[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-configuring-private-connectivity":3,"mdc-reb0ms-key":39,"related-org-cockroachdb-configuring-private-connectivity":3149,"related-repo-cockroachdb-configuring-private-connectivity":3311},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"configuring-private-connectivity","configure private network connectivity for CockroachDB","Configures private network connectivity for CockroachDB Cloud clusters including AWS PrivateLink, GCP Private Service Connect, Azure Private Link, egress private endpoints, and VPC peering. Use when setting up private endpoints to eliminate public internet exposure, configuring egress to external services like Kafka, or establishing VPC peering.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Networking","networking",{"name":20,"slug":21,"type":15},"Database","database",{"name":23,"slug":24,"type":15},"Cloud","cloud",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:57:02.859478",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fconfiguring-private-connectivity","---\nname: configuring-private-connectivity\ndescription: Configures private network connectivity for CockroachDB Cloud clusters including AWS PrivateLink, GCP Private Service Connect, Azure Private Link, egress private endpoints, and VPC peering. Use when setting up private endpoints to eliminate public internet exposure, configuring egress to external services like Kafka, or establishing VPC peering.\ncompatibility: Requires CockroachDB Cloud Advanced or Standard plan. Private endpoints require cloud provider configuration (AWS, GCP, or Azure). VPC peering requires Advanced plan.\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Configuring Private Connectivity\n\nConfigures private network connectivity for CockroachDB Cloud clusters to eliminate public internet exposure for database traffic. Covers ingress private endpoints (AWS PrivateLink, GCP Private Service Connect, Azure Private Link), egress private endpoints for outbound connections to external services, and VPC peering.\n\n## When to Use This Skill\n\n- Setting up private endpoints to eliminate public internet exposure for database connections\n- Configuring egress private endpoints for CDC changefeeds to Confluent Kafka or other external services\n- Establishing VPC peering between a CockroachDB Cloud cluster and application VPCs\n- Troubleshooting DNS resolution issues with private endpoints\n- Resolving \"stuck pending\" or connection failure errors with private endpoints\n- Automating private connectivity setup with Terraform\n\n## Prerequisites\n\n- **CockroachDB Cloud cluster** — Standard or Advanced plan (VPC peering requires Advanced)\n- **ccloud CLI** authenticated with Cluster Admin role\n- **Cloud provider access:**\n  - **AWS:** IAM permissions to create VPC endpoints, modify DNS, and manage security groups\n  - **GCP:** Permissions to create Private Service Connect endpoints and DNS records\n  - **Azure:** Permissions to create private endpoints and manage DNS zones\n- **Cluster ID and cloud provider details** from `ccloud cluster info`\n\n**Verify access:**\n```bash\nccloud auth whoami\nccloud cluster info \u003Ccluster-name> -o json\n```\n\nSee [ccloud commands reference](references\u002Fccloud-commands.md) for full command syntax.\n\n## Configuration Decisions\n\nBefore proceeding, determine which connectivity types and cloud provider apply to the user's environment. Ask which options are relevant, then follow only the corresponding sections below.\n\n**Decision 1 — Connectivity type(s) needed:**\n- **Ingress private endpoints:** Applications connect to CockroachDB over a private network path (AWS PrivateLink, GCP Private Service Connect, Azure Private Link). Most common use case.\n- **Egress private endpoints:** CockroachDB connects outbound to external services (e.g., Confluent Kafka for CDC) over a private path.\n- **VPC peering:** Direct network connection between the application VPC and the CockroachDB Cloud VPC. Requires Advanced plan.\n- **Combination:** Multiple connectivity types can be configured together.\n\n**Decision 2 — Cloud provider:**\n- **AWS:** Use AWS PrivateLink for ingress, AWS VPC peering for peering.\n- **GCP:** Use GCP Private Service Connect for ingress, GCP VPC peering for peering.\n- **Azure:** Use Azure Private Link for ingress. VPC peering is not available for Azure.\n\n## Steps\n\n### Part 1: Ingress Private Endpoints\n\n> Follow this part only if the user selected **Ingress private endpoints** in Decision 1. Follow only the subsection (1.2, 1.3, or 1.4) matching the user's cloud provider from Decision 2.\n\nPrivate endpoints allow applications in your VPC to connect to CockroachDB Cloud without traversing the public internet.\n\n#### 1.1 Get the Private Endpoint Service\n\nGet the private endpoint service information from the **Cloud Console** or **Cloud API**:\n\n**Cloud Console:** Navigate to your cluster's **Networking > Private endpoint** tab. The service name\u002FID is displayed.\n\n**Cloud API:**\n```bash\ncurl \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-services\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n```\n\nThis returns the cloud provider service name\u002FID needed to create the endpoint in your cloud account.\n\n#### 1.2 Create the Private Endpoint (AWS PrivateLink)\n\n```bash\n# In your AWS account, create a VPC endpoint\naws ec2 create-vpc-endpoint \\\n  --vpc-id \u003Cyour-vpc-id> \\\n  --service-name \u003Cservice-name-from-ccloud> \\\n  --vpc-endpoint-type Interface \\\n  --subnet-ids \u003Csubnet-id-1> \u003Csubnet-id-2> \\\n  --security-group-ids \u003Csecurity-group-id>\n```\n\n**Security group requirements:**\n- Allow inbound TCP port 26257 from your application subnets\n- Allow outbound to the VPC endpoint\n\n#### 1.3 Create the Private Endpoint (GCP Private Service Connect)\n\n```bash\n# Reserve an internal IP address\ngcloud compute addresses create cockroachdb-psc \\\n  --region=\u003Cregion> \\\n  --subnet=\u003Csubnet> \\\n  --addresses=\u003Cinternal-ip>\n\n# Create the Private Service Connect endpoint\ngcloud compute forwarding-rules create cockroachdb-psc \\\n  --region=\u003Cregion> \\\n  --network=\u003Cnetwork> \\\n  --address=cockroachdb-psc \\\n  --target-service-attachment=\u003Cservice-attachment-from-ccloud>\n```\n\n#### 1.4 Create the Private Endpoint (Azure Private Link)\n\n```bash\n# Create a private endpoint in your Azure subscription\naz network private-endpoint create \\\n  --name cockroachdb-pe \\\n  --resource-group \u003Cresource-group> \\\n  --vnet-name \u003Cvnet-name> \\\n  --subnet \u003Csubnet-name> \\\n  --private-connection-resource-id \u003Cservice-id-from-ccloud> \\\n  --connection-name cockroachdb-connection\n```\n\n#### 1.5 Register the Endpoint in CockroachDB Cloud\n\nRegister the private endpoint via the **Cloud Console** or **Cloud API**:\n\n**Cloud Console:** Navigate to your cluster's **Networking > Private endpoint** tab, click **Add a private endpoint**, and enter the cloud provider endpoint ID.\n\n**Cloud API:**\n```bash\n# Register the private endpoint connection with the cluster\ncurl -X POST \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"endpoint_id\": \"\u003Ccloud-provider-endpoint-id>\"}'\n```\n\n**Terraform:**\n```hcl\nresource \"cockroach_private_endpoint_connection\" \"connection\" {\n  cluster_id  = cockroach_cluster.cluster.id\n  endpoint_id = \"\u003Ccloud-provider-endpoint-id>\"\n}\n```\n\nWait for the connection status to become `AVAILABLE` — check in the Cloud Console or via API:\n```bash\ncurl \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n```\n\n#### 1.6 Configure DNS\n\nPrivate endpoints require DNS configuration so clients resolve the cluster hostname to the private endpoint IP instead of the public IP.\n\n**AWS:** Create a Route 53 private hosted zone with the cluster hostname pointing to the VPC endpoint DNS name.\n\n**GCP:** Create a Cloud DNS private zone with an A record pointing to the reserved internal IP.\n\n**Azure:** Create a private DNS zone with an A record pointing to the private endpoint IP.\n\nSee [cloud provider setup reference](references\u002Fcloud-provider-setup.md) for detailed DNS configuration steps.\n\n### Part 2: Egress Private Endpoints\n\n> Skip this part if the user did not select **Egress private endpoints** in Decision 1.\n\nEgress private endpoints allow CockroachDB Cloud to connect to external services (e.g., Confluent Kafka for CDC) over a private network path.\n\n#### 2.1 Create an Egress Private Endpoint\n\nCreate an egress endpoint via the **Cloud Console** or **Cloud API**:\n\n**Cloud Console:** Navigate to your cluster's **Networking > Egress** tab, click **Add egress endpoint**, and specify the external service.\n\n**Cloud API:**\n```bash\n# Create an egress endpoint to an external service\ncurl -X POST \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fegress-endpoints\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"service_name\": \"\u003Cexternal-service-name>\", \"cloud_provider\": \"\u003CAWS|GCP|AZURE>\"}'\n```\n\n**Common egress targets:**\n- Confluent Cloud Kafka (most common use case)\n- Amazon MSK\n- Self-managed Kafka on PrivateLink\n- Other SaaS services with PrivateLink support\n\n#### 2.2 Accept the Endpoint Connection\n\nThe external service owner must accept the pending connection request. For Confluent Cloud:\n\n1. Log into Confluent Cloud Console\n2. Navigate to **Networking > Private Link Access**\n3. Accept the pending connection from the CockroachDB Cloud account\n\n#### 2.3 Verify Egress Endpoint Status\n\nCheck egress endpoint status via the Cloud Console (**Networking > Egress** tab) or Cloud API:\n```bash\ncurl \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fegress-endpoints\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n```\n\n**Troubleshooting \"stuck pending\":**\n- Verify the external service has accepted the connection\n- Check that the external service is in the same cloud provider region\n- Contact the external service admin to accept the pending connection\n\n#### 2.4 Use the Egress Endpoint in CDC Changefeeds\n\n```sql\n-- Create a changefeed using the egress endpoint\nCREATE CHANGEFEED FOR TABLE orders\n  INTO 'kafka:\u002F\u002F\u003Cprivate-kafka-endpoint>:9092?topic_prefix=crdb_'\n  WITH updated, resolved;\n```\n\n### Part 3: VPC Peering\n\n> Skip this part if the user did not select **VPC peering** in Decision 1. Follow only the commands matching the user's cloud provider (AWS or GCP) from Decision 2. Azure does not support VPC peering.\n\nVPC peering creates a direct network connection between your VPC and the CockroachDB Cloud VPC.\n\n#### 3.1 Initiate VPC Peering\n\n```bash\n# AWS\nccloud cluster networking peering create \u003Ccluster-id> \\\n  --peer-account-id \u003Caws-account-id> \\\n  --peer-vpc-id \u003Cvpc-id> \\\n  --peer-vpc-region \u003Cregion> \\\n  --peer-cidr \u003Ccidr-block>\n\n# GCP\nccloud cluster networking peering create \u003Ccluster-id> \\\n  --peer-project-id \u003Cgcp-project-id> \\\n  --peer-network \u003Cnetwork-name>\n```\n\n#### 3.2 Accept the Peering Request\n\n**AWS:** Accept the peering request in the VPC Console:\n```bash\naws ec2 accept-vpc-peering-connection \\\n  --vpc-peering-connection-id \u003Cpeering-id>\n```\n\n**GCP:** Peering is established automatically if the peer network configuration is correct.\n\n#### 3.3 Configure Route Tables\n\nAfter peering is established, update route tables to route traffic to the CockroachDB Cloud CIDR through the peering connection.\n\n```bash\n# AWS — add a route to the CockroachDB Cloud CIDR\naws ec2 create-route \\\n  --route-table-id \u003Croute-table-id> \\\n  --destination-cidr-block \u003Ccockroachdb-cidr> \\\n  --vpc-peering-connection-id \u003Cpeering-id>\n```\n\n#### 3.4 Verify VPC Peering\n\n```bash\n# Check peering status\nccloud cluster networking peering list \u003Ccluster-id> -o json\n```\n\nTest connectivity from your VPC:\n```bash\n# From an instance in your peered VPC\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT 1;\"\n```\n\n## Safety Considerations\n\n| Impact Type | Severity | Recommendation |\n|-------------|----------|----------------|\n| Private endpoint creation | Low | Does not affect existing connections; additive change |\n| DNS configuration change | Medium | Incorrect DNS can break existing connections |\n| IP allowlist interaction | Medium | Private endpoints bypass IP allowlists; review security implications |\n| VPC peering CIDR overlap | High | Overlapping CIDRs will prevent peering; plan IP space carefully |\n| Egress endpoint creation | Low | Does not affect cluster operation |\n\n**Do not:**\n- Delete a private endpoint that has active connections without migrating traffic first\n- Configure overlapping CIDR ranges between peered VPCs\n- Remove DNS records for private endpoints while clients are connected\n- Assume private endpoints replace all other security controls (authentication and authorization still apply)\n\n**When to prefer private endpoints over IP allowlists:**\n- When the IP allowlist entry limit is insufficient for your number of source IPs\n- When you need to eliminate public internet exposure entirely\n- When compliance requirements mandate private network paths\n\n## Rollback\n\n**Remove a private endpoint:**\n```bash\n# Delete the endpoint connection in CockroachDB Cloud (via Cloud API)\ncurl -X DELETE \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections\u002F\u003Cendpoint-id>\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n\n# Or remove via Cloud Console: Networking > Private endpoint > Delete\n\n# Then delete the endpoint in your cloud provider\n# AWS\naws ec2 delete-vpc-endpoints --vpc-endpoint-ids \u003Cendpoint-id>\n```\n\n**Remove VPC peering:**\n```bash\nccloud cluster networking peering delete \u003Ccluster-id> --peering-id \u003Cpeering-id>\n```\n\nAfter removing private connectivity, ensure the IP allowlist is configured to allow connections from the public internet if needed.