Skip to content

delete-o11y-hosted-zone #23472

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wildpcww wants to merge 1 commit into
base: release-8.5
Choose a base branch
from
Open

delete-o11y-hosted-zone #23472

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions tidb-cloud/byoc/byoc-configure-iam-permissions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ Use the table below to map the required parameters for the script:
| `<ControlPlaneAccountId>` | **TiDB Support** | The AWS Account ID of the TiDB Control Plane. |
| `<ClinicAccountId>` | **TiDB Support** | The AWS Account ID for the TiDB Clinic service. |
| `<TidbHostedZoneId>` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ID of the TiDB Cluster Hosted Zone you created. |
| `<O11yHostedZoneId>` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ID of the Observability Hosted Zone you created. |
| `<TidbPCAArn>` | [Required information](/tidb-cloud/byoc/byoc-prepare-environment-aws.md#summary-required-information) | The ARN of the Private CA you created. |

## Execute bootstrapping script
Expand All @@ -37,7 +36,6 @@ Use the table below to map the required parameters for the script:
--control-plane-id <ControlPlaneAccountId> \
--clinic-id <ClinicAccountId> \
--tidb-hz-id <TidbHostedZoneId> \
--o11y-hz-id <O11yHostedZoneId> \
--pca-arn <TidbPCAArn>
```

Expand Down
2 changes: 1 addition & 1 deletion tidb-cloud/byoc/byoc-onboarding-overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ The TiDB Cloud BYOC deployment process is a collaborative effort between your or

| Phase | Responsibility | Description |
| :---- | :---- | :---- |
| [Phase 1: Environment preparation](/tidb-cloud/byoc/byoc-prepare-environment-aws.md) | Customer | Prepare the AWS foundation required for deployment. This includes creating a dedicated AWS account, configuring Route 53 hosted zones, and setting up the private certificate authority (PCA). |
| [Phase 1: Environment preparation](/tidb-cloud/byoc/byoc-prepare-environment-aws.md) | Customer | Prepare the AWS foundation required for deployment. This includes creating a dedicated AWS account, configuring a public or private Route 53 hosted zone for TiDB, and setting up the private certificate authority (PCA). |
| [Phase 2: IAM bootstrapping](/tidb-cloud/byoc/byoc-configure-iam-permissions.md) | Customer | Execute the provided bootstrapping scripts to install the necessary IAM roles and policies. This authorizes the TiDB Cloud Control Plane to securely manage resources within your AWS account. |
| [Phase 3: Automated region deployment](/tidb-cloud/byoc/byoc-automated-deployment.md) | TiDB Cloud | Once IAM permissions are verified, TiDB Cloud automatically provisions the VPC, EKS clusters, and control plane resources. Note: This process is **fully automated** and requires no customer intervention. |
| [Phase 4: Service initialization](/tidb-cloud/byoc/byoc-initialize-service.md) | Customer | Create your TiDB instance via the console. Subsequently, [configure a Bastion Host](/tidb-cloud/byoc/byoc-configure-bastion-host.md) and authentication scripts to establish secure maintenance channels (Tailscale) and observability pipelines. Note: You may also choose to establish maintenance channels using your own custom methods. |
Expand Down
48 changes: 11 additions & 37 deletions tidb-cloud/byoc/byoc-prepare-environment-aws.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,48 +41,22 @@ TiDB is a distributed database that requires specific infrastructure for high av
>
> Multi-AZ deployment functionality is disabled for this configuration.

## Step 4. Create hosted zones for TiDB and observability (O11Y)
## Step 4. Create a hosted zone for TiDB

You need to create two separate **public hosted zones** in Amazon Route 53.
Create one Amazon Route 53 hosted zone for TiDB service DNS. You do not need to provide a hosted zone for observability (O11Y).

1. **Create the Zones.**
Choose one of the following hosted zone types:

Follow the [Creating a public hosted zone in AWS documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.html) to create the following:
- **Public hosted zone:** supports public and private connections to TiDB. Follow [Creating a public hosted zone in AWS documentation](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.html).
- **Private hosted zone:** supports private connections only. If you choose a private hosted zone, public connection is not available for the BYOC environment. Follow [Working with private hosted zones](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/hosted-zones-private.html).

- **TiDB Cluster Zone:** Manages DNS for the TiDB Service.
For the TiDB hosted zone, use a name of no more than 38 characters. For example, `byoc.cluster.example.com`.

* Naming Constraint: Max 38 characters.
* Example: `byoc.cluster.example.com`.
For a public hosted zone, delegate the zone from its parent domain by adding the Route 53 name server (NS) records to the parent DNS configuration. For a private hosted zone, associate the hosted zone with the VPCs that require DNS resolution.

- **Observability (O11y) Zone:** Manages DNS for monitoring tools (Grafana/Prometheus).

* Naming Constraint: Max 34 characters.
* Example: `o11y.cluster.example.com`.

2. **Delegate DNS.**

> **Important:**
>
> **DNS Delegation Required.** After creating the hosted zones, you **must** add Route 53 Name Servers (NS records) to your parent domain's DNS configuration (for example, in your corporate DNS or parent AWS zone).

- **Action:** Copy the 4 NS records from your new Route 53 zones and add them to the parent domain.
- **Result:** Without this, internal service discovery will fail.

3. **Verify the DNS delegation.**

Verify the DNS delegation by running `nslookup` or `dig` from any internet-connected command-line environment. The domain must resolve correctly.

