[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-enforcing-password-policies":3,"mdc--qcholh-key":36,"related-org-cockroachdb-enforcing-password-policies":1251,"related-repo-cockroachdb-enforcing-password-policies":1413},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":31,"sourceUrl":34,"mdContent":35},"enforcing-password-policies","enforce password policies on CockroachDB clusters","Configures and enforces password policies on CockroachDB clusters including minimum length, complexity requirements, and hash cost settings. Use when strengthening authentication requirements, setting up password policies for a new cluster, or meeting compliance password standards.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Auth","auth",{"name":20,"slug":21,"type":15},"Database","database",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:56:51.119192",null,2,[28,29,8,30],"claude","cockroach-cloud","developer-tools",{"repoUrl":23,"stars":22,"forks":26,"topics":32,"description":33},[28,29,8,30],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fenforcing-password-policies","---\nname: enforcing-password-policies\ndescription: Configures and enforces password policies on CockroachDB clusters including minimum length, complexity requirements, and hash cost settings. Use when strengthening authentication requirements, setting up password policies for a new cluster, or meeting compliance password standards.\ncompatibility: Requires admin role for cluster setting changes.\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Enforcing Password Policies\n\nConfigures and enforces password policies on CockroachDB clusters by setting minimum password length and bcrypt hash cost. Ensures password strength meets organizational and compliance requirements.\n\n## When to Use This Skill\n\n- Strengthening password requirements to meet compliance standards (SOC 2, HIPAA, NIST 800-63B)\n- Setting up password policies for a new production cluster\n- Responding to a security audit finding about weak password policies\n- Increasing bcrypt hash cost to improve resistance against brute-force attacks\n\n## Prerequisites\n\n- **SQL access** with admin role (required to modify cluster settings)\n- **Understanding of impact:** Password policy changes affect new passwords only, not existing passwords\n\n**Check your access:**\n```sql\nSELECT member FROM [SHOW GRANTS ON ROLE admin] WHERE member = current_user();\n```\n\n## Steps\n\n### 1. Check Current Password Policy Settings\n\n```sql\n-- Minimum password length\nSHOW CLUSTER SETTING server.user_login.min_password_length;\n\n-- Password hash cost (bcrypt rounds)\nSHOW CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n```\n\nSee [SQL queries reference](references\u002Fsql-queries.md) for additional password-related queries.\n\n### 2. Set Minimum Password Length\n\n```sql\n-- Set minimum password length to 12 characters (recommended)\nSET CLUSTER SETTING server.user_login.min_password_length = 12;\n```\n\n**Recommended minimums by compliance framework:**\n\n| Framework | Minimum Length | Recommendation |\n|-----------|---------------|----------------|\n| NIST 800-63B | 8 characters | 12+ recommended |\n| SOC 2 | 8 characters | 12+ recommended |\n| HIPAA | 8 characters | 12+ recommended |\n| PCI DSS | 7 characters | 12+ recommended |\n| Internal best practice | — | 14+ for admin accounts |\n\n### 3. Configure Hash Cost\n\nThe bcrypt hash cost controls how computationally expensive password hashing is. Higher values make brute-force attacks slower but increase CPU during authentication.\n\n```sql\n-- Set bcrypt hash cost (default: 10, recommended: 12)\nSET CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt = 12;\n```\n\n**Hash cost guidance:**\n\n| Cost | Time per Hash (approx.) | Recommendation |\n|------|------------------------|----------------|\n| 10 | ~100ms | Default, acceptable for most |\n| 12 | ~400ms | Recommended for production |\n| 14 | ~1.5s | High security, slower logins |\n\n**Trade-off:** Higher cost means slower password verification, which affects login latency. Cost 12 is a good balance.\n\n### 4. Verify Enforcement\n\n```sql\n-- Confirm settings\nSHOW CLUSTER SETTING server.user_login.min_password_length;\nSHOW CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n```\n\n**Test enforcement:**\n```sql\n-- This should fail if min_password_length is 12\nCREATE USER test_weak_password WITH PASSWORD 'short';\n-- Expected: ERROR: password too short\n\n-- This should succeed\nCREATE USER test_strong_password WITH PASSWORD 'a-secure-password-123';\nDROP USER test_strong_password;\n```\n\n### 5. Address Existing Users with Weak Passwords\n\nPassword policy changes only apply to new passwords. Existing users retain their old passwords until they change them.\n\n**Options for enforcing password rotation:**\n1. **Communicate the policy change** and ask users to update their passwords\n2. **Expire existing passwords** by requiring a password change on next login (if supported by your application layer)\n3. **Reset passwords administratively** for critical accounts:\n\n```sql\n-- Reset a user's password (forces them to use a new, policy-compliant password)\nALTER USER \u003Cusername> WITH PASSWORD '\u003Cnew-strong-password>';\n```\n\n### 6. Manage Password Changes and Rotation\n\n#### User Self-Service Password Changes\n\nSQL users can change their own passwords:\n\n```sql\n-- User changes their own password (CURRENT_USER, no parens)\nALTER USER CURRENT_USER WITH PASSWORD '\u003Cnew-password>';\n```\n\n**Note:** Non-admin users can change their own passwords by default. If users report they cannot change their password, verify they are connected as the correct user and that there are no HBA rules blocking password-based authentication.\n\n#### Administrative Password Reset\n\n```sql\n-- Admin resets another user's password\nALTER USER \u003Cusername> WITH PASSWORD '\u003Cnew-strong-password>';\n\n-- Verify the user exists before resetting\nSELECT username FROM [SHOW USERS] WHERE username = '\u003Cusername>';\n```\n\n#### Cloud Console vs SQL Passwords\n\nCockroachDB Cloud has two separate password domains:\n- **Cloud Console password** — Managed via Cloud Console UI or SSO. Reset via the Cloud Console login page \"Forgot password\" flow.