\n\n## References\n\n**Skill references:**\n- [ccloud networking commands](references\u002Fccloud-commands.md)\n- [Cloud provider setup steps](references\u002Fcloud-provider-setup.md)\n\n**Related skills:**\n- [configuring-ip-allowlists](..\u002Fconfiguring-ip-allowlists\u002FSKILL.md) — IP-based network access control\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Run a full security posture audit\n\n**Official CockroachDB Documentation:**\n- [Network Authorization](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html)\n- [AWS PrivateLink](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Faws-privatelink.html)\n- [GCP Private Service Connect](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fconnect-to-an-advanced-cluster)\n- [Azure Private Link](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization)\n- [VPC Peering](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html#vpc-peering)\n- [Egress Perimeter Controls](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fegress-perimeter-controls.html)\n",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"Requires CockroachDB Cloud Advanced or Standard plan. Private endpoints require cloud provider configuration (AWS, GCP, or Azure). VPC peering requires Advanced plan.",{"author":8,"version":43},"1.0",{"type":45,"children":46},"root",[47,55,61,68,103,109,191,199,282,296,302,307,315,358,366,396,402,409,425,430,437,456,473,481,538,543,549,732,740,753,759,1009,1015,1202,1208,1223,1244,1251,1370,1378,1419,1432,1481,1487,1492,1501,1510,1519,1531,1537,1552,1557,1563,1578,1599,1606,1719,1727,1750,1756,1761,1785,1791,1802,1851,1859,1877,1883,1924,1930,1944,1949,1955,2242,2248,2257,2309,2318,2324,2329,2446,2452,2515,2520,2584,2590,2711,2719,2742,2750,2768,2774,2782,2924,2932,3000,3005,3011,3019,3038,3046,3071,3079,3143],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Configuring Private Connectivity",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Configures private network connectivity for CockroachDB Cloud clusters to eliminate public internet exposure for database traffic. Covers ingress private endpoints (AWS PrivateLink, GCP Private Service Connect, Azure Private Link), egress private endpoints for outbound connections to external services, and VPC peering.",{"type":48,"tag":62,"props":63,"children":65},"h2",{"id":64},"when-to-use-this-skill",[66],{"type":53,"value":67},"When to Use This Skill",{"type":48,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,88,93,98],{"type":48,"tag":73,"props":74,"children":75},"li",{},[76],{"type":53,"value":77},"Setting up private endpoints to eliminate public internet exposure for database connections",{"type":48,"tag":73,"props":79,"children":80},{},[81],{"type":53,"value":82},"Configuring egress private endpoints for CDC changefeeds to Confluent Kafka or other external services",{"type":48,"tag":73,"props":84,"children":85},{},[86],{"type":53,"value":87},"Establishing VPC peering between a CockroachDB Cloud cluster and application VPCs",{"type":48,"tag":73,"props":89,"children":90},{},[91],{"type":53,"value":92},"Troubleshooting DNS resolution issues with private endpoints",{"type":48,"tag":73,"props":94,"children":95},{},[96],{"type":53,"value":97},"Resolving \"stuck pending\" or connection failure errors with private endpoints",{"type":48,"tag":73,"props":99,"children":100},{},[101],{"type":53,"value":102},"Automating private connectivity setup with Terraform",{"type":48,"tag":62,"props":104,"children":106},{"id":105},"prerequisites",[107],{"type":53,"value":108},"Prerequisites",{"type":48,"tag":69,"props":110,"children":111},{},[112,123,133,174],{"type":48,"tag":73,"props":113,"children":114},{},[115,121],{"type":48,"tag":116,"props":117,"children":118},"strong",{},[119],{"type":53,"value":120},"CockroachDB Cloud cluster",{"type":53,"value":122}," — Standard or Advanced plan (VPC peering requires Advanced)",{"type":48,"tag":73,"props":124,"children":125},{},[126,131],{"type":48,"tag":116,"props":127,"children":128},{},[129],{"type":53,"value":130},"ccloud CLI",{"type":53,"value":132}," authenticated with Cluster Admin role",{"type":48,"tag":73,"props":134,"children":135},{},[136,141],{"type":48,"tag":116,"props":137,"children":138},{},[139],{"type":53,"value":140},"Cloud provider access:",{"type":48,"tag":69,"props":142,"children":143},{},[144,154,164],{"type":48,"tag":73,"props":145,"children":146},{},[147,152],{"type":48,"tag":116,"props":148,"children":149},{},[150],{"type":53,"value":151},"AWS:",{"type":53,"value":153}," IAM permissions to create VPC endpoints, modify DNS, and manage security groups",{"type":48,"tag":73,"props":155,"children":156},{},[157,162],{"type":48,"tag":116,"props":158,"children":159},{},[160],{"type":53,"value":161},"GCP:",{"type":53,"value":163}," Permissions to create Private Service Connect endpoints and DNS records",{"type":48,"tag":73,"props":165,"children":166},{},[167,172],{"type":48,"tag":116,"props":168,"children":169},{},[170],{"type":53,"value":171},"Azure:",{"type":53,"value":173}," Permissions to create private endpoints and manage DNS zones",{"type":48,"tag":73,"props":175,"children":176},{},[177,182,184],{"type":48,"tag":116,"props":178,"children":179},{},[180],{"type":53,"value":181},"Cluster ID and cloud provider details",{"type":53,"value":183}," from ",{"type":48,"tag":185,"props":186,"children":188},"code",{"className":187},[],[189],{"type":53,"value":190},"ccloud cluster info",{"type":48,"tag":56,"props":192,"children":193},{},[194],{"type":48,"tag":116,"props":195,"children":196},{},[197],{"type":53,"value":198},"Verify access:",{"type":48,"tag":200,"props":201,"children":206},"pre",{"className":202,"code":203,"language":204,"meta":205,"style":205},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","ccloud auth whoami\nccloud cluster info \u003Ccluster-name> -o json\n","bash","",[207],{"type":48,"tag":185,"props":208,"children":209},{"__ignoreMap":205},[210,233],{"type":48,"tag":211,"props":212,"children":215},"span",{"class":213,"line":214},"line",1,[216,222,228],{"type":48,"tag":211,"props":217,"children":219},{"style":218},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[220],{"type":53,"value":221},"ccloud",{"type":48,"tag":211,"props":223,"children":225},{"style":224},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[226],{"type":53,"value":227}," auth",{"type":48,"tag":211,"props":229,"children":230},{"style":224},[231],{"type":53,"value":232}," whoami\n",{"type":48,"tag":211,"props":234,"children":235},{"class":213,"line":29},[236,240,245,250,256,261,267,272,277],{"type":48,"tag":211,"props":237,"children":238},{"style":218},[239],{"type":53,"value":221},{"type":48,"tag":211,"props":241,"children":242},{"style":224},[243],{"type":53,"value":244}," cluster",{"type":48,"tag":211,"props":246,"children":247},{"style":224},[248],{"type":53,"value":249}," info",{"type":48,"tag":211,"props":251,"children":253},{"style":252},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[254],{"type":53,"value":255}," \u003C",{"type":48,"tag":211,"props":257,"children":258},{"style":224},[259],{"type":53,"value":260},"cluster-nam",{"type":48,"tag":211,"props":262,"children":264},{"style":263},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[265],{"type":53,"value":266},"e",{"type":48,"tag":211,"props":268,"children":269},{"style":252},[270],{"type":53,"value":271},">",{"type":48,"tag":211,"props":273,"children":274},{"style":224},[275],{"type":53,"value":276}," -o",{"type":48,"tag":211,"props":278,"children":279},{"style":224},[280],{"type":53,"value":281}," json\n",{"type":48,"tag":56,"props":283,"children":284},{},[285,287,294],{"type":53,"value":286},"See ",{"type":48,"tag":288,"props":289,"children":291},"a",{"href":290},"references\u002Fccloud-commands.md",[292],{"type":53,"value":293},"ccloud commands reference",{"type":53,"value":295}," for full command syntax.",{"type":48,"tag":62,"props":297,"children":299},{"id":298},"configuration-decisions",[300],{"type":53,"value":301},"Configuration Decisions",{"type":48,"tag":56,"props":303,"children":304},{},[305],{"type":53,"value":306},"Before proceeding, determine which connectivity types and cloud provider apply to the user's environment. Ask which options are relevant, then follow only the corresponding sections below.",{"type":48,"tag":56,"props":308,"children":309},{},[310],{"type":48,"tag":116,"props":311,"children":312},{},[313],{"type":53,"value":314},"Decision 1 — Connectivity type(s) needed:",{"type":48,"tag":69,"props":316,"children":317},{},[318,328,338,348],{"type":48,"tag":73,"props":319,"children":320},{},[321,326],{"type":48,"tag":116,"props":322,"children":323},{},[324],{"type":53,"value":325},"Ingress private endpoints:",{"type":53,"value":327}," Applications connect to CockroachDB over a private network path (AWS PrivateLink, GCP Private Service Connect, Azure Private Link). Most common use case.",{"type":48,"tag":73,"props":329,"children":330},{},[331,336],{"type":48,"tag":116,"props":332,"children":333},{},[334],{"type":53,"value":335},"Egress private endpoints:",{"type":53,"value":337}," CockroachDB connects outbound to external services (e.g., Confluent Kafka for CDC) over a private path.",{"type":48,"tag":73,"props":339,"children":340},{},[341,346],{"type":48,"tag":116,"props":342,"children":343},{},[344],{"type":53,"value":345},"VPC peering:",{"type":53,"value":347}," Direct network connection between the application VPC and the CockroachDB Cloud VPC. Requires Advanced plan.",{"type":48,"tag":73,"props":349,"children":350},{},[351,356],{"type":48,"tag":116,"props":352,"children":353},{},[354],{"type":53,"value":355},"Combination:",{"type":53,"value":357}," Multiple connectivity types can be configured together.",{"type":48,"tag":56,"props":359,"children":360},{},[361],{"type":48,"tag":116,"props":362,"children":363},{},[364],{"type":53,"value":365},"Decision 2 — Cloud provider:",{"type":48,"tag":69,"props":367,"children":368},{},[369,378,387],{"type":48,"tag":73,"props":370,"children":371},{},[372,376],{"type":48,"tag":116,"props":373,"children":374},{},[375],{"type":53,"value":151},{"type":53,"value":377}," Use AWS PrivateLink for ingress, AWS VPC peering for peering.",{"type":48,"tag":73,"props":379,"children":380},{},[381,385],{"type":48,"tag":116,"props":382,"children":383},{},[384],{"type":53,"value":161},{"type":53,"value":386}," Use GCP Private Service Connect for ingress, GCP VPC peering for peering.",{"type":48,"tag":73,"props":388,"children":389},{},[390,394],{"type":48,"tag":116,"props":391,"children":392},{},[393],{"type":53,"value":171},{"type":53,"value":395}," Use Azure Private Link for ingress. VPC peering is not available for Azure.",{"type":48,"tag":62,"props":397,"children":399},{"id":398},"steps",[400],{"type":53,"value":401},"Steps",{"type":48,"tag":403,"props":404,"children":406},"h3",{"id":405},"part-1-ingress-private-endpoints",[407],{"type":53,"value":408},"Part 1: Ingress Private Endpoints",{"type":48,"tag":410,"props":411,"children":412},"blockquote",{},[413],{"type":48,"tag":56,"props":414,"children":415},{},[416,418,423],{"type":53,"value":417},"Follow this part only if the user selected ",{"type":48,"tag":116,"props":419,"children":420},{},[421],{"type":53,"value":422},"Ingress private endpoints",{"type":53,"value":424}," in Decision 1. Follow only the subsection (1.2, 1.3, or 1.4) matching the user's cloud provider from Decision 2.",{"type":48,"tag":56,"props":426,"children":427},{},[428],{"type":53,"value":429},"Private endpoints allow applications in your VPC to connect to CockroachDB Cloud without traversing the public internet.",{"type":48,"tag":431,"props":432,"children":434},"h4",{"id":433},"_11-get-the-private-endpoint-service",[435],{"type":53,"value":436},"1.1 Get the Private Endpoint Service",{"type":48,"tag":56,"props":438,"children":439},{},[440,442,447,449,454],{"type":53,"value":441},"Get the private endpoint service information from the ",{"type":48,"tag":116,"props":443,"children":444},{},[445],{"type":53,"value":446},"Cloud Console",{"type":53,"value":448}," or ",{"type":48,"tag":116,"props":450,"children":451},{},[452],{"type":53,"value":453},"Cloud API",{"type":53,"value":455},":",{"type":48,"tag":56,"props":457,"children":458},{},[459,464,466,471],{"type":48,"tag":116,"props":460,"children":461},{},[462],{"type":53,"value":463},"Cloud