```bash
nslookup -type=ns {hosted_zone_name}
nslookup -type=ns byoc-tidb.cluster.example.com
nslookup -type=ns o11y.cluster.example.com
```

<!--To confirm: whether to add image-->

> **Note:**
>
> If you plan to deploy TiDB Cloud BYOC in **multiple AWS regions**, the same hosted zones can be shared across all regions, or you can choose to create dedicated hosted zones per region. See [Multi-Region Deployment](/tidb-cloud/byoc/multi-region-deployment.md) for detailed multi-region architecture configurations.
> **Note:**
>
> If you plan to deploy TiDB Cloud BYOC in multiple AWS Regions, you can share the same TiDB hosted zone across all regions or use a dedicated hosted zone for each region. See [Multi-Region Deployment](/tidb-cloud/byoc/multi-region-deployment.md) for details.
Comment on lines +55 to +59

@coderabbitai coderabbitai Bot Aug 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Files:"
git ls-files | rg '(^|/)byoc-prepare-environment-aws\.md$|(^|/)byoc-onboarding-overview\.md$|(^|/)multi-region-deployment\.md$|resources/doc-templates' || true

echo
echo "Target file excerpt:"
if [ -f tidb-cloud/byoc/byoc-prepare-environment-aws.md ]; then
  cat -n tidb-cloud/byoc/byoc-prepare-environment-aws.md | sed -n '1,120p'
fi

echo
echo "Overview file excerpt:"
if [ -f tidb-cloud/byoc/byoc-onboarding-overview.md ]; then
  cat -n tidb-cloud/byoc/byoc-onboarding-overview.md | sed -n '1,80p'
fi

echo
echo "Search relevant terms:"
rg -n -i "private hosted zone|associate|name server|NS|Route 53|hosted zone|provisioned|Phase 3|VPC" tidb-cloud/byoc resources/doc-templates || true

Repository: pingcap/docs

Length of output: 50368

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Byoc automated deployment excerpts:"
if [ -f tidb-cloud/byoc/byoc-automated-deployment.md ]; then
  wc -l tidb-cloud/byoc/byoc-automated-deployment.md
  cat -n tidb-cloud/byoc/byoc-automated-deployment.md | sed -n '1,240p'
fi

echo
echo "IAM script/config references to hosted zones:"
rg -n -i "Hosted Zone|HostedZone|hostedZone|Hosted Zone Id|HostedZoneId|TiDBHostedZone|TiDB hosted zone|Route53|route53|associate|VPC|VPCTiDB|Private Zone" tidb-cloud/byoc/byoc-configure-iam-permissions.md tidb-cloud/byoc/*.md || true

echo
echo "Search for automation/vpc/private-hosted-zone keywords in scripts/docs:"
rg -n -i "auto-deploy|create-.*vpc|route-53|private hosted zone|private-hosted|associate-hosted-zone|vpc-association|VPC Association" . --glob '!**/node_modules/**' --glob '!**/build/**' --glob '!**/dist/**' | head -n 200

Repository: pingcap/docs

Length of output: 23208

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Check for Route 53 hosted-zone scripts/templates:"
fd -a . . | rg -i 'hosted|route53|byoc|terraform|cloudformation|stack|setup|update|deploy|byoc-configure-iam-permissions' | sed 's#^\./##' | head -n 300

echo
echo "Search repository-wide for hosted zone association text (focused):"
rg -n -i "associate.*hosted zone|hosted zone.*associate|HostedZoneAssociations|hosted_zone_associations|CreateHostedZone|CreateVpcAssociation|VPCAssociation|hosted zone id" . --glob '!**/node_modules/**' --glob '!**/build/**' --glob '!**/dist/**' --glob '!**/.git/**' | head -n 300

echo
echo "Inspect relevant BYOC IAM/prepare file sizes and key references:"
wc -l tidb-cloud/byoc/byoc-prepare-environment-aws.md tidb-cloud/byoc/byoc-configure-iam-permissions.md

Repository: pingcap/docs

Length of output: 10860

Document the private hosted-zone association step.

The private hosted zone option says users must associate the zone with VPCs, but the BYOC VPC is provisioned later in Phase 3 and this step only asks customers to create/configure the hosted zone. Clarify when the TiDB cluster VPC exists, who performs the Route 53 VPC association, and whether cross-account association is supported or requires TiDB Cloud assistance.

🧰 Tools
🪛 LanguageTool

[style] ~55-~55: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ecords to the parent DNS configuration. For a private hosted zone, associate the ho...

(ENGLISH_WORD_REPEAT_BEGINNING_RULE)


