[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-hardening-user-privileges":3,"mdc-9ih87p-key":39,"related-repo-cockroachdb-hardening-user-privileges":1698,"related-org-cockroachdb-hardening-user-privileges":1792},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"hardening-user-privileges","harden user privileges and access control","Hardens CockroachDB user privileges by auditing and tightening role-based access control, reducing admin grants, restricting PUBLIC role permissions, and applying least-privilege principles. Use when reducing excessive privileges, cleaning up admin access, or implementing RBAC best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Database","database",{"name":20,"slug":21,"type":15},"RBAC","rbac",{"name":23,"slug":24,"type":15},"Access Control","access-control",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:56:58.844405",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fhardening-user-privileges","---\nname: hardening-user-privileges\ndescription: Hardens CockroachDB user privileges by auditing and tightening role-based access control, reducing admin grants, restricting PUBLIC role permissions, and applying least-privilege principles. Use when reducing excessive privileges, cleaning up admin access, or implementing RBAC best practices.\ncompatibility: Requires admin role to modify grants and role membership.\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Hardening User Privileges\n\nAudits and tightens CockroachDB role-based access control (RBAC) by identifying over-privileged users, reducing admin grants, restricting PUBLIC role permissions, creating purpose-specific roles, and applying least-privilege principles.\n\n## When to Use This Skill\n\n- Reducing the number of users with admin role\n- Removing excessive PUBLIC role privileges (SELECT, INSERT, UPDATE, DELETE)\n- Creating purpose-specific roles to replace broad admin grants\n- Responding to a security audit finding about excessive privileges\n- Implementing RBAC best practices for a production cluster\n- Onboarding a cluster to a least-privilege access model\n\n## Prerequisites\n\n- **SQL access** with admin role (required to modify grants and role membership)\n- **User inventory:** Understanding of which users\u002Fapplications need which level of access\n- **Application testing plan:** Revoking grants can break applications that depend on them\n\n**Check your access:**\n```sql\nSELECT member FROM [SHOW GRANTS ON ROLE admin] WHERE member = current_user();\n```\n\n## Steps\n\n### 1. Audit Current Users and Roles\n\n```sql\n-- List all users and their role memberships\nSELECT\n  username,\n  options,\n  member_of\nFROM [SHOW USERS]\nORDER BY username;\n\n-- Count admin role members\nSELECT COUNT(*) AS admin_count\nFROM [SHOW GRANTS ON ROLE admin];\n\n-- List all admin users\nSELECT member AS admin_user\nFROM [SHOW GRANTS ON ROLE admin]\nWHERE is_admin = true\nORDER BY member;\n```\n\nSee [SQL queries reference](references\u002Fsql-queries.md) for additional audit queries.\n\n### 2. Identify Over-Privileged Users\n\n**Admin role review:**\n```sql\n-- Admin users — each should have a documented reason for admin access\nSELECT member AS admin_user\nFROM [SHOW GRANTS ON ROLE admin]\nWHERE is_admin = true\nORDER BY member;\n```\n\nEvaluate each admin user:\n- **Keep admin:** Cluster operators, DBAs, automation accounts that genuinely need full access\n- **Downgrade:** Developers, analysts, application service accounts that only need specific permissions\n\n**PUBLIC role review:**\n```sql\n-- Check what PUBLIC can do (these apply to ALL users)\nSELECT\n  database_name,\n  schema_name,\n  object_name,\n  object_type,\n  privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE')\n  AND schema_name = 'public'\nORDER BY database_name, object_name;\n```\n\n**System privilege review:**\n```sql\n-- Users with sensitive system privileges\nSELECT grantee, privilege_type\nFROM [SHOW SYSTEM GRANTS]\nWHERE privilege_type IN (\n  'MODIFYCLUSTERSETTING',\n  'CANCELQUERY',\n  'CANCELSESSION',\n  'VIEWACTIVITY',\n  'CREATEDB',\n  'CREATELOGIN'\n)\nORDER BY privilege_type, grantee;\n```\n\n### 3. Create Purpose-Specific Roles\n\nReplace broad admin grants with targeted roles. Database-level grants in\nCockroachDB only support `CONNECT`, `CREATE`, `DROP`, `ZONECONFIG`, `BACKUP`,\n`RESTORE`, and `ALL` — data-access privileges (`SELECT`, `INSERT`, `UPDATE`,\n`DELETE`) live at the schema or table level. Pair `GRANT ... ON ALL TABLES IN\nSCHEMA` (covers existing tables) with `ALTER DEFAULT PRIVILEGES` (covers\nfuture tables created by the listed grantors) so new tables inherit the\nintended access.\n\n```sql\n-- Read-only role for analysts\nCREATE ROLE analyst_reader;\nGRANT CONNECT ON DATABASE \u003Capp_db> TO analyst_reader;\nGRANT USAGE ON SCHEMA \u003Capp_db>.public TO analyst_reader;\nGRANT SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO analyst_reader;\nALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public GRANT SELECT ON TABLES TO analyst_reader;\n\n-- Application service role (read + write, no DDL)\nCREATE ROLE app_service;\nGRANT CONNECT ON DATABASE \u003Capp_db> TO app_service;\nGRANT USAGE ON SCHEMA \u003Capp_db>.public TO app_service;\nGRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO app_service;\nALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public\n  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO app_service;\n\n-- Schema management role (DDL only)\nCREATE ROLE schema_manager;\nGRANT CREATE ON DATABASE \u003Capp_db> TO schema_manager;\n\n-- Monitoring role (read-only system visibility)\nCREATE ROLE monitoring;\nGRANT SYSTEM VIEWACTIVITYREDACTED TO monitoring;\n\n-- Operations role (triage + cancel, no data access)\nCREATE ROLE ops_triage;\nGRANT SYSTEM VIEWACTIVITYREDACTED, CANCELQUERY TO ops_triage;\n```\n\n### 4. Reassign Users to Purpose-Specific Roles\n\n```sql\n-- Assign users to their appropriate roles\nGRANT analyst_reader TO analyst_user;\nGRANT app_service TO payment_service, order_service;\nGRANT schema_manager TO migration_user;\nGRANT monitoring TO monitoring_user;\nGRANT ops_triage TO oncall_sre;\n```\n\n### 5. Revoke Excessive Grants\n\n**Revoke admin from users who no longer need it:**\n```sql\n-- Revoke admin from specific users\nREVOKE admin FROM analyst_user;\nREVOKE admin FROM payment_service;\nREVOKE admin FROM monitoring_user;\n```\n\n**Revoke PUBLIC role data grants:**\n```sql\n-- Revoke SELECT from PUBLIC on existing tables, plus the default-privilege grant\nREVOKE SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public FROM public;\nALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public REVOKE SELECT ON TABLES FROM public;\n\n-- Revoke all data privileges from PUBLIC on specific tables\nREVOKE ALL ON TABLE \u003Csensitive_table> FROM public;\n```\n\n**Revoke unnecessary system privileges:**\n```sql\n-- Revoke system privileges from users who don't need them\nREVOKE SYSTEM MODIFYCLUSTERSETTING FROM \u003Cusername>;\nREVOKE SYSTEM CREATEDB FROM \u003Cusername>;\n```\n\n### 6. Verify Changes\n\n```sql\n-- Confirm admin count is reduced\nSELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];\n\n-- Confirm PUBLIC privileges are minimal\nSELECT database_name, privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE');\n\n-- Verify specific user's effective privileges\nSHOW GRANTS FOR \u003Cusername>;\n```\n\n**Application testing:** After revoking grants, verify that all applications still function correctly. Test:\n- Read operations (SELECT)\n- Write operations (INSERT, UPDATE, DELETE)\n- Schema operations (CREATE, ALTER, DROP) — only for schema management accounts\n- Connection and authentication\n\n## Safety Considerations\n\n**Revoking grants can break applications.** Applications that depend on admin, PUBLIC, or specific grants will fail with permission errors if those grants are revoked.