":1282},{"class":200,"line":25},[1283],{"type":48,"tag":198,"props":1284,"children":1285},{"emptyLinePlaceholder":854},[1286],{"type":53,"value":857},{"type":48,"tag":198,"props":1288,"children":1289},{"class":200,"line":701},[1290],{"type":48,"tag":198,"props":1291,"children":1292},{"style":262},[1293],{"type":53,"value":1294},"# Test from a non-allowed IP (should fail)\n",{"type":48,"tag":198,"props":1296,"children":1297},{"class":200,"line":714},[1298],{"type":48,"tag":198,"props":1299,"children":1300},{"style":262},[1301],{"type":53,"value":1302},"# Attempt connection from an IP not in the allowlist — expect connection refused\n",{"type":48,"tag":71,"props":1304,"children":1306},{"id":1305},"safety-considerations",[1307],{"type":53,"value":1308},"Safety Considerations",{"type":48,"tag":56,"props":1310,"children":1311},{},[1312,1317,1319,1324],{"type":48,"tag":127,"props":1313,"children":1314},{},[1315],{"type":53,"value":1316},"Risk: Locking yourself out.",{"type":53,"value":1318}," Removing ",{"type":48,"tag":62,"props":1320,"children":1322},{"className":1321},[],[1323],{"type":53,"value":67},{"type":53,"value":1325}," before adding your current IP will immediately block your access.",{"type":48,"tag":56,"props":1327,"children":1328},{},[1329],{"type":48,"tag":127,"props":1330,"children":1331},{},[1332],{"type":53,"value":1333},"Mitigation steps:",{"type":48,"tag":1335,"props":1336,"children":1337},"ol",{},[1338,1354,1371,1386],{"type":48,"tag":82,"props":1339,"children":1340},{},[1341,1346,1348],{"type":48,"tag":127,"props":1342,"children":1343},{},[1344],{"type":53,"value":1345},"Identify your current IP",{"type":53,"value":1347}," before making changes: ",{"type":48,"tag":62,"props":1349,"children":1351},{"className":1350},[],[1352],{"type":53,"value":1353},"curl -s https:\u002F\u002Fcheckip.amazonaws.com",{"type":48,"tag":82,"props":1355,"children":1356},{},[1357,1362,1364,1369],{"type":48,"tag":127,"props":1358,"children":1359},{},[1360],{"type":53,"value":1361},"Add your IP first",{"type":53,"value":1363}," as a ",{"type":48,"tag":62,"props":1365,"children":1367},{"className":1366},[],[1368],{"type":53,"value":412},{"type":53,"value":1370}," entry before removing broad ranges",{"type":48,"tag":82,"props":1372,"children":1373},{},[1374,1379,1381],{"type":48,"tag":127,"props":1375,"children":1376},{},[1377],{"type":53,"value":1378},"Test connectivity",{"type":53,"value":1380}," after adding specific entries but before removing ",{"type":48,"tag":62,"props":1382,"children":1384},{"className":1383},[],[1385],{"type":53,"value":67},{"type":48,"tag":82,"props":1387,"children":1388},{},[1389,1394],{"type":48,"tag":127,"props":1390,"children":1391},{},[1392],{"type":53,"value":1393},"Keep Cloud Console access",{"type":53,"value":1395}," — the Cloud Console UI can modify allowlists even if SQL access is blocked",{"type":48,"tag":56,"props":1397,"children":1398},{},[1399],{"type":48,"tag":127,"props":1400,"children":1401},{},[1402],{"type":53,"value":1403},"Order of operations:",{"type":48,"tag":1335,"props":1405,"children":1406},{},[1407,1412,1417,1429],{"type":48,"tag":82,"props":1408,"children":1409},{},[1410],{"type":53,"value":1411},"Add all specific CIDR entries",{"type":48,"tag":82,"props":1413,"children":1414},{},[1415],{"type":53,"value":1416},"Verify SQL connectivity from each allowed source",{"type":48,"tag":82,"props":1418,"children":1419},{},[1420,1422,1427],{"type":53,"value":1421},"Remove ",{"type":48,"tag":62,"props":1423,"children":1425},{"className":1424},[],[1426],{"type":53,"value":67},{"type":53,"value":1428}," only after verifying all needed entries are in place",{"type":48,"tag":82,"props":1430,"children":1431},{},[1432],{"type":53,"value":1433},"Test again to confirm access still works",{"type":48,"tag":71,"props":1435,"children":1437},{"id":1436},"rollback",[1438],{"type":53,"value":1439},"Rollback",{"type":48,"tag":56,"props":1441,"children":1442},{},[1443],{"type":53,"value":1444},"If you lose access after removing a broad entry:",{"type":48,"tag":1335,"props":1446,"children":1447},{},[1448,1458,1482],{"type":48,"tag":82,"props":1449,"children":1450},{},[1451,1456],{"type":48,"tag":127,"props":1452,"children":1453},{},[1454],{"type":53,"value":1455},"Cloud Console:",{"type":53,"value":1457}," Log into the CockroachDB Cloud Console (web UI) — this does not use the IP allowlist",{"type":48,"tag":82,"props":1459,"children":1460},{},[1461,1466,1468,1473,1475,1480],{"type":48,"tag":127,"props":1462,"children":1463},{},[1464],{"type":53,"value":1465},"Re-add your IP:",{"type":53,"value":1467}," Add your current IP as a ",{"type":48,"tag":62,"props":1469,"children":1471},{"className":1470},[],[1472],{"type":53,"value":412},{"type":53,"value":1474}," or re-add ",{"type":48,"tag":62,"props":1476,"children":1478},{"className":1477},[],[1479],{"type":53,"value":67},{"type":53,"value":1481}," temporarily",{"type":48,"tag":82,"props":1483,"children":1484},{},[1485,1490],{"type":48,"tag":127,"props":1486,"children":1487},{},[1488],{"type":53,"value":1489},"Investigate:",{"type":53,"value":1491}," Determine which CIDR was missing and add it",{"type":48,"tag":187,"props":1493,"children":1495},{"className":189,"code":1494,"language":191,"meta":192,"style":192},"# Emergency: re-add 0.0.0.0\u002F0 via ccloud (if you still have ccloud access)\nccloud cluster networking allowlist create \u003Ccluster-name> 0.0.0.0\u002F0 \\\n  --sql \\\n  --ui \\\n  --name \"Emergency - temporary open access\"\n",[1496],{"type":48,"tag":62,"props":1497,"children":1498},{"__ignoreMap":192},[1499,1507,1555,1566,1577],{"type":48,"tag":198,"props":1500,"children":1501},{"class":200,"line":201},[1502],{"type":48,"tag":198,"props":1503,"children":1504},{"style":262},[1505],{"type":53,"value":1506},"# Emergency: re-add 0.0.0.0\u002F0 via ccloud (if you still have ccloud access)\n",{"type":48,"tag":198,"props":1508,"children":1509},{"class":200,"line":29},[1510,1514,1518,1522,1526,1530,1534,1538,1542,1546,1551],{"type":48,"tag":198,"props":1511,"children":1512},{"style":205},[1513],{"type":53,"value":208},{"type":48,"tag":198,"props":1515,"children":1516},{"style":211},[1517],{"type":53,"value":231},{"type":48,"tag":198,"props":1519,"children":1520},{"style":211},[1521],{"type":53,"value":281},{"type":48,"tag":198,"props":1523,"children":1524},{"style":211},[1525],{"type":53,"value":286},{"type":48,"tag":198,"props":1527,"children":1528},{"style":211},[1529],{"type":53,"value":645},{"type":48,"tag":198,"props":1531,"children":1532},{"style":294},[1533],{"type":53,"value":297},{"type":48,"tag":198,"props":1535,"children":1536},{"style":211},[1537],{"type":53,"value":654},{"type":48,"tag":198,"props":1539,"children":1540},{"style":305},[1541],{"type":53,"value":659},{"type":48,"tag":198,"props":1543,"children":1544},{"style":294},[1545],{"type":53,"value":313},{"type":48,"tag":198,"props":1547,"children":1548},{"style":211},[1549],{"type":53,"value":1550}," 