[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-cockroachdb-preparing-compliance-documentation":3,"mdc--spzsbs-key":39,"related-repo-cockroachdb-preparing-compliance-documentation":1835,"related-org-cockroachdb-preparing-compliance-documentation":1931},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":34,"sourceUrl":37,"mdContent":38},"preparing-compliance-documentation","prepare compliance documentation for CockroachDB","Guides preparation of compliance documentation for CockroachDB Cloud deployments, covering SOC 2, PCI DSS, ISO 27001, HIPAA, and GDPR certifications. Use when responding to compliance questionnaires, preparing for audits, locating certification documents, or assessing cluster configuration for compliance readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"cockroachdb","CockroachDB","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fcockroachdb.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"GDPR","gdpr","tag",{"name":17,"slug":18,"type":15},"Compliance","compliance",{"name":20,"slug":21,"type":15},"SOC 2","soc-2",{"name":23,"slug":24,"type":15},"Documentation","documentation",3,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin","2026-07-12T07:57:04.109713",null,2,[31,32,8,33],"claude","cockroach-cloud","developer-tools",{"repoUrl":26,"stars":25,"forks":29,"topics":35,"description":36},[31,32,8,33],"CockroachDB development plugin for Claude","https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fclaude-plugin\u002Ftree\u002FHEAD\u002Fskills\u002Fcockroachdb-security-and-governance\u002Fpreparing-compliance-documentation","---\nname: preparing-compliance-documentation\ndescription: Guides preparation of compliance documentation for CockroachDB Cloud deployments, covering SOC 2, PCI DSS, ISO 27001, HIPAA, and GDPR certifications. Use when responding to compliance questionnaires, preparing for audits, locating certification documents, or assessing cluster configuration for compliance readiness.\ncompatibility: Applicable to all CockroachDB Cloud plans. Some compliance features require Advanced plan with security add-ons.\nmetadata:\n  author: cockroachdb\n  version: \"1.0\"\n---\n\n# Preparing Compliance Documentation\n\nGuides the preparation of compliance documentation for CockroachDB Cloud deployments by identifying available certifications, mapping security features to compliance controls, and providing a configuration checklist for compliance readiness. Covers SOC 2 Type II, PCI DSS, ISO 27001, HIPAA, and GDPR.\n\n## When to Use This Skill\n\n- Responding to customer security questionnaires about CockroachDB Cloud\n- Preparing for SOC 2, PCI DSS, or HIPAA compliance audits\n- Locating CockroachDB Cloud certification documents (SOC 2 reports, PCI AOC, ISO certificates)\n- Assessing whether a cluster's configuration meets a specific compliance framework\n- Understanding which compliance features are available on each CockroachDB Cloud plan\n\n## Prerequisites\n\n- **CockroachDB Cloud account** — Any plan\n- **Cloud Console access** — For downloading compliance documents\n- **Understanding of your compliance requirements** — Which frameworks apply to your organization\n\n## Steps\n\n### 1. Identify Available Certifications\n\nCockroachDB Cloud maintains the following certifications and attestations:\n\n| Certification | Type | Scope | Where to Find |\n|--------------|------|-------|---------------|\n| SOC 2 Type II | Attestation report | Cloud infrastructure and operations | Trust Center or request via support |\n| PCI DSS | Certificate of Compliance (AOC) | Payment data processing | Trust Center or request via support |\n| ISO 27001 | Certification | Information security management | Trust Center or request via support |\n| HIPAA | BAA eligibility | Protected health information | Contact sales for BAA execution |\n| GDPR | Compliance | EU personal data protection | DPA available on request |\n\n**CockroachDB Cloud Trust Center:** The Trust Center is the primary location for downloading compliance documents. Access it via the Cloud Console or request documents through a support ticket.\n\n### 2. Map Compliance Controls to CockroachDB Features\n\nSee [compliance matrix reference](references\u002Fcompliance-matrix.md) for a detailed mapping of compliance controls to CockroachDB features.\n\n#### SOC 2 — Key Controls\n\n| Control Area | CockroachDB Feature | Configuration Required |\n|-------------|---------------------|----------------------|\n| Access Control | RBAC, SSO, SCIM | Configure roles, enable SSO |\n| Encryption | TLS (always on), CMEK | Enable CMEK on Advanced plan |\n| Audit Logging | SQL audit logging, log export | Enable audit logging + log export |\n| Network Security | IP allowlists, private endpoints | Configure network restrictions |\n| Availability | Multi-region, managed backups | Built-in on all plans |\n| Change Management | Cluster versioning, Terraform | Use IaC for cluster management |\n\n#### PCI DSS — Key Requirements\n\n| Requirement | CockroachDB Feature | Notes |\n|------------|---------------------|-------|\n| Req 1: Network Security | IP allowlists, private endpoints | Restrict access to cardholder data environment |\n| Req 3: Protect Stored Data | Encryption at rest (default), CMEK | CMEK provides key control |\n| Req 4: Encrypt Transmission | TLS (always on) | Enforced by default |\n| Req 7: Restrict Access | RBAC, least privilege | Use hardening-user-privileges skill |\n| Req 8: Identify Users | SQL users, SSO, MFA | Enable SSO with MFA at IdP |\n| Req 10: Track Access | Audit logging, log export | Enable and export audit logs |\n\n#### HIPAA — Key Safeguards\n\n| Safeguard | CockroachDB Feature | Notes |\n|-----------|---------------------|-------|\n| Access Control | RBAC, SSO | Implement least privilege |\n| Audit Controls | Audit logging, log export | Export to SIEM |\n| Integrity | Checksums, replication | Built-in data integrity |\n| Transmission Security | TLS (always on) | Enforced by default |\n| Encryption | Encryption at rest, CMEK | CMEK for key control |\n\n**HIPAA requirement:** A Business Associate Agreement (BAA) must be executed with Cockroach Labs before storing PHI. Contact your account team to execute a BAA.\n\n### 3. Assess Cluster Configuration for Compliance\n\nUse this checklist to evaluate whether a cluster meets common compliance requirements:\n\n#### Baseline (All Frameworks)\n\n```sql\n-- Check password policy\nSHOW CLUSTER SETTING server.user_login.min_password_length;\n-- Should be >= 12\n\n-- Check admin user count\nSELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];\n-- Should be minimized (1-3)\n\n-- Check audit logging\nSHOW CLUSTER SETTING sql.log.admin_audit.enabled;\nSHOW CLUSTER SETTING sql.log.user_audit;\n-- Should be enabled\n\n-- Check PUBLIC role privileges\nSELECT database_name, privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE')\n  AND schema_name = 'public';\n-- Should return no rows for application databases\n```\n\n```bash\n# Check network security\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n# Should NOT contain 0.0.0.0\u002F0\n\n# Check SSO configuration (Cloud Console)\n# Verify in Cloud Console > Organization Settings > Authentication\n\n# Check CMEK (Advanced plan)\nccloud cluster info \u003Ccluster-name> -o json\n# Check for cmek_config\n\n# Check log export (Advanced plan)\n# Look for log_export_config in cluster info output\n```\n\n#### Advanced Compliance (SOC 2 + PCI DSS + HIPAA)\n\n| Check | Command\u002FLocation | Expected State |\n|-------|------------------|----------------|\n| SSO enabled | Cloud Console | Enabled and enforced |\n| SCIM provisioning | Cloud Console | Enabled |\n| CMEK enabled | `ccloud cluster info` | Enabled with valid key |\n| Audit logging | SQL: `SHOW CLUSTER SETTING sql.log.admin_audit.enabled` | `true` |\n| Log export | `ccloud cluster info` | Configured and ENABLED |\n| IP allowlist | `ccloud cluster networking allowlist list` | No 0.0.0.0\u002F0 |\n| Private endpoints | Cloud Console: Networking > Private endpoint | Configured (recommended) |\n| Password policy | SQL: min_password_length | >= 12 |\n| Admin count | SQL: admin role grants | \u003C= 3 |\n| PUBLIC privileges | SQL: SHOW GRANTS FOR public | Minimal |\n\n### 4. Respond to Security Questionnaires\n\nWhen responding to customer or auditor questionnaires, reference these standard answers:\n\n**Encryption at rest:**\n- CockroachDB Cloud encrypts all data at rest using AES-256\n- CMEK is available on Advanced plan with Advanced Security Add-on for customer-controlled keys\n- Key management follows cloud provider best practices (AWS KMS, GCP Cloud