\n\n**Mitigation steps:**\n1. **Audit before revoking:** Document which users\u002Fapps depend on which grants\n2. **Create replacement roles first:** Assign purpose-specific roles before revoking admin\n3. **Test in staging:** Revoke grants in a staging environment first and test all application flows\n4. **Revoke incrementally:** Revoke one user\u002Fgrant at a time and test\n5. **Monitor for errors:** Watch application logs for permission-denied errors after changes\n\n**Do not revoke admin from:**\n- The last remaining admin user (you'll lose the ability to manage the cluster)\n- Automation accounts that manage schema migrations (unless you've created a schema_manager role)\n- The `root` user (built-in, cannot be revoked)\n\n## Rollback\n\nIf an application breaks after revoking a grant:\n\n```sql\n-- Re-grant admin (emergency)\nGRANT admin TO \u003Cusername>;\n\n-- Re-grant specific privileges\nGRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO \u003Cusername>;\n\n-- Re-grant PUBLIC privileges\nGRANT SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO public;\n```\n\n**Best practice:** Keep a record of all grants before revoking so you can restore them if needed:\n```sql\n-- Snapshot current grants before changes\nSELECT * FROM [SHOW GRANTS FOR \u003Cusername>];\nSELECT * FROM [SHOW GRANTS FOR public];\nSELECT * FROM [SHOW SYSTEM GRANTS];\n```\n\n## References\n\n**Skill references:**\n- [SQL queries for privilege hardening](references\u002Fsql-queries.md)\n\n**Related skills:**\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Run a full security posture audit\n- [configuring-audit-logging](..\u002Fconfiguring-audit-logging\u002FSKILL.md) — Set up audit logging for privilege-sensitive operations\n\n**Official CockroachDB Documentation:**\n- [Authorization Overview](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthorization.html)\n- [GRANT](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fgrant.html)\n- [REVOKE](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frevoke.html)\n- [CREATE ROLE](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcreate-role.html)\n- [SHOW GRANTS](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fshow-grants.html)\n- [System Privileges](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthorization.html#supported-privileges)\n",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"Requires admin role to modify grants and role membership.",{"author":8,"version":43},"1.0",{"type":45,"children":46},"root",[47,55,61,68,103,109,143,151,173,179,186,343,357,363,371,414,419,442,450,544,552,655,661,764,984,990,1045,1051,1059,1098,1106,1160,1168,1199,1205,1289,1299,1322,1328,1338,1346,1400,1408,1433,1439,1444,1513,1523,1562,1568,1576,1587,1595,1620,1628,1692],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Hardening User Privileges",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Audits and tightens CockroachDB role-based access control (RBAC) by identifying over-privileged users, reducing admin grants, restricting PUBLIC role permissions, creating purpose-specific roles, and applying least-privilege principles.",{"type":48,"tag":62,"props":63,"children":65},"h2",{"id":64},"when-to-use-this-skill",[66],{"type":53,"value":67},"When to Use This Skill",{"type":48,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,88,93,98],{"type":48,"tag":73,"props":74,"children":75},"li",{},[76],{"type":53,"value":77},"Reducing the number of users with admin role",{"type":48,"tag":73,"props":79,"children":80},{},[81],{"type":53,"value":82},"Removing excessive PUBLIC role privileges (SELECT, INSERT, UPDATE, DELETE)",{"type":48,"tag":73,"props":84,"children":85},{},[86],{"type":53,"value":87},"Creating purpose-specific roles to replace broad admin grants",{"type":48,"tag":73,"props":89,"children":90},{},[91],{"type":53,"value":92},"Responding to a security audit finding about excessive privileges",{"type":48,"tag":73,"props":94,"children":95},{},[96],{"type":53,"value":97},"Implementing RBAC best practices for a production cluster",{"type":48,"tag":73,"props":99,"children":100},{},[101],{"type":53,"value":102},"Onboarding a cluster to a least-privilege access model",{"type":48,"tag":62,"props":104,"children":106},{"id":105},"prerequisites",[107],{"type":53,"value":108},"Prerequisites",{"type":48,"tag":69,"props":110,"children":111},{},[112,123,133],{"type":48,"tag":73,"props":113,"children":114},{},[115,121],{"type":48,"tag":116,"props":117,"children":118},"strong",{},[119],{"type":53,"value":120},"SQL access",{"type":53,"value":122}," with admin role (required to modify grants and role membership)",{"type":48,"tag":73,"props":124,"children":125},{},[126,131],{"type":48,"tag":116,"props":127,"children":128},{},[129],{"type":53,"value":130},"User inventory:",{"type":53,"value":132}," Understanding of which users\u002Fapplications need which level of access",{"type":48,"tag":73,"props":134,"children":135},{},[136,141],{"type":48,"tag":116,"props":137,"children":138},{},[139],{"type":53,"value":140},"Application testing plan:",{"type":53,"value":142}," Revoking grants can break applications that depend on them",{"type":48,"tag":56,"props":144,"children":145},{},[146],{"type":48,"tag":116,"props":147,"children":148},{},[149],{"type":53,"value":150},"Check your access:",{"type":48,"tag":152,"props":153,"children":158},"pre",{"className":154,"code":155,"language":156,"meta":157,"style":157},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","SELECT member FROM [SHOW GRANTS ON ROLE admin] WHERE member = current_user();\n","sql","",[159],{"type":48,"tag":160,"props":161,"children":162},"code",{"__ignoreMap":157},[163],{"type":48,"tag":164,"props":165,"children":168},"span",{"class":166,"line":167},"line",1,[169],{"type":48,"tag":164,"props":170,"children":171},{},[172],{"type":53,"value":155},{"type":48,"tag":62,"props":174,"children":176},{"id":175},"steps",[177],{"type":53,"value":178},"Steps",{"type":48,"tag":180,"props":181,"children":183},"h3",{"id":182},"_1-audit-current-users-and-roles",[184],{"type":53,"value":185},"1. Audit Current Users and Roles",{"type":48,"tag":152,"props":187,"children":189},{"className":154,"code":188,"language":156,"meta":157,"style":157},"-- List all users and their role memberships\nSELECT\n  username,\n  options,\n  member_of\nFROM [SHOW USERS]\nORDER BY username;\n\n-- Count admin role members\nSELECT COUNT(*) AS admin_count\nFROM [SHOW GRANTS ON ROLE admin];\n\n-- List all admin users\nSELECT member AS admin_user\nFROM [SHOW GRANTS ON ROLE admin]\nWHERE is_admin = true\nORDER BY member;\n",[190],{"type":48,"tag":160,"props":191,"children":192},{"__ignoreMap":157},[193,201,209,217,226,235,244,253,263,272,281,290,298,307,316,325,334],{"type":48,"tag":164,"props":194,"children":195},{"class":166,"line":167},[196],{"type":48,"tag":164,"props":197,"children":198},{},[199],{"type":53,"value":200},"-- List all users and their role memberships\n",{"type":48,"tag":164,"props":202,"children":203},{"class":166,"line":29},[204],{"type":48,"tag":164,"props":205,"children":206},{},[207],{"type":53,"value":208},"SELECT\n",{"type":48,"tag":164,"props":210,"children":211},{"class":166,"line":25},[212],{"type":48,"tag":164,"props":213,"children":214},{},[215],{"type":53,"value":216},"  username,\n",{"type":48,"tag":164,"props":218,"children":220},{"class":166,"line":219},4,[221],{"type":48,"tag":164,"props":222,"children":223},{},[224],{"type":53,"value":225},"  options,\n",{"type":48,"tag":164,"props":227,"children":229},{"class":166,"line":228},5,[230],{"type":48,"tag":164,"props":231,"children":232},{},[233],{"type":53,"value":234},"  member_of\n",{"type":48,"tag":164,"props":236,"children":238},{"class":166,"line":237},6,[239],{"type":48,"tag":164,"props":240,"children":241},{},[242],{"type":53,"value":243},"FROM [SHOW USERS]\n",{"type":48,"tag":164,"props":245,"children":247},{"class":166,"line":246},7,[248],{"type":48,"tag":164,"props":249,"children":250},{},[251],{"type":53,"value":252},"ORDER