0.0.0.0\u002F0",{"type":48,"tag":198,"props":1552,"children":1553},{"style":305},[1554],{"type":53,"value":686},{"type":48,"tag":198,"props":1556,"children":1557},{"class":200,"line":25},[1558,1562],{"type":48,"tag":198,"props":1559,"children":1560},{"style":211},[1561],{"type":53,"value":694},{"type":48,"tag":198,"props":1563,"children":1564},{"style":305},[1565],{"type":53,"value":686},{"type":48,"tag":198,"props":1567,"children":1568},{"class":200,"line":701},[1569,1573],{"type":48,"tag":198,"props":1570,"children":1571},{"style":211},[1572],{"type":53,"value":707},{"type":48,"tag":198,"props":1574,"children":1575},{"style":305},[1576],{"type":53,"value":686},{"type":48,"tag":198,"props":1578,"children":1579},{"class":200,"line":714},[1580,1584,1588,1593],{"type":48,"tag":198,"props":1581,"children":1582},{"style":211},[1583],{"type":53,"value":720},{"type":48,"tag":198,"props":1585,"children":1586},{"style":294},[1587],{"type":53,"value":725},{"type":48,"tag":198,"props":1589,"children":1590},{"style":211},[1591],{"type":53,"value":1592},"Emergency - temporary open access",{"type":48,"tag":198,"props":1594,"children":1595},{"style":294},[1596],{"type":53,"value":735},{"type":48,"tag":71,"props":1598,"children":1600},{"id":1599},"references",[1601],{"type":53,"value":1602},"References",{"type":48,"tag":56,"props":1604,"children":1605},{},[1606],{"type":48,"tag":127,"props":1607,"children":1608},{},[1609],{"type":53,"value":1610},"Skill references:",{"type":48,"tag":78,"props":1612,"children":1613},{},[1614],{"type":48,"tag":82,"props":1615,"children":1616},{},[1617],{"type":48,"tag":375,"props":1618,"children":1619},{"href":377},[1620],{"type":53,"value":1621},"ccloud commands for IP allowlists",{"type":48,"tag":56,"props":1623,"children":1624},{},[1625],{"type":48,"tag":127,"props":1626,"children":1627},{},[1628],{"type":53,"value":1629},"Related skills:",{"type":48,"tag":78,"props":1631,"children":1632},{},[1633,1644],{"type":48,"tag":82,"props":1634,"children":1635},{},[1636,1642],{"type":48,"tag":375,"props":1637,"children":1639},{"href":1638},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[1640],{"type":53,"value":1641},"auditing-cloud-cluster-security",{"type":53,"value":1643}," — Run a full security posture audit",{"type":48,"tag":82,"props":1645,"children":1646},{},[1647,1652],{"type":48,"tag":375,"props":1648,"children":1649},{"href":434},[1650],{"type":53,"value":1651},"configuring-private-connectivity",{"type":53,"value":1653}," — Private endpoints as an alternative to IP allowlists",{"type":48,"tag":56,"props":1655,"children":1656},{},[1657],{"type":48,"tag":127,"props":1658,"children":1659},{},[1660],{"type":53,"value":1661},"Official CockroachDB Documentation:",{"type":48,"tag":78,"props":1663,"children":1664},{},[1665,1676,1686],{"type":48,"tag":82,"props":1666,"children":1667},{},[1668],{"type":48,"tag":375,"props":1669,"children":1673},{"href":1670,"rel":1671},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html",[1672],"nofollow",[1674],{"type":53,"value":1675},"Network Authorization",{"type":48,"tag":82,"props":1677,"children":1678},{},[1679],{"type":48,"tag":375,"props":1680,"children":1683},{"href":1681,"rel":1682},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fprivate-clusters.html",[1672],[1684],{"type":53,"value":1685},"Private Clusters",{"type":48,"tag":82,"props":1687,"children":1688},{},[1689],{"type":48,"tag":375,"props":1690,"children":1693},{"href":1691,"rel":1692},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fccloud-get-started.html",[1672],[1694],{"type":53,"value":1695},"ccloud