KMS, Azure Key Vault)\n\n**Encryption in transit:**\n- TLS 1.2+ is enforced on all connections — cannot be disabled\n- Client certificate authentication (mTLS) is supported\n\n**Data residency:**\n- Clusters can be deployed in specific regions to meet data residency requirements\n- Multi-region clusters keep data within specified regions\n\n**Backup and recovery:**\n- Managed backups are automatic on all plans\n- RPO and RTO depend on plan type and configuration\n- Backups are encrypted and stored in the same cloud provider\n\n**Incident response:**\n- Cockroach Labs maintains a documented incident response plan\n- Details are available in the SOC 2 Type II report\n\n### 5. Prepare for Compliance Audits\n\n**Before the audit:**\n1. Run the [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) skill to identify gaps\n2. Remediate any FAIL findings using the linked remediation skills\n3. Download current compliance documents from the Trust Center\n4. Document your CockroachDB Cloud configuration with screenshots or Terraform state\n\n**During the audit:**\n1. Provide the SOC 2 Type II report to demonstrate CockroachDB Cloud's controls\n2. Show your cluster configuration (security audit report) to demonstrate your controls\n3. Demonstrate audit log export and review capability\n4. Show RBAC configuration and access control policies\n\n**Compliance documents to have ready:**\n- SOC 2 Type II report (from Trust Center)\n- PCI AOC (if processing payment data)\n- ISO 27001 certificate (if required)\n- BAA (if storing PHI — executed with Cockroach Labs)\n- DPA (if processing EU personal data)\n- Your security audit report (from auditing-cloud-cluster-security skill)\n\n## Safety Considerations\n\n- **This skill is read-only.** No cluster configuration is modified.\n- **Compliance documents may be confidential.** Handle SOC 2 reports and PCI AOCs according to your organization's information classification policy.\n- **Compliance is shared responsibility.** CockroachDB Cloud provides the platform controls; your organization is responsible for configuring and using them correctly.\n\n## References\n\n**Skill references:**\n- [Compliance control matrix](references\u002Fcompliance-matrix.md)\n\n**Related skills:**\n- [auditing-cloud-cluster-security](..\u002Fauditing-cloud-cluster-security\u002FSKILL.md) — Automated security posture assessment\n- [configuring-audit-logging](..\u002Fconfiguring-audit-logging\u002FSKILL.md) — Enable audit logging for compliance\n- [enabling-cmek-encryption](..\u002Fenabling-cmek-encryption\u002FSKILL.md) — Enable customer-managed encryption keys\n- [configuring-sso-and-scim](..\u002Fconfiguring-sso-and-scim\u002FSKILL.md) — Enable SSO and automated provisioning\n- [hardening-user-privileges](..\u002Fhardening-user-privileges\u002FSKILL.md) — Implement least-privilege access\n- [enforcing-password-policies](..\u002Fenforcing-password-policies\u002FSKILL.md) — Configure password requirements\n- [configuring-ip-allowlists](..\u002Fconfiguring-ip-allowlists\u002FSKILL.md) — Network access control\n- [configuring-private-connectivity](..\u002Fconfiguring-private-connectivity\u002FSKILL.md) — Private network endpoints\n- [configuring-log-export](..\u002Fconfiguring-log-export\u002FSKILL.md) — Export logs for compliance retention\n\n**Official CockroachDB Documentation:**\n- [CockroachDB Cloud Security Overview](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fsecurity-overview.html)\n- [Compliance](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcompliance.html)\n- [SOC 2 Compliance](https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcompliance)\n",{"data":40,"body":44},{"name":4,"description":6,"compatibility":41,"metadata":42},"Applicable to all CockroachDB Cloud plans. Some compliance features require Advanced plan with security add-ons.",{"author":8,"version":43},"1.0",{"type":45,"children":46},"root",[47,55,61,68,98,104,138,144,151,156,304,314,320,334,341,476,482,615,621,731,741,747,752,758,940,1139,1145,1372,1378,1383,1391,1409,1417,1430,1438,1451,1459,1477,1485,1498,1504,1512,1544,1552,1575,1583,1616,1622,1655,1661,1669,1680,1688,1788,1796,1829],{"type":48,"tag":49,"props":50,"children":51},"element","h1",{"id":4},[52],{"type":53,"value":54},"text","Preparing Compliance Documentation",{"type":48,"tag":56,"props":57,"children":58},"p",{},[59],{"type":53,"value":60},"Guides the preparation of compliance documentation for CockroachDB Cloud deployments by identifying available certifications, mapping security features to compliance controls, and providing a configuration checklist for compliance readiness. Covers SOC 2 Type II, PCI DSS, ISO 27001, HIPAA, and GDPR.",{"type":48,"tag":62,"props":63,"children":65},"h2",{"id":64},"when-to-use-this-skill",[66],{"type":53,"value":67},"When to Use This Skill",{"type":48,"tag":69,"props":70,"children":71},"ul",{},[72,78,83,88,93],{"type":48,"tag":73,"props":74,"children":75},"li",{},[76],{"type":53,"value":77},"Responding to customer security questionnaires about CockroachDB Cloud",{"type":48,"tag":73,"props":79,"children":80},{},[81],{"type":53,"value":82},"Preparing for SOC 2, PCI DSS, or HIPAA compliance audits",{"type":48,"tag":73,"props":84,"children":85},{},[86],{"type":53,"value":87},"Locating CockroachDB Cloud certification documents (SOC 2 reports, PCI AOC, ISO certificates)",{"type":48,"tag":73,"props":89,"children":90},{},[91],{"type":53,"value":92},"Assessing whether a cluster's configuration meets a specific compliance framework",{"type":48,"tag":73,"props":94,"children":95},{},[96],{"type":53,"value":97},"Understanding which compliance features are available on each CockroachDB Cloud plan",{"type":48,"tag":62,"props":99,"children":101},{"id":100},"prerequisites",[102],{"type":53,"value":103},"Prerequisites",{"type":48,"tag":69,"props":105,"children":106},{},[107,118,128],{"type":48,"tag":73,"props":108,"children":109},{},[110,116],{"type":48,"tag":111,"props":112,"children":113},"strong",{},[114],{"type":53,"value":115},"CockroachDB Cloud account",{"type":53,"value":117}," — Any plan",{"type":48,"tag":73,"props":119,"children":120},{},[121,126],{"type":48,"tag":111,"props":122,"children":123},{},[124],{"type":53,"value":125},"Cloud Console access",{"type":53,"value":127}," — For downloading compliance documents",{"type":48,"tag":73,"props":129,"children":130},{},[131,136],{"type":48,"tag":111,"props":132,"children":133},{},[134],{"type":53,"value":135},"Understanding of your compliance requirements",{"type":53,"value":137}," — Which frameworks apply to your organization",{"type":48,"tag":62,"props":139,"children":141},{"id":140},"steps",[142],{"type":53,"value":143},"Steps",{"type":48,"tag":145,"props":146,"children":148},"h3",{"id":147},"_1-identify-available-certifications",[149],{"type":53,"value":150},"1. Identify Available Certifications",{"type":48,"tag":56,"props":152,"children":153},{},[154],{"type":53,"value":155},"CockroachDB Cloud maintains the following certifications and attestations:",{"type":48,"tag":157,"props":158,"children":159},"table",{},[160,189],{"type":48,"tag":161,"props":162,"children":163},"thead",{},[164],{"type":48,"tag":165,"props":166,"children":167},"tr",{},[168,174,179,184],{"type":48,"tag":169,"props":170,"children":171},"th",{},[172],{"type":53,"value":173},"Certification",{"type":48,"tag":169,"props":175,"children":176},{},[177],{"type":53,"value":178},"Type",{"type":48,"tag":169,"props":180,"children":181},{},[182],{"type":53,"value":183},"Scope",{"type":48,"tag":169,"props":185,"children":186},{},[187],{"type":53,"value":188},"Where to Find",{"type":48,"tag":190,"props":191,"children":192},"tbody",{},[193,217,239,260,283],{"type":48,"tag":165,"props":194,"children":195},{},[196,202,207,212],{"type":48,"tag":197,"props":198,"children":199},"td",{},[200],{"type":53,"value":201},"SOC 2 Type II",{"type":48,"tag":197,"props":203,"children":204},{},[205],{"type":53,"value":206},"Attestation report",{"type":48,"tag":197,"props":208,"children":209},{},[210],{"type":53,"value":211},"Cloud infrastructure and operations",{"type":48,"tag":197,"props":213,"children":214},{},[215],{"type":53,"value":216},"Trust Center or request via support",{"type":48,"tag":165,"props":218,"children":219},{},[220,225,230,235],{"type":48,"tag":197,"props":221,"children":222},{},[223],{"type":53,"value":224},"PCI DSS",{"type":48,"tag":197,"props":226,"children":227},{},[228],{"type":53,"value":229},"Certificate of Compliance (AOC)",{"type":48,"tag":197,"props":231,"children":232},{},[233],{"type":53,"value":234},"Payment data