Update to CockroachDB

{
  "description": "Configures and hardens IP allowlists for CockroachDB Cloud clusters to restrict network access to authorized CIDR ranges. Use when tightening network security, removing overly permissive allowlist entries like 0.0.0.0/0, or setting up allowlists for a new cluster.",
  "included_files": [
    {
      "relative_path": "references/ccloud-commands.md",
      "size_in_bytes": 2931
    }
  ],
  "name": "configuring-ip-allowlists",
  "skill_md_contents": "---\nname: configuring-ip-allowlists\ndescription: Configures and hardens IP allowlists for CockroachDB Cloud clusters to restrict network access to authorized CIDR ranges. Use when tightening network security, removing overly permissive allowlist entries like 0.0.0.0/0, or setting up allowlists for a new cluster.\ncompatibility: Requires ccloud CLI with Cluster Admin or Cluster Operator role.\n---\n\n# Configuring IP Allowlists\n\nConfigures and hardens IP allowlists on CockroachDB Cloud clusters to restrict SQL and DB Console access to authorized CIDR ranges. Identifies overly permissive entries (such as `0.0.0.0/0`) and replaces them with specific, narrow ranges.\n\n## When to Use This Skill\n\n- Removing `0.0.0.0/0` (open to all) from the IP allowlist\n- Restricting network access after initial cluster setup\n- Adding office, VPN, or CI/CD CIDR ranges to the allowlist\n- Reviewing and tightening existing allowlist entries\n- Responding to a security audit finding about overly broad network access\n\n## Prerequisites\n\n- **ccloud CLI** installed and authenticated (`ccloud auth login`)\n- **Cloud Console role:** Cluster Admin or Cluster Operator\n- **Known CIDR ranges:** Office IPs, VPN egress IPs, CI/CD runner IPs, or other authorized sources\n- **Cluster ID:** Available from `ccloud cluster list`\n\n**Verify access:**\n```bash\nccloud auth whoami\nccloud cluster list\n```\n\n## Steps\n\n### 1. List Current Allowlist Entries\n\n```bash\n# List all IP allowlist entries for the cluster\nccloud cluster networking allowlist list <cluster-id> -o json\n```\n\nReview each entry. Flag any of these as overly permissive:\n- `0.0.0.0/0` — Open to all IPv4 addresses\n- `/8` ranges — 16 million+ addresses\n- `/16` ranges — 65,000+ addresses\n- Unknown or undocumented entries\n\nSee [ccloud commands reference](references/ccloud-commands.md) for full command syntax.\n\n### 2. Understand Allowlist Limits\n\nCockroachDB Cloud clusters have a maximum number of IP allowlist entries per cluster. If you need more entries than the limit allows:\n\n- **Consolidate entries:** Use broader CIDR ranges where security permits (e.g., combine several `/32` entries into a `/24`)\n- **Use private endpoints:** Switch to [private endpoints](../configure-private-network/SKILL.md) instead of allowlists for VPC-based access — private endpoints bypass the allowlist entirely\n- **Request a limit increase:** Contact CockroachDB Cloud support if consolidation and private endpoints are not sufficient\n\n### 3. Identify Required CIDR Ranges\n\nBefore modifying the allowlist, document all legitimate access sources:\n\n| Source | CIDR | SQL Access | UI Access |\n|--------|------|------------|-----------|\n| Office network | `203.0.113.0/24` | Yes | Yes |\n| VPN egress | `198.51.100.0/24` | Yes | Yes |\n| CI/CD runners | `192.0.2.0/28` | Yes | No |\n| Monitoring | `10.0.1.5/32` | Yes | No |\n\n### 4. Add Specific CIDR Entries\n\n```bash\n# Add a specific CIDR range (CIDR is a positional argument)\nccloud cluster networking allowlist create <cluster-name> <cidr> \\\n  --sql \\\n  --ui \\\n  --name \"<description>\"\n```\n\n**Examples:**\n```bash\n# Office network — SQL and UI access\nccloud cluster networking allowlist create <cluster-name> 203.0.113.0/24 \\\n  --sql \\\n  --ui \\\n  --name \"Office network\"\n\n# CI/CD runners — SQL only\nccloud cluster networking allowlist create <cluster-name> 192.0.2.0/28 \\\n  --sql \\\n  --name \"CI/CD runners\"\n\n# Single IP — /32 for maximum specificity\nccloud cluster networking allowlist create <cluster-name> 198.51.100.42/32 \\\n  --sql \\\n  --ui \\\n  --name \"Developer workstation\"\n```\n\n### 5. Remove Overly Permissive Entries\n\n```bash\n# Delete the 0.0.0.0/0 entry (or other overly broad entries)\nccloud cluster networking allowlist delete <cluster-name> 0.0.0.0/0\n```\n\n**Important:** Only remove `0.0.0.0/0` after confirming your specific CIDR entries are in place and tested.\n\n### 6. Verify the Updated Allowlist\n\n```bash\n# Confirm the final allowlist\nccloud cluster networking allowlist list <cluster-id> -o json\n```\n\nTest connectivity from each authorized source:\n```bash\n# Test SQL connection from an allowed IP\ncockroach sql --url \"<connection-string>\" -e \"SELECT 1;\"\n\n# Test from a non-allowed IP (should fail)\n# Attempt connection from an IP not in the allowlist — expect connection refused\n```\n\n## Safety Considerations\n\n**Risk: Locking yourself out.** Removing `0.0.0.0/0` before adding your current IP will immediately block your access.\n\n**Mitigation steps:**\n1. **Identify your current IP** before making changes: `curl -s https://checkip.amazonaws.com`\n2. **Add your IP first** as a `/32` entry before removing broad ranges\n3. **Test connectivity** after adding specific entries but before removing `0.0.0.0/0`\n4. **Keep Cloud Console access** — the Cloud Console UI can modify allowlists even if SQL access is blocked\n\n**Order of operations:**\n1. Add all specific CIDR entries\n2. Verify SQL connectivity from each allowed source\n3. Remove `0.0.0.0/0` only after verifying all needed entries are in place\n4. Test again to confirm access still works\n\n## Rollback\n\nIf you lose access after removing a broad entry:\n\n1. **Cloud Console:** Log into the CockroachDB Cloud Console (web UI) — this does not use the IP allowlist\n2. **Re-add your IP:** Add your current IP as a `/32` or re-add `0.0.0.0/0` temporarily\n3. **Investigate:** Determine which CIDR was missing and add it\n\n```bash\n# Emergency: re-add 0.0.0.0/0 via ccloud (if you still have ccloud access)\nccloud cluster networking allowlist create <cluster-name> 0.0.0.0/0 \\\n  --sql \\\n  --ui \\\n  --name \"Emergency - temporary open access\"\n```\n\n## References\n\n**Skill references:**\n- [ccloud commands for IP allowlists](references/ccloud-commands.md)\n\n**Related skills:**\n- [auditing-cloud-cluster-security](../audit-cloud-security/SKILL.md) — Run a full security posture audit\n- [configuring-private-connectivity](../configure-private-network/SKILL.md) — Private endpoints as an alternative to IP allowlists\n\n**Official CockroachDB Documentation:**\n- [Network Authorization](https://www.cockroachlabs.com/docs/cockroachcloud/network-authorization.html)\n- [Private Clusters](https://www.cockroachlabs.com/docs/cockroachcloud/private-clusters.html)\n- [ccloud CLI Reference](https://www.cockroachlabs.com/docs/cockroachcloud/ccloud-get-started.html)\n"
}