\n- **SQL user password** — Managed via SQL `ALTER USER`. Independent of the Cloud Console password.\n\nChanging one does not affect the other. Users must manage both if they use both access methods.\n\n#### Password Rotation Best Practices\n\n- Rotate service account passwords on a regular schedule (e.g., every 90 days)\n- Use certificate-based authentication for service accounts to avoid password rotation entirely\n- Coordinate password rotation with application deployment cycles to avoid downtime\n- After changing a password, verify the application can connect with the new credentials before decommissioning the old password\n\n### 7. Troubleshoot Common Password Errors\n\n#### \"password too short\"\n\nThe password does not meet the `min_password_length` setting.\n\n```sql\n-- Check the current minimum\nSHOW CLUSTER SETTING server.user_login.min_password_length;\n```\n\nFix: Use a longer password that meets or exceeds the minimum length.\n\n#### \"bcrypt password hash too long\"\n\nThe password exceeds the bcrypt input limit of 72 bytes. This can occur with very long passwords or multi-byte Unicode characters.\n\n```sql\n-- Workaround: use a shorter password (under 72 bytes)\nALTER USER \u003Cusername> WITH PASSWORD '\u003Cshorter-password>';\n```\n\nThis is a bcrypt limitation, not a CockroachDB-specific issue.\n\n#### Authentication failures after password change\n\nIf users report authentication failures immediately after changing their password:\n\n1. Verify the password was set correctly (no copy-paste whitespace)\n2. Check for connection pool caching of old credentials — restart the connection pool\n3. Verify the HBA configuration allows password authentication:\n   ```sql\n   SHOW CLUSTER SETTING server.host_based_authentication.configuration;\n   ```\n\n## Safety Considerations\n\n- **New passwords only:** Changing `min_password_length` does not invalidate existing passwords. Users with short passwords can still log in until they change their password.\n- **Hash cost latency:** Increasing `crdb_bcrypt` cost increases login time. Test with realistic connection pools before setting cost above 12.\n- **Service accounts:** Ensure service accounts use strong passwords or certificate-based authentication (certificates bypass password policy).\n\n## Rollback\n\n```sql\n-- Reset minimum password length to default (1 = no minimum)\nSET CLUSTER SETTING server.user_login.min_password_length = 1;\n\n-- Reset hash cost to default\nRESET CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n```\n\n## References\n\n**Skill references:**\n- [SQL queries for password policies](references\u002Fsql-queries.md)\n\n**Related skills:**\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Run a full security posture audit\n- [configuring-sso-and-scim](..\u002Fconfiguring-sso-and-scim\u002FSKILL.md) — Use SSO to eliminate password-based authentication\n- [managing-tls-certificates](..\u002Fmanaging-tls-certificates\u002FSKILL.md) — Use certificate-based authentication instead of passwords\n\n**Official CockroachDB Documentation:**\n- [Cluster Settings Reference](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcluster-settings.html)\n- [CREATE USER](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcreate-user.html)\n- [ALTER USER](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Falter-user.html)\n- [Security Overview](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fsecurity-overview.html)\n- [Authentication](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fauthentication.html)\n",{"data":37,"body":41},{"name":4,"description":6,"compatibility":38,"metadata":39},"Requires admin role for cluster setting changes.",{"author":8,"version":40},"1.0",{"type":42,"children":43},"root",[44,52,58,65,90,96,120,128,150,156,163,213,227,233,256,264,382,388,393,416,424,504,514,520,549,557,621,627,632,640,674,697,703,710,715,738,748,754,799,805,810,841,846,852,875,881,887,900,922,927,933,938,961,966,972,977,1009,1015,1063,1069,1115,1121,1129,1140,1148,1184,1192,1245],{"type":45,"tag":46,"props":47,"children":48},"element","h1",{"id":4},[49],{"type":50,"value":51},"text","Enforcing Password Policies",{"type":45,"tag":53,"props":54,"children":55},"p",{},[56],{"type":50,"value":57},"Configures and enforces password policies on CockroachDB clusters by setting minimum password length and bcrypt hash cost. Ensures password strength meets organizational and compliance requirements.",{"type":45,"tag":59,"props":60,"children":62},"h2",{"id":61},"when-to-use-this-skill",[63],{"type":50,"value":64},"When to Use This Skill",{"type":45,"tag":66,"props":67,"children":68},"ul",{},[69,75,80,85],{"type":45,"tag":70,"props":71,"children":72},"li",{},[73],{"type":50,"value":74},"Strengthening password requirements to meet compliance standards (SOC 2, HIPAA, NIST 800-63B)",{"type":45,"tag":70,"props":76,"children":77},{},[78],{"type":50,"value":79},"Setting up password policies for a new production cluster",{"type":45,"tag":70,"props":81,"children":82},{},[83],{"type":50,"value":84},"Responding to a security audit finding about weak password policies",{"type":45,"tag":70,"props":86,"children":87},{},[88],{"type":50,"value":89},"Increasing bcrypt hash cost to improve resistance against brute-force attacks",{"type":45,"tag":59,"props":91,"children":93},{"id":92},"prerequisites",[94],{"type":50,"value":95},"Prerequisites",{"type":45,"tag":66,"props":97,"children":98},{},[99,110],{"type":45,"tag":70,"props":100,"children":101},{},[102,108],{"type":45,"tag":103,"props":104,"children":105},"strong",{},[106],{"type":50,"value":107},"SQL access",{"type":50,"value":109}," with admin role (required to modify cluster settings)",{"type":45,"tag":70,"props":111,"children":112},{},[113,118],{"type":45,"tag":103,"props":114,"children":115},{},[116],{"type":50,"value":117},"Understanding of impact:",{"type":50,"value":119}," Password policy changes affect new passwords only, not existing passwords",{"type":45,"tag":53,"props":121,"children":122},{},[123],{"type":45,"tag":103,"props":124,"children":125},{},[126],{"type":50,"value":127},"Check your