processing",{"type":48,"tag":197,"props":236,"children":237},{},[238],{"type":53,"value":216},{"type":48,"tag":165,"props":240,"children":241},{},[242,247,251,256],{"type":48,"tag":197,"props":243,"children":244},{},[245],{"type":53,"value":246},"ISO 27001",{"type":48,"tag":197,"props":248,"children":249},{},[250],{"type":53,"value":173},{"type":48,"tag":197,"props":252,"children":253},{},[254],{"type":53,"value":255},"Information security management",{"type":48,"tag":197,"props":257,"children":258},{},[259],{"type":53,"value":216},{"type":48,"tag":165,"props":261,"children":262},{},[263,268,273,278],{"type":48,"tag":197,"props":264,"children":265},{},[266],{"type":53,"value":267},"HIPAA",{"type":48,"tag":197,"props":269,"children":270},{},[271],{"type":53,"value":272},"BAA eligibility",{"type":48,"tag":197,"props":274,"children":275},{},[276],{"type":53,"value":277},"Protected health information",{"type":48,"tag":197,"props":279,"children":280},{},[281],{"type":53,"value":282},"Contact sales for BAA execution",{"type":48,"tag":165,"props":284,"children":285},{},[286,290,294,299],{"type":48,"tag":197,"props":287,"children":288},{},[289],{"type":53,"value":13},{"type":48,"tag":197,"props":291,"children":292},{},[293],{"type":53,"value":17},{"type":48,"tag":197,"props":295,"children":296},{},[297],{"type":53,"value":298},"EU personal data protection",{"type":48,"tag":197,"props":300,"children":301},{},[302],{"type":53,"value":303},"DPA available on request",{"type":48,"tag":56,"props":305,"children":306},{},[307,312],{"type":48,"tag":111,"props":308,"children":309},{},[310],{"type":53,"value":311},"CockroachDB Cloud Trust Center:",{"type":53,"value":313}," The Trust Center is the primary location for downloading compliance documents. Access it via the Cloud Console or request documents through a support ticket.",{"type":48,"tag":145,"props":315,"children":317},{"id":316},"_2-map-compliance-controls-to-cockroachdb-features",[318],{"type":53,"value":319},"2. Map Compliance Controls to CockroachDB Features",{"type":48,"tag":56,"props":321,"children":322},{},[323,325,332],{"type":53,"value":324},"See ",{"type":48,"tag":326,"props":327,"children":329},"a",{"href":328},"references\u002Fcompliance-matrix.md",[330],{"type":53,"value":331},"compliance matrix reference",{"type":53,"value":333}," for a detailed mapping of compliance controls to CockroachDB features.",{"type":48,"tag":335,"props":336,"children":338},"h4",{"id":337},"soc-2-key-controls",[339],{"type":53,"value":340},"SOC 2 — Key Controls",{"type":48,"tag":157,"props":342,"children":343},{},[344,365],{"type":48,"tag":161,"props":345,"children":346},{},[347],{"type":48,"tag":165,"props":348,"children":349},{},[350,355,360],{"type":48,"tag":169,"props":351,"children":352},{},[353],{"type":53,"value":354},"Control Area",{"type":48,"tag":169,"props":356,"children":357},{},[358],{"type":53,"value":359},"CockroachDB Feature",{"type":48,"tag":169,"props":361,"children":362},{},[363],{"type":53,"value":364},"Configuration Required",{"type":48,"tag":190,"props":366,"children":367},{},[368,386,404,422,440,458],{"type":48,"tag":165,"props":369,"children":370},{},[371,376,381],{"type":48,"tag":197,"props":372,"children":373},{},[374],{"type":53,"value":375},"Access Control",{"type":48,"tag":197,"props":377,"children":378},{},[379],{"type":53,"value":380},"RBAC, SSO, SCIM",{"type":48,"tag":197,"props":382,"children":383},{},[384],{"type":53,"value":385},"Configure roles, enable SSO",{"type":48,"tag":165,"props":387,"children":388},{},[389,394,399],{"type":48,"tag":197,"props":390,"children":391},{},[392],{"type":53,"value":393},"Encryption",{"type":48,"tag":197,"props":395,"children":396},{},[397],{"type":53,"value":398},"TLS (always on), CMEK",{"type":48,"tag":197,"props":400,"children":401},{},[402],{"type":53,"value":403},"Enable CMEK on Advanced plan",{"type":48,"tag":165,"props":405,"children":406},{},[407,412,417],{"type":48,"tag":197,"props":408,"children":409},{},[410],{"type":53,"value":411},"Audit Logging",{"type":48,"tag":197,"props":413,"children":414},{},[415],{"type":53,"value":416},"SQL audit logging, log export",{"type":48,"tag":197,"props":418,"children":419},{},[420],{"type":53,"value":421},"Enable audit logging + log export",{"type":48,"tag":165,"props":423,"children":424},{},[425,430,435],{"type":48,"tag":197,"props":426,"children":427},{},[428],{"type":53,"value":429},"Network Security",{"type":48,"tag":197,"props":431,"children":432},{},[433],{"type":53,"value":434},"IP allowlists, private endpoints",{"type":48,"tag":197,"props":436,"children":437},{},[438],{"type":53,"value":439},"Configure network restrictions",{"type":48,"tag":165,"props":441,"children":442},{},[443,448,453],{"type":48,"tag":197,"props":444,"children":445},{},[446],{"type":53,"value":447},"Availability",{"type":48,"tag":197,"props":449,"children":450},{},[451],{"type":53,"value":452},"Multi-region, managed backups",{"type":48,"tag":197,"props":454,"children":455},{},[456],{"type":53,"value":457},"Built-in on all plans",{"type":48,"tag":165,"props":459,"children":460},{},[461,466,471],{"type":48,"tag":197,"props":462,"children":463},{},[464],{"type":53,"value":465},"Change Management",{"type":48,"tag":197,"props":467,"children":468},{},[469],{"type":53,"value":470},"Cluster versioning, Terraform",{"type":48,"tag":197,"props":472,"children":473},{},[474],{"type":53,"value":475},"Use IaC for cluster management",{"type":48,"tag":335,"props":477,"children":479},{"id":478},"pci-dss-key-requirements",[480],{"type":53,"value":481},"PCI DSS — Key Requirements",{"type":48,"tag":157,"props":483,"children":484},{},[485,505],{"type":48,"tag":161,"props":486,"children":487},{},[488],{"type":48,"tag":165,"props":489,"children":490},{},[491,496,500],{"type":48,"tag":169,"props":492,"children":493},{},[494],{"type":53,"value":495},"Requirement",{"type":48,"tag":169,"props":497,"children":498},{},[499],{"type":53,"value":359},{"type":48,"tag":169,"props":501,"children":502},{},[503],{"type":53,"value":504},"Notes",{"type":48,"tag":190,"props":506,"children":507},{},[508,525,543,561,579,597],{"type":48,"tag":165,"props":509,"children":510},{},[511,516,520],{"type":48,"tag":197,"props":512,"children":513},{},[514],{"type":53,"value":515},"Req 1: Network Security",{"type":48,"tag":197,"props":517,"children":518},{},[519],{"type":53,"value":434},{"type":48,"tag":197,"props":521,"children":522},{},[523],{"type":53,"value":524},"Restrict access to cardholder data environment",{"type":48,"tag":165,"props":526,"children":527},{},[528,533,538],{"type":48,"tag":197,"props":529,"children":530},{},[531],{"type":53,"value":532},"Req 3: Protect Stored Data",{"type":48,"tag":197,"props":534,"children":535},{},[536],{"type":53,"value":537},"Encryption at rest (default), CMEK",{"type":48,"tag":197,"props":539,"children":540},{},[541],{"type":53,"value":542},"CMEK provides key control",{"type":48,"tag":165,"props":544,"children":545},{},[546,551,556],{"type":48,"tag":197,"props":547,"children":548},{},[549],{"type":53,"value":550},"Req 4: Encrypt Transmission",{"type":48,"tag":197,"props":552,"children":553},{},[554],{"type":53,"value":555},"TLS (always on)",{"type":48,"tag":197,"props":557,"children":558},{},[559],{"type":53,"value":560},"Enforced by default",{"type":48,"tag":165,"props":562,"children":563},{},[564,569,574],{"type":48,"tag":197,"props":565,"children":566},{},[567],{"type":53,"value":568},"Req 7: Restrict Access",{"type":48,"tag":197,"props":570,"children":571},{},[572],{"type":53,"value":573},"RBAC, least privilege",{"type":48,"tag":197,"props":575,"children":576},{},[577],{"type":53,"value":578},"Use hardening-user-privileges skill",{"type":48,"tag":165,"props":580,"children":581},{},[582,587,592],{"type":48,"tag":197,"props":583,"children":584},{},[585],{"type":53,"value":586},"Req 8: Identify Users",{"type":48,"tag":197,"props":588,"children":589},{},[590],{"type":53,"value":591},"SQL users, SSO, MFA",{"type":48,"tag":197,"props":593,"children":594},{},[595],{"type":53,"value":596},"Enable SSO with MFA at IdP",{"type":48,"tag":165,"props":598,"children":599},{},[600,605,610],{"type":48,"tag":197,"props":601,"children":602},{},[603],{"type":53,"value":604},"Req 10: Track Access",{"type":48,"tag":197,"props":606,"children":607},{},[608],{"type":53,"value":609},"Audit logging, log export",{"type":48,"tag":197,"props":611,"children":612},{},[613],{"type":53,"value":614},"Enable and export audit logs",{"type":48,"tag":335,"props":616,"children":618},{"id":617},"hipaa-key-safeguards",[619],{"type":53,"value":620},"HIPAA — Key