CLI Reference",{"type":48,"tag":1697,"props":1698,"children":1699},"style",{},[1700],{"type":53,"value":1701},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1703,"total":1793},[1704,1717,1732,1747,1757,1770,1783],{"slug":1705,"name":1705,"fn":1706,"description":1707,"org":1708,"tags":1709,"stars":25,"repoUrl":26,"updatedAt":1716},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1710,1711,1713],{"name":23,"slug":24,"type":15},{"name":583,"slug":1712,"type":15},"monitoring",{"name":1714,"slug":1715,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":1718,"name":1718,"fn":1719,"description":1720,"org":1721,"tags":1722,"stars":25,"repoUrl":26,"updatedAt":1731},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1723,1726,1727,1728],{"name":1724,"slug":1725,"type":15},"Data Modeling","data-modeling",{"name":23,"slug":24,"type":15},{"name":1714,"slug":1715,"type":15},{"name":1729,"slug":1730,"type":15},"SQL","sql","2026-07-12T07:57:22.763788",{"slug":1733,"name":1733,"fn":1734,"description":1735,"org":1736,"tags":1737,"stars":25,"repoUrl":26,"updatedAt":1746},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1738,1741,1744,1745],{"name":1739,"slug":1740,"type":15},"Audit","audit",{"name":1742,"slug":1743,"type":15},"Compliance","compliance",{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":1641,"name":1641,"fn":1748,"description":1749,"org":1750,"tags":1751,"stars":25,"repoUrl":26,"updatedAt":1756},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1752,1753,1754,1755],{"name":1739,"slug":1740,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":1758,"name":1758,"fn":1759,"description":1760,"org":1761,"tags":1762,"stars":25,"repoUrl":26,"updatedAt":1769},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1763,1764,1767,1768],{"name":1739,"slug":1740,"type":15},{"name":1765,"slug":1766,"type":15},"Data Analysis","data-analysis",{"name":23,"slug":24,"type":15},{"name":1714,"slug":1715,"type":15},"2026-07-12T07:57:16.190081",{"slug":1771,"name":1771,"fn":1772,"description":1773,"org":1774,"tags":1775,"stars":25,"repoUrl":26,"updatedAt":1782},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1776,1777,1780,1781],{"name":23,"slug":24,"type":15},{"name":1778,"slug":1779,"type":15},"Engineering","engineering",{"name":1714,"slug":1715,"type":15},{"name":1729,"slug":1730,"type":15},"2026-07-12T07:57:26.543278",{"slug":1784,"name":1784,"fn":1785,"description":1786,"org":1787,"tags":1788,"stars":25,"repoUrl":26,"updatedAt":1792},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1789,1790,1791],{"name":23,"slug":24,"type":15},{"name":1714,"slug":1715,"type":15},{"name":1729,"slug":1730,"type":15},"2026-07-25T05:31:22.562808",34,{"items":1795,"total":1915},[1796,1813,1827,1842,1853,1863,1874,1880,1887,1894,1901,1908],{"slug":1797,"name":1797,"fn":1798,"description":1799,"org":1800,"tags":1801,"stars":1810,"repoUrl":1811,"updatedAt":1812},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1802,1803,1806,1809],{"name":23,"slug":24,"type":15},{"name":1804,"slug":1805,"type":15},"Incident