access:",{"type":45,"tag":129,"props":130,"children":135},"pre",{"className":131,"code":132,"language":133,"meta":134,"style":134},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SELECT member FROM [SHOW GRANTS ON ROLE admin] WHERE member = current_user();\n","sql","",[136],{"type":45,"tag":137,"props":138,"children":139},"code",{"__ignoreMap":134},[140],{"type":45,"tag":141,"props":142,"children":145},"span",{"class":143,"line":144},"line",1,[146],{"type":45,"tag":141,"props":147,"children":148},{},[149],{"type":50,"value":132},{"type":45,"tag":59,"props":151,"children":153},{"id":152},"steps",[154],{"type":50,"value":155},"Steps",{"type":45,"tag":157,"props":158,"children":160},"h3",{"id":159},"_1-check-current-password-policy-settings",[161],{"type":50,"value":162},"1. Check Current Password Policy Settings",{"type":45,"tag":129,"props":164,"children":166},{"className":131,"code":165,"language":133,"meta":134,"style":134},"-- Minimum password length\nSHOW CLUSTER SETTING server.user_login.min_password_length;\n\n-- Password hash cost (bcrypt rounds)\nSHOW CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n",[167],{"type":45,"tag":137,"props":168,"children":169},{"__ignoreMap":134},[170,178,186,195,204],{"type":45,"tag":141,"props":171,"children":172},{"class":143,"line":144},[173],{"type":45,"tag":141,"props":174,"children":175},{},[176],{"type":50,"value":177},"-- Minimum password length\n",{"type":45,"tag":141,"props":179,"children":180},{"class":143,"line":26},[181],{"type":45,"tag":141,"props":182,"children":183},{},[184],{"type":50,"value":185},"SHOW CLUSTER SETTING server.user_login.min_password_length;\n",{"type":45,"tag":141,"props":187,"children":188},{"class":143,"line":22},[189],{"type":45,"tag":141,"props":190,"children":192},{"emptyLinePlaceholder":191},true,[193],{"type":50,"value":194},"\n",{"type":45,"tag":141,"props":196,"children":198},{"class":143,"line":197},4,[199],{"type":45,"tag":141,"props":200,"children":201},{},[202],{"type":50,"value":203},"-- Password hash cost (bcrypt rounds)\n",{"type":45,"tag":141,"props":205,"children":207},{"class":143,"line":206},5,[208],{"type":45,"tag":141,"props":209,"children":210},{},[211],{"type":50,"value":212},"SHOW CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n",{"type":45,"tag":53,"props":214,"children":215},{},[216,218,225],{"type":50,"value":217},"See ",{"type":45,"tag":219,"props":220,"children":222},"a",{"href":221},"references\u002Fsql-queries.md",[223],{"type":50,"value":224},"SQL queries reference",{"type":50,"value":226}," for additional password-related queries.",{"type":45,"tag":157,"props":228,"children":230},{"id":229},"_2-set-minimum-password-length",[231],{"type":50,"value":232},"2. Set Minimum Password Length",{"type":45,"tag":129,"props":234,"children":236},{"className":131,"code":235,"language":133,"meta":134,"style":134},"-- Set minimum password length to 12 characters (recommended)\nSET CLUSTER SETTING server.user_login.min_password_length = 12;\n",[237],{"type":45,"tag":137,"props":238,"children":239},{"__ignoreMap":134},[240,248],{"type":45,"tag":141,"props":241,"children":242},{"class":143,"line":144},[243],{"type":45,"tag":141,"props":244,"children":245},{},[246],{"type":50,"value":247},"-- Set minimum password length to 12 characters (recommended)\n",{"type":45,"tag":141,"props":249,"children":250},{"class":143,"line":26},[251],{"type":45,"tag":141,"props":252,"children":253},{},[254],{"type":50,"value":255},"SET CLUSTER SETTING server.user_login.min_password_length = 12;\n",{"type":45,"tag":53,"props":257,"children":258},{},[259],{"type":45,"tag":103,"props":260,"children":261},{},[262],{"type":50,"value":263},"Recommended minimums by compliance framework:",{"type":45,"tag":265,"props":266,"children":267},"table",{},[268,292],{"type":45,"tag":269,"props":270,"children":271},"thead",{},[272],{"type":45,"tag":273,"props":274,"children":275},"tr",{},[276,282,287],{"type":45,"tag":277,"props":278,"children":279},"th",{},[280],{"type":50,"value":281},"Framework",{"type":45,"tag":277,"props":283,"children":284},{},[285],{"type":50,"value":286},"Minimum Length",{"type":45,"tag":277,"props":288,"children":289},{},[290],{"type":50,"value":291},"Recommendation",{"type":45,"tag":293,"props":294,"children":295},"tbody",{},[296,315,331,347,364],{"type":45,"tag":273,"props":297,"children":298},{},[299,305,310],{"type":45,"tag":300,"props":301,"children":302},"td",{},[303],{"type":50,"value":304},"NIST 800-63B",{"type":45,"tag":300,"props":306,"children":307},{},[308],{"type":50,"value":309},"8 characters",{"type":45,"tag":300,"props":311,"children":312},{},[313],{"type":50,"value":314},"12+ recommended",{"type":45,"tag":273,"props":316,"children":317},{},[318,323,327],{"type":45,"tag":300,"props":319,"children":320},{},[321],{"type":50,"value":322},"SOC 2",{"type":45,"tag":300,"props":324,"children":325},{},[326],{"type":50,"value":309},{"type":45,"tag":300,"props":328,"children":329},{},[330],{"type":50,"value":314},{"type":45,"tag":273,"props":332,"children":333},{},[334,339,343],{"type":45,"tag":300,"props":335,"children":336},{},[337],{"type":50,"value":338},"HIPAA",{"type":45,"tag":300,"props":340,"children":341},{},[342],{"type":50,"value":309},{"type":45,"tag":300,"props":344,"children":345},{},[346],{"type":50,"value":314},{"type":45,"tag":273,"props":348,"children":349},{},[350,355,360],{"type":45,"tag":300,"props":351,"children":352},{},[353],{"type":50,"value":354},"PCI DSS",{"type":45,"tag":300,"props":356,"children":357},{},[358],{"type":50,"value":359},"7 characters",{"type":45,"tag":300,"props":361,"children":362},{},[363],{"type":50,"value":314},{"type":45,"tag":273,"props":365,"children":366},{},[367,372,377],{"type":45,"tag":300,"props":368,"children":369},{},[370],{"type":50,"value":371},"Internal best practice",{"type":45,"tag":300,"props":373,"children":374},{},[375],{"type":50,"value":376},"—",{"type":45,"tag":300,"props":378,"children":379},{},[380],{"type":50,"value":381},"14+ for admin accounts",{"type":45,"tag":157,"props":383,"children":385},{"id":384},"_3-configure-hash-cost",[386],{"type":50,"value":387},"3. Configure Hash Cost",{"type":45,"tag":53,"props":389,"children":390},{},[391],{"type":50,"value":392},"The bcrypt hash cost controls how computationally expensive password