Safeguards",{"type":48,"tag":157,"props":622,"children":623},{},[624,643],{"type":48,"tag":161,"props":625,"children":626},{},[627],{"type":48,"tag":165,"props":628,"children":629},{},[630,635,639],{"type":48,"tag":169,"props":631,"children":632},{},[633],{"type":53,"value":634},"Safeguard",{"type":48,"tag":169,"props":636,"children":637},{},[638],{"type":53,"value":359},{"type":48,"tag":169,"props":640,"children":641},{},[642],{"type":53,"value":504},{"type":48,"tag":190,"props":644,"children":645},{},[646,663,680,698,714],{"type":48,"tag":165,"props":647,"children":648},{},[649,653,658],{"type":48,"tag":197,"props":650,"children":651},{},[652],{"type":53,"value":375},{"type":48,"tag":197,"props":654,"children":655},{},[656],{"type":53,"value":657},"RBAC, SSO",{"type":48,"tag":197,"props":659,"children":660},{},[661],{"type":53,"value":662},"Implement least privilege",{"type":48,"tag":165,"props":664,"children":665},{},[666,671,675],{"type":48,"tag":197,"props":667,"children":668},{},[669],{"type":53,"value":670},"Audit Controls",{"type":48,"tag":197,"props":672,"children":673},{},[674],{"type":53,"value":609},{"type":48,"tag":197,"props":676,"children":677},{},[678],{"type":53,"value":679},"Export to SIEM",{"type":48,"tag":165,"props":681,"children":682},{},[683,688,693],{"type":48,"tag":197,"props":684,"children":685},{},[686],{"type":53,"value":687},"Integrity",{"type":48,"tag":197,"props":689,"children":690},{},[691],{"type":53,"value":692},"Checksums, replication",{"type":48,"tag":197,"props":694,"children":695},{},[696],{"type":53,"value":697},"Built-in data integrity",{"type":48,"tag":165,"props":699,"children":700},{},[701,706,710],{"type":48,"tag":197,"props":702,"children":703},{},[704],{"type":53,"value":705},"Transmission Security",{"type":48,"tag":197,"props":707,"children":708},{},[709],{"type":53,"value":555},{"type":48,"tag":197,"props":711,"children":712},{},[713],{"type":53,"value":560},{"type":48,"tag":165,"props":715,"children":716},{},[717,721,726],{"type":48,"tag":197,"props":718,"children":719},{},[720],{"type":53,"value":393},{"type":48,"tag":197,"props":722,"children":723},{},[724],{"type":53,"value":725},"Encryption at rest, CMEK",{"type":48,"tag":197,"props":727,"children":728},{},[729],{"type":53,"value":730},"CMEK for key control",{"type":48,"tag":56,"props":732,"children":733},{},[734,739],{"type":48,"tag":111,"props":735,"children":736},{},[737],{"type":53,"value":738},"HIPAA requirement:",{"type":53,"value":740}," A Business Associate Agreement (BAA) must be executed with Cockroach Labs before storing PHI. Contact your account team to execute a BAA.",{"type":48,"tag":145,"props":742,"children":744},{"id":743},"_3-assess-cluster-configuration-for-compliance",[745],{"type":53,"value":746},"3. Assess Cluster Configuration for Compliance",{"type":48,"tag":56,"props":748,"children":749},{},[750],{"type":53,"value":751},"Use this checklist to evaluate whether a cluster meets common compliance requirements:",{"type":48,"tag":335,"props":753,"children":755},{"id":754},"baseline-all-frameworks",[756],{"type":53,"value":757},"Baseline (All Frameworks)",{"type":48,"tag":759,"props":760,"children":765},"pre",{"className":761,"code":762,"language":763,"meta":764,"style":764},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","-- Check password policy\nSHOW CLUSTER SETTING server.user_login.min_password_length;\n-- Should be >= 12\n\n-- Check admin user count\nSELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];\n-- Should be minimized (1-3)\n\n-- Check audit logging\nSHOW CLUSTER SETTING sql.log.admin_audit.enabled;\nSHOW CLUSTER SETTING sql.log.user_audit;\n-- Should be enabled\n\n-- Check PUBLIC role privileges\nSELECT database_name, privilege_type\nFROM [SHOW GRANTS FOR public]\nWHERE privilege_type NOT IN ('USAGE')\n  AND schema_name = 'public';\n-- Should return no rows for application databases\n","sql","",[766],{"type":48,"tag":767,"props":768,"children":769},"code",{"__ignoreMap":764},[770,781,789,797,807,816,825,834,842,851,860,869,878,886,895,904,913,922,931],{"type":48,"tag":771,"props":772,"children":775},"span",{"class":773,"line":774},"line",1,[776],{"type":48,"tag":771,"props":777,"children":778},{},[779],{"type":53,"value":780},"-- Check password policy\n",{"type":48,"tag":771,"props":782,"children":783},{"class":773,"line":29},[784],{"type":48,"tag":771,"props":785,"children":786},{},[787],{"type":53,"value":788},"SHOW CLUSTER SETTING server.user_login.min_password_length;\n",{"type":48,"tag":771,"props":790,"children":791},{"class":773,"line":25},[792],{"type":48,"tag":771,"props":793,"children":794},{},[795],{"type":53,"value":796},"-- Should be >= 12\n",{"type":48,"tag":771,"props":798,"children":800},{"class":773,"line":799},4,[801],{"type":48,"tag":771,"props":802,"children":804},{"emptyLinePlaceholder":803},true,[805],{"type":53,"value":806},"\n",{"type":48,"tag":771,"props":808,"children":810},{"class":773,"line":809},5,[811],{"type":48,"tag":771,"props":812,"children":813},{},[814],{"type":53,"value":815},"-- Check admin user count\n",{"type":48,"tag":771,"props":817,"children":819},{"class":773,"line":818},6,[820],{"type":48,"tag":771,"props":821,"children":822},{},[823],{"type":53,"value":824},"SELECT COUNT(*) AS admin_count FROM [SHOW GRANTS ON ROLE admin];\n",{"type":48,"tag":771,"props":826,"children":828},{"class":773,"line":827},7,[829],{"type":48,"tag":771,"props":830,"children":831},{},[832],{"type":53,"value":833},"-- Should be minimized (1-3)\n",{"type":48,"tag":771,"props":835,"children":837},{"class":773,"line":836},8,[838],{"type":48,"tag":771,"props":839,"children":840},{"emptyLinePlaceholder":803},[841],{"type":53,"value":806},{"type":48,"tag":771,"props":843,"children":845},{"class":773,"line":844},9,[846],{"type":48,"tag":771,"props":847,"children":848},{},[849],{"type":53,"value":850},"-- Check audit logging\n",{"type":48,"tag":771,"props":852,"children":854},{"class":773,"line":853},10,[855],{"type":48,"tag":771,"props":856,"children":857},{},[858],{"type":53,"value":859},"SHOW CLUSTER SETTING sql.log.admin_audit.enabled;\n",{"type":48,"tag":771,"props":861,"children":863},{"class":773,"line":862},11,[864],{"type":48,"tag":771,"props":865,"children":866},{},[867],{"type":53,"value":868},"SHOW CLUSTER SETTING sql.log.user_audit;\n",{"type":48,"tag":771,"props":870,"children":872},{"class":773,"line":871},12,[873],{"type":48,"tag":771,"props":874,"children":875},{},[876],{"type":53,"value":877},"-- Should be enabled\n",{"type":48,"tag":771,"props":879,"children":881},{"class":773,"line":880},13,[882],{"type":48,"tag":771,"props":883,"children":884},{"emptyLinePlaceholder":803},[885],{"type":53,"value":806},{"type":48,"tag":771,"props":887,"children":889},{"class":773,"line":888},14,[890],{"type":48,"tag":771,"props":891,"children":892},{},[893],{"type":53,"value":894},"-- Check PUBLIC role privileges\n",{"type":48,"tag":771,"props":896,"children":898},{"class":773,"line":897},15,[899],{"type":48,"tag":771,"props":900,"children":901},{},[902],{"type":53,"value":903},"SELECT database_name, privilege_type\n",{"type":48,"tag":771,"props":905,"children":907},{"class":773,"line":906},16,[908],{"type":48,"tag":771,"props":909,"children":910},{},[911],{"type":53,"value":912},"FROM [SHOW GRANTS FOR public]\n",{"type":48,"tag":771,"props":914,"children":916},{"class":773,"line":915},17,[917],{"type":48,"tag":771,"props":918,"children":919},{},[920],{"type":53,"value":921},"WHERE privilege_type NOT IN ('USAGE')\n",{"type":48,"tag":771,"props":923,"children":925},{"class":773,"line":924},18,[926],{"type":48,"tag":771,"props":927,"children":928},{},[929],{"type":53,"value":930},"  AND schema_name = 'public';\n",{"type":48,"tag":771,"props":932,"children":934},{"class":773,"line":933},19,[935],{"type":48,"tag":771,"props":936,"children":937},{},[938],{"type":53,"value":939},"-- Should return no rows for application databases\n",{"type":48,"tag":759,"props":941,"children":945},{"className":942,"code":943,"language":944,"meta":764,"style":764},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Check network security\nccloud cluster networking allowlist list \u003Ccluster-id> -o json\n# Should NOT contain 0.0.0.0\u002F0\n\n# Check SSO configuration (Cloud Console)\n# Verify in Cloud Console > Organization Settings > Authentication\n\n# Check CMEK (Advanced plan)\nccloud cluster info \u003Ccluster-name> -o json\n# Check for cmek_config\n\n# Check log export (Advanced plan)\n# Look for log_export_config in cluster info output\n","bash",[946],{"type":48,"tag":767,"props":947,"children":948},{"__ignoreMap":764},[949,958,1020,1028,1035,1043,1051,1058,1066,1108,1116,1123,1131],{"type":48,"tag":771,"props":950,"children":951},{"class":773,"line":774},[952],{"type":48,"tag":771,"props":953,"children":955},{"style":954},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[956],{"type":53,"value":957},"# Check