BY username;\n",{"type":48,"tag":164,"props":254,"children":256},{"class":166,"line":255},8,[257],{"type":48,"tag":164,"props":258,"children":260},{"emptyLinePlaceholder":259},true,[261],{"type":53,"value":262},"\n",{"type":48,"tag":164,"props":264,"children":266},{"class":166,"line":265},9,[267],{"type":48,"tag":164,"props":268,"children":269},{},[270],{"type":53,"value":271},"-- Count admin role members\n",{"type":48,"tag":164,"props":273,"children":275},{"class":166,"line":274},10,[276],{"type":48,"tag":164,"props":277,"children":278},{},[279],{"type":53,"value":280},"SELECT COUNT(*) AS admin_count\n",{"type":48,"tag":164,"props":282,"children":284},{"class":166,"line":283},11,[285],{"type":48,"tag":164,"props":286,"children":287},{},[288],{"type":53,"value":289},"FROM [SHOW GRANTS ON ROLE admin];\n",{"type":48,"tag":164,"props":291,"children":293},{"class":166,"line":292},12,[294],{"type":48,"tag":164,"props":295,"children":296},{"emptyLinePlaceholder":259},[297],{"type":53,"value":262},{"type":48,"tag":164,"props":299,"children":301},{"class":166,"line":300},13,[302],{"type":48,"tag":164,"props":303,"children":304},{},[305],{"type":53,"value":306},"-- List all admin users\n",{"type":48,"tag":164,"props":308,"children":310},{"class":166,"line":309},14,[311],{"type":48,"tag":164,"props":312,"children":313},{},[314],{"type":53,"value":315},"SELECT member AS admin_user\n",{"type":48,"tag":164,"props":317,"children":319},{"class":166,"line":318},15,[320],{"type":48,"tag":164,"props":321,"children":322},{},[323],{"type":53,"value":324},"FROM [SHOW GRANTS ON ROLE admin]\n",{"type":48,"tag":164,"props":326,"children":328},{"class":166,"line":327},16,[329],{"type":48,"tag":164,"props":330,"children":331},{},[332],{"type":53,"value":333},"WHERE is_admin = true\n",{"type":48,"tag":164,"props":335,"children":337},{"class":166,"line":336},17,[338],{"type":48,"tag":164,"props":339,"children":340},{},[341],{"type":53,"value":342},"ORDER BY member;\n",{"type":48,"tag":56,"props":344,"children":345},{},[346,348,355],{"type":53,"value":347},"See ",{"type":48,"tag":349,"props":350,"children":352},"a",{"href":351},"references\u002Fsql-queries.md",[353],{"type":53,"value":354},"SQL queries reference",{"type":53,"value":356}," for additional audit queries.",{"type":48,"tag":180,"props":358,"children":360},{"id":359},"_2-identify-over-privileged-users",[361],{"type":53,"value":362},"2. Identify Over-Privileged Users",{"type":48,"tag":56,"props":364,"children":365},{},[366],{"type":48,"tag":116,"props":367,"children":368},{},[369],{"type":53,"value":370},"Admin role review:",{"type":48,"tag":152,"props":372,"children":374},{"className":154,"code":373,"language":156,"meta":157,"style":157},"-- Admin users — each should have a documented reason for admin access\nSELECT member AS admin_user\nFROM [SHOW GRANTS ON ROLE admin]\nWHERE is_admin = true\nORDER BY member;\n",[375],{"type":48,"tag":160,"props":376,"children":377},{"__ignoreMap":157},[378,386,393,400,407],{"type":48,"tag":164,"props":379,"children":380},{"class":166,"line":167},[381],{"type":48,"tag":164,"props":382,"children":383},{},[384],{"type":53,"value":385},"-- Admin users — each should have a documented reason for admin access\n",{"type":48,"tag":164,"props":387,"children":388},{"class":166,"line":29},[389],{"type":48,"tag":164,"props":390,"children":391},{},[392],{"type":53,"value":315},{"type":48,"tag":164,"props":394,"children":395},{"class":166,"line":25},[396],{"type":48,"tag":164,"props":397,"children":398},{},[399],{"type":53,"value":324},{"type":48,"tag":164,"props":401,"children":402},{"class":166,"line":219},[403],{"type":48,"tag":164,"props":404,"children":405},{},[406],{"type":53,"value":333},{"type":48,"tag":164,"props":408,"children":409},{"class":166,"line":228},[410],{"type":48,"tag":164,"props":411,"children":412},{},[413],{"type":53,"value":342},{"type":48,"tag":56,"props":415,"children":416},{},[417],{"type":53,"value":418},"Evaluate each admin user:",{"type":48,"tag":69,"props":420,"children":421},{},[422,432],{"type":48,"tag":73,"props":423,"children":424},{},[425,430],{"type":48,"tag":116,"props":426,"children":427},{},[428],{"type":53,"value":429},"Keep admin:",{"type":53,"value":431}," Cluster operators, DBAs, automation accounts that genuinely need full access",{"type":48,"tag":73,"props":433,"children":434},{},[435,440],{"type":48,"tag":116,"props":436,"children":437},{},[438],{"type":53,"value":439},"Downgrade:",{"type":53,"value":441}," Developers, analysts, application service accounts that only need specific permissions",{"type":48,"tag":56,"props":443,"children":444},{},[445],{"type":48,"tag":116,"props":446,"children":447},{},[448],{"type":53,"value":449},"PUBLIC role review:",{"type":48,"tag":152,"props":451,"children":453},{"className":154,"code":452,"language":156,"meta":157,"style":157},"-- Check what PUBLIC can do (these apply to ALL users)\nSELECT\n  database_name,\n  schema_name,\n  object_name,\n  object_type,\n  privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE')\n  AND schema_name = 'public'\nORDER BY database_name, object_name;\n",[454],{"type":48,"tag":160,"props":455,"children":456},{"__ignoreMap":157},[457,465,472,480,488,496,504,512,520,528,536],{"type":48,"tag":164,"props":458,"children":459},{"class":166,"line":167},[460],{"type":48,"tag":164,"props":461,"children":462},{},[463],{"type":53,"value":464},"-- Check what PUBLIC can do (these apply to ALL users)\n",{"type":48,"tag":164,"props":466,"children":467},{"class":166,"line":29},[468],{"type":48,"tag":164,"props":469,"children":470},{},[471],{"type":53,"value":208},{"type":48,"tag":164,"props":473,"children":474},{"class":166,"line":25},[475],{"type":48,"tag":164,"props":476,"children":477},{},[478],{"type":53,"value":479},"  database_name,\n",{"type":48,"tag":164,"props":481,"children":482},{"class":166,"line":219},[483],{"type":48,"tag":164,"props":484,"children":485},{},[486],{"type":53,"value":487},"  schema_name,\n",{"type":48,"tag":164,"props":489,"children":490},{"class":166,"line":228},[491],{"type":48,"tag":164,"props":492,"children":493},{},[494],{"type":53,"value":495},"  object_name,\n",{"type":48,"tag":164,"props":497,"children":498},{"class":166,"line":237},[499],{"type":48,"tag":164,"props":500,"children":501},{},[502],{"type":53,"value":503},"  object_type,\n",{"type":48,"tag":164,"props":505,"children":506},{"class":166,"line":246},[507],{"type":48,"tag":164,"props":508,"children":509},{},[510],{"type":53,"value":511},"  privilege_type\n",{"type":48,"tag":164,"props":513,"children":514},{"class":166,"line":255},[515],{"type":48,"tag":164,"props":516,"children":517},{},[518],{"type":53,"value":519},"FROM [SHOW GRANTS FOR public]\n",{"type":48,"tag":164,"props":521,"children":522},{"class":166,"line":265},[523],{"type":48,"tag":164,"props":524,"children":525},{},[526],{"type":53,"value":527},"WHERE privilege_type NOT IN ('USAGE')\n",{"type":48,"tag":164,"props":529,"children":530},{"class":166,"line":274},[531],{"type":48,"tag":164,"props":532,"children":533},{},[534],{"type":53,"value":535},"  AND schema_name = 'public'\n",{"type":48,"tag":164,"props":537,"children":538},{"class":166,"line":283},[539],{"type":48,"tag":164,"props":540,"children":541},{},[542],{"type":53,"value":543},"ORDER BY database_name, object_name;\n",{"type":48,"tag":56,"props":545,"children":546},{},[547],{"type":48,"tag":116,"props":548,"children":549},{},[550],{"type":53,"value":551},"System privilege review:",{"type":48,"tag":152,"props":553,"children":555},{"className":154,"code":554,"language":156,"meta":157,"style":157},"-- Users with sensitive system privileges\nSELECT grantee, privilege_type\nFROM [SHOW SYSTEM GRANTS]\nWHERE privilege_type IN (\n  'MODIFYCLUSTERSETTING',\n  'CANCELQUERY',\n  'CANCELSESSION',\n  'VIEWACTIVITY',\n  'CREATEDB',\n  'CREATELOGIN'\n)\nORDER BY