Console:",{"type":53,"value":465}," Navigate to your cluster's ",{"type":48,"tag":116,"props":467,"children":468},{},[469],{"type":53,"value":470},"Networking > Private endpoint",{"type":53,"value":472}," tab. The service name\u002FID is displayed.",{"type":48,"tag":56,"props":474,"children":475},{},[476],{"type":48,"tag":116,"props":477,"children":478},{},[479],{"type":53,"value":480},"Cloud API:",{"type":48,"tag":200,"props":482,"children":484},{"className":202,"code":483,"language":204,"meta":205,"style":205},"curl \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-services\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n",[485],{"type":48,"tag":185,"props":486,"children":487},{"__ignoreMap":205},[488,516],{"type":48,"tag":211,"props":489,"children":490},{"class":213,"line":214},[491,496,501,506,511],{"type":48,"tag":211,"props":492,"children":493},{"style":218},[494],{"type":53,"value":495},"curl",{"type":48,"tag":211,"props":497,"children":498},{"style":252},[499],{"type":53,"value":500}," \"",{"type":48,"tag":211,"props":502,"children":503},{"style":224},[504],{"type":53,"value":505},"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-services",{"type":48,"tag":211,"props":507,"children":508},{"style":252},[509],{"type":53,"value":510},"\"",{"type":48,"tag":211,"props":512,"children":513},{"style":263},[514],{"type":53,"value":515}," \\\n",{"type":48,"tag":211,"props":517,"children":518},{"class":213,"line":29},[519,524,528,533],{"type":48,"tag":211,"props":520,"children":521},{"style":224},[522],{"type":53,"value":523},"  -H",{"type":48,"tag":211,"props":525,"children":526},{"style":252},[527],{"type":53,"value":500},{"type":48,"tag":211,"props":529,"children":530},{"style":224},[531],{"type":53,"value":532},"Authorization: Bearer \u003Capi-key>",{"type":48,"tag":211,"props":534,"children":535},{"style":252},[536],{"type":53,"value":537},"\"\n",{"type":48,"tag":56,"props":539,"children":540},{},[541],{"type":53,"value":542},"This returns the cloud provider service name\u002FID needed to create the endpoint in your cloud account.",{"type":48,"tag":431,"props":544,"children":546},{"id":545},"_12-create-the-private-endpoint-aws-privatelink",[547],{"type":53,"value":548},"1.2 Create the Private Endpoint (AWS PrivateLink)",{"type":48,"tag":200,"props":550,"children":552},{"className":202,"code":551,"language":204,"meta":205,"style":205},"# In your AWS account, create a VPC endpoint\naws ec2 create-vpc-endpoint \\\n  --vpc-id \u003Cyour-vpc-id> \\\n  --service-name \u003Cservice-name-from-ccloud> \\\n  --vpc-endpoint-type Interface \\\n  --subnet-ids \u003Csubnet-id-1> \u003Csubnet-id-2> \\\n  --security-group-ids \u003Csecurity-group-id>\n",[553],{"type":48,"tag":185,"props":554,"children":555},{"__ignoreMap":205},[556,565,587,617,647,665,705],{"type":48,"tag":211,"props":557,"children":558},{"class":213,"line":214},[559],{"type":48,"tag":211,"props":560,"children":562},{"style":561},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[563],{"type":53,"value":564},"# In your AWS account, create a VPC endpoint\n",{"type":48,"tag":211,"props":566,"children":567},{"class":213,"line":29},[568,573,578,583],{"type":48,"tag":211,"props":569,"children":570},{"style":218},[571],{"type":53,"value":572},"aws",{"type":48,"tag":211,"props":574,"children":575},{"style":224},[576],{"type":53,"value":577}," ec2",{"type":48,"tag":211,"props":579,"children":580},{"style":224},[581],{"type":53,"value":582}," create-vpc-endpoint",{"type":48,"tag":211,"props":584,"children":585},{"style":263},[586],{"type":53,"value":515},{"type":48,"tag":211,"props":588,"children":589},{"class":213,"line":25},[590,595,599,604,609,613],{"type":48,"tag":211,"props":591,"children":592},{"style":224},[593],{"type":53,"value":594},"  --vpc-id",{"type":48,"tag":211,"props":596,"children":597},{"style":252},[598],{"type":53,"value":255},{"type":48,"tag":211,"props":600,"children":601},{"style":224},[602],{"type":53,"value":603},"your-vpc-i",{"type":48,"tag":211,"props":605,"children":606},{"style":263},[607],{"type":53,"value":608},"d",{"type":48,"tag":211,"props":610,"children":611},{"style":252},[612],{"type":53,"value":271},{"type":48,"tag":211,"props":614,"children":615},{"style":263},[616],{"type":53,"value":515},{"type":48,"tag":211,"props":618,"children":620},{"class":213,"line":619},4,[621,626,630,635,639,643],{"type":48,"tag":211,"props":622,"children":623},{"style":224},[624],{"type":53,"value":625},"  --service-name",{"type":48,"tag":211,"props":627,"children":628},{"style":252},[629],{"type":53,"value":255},{"type":48,"tag":211,"props":631,"children":632},{"style":224},[633],{"type":53,"value":634},"service-name-from-cclou",{"type":48,"tag":211,"props":636,"children":637},{"style":263},[638],{"type":53,"value":608},{"type":48,"tag":211,"props":640,"children":641},{"style":252},[642],{"type":53,"value":271},{"type":48,"tag":211,"props":644,"children":645},{"style":263},[646],{"type":53,"value":515},{"type":48,"tag":211,"props":648,"children":650},{"class":213,"line":649},5,[651,656,661],{"type":48,"tag":211,"props":652,"children":653},{"style":224},[654],{"type":53,"value":655},"  --vpc-endpoint-type",{"type":48,"tag":211,"props":657,"children":658},{"style":224},[659],{"type":53,"value":660}," Interface",{"type":48,"tag":211,"props":662,"children":663},{"style":263},[664],{"type":53,"value":515},{"type":48,"tag":211,"props":666,"children":668},{"class":213,"line":667},6,[669,674,678,683,688,692,696,701],{"type":48,"tag":211,"props":670,"children":671},{"style":224},[672],{"type":53,"value":673},"  --subnet-ids",{"type":48,"tag":211,"props":675,"children":676},{"style":252},[677],{"type":53,"value":255},{"type":48,"tag":211,"props":679,"children":680},{"style":224},[681],{"type":53,"value":682},"subnet-id-",{"type":48,"tag":211,"props":684,"children":685},{"style":252},[686],{"type":53,"value":687},"1>",{"type":48,"tag":211,"props":689,"children":690},{"style":252},[691],{"type":53,"value":255},{"type":48,"tag":211,"props":693,"children":694},{"style":224},[695],{"type":53,"value":682},{"type":48,"tag":211,"props":697,"children":698},{"style":252},[699],{"type":53,"value":700},"2>",{"type":48,"tag":211,"props":702,"children":703},{"style":263},[704],{"type":53,"value":515},{"type":48,"tag":211,"props":706,"children":708},{"class":213,"line":707},7,[709,714,718,723,727],{"type":48,"tag":211,"props":710,"children":711},{"style":224},[712],{"type":53,"value":713},"  --security-group-ids",{"type":48,"tag":211,"props":715,"children":716},{"style":252},[717],{"type":53,"value":255},{"type":48,"tag":211,"props":719,"children":720},{"style":224},[721],{"type":53,"value":722},"security-group-i",{"type":48,"tag":211,"props":724,"children":725},{"style":263},[726],{"type":53,"value":608},{"type":48,"tag":211,"props":728,"children":729},{"style":252},[730],{"type":53,"value":731},">\n",{"type":48,"tag":56,"props":733,"children":734},{},[735],{"type":48,"tag":116,"props":736,"children":737},{},[738],{"type":53,"value":739},"Security group requirements:",{"type":48,"tag":69,"props":741,"children":742},{},[743,748],{"type":48,"tag":73,"props":744,"children":745},{},[746],{"type":53,"value":747},"Allow inbound TCP port 26257 from your application subnets",{"type":48,"tag":73,"props":749,"children":750},{},[751],{"type":53,"value":752},"Allow outbound to the VPC endpoint",{"type":48,"tag":431,"props":754,"children":756},{"id":755},"_13-create-the-private-endpoint-gcp-private-service-connect",[757],{"type":53,"value":758},"1.3 Create the Private Endpoint (GCP Private Service Connect)",{"type":48,"tag":200,"props":760,"children":762},{"className":202,"code":761,"language":204,"meta":205,"style":205},"# Reserve an internal IP address\ngcloud compute addresses create cockroachdb-psc \\\n  --region=\u003Cregion> \\\n  --subnet=\u003Csubnet> \\\n  --addresses=\u003Cinternal-ip>\n\n# Create the Private Service Connect endpoint\ngcloud compute forwarding-rules create cockroachdb-psc \\\n  --region=\u003Cregion> \\\n  --network=\u003Cnetwork> \\\n  --address=cockroachdb-psc \\\n  --target-service-attachment=\u003Cservice-attachment-from-ccloud>\n",[763],{"type":48,"tag":185,"props":764,"children":765},{"__ignoreMap":205},[766,774,806,832,857,878,887,895,924,948,974,987],{"type":48,"tag":211,"props":767,"children":768},{"class":213,"line":214},[769],{"type":48,"tag":211,"props":770,"children":771},{"style":561},[772],{"type":53,"value":773},"# Reserve an internal IP address\n",{"type":48,"tag":211,"props":775,"children":776},{"class":213,"line":29},[777,782,787,792,797,802],{"type":48,"tag":211,"props":778,"children":779},{"style":218},[780],{"type":53,"value":781},"gcloud",{"type":48,"tag":211,"props":783,"children":784},{"style":224},[785],{"type":53,"value":786}," compute",{"type":48,"tag":211,"props":788,"children":789},{"style":224},[790],{"type":53,"value":791}," addresses",{"type":48,"tag":211,"props":793,"children":794},{"style":224},[795],{"type":53,"value":796}," create",{"type":48,"tag":211,"props":798,"children":799},{"style":224},[800],{"type":53,"value":801}," cockroachdb-psc",{"type":48,"tag":211,"props":803,"children":804},{"style":263},[805],{"type":53,"value":515},{"type":48,"tag":211,"props":807,"children":808},{"class":213,"line":25},[809,814,819,824,828],{"type":48,"tag":211,"props":810,"children":811},{"style":224},[812],{"type":53,"value":813},"  --region=",{"type":48,"tag":211,"props":815,"children":816},{"style":252},[817],{"type":53,"value":818},"\u003C",{"type":48,"tag":211,"props":820,"children":821},{"style":224},[822],{"type":53,"value":823},"region",{"type":48,"tag":211,"props":825,"children":826},{"style":252},[827],{"type":53,"value":271},{"type":48,"tag":211,"props":829,"children":830},{"style":263},[831],{"type":53,"value":515},{"type":48,"tag":211,"props":833,"children":834},{"class":213,"line":619},[835,840,844,849,853],{"type":48,"tag":211,"props":836,"children":837},{"style":224},[838],{"type":53,"value":839},"  --subnet=",{"type":48,"tag":211,"props":841,"children":842},{"style":252},[843],{"type":53,"value":818},{"type":48,"tag":211,"props":845,"children":846},{"style":224},[847],{"type":53,"value":848},"subnet",{"type":48,"tag":211,"props":850,"children":851},{"style":252},[852],{"type":53,"value":271},{"type":48,"tag":211,"props":854,"children":855},{"style":263},[856],{"type":53,"value":515},{"type":48,"tag":211,"props":858,"children":859},{"class":213,"line":649},[860,865,869,874],{"type":48,"tag":211,"props":861,"children":862},{"style":224},[863],{"type":53,"value":864},"  --addresses=",{"type":48,"tag":211,"props":866,"children":867},{"style":252},[868],{"type":53,"value":818},{"type":48,"tag":211,"props":870,"children":871},{"style":224},[872],{"type":53,"value":873},"internal-ip",{"type":48,"tag":211,"props":875,"children":876},{"style":252},[877],{"type":53,"value":731},{"type":48,"tag":211,"props":879,"children":880},{"class":213,"line":667},[881],{"type":48,"tag":211,"props":882,"children":884},{"emptyLinePlaceholder":883},true,[885],{"type":53,"value":886},"\n",{"type":48,"tag":211,"props":888,"children":889},{"class":213,"line":707},[890],{"type":48,"tag":211,"props":891,"children":892},{"style":561},[893],{"type":53,"value":894},"# Create the Private Service Connect endpoint\n",{"type":48,"tag":211,"props":896,"children":898},{"class":213,"line":897},8,[899,903,907,912,916,920],{"type":48,"tag":211,"props":900,"children":901},{"style":218},[902],{"type":53,"value":781},{"type":48,"tag":211,"props":904,"children":905},{"style":224},[906],{"type":53,"value":786},{"type":48,"tag":211,"props":908,"children":909},{"style":224},[910],{"type":53,"value":911}," forwarding-rules",{"type":48,"tag":211,"props":913,"children":914},{"style":224},[915],{"type":53,"value":796},{"type":48,"tag":211,"props":917,"children":918},{"style":224},[919],{"type":53,"value":801},{"type":48,"tag":211,"props":921,"children":922},{"style":263},[923],{"type":53,"value":515},{"type":48,"tag":211,"props":925,"children":927},{"class":213,"line":926},9,[928,932,936,940,944],{"type":48,"tag":211,"props":929,"children":930},{"style":224},[931],{"type":53,"value":813},{"type":48,"tag":211,"props":933,"children":934},{"style":252},[935],{"type":53,"value":818},{"type":48,"tag":211,"props":937,"children":938},{"style":224},[939],{"type":53,"value":823},{"type":48,"tag":211,"props":941,"children":942},{"style":252},[943],{"type":53,"value":271},{"type":48,"tag":211,"props":945,"children":946},{"style":263},[947],{"type":53,"value":515},{"type":48,"tag":211,"props":949,"children":951},{"class":213,"line":950},10,[952,957,961,966,970],{"type":48,"tag":211,"props":953,"children":954},{"style":224},[955],{"type":53,"value":956},"  --network=",{"type":48,"tag":211,"props":958,"children":959},{"style":252},[960],{"type":53,"value":818},{"type":48,"tag":211,"props":962,"children":963},{"style":224},[964],{"type":53,"value":965},"network",{"type":48,"tag":211,"props":967,"children":968},{"style":252},[969],{"type":53,"value":271},{"type":48,"tag":211,"props":971,"children":972},{"style":263},[973],{"type":53,"value":515},{"type":48,"tag":211,"props":975,"children":977},{"class":213,"line":976},11,[978,983],{"type":48,"tag":211,"props":979,"children":980},{"style":224},[981],{"type":53,"value":982},"  --address=cockroachdb-psc",{"type":48,"tag":211,"props":984,"children":985},{"style":263},[986],{"type":53,"value":515},{"type":48,"tag":211,"props":988,"children":990},{"class":213,"line":989},12,[991,996,1000,1005],{"type":48,"tag":211,"props":992,"children":993},{"style":224},[994],{"type":53,"value":995},"  --target-service-attachment=",{"type":48,"tag":211,"props":997,"children":998},{"style":252},[999],{"type":53,"value":818},{"type":48,"tag":211,"props":1001,"children":1002},{"style":224},[1003],{"type":53,"value":1004},"service-attachment-from-ccloud",{"type":48,"tag":211,"props":1006,"children":1007},{"style":252},[1008],{"type":53,"value":731},{"type":48,"tag":431,"props":1010,"children":1012},{"id":1011},"_14-create-the-private-endpoint-azure-private-link",[1013],{"type":53,"value":1014},"1.4 Create the Private Endpoint (Azure Private Link)",{"type":48,"tag":200,"props":1016,"children":1018},{"className":202,"code":1017,"language":204,"meta":205,"style":205},"# Create a private endpoint in your Azure subscription\naz network private-endpoint create \\\n  --name cockroachdb-pe \\\n  --resource-group \u003Cresource-group> \\\n  --vnet-name \u003Cvnet-name> \\\n  --subnet \u003Csubnet-name> \\\n  --private-connection-resource-id \u003Cservice-id-from-ccloud> \\\n  --connection-name cockroachdb-connection\n",[1019],{"type":48,"tag":185,"props":1020,"children":1021},{"__ignoreMap":205},[1022,1030,1056,1073,1102,1131,1160,1189],{"type":48,"tag":211,"props":1023,"children":1024},{"class":213,"line":214},[1025],{"type":48,"tag":211,"props":1026,"children":1027},{"style":561},[1028],{"type":53,"value":1029},"# Create a private endpoint in your Azure subscription\n",{"type":48,"tag":211,"props":1031,"children":1032},{"class":213,"line":29},[1033,1038,1043,1048,1052],{"type":48,"tag":211,"props":1034,"children":1035},{"style":218},[1036],{"type":53,"value":1037},"az",{"type":48,"tag":211,"props":1039,"children":1040},{"style":224},[1041],{"type":53,"value":1042}," network",{"type":48,"tag":211,"props":1044,"children":1045},{"style":224},[1046],{"type":53,"value":1047}," private-endpoint",{"type":48,"tag":211,"props":1049,"children":1050},{"style":224},[1051],{"type":53,"value":796},{"type":48,"tag":211,"props":1053,"children":1054},{"style":263},[1055],{"type":53,"value":515},{"type":48,"tag":211,"props":1057,"children":1058},{"class":213,"line":25},[1059,1064,1069],{"type":48,"tag":211,"props":1060,"children":1061},{"style":224},[1062],{"type":53,"value":1063},"  --name",{"type":48,"tag":211,"props":1065,"children":1066},{"style":224},[1067],{"type":53,"value":1068}," cockroachdb-pe",{"type":48,"tag":211,"props":1070,"children":1071},{"style":263},[1072],{"type":53,"value":515},{"type":48,"tag":211,"props":1074,"children":1075},{"class":213,"line":619},[1076,1081,1085,1090,1094,1098],{"type":48,"tag":211,"props":1077,"children":1078},{"style":224},[1079],{"type":53,"value":1080},"  --resource-group",{"type":48,"tag":211,"props":1082,"children":1083},{"style":252},[1084],{"type":53,"value":255},{"type":48,"tag":211,"props":1086,"children":1087},{"style":224},[1088],{"type":53,"value":1089},"resource-grou",{"type":48,"tag":211,"props":1091,"children":1092},{"style":263},[1093],{"type":53,"value":56},{"type":48,"tag":211,"props":1095,"children":1096},{"style":252},[1097],{"type":53,"value":271},{"type":48,"tag":211,"props":1099,"children":1100},{"style":263},[1101],{"type":53,"value":515},{"type":48,"tag":211,"props":1103,"children":1104},{"class":213,"line":649},[1105,1110,1114,1119,1123,1127],{"type":48,"tag":211,"props":1106,"children":1107},{"style":224},[1108],{"type":53,"value":1109},"  --vnet-name",{"type":48,"tag":211,"props":1111,"children":1112},{"style":252},[1113],{"type":53,"value":255},{"type":48,"tag":211,"props":1115,"children":1116},{"style":224},[1117],{"type":53,"value":1118},"vnet-nam",{"type":48,"tag":211,"props":1120,"children":1121},{"style":263},[1122],{"type":53,"value":266},{"type":48,"tag":211,"props":1124,"children":1125},{"style":252},[1126],{"type":53,"value":271},{"type":48,"tag":211,"props":1128,"children":1129},{"style":263},[1130],{"type":53,"value":515},{"type":48,"tag":211,"props":1132,"children":1133},{"class":213,"line":667},[1134,1139,1143,1148,1152,1156],{"type":48,"tag":211,"props":1135,"children":1136},{"style":224},[1137],{"type":53,"value":1138},"  --subnet",{"type":48,"tag":211,"props":1140,"children":1141},{"style":252},[1142],{"type":53,"value":255},{"type":48,"tag":211,"props":1144,"children":1145},{"style":224},[1146],{"type":53,"value":1147},"subnet-nam",{"type":48,"tag":211,"props":1149,"children":1150},{"style":263},[1151],{"type":53,"value":266},{"type":48,"tag":211,"props":1153,"children":1154},{"style":252},[1155],{"type":53,"value":271},{"type":48,"tag":211,"props":1157,"children":1158},{"style":263},[1159],{"type":53,"value":515},{"type":48,"tag":211,"props":1161,"children":1162},{"class":213,"line":707},[1163,1168,1172,1177,1181,1185],{"type":48,"tag":211,"props":1164,"children":1165},{"style":224},[1166],{"type":53,"value":1167},"  --private-connection-resource-id",{"type":48,"tag":211,"props":1169,"children":1170},{"style":252},[1171],{"type":53,"value":255},{"type":48,"tag":211,"props":1173,"children":1174},{"style":224},[1175],{"type":53,"value":1176},"service-id-from-cclou",{"type":48,"tag":211,"props":1178,"children":1179},{"style":263},[1180],{"type":53,"value":608},{"type":48,"tag":211,"props":1182,"children":1183},{"style":252},[1184],{"type":53,"value":271},{"type":48,"tag":211,"props":1186,"children":1187},{"style":263},[1188],{"type":53,"value":515},{"type":48,"tag":211,"props":1190,"children":1191},{"class":213,"line":897},[1192,1197],{"type":48,"tag":211,"props":1193,"children":1194},{"style":224},[1195],{"type":53,"value":1196},"  --connection-name",{"type":48,"tag":211,"props":1198,"children":1199},{"style":224},[1200],{"type":53,"value":1201}," cockroachdb-connection\n",{"type":48,"tag":431,"props":1203,"children":1205},{"id":1204},"_15-register-the-endpoint-in-cockroachdb-cloud",[1206],{"type":53,"value":1207},"1.5 Register the Endpoint in CockroachDB Cloud",{"type":48,"tag":56,"props":1209,"children":1210},{},[1211,1213,1217,1218,1222],{"type":53,"value":1212},"Register the private endpoint via the ",{"type":48,"tag":116,"props":1214,"children":1215},{},[1216],{"type":53,"value":446},{"type":53,"value":448},{"type":48,"tag":116,"props":1219,"children":1220},{},[1221],{"type":53,"value":453},{"type":53,"value":455},{"type":48,"tag":56,"props":1224,"children":1225},{},[1226,1230,1231,1235,1237,1242],{"type":48,"tag":116,"props":1227,"children":1228},{},[1229],{"type":53,"value":463},{"type":53,"value":465},{"type":48,"tag":116,"props":1232,"children":1233},{},[1234],{"type":53,"value":470},{"type":53,"value":1236}," tab, click ",{"type":48,"tag":116,"props":1238,"children":1239},{},[1240],{"type":53,"value":1241},"Add a private endpoint",{"type":53,"value":1243},", and enter the cloud provider endpoint ID.",{"type":48,"tag":56,"props":1245,"children":1246},{},[1247],{"type":48,"tag":116,"props":1248,"children":1249},{},[1250],{"type":53,"value":480},{"type":48,"tag":200,"props":1252,"children":1254},{"className":202,"code":1253,"language":204,"meta":205,"style":205},"# Register the private endpoint connection with the cluster\ncurl -X POST \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"endpoint_id\": \"\u003Ccloud-provider-endpoint-id>\"}'\n",[1255],{"type":48,"tag":185,"props":1256,"children":1257},{"__ignoreMap":205},[1258,1266,1300,1323,1347],{"type":48,"tag":211,"props":1259,"children":1260},{"class":213,"line":214},[1261],{"type":48,"tag":211,"props":1262,"children":1263},{"style":561},[1264],{"type":53,"value":1265},"# Register the private endpoint connection with the cluster\n",{"type":48,"tag":211,"props":1267,"children":1268},{"class":213,"line":29},[1269,1273,1278,1283,1287,1292,1296],{"type":48,"tag":211,"props":1270,"children":1271},{"style":218},[1272],{"type":53,"value":495},{"type":48,"tag":211,"props":1274,"children":1275},{"style":224},[1276],{"type":53,"value":1277}," -X",{"type":48,"tag":211,"props":1279,"children":1280},{"style":224},[1281],{"type":53,"value":1282}," POST",{"type":48,"tag":211,"props":1284,"children":1285},{"style":252},[1286],{"type":53,"value":500},{"type":48,"tag":211,"props":1288,"children":1289},{"style":224},[1290],{"type":53,"value":1291},"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections",{"type":48,"tag":211,"props":1293,"children":1294},{"style":252},[1295],{"type":53,"value":510},{"type":48,"tag":211,"props":1297,"children":1298},{"style":263},[1299],{"type":53,"value":515},{"type":48,"tag":211,"props":1301,"children":1302},{"class":213,"line":25},[1303,1307,1311,1315,1319],{"type":48,"tag":211,"props":1304,"children":1305},{"style":224},[1306],{"type":53,"value":523},{"type":48,"tag":211,"props":1308,"children":1309},{"style":252},[1310],{"type":53,"value":500},{"type":48,"tag":211,"props":1312,"children":1313},{"style":224},[1314],{"type":53,"value":532},{"type":48,"tag":211,"props":1316,"children":1317},{"style":252},[1318],{"type":53,"value":510},{"type":48,"tag":211,"props":1320,"children":1321},{"style":263},[1322],{"type":53,"value":515},{"type":48,"tag":211,"props":1324,"children":1325},{"class":213,"line":619},[1326,1330,1334,1339,1343],{"type":48,"tag":211,"props":1327,"children":1328},{"style":224},[1329],{"type":53,"value":523},{"type":48,"tag":211,"props":1331,"children":1332},{"style":252},[1333],{"type":53,"value":500},{"type":48,"tag":211,"props":1335,"children":1336},{"style":224},[1337],{"type":53,"value":1338},"Content-Type: application\u002Fjson",{"type":48,"tag":211,"props":1340,"children":1341},{"style":252},[1342],{"type":53,"value":510},{"type":48,"tag":211,"props":1344,"children":1345},{"style":263},[1346],{"type":53,"value":515},{"type":48,"tag":211,"props":1348,"children":1349},{"class":213,"line":649},[1350,1355,1360,1365],{"type":48,"tag":211,"props":1351,"children":1352},{"style":224},[1353],{"type":53,"value":1354},"  -d",{"type":48,"tag":211,"props":1356,"children":1357},{"style":252},[1358],{"type":53,"value":1359}," '",{"type":48,"tag":211,"props":1361,"children":1362},{"style":224},[1363],{"type":53,"value":1364},"{\"endpoint_id\": \"\u003Ccloud-provider-endpoint-id>\"}",{"type":48,"tag":211,"props":1366,"children":1367},{"style":252},[1368],{"type":53,"value":1369},"'\n",{"type":48,"tag":56,"props":1371,"children":1372},{},[1373],{"type":48,"tag":116,"props":1374,"children":1375},{},[1376],{"type":53,"value":1377},"Terraform:",{"type":48,"tag":200,"props":1379,"children":1383},{"className":1380,"code":1381,"language":1382,"meta":205,"style":205},"language-hcl shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","resource \"cockroach_private_endpoint_connection\" \"connection\" {\n  cluster_id  = cockroach_cluster.cluster.id\n  endpoint_id = \"\u003Ccloud-provider-endpoint-id>\"\n}\n","hcl",[1384],{"type":48,"tag":185,"props":1385,"children":1386},{"__ignoreMap":205},[1387,1395,1403,1411],{"type":48,"tag":211,"props":1388,"children":1389},{"class":213,"line":214},[1390],{"type":48,"tag":211,"props":1391,"children":1392},{},[1393],{"type":53,"value":1394},"resource \"cockroach_private_endpoint_connection\" \"connection\" {\n",{"type":48,"tag":211,"props":1396,"children":1397},{"class":213,"line":29},[1398],{"type":48,"tag":211,"props":1399,"children":1400},{},[1401],{"type":53,"value":1402},"  cluster_id  = cockroach_cluster.cluster.id\n",{"type":48,"tag":211,"props":1404,"children":1405},{"class":213,"line":25},[1406],{"type":48,"tag":211,"props":1407,"children":1408},{},[1409],{"type":53,"value":1410},"  endpoint_id = \"\u003Ccloud-provider-endpoint-id>\"\n",{"type":48,"tag":211,"props":1412,"children":1413},{"class":213,"line":619},[1414],{"type":48,"tag":211,"props":1415,"children":1416},{},[1417],{"type":53,"value":1418},"}\n",{"type":48,"tag":56,"props":1420,"children":1421},{},[1422,1424,1430],{"type":53,"value":1423},"Wait for the connection status to become ",{"type":48,"tag":185,"props":1425,"children":1427},{"className":1426},[],[1428],{"type":53,"value":1429},"AVAILABLE",{"type":53,"value":1431}," — check in the Cloud Console or via API:",{"type":48,"tag":200,"props":1433,"children":1435},{"className":202,"code":1434,"language":204,"meta":205,"style":205},"curl \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n",[1436],{"type":48,"tag":185,"props":1437,"children":1438},{"__ignoreMap":205},[1439,1462],{"type":48,"tag":211,"props":1440,"children":1441},{"class":213,"line":214},[1442,1446,1450,1454,1458],{"type":48,"tag":211,"props":1443,"children":1444},{"style":218},[1445],{"type":53,"value":495},{"type":48,"tag":211,"props":1447,"children":1448},{"style":252},[1449],{"type":53,"value":500},{"type":48,"tag":211,"props":1451,"children":1452},{"style":224},[1453],{"type":53,"value":1291},{"type":48,"tag":211,"props":1455,"children":1456},{"style":252},[1457],{"type":53,"value":510},{"type":48,"tag":211,"props":1459,"children":1460},{"style":263},[1461],{"type":53,"value":515},{"type":48,"tag":211,"props":1463,"children":1464},{"class":213,"line":29},[1465,1469,1473,1477],{"type":48,"tag":211,"props":1466,"children":1467},{"style":224},[1468],{"type":53,"value":523},{"type":48,"tag":211,"props":1470,"children":1471},{"style":252},[1472],{"type":53,"value":500},{"type":48,"tag":211,"props":1474,"children":1475},{"style":224},[1476],{"type":53,"value":532},{"type":48,"tag":211,"props":1478,"children":1479},{"style":252},[1480],{"type":53,"value":537},{"type":48,"tag":431,"props":1482,"children":1484},{"id":1483},"_16-configure-dns",[1485],{"type":53,"value":1486},"1.6 Configure DNS",{"type":48,"tag":56,"props":1488,"children":1489},{},[1490],{"type":53,"value":1491},"Private endpoints require DNS configuration so clients resolve the cluster hostname to the private endpoint IP instead of the public IP.",{"type":48,"tag":56,"props":1493,"children":1494},{},[1495,1499],{"type":48,"tag":116,"props":1496,"children":1497},{},[1498],{"type":53,"value":151},{"type":53,"value":1500}," Create a Route 53 private hosted zone with the cluster hostname pointing to the VPC endpoint DNS name.",{"type":48,"tag":56,"props":1502,"children":1503},{},[1504,1508],{"type":48,"tag":116,"props":1505,"children":1506},{},[1507],{"type":53,"value":161},{"type":53,"value":1509}," Create a Cloud DNS private zone with an A record pointing to the reserved internal IP.",{"type":48,"tag":56,"props":1511,"children":1512},{},[1513,1517],{"type":48,"tag":116,"props":1514,"children":1515},{},[1516],{"type":53,"value":171},{"type":53,"value":1518}," Create a private DNS zone with an A record pointing to the private endpoint IP.",{"type":48,"tag":56,"props":1520,"children":1521},{},[1522,1523,1529],{"type":53,"value":286},{"type":48,"tag":288,"props":1524,"children":1526},{"href":1525},"references\u002Fcloud-provider-setup.md",[1527],{"type":53,"value":1528},"cloud provider setup reference",{"type":53,"value":1530}," for detailed DNS configuration steps.",{"type":48,"tag":403,"props":1532,"children":1534},{"id":1533},"part-2-egress-private-endpoints",[1535],{"type":53,"value":1536},"Part 2: Egress Private Endpoints",{"type":48,"tag":410,"props":1538,"children":1539},{},[1540],{"type":48,"tag":56,"props":1541,"children":1542},{},[1543,1545,1550],{"type":53,"value":1544},"Skip this part if the user did not select ",{"type":48,"tag":116,"props":1546,"children":1547},{},[1548],{"type":53,"value":1549},"Egress private endpoints",{"type":53,"value":1551}," in Decision 1.",{"type":48,"tag":56,"props":1553,"children":1554},{},[1555],{"type":53,"value":1556},"Egress private endpoints allow CockroachDB Cloud to connect to external services (e.g., Confluent Kafka for CDC) over a private network path.",{"type":48,"tag":431,"props":1558,"children":1560},{"id":1559},"_21-create-an-egress-private-endpoint",[1561],{"type":53,"value":1562},"2.1 Create an Egress Private Endpoint",{"type":48,"tag":56,"props":1564,"children":1565},{},[1566,1568,1572,1573,1577],{"type":53,"value":1567},"Create an egress endpoint via the ",{"type":48,"tag":116,"props":1569,"children":1570},{},[1571],{"type":53,"value":446},{"type":53,"value":448},{"type":48,"tag":116,"props":1574,"children":1575},{},[1576],{"type":53,"value":453},{"type":53,"value":455},{"type":48,"tag":56,"props":1579,"children":1580},{},[1581,1585,1586,1591,1592,1597],{"type":48,"tag":116,"props":1582,"children":1583},{},[1584],{"type":53,"value":463},{"type":53,"value":465},{"type":48,"tag":116,"props":1587,"children":1588},{},[1589],{"type":53,"value":1590},"Networking > Egress",{"type":53,"value":1236},{"type":48,"tag":116,"props":1593,"children":1594},{},[1595],{"type":53,"value":1596},"Add egress endpoint",{"type":53,"value":1598},", and specify the external service.",{"type":48,"tag":56,"props":1600,"children":1601},{},[1602],{"type":48,"tag":116,"props":1603,"children":1604},{},[1605],{"type":53,"value":480},{"type":48,"tag":200,"props":1607,"children":1609},{"className":202,"code":1608,"language":204,"meta":205,"style":205},"# Create an egress endpoint to an external service\ncurl -X POST \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fegress-endpoints\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"service_name\": \"\u003Cexternal-service-name>\", \"cloud_provider\": \"\u003CAWS|GCP|AZURE>\"}'\n",[1610],{"type":48,"tag":185,"props":1611,"children":1612},{"__ignoreMap":205},[1613,1621,1653,1676,1699],{"type":48,"tag":211,"props":1614,"children":1615},{"class":213,"line":214},[1616],{"type":48,"tag":211,"props":1617,"children":1618},{"style":561},[1619],{"type":53,"value":1620},"# Create an egress endpoint to an external service\n",{"type":48,"tag":211,"props":1622,"children":1623},{"class":213,"line":29},[1624,1628,1632,1636,1640,1645,1649],{"type":48,"tag":211,"props":1625,"children":1626},{"style":218},[1627],{"type":53,"value":495},{"type":48,"tag":211,"props":1629,"children":1630},{"style":224},[1631],{"type":53,"value":1277},{"type":48,"tag":211,"props":1633,"children":1634},{"style":224},[1635],{"type":53,"value":1282},{"type":48,"tag":211,"props":1637,"children":1638},{"style":252},[1639],{"type":53,"value":500},{"type":48,"tag":211,"props":1641,"children":1642},{"style":224},[1643],{"type":53,"value":1644},"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fegress-endpoints",{"type":48,"tag":211,"props":1646,"children":1647},{"style":252},[1648],{"type":53,"value":510},{"type":48,"tag":211,"props":1650,"children":1651},{"style":263},[1652],{"type":53,"value":515},{"type":48,"tag":211,"props":1654,"children":1655},{"class":213,"line":25},[1656,1660,1664,1668,1672],{"type":48,"tag":211,"props":1657,"children":1658},{"style":224},[1659],{"type":53,"value":523},{"type":48,"tag":211,"props":1661,"children":1662},{"style":252},[1663],{"type":53,"value":500},{"type":48,"tag":211,"props":1665,"children":1666},{"style":224},[1667],{"type":53,"value":532},{"type":48,"tag":211,"props":1669,"children":1670},{"style":252},[1671],{"type":53,"value":510},{"type":48,"tag":211,"props":1673,"children":1674},{"style":263},[1675],{"type":53,"value":515},{"type":48,"tag":211,"props":1677,"children":1678},{"class":213,"line":619},[1679,1683,1687,1691,1695],{"type":48,"tag":211,"props":1680,"children":1681},{"style":224},[1682],{"type":53,"value":523},{"type":48,"tag":211,"props":1684,"children":1685},{"style":252},[1686],{"type":53,"value":500},{"type":48,"tag":211,"props":1688,"children":1689},{"style":224},[1690],{"type":53,"value":1338},{"type":48,"tag":211,"props":1692,"children":1693},{"style":252},[1694],{"type":53,"value":510},{"type":48,"tag":211,"props":1696,"children":1697},{"style":263},[1698],{"type":53,"value":515},{"type":48,"tag":211,"props":1700,"children":1701},{"class":213,"line":649},[1702,1706,1710,1715],{"type":48,"tag":211,"props":1703,"children":1704},{"style":224},[1705],{"type":53,"value":1354},{"type":48,"tag":211,"props":1707,"children":1708},{"style":252},[1709],{"type":53,"value":1359},{"type":48,"tag":211,"props":1711,"children":1712},{"style":224},[1713],{"type":53,"value":1714},"{\"service_name\": \"\u003Cexternal-service-name>\", \"cloud_provider\": \"\u003CAWS|GCP|AZURE>\"}",{"type":48,"tag":211,"props":1716,"children":1717},{"style":252},[1718],{"type":53,"value":1369},{"type":48,"tag":56,"props":1720,"children":1721},{},[1722],{"type":48,"tag":116,"props":1723,"children":1724},{},[1725],{"type":53,"value":1726},"Common egress targets:",{"type":48,"tag":69,"props":1728,"children":1729},{},[1730,1735,1740,1745],{"type":48,"tag":73,"props":1731,"children":1732},{},[1733],{"type":53,"value":1734},"Confluent Cloud Kafka (most common use case)",{"type":48,"tag":73,"props":1736,"children":1737},{},[1738],{"type":53,"value":1739},"Amazon MSK",{"type":48,"tag":73,"props":1741,"children":1742},{},[1743],{"type":53,"value":1744},"Self-managed Kafka on PrivateLink",{"type":48,"tag":73,"props":1746,"children":1747},{},[1748],{"type":53,"value":1749},"Other SaaS services with PrivateLink support",{"type":48,"tag":431,"props":1751,"children":1753},{"id":1752},"_22-accept-the-endpoint-connection",[1754],{"type":53,"value":1755},"2.2 Accept the Endpoint Connection",{"type":48,"tag":56,"props":1757,"children":1758},{},[1759],{"type":53,"value":1760},"The external service owner must accept the pending connection request. For Confluent Cloud:",{"type":48,"tag":1762,"props":1763,"children":1764},"ol",{},[1765,1770,1780],{"type":48,"tag":73,"props":1766,"children":1767},{},[1768],{"type":53,"value":1769},"Log into Confluent Cloud Console",{"type":48,"tag":73,"props":1771,"children":1772},{},[1773,1775],{"type":53,"value":1774},"Navigate to ",{"type":48,"tag":116,"props":1776,"children":1777},{},[1778],{"type":53,"value":1779},"Networking > Private Link Access",{"type":48,"tag":73,"props":1781,"children":1782},{},[1783],{"type":53,"value":1784},"Accept the pending connection from the CockroachDB Cloud account",{"type":48,"tag":431,"props":1786,"children":1788},{"id":1787},"_23-verify-egress-endpoint-status",[1789],{"type":53,"value":1790},"2.3 Verify Egress Endpoint Status",{"type":48,"tag":56,"props":1792,"children":1793},{},[1794,1796,1800],{"type":53,"value":1795},"Check egress endpoint status via the Cloud Console (",{"type":48,"tag":116,"props":1797,"children":1798},{},[1799],{"type":53,"value":1590},{"type":53,"value":1801}," tab) or Cloud API:",{"type":48,"tag":200,"props":1803,"children":1805},{"className":202,"code":1804,"language":204,"meta":205,"style":205},"curl \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fegress-endpoints\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n",[1806],{"type":48,"tag":185,"props":1807,"children":1808},{"__ignoreMap":205},[1809,1832],{"type":48,"tag":211,"props":1810,"children":1811},{"class":213,"line":214},[1812,1816,1820,1824,1828],{"type":48,"tag":211,"props":1813,"children":1814},{"style":218},[1815],{"type":53,"value":495},{"type":48,"tag":211,"props":1817,"children":1818},{"style":252},[1819],{"type":53,"value":500},{"type":48,"tag":211,"props":1821,"children":1822},{"style":224},[1823],{"type":53,"value":1644},{"type":48,"tag":211,"props":1825,"children":1826},{"style":252},[1827],{"type":53,"value":510},{"type":48,"tag":211,"props":1829,"children":1830},{"style":263},[1831],{"type":53,"value":515},{"type":48,"tag":211,"props":1833,"children":1834},{"class":213,"line":29},[1835,1839,1843,1847],{"type":48,"tag":211,"props":1836,"children":1837},{"style":224},[1838],{"type":53,"value":523},{"type":48,"tag":211,"props":1840,"children":1841},{"style":252},[1842],{"type":53,"value":500},{"type":48,"tag":211,"props":1844,"children":1845},{"style":224},[1846],{"type":53,"value":532},{"type":48,"tag":211,"props":1848,"children":1849},{"style":252},[1850],{"type":53,"value":537},{"type":48,"tag":56,"props":1852,"children":1853},{},[1854],{"type":48,"tag":116,"props":1855,"children":1856},{},[1857],{"type":53,"value":1858},"Troubleshooting \"stuck pending\":",{"type":48,"tag":69,"props":1860,"children":1861},{},[1862,1867,1872],{"type":48,"tag":73,"props":1863,"children":1864},{},[1865],{"type":53,"value":1866},"Verify the external service has accepted the connection",{"type":48,"tag":73,"props":1868,"children":1869},{},[1870],{"type":53,"value":1871},"Check that the external service is in the same cloud provider region",{"type":48,"tag":73,"props":1873,"children":1874},{},[1875],{"type":53,"value":1876},"Contact the external service admin to accept the pending connection",{"type":48,"tag":431,"props":1878,"children":1880},{"id":1879},"_24-use-the-egress-endpoint-in-cdc-changefeeds",[1881],{"type":53,"value":1882},"2.4 Use the Egress Endpoint in CDC Changefeeds",{"type":48,"tag":200,"props":1884,"children":1888},{"className":1885,"code":1886,"language":1887,"meta":205,"style":205},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","-- Create a changefeed using the egress endpoint\nCREATE CHANGEFEED FOR TABLE orders\n  INTO 'kafka:\u002F\u002F\u003Cprivate-kafka-endpoint>:9092?topic_prefix=crdb_'\n  WITH updated, resolved;\n","sql",[1889],{"type":48,"tag":185,"props":1890,"children":1891},{"__ignoreMap":205},[1892,1900,1908,1916],{"type":48,"tag":211,"props":1893,"children":1894},{"class":213,"line":214},[1895],{"type":48,"tag":211,"props":1896,"children":1897},{},[1898],{"type":53,"value":1899},"-- Create a changefeed using the egress endpoint\n",{"type":48,"tag":211,"props":1901,"children":1902},{"class":213,"line":29},[1903],{"type":48,"tag":211,"props":1904,"children":1905},{},[1906],{"type":53,"value":1907},"CREATE CHANGEFEED FOR TABLE orders\n",{"type":48,"tag":211,"props":1909,"children":1910},{"class":213,"line":25},[1911],{"type":48,"tag":211,"props":1912,"children":1913},{},[1914],{"type":53,"value":1915},"  INTO 'kafka:\u002F\u002F\u003Cprivate-kafka-endpoint>:9092?topic_prefix=crdb_'\n",{"type":48,"tag":211,"props":1917,"children":1918},{"class":213,"line":619},[1919],{"type":48,"tag":211,"props":1920,"children":1921},{},[1922],{"type":53,"value":1923},"  WITH updated, resolved;\n",{"type":48,"tag":403,"props":1925,"children":1927},{"id":1926},"part-3-vpc-peering",[1928],{"type":53,"value":1929},"Part 