network security\n",{"type":48,"tag":771,"props":959,"children":960},{"class":773,"line":29},[961,967,973,978,983,988,994,999,1005,1010,1015],{"type":48,"tag":771,"props":962,"children":964},{"style":963},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[965],{"type":53,"value":966},"ccloud",{"type":48,"tag":771,"props":968,"children":970},{"style":969},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[971],{"type":53,"value":972}," cluster",{"type":48,"tag":771,"props":974,"children":975},{"style":969},[976],{"type":53,"value":977}," networking",{"type":48,"tag":771,"props":979,"children":980},{"style":969},[981],{"type":53,"value":982}," allowlist",{"type":48,"tag":771,"props":984,"children":985},{"style":969},[986],{"type":53,"value":987}," list",{"type":48,"tag":771,"props":989,"children":991},{"style":990},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[992],{"type":53,"value":993}," \u003C",{"type":48,"tag":771,"props":995,"children":996},{"style":969},[997],{"type":53,"value":998},"cluster-i",{"type":48,"tag":771,"props":1000,"children":1002},{"style":1001},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1003],{"type":53,"value":1004},"d",{"type":48,"tag":771,"props":1006,"children":1007},{"style":990},[1008],{"type":53,"value":1009},">",{"type":48,"tag":771,"props":1011,"children":1012},{"style":969},[1013],{"type":53,"value":1014}," -o",{"type":48,"tag":771,"props":1016,"children":1017},{"style":969},[1018],{"type":53,"value":1019}," json\n",{"type":48,"tag":771,"props":1021,"children":1022},{"class":773,"line":25},[1023],{"type":48,"tag":771,"props":1024,"children":1025},{"style":954},[1026],{"type":53,"value":1027},"# Should NOT contain 0.0.0.0\u002F0\n",{"type":48,"tag":771,"props":1029,"children":1030},{"class":773,"line":799},[1031],{"type":48,"tag":771,"props":1032,"children":1033},{"emptyLinePlaceholder":803},[1034],{"type":53,"value":806},{"type":48,"tag":771,"props":1036,"children":1037},{"class":773,"line":809},[1038],{"type":48,"tag":771,"props":1039,"children":1040},{"style":954},[1041],{"type":53,"value":1042},"# Check SSO configuration (Cloud Console)\n",{"type":48,"tag":771,"props":1044,"children":1045},{"class":773,"line":818},[1046],{"type":48,"tag":771,"props":1047,"children":1048},{"style":954},[1049],{"type":53,"value":1050},"# Verify in Cloud Console > Organization Settings > Authentication\n",{"type":48,"tag":771,"props":1052,"children":1053},{"class":773,"line":827},[1054],{"type":48,"tag":771,"props":1055,"children":1056},{"emptyLinePlaceholder":803},[1057],{"type":53,"value":806},{"type":48,"tag":771,"props":1059,"children":1060},{"class":773,"line":836},[1061],{"type":48,"tag":771,"props":1062,"children":1063},{"style":954},[1064],{"type":53,"value":1065},"# Check CMEK (Advanced plan)\n",{"type":48,"tag":771,"props":1067,"children":1068},{"class":773,"line":844},[1069,1073,1077,1082,1086,1091,1096,1100,1104],{"type":48,"tag":771,"props":1070,"children":1071},{"style":963},[1072],{"type":53,"value":966},{"type":48,"tag":771,"props":1074,"children":1075},{"style":969},[1076],{"type":53,"value":972},{"type":48,"tag":771,"props":1078,"children":1079},{"style":969},[1080],{"type":53,"value":1081}," info",{"type":48,"tag":771,"props":1083,"children":1084},{"style":990},[1085],{"type":53,"value":993},{"type":48,"tag":771,"props":1087,"children":1088},{"style":969},[1089],{"type":53,"value":1090},"cluster-nam",{"type":48,"tag":771,"props":1092,"children":1093},{"style":1001},[1094],{"type":53,"value":1095},"e",{"type":48,"tag":771,"props":1097,"children":1098},{"style":990},[1099],{"type":53,"value":1009},{"type":48,"tag":771,"props":1101,"children":1102},{"style":969},[1103],{"type":53,"value":1014},{"type":48,"tag":771,"props":1105,"children":1106},{"style":969},[1107],{"type":53,"value":1019},{"type":48,"tag":771,"props":1109,"children":1110},{"class":773,"line":853},[1111],{"type":48,"tag":771,"props":1112,"children":1113},{"style":954},[1114],{"type":53,"value":1115},"# Check for cmek_config\n",{"type":48,"tag":771,"props":1117,"children":1118},{"class":773,"line":862},[1119],{"type":48,"tag":771,"props":1120,"children":1121},{"emptyLinePlaceholder":803},[1122],{"type":53,"value":806},{"type":48,"tag":771,"props":1124,"children":1125},{"class":773,"line":871},[1126],{"type":48,"tag":771,"props":1127,"children":1128},{"style":954},[1129],{"type":53,"value":1130},"# Check log export (Advanced plan)\n",{"type":48,"tag":771,"props":1132,"children":1133},{"class":773,"line":880},[1134],{"type":48,"tag":771,"props":1135,"children":1136},{"style":954},[1137],{"type":53,"value":1138},"# Look for log_export_config in cluster info output\n",{"type":48,"tag":335,"props":1140,"children":1142},{"id":1141},"advanced-compliance-soc-2-pci-dss-hipaa",[1143],{"type":53,"value":1144},"Advanced Compliance (SOC 2 + PCI DSS + HIPAA)",{"type":48,"tag":157,"props":1146,"children":1147},{},[1148,1169],{"type":48,"tag":161,"props":1149,"children":1150},{},[1151],{"type":48,"tag":165,"props":1152,"children":1153},{},[1154,1159,1164],{"type":48,"tag":169,"props":1155,"children":1156},{},[1157],{"type":53,"value":1158},"Check",{"type":48,"tag":169,"props":1160,"children":1161},{},[1162],{"type":53,"value":1163},"Command\u002FLocation",{"type":48,"tag":169,"props":1165,"children":1166},{},[1167],{"type":53,"value":1168},"Expected State",{"type":48,"tag":190,"props":1170,"children":1171},{},[1172,1190,1207,1229,1257,1278,1300,1318,1336,1354],{"type":48,"tag":165,"props":1173,"children":1174},{},[1175,1180,1185],{"type":48,"tag":197,"props":1176,"children":1177},{},[1178],{"type":53,"value":1179},"SSO enabled",{"type":48,"tag":197,"props":1181,"children":1182},{},[1183],{"type":53,"value":1184},"Cloud Console",{"type":48,"tag":197,"props":1186,"children":1187},{},[1188],{"type":53,"value":1189},"Enabled and enforced",{"type":48,"tag":165,"props":1191,"children":1192},{},[1193,1198,1202],{"type":48,"tag":197,"props":1194,"children":1195},{},[1196],{"type":53,"value":1197},"SCIM provisioning",{"type":48,"tag":197,"props":1199,"children":1200},{},[1201],{"type":53,"value":1184},{"type":48,"tag":197,"props":1203,"children":1204},{},[1205],{"type":53,"value":1206},"Enabled",{"type":48,"tag":165,"props":1208,"children":1209},{},[1210,1215,1224],{"type":48,"tag":197,"props":1211,"children":1212},{},[1213],{"type":53,"value":1214},"CMEK enabled",{"type":48,"tag":197,"props":1216,"children":1217},{},[1218],{"type":48,"tag":767,"props":1219,"children":1221},{"className":1220},[],[1222],{"type":53,"value":1223},"ccloud cluster info",{"type":48,"tag":197,"props":1225,"children":1226},{},[1227],{"type":53,"value":1228},"Enabled with valid key",{"type":48,"tag":165,"props":1230,"children":1231},{},[1232,1237,1248],{"type":48,"tag":197,"props":1233,"children":1234},{},[1235],{"type":53,"value":1236},"Audit logging",{"type":48,"tag":197,"props":1238,"children":1239},{},[1240,1242],{"type":53,"value":1241},"SQL: ",{"type":48,"tag":767,"props":1243,"children":1245},{"className":1244},[],[1246],{"type":53,"value":1247},"SHOW CLUSTER SETTING sql.log.admin_audit.enabled",{"type":48,"tag":197,"props":1249,"children":1250},{},[1251],{"type":48,"tag":767,"props":1252,"children":1254},{"className":1253},[],[1255],{"type":53,"value":1256},"true",{"type":48,"tag":165,"props":1258,"children":1259},{},[1260,1265,1273],{"type":48,"tag":197,"props":1261,"children":1262},{},[1263],{"type":53,"value":1264},"Log export",{"type":48,"tag":197,"props":1266,"children":1267},{},[1268],{"type":48,"tag":767,"props":1269,"children":1271},{"className":1270},[],[1272],{"type":53,"value":1223},{"type":48,"tag":197,"props":1274,"children":1275},{},[1276],{"type":53,"value":1277},"Configured and ENABLED",{"type":48,"tag":165,"props":1279,"children":1280},{},[1281,1286,1295],{"type":48,"tag":197,"props":1282,"children":1283},{},[1284],{"type":53,"value":1285},"IP allowlist",{"type":48,"tag":197,"props":1287,"children":1288},{},[1289],{"type":48,"tag":767,"props":1290,"children":1292},{"className":1291},[],[1293],{"type":53,"value":1294},"ccloud cluster networking allowlist list",{"type":48,"tag":197,"props":1296,"children":1297},{},[1298],{"type":53,"value":1299},"No 0.0.0.0\u002F0",{"type":48,"tag":165,"props":1301,"children":1302},{},[1303,1308,1313],{"type":48,"tag":197,"props":1304,"children":1305},{},[1306],{"type":53,"value":1307},"Private endpoints",{"type":48,"tag":197,"props":1309,"children":1310},{},[1311],{"type":53,"value":1312},"Cloud Console: Networking > Private