diff --git a/tidb-cloud/byoc/byoc-configure-iam-permissions.md b/tidb-cloud/byoc/byoc-configure-iam-permissions.md index d34dee3bc6183..c81a3717356f5 100644 --- a/tidb-cloud/byoc/byoc-configure-iam-permissions.md +++ b/tidb-cloud/byoc/byoc-configure-iam-permissions.md @@ -23,7 +23,6 @@ Use the table below to map the required parameters for the script: | `` | **TiDB Support** | The AWS Account ID of the TiDB Control Plane. | | `` | **TiDB Support** | The AWS Account ID for the TiDB Clinic service. | | `` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ID of the TiDB Cluster Hosted Zone you created. | -| `` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ID of the Observability Hosted Zone you created. | | `` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ARN of the Private CA you created. | ## Execute bootstrapping script @@ -37,7 +36,6 @@ Use the table below to map the required parameters for the script: --control-plane-id \ --clinic-id \ --tidb-hz-id \ - --o11y-hz-id \ --pca-arn ``` diff --git a/tidb-cloud/byoc/byoc-onboarding-overview.md b/tidb-cloud/byoc/byoc-onboarding-overview.md index e6106e9f3ea4a..f5abf60da9e2a 100644 --- a/tidb-cloud/byoc/byoc-onboarding-overview.md +++ b/tidb-cloud/byoc/byoc-onboarding-overview.md @@ -15,7 +15,7 @@ The TiDB Cloud BYOC deployment process is a collaborative effort between your or | Phase | Responsibility | Description | | :---- | :---- | :---- | -| [Phase 1: Environment preparation](/tidb-cloud/byoc/byoc-prepare-environment-aws.md) | Customer | Prepare the AWS foundation required for deployment. This includes creating a dedicated AWS account, configuring Route 53 hosted zones, and setting up the private certificate authority (PCA). | +| [Phase 1: Environment preparation](/tidb-cloud/byoc/byoc-prepare-environment-aws.md) | Customer | Prepare the AWS foundation required for deployment. This includes creating a dedicated AWS account, configuring a public or private Route 53 hosted zone for TiDB, and setting up the private certificate authority (PCA). | | [Phase 2: IAM bootstrapping](/tidb-cloud/byoc/byoc-configure-iam-permissions.md) | Customer | Execute the provided bootstrapping scripts to install the necessary IAM roles and policies. This authorizes the TiDB Cloud Control Plane to securely manage resources within your AWS account. | | [Phase 3: Automated region deployment](/tidb-cloud/byoc/byoc-automated-deployment.md) | TiDB Cloud | Once IAM permissions are verified, TiDB Cloud automatically provisions the VPC, EKS clusters, and control plane resources. Note: This process is **fully automated** and requires no customer intervention. | | [Phase 4: Service initialization](/tidb-cloud/byoc/byoc-initialize-service.md) | Customer | Create your TiDB instance via the console. Subsequently, [configure a Bastion Host](/tidb-cloud/byoc/byoc-configure-bastion-host.md) and authentication scripts to establish secure maintenance channels (Tailscale) and observability pipelines. Note: You may also choose to establish maintenance channels using your own custom methods. | diff --git a/tidb-cloud/byoc/byoc-prepare-environment-aws.md b/tidb-cloud/byoc/byoc-prepare-environment-aws.md index 7d7be31ed64a2..bb765f2a42c1f 100644 --- a/tidb-cloud/byoc/byoc-prepare-environment-aws.md +++ b/tidb-cloud/byoc/byoc-prepare-environment-aws.md @@ -41,48 +41,22 @@ TiDB is a distributed database that requires specific infrastructure for high av > > Multi-AZ deployment functionality is disabled for this configuration. -## Step 4. Create hosted zones for TiDB and observability (O11Y) +## Step 4. Create a hosted zone for TiDB -You need to create two separate **public hosted zones** in Amazon Route 53. +Create one Amazon Route 53 hosted zone for TiDB service DNS. You do not need to provide a hosted zone for observability (O11Y). -1. **Create the Zones.