Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 25 additions & 6 deletions tidb-cloud/configure-ip-access-list.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ For each TiDB Cloud Dedicated cluster in TiDB Cloud, you can configure an IP acc
>
> This document applies to [**TiDB Cloud Dedicated**](/tidb-cloud/select-cluster-tier.md#tidb-cloud-dedicated). For instructions on configuring an IP access list for **{{{ .starter }}}** or **{{{ .essential }}}**, see [Configure {{{ .starter }}} or Essential Firewall Rules for Public Endpoints](/tidb-cloud/configure-serverless-firewall-rules-for-public-endpoints.md).

To configure an IP access list for your TiDB Cloud Dedicated cluster, take the following steps:
## Add an IP address

To add an IP address to the IP access list for your TiDB Cloud Dedicated cluster, take the following steps:

1. Navigate to the [**My TiDB**](https://tidbcloud.com/tidbs) page, and then click the name of your target TiDB Cloud Dedicated cluster to go to its overview page.

Expand All @@ -21,10 +23,27 @@ To configure an IP access list for your TiDB Cloud Dedicated cluster, take the f

2. In the left navigation pane, click **Settings** > **Networking**.
3. On the **Networking** page, click **Add IP Address**.
4. In the displayed dialog, choose one of the following options:
4. In the **Add IP Address** dialog, add IP addresses with an optional description. For each TiDB Cloud Dedicated cluster, you can add up to 100 IP addresses.

- To add a custom IP address, click the **+** icon, enter the IP address in CIDR notation (for example, `192.168.1.1/32`), and add a description.
- To add the current IP address of your computer, click **Add Current IP**.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Identify the detected address as public.

The cluster receives the source address after network translation. “IP address of your computer” can imply a private local address. A private address will not permit a public connection.

Suggested change
- To add the current IP address of your computer, click **Add Current IP**.
- To add your computer's current public IP address, click **Add Current IP**.

As per path instructions: **/*.md requires a GitHub committable suggestion for an actionable issue when the fix is contiguous.

Source: Path instructions

- To allow any IP address to access your cluster, click **Allow access from anywhere**. This adds the `0.0.0.0/0` CIDR entry. This is highly risky and NOT recommended for production environments.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Limit the access description to IPv4.

0.0.0.0/0 matches every IPv4 address. It does not match IPv6 addresses. The current text overstates the access granted by Allow access from anywhere.

Suggested change
- To allow any IP address to access your cluster, click **Allow access from anywhere**. This adds the `0.0.0.0/0` CIDR entry. This is highly risky and NOT recommended for production environments.
- To allow any IPv4 address to access your cluster, click **Allow access from anywhere**. This adds the `0.0.0.0/0` CIDR entry. This is highly risky and NOT recommended for production environments.

As per path instructions: **/*.md requires a GitHub committable suggestion for an actionable issue when the fix is contiguous.

🧰 Tools
🪛 LanguageTool

[style] ~30-~30: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...mputer, click Add Current IP. - To allow any IP address to access your clu...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)

Source: Path instructions


5. Click **Save**.

## Edit an IP address

To edit an existing IP address in the IP access list, take the following steps:

1. On the **Networking** page, locate the IP address you want to edit in the **IP Access List**.
2. Click **...** in the row of the IP address, and then click **Edit**.
3. In the **Edit IP Address** dialog, modify the IP address or description as needed.
4. Click **Submit**.

## Delete an IP address

- **Allow access from anywhere**: allows all IP addresses to access TiDB Cloud. This option exposes your TiDB Cloud Dedicated cluster to the internet completely and is highly risky.
- **Use IP addresses** (recommended): you can add a list of IPs and CIDR addresses that are allowed to access TiDB Cloud via a SQL client.
To delete an existing IP address from the IP access list, take the following steps:

5. If you choose **Use IP addresses**, add IP addresses or CIDR range with an optional description. For each TiDB Cloud Dedicated cluster, you can add up to 100 IP addresses.
6. Click **Confirm** to save your changes.
1. On the **Networking** page, locate the IP address you want to delete in the **IP Access List**.
2. Click **...** in the row of the IP address, and then click **Delete**.
3. In the confirmation dialog, click **Delete**.
8 changes: 4 additions & 4 deletions tidb-cloud/premium/set-up-sink-private-endpoint-premium.md
Original file line number Diff line number Diff line change
Expand Up @@ -74,8 +74,8 @@ The configuration steps vary depending on the cloud provider where your instance
<SimpleTab>
<div label="AWS">

1. On the **Networking** page, click **Create Private Endpoint** in the **AWS Private Endpoint for Changefeed** section.
2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint.
1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **AWS Private Endpoints for External Services** section.
2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint.
3. Follow the reminder to authorize the [AWS Principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-accounts) of TiDB Cloud to create an endpoint.
4. Enter the **Endpoint Service Name** that you collected in the [Network](#network) section.
5. Select the **Number of AZs**. Ensure that the number of AZs and the AZ IDs match your Kafka deployment.
Expand All @@ -93,8 +93,8 @@ The configuration steps vary depending on the cloud provider where your instance