privilege_type, grantee;\n",[556],{"type":48,"tag":160,"props":557,"children":558},{"__ignoreMap":157},[559,567,575,583,591,599,607,615,623,631,639,647],{"type":48,"tag":164,"props":560,"children":561},{"class":166,"line":167},[562],{"type":48,"tag":164,"props":563,"children":564},{},[565],{"type":53,"value":566},"-- Users with sensitive system privileges\n",{"type":48,"tag":164,"props":568,"children":569},{"class":166,"line":29},[570],{"type":48,"tag":164,"props":571,"children":572},{},[573],{"type":53,"value":574},"SELECT grantee, privilege_type\n",{"type":48,"tag":164,"props":576,"children":577},{"class":166,"line":25},[578],{"type":48,"tag":164,"props":579,"children":580},{},[581],{"type":53,"value":582},"FROM [SHOW SYSTEM GRANTS]\n",{"type":48,"tag":164,"props":584,"children":585},{"class":166,"line":219},[586],{"type":48,"tag":164,"props":587,"children":588},{},[589],{"type":53,"value":590},"WHERE privilege_type IN (\n",{"type":48,"tag":164,"props":592,"children":593},{"class":166,"line":228},[594],{"type":48,"tag":164,"props":595,"children":596},{},[597],{"type":53,"value":598},"  'MODIFYCLUSTERSETTING',\n",{"type":48,"tag":164,"props":600,"children":601},{"class":166,"line":237},[602],{"type":48,"tag":164,"props":603,"children":604},{},[605],{"type":53,"value":606},"  'CANCELQUERY',\n",{"type":48,"tag":164,"props":608,"children":609},{"class":166,"line":246},[610],{"type":48,"tag":164,"props":611,"children":612},{},[613],{"type":53,"value":614},"  'CANCELSESSION',\n",{"type":48,"tag":164,"props":616,"children":617},{"class":166,"line":255},[618],{"type":48,"tag":164,"props":619,"children":620},{},[621],{"type":53,"value":622},"  'VIEWACTIVITY',\n",{"type":48,"tag":164,"props":624,"children":625},{"class":166,"line":265},[626],{"type":48,"tag":164,"props":627,"children":628},{},[629],{"type":53,"value":630},"  'CREATEDB',\n",{"type":48,"tag":164,"props":632,"children":633},{"class":166,"line":274},[634],{"type":48,"tag":164,"props":635,"children":636},{},[637],{"type":53,"value":638},"  'CREATELOGIN'\n",{"type":48,"tag":164,"props":640,"children":641},{"class":166,"line":283},[642],{"type":48,"tag":164,"props":643,"children":644},{},[645],{"type":53,"value":646},")\n",{"type":48,"tag":164,"props":648,"children":649},{"class":166,"line":292},[650],{"type":48,"tag":164,"props":651,"children":652},{},[653],{"type":53,"value":654},"ORDER BY privilege_type, grantee;\n",{"type":48,"tag":180,"props":656,"children":658},{"id":657},"_3-create-purpose-specific-roles",[659],{"type":53,"value":660},"3. Create Purpose-Specific Roles",{"type":48,"tag":56,"props":662,"children":663},{},[664,666,672,674,680,681,687,688,694,695,701,703,709,711,717,719,725,726,732,733,739,740,746,748,754,756,762],{"type":53,"value":665},"Replace broad admin grants with targeted roles. Database-level grants in\nCockroachDB only support ",{"type":48,"tag":160,"props":667,"children":669},{"className":668},[],[670],{"type":53,"value":671},"CONNECT",{"type":53,"value":673},", ",{"type":48,"tag":160,"props":675,"children":677},{"className":676},[],[678],{"type":53,"value":679},"CREATE",{"type":53,"value":673},{"type":48,"tag":160,"props":682,"children":684},{"className":683},[],[685],{"type":53,"value":686},"DROP",{"type":53,"value":673},{"type":48,"tag":160,"props":689,"children":691},{"className":690},[],[692],{"type":53,"value":693},"ZONECONFIG",{"type":53,"value":673},{"type":48,"tag":160,"props":696,"children":698},{"className":697},[],[699],{"type":53,"value":700},"BACKUP",{"type":53,"value":702},",\n",{"type":48,"tag":160,"props":704,"children":706},{"className":705},[],[707],{"type":53,"value":708},"RESTORE",{"type":53,"value":710},", and ",{"type":48,"tag":160,"props":712,"children":714},{"className":713},[],[715],{"type":53,"value":716},"ALL",{"type":53,"value":718}," — data-access privileges (",{"type":48,"tag":160,"props":720,"children":722},{"className":721},[],[723],{"type":53,"value":724},"SELECT",{"type":53,"value":673},{"type":48,"tag":160,"props":727,"children":729},{"className":728},[],[730],{"type":53,"value":731},"INSERT",{"type":53,"value":673},{"type":48,"tag":160,"props":734,"children":736},{"className":735},[],[737],{"type":53,"value":738},"UPDATE",{"type":53,"value":702},{"type":48,"tag":160,"props":741,"children":743},{"className":742},[],[744],{"type":53,"value":745},"DELETE",{"type":53,"value":747},") live at the schema or table level. Pair ",{"type":48,"tag":160,"props":749,"children":751},{"className":750},[],[752],{"type":53,"value":753},"GRANT ... ON ALL TABLES IN SCHEMA",{"type":53,"value":755}," (covers existing tables) with ",{"type":48,"tag":160,"props":757,"children":759},{"className":758},[],[760],{"type":53,"value":761},"ALTER DEFAULT PRIVILEGES",{"type":53,"value":763}," (covers\nfuture tables created by the listed grantors) so new tables inherit the\nintended access.",{"type":48,"tag":152,"props":765,"children":767},{"className":154,"code":766,"language":156,"meta":157,"style":157},"-- Read-only role for analysts\nCREATE ROLE analyst_reader;\nGRANT CONNECT ON DATABASE \u003Capp_db> TO analyst_reader;\nGRANT USAGE ON SCHEMA \u003Capp_db>.public TO analyst_reader;\nGRANT SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO analyst_reader;\nALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public GRANT SELECT ON TABLES TO analyst_reader;\n\n-- Application service role (read + write, no DDL)\nCREATE ROLE app_service;\nGRANT CONNECT ON DATABASE \u003Capp_db> TO app_service;\nGRANT USAGE ON SCHEMA \u003Capp_db>.public TO app_service;\nGRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO app_service;\nALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public\n  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO app_service;\n\n-- Schema management role (DDL only)\nCREATE ROLE schema_manager;\nGRANT CREATE ON DATABASE \u003Capp_db> TO schema_manager;\n\n-- Monitoring role (read-only system visibility)\nCREATE ROLE monitoring;\nGRANT SYSTEM VIEWACTIVITYREDACTED TO monitoring;\n\n-- Operations role (triage + cancel, no data access)\nCREATE ROLE ops_triage;\nGRANT SYSTEM VIEWACTIVITYREDACTED, CANCELQUERY TO ops_triage;\n",[768],{"type":48,"tag":160,"props":769,"children":770},{"__ignoreMap":157},[771,779,787,795,803,811,819,826,834,842,850,858,866,874,882,889,897,905,914,922,931,940,949,957,966,975],{"type":48,"tag":164,"props":772,"children":773},{"class":166,"line":167},[774],{"type":48,"tag":164,"props":775,"children":776},{},[777],{"type":53,"value":778},"-- Read-only role for analysts\n",{"type":48,"tag":164,"props":780,"children":781},{"class":166,"line":29},[782],{"type":48,"tag":164,"props":783,"children":784},{},[785],{"type":53,"value":786},"CREATE ROLE analyst_reader;\n",{"type":48,"tag":164,"props":788,"children":789},{"class":166,"line":25},[790],{"type":48,"tag":164,"props":791,"children":792},{},[793],{"type":53,"value":794},"GRANT CONNECT ON DATABASE \u003Capp_db> TO analyst_reader;\n",{"type":48,"tag":164,"props":796,"children":797},{"class":166,"line":219},[798],{"type":48,"tag":164,"props":799,"children":800},{},[801],{"type":53,"value":802},"GRANT USAGE ON SCHEMA \u003Capp_db>.public TO analyst_reader;\n",{"type":48,"tag":164,"props":804,"children":805},{"class":166,"line":228},[806],{"type":48,"tag":164,"props":807,"children":808},{},[809],{"type":53,"value":810},"GRANT SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO analyst_reader;\n",{"type":48,"tag":164,"props":812,"children":813},{"class":166,"line":237},[814],{"type":48,"tag":164,"props":815,"children":816},{},[817],{"type":53,"value":818},"ALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public GRANT SELECT ON TABLES TO analyst_reader;\n",{"type":48,"tag":164,"props":820,"children":821},{"class":166,"line":246},[822],{"type":48,"tag":164,"props":823,"children":824},{"emptyLinePlaceholder":259},[825],{"type":53,"value":262},{"type":48,"tag":164,"props":827,"children":828},{"class":166,"line":255},[829],{"type":48,"tag":164,"props":830,"children":831},{},[832],{"type":53,"value":833},"-- Application