hashing is. Higher values make brute-force attacks slower but increase CPU during authentication.",{"type":45,"tag":129,"props":394,"children":396},{"className":131,"code":395,"language":133,"meta":134,"style":134},"-- Set bcrypt hash cost (default: 10, recommended: 12)\nSET CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt = 12;\n",[397],{"type":45,"tag":137,"props":398,"children":399},{"__ignoreMap":134},[400,408],{"type":45,"tag":141,"props":401,"children":402},{"class":143,"line":144},[403],{"type":45,"tag":141,"props":404,"children":405},{},[406],{"type":50,"value":407},"-- Set bcrypt hash cost (default: 10, recommended: 12)\n",{"type":45,"tag":141,"props":409,"children":410},{"class":143,"line":26},[411],{"type":45,"tag":141,"props":412,"children":413},{},[414],{"type":50,"value":415},"SET CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt = 12;\n",{"type":45,"tag":53,"props":417,"children":418},{},[419],{"type":45,"tag":103,"props":420,"children":421},{},[422],{"type":50,"value":423},"Hash cost guidance:",{"type":45,"tag":265,"props":425,"children":426},{},[427,447],{"type":45,"tag":269,"props":428,"children":429},{},[430],{"type":45,"tag":273,"props":431,"children":432},{},[433,438,443],{"type":45,"tag":277,"props":434,"children":435},{},[436],{"type":50,"value":437},"Cost",{"type":45,"tag":277,"props":439,"children":440},{},[441],{"type":50,"value":442},"Time per Hash (approx.)",{"type":45,"tag":277,"props":444,"children":445},{},[446],{"type":50,"value":291},{"type":45,"tag":293,"props":448,"children":449},{},[450,468,486],{"type":45,"tag":273,"props":451,"children":452},{},[453,458,463],{"type":45,"tag":300,"props":454,"children":455},{},[456],{"type":50,"value":457},"10",{"type":45,"tag":300,"props":459,"children":460},{},[461],{"type":50,"value":462},"~100ms",{"type":45,"tag":300,"props":464,"children":465},{},[466],{"type":50,"value":467},"Default, acceptable for most",{"type":45,"tag":273,"props":469,"children":470},{},[471,476,481],{"type":45,"tag":300,"props":472,"children":473},{},[474],{"type":50,"value":475},"12",{"type":45,"tag":300,"props":477,"children":478},{},[479],{"type":50,"value":480},"~400ms",{"type":45,"tag":300,"props":482,"children":483},{},[484],{"type":50,"value":485},"Recommended for production",{"type":45,"tag":273,"props":487,"children":488},{},[489,494,499],{"type":45,"tag":300,"props":490,"children":491},{},[492],{"type":50,"value":493},"14",{"type":45,"tag":300,"props":495,"children":496},{},[497],{"type":50,"value":498},"~1.5s",{"type":45,"tag":300,"props":500,"children":501},{},[502],{"type":50,"value":503},"High security, slower logins",{"type":45,"tag":53,"props":505,"children":506},{},[507,512],{"type":45,"tag":103,"props":508,"children":509},{},[510],{"type":50,"value":511},"Trade-off:",{"type":50,"value":513}," Higher cost means slower password verification, which affects login latency. Cost 12 is a good balance.",{"type":45,"tag":157,"props":515,"children":517},{"id":516},"_4-verify-enforcement",[518],{"type":50,"value":519},"4. Verify Enforcement",{"type":45,"tag":129,"props":521,"children":523},{"className":131,"code":522,"language":133,"meta":134,"style":134},"-- Confirm settings\nSHOW CLUSTER SETTING server.user_login.min_password_length;\nSHOW CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n",[524],{"type":45,"tag":137,"props":525,"children":526},{"__ignoreMap":134},[527,535,542],{"type":45,"tag":141,"props":528,"children":529},{"class":143,"line":144},[530],{"type":45,"tag":141,"props":531,"children":532},{},[533],{"type":50,"value":534},"-- Confirm settings\n",{"type":45,"tag":141,"props":536,"children":537},{"class":143,"line":26},[538],{"type":45,"tag":141,"props":539,"children":540},{},[541],{"type":50,"value":185},{"type":45,"tag":141,"props":543,"children":544},{"class":143,"line":22},[545],{"type":45,"tag":141,"props":546,"children":547},{},[548],{"type":50,"value":212},{"type":45,"tag":53,"props":550,"children":551},{},[552],{"type":45,"tag":103,"props":553,"children":554},{},[555],{"type":50,"value":556},"Test enforcement:",{"type":45,"tag":129,"props":558,"children":560},{"className":131,"code":559,"language":133,"meta":134,"style":134},"-- This should fail if min_password_length is 12\nCREATE USER test_weak_password WITH PASSWORD 'short';\n-- Expected: ERROR: password too short\n\n-- This should succeed\nCREATE USER test_strong_password WITH PASSWORD 'a-secure-password-123';\nDROP USER test_strong_password;\n",[561],{"type":45,"tag":137,"props":562,"children":563},{"__ignoreMap":134},[564,572,580,588,595,603,612],{"type":45,"tag":141,"props":565,"children":566},{"class":143,"line":144},[567],{"type":45,"tag":141,"props":568,"children":569},{},[570],{"type":50,"value":571},"-- This should fail if min_password_length is 12\n",{"type":45,"tag":141,"props":573,"children":574},{"class":143,"line":26},[575],{"type":45,"tag":141,"props":576,"children":577},{},[578],{"type":50,"value":579},"CREATE USER test_weak_password WITH PASSWORD 'short';\n",{"type":45,"tag":141,"props":581,"children":582},{"class":143,"line":22},[583],{"type":45,"tag":141,"props":584,"children":585},{},[586],{"type":50,"value":587},"-- Expected: ERROR: password too short\n",{"type":45,"tag":141,"props":589,"children":590},{"class":143,"line":197},[591],{"type":45,"tag":141,"props":592,"children":593},{"emptyLinePlaceholder":191},[594],{"type":50,"value":194},{"type":45,"tag":141,"props":596,"children":597},{"class":143,"line":206},[598],{"type":45,"tag":141,"props":599,"children":600},{},[601],{"type":50,"value":602},"-- This should succeed\n",{"type":45,"tag":141,"props":604,"children":606},{"class":143,"line":605},6,[607],{"type":45,"tag":141,"props":608,"children":609},{},[610],{"type":50,"value":611},"CREATE USER test_strong_password WITH PASSWORD 'a-secure-password-123';\n",{"type":45,"tag":141,"props":613,"children":615},{"class":143,"line":614},7,[616],{"type":45,"tag":141,"props":617,"children":618},{},[619],{"type":50,"value":620},"DROP USER test_strong_password;\n",{"type":45,"tag":157,"props":622,"children":624},{"id":623},"_5-address-existing-users-with-weak-passwords",[625],{"type":50,"value":626},"5. Address Existing Users with Weak