endpoint",{"type":48,"tag":197,"props":1314,"children":1315},{},[1316],{"type":53,"value":1317},"Configured (recommended)",{"type":48,"tag":165,"props":1319,"children":1320},{},[1321,1326,1331],{"type":48,"tag":197,"props":1322,"children":1323},{},[1324],{"type":53,"value":1325},"Password policy",{"type":48,"tag":197,"props":1327,"children":1328},{},[1329],{"type":53,"value":1330},"SQL: min_password_length",{"type":48,"tag":197,"props":1332,"children":1333},{},[1334],{"type":53,"value":1335},">= 12",{"type":48,"tag":165,"props":1337,"children":1338},{},[1339,1344,1349],{"type":48,"tag":197,"props":1340,"children":1341},{},[1342],{"type":53,"value":1343},"Admin count",{"type":48,"tag":197,"props":1345,"children":1346},{},[1347],{"type":53,"value":1348},"SQL: admin role grants",{"type":48,"tag":197,"props":1350,"children":1351},{},[1352],{"type":53,"value":1353},"\u003C= 3",{"type":48,"tag":165,"props":1355,"children":1356},{},[1357,1362,1367],{"type":48,"tag":197,"props":1358,"children":1359},{},[1360],{"type":53,"value":1361},"PUBLIC privileges",{"type":48,"tag":197,"props":1363,"children":1364},{},[1365],{"type":53,"value":1366},"SQL: SHOW GRANTS FOR public",{"type":48,"tag":197,"props":1368,"children":1369},{},[1370],{"type":53,"value":1371},"Minimal",{"type":48,"tag":145,"props":1373,"children":1375},{"id":1374},"_4-respond-to-security-questionnaires",[1376],{"type":53,"value":1377},"4. Respond to Security Questionnaires",{"type":48,"tag":56,"props":1379,"children":1380},{},[1381],{"type":53,"value":1382},"When responding to customer or auditor questionnaires, reference these standard answers:",{"type":48,"tag":56,"props":1384,"children":1385},{},[1386],{"type":48,"tag":111,"props":1387,"children":1388},{},[1389],{"type":53,"value":1390},"Encryption at rest:",{"type":48,"tag":69,"props":1392,"children":1393},{},[1394,1399,1404],{"type":48,"tag":73,"props":1395,"children":1396},{},[1397],{"type":53,"value":1398},"CockroachDB Cloud encrypts all data at rest using AES-256",{"type":48,"tag":73,"props":1400,"children":1401},{},[1402],{"type":53,"value":1403},"CMEK is available on Advanced plan with Advanced Security Add-on for customer-controlled keys",{"type":48,"tag":73,"props":1405,"children":1406},{},[1407],{"type":53,"value":1408},"Key management follows cloud provider best practices (AWS KMS, GCP Cloud KMS, Azure Key Vault)",{"type":48,"tag":56,"props":1410,"children":1411},{},[1412],{"type":48,"tag":111,"props":1413,"children":1414},{},[1415],{"type":53,"value":1416},"Encryption in transit:",{"type":48,"tag":69,"props":1418,"children":1419},{},[1420,1425],{"type":48,"tag":73,"props":1421,"children":1422},{},[1423],{"type":53,"value":1424},"TLS 1.2+ is enforced on all connections — cannot be disabled",{"type":48,"tag":73,"props":1426,"children":1427},{},[1428],{"type":53,"value":1429},"Client certificate authentication (mTLS) is supported",{"type":48,"tag":56,"props":1431,"children":1432},{},[1433],{"type":48,"tag":111,"props":1434,"children":1435},{},[1436],{"type":53,"value":1437},"Data residency:",{"type":48,"tag":69,"props":1439,"children":1440},{},[1441,1446],{"type":48,"tag":73,"props":1442,"children":1443},{},[1444],{"type":53,"value":1445},"Clusters can be deployed in specific regions to meet data residency requirements",{"type":48,"tag":73,"props":1447,"children":1448},{},[1449],{"type":53,"value":1450},"Multi-region clusters keep data within specified regions",{"type":48,"tag":56,"props":1452,"children":1453},{},[1454],{"type":48,"tag":111,"props":1455,"children":1456},{},[1457],{"type":53,"value":1458},"Backup and recovery:",{"type":48,"tag":69,"props":1460,"children":1461},{},[1462,1467,1472],{"type":48,"tag":73,"props":1463,"children":1464},{},[1465],{"type":53,"value":1466},"Managed backups are automatic on all plans",{"type":48,"tag":73,"props":1468,"children":1469},{},[1470],{"type":53,"value":1471},"RPO and RTO depend on plan type and configuration",{"type":48,"tag":73,"props":1473,"children":1474},{},[1475],{"type":53,"value":1476},"Backups are encrypted and stored in the same cloud provider",{"type":48,"tag":56,"props":1478,"children":1479},{},[1480],{"type":48,"tag":111,"props":1481,"children":1482},{},[1483],{"type":53,"value":1484},"Incident response:",{"type":48,"tag":69,"props":1486,"children":1487},{},[1488,1493],{"type":48,"tag":73,"props":1489,"children":1490},{},[1491],{"type":53,"value":1492},"Cockroach Labs maintains a documented incident response plan",{"type":48,"tag":73,"props":1494,"children":1495},{},[1496],{"type":53,"value":1497},"Details are available in the SOC 2 Type II report",{"type":48,"tag":145,"props":1499,"children":1501},{"id":1500},"_5-prepare-for-compliance-audits",[1502],{"type":53,"value":1503},"5. Prepare for Compliance Audits",{"type":48,"tag":56,"props":1505,"children":1506},{},[1507],{"type":48,"tag":111,"props":1508,"children":1509},{},[1510],{"type":53,"value":1511},"Before the audit:",{"type":48,"tag":1513,"props":1514,"children":1515},"ol",{},[1516,1529,1534,1539],{"type":48,"tag":73,"props":1517,"children":1518},{},[1519,1521,1527],{"type":53,"value":1520},"Run the ",{"type":48,"tag":326,"props":1522,"children":1524},{"href":1523},"..\u002Fauditing-cloud-cluster-security\u002FSKILL.md",[1525],{"type":53,"value":1526},"auditing-cloud-cluster-security",{"type":53,"value":1528}," skill to identify gaps",{"type":48,"tag":73,"props":1530,"children":1531},{},[1532],{"type":53,"value":1533},"Remediate any FAIL findings using the linked remediation skills",{"type":48,"tag":73,"props":1535,"children":1536},{},[1537],{"type":53,"value":1538},"Download current compliance documents from the Trust Center",{"type":48,"tag":73,"props":1540,"children":1541},{},[1542],{"type":53,"value":1543},"Document your CockroachDB Cloud configuration with screenshots or Terraform state",{"type":48,"tag":56,"props":1545,"children":1546},{},[1547],{"type":48,"tag":111,"props":1548,"children":1549},{},[1550],{"type":53,"value":1551},"During the audit:",{"type":48,"tag":1513,"props":1553,"children":1554},{},[1555,1560,1565,1570],{"type":48,"tag":73,"props":1556,"children":1557},{},[1558],{"type":53,"value":1559},"Provide the SOC 2 Type II report to demonstrate CockroachDB Cloud's controls",{"type":48,"tag":73,"props":1561,"children":1562},{},[1563],{"type":53,"value":1564},"Show your cluster configuration (security audit report) to demonstrate your controls",{"type":48,"tag":73,"props":1566,"children":1567},{},[1568],{"type":53,"value":1569},"Demonstrate audit log export and review capability",{"type":48,"tag":73,"props":1571,"children":1572},{},[1573],{"type":53,"value":1574},"Show RBAC configuration and access control policies",{"type":48,"tag":56,"props":1576,"children":1577},{},[1578],{"type":48,"tag":111,"props":1579,"children":1580},{},[1581],{"type":53,"value":1582},"Compliance documents to have ready:",{"type":48,"tag":69,"props":1584,"children":1585},{},[1586,1591,1596,1601,1606,1611],{"type":48,"tag":73,"props":1587,"children":1588},{},[1589],{"type":53,"value":1590},"SOC 2 Type II report (from Trust Center)",{"type":48,"tag":73,"props":1592,"children":1593},{},[1594],{"type":53,"value":1595},"PCI AOC (if processing payment data)",{"type":48,"tag":73,"props":1597,"children":1598},{},[1599],{"type":53,"value":1600},"ISO 27001 certificate (if required)",{"type":48,"tag":73,"props":1602,"children":1603},{},[1604],{"type":53,"value":1605},"BAA (if storing PHI — executed with Cockroach Labs)",{"type":48,"tag":73,"props":1607,"children":1608},{},[1609],{"type":53,"value":1610},"DPA (if processing EU personal data)",{"type":48,"tag":73,"props":1612,"children":1613},{},[1614],{"type":53,"value":1615},"Your security audit report (from auditing-cloud-cluster-security skill)",{"type":48,"tag":62,"props":1617,"children":1619},{"id":1618},"safety-considerations",[1620],{"type":53,"value":1621},"Safety Considerations",{"type":48,"tag":69,"props":1623,"children":1624},{},[1625,1635,1645],{"type":48,"tag":73,"props":1626,"children":1627},{},[1628,1633],{"type":48,"tag":111,"props":1629,"children":1630},{},[1631],{"type":53,"value":1632},"This skill is read-only.",{"type":53,"value":1634}," No cluster configuration is modified.",{"type":48,"tag":73,"props":1636,"children":1637},{},[1638,1643],{"type":48,"tag":111,"props":1639,"children":1640},{},[1641],{"type":53,"value":1642},"Compliance documents may be confidential.",{"type":53,"value":1644}," Handle SOC 2 reports and PCI AOCs according to your organization's information classification policy.",{"type":48,"tag":73,"props":1646,"children":1647},{},[1648,1653],{"type":48,"tag":111,"props":1649,"children":1650},{},[1651],{"type":53,"value":1652},"Compliance is shared