Configures private network connectivity for CockroachDB Cloud clusters including AWS PrivateLink, GCP Private Service Connect, Azure Private Link, egress private endpoints, and VPC peering. Use when setting up private endpoints to eliminate public internet exposure, configuring egress to external services like Kafka, or establishing VPC peering.
Configures private network connectivity for CockroachDB Cloud clusters including AWS PrivateLink, GCP Private Service Connect, Azure Private Link, egress private endpoints, and VPC peering. Use when setting up private endpoints to eliminate public internet exposure, configuring egress to external services like Kafka, or establishing VPC peering.
compatibility
Requires CockroachDB Cloud Advanced or Standard plan. Private endpoints require cloud provider configuration (AWS, GCP, or Azure). VPC peering requires Advanced plan.
metadata
{"author":"cockroachdb","version":"1.0"}
Configuring Private Connectivity
Configures private network connectivity for CockroachDB Cloud clusters to eliminate public internet exposure for database traffic. Covers ingress private endpoints (AWS PrivateLink, GCP Private Service Connect, Azure Private Link), egress private endpoints for outbound connections to external services, and VPC peering.
When to Use This Skill
Setting up private endpoints to eliminate public internet exposure for database connections
Configuring egress private endpoints for CDC changefeeds to Confluent Kafka or other external services
Establishing VPC peering between a CockroachDB Cloud cluster and application VPCs
Troubleshooting DNS resolution issues with private endpoints
Resolving "stuck pending" or connection failure errors with private endpoints
Automating private connectivity setup with Terraform
Prerequisites
CockroachDB Cloud cluster — Standard or Advanced plan (VPC peering requires Advanced)
ccloud CLI authenticated with Cluster Admin role
Cloud provider access:
AWS: IAM permissions to create VPC endpoints, modify DNS, and manage security groups
GCP: Permissions to create Private Service Connect endpoints and DNS records
Azure: Permissions to create private endpoints and manage DNS zones
Cluster ID and cloud provider details from ccloud cluster info
Verify access:
ccloud auth whoami
ccloud cluster info <cluster-name> -o json
Before proceeding, determine which connectivity types and cloud provider apply to the user's environment. Ask which options are relevant, then follow only the corresponding sections below.
Decision 1 — Connectivity type(s) needed:
Ingress private endpoints: Applications connect to CockroachDB over a private network path (AWS PrivateLink, GCP Private Service Connect, Azure Private Link). Most common use case.
Egress private endpoints: CockroachDB connects outbound to external services (e.g., Confluent Kafka for CDC) over a private path.
VPC peering: Direct network connection between the application VPC and the CockroachDB Cloud VPC. Requires Advanced plan.
Combination: Multiple connectivity types can be configured together.
Decision 2 — Cloud provider:
AWS: Use AWS PrivateLink for ingress, AWS VPC peering for peering.
GCP: Use GCP Private Service Connect for ingress, GCP VPC peering for peering.
Azure: Use Azure Private Link for ingress. VPC peering is not available for Azure.
Steps
Part 1: Ingress Private Endpoints
Follow this part only if the user selected Ingress private endpoints in Decision 1. Follow only the subsection (1.2, 1.3, or 1.4) matching the user's cloud provider from Decision 2.
Private endpoints allow applications in your VPC to connect to CockroachDB Cloud without traversing the public internet.
1.1 Get the Private Endpoint Service
Get the private endpoint service information from the Cloud Console or Cloud API:
Cloud Console: Navigate to your cluster's Networking > Private endpoint tab. The service name/ID is displayed.
Verify the external service has accepted the connection
Check that the external service is in the same cloud provider region
Contact the external service admin to accept the pending connection
2.4 Use the Egress Endpoint in CDC Changefeeds
-- Create a changefeed using the egress endpointCREATE CHANGEFEED FORTABLE orders
INTO'kafka://<private-kafka-endpoint>:9092?topic_prefix=crdb_'WITH updated, resolved;
Part 3: VPC Peering
Skip this part if the user did not select VPC peering in Decision 1. Follow only the commands matching the user's cloud provider (AWS or GCP) from Decision 2. Azure does not support VPC peering.
VPC peering creates a direct network connection between your VPC and the CockroachDB Cloud VPC.