service role (read + write, no DDL)\n",{"type":48,"tag":164,"props":835,"children":836},{"class":166,"line":265},[837],{"type":48,"tag":164,"props":838,"children":839},{},[840],{"type":53,"value":841},"CREATE ROLE app_service;\n",{"type":48,"tag":164,"props":843,"children":844},{"class":166,"line":274},[845],{"type":48,"tag":164,"props":846,"children":847},{},[848],{"type":53,"value":849},"GRANT CONNECT ON DATABASE \u003Capp_db> TO app_service;\n",{"type":48,"tag":164,"props":851,"children":852},{"class":166,"line":283},[853],{"type":48,"tag":164,"props":854,"children":855},{},[856],{"type":53,"value":857},"GRANT USAGE ON SCHEMA \u003Capp_db>.public TO app_service;\n",{"type":48,"tag":164,"props":859,"children":860},{"class":166,"line":292},[861],{"type":48,"tag":164,"props":862,"children":863},{},[864],{"type":53,"value":865},"GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO app_service;\n",{"type":48,"tag":164,"props":867,"children":868},{"class":166,"line":300},[869],{"type":48,"tag":164,"props":870,"children":871},{},[872],{"type":53,"value":873},"ALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public\n",{"type":48,"tag":164,"props":875,"children":876},{"class":166,"line":309},[877],{"type":48,"tag":164,"props":878,"children":879},{},[880],{"type":53,"value":881},"  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO app_service;\n",{"type":48,"tag":164,"props":883,"children":884},{"class":166,"line":318},[885],{"type":48,"tag":164,"props":886,"children":887},{"emptyLinePlaceholder":259},[888],{"type":53,"value":262},{"type":48,"tag":164,"props":890,"children":891},{"class":166,"line":327},[892],{"type":48,"tag":164,"props":893,"children":894},{},[895],{"type":53,"value":896},"-- Schema management role (DDL only)\n",{"type":48,"tag":164,"props":898,"children":899},{"class":166,"line":336},[900],{"type":48,"tag":164,"props":901,"children":902},{},[903],{"type":53,"value":904},"CREATE ROLE schema_manager;\n",{"type":48,"tag":164,"props":906,"children":908},{"class":166,"line":907},18,[909],{"type":48,"tag":164,"props":910,"children":911},{},[912],{"type":53,"value":913},"GRANT CREATE ON DATABASE \u003Capp_db> TO schema_manager;\n",{"type":48,"tag":164,"props":915,"children":917},{"class":166,"line":916},19,[918],{"type":48,"tag":164,"props":919,"children":920},{"emptyLinePlaceholder":259},[921],{"type":53,"value":262},{"type":48,"tag":164,"props":923,"children":925},{"class":166,"line":924},20,[926],{"type":48,"tag":164,"props":927,"children":928},{},[929],{"type":53,"value":930},"-- Monitoring role (read-only system visibility)\n",{"type":48,"tag":164,"props":932,"children":934},{"class":166,"line":933},21,[935],{"type":48,"tag":164,"props":936,"children":937},{},[938],{"type":53,"value":939},"CREATE ROLE monitoring;\n",{"type":48,"tag":164,"props":941,"children":943},{"class":166,"line":942},22,[944],{"type":48,"tag":164,"props":945,"children":946},{},[947],{"type":53,"value":948},"GRANT SYSTEM VIEWACTIVITYREDACTED TO monitoring;\n",{"type":48,"tag":164,"props":950,"children":952},{"class":166,"line":951},23,[953],{"type":48,"tag":164,"props":954,"children":955},{"emptyLinePlaceholder":259},[956],{"type":53,"value":262},{"type":48,"tag":164,"props":958,"children":960},{"class":166,"line":959},24,[961],{"type":48,"tag":164,"props":962,"children":963},{},[964],{"type":53,"value":965},"-- Operations role (triage + cancel, no data access)\n",{"type":48,"tag":164,"props":967,"children":969},{"class":166,"line":968},25,[970],{"type":48,"tag":164,"props":971,"children":972},{},[973],{"type":53,"value":974},"CREATE ROLE ops_triage;\n",{"type":48,"tag":164,"props":976,"children":978},{"class":166,"line":977},26,[979],{"type":48,"tag":164,"props":980,"children":981},{},[982],{"type":53,"value":983},"GRANT SYSTEM VIEWACTIVITYREDACTED, CANCELQUERY TO ops_triage;\n",{"type":48,"tag":180,"props":985,"children":987},{"id":986},"_4-reassign-users-to-purpose-specific-roles",[988],{"type":53,"value":989},"4. Reassign Users to Purpose-Specific Roles",{"type":48,"tag":152,"props":991,"children":993},{"className":154,"code":992,"language":156,"meta":157,"style":157},"-- Assign users to their appropriate roles\nGRANT analyst_reader TO analyst_user;\nGRANT app_service TO payment_service, order_service;\nGRANT schema_manager TO migration_user;\nGRANT monitoring TO monitoring_user;\nGRANT ops_triage TO oncall_sre;\n",[994],{"type":48,"tag":160,"props":995,"children":996},{"__ignoreMap":157},[997,1005,1013,1021,1029,1037],{"type":48,"tag":164,"props":998,"children":999},{"class":166,"line":167},[1000],{"type":48,"tag":164,"props":1001,"children":1002},{},[1003],{"type":53,"value":1004},"-- Assign users to their appropriate roles\n",{"type":48,"tag":164,"props":1006,"children":1007},{"class":166,"line":29},[1008],{"type":48,"tag":164,"props":1009,"children":1010},{},[1011],{"type":53,"value":1012},"GRANT analyst_reader TO analyst_user;\n",{"type":48,"tag":164,"props":1014,"children":1015},{"class":166,"line":25},[1016],{"type":48,"tag":164,"props":1017,"children":1018},{},[1019],{"type":53,"value":1020},"GRANT app_service TO payment_service, order_service;\n",{"type":48,"tag":164,"props":1022,"children":1023},{"class":166,"line":219},[1024],{"type":48,"tag":164,"props":1025,"children":1026},{},[1027],{"type":53,"value":1028},"GRANT schema_manager TO migration_user;\n",{"type":48,"tag":164,"props":1030,"children":1031},{"class":166,"line":228},[1032],{"type":48,"tag":164,"props":1033,"children":1034},{},[1035],{"type":53,"value":1036},"GRANT monitoring TO monitoring_user;\n",{"type":48,"tag":164,"props":1038,"children":1039},{"class":166,"line":237},[1040],{"type":48,"tag":164,"props":1041,"children":1042},{},[1043],{"type":53,"value":1044},"GRANT ops_triage TO oncall_sre;\n",{"type":48,"tag":180,"props":1046,"children":1048},{"id":1047},"_5-revoke-excessive-grants",[1049],{"type":53,"value":1050},"5. Revoke Excessive Grants",{"type":48,"tag":56,"props":1052,"children":1053},{},[1054],{"type":48,"tag":116,"props":1055,"children":1056},{},[1057],{"type":53,"value":1058},"Revoke admin from users who no longer need it:",{"type":48,"tag":152,"props":1060,"children":1062},{"className":154,"code":1061,"language":156,"meta":157,"style":157},"-- Revoke admin from specific users\nREVOKE admin FROM analyst_user;\nREVOKE admin FROM payment_service;\nREVOKE admin FROM monitoring_user;\n",[1063],{"type":48,"tag":160,"props":1064,"children":1065},{"__ignoreMap":157},[1066,1074,1082,1090],{"type":48,"tag":164,"props":1067,"children":1068},{"class":166,"line":167},[1069],{"type":48,"tag":164,"props":1070,"children":1071},{},[1072],{"type":53,"value":1073},"-- Revoke admin from specific users\n",{"type":48,"tag":164,"props":1075,"children":1076},{"class":166,"line":29},[1077],{"type":48,"tag":164,"props":1078,"children":1079},{},[1080],{"type":53,"value":1081},"REVOKE admin FROM analyst_user;\n",{"type":48,"tag":164,"props":1083,"children":1084},{"class":166,"line":25},[1085],{"type":48,"tag":164,"props":1086,"children":1087},{},[1088],{"type":53,"value":1089},"REVOKE admin FROM payment_service;\n",{"type":48,"tag":164,"props":1091,"children":1092},{"class":166,"line":219},[1093],{"type":48,"tag":164,"props":1094,"children":1095},{},[1096],{"type":53,"value":1097},"REVOKE admin FROM monitoring_user;\n",{"type":48,"tag":56,"props":1099,"children":1100},{},[1101],{"type":48,"tag":116,"props":1102,"children":1103},{},[1104],{"type":53,"value":1105},"Revoke PUBLIC role data grants:",{"type":48,"tag":152,"props":1107,"children":1109},{"className":154,"code":1108,"language":156,"meta":157,"style":157},"-- Revoke SELECT from PUBLIC on existing tables, plus the default-privilege grant\nREVOKE SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public FROM public;\nALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public REVOKE SELECT ON TABLES FROM public;\n\n-- Revoke all data privileges from