Passwords",{"type":45,"tag":53,"props":628,"children":629},{},[630],{"type":50,"value":631},"Password policy changes only apply to new passwords. Existing users retain their old passwords until they change them.",{"type":45,"tag":53,"props":633,"children":634},{},[635],{"type":45,"tag":103,"props":636,"children":637},{},[638],{"type":50,"value":639},"Options for enforcing password rotation:",{"type":45,"tag":641,"props":642,"children":643},"ol",{},[644,654,664],{"type":45,"tag":70,"props":645,"children":646},{},[647,652],{"type":45,"tag":103,"props":648,"children":649},{},[650],{"type":50,"value":651},"Communicate the policy change",{"type":50,"value":653}," and ask users to update their passwords",{"type":45,"tag":70,"props":655,"children":656},{},[657,662],{"type":45,"tag":103,"props":658,"children":659},{},[660],{"type":50,"value":661},"Expire existing passwords",{"type":50,"value":663}," by requiring a password change on next login (if supported by your application layer)",{"type":45,"tag":70,"props":665,"children":666},{},[667,672],{"type":45,"tag":103,"props":668,"children":669},{},[670],{"type":50,"value":671},"Reset passwords administratively",{"type":50,"value":673}," for critical accounts:",{"type":45,"tag":129,"props":675,"children":677},{"className":131,"code":676,"language":133,"meta":134,"style":134},"-- Reset a user's password (forces them to use a new, policy-compliant password)\nALTER USER \u003Cusername> WITH PASSWORD '\u003Cnew-strong-password>';\n",[678],{"type":45,"tag":137,"props":679,"children":680},{"__ignoreMap":134},[681,689],{"type":45,"tag":141,"props":682,"children":683},{"class":143,"line":144},[684],{"type":45,"tag":141,"props":685,"children":686},{},[687],{"type":50,"value":688},"-- Reset a user's password (forces them to use a new, policy-compliant password)\n",{"type":45,"tag":141,"props":690,"children":691},{"class":143,"line":26},[692],{"type":45,"tag":141,"props":693,"children":694},{},[695],{"type":50,"value":696},"ALTER USER \u003Cusername> WITH PASSWORD '\u003Cnew-strong-password>';\n",{"type":45,"tag":157,"props":698,"children":700},{"id":699},"_6-manage-password-changes-and-rotation",[701],{"type":50,"value":702},"6. Manage Password Changes and Rotation",{"type":45,"tag":704,"props":705,"children":707},"h4",{"id":706},"user-self-service-password-changes",[708],{"type":50,"value":709},"User Self-Service Password Changes",{"type":45,"tag":53,"props":711,"children":712},{},[713],{"type":50,"value":714},"SQL users can change their own passwords:",{"type":45,"tag":129,"props":716,"children":718},{"className":131,"code":717,"language":133,"meta":134,"style":134},"-- User changes their own password (CURRENT_USER, no parens)\nALTER USER CURRENT_USER WITH PASSWORD '\u003Cnew-password>';\n",[719],{"type":45,"tag":137,"props":720,"children":721},{"__ignoreMap":134},[722,730],{"type":45,"tag":141,"props":723,"children":724},{"class":143,"line":144},[725],{"type":45,"tag":141,"props":726,"children":727},{},[728],{"type":50,"value":729},"-- User changes their own password (CURRENT_USER, no parens)\n",{"type":45,"tag":141,"props":731,"children":732},{"class":143,"line":26},[733],{"type":45,"tag":141,"props":734,"children":735},{},[736],{"type":50,"value":737},"ALTER USER CURRENT_USER WITH PASSWORD '\u003Cnew-password>';\n",{"type":45,"tag":53,"props":739,"children":740},{},[741,746],{"type":45,"tag":103,"props":742,"children":743},{},[744],{"type":50,"value":745},"Note:",{"type":50,"value":747}," Non-admin users can change their own passwords by default. If users report they cannot change their password, verify they are connected as the correct user and that there are no HBA rules blocking password-based authentication.",{"type":45,"tag":704,"props":749,"children":751},{"id":750},"administrative-password-reset",[752],{"type":50,"value":753},"Administrative Password Reset",{"type":45,"tag":129,"props":755,"children":757},{"className":131,"code":756,"language":133,"meta":134,"style":134},"-- Admin resets another user's password\nALTER USER \u003Cusername> WITH PASSWORD '\u003Cnew-strong-password>';\n\n-- Verify the user exists before resetting\nSELECT username FROM [SHOW USERS] WHERE username = '\u003Cusername>';\n",[758],{"type":45,"tag":137,"props":759,"children":760},{"__ignoreMap":134},[761,769,776,783,791],{"type":45,"tag":141,"props":762,"children":763},{"class":143,"line":144},[764],{"type":45,"tag":141,"props":765,"children":766},{},[767],{"type":50,"value":768},"-- Admin resets another user's password\n",{"type":45,"tag":141,"props":770,"children":771},{"class":143,"line":26},[772],{"type":45,"tag":141,"props":773,"children":774},{},[775],{"type":50,"value":696},{"type":45,"tag":141,"props":777,"children":778},{"class":143,"line":22},[779],{"type":45,"tag":141,"props":780,"children":781},{"emptyLinePlaceholder":191},[782],{"type":50,"value":194},{"type":45,"tag":141,"props":784,"children":785},{"class":143,"line":197},[786],{"type":45,"tag":141,"props":787,"children":788},{},[789],{"type":50,"value":790},"-- Verify the user exists before resetting\n",{"type":45,"tag":141,"props":792,"children":793},{"class":143,"line":206},[794],{"type":45,"tag":141,"props":795,"children":796},{},[797],{"type":50,"value":798},"SELECT username FROM [SHOW USERS] WHERE username = '\u003Cusername>';\n",{"type":45,"tag":704,"props":800,"children":802},{"id":801},"cloud-console-vs-sql-passwords",[803],{"type":50,"value":804},"Cloud Console vs SQL Passwords",{"type":45,"tag":53,"props":806,"children":807},{},[808],{"type":50,"value":809},"CockroachDB Cloud has two separate password domains:",{"type":45,"tag":66,"props":811,"children":812},{},[813,823],{"type":45,"tag":70,"props":814,"children":815},{},[816,821],{"type":45,"tag":103,"props":817,"children":818},{},[819],{"type":50,"value":820},"Cloud Console password",{"type":50,"value":822}," — Managed via Cloud Console UI or SSO. Reset via the Cloud Console login page \"Forgot password\" flow.",{"type":45,"tag":70,"props":824,"children":825},{},[826,831,833,839],{"type":45,"tag":103,"props":827,"children":828},{},[829],{"type":50,"value":830},"SQL user password",{"type":50,"value":832}," — Managed via SQL ",{"type":45,"tag":137,"props":834,"children":836},{"className":835},[],[837],{"type":50,"value":838},"ALTER