3: VPC Peering",{"type":48,"tag":410,"props":1931,"children":1932},{},[1933],{"type":48,"tag":56,"props":1934,"children":1935},{},[1936,1937,1942],{"type":53,"value":1544},{"type":48,"tag":116,"props":1938,"children":1939},{},[1940],{"type":53,"value":1941},"VPC peering",{"type":53,"value":1943}," in Decision 1. Follow only the commands matching the user's cloud provider (AWS or GCP) from Decision 2. Azure does not support VPC peering.",{"type":48,"tag":56,"props":1945,"children":1946},{},[1947],{"type":53,"value":1948},"VPC peering creates a direct network connection between your VPC and the CockroachDB Cloud VPC.",{"type":48,"tag":431,"props":1950,"children":1952},{"id":1951},"_31-initiate-vpc-peering",[1953],{"type":53,"value":1954},"3.1 Initiate VPC Peering",{"type":48,"tag":200,"props":1956,"children":1958},{"className":202,"code":1957,"language":204,"meta":205,"style":205},"# AWS\nccloud cluster networking peering create \u003Ccluster-id> \\\n  --peer-account-id \u003Caws-account-id> \\\n  --peer-vpc-id \u003Cvpc-id> \\\n  --peer-vpc-region \u003Cregion> \\\n  --peer-cidr \u003Ccidr-block>\n\n# GCP\nccloud cluster networking peering create \u003Ccluster-id> \\\n  --peer-project-id \u003Cgcp-project-id> \\\n  --peer-network \u003Cnetwork-name>\n",[1959],{"type":48,"tag":185,"props":1960,"children":1961},{"__ignoreMap":205},[1962,1970,2016,2045,2074,2104,2130,2137,2145,2188,2217],{"type":48,"tag":211,"props":1963,"children":1964},{"class":213,"line":214},[1965],{"type":48,"tag":211,"props":1966,"children":1967},{"style":561},[1968],{"type":53,"value":1969},"# AWS\n",{"type":48,"tag":211,"props":1971,"children":1972},{"class":213,"line":29},[1973,1977,1981,1986,1991,1995,1999,2004,2008,2012],{"type":48,"tag":211,"props":1974,"children":1975},{"style":218},[1976],{"type":53,"value":221},{"type":48,"tag":211,"props":1978,"children":1979},{"style":224},[1980],{"type":53,"value":244},{"type":48,"tag":211,"props":1982,"children":1983},{"style":224},[1984],{"type":53,"value":1985}," networking",{"type":48,"tag":211,"props":1987,"children":1988},{"style":224},[1989],{"type":53,"value":1990}," peering",{"type":48,"tag":211,"props":1992,"children":1993},{"style":224},[1994],{"type":53,"value":796},{"type":48,"tag":211,"props":1996,"children":1997},{"style":252},[1998],{"type":53,"value":255},{"type":48,"tag":211,"props":2000,"children":2001},{"style":224},[2002],{"type":53,"value":2003},"cluster-i",{"type":48,"tag":211,"props":2005,"children":2006},{"style":263},[2007],{"type":53,"value":608},{"type":48,"tag":211,"props":2009,"children":2010},{"style":252},[2011],{"type":53,"value":271},{"type":48,"tag":211,"props":2013,"children":2014},{"style":263},[2015],{"type":53,"value":515},{"type":48,"tag":211,"props":2017,"children":2018},{"class":213,"line":25},[2019,2024,2028,2033,2037,2041],{"type":48,"tag":211,"props":2020,"children":2021},{"style":224},[2022],{"type":53,"value":2023},"  --peer-account-id",{"type":48,"tag":211,"props":2025,"children":2026},{"style":252},[2027],{"type":53,"value":255},{"type":48,"tag":211,"props":2029,"children":2030},{"style":224},[2031],{"type":53,"value":2032},"aws-account-i",{"type":48,"tag":211,"props":2034,"children":2035},{"style":263},[2036],{"type":53,"value":608},{"type":48,"tag":211,"props":2038,"children":2039},{"style":252},[2040],{"type":53,"value":271},{"type":48,"tag":211,"props":2042,"children":2043},{"style":263},[2044],{"type":53,"value":515},{"type":48,"tag":211,"props":2046,"children":2047},{"class":213,"line":619},[2048,2053,2057,2062,2066,2070],{"type":48,"tag":211,"props":2049,"children":2050},{"style":224},[2051],{"type":53,"value":2052},"  --peer-vpc-id",{"type":48,"tag":211,"props":2054,"children":2055},{"style":252},[2056],{"type":53,"value":255},{"type":48,"tag":211,"props":2058,"children":2059},{"style":224},[2060],{"type":53,"value":2061},"vpc-i",{"type":48,"tag":211,"props":2063,"children":2064},{"style":263},[2065],{"type":53,"value":608},{"type":48,"tag":211,"props":2067,"children":2068},{"style":252},[2069],{"type":53,"value":271},{"type":48,"tag":211,"props":2071,"children":2072},{"style":263},[2073],{"type":53,"value":515},{"type":48,"tag":211,"props":2075,"children":2076},{"class":213,"line":649},[2077,2082,2086,2091,2096,2100],{"type":48,"tag":211,"props":2078,"children":2079},{"style":224},[2080],{"type":53,"value":2081},"  --peer-vpc-region",{"type":48,"tag":211,"props":2083,"children":2084},{"style":252},[2085],{"type":53,"value":255},{"type":48,"tag":211,"props":2087,"children":2088},{"style":224},[2089],{"type":53,"value":2090},"regio",{"type":48,"tag":211,"props":2092,"children":2093},{"style":263},[2094],{"type":53,"value":2095},"n",{"type":48,"tag":211,"props":2097,"children":2098},{"style":252},[2099],{"type":53,"value":271},{"type":48,"tag":211,"props":2101,"children":2102},{"style":263},[2103],{"type":53,"value":515},{"type":48,"tag":211,"props":2105,"children":2106},{"class":213,"line":667},[2107,2112,2116,2121,2126],{"type":48,"tag":211,"props":2108,"children":2109},{"style":224},[2110],{"type":53,"value":2111},"  --peer-cidr",{"type":48,"tag":211,"props":2113,"children":2114},{"style":252},[2115],{"type":53,"value":255},{"type":48,"tag":211,"props":2117,"children":2118},{"style":224},[2119],{"type":53,"value":2120},"cidr-bloc",{"type":48,"tag":211,"props":2122,"children":2123},{"style":263},[2124],{"type":53,"value":2125},"k",{"type":48,"tag":211,"props":2127,"children":2128},{"style":252},[2129],{"type":53,"value":731},{"type":48,"tag":211,"props":2131,"children":2132},{"class":213,"line":707},[2133],{"type":48,"tag":211,"props":2134,"children":2135},{"emptyLinePlaceholder":883},[2136],{"type":53,"value":886},{"type":48,"tag":211,"props":2138,"children":2139},{"class":213,"line":897},[2140],{"type":48,"tag":211,"props":2141,"children":2142},{"style":561},[2143],{"type":53,"value":2144},"# GCP\n",{"type":48,"tag":211,"props":2146,"children":2147},{"class":213,"line":926},[2148,2152,2156,2160,2164,2168,2172,2176,2180,2184],{"type":48,"tag":211,"props":2149,"children":2150},{"style":218},[2151],{"type":53,"value":221},{"type":48,"tag":211,"props":2153,"children":2154},{"style":224},[2155],{"type":53,"value":244},{"type":48,"tag":211,"props":2157,"children":2158},{"style":224},[2159],{"type":53,"value":1985},{"type":48,"tag":211,"props":2161,"children":2162},{"style":224},[2163],{"type":53,"value":1990},{"type":48,"tag":211,"props":2165,"children":2166},{"style":224},[2167],{"type":53,"value":796},{"type":48,"tag":211,"props":2169,"children":2170},{"style":252},[2171],{"type":53,"value":255},{"type":48,"tag":211,"props":2173,"children":2174},{"style":224},[2175],{"type":53,"value":2003},{"type":48,"tag":211,"props":2177,"children":2178},{"style":263},[2179],{"type":53,"value":608},{"type":48,"tag":211,"props":2181,"children":2182},{"style":252},[2183],{"type":53,"value":271},{"type":48,"tag":211,"props":2185,"children":2186},{"style":263},[2187],{"type":53,"value":515},{"type":48,"tag":211,"props":2189,"children":2190},{"class":213,"line":950},[2191,2196,2200,2205,2209,2213],{"type":48,"tag":211,"props":2192,"children":2193},{"style":224},[2194],{"type":53,"value":2195},"  --peer-project-id",{"type":48,"tag":211,"props":2197,"children":2198},{"style":252},[2199],{"type":53,"value":255},{"type":48,"tag":211,"props":2201,"children":2202},{"style":224},[2203],{"type":53,"value":2204},"gcp-project-i",{"type":48,"tag":211,"props":2206,"children":2207},{"style":263},[2208],{"type":53,"value":608},{"type":48,"tag":211,"props":2210,"children":2211},{"style":252},[2212],{"type":53,"value":271},{"type":48,"tag":211,"props":2214,"children":2215},{"style":263},[2216],{"type":53,"value":515},{"type":48,"tag":211,"props":2218,"children":2219},{"class":213,"line":976},[2220,2225,2229,2234,2238],{"type":48,"tag":211,"props":2221,"children":2222},{"style":224},[2223],{"type":53,"value":2224},"  --peer-network",{"type":48,"tag":211,"props":2226,"children":2227},{"style":252},[2228],{"type":53,"value":255},{"type":48,"tag":211,"props":2230,"children":2231},{"style":224},[2232],{"type":53,"value":2233},"network-nam",{"type":48,"tag":211,"props":2235,"children":2236},{"style":263},[2237],{"type":53,"value":266},{"type":48,"tag":211,"props":2239,"children":2240},{"style":252},[2241],{"type":53,"value":731},{"type":48,"tag":431,"props":2243,"children":2245},{"id":2244},"_32-accept-the-peering-request",[2246],{"type":53,"value":2247},"3.2 Accept the Peering Request",{"type":48,"tag":56,"props":2249,"children":2250},{},[2251,2255],{"type":48,"tag":116,"props":2252,"children":2253},{},[2254],{"type":53,"value":151},{"type":53,"value":2256}," Accept the peering request in the VPC Console:",{"type":48,"tag":200,"props":2258,"children":2260},{"className":202,"code":2259,"language":204,"meta":205,"style":205},"aws ec2 accept-vpc-peering-connection \\\n  --vpc-peering-connection-id \u003Cpeering-id>\n",[2261],{"type":48,"tag":185,"props":2262,"children":2263},{"__ignoreMap":205},[2264,2284],{"type":48,"tag":211,"props":2265,"children":2266},{"class":213,"line":214},[2267,2271,2275,2280],{"type":48,"tag":211,"props":2268,"children":2269},{"style":218},[2270],{"type":53,"value":572},{"type":48,"tag":211,"props":2272,"children":2273},{"style":224},[2274],{"type":53,"value":577},{"type":48,"tag":211,"props":2276,"children":2277},{"style":224},[2278],{"type":53,"value":2279}," accept-vpc-peering-connection",{"type":48,"tag":211,"props":2281,"children":2282},{"style":263},[2283],{"type":53,"value":515},{"type":48,"tag":211,"props":2285,"children":2286},{"class":213,"line":29},[2287,2292,2296,2301,2305],{"type":48,"tag":211,"props":2288,"children":2289},{"style":224},[2290],{"type":53,"value":2291},"  --vpc-peering-connection-id",{"type":48,"tag":211,"props":2293,"children":2294},{"style":252},[2295],{"type":53,"value":255},{"type":48,"tag":211,"props":2297,"children":2298},{"style":224},[2299],{"type":53,"value":2300},"peering-i",{"type":48,"tag":211,"props":2302,"children":2303},{"style":263},[2304],{"type":53,"value":608},{"type":48,"tag":211,"props":2306,"children":2307},{"style":252},[2308],{"type":53,"value":731},{"type":48,"tag":56,"props":2310,"children":2311},{},[2312,2316],{"type":48,"tag":116,"props":2313,"children":2314},{},[2315],{"type":53,"value":161},{"type":53,"value":2317}," Peering is established automatically if the peer network configuration is correct.",{"type":48,"tag":431,"props":2319,"children":2321},{"id":2320},"_33-configure-route-tables",[2322],{"type":53,"value":2323},"3.3 Configure Route Tables",{"type":48,"tag":56,"props":2325,"children":2326},{},[2327],{"type":53,"value":2328},"After peering is established, update route tables to route traffic to the CockroachDB Cloud CIDR through the peering connection.",{"type":48,"tag":200,"props":2330,"children":2332},{"className":202,"code":2331,"language":204,"meta":205,"style":205},"# AWS — add a route to the CockroachDB Cloud CIDR\naws ec2 create-route \\\n  --route-table-id \u003Croute-table-id> \\\n  --destination-cidr-block \u003Ccockroachdb-cidr> \\\n  --vpc-peering-connection-id \u003Cpeering-id>\n",[2333],{"type":48,"tag":185,"props":2334,"children":2335},{"__ignoreMap":205},[2336,2344,2364,2393,2423],{"type":48,"tag":211,"props":2337,"children":2338},{"class":213,"line":214},[2339],{"type":48,"tag":211,"props":2340,"children":2341},{"style":561},[2342],{"type":53,"value":2343},"# AWS — add a route to the CockroachDB Cloud CIDR\n",{"type":48,"tag":211,"props":2345,"children":2346},{"class":213,"line":29},[2347,2351,2355,2360],{"type":48,"tag":211,"props":2348,"children":2349},{"style":218},[2350],{"type":53,"value":572},{"type":48,"tag":211,"props":2352,"children":2353},{"style":224},[2354],{"type":53,"value":577},{"type":48,"tag":211,"props":2356,"children":2357},{"style":224},[2358],{"type":53,"value":2359}," create-route",{"type":48,"tag":211,"props":2361,"children":2362},{"style":263},[2363],{"type":53,"value":515},{"type":48,"tag":211,"props":2365,"children":2366},{"class":213,"line":25},[2367,2372,2376,2381,2385,2389],{"type":48,"tag":211,"props":2368,"children":2369},{"style":224},[2370],{"type":53,"value":2371},"  --route-table-id",{"type":48,"tag":211,"props":2373,"children":2374},{"style":252},[2375],{"type":53,"value":255},{"type":48,"tag":211,"props":2377,"children":2378},{"style":224},[2379],{"type":53,"value":2380},"route-table-i",{"type":48,"tag":211,"props":2382,"children":2383},{"style":263},[2384],{"type":53,"value":608},{"type":48,"tag":211,"props":2386,"children":2387},{"style":252},[2388],{"type":53,"value":271},{"type":48,"tag":211,"props":2390,"children":2391},{"style":263},[2392],{"type":53,"value":515},{"type":48,"tag":211,"props":2394,"children":2395},{"class":213,"line":619},[2396,2401,2405,2410,2415,2419],{"type":48,"tag":211,"props":2397,"children":2398},{"style":224},[2399],{"type":53,"value":2400},"  --destination-cidr-block",{"type":48,"tag":211,"props":2402,"children":2403},{"style":252},[2404],{"type":53,"value":255},{"type":48,"tag":211,"props":2406,"children":2407},{"style":224},[2408],{"type":53,"value":2409},"cockroachdb-cid",{"type":48,"tag":211,"props":2411,"children":2412},{"style":263},[2413],{"type":53,"value":2414},"r",{"type":48,"tag":211,"props":2416,"children":2417},{"style":252},[2418],{"type":53,"value":271},{"type":48,"tag":211,"props":2420,"children":2421},{"style":263},[2422],{"type":53,"value":515},{"type":48,"tag":211,"props":2424,"children":2425},{"class":213,"line":649},[2426,2430,2434,2438,2442],{"type":48,"tag":211,"props":2427,"children":2428},{"style":224},[2429],{"type":53,"value":2291},{"type":48,"tag":211,"props":2431,"children":2432},{"style":252},[2433],{"type":53,"value":255},{"type":48,"tag":211,"props":2435,"children":2436},{"style":224},[2437],{"type":53,"value":2300},{"type":48,"tag":211,"props":2439,"children":2440},{"style":263},[2441],{"type":53,"value":608},{"type":48,"tag":211,"props":2443,"children":2444},{"style":252},[2445],{"type":53,"value":731},{"type":48,"tag":431,"props":2447,"children":2449},{"id":2448},"_34-verify-vpc-peering",[2450],{"type":53,"value":2451},"3.4 Verify VPC Peering",{"type":48,"tag":200,"props":2453,"children":2455},{"className":202,"code":2454,"language":204,"meta":205,"style":205},"# Check peering status\nccloud cluster networking peering list \u003Ccluster-id> -o json\n",[2456],{"type":48,"tag":185,"props":2457,"children":2458},{"__ignoreMap":205},[2459,2467],{"type":48,"tag":211,"props":2460,"children":2461},{"class":213,"line":214},[2462],{"type":48,"tag":211,"props":2463,"children":2464},{"style":561},[2465],{"type":53,"value":2466},"# Check peering status\n",{"type":48,"tag":211,"props":2468,"children":2469},{"class":213,"line":29},[2470,2474,2478,2482,2486,2491,2495,2499,2503,2507,2511],{"type":48,"tag":211,"props":2471,"children":2472},{"style":218},[2473],{"type":53,"value":221},{"type":48,"tag":211,"props":2475,"children":2476},{"style":224},[2477],{"type":53,"value":244},{"type":48,"tag":211,"props":2479,"children":2480},{"style":224},[2481],{"type":53,"value":1985},{"type":48,"tag":211,"props":2483,"children":2484},{"style":224},[2485],{"type":53,"value":1990},{"type":48,"tag":211,"props":2487,"children":2488},{"style":224},[2489],{"type":53,"value":2490}," list",{"type":48,"tag":211,"props":2492,"children":2493},{"style":252},[2494],{"type":53,"value":255},{"type":48,"tag":211,"props":2496,"children":2497},{"style":224},[2498],{"type":53,"value":2003},{"type":48,"tag":211,"props":2500,"children":2501},{"style":263},[2502],{"type":53,"value":608},{"type":48,"tag":211,"props":2504,"children":2505},{"style":252},[2506],{"type":53,"value":271},{"type":48,"tag":211,"props":2508,"children":2509},{"style":224},[2510],{"type":53,"value":276},{"type":48,"tag":211,"props":2512,"children":2513},{"style":224},[2514],{"type":53,"value":281},{"type":48,"tag":56,"props":2516,"children":2517},{},[2518],{"type":53,"value":2519},"Test connectivity from your VPC:",{"type":48,"tag":200,"props":2521,"children":2523},{"className":202,"code":2522,"language":204,"meta":205,"style":205},"# From an instance in your peered VPC\ncockroach sql --url \"\u003Cconnection-string>\" -e \"SELECT 1;\"\n",[2524],{"type":48,"tag":185,"props":2525,"children":2526},{"__ignoreMap":205},[2527,2535],{"type":48,"tag":211,"props":2528,"children":2529},{"class":213,"line":214},[2530],{"type":48,"tag":211,"props":2531,"children":2532},{"style":561},[2533],{"type":53,"value":2534},"# From an instance in your peered VPC\n",{"type":48,"tag":211,"props":2536,"children":2537},{"class":213,"line":29},[2538,2543,2548,2553,2557,2562,2566,2571,2575,2580],{"type":48,"tag":211,"props":2539,"children":2540},{"style":218},[2541],{"type":53,"value":2542},"cockroach",{"type":48,"tag":211,"props":2544,"children":2545},{"style":224},[2546],{"type":53,"value":2547}," sql",{"type":48,"tag":211,"props":2549,"children":2550},{"style":224},[2551],{"type":53,"value":2552}," --url",{"type":48,"tag":211,"props":2554,"children":2555},{"style":252},[2556],{"type":53,"value":500},{"type":48,"tag":211,"props":2558,"children":2559},{"style":224},[2560],{"type":53,"value":2561},"\u003Cconnection-string>",{"type":48,"tag":211,"props":2563,"children":2564},{"style":252},[2565],{"type":53,"value":510},{"type":48,"tag":211,"props":2567,"children":2568},{"style":224},[2569],{"type":53,"value":2570}," -e",{"type":48,"tag":211,"props":2572,"children":2573},{"style":252},[2574],{"type":53,"value":500},{"type":48,"tag":211,"props":2576,"children":2577},{"style":224},[2578],{"type":53,"value":2579},"SELECT 1;",{"type":48,"tag":211,"props":2581,"children":2582},{"style":252},[2583],{"type":53,"value":537},{"type":48,"tag":62,"props":2585,"children":2587},{"id":2586},"safety-considerations",[2588],{"type":53,"value":2589},"Safety Considerations",{"type":48,"tag":2591,"props":2592,"children":2593},"table",{},[2594,2618],{"type":48,"tag":2595,"props":2596,"children":2597},"thead",{},[2598],{"type":48,"tag":2599,"props":2600,"children":2601},"tr",{},[2602,2608,2613],{"type":48,"tag":2603,"props":2604,"children":2605},"th",{},[2606],{"type":53,"value":2607},"Impact Type",{"type":48,"tag":2603,"props":2609,"children":2610},{},[2611],{"type":53,"value":2612},"Severity",{"type":48,"tag":2603,"props":2614,"children":2615},{},[2616],{"type":53,"value":2617},"Recommendation",{"type":48,"tag":2619,"props":2620,"children":2621},"tbody",{},[2622,2641,2659,2676,2694],{"type":48,"tag":2599,"props":2623,"children":2624},{},[2625,2631,2636],{"type":48,"tag":2626,"props":2627,"children":2628},"td",{},[2629],{"type":53,"value":2630},"Private endpoint creation",{"type":48,"tag":2626,"props":2632,"children":2633},{},[2634],{"type":53,"value":2635},"Low",{"type":48,"tag":2626,"props":2637,"children":2638},{},[2639],{"type":53,"value":2640},"Does not affect existing connections; additive change",{"type":48,"tag":2599,"props":2642,"children":2643},{},[2644,2649,2654],{"type":48,"tag":2626,"props":2645,"children":2646},{},[2647],{"type":53,"value":2648},"DNS configuration change",{"type":48,"tag":2626,"props":2650,"children":2651},{},[2652],{"type":53,"value":2653},"Medium",{"type":48,"tag":2626,"props":2655,"children":2656},{},[2657],{"type":53,"value":2658},"Incorrect DNS can break existing connections",{"type":48,"tag":2599,"props":2660,"children":2661},{},[2662,2667,2671],{"type":48,"tag":2626,"props":2663,"children":2664},{},[2665],{"type":53,"value":2666},"IP allowlist interaction",{"type":48,"tag":2626,"props":2668,"children":2669},{},[2670],{"type":53,"value":2653},{"type":48,"tag":2626,"props":2672,"children":2673},{},[2674],{"type":53,"value":2675},"Private endpoints bypass IP allowlists; review security implications",{"type":48,"tag":2599,"props":2677,"children":2678},{},[2679,2684,2689],{"type":48,"tag":2626,"props":2680,"children":2681},{},[2682],{"type":53,"value":2683},"VPC peering CIDR overlap",{"type":48,"tag":2626,"props":2685,"children":2686},{},[2687],{"type":53,"value":2688},"High",{"type":48,"tag":2626,"props":2690,"children":2691},{},[2692],{"type":53,"value":2693},"Overlapping CIDRs will prevent peering; plan IP space carefully",{"type":48,"tag":2599,"props":2695,"children":2696},{},[2697,2702,2706],{"type":48,"tag":2626,"props":2698,"children":2699},{},[2700],{"type":53,"value":2701},"Egress endpoint creation",{"type":48,"tag":2626,"props":2703,"children":2704},{},[2705],{"type":53,"value":2635},{"type":48,"tag":2626,"props":2707,"children":2708},{},[2709],{"type":53,"value":2710},"Does not affect cluster operation",{"type":48,"tag":56,"props":2712,"children":2713},{},[2714],{"type":48,"tag":116,"props":2715,"children":2716},{},[2717],{"type":53,"value":2718},"Do not:",{"type":48,"tag":69,"props":2720,"children":2721},{},[2722,2727,2732,2737],{"type":48,"tag":73,"props":2723,"children":2724},{},[2725],{"type":53,"value":2726},"Delete a private endpoint that has active connections without migrating traffic first",{"type":48,"tag":73,"props":2728,"children":2729},{},[2730],{"type":53,"value":2731},"Configure overlapping CIDR ranges between peered VPCs",{"type":48,"tag":73,"props":2733,"children":2734},{},[2735],{"type":53,"value":2736},"Remove DNS records for private endpoints while clients are connected",{"type":48,"tag":73,"props":2738,"children":2739},{},[2740],{"type":53,"value":2741},"Assume private endpoints replace all other security controls (authentication and authorization still apply)",{"type":48,"tag":56,"props":2743,"children":2744},{},[2745],{"type":48,"tag":116,"props":2746,"children":2747},{},[2748],{"type":53,"value":2749},"When to prefer private endpoints over IP allowlists:",{"type":48,"tag":69,"props":2751,"children":2752},{},[2753,2758,2763],{"type":48,"tag":73,"props":2754,"children":2755},{},[2756],{"type":53,"value":2757},"When the IP allowlist entry limit is insufficient for your number of source IPs",{"type":48,"tag":73,"props":2759,"children":2760},{},[2761],{"type":53,"value":2762},"When you need to eliminate public internet exposure entirely",{"type":48,"tag":73,"props":2764,"children":2765},{},[2766],{"type":53,"value":2767},"When compliance requirements mandate private network paths",{"type":48,"tag":62,"props":2769,"children":2771},{"id":2770},"rollback",[2772],{"type":53,"value":2773},"Rollback",{"type":48,"tag":56,"props":2775,"children":2776},{},[2777],{"type":48,"tag":116,"props":2778,"children":2779},{},[2780],{"type":53,"value":2781},"Remove a private endpoint:",{"type":48,"tag":200,"props":2783,"children":2785},{"className":202,"code":2784,"language":204,"meta":205,"style":205},"# Delete the endpoint connection in CockroachDB Cloud (via Cloud API)\ncurl -X DELETE \"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections\u002F\u003Cendpoint-id>\" \\\n  -H \"Authorization: Bearer \u003Capi-key>\"\n\n# Or remove via Cloud Console: Networking > Private endpoint > Delete\n\n# Then delete the endpoint in your cloud provider\n# AWS\naws ec2 delete-vpc-endpoints --vpc-endpoint-ids \u003Cendpoint-id>\n",[2786],{"type":48,"tag":185,"props":2787,"children":2788},{"__ignoreMap":205},[2789,2797,2830,2849,2856,2864,2871,2879,2886],{"type":48,"tag":211,"props":2790,"children":2791},{"class":213,"line":214},[2792],{"type":48,"tag":211,"props":2793,"children":2794},{"style":561},[2795],{"type":53,"value":2796},"# Delete the endpoint connection in CockroachDB Cloud (via Cloud API)\n",{"type":48,"tag":211,"props":2798,"children":2799},{"class":213,"line":29},[2800,2804,2808,2813,2817,2822,2826],{"type":48,"tag":211,"props":2801,"children":2802},{"style":218},[2803],{"type":53,"value":495},{"type":48,"tag":211,"props":2805,"children":2806},{"style":224},[2807],{"type":53,"value":1277},{"type":48,"tag":211,"props":2809,"children":2810},{"style":224},[2811],{"type":53,"value":2812}," DELETE",{"type":48,"tag":211,"props":2814,"children":2815},{"style":252},[2816],{"type":53,"value":500},{"type":48,"tag":211,"props":2818,"children":2819},{"style":224},[2820],{"type":53,"value":2821},"https:\u002F\u002Fcockroachlabs.cloud\u002Fapi\u002Fv1\u002Fclusters\u002F\u003Ccluster-id>\u002Fnetworking\u002Fprivate-endpoint-connections\u002F\u003Cendpoint-id>",{"type":48,"tag":211,"props":2823,"children":2824},{"style":252},[2825],{"type":53,"value":510},{"type":48,"tag":211,"props":2827,"children":2828},{"style":263},[2829],{"type":53,"value":515},{"type":48,"tag":211,"props":2831,"children":2832},{"class":213,"line":25},[2833,2837,2841,2845],{"type":48,"tag":211,"props":2834,"children":2835},{"style":224},[2836],{"type":53,"value":523},{"type":48,"tag":211,"props":2838,"children":2839},{"style":252},[2840],{"type":53,"value":500},{"type":48,"tag":211,"props":2842,"children":2843},{"style":224},[2844],{"type":53,"value":532},{"type":48,"tag":211,"props":2846,"children":2847},{"style":252},[2848],{"type":53,"value":537},{"type":48,"tag":211,"props":2850,"children":2851},{"class":213,"line":619},[2852],{"type":48,"tag":211,"props":2853,"children":2854},{"emptyLinePlaceholder":883},[2855],{"type":53,"value":886},{"type":48,"tag":211,"props":2857,"children":2858},{"class":213,"line":649},[2859],{"type":48,"tag":211,"props":2860,"children":2861},{"style":561},[2862],{"type":53,"value":2863},"# Or remove via Cloud Console: Networking > Private endpoint > Delete\n",{"type":48,"tag":211,"props":2865,"children":2866},{"class":213,"line":667},[2867],{"type":48,"tag":211,"props":2868,"children":2869},{"emptyLinePlaceholder":883},[2870],{"type":53,"value":886},{"type":48,"tag":211,"props":2872,"children":2873},{"class":213,"line":707},[2874],{"type":48,"tag":211,"props":2875,"children":2876},{"style":561},[2877],{"type":53,"value":2878},"# Then delete the endpoint in your cloud provider\n",{"type":48,"tag":211,"props":2880,"children":2881},{"class":213,"line":897},[2882],{"type":48,"tag":211,"props":2883,"children":2884},{"style":561},[2885],{"type":53,"value":1969},{"type":48,"tag":211,"props":2887,"children":2888},{"class":213,"line":926},[2889,2893,2897,2902,2907,2911,2916,2920],{"type":48,"tag":211,"props":2890,"children":2891},{"style":218},[2892],{"type":53,"value":572},{"type":48,"tag":211,"props":2894,"children":2895},{"style":224},[2896],{"type":53,"value":577},{"type":48,"tag":211,"props":2898,"children":2899},{"style":224},[2900],{"type":53,"value":2901}," delete-vpc-endpoints",{"type":48,"tag":211,"props":2903,"children":2904},{"style":224},[2905],{"type":53,"value":2906}," --vpc-endpoint-ids",{"type":48,"tag":211,"props":2908,"children":2909},{"style":252},[2910],{"type":53,"value":255},{"type":48,"tag":211,"props":2912,"children":2913},{"style":224},[2914],{"type":53,"value":2915},"endpoint-i",{"type":48,"tag":211,"props":2917,"children":2918},{"style":263},[2919],{"type":53,"value":608},{"type":48,"tag":211,"props":2921,"children":2922},{"style":252},[2923],{"type":53,"value":731},{"type":48,"tag":56,"props":2925,"children":2926},{},[2927],{"type":48,"tag":116,"props":2928,"children":2929},{},[2930],{"type":53,"value":2931},"Remove