diff --git a/tidb-cloud/configure-ip-access-list.md b/tidb-cloud/configure-ip-access-list.md index aaf59d2815223..70ee7443ec804 100644 --- a/tidb-cloud/configure-ip-access-list.md +++ b/tidb-cloud/configure-ip-access-list.md @@ -11,7 +11,9 @@ For each TiDB Cloud Dedicated cluster in TiDB Cloud, you can configure an IP acc > > This document applies to [**TiDB Cloud Dedicated**](/tidb-cloud/select-cluster-tier.md#tidb-cloud-dedicated). For instructions on configuring an IP access list for **{{{ .starter }}}** or **{{{ .essential }}}**, see [Configure {{{ .starter }}} or Essential Firewall Rules for Public Endpoints](/tidb-cloud/configure-serverless-firewall-rules-for-public-endpoints.md). -To configure an IP access list for your TiDB Cloud Dedicated cluster, take the following steps: +## Add an IP address + +To add an IP address to the IP access list for your TiDB Cloud Dedicated cluster, take the following steps: 1. Navigate to the [**My TiDB**](https://tidbcloud.com/tidbs) page, and then click the name of your target TiDB Cloud Dedicated cluster to go to its overview page. @@ -21,10 +23,27 @@ To configure an IP access list for your TiDB Cloud Dedicated cluster, take the f 2. In the left navigation pane, click **Settings** > **Networking**. 3. On the **Networking** page, click **Add IP Address**. -4. In the displayed dialog, choose one of the following options: +4. In the **Add IP Address** dialog, add IP addresses with an optional description. For each TiDB Cloud Dedicated cluster, you can add up to 100 IP addresses. + + - To add a custom IP address, click the **+** icon, enter the IP address in CIDR notation (for example, `192.168.1.1/32`), and add a description. + - To add the current IP address of your computer, click **Add Current IP**. + - To allow any IP address to access your cluster, click **Allow access from anywhere**. This adds the `0.0.0.0/0` CIDR entry. This is highly risky and NOT recommended for production environments. + +5. Click **Save**. + +## Edit an IP address + +To edit an existing IP address in the IP access list, take the following steps: + +1. On the **Networking** page, locate the IP address you want to edit in the **IP Access List**. +2. Click **...** in the row of the IP address, and then click **Edit**. +3. In the **Edit IP Address** dialog, modify the IP address or description as needed. +4. Click **Submit**. + +## Delete an IP address - - **Allow access from anywhere**: allows all IP addresses to access TiDB Cloud. This option exposes your TiDB Cloud Dedicated cluster to the internet completely and is highly risky. - - **Use IP addresses** (recommended): you can add a list of IPs and CIDR addresses that are allowed to access TiDB Cloud via a SQL client. +To delete an existing IP address from the IP access list, take the following steps: -5. If you choose **Use IP addresses**, add IP addresses or CIDR range with an optional description. For each TiDB Cloud Dedicated cluster, you can add up to 100 IP addresses. -6. Click **Confirm** to save your changes. +1. On the **Networking** page, locate the IP address you want to delete in the **IP Access List**. +2. Click **...** in the row of the IP address, and then click **Delete**. +3. In the confirmation dialog, click **Delete**. diff --git a/tidb-cloud/premium/set-up-sink-private-endpoint-premium.md b/tidb-cloud/premium/set-up-sink-private-endpoint-premium.md index 59669c3f668fe..547f3f0be5031 100644 --- a/tidb-cloud/premium/set-up-sink-private-endpoint-premium.md +++ b/tidb-cloud/premium/set-up-sink-private-endpoint-premium.md @@ -74,8 +74,8 @@ The configuration steps vary depending on the cloud provider where your instance
-1. On the **Networking** page, click **Create Private Endpoint** in the **AWS Private Endpoint for Changefeed** section. -2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint. +1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **AWS Private Endpoints for External Services** section. +2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint. 3. Follow the reminder to authorize the [AWS Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-accounts) of TiDB Cloud to create an endpoint. 4. Enter the **Endpoint Service Name** that you collected in the [Network](#network) section. 5. Select the **Number of AZs**. Ensure that the number of AZs and the AZ IDs match your Kafka deployment. @@ -93,8 +93,8 @@ The configuration steps vary depending on the cloud provider where your instance
-1. On the **Networking** page, click **Create Private Endpoint** in the **Alibaba Cloud Private Endpoint for Changefeed** section. -2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint. +1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **Alibaba Cloud Private Endpoints for External Services** section. +2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint. 3. Follow the reminder to add TiDB Cloud's Alibaba Cloud account ID to the allowlist of your endpoint service to grant TiDB Cloud VPC access. For more information, see [managing account IDs in the allowlist of an endpoint service](https://www.alibabacloud.com/help/en/privatelink/user-guide/add-and-manage-service-whitelists). 4. Enter the **Endpoint Service Name** that you collected in the [Network](#network) section. 5. Select the **Number of AZs**. Ensure that the number of AZs and the AZ IDs match your Kafka deployment. diff --git a/tidb-cloud/serverless-private-link-connection-to-alicloud-rds.md b/tidb-cloud/serverless-private-link-connection-to-alicloud-rds.md index 2efa76cf56ebf..981056d4e036a 100644 --- a/tidb-cloud/serverless-private-link-connection-to-alicloud-rds.md +++ b/tidb-cloud/serverless-private-link-connection-to-alicloud-rds.md @@ -24,7 +24,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Alib To view the Alibaba Cloud account ID and availability zones, do the following: 1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane. -2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**. +2. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. 3. In the displayed dialog, you can find the Alibaba Cloud account ID and availability zones. ## Step 1. Set up an ApsaraDB RDS for MySQL instance diff --git a/tidb-cloud/serverless-private-link-connection-to-amazon-msk.md b/tidb-cloud/serverless-private-link-connection-to-amazon-msk.md index 14413aaba7d50..62c189b5787cc 100644 --- a/tidb-cloud/serverless-private-link-connection-to-amazon-msk.md +++ b/tidb-cloud/serverless-private-link-connection-to-amazon-msk.md @@ -17,7 +17,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Amaz To view the AWS account ID and availability zones: 1. In the [TiDB Cloud console](https://tidbcloud.com), go to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane. -2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**. +2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. 3. In the dialog, note the AWS account ID and availability zones. ## Prerequisites for the Amazon MSK Provisioned cluster diff --git a/tidb-cloud/serverless-private-link-connection-to-aws-confluent.md b/tidb-cloud/serverless-private-link-connection-to-aws-confluent.md index 08926db8422d1..6f2f34b3515d0 100644 --- a/tidb-cloud/serverless-private-link-connection-to-aws-confluent.md +++ b/tidb-cloud/serverless-private-link-connection-to-aws-confluent.md @@ -23,7 +23,7 @@ This document describes how to connect a {{{ .essential }}} instance to a [Confl To view the AWS account ID and availability zones, do the following: 1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane. -2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**. +2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. 3. In the displayed dialog, you can find the AWS account ID and availability zones. ## Step 1. Set up a Confluent Cloud network diff --git a/tidb-cloud/serverless-private-link-connection-to-aws-rds.md b/tidb-cloud/serverless-private-link-connection-to-aws-rds.md index 54be497698b7c..027193e4a36d0 100644 --- a/tidb-cloud/serverless-private-link-connection-to-aws-rds.md +++ b/tidb-cloud/serverless-private-link-connection-to-aws-rds.md @@ -25,7 +25,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Amaz To view the AWS account ID and availability zones, do the following: 1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane. -2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**. +2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. 3. In the displayed dialog, you can find the AWS account ID and availability zones. ## Step 1. Set up the Amazon RDS instance diff --git a/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-alicloud.md b/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-alicloud.md index 47497ce2ede78..686ab44ce1b2e 100644 --- a/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-alicloud.md +++ b/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-alicloud.md @@ -43,7 +43,7 @@ For example, the port mapping is as follows: To view the Alibaba Cloud account ID and availability zones, do the following: 1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane. -2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**. +2. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. 3. In the displayed dialog, you can find the Alibaba Cloud account ID and availability zones. The following table shows an example of the deployment information. diff --git a/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-aws.md b/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-aws.md index 41913cbf1012a..40d1622d4cc9d 100644 --- a/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-aws.md +++ b/tidb-cloud/serverless-private-link-connection-to-self-hosted-kafka-in-aws.md @@ -37,7 +37,7 @@ The mechanism works as follows: To view the AWS account ID and availability zones, do the following: 1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane. -2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**. +2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. 3. In the displayed dialog, you can find the AWS account ID and availability zones. The following table shows an example of the deployment information. diff --git a/tidb-cloud/serverless-private-link-connection.md b/tidb-cloud/serverless-private-link-connection.md index 7c277ab20bce6..9c769740af2c0 100644 --- a/tidb-cloud/serverless-private-link-connection.md +++ b/tidb-cloud/serverless-private-link-connection.md @@ -39,7 +39,7 @@ Ensure that the AWS endpoint service: - Add the TiDB Cloud account ID to the **Allow principals** list. - Has availability zones that overlap with your {{{ .essential }}} instance. -You can get the account ID and availability zones information at the bottom of the **Create Private Link Connection** dialog, or by running the following command: +You can get the account ID and availability zones information at the bottom of the **Create Private Endpoint for External Services** dialog, or by running the following command: ```shell ticloud serverless private-link-connection zones --cluster-id @@ -56,13 +56,14 @@ ticloud serverless private-link-connection zones --cluster-id 2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane. -3. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection** to create a private endpoint in endpoint shared mode. In this model, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region. +3. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. > **Note:** > - > If your TiDB Cloud Essential instance is created after June 30, 2026 and the **Private Link Connection For Dataflow** area is not available, you can create a private link connection in endpoint exclusive mode by clicking **Create Private Endpoint for External Services** in the **AWS Private Endpoint for External Services** area instead. In the endpoint exclusive model, each {{{ .essential }}} instance uses its own standalone private endpoint. This model eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting. + > - If your TiDB Cloud Essential instance is created on July 1, 2026 or later, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint exclusive mode. In this mode, each {{{ .essential }}} instance uses its own standalone private endpoint, which eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting. + > - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region. -4. In the **Create Private Link Connection** dialog, enter the required information: +4. In the **Create Private Endpoint for External Services** dialog, enter the required information: - **Private Link Connection Name**: enter a name for the private link connection. - **Connection Type**: select **AWS Endpoint Service**. If this option is not displayed, ensure that your {{{ .essential }}} instance is created on AWS. @@ -103,13 +104,14 @@ Before creating the Amazon MSK Provisioned private link connection, ensure that 2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane. -3. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection** to create a private endpoint in endpoint shared mode. In this model, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region. +3. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. > **Note:** > - > If your TiDB Cloud Essential instance is created after June 30, 2026 and the **Private Link Connection For Dataflow** area is not available, you can create a private link connection in endpoint exclusive mode by clicking **Create Private Endpoint for External Services** in the **Amazon MSK Provisioned Private Endpoint for External Services** area instead. In the endpoint exclusive model, each {{{ .essential }}} instance uses its own standalone private endpoint. This model eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting. + > - If your TiDB Cloud Essential instance is created on July 1, 2026 or later, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint exclusive mode. In this mode, each {{{ .essential }}} instance uses its own standalone private endpoint, which eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting. + > - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region. -4. In the **Create Private Link Connection** dialog, enter the required information: +4. In the **Create Private Endpoint for External Services** dialog, enter the required information: - **Private Link Connection Name**: enter a name for the private link connection. - **Connection Type**: select **Amazon MSK Provisioned**. If this option is not displayed, ensure that your {{{ .essential }}} instance is created on AWS. @@ -127,7 +129,7 @@ Ensure that the Alibaba Cloud endpoint service: - Add the TiDB Cloud account ID to the **Service Whitelist**. - Has availability zones that overlap with your {{{ .essential }}} instance. -You can get the account ID and available zones information at the bottom of the **Create Private Link Connection** dialog, or by running the following command: +You can get the account ID and available zones information at the bottom of the **Create Private Endpoint for External Services** dialog, or by running the following command: ```shell ticloud serverless private-link-connection zones --cluster-id @@ -144,13 +146,14 @@ ticloud serverless private-link-connection zones --cluster-id 2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane. -3. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection** to create a private endpoint in endpoint shared mode. In this model, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same Alibaba Cloud Region. +3. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**. > **Note:** > - > If your TiDB Cloud Essential instance is created after June 30, 2026 and the **Private Link Connection For Dataflow** area is not available, you can create a private link connection in endpoint exclusive mode by clicking **Create Private Endpoint for External Services** in the **Alibaba Cloud Private Endpoint for External Services** area instead. In the endpoint exclusive model, each {{{ .essential }}} instance uses its own standalone private endpoint. This model eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting. + > - If your TiDB Cloud Essential instance is created on July 1, 2026 or later, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint exclusive mode. In this mode, each {{{ .essential }}} instance uses its own standalone private endpoint, which eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting. + > - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region. -4. In the **Create Private Link Connection** dialog, enter the required information: +4. In the **Create Private Endpoint for External Services** dialog, enter the required information: - **Private Link Connection Name**: enter a name for the private link connection. - **Connection Type**: select **Alibaba Cloud Endpoint Service**. If this option is not displayed, ensure that your {{{ .essential }}} instance is created on Alibaba Cloud. @@ -206,7 +209,7 @@ To attach domains to a private link connection using the TiDB Cloud console, do 2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane. -3. In the **Private Link Connection For Dataflow** area, choose the target private link connection, and then click **...