Response","incident-response",{"name":1807,"slug":1808,"type":15},"Kubernetes","kubernetes",{"name":583,"slug":1712,"type":15},105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":1814,"name":1814,"fn":1815,"description":1816,"org":1817,"tags":1818,"stars":1810,"repoUrl":1811,"updatedAt":1826},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1819,1822,1825],{"name":1820,"slug":1821,"type":15},"Deployment","deployment",{"name":1823,"slug":1824,"type":15},"Encryption","encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":1828,"name":1828,"fn":1829,"description":1830,"org":1831,"tags":1832,"stars":1810,"repoUrl":1811,"updatedAt":1841},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1833,1834,1837,1838],{"name":23,"slug":24,"type":15},{"name":1835,"slug":1836,"type":15},"Debugging","debugging",{"name":1807,"slug":1808,"type":15},{"name":1839,"slug":1840,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":1843,"name":1843,"fn":1844,"description":1845,"org":1846,"tags":1847,"stars":1810,"repoUrl":1811,"updatedAt":1852},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1848,1849,1850,1851],{"name":23,"slug":24,"type":15},{"name":1835,"slug":1836,"type":15},{"name":1820,"slug":1821,"type":15},{"name":1807,"slug":1808,"type":15},"2026-07-12T07:57:24.018818",{"slug":1854,"name":1854,"fn":1855,"description":1856,"org":1857,"tags":1858,"stars":1810,"repoUrl":1811,"updatedAt":1862},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1859,1860,1861],{"name":23,"slug":24,"type":15},{"name":1820,"slug":1821,"type":15},{"name":1807,"slug":1808,"type":15},"2026-07-12T07:56:45.777567",{"slug":1864,"name":1864,"fn":1865,"description":1866,"org":1867,"tags":1868,"stars":1810,"repoUrl":1811,"updatedAt":1873},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1869,1870,1871,1872],{"name":23,"slug":24,"type":15},{"name":1820,"slug":1821,"type":15},{"name":1807,"slug":1808,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T07:56:47.082609",{"slug":1705,"name":1705,"fn":1706,"description":1707,"org":1875,"tags":1876,"stars":25,"repoUrl":26,"updatedAt":1716},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1877,1878,1879],{"name":23,"slug":24,"type":15},{"name":583,"slug":1712,"type":15},{"name":1714,"slug":1715,"type":15},{"slug":1718,"name":1718,"fn":1719,"description":1720,"org":1881,"tags":1882,"stars":25,"repoUrl":26,"updatedAt":1731},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1883,1884,1885,1886],{"name":1724,"slug":1725,"type":15},{"name":23,"slug":24,"type":15},{"name":1714,"slug":1715,"type":15},{"name":1729,"slug":1730,"type":15},{"slug":1733,"name":1733,"fn":1734,"description":1735,"org":1888,"tags":1889,"stars":25,"repoUrl":26,"updatedAt":1746},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1890,1891,1892,1893],{"name":1739,"slug":1740,"type":15},{"name":1742,"slug":1743,"type":15},{"name":23,"slug":24,"type":15},{"name":13,"slug":14,"type":15},{"slug":1641,"name":1641,"fn":1748,"description":1749,"org":1895,"tags":1896,"stars":25,"repoUrl":26,"updatedAt":1756},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1897,1898,1899,1900],{"name":1739,"slug":1740,"type":15},{"name":23,"slug":24,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":1758,"name":1758,"fn":1759,"description":1760,"org":1902,"tags":1903,"stars":25,"repoUrl":26,"updatedAt":1769},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1904,1905,1906,1907],{"name":1739,"slug":1740,"type":15},{"name":1765,"slug":1766,"type":15},{"name":23,"slug":24,"type":15},{"name":1714,"slug":1715,"type":15},{"slug":1771,"name":1771,"fn":1772,"description":1773,"org":1909,"tags":1910,"stars":25,"repoUrl":26,"updatedAt":1782},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1911,1912,1913,1914],{"name":23,"slug":24,"type":15},{"name":1778,"slug":1779,"type":15},{"name":1714,"slug":1715,"type":15},{"name":1729,"slug":1730,"type":15},40]