PUBLIC on specific tables\nREVOKE ALL ON TABLE \u003Csensitive_table> FROM public;\n",[1110],{"type":48,"tag":160,"props":1111,"children":1112},{"__ignoreMap":157},[1113,1121,1129,1137,1144,1152],{"type":48,"tag":164,"props":1114,"children":1115},{"class":166,"line":167},[1116],{"type":48,"tag":164,"props":1117,"children":1118},{},[1119],{"type":53,"value":1120},"-- Revoke SELECT from PUBLIC on existing tables, plus the default-privilege grant\n",{"type":48,"tag":164,"props":1122,"children":1123},{"class":166,"line":29},[1124],{"type":48,"tag":164,"props":1125,"children":1126},{},[1127],{"type":53,"value":1128},"REVOKE SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public FROM public;\n",{"type":48,"tag":164,"props":1130,"children":1131},{"class":166,"line":25},[1132],{"type":48,"tag":164,"props":1133,"children":1134},{},[1135],{"type":53,"value":1136},"ALTER DEFAULT PRIVILEGES IN SCHEMA \u003Capp_db>.public REVOKE SELECT ON TABLES FROM public;\n",{"type":48,"tag":164,"props":1138,"children":1139},{"class":166,"line":219},[1140],{"type":48,"tag":164,"props":1141,"children":1142},{"emptyLinePlaceholder":259},[1143],{"type":53,"value":262},{"type":48,"tag":164,"props":1145,"children":1146},{"class":166,"line":228},[1147],{"type":48,"tag":164,"props":1148,"children":1149},{},[1150],{"type":53,"value":1151},"-- Revoke all data privileges from PUBLIC on specific tables\n",{"type":48,"tag":164,"props":1153,"children":1154},{"class":166,"line":237},[1155],{"type":48,"tag":164,"props":1156,"children":1157},{},[1158],{"type":53,"value":1159},"REVOKE ALL ON TABLE \u003Csensitive_table> FROM public;\n",{"type":48,"tag":56,"props":1161,"children":1162},{},[1163],{"type":48,"tag":116,"props":1164,"children":1165},{},[1166],{"type":53,"value":1167},"Revoke unnecessary system privileges:",{"type":48,"tag":152,"props":1169,"children":1171},{"className":154,"code":1170,"language":156,"meta":157,"style":157},"-- Revoke system privileges from users who don't need them\nREVOKE SYSTEM MODIFYCLUSTERSETTING FROM \u003Cusername>;\nREVOKE SYSTEM CREATEDB FROM \u003Cusername>;\n",[1172],{"type":48,"tag":160,"props":1173,"children":1174},{"__ignoreMap":157},[1175,1183,1191],{"type":48,"tag":164,"props":1176,"children":1177},{"class":166,"line":167},[1178],{"type":48,"tag":164,"props":1179,"children":1180},{},[1181],{"type":53,"value":1182},"-- Revoke system privileges from users who don't need them\n",{"type":48,"tag":164,"props":1184,"children":1185},{"class":166,"line":29},[1186],{"type":48,"tag":164,"props":1187,"children":1188},{},[1189],{"type":53,"value":1190},"REVOKE SYSTEM MODIFYCLUSTERSETTING FROM \u003Cusername>;\n",{"type":48,"tag":164,"props":1192,"children":1193},{"class":166,"line":25},[1194],{"type":48,"tag":164,"props":1195,"children":1196},{},[1197],{"type":53,"value":1198},"REVOKE SYSTEM CREATEDB FROM \u003Cusername>;\n",{"type":48,"tag":180,"props":1200,"children":1202},{"id":1201},"_6-verify-changes",[1203],{"type":53,"value":1204},"6. Verify Changes",{"type":48,"tag":152,"props":1206,"children":1208},{"className":154,"code":1207,"language":156,"meta":157,"style":157},"-- Confirm admin count is reduced\nSELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];\n\n-- Confirm PUBLIC privileges are minimal\nSELECT database_name, privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE');\n\n-- Verify specific user's effective privileges\nSHOW GRANTS FOR \u003Cusername>;\n",[1209],{"type":48,"tag":160,"props":1210,"children":1211},{"__ignoreMap":157},[1212,1220,1228,1235,1243,1251,1258,1266,1273,1281],{"type":48,"tag":164,"props":1213,"children":1214},{"class":166,"line":167},[1215],{"type":48,"tag":164,"props":1216,"children":1217},{},[1218],{"type":53,"value":1219},"-- Confirm admin count is reduced\n",{"type":48,"tag":164,"props":1221,"children":1222},{"class":166,"line":29},[1223],{"type":48,"tag":164,"props":1224,"children":1225},{},[1226],{"type":53,"value":1227},"SELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];\n",{"type":48,"tag":164,"props":1229,"children":1230},{"class":166,"line":25},[1231],{"type":48,"tag":164,"props":1232,"children":1233},{"emptyLinePlaceholder":259},[1234],{"type":53,"value":262},{"type":48,"tag":164,"props":1236,"children":1237},{"class":166,"line":219},[1238],{"type":48,"tag":164,"props":1239,"children":1240},{},[1241],{"type":53,"value":1242},"-- Confirm PUBLIC privileges are minimal\n",{"type":48,"tag":164,"props":1244,"children":1245},{"class":166,"line":228},[1246],{"type":48,"tag":164,"props":1247,"children":1248},{},[1249],{"type":53,"value":1250},"SELECT database_name, privilege_type\n",{"type":48,"tag":164,"props":1252,"children":1253},{"class":166,"line":237},[1254],{"type":48,"tag":164,"props":1255,"children":1256},{},[1257],{"type":53,"value":519},{"type":48,"tag":164,"props":1259,"children":1260},{"class":166,"line":246},[1261],{"type":48,"tag":164,"props":1262,"children":1263},{},[1264],{"type":53,"value":1265},"WHERE privilege_type NOT IN ('USAGE');\n",{"type":48,"tag":164,"props":1267,"children":1268},{"class":166,"line":255},[1269],{"type":48,"tag":164,"props":1270,"children":1271},{"emptyLinePlaceholder":259},[1272],{"type":53,"value":262},{"type":48,"tag":164,"props":1274,"children":1275},{"class":166,"line":265},[1276],{"type":48,"tag":164,"props":1277,"children":1278},{},[1279],{"type":53,"value":1280},"-- Verify specific user's effective privileges\n",{"type":48,"tag":164,"props":1282,"children":1283},{"class":166,"line":274},[1284],{"type":48,"tag":164,"props":1285,"children":1286},{},[1287],{"type":53,"value":1288},"SHOW GRANTS FOR \u003Cusername>;\n",{"type":48,"tag":56,"props":1290,"children":1291},{},[1292,1297],{"type":48,"tag":116,"props":1293,"children":1294},{},[1295],{"type":53,"value":1296},"Application testing:",{"type":53,"value":1298}," After revoking grants, verify that all applications still function correctly. Test:",{"type":48,"tag":69,"props":1300,"children":1301},{},[1302,1307,1312,1317],{"type":48,"tag":73,"props":1303,"children":1304},{},[1305],{"type":53,"value":1306},"Read operations (SELECT)",{"type":48,"tag":73,"props":1308,"children":1309},{},[1310],{"type":53,"value":1311},"Write operations (INSERT, UPDATE, DELETE)",{"type":48,"tag":73,"props":1313,"children":1314},{},[1315],{"type":53,"value":1316},"Schema operations (CREATE, ALTER, DROP) — only for schema management accounts",{"type":48,"tag":73,"props":1318,"children":1319},{},[1320],{"type":53,"value":1321},"Connection and authentication",{"type":48,"tag":62,"props":1323,"children":1325},{"id":1324},"safety-considerations",[1326],{"type":53,"value":1327},"Safety Considerations",{"type":48,"tag":56,"props":1329,"children":1330},{},[1331,1336],{"type":48,"tag":116,"props":1332,"children":1333},{},[1334],{"type":53,"value":1335},"Revoking grants can break applications.",{"type":53,"value":1337}," Applications that depend on admin, PUBLIC, or specific grants will fail with permission errors if those grants are revoked.",{"type":48,"tag":56,"props":1339,"children":1340},{},[1341],{"type":48,"tag":116,"props":1342,"children":1343},{},[1344],{"type":53,"value":1345},"Mitigation steps:",{"type":48,"tag":1347,"props":1348,"children":1349},"ol",{},[1350,1360,1370,1380,1390],{"type":48,"tag":73,"props":1351,"children":1352},{},[1353,1358],{"type":48,"tag":116,"props":1354,"children":1355},{},[1356],{"type":53,"value":1357},"Audit before revoking:",{"type":53,"value":1359}," Document which users\u002Fapps depend on which grants",{"type":48,"tag":73,"props":1361,"children":1362},{},[1363,1368],{"type":48,"tag":116,"props":1364,"children":1365},{},[1366],{"type":53,"value":1367},"Create replacement roles first:",{"type":53,"value":1369}," Assign purpose-specific roles before revoking admin",{"type":48,"tag":73,"props":1371,"children":1372},{},[1373,1378],{"type":48,"tag":116,"props":1374,"children":1375},{},[1376],{"type":53,"value":1377},"Test in staging:",{"type":53,"value":1379}," Revoke