<div label="Alibaba Cloud">

1. On the **Networking** page, click **Create Private Endpoint** in the **Alibaba Cloud Private Endpoint for Changefeed** section.
2. In the **Create Private Endpoint for Changefeed** dialog, enter a name for the private endpoint.
1. On the **Networking** page, click **Create Private Endpoint for External Services** in the **Alibaba Cloud Private Endpoints for External Services** section.
2. In the **Create Private Endpoint for External Services** dialog, enter a name for the private endpoint.
3. Follow the reminder to add TiDB Cloud's Alibaba Cloud account ID to the allowlist of your endpoint service to grant TiDB Cloud VPC access. For more information, see [managing account IDs in the allowlist of an endpoint service](https://www.alibabacloud.com/help/en/privatelink/user-guide/add-and-manage-service-whitelists).
4. Enter the **Endpoint Service Name** that you collected in the [Network](#network) section.
5. Select the **Number of AZs**. Ensure that the number of AZs and the AZ IDs match your Kafka deployment.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Alib
To view the Alibaba Cloud account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the Alibaba Cloud account ID and availability zones.

## Step 1. Set up an ApsaraDB RDS for MySQL instance
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Amaz
To view the AWS account ID and availability zones:

1. In the [TiDB Cloud console](https://tidbcloud.com), go to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the dialog, note the AWS account ID and availability zones.

## Prerequisites for the Amazon MSK Provisioned cluster
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ This document describes how to connect a {{{ .essential }}} instance to a [Confl
To view the AWS account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the AWS account ID and availability zones.

## Step 1. Set up a Confluent Cloud network
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ This document describes how to connect a {{{ .essential }}} instance to an [Amaz
To view the AWS account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the AWS account ID and availability zones.

## Step 1. Set up the Amazon RDS instance
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ For example, the port mapping is as follows:
To view the Alibaba Cloud account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the Alibaba Cloud account ID and availability zones.

The following table shows an example of the deployment information.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ The mechanism works as follows:
To view the AWS account ID and availability zones, do the following:

1. In the [TiDB Cloud console](https://tidbcloud.com), navigate to the overview page of your {{{ .essential }}} instance, and then click **Settings** > **Networking** in the left navigation pane.
2. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection**.
2. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.
3. In the displayed dialog, you can find the AWS account ID and availability zones.

The following table shows an example of the deployment information.
Expand Down
31 changes: 17 additions & 14 deletions tidb-cloud/serverless-private-link-connection.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ Ensure that the AWS endpoint service:
- Add the TiDB Cloud account ID to the **Allow principals** list.
- Has availability zones that overlap with your {{{ .essential }}} instance.

You can get the account ID and availability zones information at the bottom of the **Create Private Link Connection** dialog, or by running the following command:
You can get the account ID and availability zones information at the bottom of the **Create Private Endpoint for External Services** dialog, or by running the following command:

```shell
ticloud serverless private-link-connection zones --cluster-id <cluster-id>
Expand All @@ -56,13 +56,14 @@ ticloud serverless private-link-connection zones --cluster-id <cluster-id>

2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane.

3. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection** to create a private endpoint in endpoint shared mode. In this model, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region.
3. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.

> **Note:**
>
> If your TiDB Cloud Essential instance is created after June 30, 2026 and the **Private Link Connection For Dataflow** area is not available, you can create a private link connection in endpoint exclusive mode by clicking **Create Private Endpoint for External Services** in the **AWS Private Endpoint for External Services** area instead. In the endpoint exclusive model, each {{{ .essential }}} instance uses its own standalone private endpoint. This model eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting.
> - If your TiDB Cloud Essential instance is created on July 1, 2026 or later, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint exclusive mode. In this mode, each {{{ .essential }}} instance uses its own standalone private endpoint, which eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting.
> - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region.

4. In the **Create Private Link Connection** dialog, enter the required information:
4. In the **Create Private Endpoint for External Services** dialog, enter the required information:

- **Private Link Connection Name**: enter a name for the private link connection.
- **Connection Type**: select **AWS Endpoint Service**. If this option is not displayed, ensure that your {{{ .essential }}} instance is created on AWS.
Expand Down Expand Up @@ -103,13 +104,14 @@ Before creating the Amazon MSK Provisioned private link connection, ensure that

2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane.

3. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection** to create a private endpoint in endpoint shared mode. In this model, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region.
3. In the **AWS Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.

> **Note:**
>
> If your TiDB Cloud Essential instance is created after June 30, 2026 and the **Private Link Connection For Dataflow** area is not available, you can create a private link connection in endpoint exclusive mode by clicking **Create Private Endpoint for External Services** in the **Amazon MSK Provisioned Private Endpoint for External Services** area instead. In the endpoint exclusive model, each {{{ .essential }}} instance uses its own standalone private endpoint. This model eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting.
> - If your TiDB Cloud Essential instance is created on July 1, 2026 or later, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint exclusive mode. In this mode, each {{{ .essential }}} instance uses its own standalone private endpoint, which eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting.
> - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region.

4. In the **Create Private Link Connection** dialog, enter the required information:
4. In the **Create Private Endpoint for External Services** dialog, enter the required information:

- **Private Link Connection Name**: enter a name for the private link connection.
- **Connection Type**: select **Amazon MSK Provisioned**. If this option is not displayed, ensure that your {{{ .essential }}} instance is created on AWS.
Expand All @@ -127,7 +129,7 @@ Ensure that the Alibaba Cloud endpoint service:
- Add the TiDB Cloud account ID to the **Service Whitelist**.
- Has availability zones that overlap with your {{{ .essential }}} instance.

You can get the account ID and available zones information at the bottom of the **Create Private Link Connection** dialog, or by running the following command:
You can get the account ID and available zones information at the bottom of the **Create Private Endpoint for External Services** dialog, or by running the following command:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Use the established term availability zones.

Line 132 introduces available zones, while this file already uses availability zones for the same concept.

Suggested change
You can get the account ID and available zones information at the bottom of the **Create Private Endpoint for External Services** dialog, or by running the following command:
You can get the account ID and availability zones information at the bottom of the **Create Private Endpoint for External Services** dialog, or by running the following command:

As per coding guidelines, do not introduce new terminology when an established term exists.

Source: Coding guidelines