responsibility.",{"type":53,"value":1654}," CockroachDB Cloud provides the platform controls; your organization is responsible for configuring and using them correctly.",{"type":48,"tag":62,"props":1656,"children":1658},{"id":1657},"references",[1659],{"type":53,"value":1660},"References",{"type":48,"tag":56,"props":1662,"children":1663},{},[1664],{"type":48,"tag":111,"props":1665,"children":1666},{},[1667],{"type":53,"value":1668},"Skill references:",{"type":48,"tag":69,"props":1670,"children":1671},{},[1672],{"type":48,"tag":73,"props":1673,"children":1674},{},[1675],{"type":48,"tag":326,"props":1676,"children":1677},{"href":328},[1678],{"type":53,"value":1679},"Compliance control matrix",{"type":48,"tag":56,"props":1681,"children":1682},{},[1683],{"type":48,"tag":111,"props":1684,"children":1685},{},[1686],{"type":53,"value":1687},"Related skills:",{"type":48,"tag":69,"props":1689,"children":1690},{},[1691,1700,1711,1722,1733,1744,1755,1766,1777],{"type":48,"tag":73,"props":1692,"children":1693},{},[1694,1698],{"type":48,"tag":326,"props":1695,"children":1696},{"href":1523},[1697],{"type":53,"value":1526},{"type":53,"value":1699}," — Automated security posture assessment",{"type":48,"tag":73,"props":1701,"children":1702},{},[1703,1709],{"type":48,"tag":326,"props":1704,"children":1706},{"href":1705},"..\u002Fconfiguring-audit-logging\u002FSKILL.md",[1707],{"type":53,"value":1708},"configuring-audit-logging",{"type":53,"value":1710}," — Enable audit logging for compliance",{"type":48,"tag":73,"props":1712,"children":1713},{},[1714,1720],{"type":48,"tag":326,"props":1715,"children":1717},{"href":1716},"..\u002Fenabling-cmek-encryption\u002FSKILL.md",[1718],{"type":53,"value":1719},"enabling-cmek-encryption",{"type":53,"value":1721}," — Enable customer-managed encryption keys",{"type":48,"tag":73,"props":1723,"children":1724},{},[1725,1731],{"type":48,"tag":326,"props":1726,"children":1728},{"href":1727},"..\u002Fconfiguring-sso-and-scim\u002FSKILL.md",[1729],{"type":53,"value":1730},"configuring-sso-and-scim",{"type":53,"value":1732}," — Enable SSO and automated provisioning",{"type":48,"tag":73,"props":1734,"children":1735},{},[1736,1742],{"type":48,"tag":326,"props":1737,"children":1739},{"href":1738},"..\u002Fhardening-user-privileges\u002FSKILL.md",[1740],{"type":53,"value":1741},"hardening-user-privileges",{"type":53,"value":1743}," — Implement least-privilege access",{"type":48,"tag":73,"props":1745,"children":1746},{},[1747,1753],{"type":48,"tag":326,"props":1748,"children":1750},{"href":1749},"..\u002Fenforcing-password-policies\u002FSKILL.md",[1751],{"type":53,"value":1752},"enforcing-password-policies",{"type":53,"value":1754}," — Configure password requirements",{"type":48,"tag":73,"props":1756,"children":1757},{},[1758,1764],{"type":48,"tag":326,"props":1759,"children":1761},{"href":1760},"..\u002Fconfiguring-ip-allowlists\u002FSKILL.md",[1762],{"type":53,"value":1763},"configuring-ip-allowlists",{"type":53,"value":1765}," — Network access control",{"type":48,"tag":73,"props":1767,"children":1768},{},[1769,1775],{"type":48,"tag":326,"props":1770,"children":1772},{"href":1771},"..\u002Fconfiguring-private-connectivity\u002FSKILL.md",[1773],{"type":53,"value":1774},"configuring-private-connectivity",{"type":53,"value":1776}," — Private network endpoints",{"type":48,"tag":73,"props":1778,"children":1779},{},[1780,1786],{"type":48,"tag":326,"props":1781,"children":1783},{"href":1782},"..\u002Fconfiguring-log-export\u002FSKILL.md",[1784],{"type":53,"value":1785},"configuring-log-export",{"type":53,"value":1787}," — Export logs for compliance retention",{"type":48,"tag":56,"props":1789,"children":1790},{},[1791],{"type":48,"tag":111,"props":1792,"children":1793},{},[1794],{"type":53,"value":1795},"Official CockroachDB Documentation:",{"type":48,"tag":69,"props":1797,"children":1798},{},[1799,1810,1819],{"type":48,"tag":73,"props":1800,"children":1801},{},[1802],{"type":48,"tag":326,"props":1803,"children":1807},{"href":1804,"rel":1805},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fsecurity-overview.html",[1806],"nofollow",[1808],{"type":53,"value":1809},"CockroachDB Cloud Security Overview",{"type":48,"tag":73,"props":1811,"children":1812},{},[1813],{"type":48,"tag":326,"props":1814,"children":1817},{"href":1815,"rel":1816},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcompliance.html",[1806],[1818],{"type":53,"value":17},{"type":48,"tag":73,"props":1820,"children":1821},{},[1822],{"type":48,"tag":326,"props":1823,"children":1826},{"href":1824,"rel":1825},"https:\u002F\u002Fwww.cockroachlabs.com\u002Fdocs\u002Fcockroachcloud\u002Fcompliance",[1806],[1827],{"type":53,"value":1828},"SOC 2 Compliance",{"type":48,"tag":1830,"props":1831,"children":1832},"style",{},[1833],{"type":53,"value":1834},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1836,"total":1930},[1837,1853,1867,1882,1894,1907,1920],{"slug":1838,"name":1838,"fn":1839,"description":1840,"org":1841,"tags":1842,"stars":25,"repoUrl":26,"updatedAt":1852},"analyzing-range-distribution","analyze CockroachDB range distribution and health","Analyzes CockroachDB range distribution across tables and indexes using SHOW RANGES to identify range count, size patterns, leaseholder placement, and replication health. Use when investigating hotspots, uneven data distribution, range fragmentation, or validating zone configuration effects without DB Console access.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1843,1846,1849],{"name":1844,"slug":1845,"type":15},"Database","database",{"name":1847,"slug":1848,"type":15},"Monitoring","monitoring",{"name":1850,"slug":1851,"type":15},"Performance","performance","2026-07-12T07:57:18.753533",{"slug":1854,"name":1854,"fn":1855,"description":1856,"org":1857,"tags":1858,"stars":25,"repoUrl":26,"updatedAt":1866},"analyzing-schema-change-storage-risk","analyze schema change storage requirements","Estimates storage requirements for CockroachDB online schema change backfills using SHOW RANGES WITH DETAILS, KEYS, INDEXES. Use before CREATE INDEX, ADD COLUMN with INDEX\u002FUNIQUE, ALTER PRIMARY KEY, CREATE MATERIALIZED VIEW, CREATE TABLE AS, REFRESH, or SET LOCALITY on tables with large per-index footprints, to avoid mid-backfill disk exhaustion.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1859,1862,1863,1864],{"name":1860,"slug":1861,"type":15},"Data Modeling","data-modeling",{"name":1844,"slug":1845,"type":15},{"name":1850,"slug":1851,"type":15},{"name":1865,"slug":763,"type":15},"SQL","2026-07-12T07:57:22.763788",{"slug":1868,"name":1868,"fn":1869,"description":1870,"org":1871,"tags":1872,"stars":25,"repoUrl":26,"updatedAt":1881},"auditing-cis-benchmark","audit CockroachDB clusters against CIS benchmarks","Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls. Supports two audit depths — quick automated scans and full CIS audit procedures. Produces a structured PASS\u002FFAIL\u002FMANUAL report covering installation, system hardening, logging, user access, data protection, and CockroachDB settings. Use when preparing for CIS compliance assessments, hardening self-hosted deployments, or validating security posture against industry benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1873,1876,1877,1878],{"name":1874,"slug":1875,"type":15},"Audit","audit",{"name":17,"slug":18,"type":15},{"name":1844,"slug":1845,"type":15},{"name":1879,"slug":1880,"type":15},"Security","security","2026-07-18T05:48:00.862384",{"slug":1526,"name":1526,"fn":1883,"description":1884,"org":1885,"tags":1886,"stars":25,"repoUrl":26,"updatedAt":1893},"audit CockroachDB cluster security posture","Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions. Use when assessing cluster security readiness, preparing for compliance reviews, or investigating security configuration gaps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1887,1888,1889,1892],{"name":1874,"slug":1875,"type":15},{"name":1844,"slug":1845,"type":15},{"name":1890,"slug":1891,"type":15},"Operations","operations",{"name":1879,"slug":1880,"type":15},"2026-07-12T07:57:01.506735",{"slug":1895,"name":1895,"fn":1896,"description":1897,"org":1898,"tags":1899,"stars":25,"repoUrl":26,"updatedAt":1906},"auditing-table-statistics","audit optimizer table statistics","Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS. Use when diagnosing poor query performance, unexpected plan changes, or after bulk data changes to identify stale statistics requiring refresh via CREATE STATISTICS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1900,1901,1904,1905],{"name":1874,"slug":1875,"type":15},{"name":1902,"slug":1903,"type":15},"Data Analysis","data-analysis",{"name":1844,"slug":1845,"type":15},{"name":1850,"slug":1851,"type":15},"2026-07-12T07:57:16.190081",{"slug":1908,"name":1908,"fn":1909,"description":1910,"org":1911,"tags":1912,"stars":25,"repoUrl":26,"updatedAt":1919},"benchmarking-transaction-patterns","benchmark CockroachDB transaction patterns","Guides benchmarking and comparing explicit multi-statement transactions versus single-statement CTE transactions in CockroachDB, with fair test methodology, contention analysis, and performance interpretation. Use when comparing transaction formulations, benchmarking CockroachDB workloads under contention, investigating retry pressure, or deciding whether to rewrite multi-step application flows into single SQL statements.