## Step 5. Set up private certificate authority (PCA)

Expand Down Expand Up @@ -156,7 +130,7 @@ Fill out the table below with the information gathered in steps above and share
| **AWS Region** | Region selected for deployment | `us-west-2`, `us-east-1`, `us-east-2` | Step 3. For multi-region deployment, list all regions. |
| **Availability Zones** | 3 AZs or single AZ per region (specify names and ID) | **Us-east-1:** `us-east-1a`, `use1-az1`, `us-east-1b`, `use1-az2`, `us-east-1c`, `use1-az4`; **Us-east-2:** `us-east-2a`, `use2-az1`, `us-east-2b`, `use2-az2`, `us-east-2c`, `use2-az3`; **Us-west-2:** `us-west-2a`, `usw2-az1` | Step 3. Note to meet the AZ quantity requirement for **each** selected region. |
| **Subordinate CA ARN** | AWS ACM Private CA ARN | `arn:aws:acm-pca:us-west-2:123456789012:ca/abcd-1234` | Step 5. The ARN can be shared across multiple regions. |
| **Hosted Zone Names & Host Zone ID** | TiDB Cluster Zone, Observability (O11Y) Zone | **Hosted TiDB cluster zone name:** `clusters.byoc-0929.pingcap.net`; **Hosted TiDB cluster zone ID:** `Z1039122VAY4T8UNWR8E`. **Hosted O11Y zone name:** `o11y.byoc-0929.pingcap.net`; **Hosted O11Y zone ID:** `Z10389823CTXFNM7VG79P`. | Step 4. The zone names and IDs can be shared across multiple regions. |
| **Hosted Zone Name & Hosted Zone ID** | TiDB hosted zone. You can provide either a public or private hosted zone. | **Hosted TiDB zone name:** `clusters.byoc-0929.pingcap.net`; **Hosted TiDB zone ID:** `Z1039122VAY4T8UNWR8E`. | Step 4. The hosted zone can be shared across multiple regions. |
| **CIDR** | Customer-planned CIDR range for the TiDB cluster, Customer-planned CIDR range for the O11Y cluster | **TiDB cluster CIDR:** `10.10.0.0/16`; **O11Y cluster CIDR:** `10.20.0.0/16` | Step 6 |
| **Image Sync Region** | Region ID chosen for image synchronization | `us-west-2` | Refer to [image synchronization](/tidb-cloud/byoc/byoc-automated-deployment.md#step-1-image-synchronization) for details. |

Expand Down
44 changes: 17 additions & 27 deletions tidb-cloud/byoc/multi-region-deployment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,37 +23,34 @@ Before configuring multiple regions, determine whether the following foundationa

* AWS private certificate authority (PCA)
* Route 53 hosted zone for TiDB
* Route 53 hosted zone for O11Y

### Shared resources

The same PCA, TiDB hosted zone, and O11Y hosted zone can be shared across all enabled regions.
The same PCA and TiDB hosted zone can be shared across all enabled regions.

In this configuration, provide the primary PCA and Hosted Zones through the standard parameters and omit the corresponding \--additional-\* parameters.
In this configuration, provide the primary PCA and TiDB hosted zone through the standard parameters and omit the corresponding `--additional-*` parameters.

### Dedicated resources

You can prepare a separate PCA, TiDB hosted zone, and O11Y hosted zone for each additional region.
You can prepare a separate PCA and TiDB hosted zone for each additional region.

The primary region resources are provided through the standard parameters:

* `--pca-arn`
* `--tidb-hz-id`
* `--o11y-hz-id`

Resources for additional regions are provided through:

* `--additional-pca-arns`
* `--additional-tidb-hz-ids`
* `--additional-o11y-hz-ids`

For two or more additional regions, provide the values as comma-separated lists in the same regional order.

### Mixed resources

Shared and dedicated resources can be combined.

For example, all regions can share the same PCA while using separate Hosted Zones.
For example, all regions can share the same PCA while using separate TiDB hosted zones.

Each additional resource parameter is independent. Omit a parameter when the corresponding resource will remain shared with the primary region.

Expand All @@ -65,14 +62,13 @@ Run `tidbcloud-byoc-setup.sh` to initialize the BYOC environment and configure t

### All regions share the same resources

When all regions share the same PCA and hosted zones, run the standard setup command:
When all regions share the same PCA and TiDB hosted zone, run the standard setup command:

```shell
bash tidbcloud-byoc-setup.sh \
--control-plane-id <ControlPlaneAccountId> \
--clinic-id <ClinicAccountId> \
--tidb-hz-id <SharedTidbHostedZoneId> \
--o11y-hz-id <SharedO11yHostedZoneId> \
--pca-arn <SharedPCAArn>
```

Expand All @@ -87,10 +83,8 @@ bash tidbcloud-byoc-setup.sh \
--control-plane-id <ControlPlaneAccountId> \
--clinic-id <ClinicAccountId> \
--tidb-hz-id <Region1TidbHostedZoneId> \
--o11y-hz-id <Region1O11yHostedZoneId> \
--pca-arn <Region1PCAArn> \
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId> \
--additional-o11y-hz-ids <Region2O11yHostedZoneId>,<Region3O11yHostedZoneId> \
--additional-pca-arns <Region2PCAArn>,<Region3PCAArn>
```

Expand All @@ -101,17 +95,15 @@ The values in all comma-separated lists must follow the same regional order. For

### Mixed shared and dedicated resources

The following example shares one PCA across all regions while using dedicated hosted zones:
The following example shares one PCA across all regions while using dedicated TiDB hosted zones:

```shell
bash tidbcloud-byoc-setup.sh \
--control-plane-id <ControlPlaneAccountId> \
--clinic-id <ClinicAccountId> \
--tidb-hz-id <Region1TidbHostedZoneId> \
--o11y-hz-id <Region1O11yHostedZoneId> \
--pca-arn <SharedPCAArn> \
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId> \
--additional-o11y-hz-ids <Region2O11yHostedZoneId>,<Region3O11yHostedZoneId>
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId>
```

Because the PCA is shared, `--additional-pca-arns` is omitted.
Expand All @@ -132,8 +124,8 @@ Before running the update script:
2. Select the Availability Zones for the new regions.
3. Plan the TiDB Cluster CIDR and O11Y CIDR for each new region.
4. Confirm whether each new region will:
* share the existing PCA and hosted zones, or
* use dedicated PCA and hosted zones.
* share the existing PCA and TiDB hosted zone, or
* use a dedicated PCA and TiDB hosted zone.
5. Review and increase AWS service quotas in each new region.
6. Share the information for the new regions with your TiDB Cloud representative.