USER",{"type":50,"value":840},". Independent of the Cloud Console password.",{"type":45,"tag":53,"props":842,"children":843},{},[844],{"type":50,"value":845},"Changing one does not affect the other. Users must manage both if they use both access methods.",{"type":45,"tag":704,"props":847,"children":849},{"id":848},"password-rotation-best-practices",[850],{"type":50,"value":851},"Password Rotation Best Practices",{"type":45,"tag":66,"props":853,"children":854},{},[855,860,865,870],{"type":45,"tag":70,"props":856,"children":857},{},[858],{"type":50,"value":859},"Rotate service account passwords on a regular schedule (e.g., every 90 days)",{"type":45,"tag":70,"props":861,"children":862},{},[863],{"type":50,"value":864},"Use certificate-based authentication for service accounts to avoid password rotation entirely",{"type":45,"tag":70,"props":866,"children":867},{},[868],{"type":50,"value":869},"Coordinate password rotation with application deployment cycles to avoid downtime",{"type":45,"tag":70,"props":871,"children":872},{},[873],{"type":50,"value":874},"After changing a password, verify the application can connect with the new credentials before decommissioning the old password",{"type":45,"tag":157,"props":876,"children":878},{"id":877},"_7-troubleshoot-common-password-errors",[879],{"type":50,"value":880},"7. Troubleshoot Common Password Errors",{"type":45,"tag":704,"props":882,"children":884},{"id":883},"password-too-short",[885],{"type":50,"value":886},"\"password too short\"",{"type":45,"tag":53,"props":888,"children":889},{},[890,892,898],{"type":50,"value":891},"The password does not meet the ",{"type":45,"tag":137,"props":893,"children":895},{"className":894},[],[896],{"type":50,"value":897},"min_password_length",{"type":50,"value":899}," setting.",{"type":45,"tag":129,"props":901,"children":903},{"className":131,"code":902,"language":133,"meta":134,"style":134},"-- Check the current minimum\nSHOW CLUSTER SETTING server.user_login.min_password_length;\n",[904],{"type":45,"tag":137,"props":905,"children":906},{"__ignoreMap":134},[907,915],{"type":45,"tag":141,"props":908,"children":909},{"class":143,"line":144},[910],{"type":45,"tag":141,"props":911,"children":912},{},[913],{"type":50,"value":914},"-- Check the current minimum\n",{"type":45,"tag":141,"props":916,"children":917},{"class":143,"line":26},[918],{"type":45,"tag":141,"props":919,"children":920},{},[921],{"type":50,"value":185},{"type":45,"tag":53,"props":923,"children":924},{},[925],{"type":50,"value":926},"Fix: Use a longer password that meets or exceeds the minimum length.",{"type":45,"tag":704,"props":928,"children":930},{"id":929},"bcrypt-password-hash-too-long",[931],{"type":50,"value":932},"\"bcrypt password hash too long\"",{"type":45,"tag":53,"props":934,"children":935},{},[936],{"type":50,"value":937},"The password exceeds the bcrypt input limit of 72 bytes. This can occur with very long passwords or multi-byte Unicode characters.",{"type":45,"tag":129,"props":939,"children":941},{"className":131,"code":940,"language":133,"meta":134,"style":134},"-- Workaround: use a shorter password (under 72 bytes)\nALTER USER \u003Cusername> WITH PASSWORD '\u003Cshorter-password>';\n",[942],{"type":45,"tag":137,"props":943,"children":944},{"__ignoreMap":134},[945,953],{"type":45,"tag":141,"props":946,"children":947},{"class":143,"line":144},[948],{"type":45,"tag":141,"props":949,"children":950},{},[951],{"type":50,"value":952},"-- Workaround: use a shorter password (under 72 bytes)\n",{"type":45,"tag":141,"props":954,"children":955},{"class":143,"line":26},[956],{"type":45,"tag":141,"props":957,"children":958},{},[959],{"type":50,"value":960},"ALTER USER \u003Cusername> WITH PASSWORD '\u003Cshorter-password>';\n",{"type":45,"tag":53,"props":962,"children":963},{},[964],{"type":50,"value":965},"This is a bcrypt limitation, not a CockroachDB-specific issue.",{"type":45,"tag":704,"props":967,"children":969},{"id":968},"authentication-failures-after-password-change",[970],{"type":50,"value":971},"Authentication failures after password change",{"type":45,"tag":53,"props":973,"children":974},{},[975],{"type":50,"value":976},"If users report authentication failures immediately after changing their password:",{"type":45,"tag":641,"props":978,"children":979},{},[980,985,990],{"type":45,"tag":70,"props":981,"children":982},{},[983],{"type":50,"value":984},"Verify the password was set correctly (no copy-paste whitespace)",{"type":45,"tag":70,"props":986,"children":987},{},[988],{"type":50,"value":989},"Check for connection pool caching of old credentials — restart the connection pool",{"type":45,"tag":70,"props":991,"children":992},{},[993,995],{"type":50,"value":994},"Verify the HBA configuration allows password authentication:\n",{"type":45,"tag":129,"props":996,"children":998},{"className":131,"code":997,"language":133,"meta":134,"style":134},"SHOW CLUSTER SETTING server.host_based_authentication.configuration;\n",[999],{"type":45,"tag":137,"props":1000,"children":1001},{"__ignoreMap":134},[1002],{"type":45,"tag":141,"props":1003,"children":1004},{"class":143,"line":144},[1005],{"type":45,"tag":141,"props":1006,"children":1007},{},[1008],{"type":50,"value":997},{"type":45,"tag":59,"props":1010,"children":1012},{"id":1011},"safety-considerations",[1013],{"type":50,"value":1014},"Safety Considerations",{"type":45,"tag":66,"props":1016,"children":1017},{},[1018,1035,1053],{"type":45,"tag":70,"props":1019,"children":1020},{},[1021,1026,1028,1033],{"type":45,"tag":103,"props":1022,"children":1023},{},[1024],{"type":50,"value":1025},"New passwords only:",{"type":50,"value":1027}," Changing ",{"type":45,"tag":137,"props":1029,"children":1031},{"className":1030},[],[1032],{"type":50,"value":897},{"type":50,"value":1034}," does not invalidate existing passwords. Users with short passwords can still log in until they change their password.",{"type":45,"tag":70,"props":1036,"children":1037},{},[1038,1043,1045,1051],{"type":45,"tag":103,"props":1039,"children":1040},{},[1041],{"type":50,"value":1042},"Hash cost latency:",{"type":50,"value":1044}," Increasing ",{"type":45,"tag":137,"props":1046,"children":1048},{"className":1047},[],[1049],{"type":50,"value":1050},"crdb_bcrypt",{"type":50,"value":1052}," cost