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1913,1914,1917,1918],{"name":1844,"slug":1845,"type":15},{"name":1915,"slug":1916,"type":15},"Engineering","engineering",{"name":1850,"slug":1851,"type":15},{"name":1865,"slug":763,"type":15},"2026-07-12T07:57:26.543278",{"slug":1921,"name":1921,"fn":1922,"description":1923,"org":1924,"tags":1925,"stars":25,"repoUrl":26,"updatedAt":1929},"cockroachdb-sql","write and optimize CockroachDB SQL","Use when writing, generating, or optimizing SQL for CockroachDB, designing CockroachDB schemas, or when the user asks about CockroachDB-specific SQL patterns, type mappings, and distributed database best practices. Also use when encountering CockroachDB anti-patterns like missing primary keys, sequential ID hotspots, or incorrect type usage.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1926,1927,1928],{"name":1844,"slug":1845,"type":15},{"name":1850,"slug":1851,"type":15},{"name":1865,"slug":763,"type":15},"2026-07-25T05:31:22.562808",34,{"items":1932,"total":2051},[1933,1950,1963,1978,1989,1999,2010,2016,2023,2030,2037,2044],{"slug":1934,"name":1934,"fn":1935,"description":1936,"org":1937,"tags":1938,"stars":1947,"repoUrl":1948,"updatedAt":1949},"collecting-cockroachdb-operator-escalation-packet","collect CockroachDB operator escalation packets","Collects a complete CockroachDB Operator escalation packet for TSC\u002FTSE or operator-team handoff, including Helm state, Kubernetes resources, logs, operation-specific evidence, pprof goroutine dumps, metrics, and a customer action timeline. Use when general diagnosis cannot resolve an operator-managed CockroachDB Helm issue or before restarting a stuck operator.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1939,1940,1943,1946],{"name":1844,"slug":1845,"type":15},{"name":1941,"slug":1942,"type":15},"Incident Response","incident-response",{"name":1944,"slug":1945,"type":15},"Kubernetes","kubernetes",{"name":1847,"slug":1848,"type":15},105,"https:\u002F\u002Fgithub.com\u002Fcockroachdb\u002Fhelm-charts","2026-07-12T07:57:25.288146",{"slug":1951,"name":1951,"fn":1952,"description":1953,"org":1954,"tags":1955,"stars":1947,"repoUrl":1948,"updatedAt":1962},"configuring-cockroachdb-helm-tls","configure TLS for CockroachDB Helm charts","Selects and validates TLS settings for CockroachDB Helm chart deployments, including self-signer, cert-manager, and external certificate modes. Use when a customer needs secure CockroachDB Helm values, certificate secret mapping, cert-manager integration, or TLS install troubleshooting before deploying the chart.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1956,1959,1961],{"name":1957,"slug":1958,"type":15},"Deployment","deployment",{"name":393,"slug":1960,"type":15},"encryption",{"name":1879,"slug":1880,"type":15},"2026-07-12T07:56:37.675396",{"slug":1964,"name":1964,"fn":1965,"description":1966,"org":1967,"tags":1968,"stars":1947,"repoUrl":1948,"updatedAt":1977},"debugging-cockroachdb-operator-migrations","debug CockroachDB Operator migration scenarios","Debugs CockroachDB Operator migration scenarios, including Helm StatefulSet to v1beta1 CrdbNode migration and public operator v1alpha1 to v1beta1 migration. Use when migration labels, migration phases, source StatefulSet ownership, converted CRDs, PVC ownership, or post-migration reconciliation are unclear or stuck.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1969,1970,1973,1974],{"name":1844,"slug":1845,"type":15},{"name":1971,"slug":1972,"type":15},"Debugging","debugging",{"name":1944,"slug":1945,"type":15},{"name":1975,"slug":1976,"type":15},"Migration","migration","2026-07-12T07:56:48.360871",{"slug":1979,"name":1979,"fn":1980,"description":1981,"org":1982,"tags":1983,"stars":1947,"repoUrl":1948,"updatedAt":1988},"diagnosing-cockroachdb-helm-deployments","diagnose CockroachDB Helm chart deployments","Diagnoses failed or unhealthy CockroachDB Helm chart deployments by checking Helm release state, operator health, CrdbCluster and CrdbNode status, pod readiness, RBAC, webhooks, TLS, upgrades, scaling, PVCs, DNS, and multi-region assumptions. Use when Helm install or upgrade fails, pods are not Ready, or the operator is not reconciling.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1984,1985,1986,1987],{"name":1844,"slug":1845,"type":15},{"name":1971,"slug":1972,"type":15},{"name":1957,"slug":1958,"type":15},{"name":1944,"slug":1945,"type":15},"2026-07-12T07:57:24.018818",{"slug":1990,"name":1990,"fn":1991,"description":1992,"org":1993,"tags":1994,"stars":1947,"repoUrl":1948,"updatedAt":1998},"installing-cockroachdb-with-helm","install CockroachDB using Helm","Guides customer-facing installation of CockroachDB on Kubernetes using the CockroachDB split Helm charts and operator-managed v1beta1 resources. Use when installing CockroachDB with Helm, choosing between published and local split charts, verifying a new install, or helping an agent complete first-time Kubernetes onboarding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1995,1996,1997],{"name":1844,"slug":1845,"type":15},{"name":1957,"slug":1958,"type":15},{"name":1944,"slug":1945,"type":15},"2026-07-12T07:56:45.777567",{"slug":2000,"name":2000,"fn":2001,"description":2002,"org":2003,"tags":2004,"stars":1947,"repoUrl":1948,"updatedAt":2009},"validating-cockroachdb-helm-multiregion","validate CockroachDB multi-region Helm deployments","Validates CockroachDB Helm chart values and Kubernetes prerequisites for operator-managed multi-region deployments. Use before adding a region, deploying CockroachDB across multiple Kubernetes clusters, checking region DNS domains, or confirming that all regions share certificate and networking assumptions.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2005,2006,2007,2008],{"name":1844,"slug":1845,"type":15},{"name":1957,"slug":1958,"type":15},{"name":1944,"slug":1945,"type":15},{"name":1890,"slug":1891,"type":15},"2026-07-12T07:56:47.082609",{"slug":1838,"name":1838,"fn":1839,"description":1840,"org":2011,"tags":2012,"stars":25,"repoUrl":26,"updatedAt":1852},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2013,2014,2015],{"name":1844,"slug":1845,"type":15},{"name":1847,"slug":1848,"type":15},{"name":1850,"slug":1851,"type":15},{"slug":1854,"name":1854,"fn":1855,"description":1856,"org":2017,"tags":2018,"stars":25,"repoUrl":26,"updatedAt":1866},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2019,2020,2021,2022],{"name":1860,"slug":1861,"type":15},{"name":1844,"slug":1845,"type":15},{"name":1850,"slug":1851,"type":15},{"name":1865,"slug":763,"type":15},{"slug":1868,"name":1868,"fn":1869,"description":1870,"org":2024,"tags":2025,"stars":25,"repoUrl":26,"updatedAt":1881},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2026,2027,2028,2029],{"name":1874,"slug":1875,"type":15},{"name":17,"slug":18,"type":15},{"name":1844,"slug":1845,"type":15},{"name":1879,"slug":1880,"type":15},{"slug":1526,"name":1526,"fn":1883,"description":1884,"org":2031,"tags":2032,"stars":25,"repoUrl":26,"updatedAt":1893},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2033,2034,2035,2036],{"name":1874,"slug":1875,"type":15},{"name":1844,"slug":1845,"type":15},{"name":1890,"slug":1891,"type":15},{"name":1879,"slug":1880,"type":15},{"slug":1895,"name":1895,"fn":1896,"description":1897,"org":2038,"tags":2039,"stars":25,"repoUrl":26,"updatedAt":1906},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2040,2041,2042,2043],{"name":1874,"slug":1875,"type":15},{"name":1902,"slug":1903,"type":15},{"name":1844,"slug":1845,"type":15},{"name":1850,"slug":1851,"type":15},{"slug":1908,"name":1908,"fn":1909,"description":1910,"org":2045,"tags":2046,"stars":25,"repoUrl":26,"updatedAt":1919},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[2047,2048,2049,2050],{"name":1844,"slug":1845,"type":15},{"name":1915,"slug":1916,"type":15},{"name":1850,"slug":1851,"type":15},{"name":1865,"slug":763,"type":15},40]