```shell
ticloud serverless private-link-connection zones --cluster-id <cluster-id>
Expand All @@ -144,13 +146,14 @@ ticloud serverless private-link-connection zones --cluster-id <cluster-id>

2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane.

3. In the **Private Link Connection For Dataflow** area, click **Create Private Link Connection** to create a private endpoint in endpoint shared mode. In this model, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same Alibaba Cloud Region.
3. In the **Alibaba Cloud Private Endpoints for External Services** area, click **Create Private Endpoint for External Services**.

> **Note:**
>
> If your TiDB Cloud Essential instance is created after June 30, 2026 and the **Private Link Connection For Dataflow** area is not available, you can create a private link connection in endpoint exclusive mode by clicking **Create Private Endpoint for External Services** in the **Alibaba Cloud Private Endpoint for External Services** area instead. In the endpoint exclusive model, each {{{ .essential }}} instance uses its own standalone private endpoint. This model eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting.
> - If your TiDB Cloud Essential instance is created on July 1, 2026 or later, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint exclusive mode. In this mode, each {{{ .essential }}} instance uses its own standalone private endpoint, which eliminates the need to include the [account prefix](/tidb-cloud/select-cluster-tier.md#user-name-prefix) when connecting.
> - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Correct the Alibaba Cloud region name.

This Alibaba Cloud workflow says AWS Region. Use Alibaba Cloud Region instead. (docs.pingcap.com)

Suggested change
> - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same AWS Region.
> - If your TiDB Cloud Essential instance is created before July 1, 2026, clicking **Create Private Endpoint for External Services** creates a private link connection in endpoint shared mode. In this mode, a single private endpoint can be shared by multiple {{{ .essential }}} instances in the same Alibaba Cloud Region.

Source: MCP tools


4. In the **Create Private Link Connection** dialog, enter the required information:
4. In the **Create Private Endpoint for External Services** dialog, enter the required information:

- **Private Link Connection Name**: enter a name for the private link connection.
- **Connection Type**: select **Alibaba Cloud Endpoint Service**. If this option is not displayed, ensure that your {{{ .essential }}} instance is created on Alibaba Cloud.
Expand Down Expand Up @@ -206,7 +209,7 @@ To attach domains to a private link connection using the TiDB Cloud console, do

2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane.

3. In the **Private Link Connection For Dataflow** area, choose the target private link connection, and then click **...**.
3. In the **Private Endpoints for External Services** area for your cloud provider, choose the target private link connection, and then click **...**.

4. Click **Attach Domains**.

Expand Down Expand Up @@ -259,7 +262,7 @@ To detach domains from a private link connection using the TiDB Cloud console, d

2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane.

3. In the **Private Link Connection For Dataflow** area, choose the target private link connection, and then click **...**.
3. In the **Private Endpoints for External Services** area for your cloud provider, choose the target private link connection, and then click **...**.

4. Click **Detach Domains**, and then confirm the detachment.

Expand Down Expand Up @@ -301,7 +304,7 @@ To delete a private link connection using the TiDB Cloud console, do the followi

2. Click the name of your target {{{ .essential }}} instance to go to its overview page, and then click **Settings** > **Networking** in the left navigation pane.

3. In the **Private Link Connection For Dataflow** area, choose the target private link connection, and then click **...**.
3. In the **Private Endpoints for External Services** area for your cloud provider, choose the target private link connection, and then click **...**.

4. Click **Delete**, and then confirm the deletion.

Expand Down
Loading