grants in a staging environment first and test all application flows",{"type":48,"tag":73,"props":1381,"children":1382},{},[1383,1388],{"type":48,"tag":116,"props":1384,"children":1385},{},[1386],{"type":53,"value":1387},"Revoke incrementally:",{"type":53,"value":1389}," Revoke one user\u002Fgrant at a time and test",{"type":48,"tag":73,"props":1391,"children":1392},{},[1393,1398],{"type":48,"tag":116,"props":1394,"children":1395},{},[1396],{"type":53,"value":1397},"Monitor for errors:",{"type":53,"value":1399}," Watch application logs for permission-denied errors after changes",{"type":48,"tag":56,"props":1401,"children":1402},{},[1403],{"type":48,"tag":116,"props":1404,"children":1405},{},[1406],{"type":53,"value":1407},"Do not revoke admin from:",{"type":48,"tag":69,"props":1409,"children":1410},{},[1411,1416,1421],{"type":48,"tag":73,"props":1412,"children":1413},{},[1414],{"type":53,"value":1415},"The last remaining admin user (you'll lose the ability to manage the cluster)",{"type":48,"tag":73,"props":1417,"children":1418},{},[1419],{"type":53,"value":1420},"Automation accounts that manage schema migrations (unless you've created a schema_manager role)",{"type":48,"tag":73,"props":1422,"children":1423},{},[1424,1426,1431],{"type":53,"value":1425},"The ",{"type":48,"tag":160,"props":1427,"children":1429},{"className":1428},[],[1430],{"type":53,"value":45},{"type":53,"value":1432}," user (built-in, cannot be revoked)",{"type":48,"tag":62,"props":1434,"children":1436},{"id":1435},"rollback",[1437],{"type":53,"value":1438},"Rollback",{"type":48,"tag":56,"props":1440,"children":1441},{},[1442],{"type":53,"value":1443},"If an application breaks after revoking a grant:",{"type":48,"tag":152,"props":1445,"children":1447},{"className":154,"code":1446,"language":156,"meta":157,"style":157},"-- Re-grant admin (emergency)\nGRANT admin TO \u003Cusername>;\n\n-- Re-grant specific privileges\nGRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO \u003Cusername>;\n\n-- Re-grant PUBLIC privileges\nGRANT SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO public;\n",[1448],{"type":48,"tag":160,"props":1449,"children":1450},{"__ignoreMap":157},[1451,1459,1467,1474,1482,1490,1497,1505],{"type":48,"tag":164,"props":1452,"children":1453},{"class":166,"line":167},[1454],{"type":48,"tag":164,"props":1455,"children":1456},{},[1457],{"type":53,"value":1458},"-- Re-grant admin (emergency)\n",{"type":48,"tag":164,"props":1460,"children":1461},{"class":166,"line":29},[1462],{"type":48,"tag":164,"props":1463,"children":1464},{},[1465],{"type":53,"value":1466},"GRANT admin TO \u003Cusername>;\n",{"type":48,"tag":164,"props":1468,"children":1469},{"class":166,"line":25},[1470],{"type":48,"tag":164,"props":1471,"children":1472},{"emptyLinePlaceholder":259},[1473],{"type":53,"value":262},{"type":48,"tag":164,"props":1475,"children":1476},{"class":166,"line":219},[1477],{"type":48,"tag":164,"props":1478,"children":1479},{},[1480],{"type":53,"value":1481},"-- Re-grant specific privileges\n",{"type":48,"tag":164,"props":1483,"children":1484},{"class":166,"line":228},[1485],{"type":48,"tag":164,"props":1486,"children":1487},{},[1488],{"type":53,"value":1489},"GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO \u003Cusername>;\n",{"type":48,"tag":164,"props":1491,"children":1492},{"class":166,"line":237},[1493],{"type":48,"tag":164,"props":1494,"children":1495},{"emptyLinePlaceholder":259},[1496],{"type":53,"value":262},{"type":48,"tag":164,"props":1498,"children":1499},{"class":166,"line":246},[1500],{"type":48,"tag":164,"props":1501,"children":1502},{},[1503],{"type":53,"value":1504},"-- Re-grant PUBLIC privileges\n",{"type":48,"tag":164,"props":1506,"children":1507},{"class":166,"line":255},[1508],{"type":48,"tag":164,"props":1509,"children":1510},{},[1511],{"type":53,"value":1512},"GRANT SELECT ON ALL TABLES IN SCHEMA \u003Capp_db>.public TO public;\n",{"type":48,"tag":56,"props":1514,"children":1515},{},[1516,1521],{"type":48,"tag":116,"props":1517,"children":1518},{},[1519],{"type":53,"value":1520},"Best practice:",{"type":53,"value":1522}," Keep a record of all grants before revoking so you can restore them if needed:",{"type":48,"tag":152,"props":1524,"children":1526},{"className":154,"code":1525,"language":156,"meta":157,"style":157},"-- Snapshot current grants before changes\nSELECT * FROM [SHOW GRANTS FOR \u003Cusername>];\nSELECT * FROM [SHOW GRANTS FOR public];\nSELECT * FROM [SHOW SYSTEM GRANTS];\n",[1527],{"type":48,"tag":160,"props":1528,"children":1529},{"__ignoreMap":157},[1530,1538,1546,1554],{"type":48,"tag":164,"props":1531,"children":1532},{"class":166,"line":167},[1533],{"type":48,"tag":164,"props":1534,"children":1535},{},[1536],{"type":53,"value":1537},"-- Snapshot current grants before changes\n",{"type":48,"tag":164,"props":1539,"children":1540},{"class":166,"line":29},[1541],{"type":48,"tag":164,"props":1542,"children":1543},{},[1544],{"type":53,"value":1545},"SELECT * FROM [SHOW GRANTS FOR \u003Cusername>];\n",{"type":48,"tag":164,"props":1547,"children":1548},{"class":166,"line":25},[1549],{"type":48,"tag":164,"props":1550,"children":1551},{},[1552],{"type":53,"value":1553},"SELECT * FROM [SHOW GRANTS FOR public];\n",{"type":48,"tag":164,"props":1555,"children":1556},{"class":166,"line":219},[1557],{"type":48,"tag":164,"props":1558,"children":1559},{},[1560],{"type":53,"value":1561},"SELECT * FROM [SHOW SYSTEM GRANTS];\n",{"type":48,"tag":62,"props":1563,"children":1565},{"id":1564},"references",[1566],{"type":53,"value":1567},"References",{"type":48,"tag":56,"props":1569,"children":1570},{},[1571],{"type":48,"tag":116,"props":1572,"children":1573},{},[1574],{"type":53,"value":1575},"Skill references:",{"type":48,"tag":69,"props":1577,"children":1578},{},[1579],{"type":48,"tag":73,"props":1580,"children":1581},{},[1582],{"type":48,"tag":349,"props":1583,"children":1584},{"href":351},[1585],{"type":53,"value":1586},"SQL queries for privilege hardening",{"type":48,"tag":56,"props":1588,"children":1589},{},[1590],{"type":48,"tag":116,"props":1591,"children":1592},{},[1593],{"type":53,"value":1594},"Related skills:",{"type":48,"tag":69,"props":1596,"children":1597},{},[1598,1609],{"type":48,"tag":73,"props":1599,"children":1600},{},[1601,1607],{"type":48,"tag":349,"props":1602,"children":1604},{"href":1603},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[1605],{"type":53,"value":1606},"auditing-cloud-cluster-security",{"type":53,"value":1608}," — Run a full security posture audit",{"type":48,"tag":73,"props":1610,"children":1611},{},[1612,1618],{"type":48,"tag":349,"props":1613,"children":1615},{"href":1614},"..\u002Fconfiguring-audit-logging\u002FSKILL.md",[1616],{"type":53,"value":1617},"configuring-audit-logging",{"type":53,"value":1619}," — Set up audit logging for privilege-sensitive operations",{"type":48,"tag":56,"props":1621,"children":1622},{},[1623],{"type":48,"tag":116,"props":1624,"children":1625},{},[1626],{"type":53,"value":1627},"Official CockroachDB Documentation:",{"type":48,"tag":69,"props":1629,"children":1630},{},[1631,1642,1652,1662,1672,1682],{"type":48,"tag":73,"props":1632,"children":1633},{},[1634],{"type":48,"tag":349,"props":1635,"children":1639},{"href":1636,"rel":1637},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthorization.html",[1638],"nofollow",[1640],{"type":53,"value":1641},"Authorization Overview",{"type":48,"tag":73,"props":1643,"children":1644},{},[1645],{"type":48,"tag":349,"props":1646,"children":1649},{"href":1647,"rel":1648},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fgrant.html",[1638],[1650],{"type":53,"value":1651},"GRANT",{"type":48,"tag":73,"props":1653,"children":1654},{},[1655],{"type":48,"tag":349,"props":1656,"children":1659},{"href":1657,"rel":1658},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Frevoke.html",[1638],[1660],{"type":53,"value":1661},"REVOKE",{"type":48,"tag":73,"props":1663,"children":1664},{},[1665],{"type":48,"tag":349,"props":1666,"children":1669},{"href":1667,"rel":1668},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fcreate-role.html",[1638],[1670],{"type":53,"value":1671},"CREATE