** +Choose one of the following hosted zone types: - Follow the [Creating a public hosted zone in AWS documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.html) to create the following: +- **Public hosted zone:** supports public and private connections to TiDB. Follow [Creating a public hosted zone in AWS documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.html). +- **Private hosted zone:** supports private connections only. If you choose a private hosted zone, public connection is not available for the BYOC environment. Follow [Working with private hosted zones](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html). - - **TiDB Cluster Zone:** Manages DNS for the TiDB Service. +For the TiDB hosted zone, use a name of no more than 38 characters. For example, `byoc.cluster.example.com`. - * Naming Constraint: Max 38 characters. - * Example: `byoc.cluster.example.com`. +For a public hosted zone, delegate the zone from its parent domain by adding the Route 53 name server (NS) records to the parent DNS configuration. For a private hosted zone, associate the hosted zone with the VPCs that require DNS resolution. - - **Observability (O11y) Zone:** Manages DNS for monitoring tools (Grafana/Prometheus). - - * Naming Constraint: Max 34 characters. - * Example: `o11y.cluster.example.com`. - -2. **Delegate DNS.** - - > **Important:** - > - > **DNS Delegation Required.** After creating the hosted zones, you **must** add Route 53 Name Servers (NS records) to your parent domain's DNS configuration (for example, in your corporate DNS or parent AWS zone). - - - **Action:** Copy the 4 NS records from your new Route 53 zones and add them to the parent domain. - - **Result:** Without this, internal service discovery will fail. - -3. **Verify the DNS delegation.** - - Verify the DNS delegation by running `nslookup` or `dig` from any internet-connected command-line environment. The domain must resolve correctly. - - ```bash - nslookup -type=ns {hosted_zone_name} - nslookup -type=ns byoc-tidb.cluster.example.com - nslookup -type=ns o11y.cluster.example.com - ``` - - - - > **Note:** - > - > If you plan to deploy TiDB Cloud BYOC in **multiple AWS regions**, the same hosted zones can be shared across all regions, or you can choose to create dedicated hosted zones per region. See [Multi-Region Deployment](/tidb-cloud/byoc/multi-region-deployment.md) for detailed multi-region architecture configurations. +> **Note:** +> +> If you plan to deploy TiDB Cloud BYOC in multiple AWS Regions, you can share the same TiDB hosted zone across all regions or use a dedicated hosted zone for each region. See [Multi-Region Deployment](/tidb-cloud/byoc/multi-region-deployment.md) for details. ## Step 5. Set up private certificate authority (PCA) @@ -156,7 +130,7 @@ Fill out the table below with the information gathered in steps above and share | **AWS Region** | Region selected for deployment | `us-west-2`, `us-east-1`, `us-east-2` | Step 3. For multi-region deployment, list all regions. | | **Availability Zones** | 3 AZs or single AZ per region (specify names and ID) | **Us-east-1:** `us-east-1a`, `use1-az1`, `us-east-1b`, `use1-az2`, `us-east-1c`, `use1-az4`; **Us-east-2:** `us-east-2a`, `use2-az1`, `us-east-2b`, `use2-az2`, `us-east-2c`, `use2-az3`; **Us-west-2:** `us-west-2a`, `usw2-az1` | Step 3. Note to meet the AZ quantity requirement for **each** selected region. | | **Subordinate CA ARN** | AWS ACM Private CA ARN | `arn:aws:acm-pca:us-west-2:123456789012:ca/abcd-1234` | Step 5. The ARN can be shared across multiple regions. | -| **Hosted Zone Names & Host Zone ID** | TiDB Cluster Zone, Observability (O11Y) Zone | **Hosted TiDB cluster zone name:** `clusters.byoc-0929.pingcap.net`; **Hosted TiDB cluster zone ID:** `Z1039122VAY4T8UNWR8E`. **Hosted O11Y zone name:** `o11y.byoc-0929.pingcap.net`; **Hosted O11Y zone ID:** `Z10389823CTXFNM7VG79P`. | Step 4. The zone names and IDs can be shared across multiple regions. | +| **Hosted Zone Name & Hosted Zone ID** | TiDB hosted zone. You can provide either a public or private