Expand All @@ -143,9 +135,9 @@ The CIDR ranges for the new regions must not overlap with:
* existing application VPCs, on-premises networks, or VPN networks that will be connected through VPC Peering or VPN; or
* other TiDB clusters that will participate in cross-region replication.

### Share existing PCA and hosted zones
### Share an existing PCA and TiDB hosted zone

Use this option if all new regions will share the PCA and hosted zones already used by the existing deployment.
Use this option if all new regions will share the PCA and TiDB hosted zone already used by the existing deployment.

No additional resource parameters are required:

Expand All @@ -160,16 +152,15 @@ A plain \--stack all update is safe when no new multi-region resource values are

### Use dedicated resources for the new regions

Use this option if the new regions require dedicated PCAs, TiDB hosted zones, or O11Y hosted zones.
Use this option if the new regions require dedicated PCAs or TiDB hosted zones.

Provide the resources for the new Regions through the corresponding `--additional-*` parameters:

```shell
bash tidbcloud-byoc-update.sh \
--stack all \
--additional-pca-arns <Region2PCAArn>,<Region3PCAArn> \
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId> \
--additional-o11y-hz-ids <Region2O11yHostedZoneId>,<Region3O11yHostedZoneId>
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId>

```

Expand All @@ -184,12 +175,12 @@ The values in all comma-separated lists must follow the same regional order. For

The new regions can share some existing resources while using dedicated resources for others.

For example, to share the existing PCA while using dedicated hosted zones for the new regions:
For example, to share the existing PCA while using dedicated TiDB hosted zones for the new regions:

```shell
bash tidbcloud-byoc-update.sh \
--stack all \
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId> \ --additional-o11y-hz-ids <Region2O11yHostedZoneId>,<Region3O11yHostedZoneId>
--stack all \
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId>
```

Because the existing PCA is shared, `--additional-pca-arns` is omitted.
Expand All @@ -208,8 +199,7 @@ For example, if Region 1 is the primary region, Region 2 is already configured,
bash tidbcloud-byoc-update.sh \
--stack all \
--additional-pca-arns <Region2PCAArn>,<Region3PCAArn> \
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId> \
--additional-o11y-hz-ids <Region2O11yHostedZoneId>,<Region3O11yHostedZoneId>
--additional-tidb-hz-ids <Region2TidbHostedZoneId>,<Region3TidbHostedZoneId>
```

Ensure that previously configured and newly added resource values remain in the correct regional order.
Expand Down
8 changes: 8 additions & 0 deletions tidb-cloud/premium/connect-to-premium-via-public-connection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,14 @@ summary: Learn how to connect to your {{{ .premium }}} via public connection.

This document describes how to connect to your {{{ .premium }}}<CustomContent plan="byoc"> or {{{ .byoc }}}</CustomContent> instance via public connection. The public connection exposes a public endpoint with traffic filters, so you can connect to your {{{ .premium }}}<CustomContent plan="byoc"> or {{{ .byoc }}}</CustomContent> instance via a SQL client from your laptop.

<CustomContent plan="byoc">

> **Note:**
>
> Public connection is available only if you provided a public hosted zone during BYOC deployment. If you provided a private hosted zone, connect to your instance through a private connection instead.

</CustomContent>

> **Tip:**
>
> - To learn how to connect to a {{{ .starter }}} or {{{ .essential }}} instance via public connection, see [Connect to {{{ .starter }}} or Essential via Public Endpoint](/tidb-cloud/connect-via-standard-connection-serverless.md).
Expand Down
Loading