ROLE",{"type":48,"tag":73,"props":1673,"children":1674},{},[1675],{"type":48,"tag":349,"props":1676,"children":1679},{"href":1677,"rel":1678},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fshow-grants.html",[1638],[1680],{"type":53,"value":1681},"SHOW GRANTS",{"type":48,"tag":73,"props":1683,"children":1684},{},[1685],{"type":48,"tag":349,"props":1686,"children":1689},{"href":1687,"rel":1688},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fstable\u002Fsecurity-reference\u002Fauthorization.html#supported-privileges",[1638],[1690],{"type":53,"value":1691},"System Privileges",{"type":48,"tag":1693,"props":1694,"children":1695},"style",{},[1696],{"type":53,"value":1697},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1699,"total":1791},[1700,1714,1728,1743,1755,1768,1781],{"slug":1701,"name":1701,"fn":1702,"description":1703,"org":1704,"tags":1705,"stars":25,"repoUrl":26,"updatedAt":1713},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1706,1707,1710],{"name":17,"slug":18,"type":15},{"name":1708,"slug":1709,"type":15},"Monitoring","monitoring",{"name":1711,"slug":1712,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":1715,"name":1715,"fn":1716,"description":1717,"org":1718,"tags":1719,"stars":25,"repoUrl":26,"updatedAt":1727},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1720,1723,1724,1725],{"name":1721,"slug":1722,"type":15},"Data Modeling","data-modeling",{"name":17,"slug":18,"type":15},{"name":1711,"slug":1712,"type":15},{"name":1726,"slug":156,"type":15},"SQL","2026-07-12T07:57:22.763788",{"slug":1729,"name":1729,"fn":1730,"description":1731,"org":1732,"tags":1733,"stars":25,"repoUrl":26,"updatedAt":1742},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1734,1737,1740,1741],{"name":1735,"slug":1736,"type":15},"Audit","audit",{"name":1738,"slug":1739,"type":15},"Compliance","compliance",{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},"2026-07-18T05:48:00.862384",{"slug":1606,"name":1606,"fn":1744,"description":1745,"org":1746,"tags":1747,"stars":25,"repoUrl":26,"updatedAt":1754},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1748,1749,1750,1753],{"name":1735,"slug":1736,"type":15},{"name":17,"slug":18,"type":15},{"name":1751,"slug":1752,"type":15},"Operations","operations",{"name":13,"slug":14,"type":15},"2026-07-12T07:57:01.506735",{"slug":1756,"name":1756,"fn":1757,"description":1758,"org":1759,"tags":1760,"stars":25,"repoUrl":26,"updatedAt":1767},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1761,1762,1765,1766],{"name":1735,"slug":1736,"type":15},{"name":1763,"slug":1764,"type":15},"Data Analysis","data-analysis",{"name":17,"slug":18,"type":15},{"name":1711,"slug":1712,"type":15},"2026-07-12T07:57:16.190081",{"slug":1769,"name":1769,"fn":1770,"description":1771,"org":1772,"tags":1773,"stars":25,"repoUrl":26,"updatedAt":1780},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1774,1775,1778,1779],{"name":17,"slug":18,"type":15},{"name":1776,"slug":1777,"type":15},"Engineering","engineering",{"name":1711,"slug":1712,"type":15},{"name":1726,"slug":156,"type":15},"2026-07-12T07:57:26.543278",{"slug":1782,"name":1782,"fn":1783,"description":1784,"org":1785,"tags":1786,"stars":25,"repoUrl":26,"updatedAt":1790},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1787,1788,1789],{"name":17,"slug":18,"type":15},{"name":1711,"slug":1712,"type":15},{"name":1726,"slug":156,"type":15},"2026-07-25T05:31:22.562808",34,{"items":1793,"total":1913},[1794,1811,1825,1840,1851,1861,1872,1878,1885,1892,1899,1906],{"slug":1795,"name":1795,"fn":1796,"description":1797,"org":1798,"tags":1799,"stars":1808,"repoUrl":1809,"updatedAt":1810},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1800,1801,1804,1807],{"name":17,"slug":18,"type":15},{"name":1802,"slug":1803,"type":15},"Incident Response","incident-response",{"name":1805,"slug":1806,"type":15},"Kubernetes","kubernetes",{"name":1708,"slug":1709,"type":15},105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":1812,"name":1812,"fn":1813,"description":1814,"org":1815,"tags":1816,"stars":1808,"repoUrl":1809,"updatedAt":1824},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1817,1820,1823],{"name":1818,"slug":1819,"type":15},"Deployment","deployment",{"name":1821,"slug":1822,"type":15},"Encryption","encryption",{"name":13,"slug":14,"type":15},"2026-07-12T07:56:37.675396",{"slug":1826,"name":1826,"fn":1827,"description":1828,"org":1829,"tags":1830,"stars":1808,"repoUrl":1809,"updatedAt":1839},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1831,1832,1835,1836],{"name":17,"slug":18,"type":15},{"name":1833,"slug":1834,"type":15},"Debugging","debugging",{"name":1805,"slug":1806,"type":15},{"name":1837,"slug":1838,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":1841,"name":1841,"fn":1842,"description":1843,"org":1844,"tags":1845,"stars":1808,"repoUrl":1809,"updatedAt":1850},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1846,1847,1848,1849],{"name":17,"slug":18,"type":15},{"name":1833,"slug":1834,"type":15},{"name":1818,"slug":1819,"type":15},{"name":1805,"slug":1806,"type":15},"2026-07-12T07:57:24.018818",{"slug":1852,"name":1852,"fn":1853,"description":1854,"org":1855,"tags":1856,"stars":1808,"repoUrl":1809,"updatedAt":1860},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1857,1858,1859],{"name":17,"slug":18,"type":15},{"name":1818,"slug":1819,"type":15},{"name":1805,"slug":1806,"type":15},"2026-07-12T07:56:45.777567",{"slug":1862,"name":1862,"fn":1863,"description":1864,"org":1865,"tags":1866,"stars":1808,"repoUrl":1809,"updatedAt":1871},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1867,1868,1869,1870],{"name":17,"slug":18,"type":15},{"name":1818,"slug":1819,"type":15},{"name":1805,"slug":1806,"type":15},{"name":1751,"slug":1752,"type":15},"2026-07-12T07:56:47.082609",{"slug":1701,"name":1701,"fn":1702,"description":1703,"org":1873,"tags":1874,"stars":25,"repoUrl":26,"updatedAt":1713},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1875,1876,1877],{"name":17,"slug":18,"type":15},{"name":1708,"slug":1709,"type":15},{"name":1711,"slug":1712,"type":15},{"slug":1715,"name":1715,"fn":1716,"description":1717,"org":1879,"tags":1880,"stars":25,"repoUrl":26,"updatedAt":1727},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1881,1882,1883,1884],{"name":1721,"slug":1722,"type":15},{"name":17,"slug":18,"type":15},{"name":1711,"slug":1712,"type":15},{"name":1726,"slug":156,"type":15},{"slug":1729,"name":1729,"fn":1730,"description":1731,"org":1886,"tags":1887,"stars":25,"repoUrl":26,"updatedAt":1742},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1888,1889,1890,1891],{"name":1735,"slug":1736,"type":15},{"name":1738,"slug":1739,"type":15},{"name":17,"slug":18,"type":15},{"name":13,"slug":14,"type":15},{"slug":1606,"name":1606,"fn":1744,"description":1745,"org":1893,"tags":1894,"stars":25,"repoUrl":26,"updatedAt":1754},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1895,1896,1897,1898],{"name":1735,"slug":1736,"type":15},{"name":17,"slug":18,"type":15},{"name":1751,"slug":1752,"type":15},{"name":13,"slug":14,"type":15},{"slug":1756,"name":1756,"fn":1757,"description":1758,"org":1900,"tags":1901,"stars":25,"repoUrl":26,"updatedAt":1767},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1902,1903,1904,1905],{"name":1735,"slug":1736,"type":15},{"name":1763,"slug":1764,"type":15},{"name":17,"slug":18,"type":15},{"name":1711,"slug":1712,"type":15},{"slug":1769,"name":1769,"fn":1770,"description":1771,"org":1907,"tags":1908,"stars":25,"repoUrl":26,"updatedAt":1780},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1909,1910,1911,1912],{"name":17,"slug":18,"type":15},{"name":1776,"slug":1777,"type":15},{"name":1711,"slug":1712,"type":15},{"name":1726,"slug":156,"type":15},40]