hosted zone. | **Hosted TiDB zone name:** `clusters.byoc-0929.pingcap.net`; **Hosted TiDB zone ID:** `Z1039122VAY4T8UNWR8E`. | Step 4. The hosted zone can be shared across multiple regions. | | **CIDR** | Customer-planned CIDR range for the TiDB cluster, Customer-planned CIDR range for the O11Y cluster | **TiDB cluster CIDR:** `10.10.0.0/16`; **O11Y cluster CIDR:** `10.20.0.0/16` | Step 6 | | **Image Sync Region** | Region ID chosen for image synchronization | `us-west-2` | Refer to [image synchronization](/tidb-cloud/byoc/byoc-automated-deployment.md#step-1-image-synchronization) for details. | diff --git a/tidb-cloud/byoc/multi-region-deployment.md b/tidb-cloud/byoc/multi-region-deployment.md index 4d06b5a4c3933..9326d52eaea3d 100644 --- a/tidb-cloud/byoc/multi-region-deployment.md +++ b/tidb-cloud/byoc/multi-region-deployment.md @@ -23,29 +23,26 @@ Before configuring multiple regions, determine whether the following foundationa * AWS private certificate authority (PCA) * Route 53 hosted zone for TiDB -* Route 53 hosted zone for O11Y ### Shared resources -The same PCA, TiDB hosted zone, and O11Y hosted zone can be shared across all enabled regions. +The same PCA and TiDB hosted zone can be shared across all enabled regions. -In this configuration, provide the primary PCA and Hosted Zones through the standard parameters and omit the corresponding \--additional-\* parameters. +In this configuration, provide the primary PCA and TiDB hosted zone through the standard parameters and omit the corresponding `--additional-*` parameters. ### Dedicated resources -You can prepare a separate PCA, TiDB hosted zone, and O11Y hosted zone for each additional region. +You can prepare a separate PCA and TiDB hosted zone for each additional region. The primary region resources are provided through the standard parameters: * `--pca-arn` * `--tidb-hz-id` -* `--o11y-hz-id` Resources for additional regions are provided through: * `--additional-pca-arns` * `--additional-tidb-hz-ids` -* `--additional-o11y-hz-ids` For two or more additional regions, provide the values as comma-separated lists in the same regional order. @@ -53,7 +50,7 @@ For two or more additional regions, provide the values as comma-separated lists Shared and dedicated resources can be combined. -For example, all regions can share the same PCA while using separate Hosted Zones. +For example, all regions can share the same PCA while using separate TiDB hosted zones. Each additional resource parameter is independent. Omit a parameter when the corresponding resource will remain shared with the primary region. @@ -65,14 +62,13 @@ Run `tidbcloud-byoc-setup.sh` to initialize the BYOC environment and configure t ### All regions share the same resources -When all regions share the same PCA and hosted zones, run the standard setup command: +When all regions share the same PCA and TiDB hosted zone, run the standard setup command: ```shell bash tidbcloud-byoc-setup.sh \ --control-plane-id \ --clinic-id \ --tidb-hz-id \ - --o11y-hz-id \ --pca-arn ``` @@ -87,10 +83,8 @@ bash tidbcloud-byoc-setup.sh \ --control-plane-id \ --clinic-id \ --tidb-hz-id \ - --o11y-hz-id \ --pca-arn \ --additional-tidb-hz-ids , \ - --additional-o11y-hz-ids , \ --additional-pca-arns , ``` @@ -101,17 +95,15 @@ The values in all comma-separated lists must follow the same regional order. For ### Mixed shared and dedicated resources -The following example shares one PCA across all regions while using dedicated hosted zones: +The following example shares one PCA across all regions while using dedicated TiDB hosted zones: ```shell bash tidbcloud-byoc-setup.sh \ --control-plane-id \ --clinic-id \ --tidb-hz-id \ - --o11y-hz-id \ --pca-arn \ - --additional-tidb-hz-ids , \ - --additional-o11y-hz-ids , + --additional-tidb-hz-ids , ``` Because the PCA is shared, `--additional-pca-arns` is omitted. @@ -132,8 +124,8 @@ Before running the update script: 2. Select the Availability Zones for the new regions. 