**. +3. In the **Private Endpoints for External Services** area for your cloud provider, choose the target private link connection, and then click **...**. 4. Click **Attach Domains**. @@ -259,7 +262,7 @@ To detach domains from a private link connection using the TiDB Cloud console, d 2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane. -3. In the **Private Link Connection For Dataflow** area, choose the target private link connection, and then click **...**. +3. In the **Private Endpoints for External Services** area for your cloud provider, choose the target private link connection, and then click **...**. 4. Click **Detach Domains**, and then confirm the detachment. @@ -301,7 +304,7 @@ To delete a private link connection using the TiDB Cloud console, do the followi 2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane. -3. In the **Private Link Connection For Dataflow** area, choose the target private link connection, and then click **...**. +3. In the **Private Endpoints for External Services** area for your cloud provider, choose the target private link connection, and then click **...**. 4. Click **Delete**, and then confirm the deletion. diff --git a/tidb-cloud/set-up-sink-private-endpoint.md b/tidb-cloud/set-up-sink-private-endpoint.md index 7a5e93d1f471c..c9e32397b5d20 100644 --- a/tidb-cloud/set-up-sink-private-endpoint.md +++ b/tidb-cloud/set-up-sink-private-endpoint.md @@ -78,8 +78,8 @@ The configuration steps vary depending on the cloud provider where your cluster
-1. On the **Networking** page, click **Create Private Endpoint** in the **AWS Private Endpoint for Changefeed** section. -2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint. +1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **AWS Private Endpoints for External Services** section. +2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint. 3. Follow the reminder to authorize the [AWS Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-accounts) of TiDB Cloud to create an endpoint. 4. Enter the **Endpoint Service Name** that you collected in the [Network](#network) section. 5. Select the **Number of AZs**. Ensure that the number of AZs and the AZ IDs match your Kafka deployment. @@ -95,8 +95,8 @@ The configuration steps vary depending on the cloud provider where your cluster
-1. On the **Networking** page, click **Create Private Endpoint** in the **Google Cloud Private Endpoint for Changefeed** section. -2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint. +1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **Google Cloud Private Endpoints for External Services** section. +2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint. 3. Follow the reminder to authorize the [Google Cloud project](https://cloud.google.com/resource-manager/docs/creating-managing-projects) of TiDB Cloud to pre-approve endpoint creation, or manually approve the endpoint connection request when you receive it. 4. Enter the **Service Attachment** that you collected in the [Network](#network) section. 5. If this private endpoint is created for Apache Kafka, enable the **Advertised Listener for Kafka** option. @@ -111,8 +111,8 @@ The configuration steps vary depending on the cloud provider where your cluster
-1. On the **Networking** page, click **Create Private Endpoint** in the **Azure Private Endpoint for Changefeed** section. -2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint. +1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **Azure Private Endpoints for External Services** section. +2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint. 3. Follow the reminder to authorize the Azure subscription of TiDB Cloud or allow anyone with your alias to access your Private Link service before creating the changefeed. For more information about Private Link service visibility, see [Control service exposure](https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview#control-service-exposure) in Azure documentation. 4. Enter the **Alias of Private Link Service** that you collected in the [Network](#network) section. 5. If this private endpoint is created for Apache Kafka, enable the **Advertised Listener for Kafka** option. diff --git a/tidb-cloud/set-up-vpc-peering-connections.md b/tidb-cloud/set-up-vpc-peering-connections.md index 39735a3b87d03..93c8372881df5 100644 --- a/tidb-cloud/set-up-vpc-peering-connections.md +++ b/tidb-cloud/set-up-vpc-peering-connections.md @@ -11,7 +11,7 @@ summary: Learn how to connect to TiDB Cloud Dedicated via VPC peering. To connect your application to TiDB Cloud via VPC peering, you need to set up [VPC peering](/tidb-cloud/tidb-cloud-glossary.md#vpc-peering) with TiDB Cloud. This document walks you through setting up VPC peering connections [on AWS](#set-up-vpc-peering-on-aws) and [on Google Cloud](#set-up-vpc-peering-on-google-cloud) and connecting to TiDB Cloud via a VPC peering. -VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IP addresses. Instances in either VPC can communicate with each other as if they are within the same network. +VPC peering is a networking connection between two VPCs that enables you to route traffic between them using private IP addresses. Instances in either VPC can communicate with each other as if they are within the same network. Currently, TiDB clusters of the same project in the same region are created in the same VPC. Therefore, once VPC peering is set up in a region of a project, all the TiDB clusters created in the same region of this project can be connected in your VPC. VPC peering setup differs among cloud providers.