increases login time. Test with realistic connection pools before setting cost above 12.",{"type":45,"tag":70,"props":1054,"children":1055},{},[1056,1061],{"type":45,"tag":103,"props":1057,"children":1058},{},[1059],{"type":50,"value":1060},"Service accounts:",{"type":50,"value":1062}," Ensure service accounts use strong passwords or certificate-based authentication (certificates bypass password policy).",{"type":45,"tag":59,"props":1064,"children":1066},{"id":1065},"rollback",[1067],{"type":50,"value":1068},"Rollback",{"type":45,"tag":129,"props":1070,"children":1072},{"className":131,"code":1071,"language":133,"meta":134,"style":134},"-- Reset minimum password length to default (1 = no minimum)\nSET CLUSTER SETTING server.user_login.min_password_length = 1;\n\n-- Reset hash cost to default\nRESET CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n",[1073],{"type":45,"tag":137,"props":1074,"children":1075},{"__ignoreMap":134},[1076,1084,1092,1099,1107],{"type":45,"tag":141,"props":1077,"children":1078},{"class":143,"line":144},[1079],{"type":45,"tag":141,"props":1080,"children":1081},{},[1082],{"type":50,"value":1083},"-- Reset minimum password length to default (1 = no minimum)\n",{"type":45,"tag":141,"props":1085,"children":1086},{"class":143,"line":26},[1087],{"type":45,"tag":141,"props":1088,"children":1089},{},[1090],{"type":50,"value":1091},"SET CLUSTER SETTING server.user_login.min_password_length = 1;\n",{"type":45,"tag":141,"props":1093,"children":1094},{"class":143,"line":22},[1095],{"type":45,"tag":141,"props":1096,"children":1097},{"emptyLinePlaceholder":191},[1098],{"type":50,"value":194},{"type":45,"tag":141,"props":1100,"children":1101},{"class":143,"line":197},[1102],{"type":45,"tag":141,"props":1103,"children":1104},{},[1105],{"type":50,"value":1106},"-- Reset hash cost to default\n",{"type":45,"tag":141,"props":1108,"children":1109},{"class":143,"line":206},[1110],{"type":45,"tag":141,"props":1111,"children":1112},{},[1113],{"type":50,"value":1114},"RESET CLUSTER SETTING server.user_login.password_hashes.default_cost.crdb_bcrypt;\n",{"type":45,"tag":59,"props":1116,"children":1118},{"id":1117},"references",[1119],{"type":50,"value":1120},"References",{"type":45,"tag":53,"props":1122,"children":1123},{},[1124],{"type":45,"tag":103,"props":1125,"children":1126},{},[1127],{"type":50,"value":1128},"Skill references:",{"type":45,"tag":66,"props":1130,"children":1131},{},[1132],{"type":45,"tag":70,"props":1133,"children":1134},{},[1135],{"type":45,"tag":219,"props":1136,"children":1137},{"href":221},[1138],{"type":50,"value":1139},"SQL queries for password policies",{"type":45,"tag":53,"props":1141,"children":1142},{},[1143],{"type":45,"tag":103,"props":1144,"children":1145},{},[1146],{"type":50,"value":1147},"Related skills:",{"type":45,"tag":66,"props":1149,"children":1150},{},[1151,1162,1173],{"type":45,"tag":70,"props":1152,"children":1153},{},[1154,1160],{"type":45,"tag":219,"props":1155,"children":1157},{"href":1156},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[1158],{"type":50,"value":1159},"auditing-cloud-cluster-security",{"type":50,"value":1161}," — Run a full security posture audit",{"type":45,"tag":70,"props":1163,"children":1164},{},[1165,1171],{"type":45,"tag":219,"props":1166,"children":1168},{"href":1167},"..\u002Fconfiguring-sso-and-scim\u002FSKILL.md",[1169],{"type":50,"value":1170},"configuring-sso-and-scim",{"type":50,"value":1172}," — Use SSO to eliminate password-based authentication",{"type":45,"tag":70,"props":1174,"children":1175},{},[1176,1182],{"type":45,"tag":219,"props":1177,"children":1179},{"href":1178},"..\u002Fmanaging-tls-certificates\u002FSKILL.md",[1180],{"type":50,"value":1181},"managing-tls-certificates",{"type":50,"value":1183}," — Use certificate-based authentication instead of passwords",{"type":45,"tag":53,"props":1185,"children":1186},{},[1187],{"type":45,"tag":103,"props":1188,"children":1189},{},[1190],{"type":50,"value":1191},"Official CockroachDB Documentation:",{"type":45,"tag":66,"props":1193,"children":1194},{},[1195,1206,1216,1225,1235],{"type":45,"tag":70,"props":1196,"children":1197},{},[1198],{"type":45,"tag":219,"props":1199,"children":1203},{"href":1200,"rel":1201},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcluster-settings.html",[1202],"nofollow",[1204],{"type":50,"value":1205},"Cluster Settings Reference",{"type":45,"tag":70,"props":1207,"children":1208},{},[1209],{"type":45,"tag":219,"props":1210,"children":1213},{"href":1211,"rel":1212},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcreate-user.html",[1202],[1214],{"type":50,"value":1215},"CREATE USER",{"type":45,"tag":70,"props":1217,"children":1218},{},[1219],{"type":45,"tag":219,"props":1220,"children":1223},{"href":1221,"rel":1222},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Falter-user.html",[1202],[1224],{"type":50,"value":838},{"type":45,"tag":70,"props":1226,"children":1227},{},[1228],{"type":45,"tag":219,"props":1229,"children":1232},{"href":1230,"rel":1231},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fsecurity-overview.html",[1202],[1233],{"type":50,"value":1234},"Security Overview",{"type":45,"tag":70,"props":1236,"children":1237},{},[1238],{"type":45,"tag":219,"props":1239,"children":1242},{"href":1240,"rel":1241},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fauthentication.html",[1202],[1243],{"type":50,"value":1244},"Authentication",{"type":45,"tag":1246,"props":1247,"children":1248},"style",{},[1249],{"type":50,"value":1250},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1252,"total":1412},[1253,1272,1286,1301,1312,1322,1335,1347,1361,1376,1386,1399],{"slug":1254,"name":1254,"fn":1255,"description":1256,"org":1257,"tags":1258,"stars":1269,"repoUrl":1270,"updatedAt":1271},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1259,1260,1263,1266],{"name":20,"slug":21,"type":15},{"name":1261,"slug":1262,"type":15},"Incident