3. Plan the TiDB Cluster CIDR and O11Y CIDR for each new region. 4. Confirm whether each new region will: - * share the existing PCA and hosted zones, or - * use dedicated PCA and hosted zones. + * share the existing PCA and TiDB hosted zone, or + * use a dedicated PCA and TiDB hosted zone. 5. Review and increase AWS service quotas in each new region. 6. Share the information for the new regions with your TiDB Cloud representative. @@ -143,9 +135,9 @@ The CIDR ranges for the new regions must not overlap with: * existing application VPCs, on-premises networks, or VPN networks that will be connected through VPC Peering or VPN; or * other TiDB clusters that will participate in cross-region replication. -### Share existing PCA and hosted zones +### Share an existing PCA and TiDB hosted zone -Use this option if all new regions will share the PCA and hosted zones already used by the existing deployment. +Use this option if all new regions will share the PCA and TiDB hosted zone already used by the existing deployment. No additional resource parameters are required: @@ -160,7 +152,7 @@ A plain \--stack all update is safe when no new multi-region resource values are ### Use dedicated resources for the new regions -Use this option if the new regions require dedicated PCAs, TiDB hosted zones, or O11Y hosted zones. +Use this option if the new regions require dedicated PCAs or TiDB hosted zones. Provide the resources for the new Regions through the corresponding `--additional-*` parameters: @@ -168,8 +160,7 @@ Provide the resources for the new Regions through the corresponding `--additiona bash tidbcloud-byoc-update.sh \ --stack all \ --additional-pca-arns , \ - --additional-tidb-hz-ids , \ - --additional-o11y-hz-ids , + --additional-tidb-hz-ids , ``` @@ -184,12 +175,12 @@ The values in all comma-separated lists must follow the same regional order. For The new regions can share some existing resources while using dedicated resources for others. -For example, to share the existing PCA while using dedicated hosted zones for the new regions: +For example, to share the existing PCA while using dedicated TiDB hosted zones for the new regions: ```shell bash tidbcloud-byoc-update.sh \ ---stack all \ ---additional-tidb-hz-ids , \ --additional-o11y-hz-ids , + --stack all \ + --additional-tidb-hz-ids , ``` Because the existing PCA is shared, `--additional-pca-arns` is omitted. @@ -208,8 +199,7 @@ For example, if Region 1 is the primary region, Region 2 is already configured, bash tidbcloud-byoc-update.sh \ --stack all \ --additional-pca-arns , \ - --additional-tidb-hz-ids , \ - --additional-o11y-hz-ids , + --additional-tidb-hz-ids , ``` Ensure that previously configured and newly added resource values remain in the correct regional order. diff --git a/tidb-cloud/premium/connect-to-premium-via-public-connection.md b/tidb-cloud/premium/connect-to-premium-via-public-connection.md index 1e06810ba52c6..f90514022d93a 100644 --- a/tidb-cloud/premium/connect-to-premium-via-public-connection.md +++ b/tidb-cloud/premium/connect-to-premium-via-public-connection.md @@ -7,6 +7,14 @@ summary: Learn how to connect to your {{{ .premium }}} via public connection. This document describes how to connect to your {{{ .premium }}} or {{{ .byoc }}} instance via public connection. The public connection exposes a public endpoint with traffic filters, so you can connect to your {{{ .premium }}} or {{{ .byoc }}} instance via a SQL client from your laptop. + + +> **Note:** +> +> Public connection is available only if you provided a public hosted zone during BYOC deployment. If you provided a private hosted zone, connect to your instance through a private connection instead. + + + > **Tip:** > > - To learn how to connect to a {{{ .starter }}} or {{{ .essential }}} instance via public connection, see [Connect to {{{ .starter }}} or Essential via Public Endpoint](/tidb-cloud/connect-via-standard-connection-serverless.md).