VPC peering:",{"type":48,"tag":200,"props":2933,"children":2935},{"className":202,"code":2934,"language":204,"meta":205,"style":205},"ccloud cluster networking peering delete \u003Ccluster-id> --peering-id \u003Cpeering-id>\n",[2936],{"type":48,"tag":185,"props":2937,"children":2938},{"__ignoreMap":205},[2939],{"type":48,"tag":211,"props":2940,"children":2941},{"class":213,"line":214},[2942,2946,2950,2954,2958,2963,2967,2971,2975,2979,2984,2988,2992,2996],{"type":48,"tag":211,"props":2943,"children":2944},{"style":218},[2945],{"type":53,"value":221},{"type":48,"tag":211,"props":2947,"children":2948},{"style":224},[2949],{"type":53,"value":244},{"type":48,"tag":211,"props":2951,"children":2952},{"style":224},[2953],{"type":53,"value":1985},{"type":48,"tag":211,"props":2955,"children":2956},{"style":224},[2957],{"type":53,"value":1990},{"type":48,"tag":211,"props":2959,"children":2960},{"style":224},[2961],{"type":53,"value":2962}," delete",{"type":48,"tag":211,"props":2964,"children":2965},{"style":252},[2966],{"type":53,"value":255},{"type":48,"tag":211,"props":2968,"children":2969},{"style":224},[2970],{"type":53,"value":2003},{"type":48,"tag":211,"props":2972,"children":2973},{"style":263},[2974],{"type":53,"value":608},{"type":48,"tag":211,"props":2976,"children":2977},{"style":252},[2978],{"type":53,"value":271},{"type":48,"tag":211,"props":2980,"children":2981},{"style":224},[2982],{"type":53,"value":2983}," --peering-id",{"type":48,"tag":211,"props":2985,"children":2986},{"style":252},[2987],{"type":53,"value":255},{"type":48,"tag":211,"props":2989,"children":2990},{"style":224},[2991],{"type":53,"value":2300},{"type":48,"tag":211,"props":2993,"children":2994},{"style":263},[2995],{"type":53,"value":608},{"type":48,"tag":211,"props":2997,"children":2998},{"style":252},[2999],{"type":53,"value":731},{"type":48,"tag":56,"props":3001,"children":3002},{},[3003],{"type":53,"value":3004},"After removing private connectivity, ensure the IP allowlist is configured to allow connections from the public internet if needed.",{"type":48,"tag":62,"props":3006,"children":3008},{"id":3007},"references",[3009],{"type":53,"value":3010},"References",{"type":48,"tag":56,"props":3012,"children":3013},{},[3014],{"type":48,"tag":116,"props":3015,"children":3016},{},[3017],{"type":53,"value":3018},"Skill references:",{"type":48,"tag":69,"props":3020,"children":3021},{},[3022,3030],{"type":48,"tag":73,"props":3023,"children":3024},{},[3025],{"type":48,"tag":288,"props":3026,"children":3027},{"href":290},[3028],{"type":53,"value":3029},"ccloud networking commands",{"type":48,"tag":73,"props":3031,"children":3032},{},[3033],{"type":48,"tag":288,"props":3034,"children":3035},{"href":1525},[3036],{"type":53,"value":3037},"Cloud provider setup steps",{"type":48,"tag":56,"props":3039,"children":3040},{},[3041],{"type":48,"tag":116,"props":3042,"children":3043},{},[3044],{"type":53,"value":3045},"Related skills:",{"type":48,"tag":69,"props":3047,"children":3048},{},[3049,3060],{"type":48,"tag":73,"props":3050,"children":3051},{},[3052,3058],{"type":48,"tag":288,"props":3053,"children":3055},{"href":3054},"..\u002Fconfiguring-ip-allowlists\u002FSKILL.md",[3056],{"type":53,"value":3057},"configuring-ip-allowlists",{"type":53,"value":3059}," — IP-based network access control",{"type":48,"tag":73,"props":3061,"children":3062},{},[3063,3069],{"type":48,"tag":288,"props":3064,"children":3066},{"href":3065},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[3067],{"type":53,"value":3068},"auditing-cloud-cluster-security",{"type":53,"value":3070}," — Run a full security posture audit",{"type":48,"tag":56,"props":3072,"children":3073},{},[3074],{"type":48,"tag":116,"props":3075,"children":3076},{},[3077],{"type":53,"value":3078},"Official CockroachDB Documentation:",{"type":48,"tag":69,"props":3080,"children":3081},{},[3082,3093,3103,3113,3123,3133],{"type":48,"tag":73,"props":3083,"children":3084},{},[3085],{"type":48,"tag":288,"props":3086,"children":3090},{"href":3087,"rel":3088},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html",[3089],"nofollow",[3091],{"type":53,"value":3092},"Network Authorization",{"type":48,"tag":73,"props":3094,"children":3095},{},[3096],{"type":48,"tag":288,"props":3097,"children":3100},{"href":3098,"rel":3099},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Faws-privatelink.html",[3089],[3101],{"type":53,"value":3102},"AWS PrivateLink",{"type":48,"tag":73,"props":3104,"children":3105},{},[3106],{"type":48,"tag":288,"props":3107,"children":3110},{"href":3108,"rel":3109},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fconnect-to-an-advanced-cluster",[3089],[3111],{"type":53,"value":3112},"GCP Private Service Connect",{"type":48,"tag":73,"props":3114,"children":3115},{},[3116],{"type":48,"tag":288,"props":3117,"children":3120},{"href":3118,"rel":3119},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization",[3089],[3121],{"type":53,"value":3122},"Azure Private Link",{"type":48,"tag":73,"props":3124,"children":3125},{},[3126],{"type":48,"tag":288,"props":3127,"children":3130},{"href":3128,"rel":3129},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fnetwork-authorization.html#vpc-peering",[3089],[3131],{"type":53,"value":3132},"VPC Peering",{"type":48,"tag":73,"props":3134,"children":3135},{},[3136],{"type":48,"tag":288,"props":3137,"children":3140},{"href":3138,"rel":3139},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fegress-perimeter-controls.html",[3089],[3141],{"type":53,"value":3142},"Egress Perimeter Controls",{"type":48,"tag":3144,"props":3145,"children":3146},"style",{},[3147],{"type":53,"value":3148},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3150,"total":3310},[3151,3170,3184,3199,3210,3220,3233,3245,3259,3274,3284,3297],{"slug":3152,"name":3152,"fn":3153,"description":3154,"org":3155,"tags":3156,"stars":3167,"repoUrl":3168,"updatedAt":3169},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3157,3158,3161,3164],{"name":20,"slug":21,"type":15},{"name":3159,"slug":3160,"type":15},"Incident Response","incident-response",{"name":3162,"slug":3163,"type":15},"Kubernetes","kubernetes",{"name":3165,"slug":3166,"type":15},"Monitoring","monitoring",105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":3171,"name":3171,"fn":3172,"description":3173,"org":3174,"tags":3175,"stars":3167,"repoUrl":3168,"updatedAt":3183},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3176,3179,3182],{"name":3177,"slug":3178,"type":15},"Deployment","deployment",{"name":3180,"slug":3181,"type":15},"Encryption","encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":3185,"name":3185,"fn":3186,"description":3187,"org":3188,"tags":3189,"stars":3167,"repoUrl":3168,"updatedAt":3198},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3190,3191,3194,3195],{"name":20,"slug":21,"type":15},{"name":3192,"slug":3193,"type":15},"Debugging","debugging",{"name":3162,"slug":3163,"type":15},{"name":3196,"slug":3197,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":3200,"name":3200,"fn":3201,"description":3202,"org":3203,"tags":3204,"stars":3167,"repoUrl":3168,"updatedAt":3209},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3205,3206,3207,3208],{"name":20,"slug":21,"type":15},{"name":3192,"slug":3193,"type":15},{"name":3177,"slug":3178,"type":15},{"name":3162,"slug":3163,"type":15},"2026-07-12T07:57:24.018818",{"slug":3211,"name":3211,"fn":3212,"description":3213,"org":3214,"tags":3215,"stars":3167,"repoUrl":3168,"updatedAt":3219},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3216,3217,3218],{"name":20,"slug":21,"type":15},{"name":3177,"slug":3178,"type":15},{"name":3162,"slug":3163,"type":15},"2026-07-12T07:56:45.777567",{"slug":3221,"name":3221,"fn":3222,"description":3223,"org":3224,"tags":3225,"stars":3167,"repoUrl":3168,"updatedAt":3232},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3226,3227,3228,3229],{"name":20,"slug":21,"type":15},{"name":3177,"slug":3178,"type":15},{"name":3162,"slug":3163,"type":15},{"name":3230,"slug":3231,"type":15},"Operations","operations","2026-07-12T07:56:47.082609",{"slug":3234,"name":3234,"fn":3235,"description":3236,"org":3237,"tags":3238,"stars":25,"repoUrl":26,"updatedAt":3244},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3239,3240,3241],{"name":20,"slug":21,"type":15},{"name":3165,"slug":3166,"type":15},{"name":3242,"slug":3243,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":3246,"name":3246,"fn":3247,"description":3248,"org":3249,"tags":3250,"stars":25,"repoUrl":26,"updatedAt":3258},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3251,3254,3255,3256],{"name":3252,"slug":3253,"type":15},"Data Modeling","data-modeling",{"name":20,"slug":21,"type":15},{"name":3242,"slug":3243,"type":15},{"name":3257,"slug":1887,"type":15},"SQL","2026-07-12T07:57:22.763788",{"slug":3260,"name":3260,"fn":3261,"description":3262,"org":3263,"tags":3264,"stars":25,"repoUrl":26,"updatedAt":3273},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3265,3268,3271,3272],{"name":3266,"slug":3267,"type":15},"Audit","audit",{"name":3269,"slug":3270,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":3068,"name":3068,"fn":3275,"description":3276,"org":3277,"tags":3278,"stars":25,"repoUrl":26,"updatedAt":3283},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3279,3280,3281,3282],{"name":3266,"slug":3267,"type":15},{"name":20,"slug":21,"type":15},{"name":3230,"slug":3231,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":3285,"name":3285,"fn":3286,"description":3287,"org":3288,"tags":3289,"stars":25,"repoUrl":26,"updatedAt":3296},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3290,3291,3294,3295],{"name":3266,"slug":3267,"type":15},{"name":3292,"slug":3293,"type":15},"Data Analysis","data-analysis",{"name":20,"slug":21,"type":15},{"name":3242,"slug":3243,"type":15},"2026-07-12T07:57:16.190081",{"slug":3298,"name":3298,"fn":3299,"description":3300,"org":3301,"tags":3302,"stars":25,"repoUrl":26,"updatedAt":3309},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3303,3304,3307,3308],{"name":20,"slug":21,"type":15},{"name":3305,"slug":3306,"type":15},"Engineering","engineering",{"name":3242,"slug":3243,"type":15},{"name":3257,"slug":1887,"type":15},"2026-07-12T07:57:26.543278",40,{"items":3312,"total":3364},[3313,3319,3326,3333,3340,3347,3354],{"slug":3234,"name":3234,"fn":3235,"description":3236,"org":3314,"tags":3315,"stars":25,"repoUrl":26,"updatedAt":3244},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3316,3317,3318],{"name":20,"slug":21,"type":15},{"name":3165,"slug":3166,"type":15},{"name":3242,"slug":3243,"type":15},{"slug":3246,"name":3246,"fn":3247,"description":3248,"org":3320,"tags":3321,"stars":25,"repoUrl":26,"updatedAt":3258},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3322,3323,3324,3325],{"name":3252,"slug":3253,"type":15},{"name":20,"slug":21,"type":15},{"name":3242,"slug":3243,"type":15},{"name":3257,"slug":1887,"type":15},{"slug":3260,"name":3260,"fn":3261,"description":3262,"org":3327,"tags":3328,"stars":25,"repoUrl":26,"updatedAt":3273},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3329,3330,3331,3332],{"name":3266,"slug":3267,"type":15},{"name":3269,"slug":3270,"type":15},{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},{"slug":3068,"name":3068,"fn":3275,"description":3276,"org":3334,"tags":3335,"stars":25,"repoUrl":26,"updatedAt":3283},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3336,3337,3338,3339],{"name":3266,"slug":3267,"type":15},{"name":20,"slug":21,"type":15},{"name":3230,"slug":3231,"type":15},{"name":13,"slug":14,"type":15},{"slug":3285,"name":3285,"fn":3286,"description":3287,"org":3341,"tags":3342,"stars":25,"repoUrl":26,"updatedAt":3296},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3343,3344,3345,3346],{"name":3266,"slug":3267,"type":15},{"name":3292,"slug":3293,"type":15},{"name":20,"slug":21,"type":15},{"name":3242,"slug":3243,"type":15},{"slug":3298,"name":3298,"fn":3299,"description":3300,"org":3348,"tags":3349,"stars":25,"repoUrl":26,"updatedAt":3309},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3350,3351,3352,3353],{"name":20,"slug":21,"type":15},{"name":3305,"slug":3306,"type":15},{"name":3242,"slug":3243,"type":15},{"name":3257,"slug":1887,"type":15},{"slug":3355,"name":3355,"fn":3356,"description":3357,"org":3358,"tags":3359,"stars":25,"repoUrl":26,"updatedAt":3363},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3360,3361,3362],{"name":20,"slug":21,"type":15},{"name":3242,"slug":3243,"type":15},{"name":3257,"slug":1887,"type":15},"2026-07-25T05:31:22.562808",34]