Response","incident-response",{"name":1264,"slug":1265,"type":15},"Kubernetes","kubernetes",{"name":1267,"slug":1268,"type":15},"Monitoring","monitoring",105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":1273,"name":1273,"fn":1274,"description":1275,"org":1276,"tags":1277,"stars":1269,"repoUrl":1270,"updatedAt":1285},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1278,1281,1284],{"name":1279,"slug":1280,"type":15},"Deployment","deployment",{"name":1282,"slug":1283,"type":15},"Encryption","encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":1287,"name":1287,"fn":1288,"description":1289,"org":1290,"tags":1291,"stars":1269,"repoUrl":1270,"updatedAt":1300},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1292,1293,1296,1297],{"name":20,"slug":21,"type":15},{"name":1294,"slug":1295,"type":15},"Debugging","debugging",{"name":1264,"slug":1265,"type":15},{"name":1298,"slug":1299,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":1302,"name":1302,"fn":1303,"description":1304,"org":1305,"tags":1306,"stars":1269,"repoUrl":1270,"updatedAt":1311},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1307,1308,1309,1310],{"name":20,"slug":21,"type":15},{"name":1294,"slug":1295,"type":15},{"name":1279,"slug":1280,"type":15},{"name":1264,"slug":1265,"type":15},"2026-07-12T07:57:24.018818",{"slug":1313,"name":1313,"fn":1314,"description":1315,"org":1316,"tags":1317,"stars":1269,"repoUrl":1270,"updatedAt":1321},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1318,1319,1320],{"name":20,"slug":21,"type":15},{"name":1279,"slug":1280,"type":15},{"name":1264,"slug":1265,"type":15},"2026-07-12T07:56:45.777567",{"slug":1323,"name":1323,"fn":1324,"description":1325,"org":1326,"tags":1327,"stars":1269,"repoUrl":1270,"updatedAt":1334},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1328,1329,1330,1331],{"name":20,"slug":21,"type":15},{"name":1279,"slug":1280,"type":15},{"name":1264,"slug":1265,"type":15},{"name":1332,"slug":1333,"type":15},"Operations","operations","2026-07-12T07:56:47.082609",{"slug":1336,"name":1336,"fn":1337,"description":1338,"org":1339,"tags":1340,"stars":22,"repoUrl":23,"updatedAt":1346},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1341,1342,1343],{"name":20,"slug":21,"type":15},{"name":1267,"slug":1268,"type":15},{"name":1344,"slug":1345,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":1348,"name":1348,"fn":1349,"description":1350,"org":1351,"tags":1352,"stars":22,"repoUrl":23,"updatedAt":1360},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1353,1356,1357,1358],{"name":1354,"slug":1355,"type":15},"Data Modeling","data-modeling",{"name":20,"slug":21,"type":15},{"name":1344,"slug":1345,"type":15},{"name":1359,"slug":133,"type":15},"SQL","2026-07-12T07:57:22.763788",{"slug":1362,"name":1362,"fn":1363,"description":1364,"org":1365,"tags":1366,"stars":22,"repoUrl":23,"updatedAt":1375},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1367,1370,1373,1374],{"name":1368,"slug":1369,"type":15},"Audit","audit",{"name":1371,"slug":1372,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":1159,"name":1159,"fn":1377,"description":1378,"org":1379,"tags":1380,"stars":22,"repoUrl":23,"updatedAt":1385},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1381,1382,1383,1384],{"name":1368,"slug":1369,"type":15},{"name":20,"slug":21,"type":15},{"name":1332,"slug":1333,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":1387,"name":1387,"fn":1388,"description":1389,"org":1390,"tags":1391,"stars":22,"repoUrl":23,"updatedAt":1398},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1392,1393,1396,1397],{"name":1368,"slug":1369,"type":15},{"name":1394,"slug":1395,"type":15},"Data Analysis","data-analysis",{"name":20,"slug":21,"type":15},{"name":1344,"slug":1345,"type":15},"2026-07-12T07:57:16.190081",{"slug":1400,"name":1400,"fn":1401,"description":1402,"org":1403,"tags":1404,"stars":22,"repoUrl":23,"updatedAt":1411},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1405,1406,1409,1410],{"name":20,"slug":21,"type":15},{"name":1407,"slug":1408,"type":15},"Engineering","engineering",{"name":1344,"slug":1345,"type":15},{"name":1359,"slug":133,"type":15},"2026-07-12T07:57:26.543278",40,{"items":1414,"total":1466},[1415,1421,1428,1435,1442,1449,1456],{"slug":1336,"name":1336,"fn":1337,"description":1338,"org":1416,"tags":1417,"stars":22,"repoUrl":23,"updatedAt":1346},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1418,1419,1420],{"name":20,"slug":21,"type":15},{"name":1267,"slug":1268,"type":15},{"name":1344,"slug":1345,"type":15},{"slug":1348,"name":1348,"fn":1349,"description":1350,"org":1422,"tags":1423,"stars":22,"repoUrl":23,"updatedAt":1360},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1424,1425,1426,1427],{"name":1354,"slug":1355,"type":15},{"name":20,"slug":21,"type":15},{"name":1344,"slug":1345,"type":15},{"name":1359,"slug":133,"type":15},{"slug":1362,"name":1362,"fn":1363,"description":1364,"org":1429,"tags":1430,"stars":22,"repoUrl":23,"updatedAt":1375},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1431,1432,1433,1434],{"name":1368,"slug":1369,"type":15},{"name":1371,"slug":1372,"type":15},{"name":20,"slug":21,"type":15},{"name":13,"slug":14,"type":15},{"slug":1159,"name":1159,"fn":1377,"description":1378,"org":1436,"tags":1437,"stars":22,"repoUrl":23,"updatedAt":1385},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1438,1439,1440,1441],{"name":1368,"slug":1369,"type":15},{"name":20,"slug":21,"type":15},{"name":1332,"slug":1333,"type":15},{"name":13,"slug":14,"type":15},{"slug":1387,"name":1387,"fn":1388,"description":1389,"org":1443,"tags":1444,"stars":22,"repoUrl":23,"updatedAt":1398},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1445,1446,1447,1448],{"name":1368,"slug":1369,"type":15},{"name":1394,"slug":1395,"type":15},{"name":20,"slug":21,"type":15},{"name":1344,"slug":1345,"type":15},{"slug":1400,"name":1400,"fn":1401,"description":1402,"org":1450,"tags":1451,"stars":22,"repoUrl":23,"updatedAt":1411},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1452,1453,1454,1455],{"name":20,"slug":21,"type":15},{"name":1407,"slug":1408,"type":15},{"name":1344,"slug":1345,"type":15},{"name":1359,"slug":133,"type":15},{"slug":1457,"name":1457,"fn":1458,"description":1459,"org":1460,"tags":1461,"stars":22,"repoUrl":23,"updatedAt":1465},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1462,1463,1464],{"name":20,"slug":21,"type":15},{"name":1344,"slug":1345,"type":15},{"name":1359,"slug":133,"type":15},"2026-07-25T05:31:22.562808",34]