fix(lake): clarify AWS PrivateLink service setup - #23636
Conversation
ti-chi-bot
Bot
added
contribution
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
📝 WalkthroughWalkthroughThe AWS PrivateLink guide expands step 4 with detailed VPC endpoint creation instructions. The update covers service verification, VPC and subnet selection, security group selection, endpoint creation, and supporting screenshots. ChangesAWS PrivateLink guide
Estimated code review effort: 1 (Trivial) | ~3 minutes Merge Risk: 🔵 Low · up to The PR improves AWS PrivateLink setup guidance, but the current page still misplaces the relevant screenshot and omits subnet and Availability Zone constraints that could lead to confusion or failed endpoint creation. The risk is bounded and mergeable with explicit owner follow-up on these documentation fixes. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Description checkExplanation The description explains what changed and why, identifies the affected TiDB version, provides reference links, records AI involvement, and addresses the additional change categories. The optional first-time contributor checklist is omitted appropriately. Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ba403a09-8506-4953-929d-8442df52f0aa
📒 Files selected for processing (1)
tidb-cloud-lake/guides/connect-with-aws-privatelink.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
| 2. In **Endpoint settings**, fill in a name tag if needed, and then select **Endpoint services that use NLBs and GWLBs**. | ||
|
|
||
| Select the previously created security group `HTTPS`: | ||
|  |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Move the screenshot below step 3.
The screenshot is placed after step 2, but it shows the Service name field and Verify service button used by step 3. Move the image block to immediately after Line 45 so it illustrates the instruction it documents.
As per path instructions: use a regular comment when the fix requires reordering or noncontiguous changes.
Source: Path instructions
|
|
||
| 4. In **Network settings**, select your VPC. | ||
|
|
||
| 5. In **Subnets**, select the availability zones and subnets where you want to create the VPC endpoint. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
#!/bin/bash
set -eu
echo '--- applicable repository conventions ---'
head -5 /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/*/*.md 2>/dev/null || true
echo '--- target document excerpt ---'
cat -n tidb-cloud-lake/guides/connect-with-aws-privatelink.md | sed -n '35,55p'
echo '--- relevant diff ---'
git diff -- tidb-cloud-lake/guides/connect-with-aws-privatelink.md | sed -n '1,160p'Repository: pingcap/docs
Length of output: 2318
🌐 Web query:
AWS interface VPC endpoint one subnet per Availability Zone endpoint service supports selected Availability Zones
💡 Result:
When configuring an interface VPC endpoint, you are limited to selecting one subnet per Availability Zone [1][2]. You cannot select multiple subnets from the same Availability Zone for a single interface VPC endpoint [2]. Regarding support for specific Availability Zones, an interface VPC endpoint can only be created in Availability Zones that are supported by the corresponding endpoint service [3]. If you attempt to select a subnet in an Availability Zone not enabled for that endpoint service, the operation will fail [3]. Key points regarding this requirement include: 1. Availability Zone Mapping: The Availability Zones supported by an endpoint service are determined by the service provider (or AWS, for AWS services) by the Availability Zones they have enabled on their Network Load Balancer [4][3]. Because subnet-to-AZ mappings can vary between AWS accounts, it is best practice to use the unique Availability Zone ID (AZ ID) when identifying compatible zones [3]. 2. Troubleshooting: If you encounter an error stating that an endpoint service does not support the Availability Zone of a selected subnet, it indicates that the service provider has not activated that specific zone for their endpoint service [3]. You can verify which Availability Zones are supported by a service by using the describe-vpc-endpoint-services CLI command [3]. 3. High Availability: For production workloads, it is recommended to configure the interface VPC endpoint in at least two Availability Zones to ensure resiliency [5][4]. 4. Automation: Tools like the AWS Cloud Development Kit (CDK) provide parameters (such as lookup_supported_azs) to help automatically identify and restrict subnet selection to only those Availability Zones where the endpoint service is available [6][7].
Citations:
- 1: https://docs.aws.amazon.com/vpc/latest/privatelink/interface-endpoints.html
- 2: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html
- 3: https://repost.aws/knowledge-center/interface-endpoint-availability-zone
- 4: https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-share-your-services.html
- 5: https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html
- 6: https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/InterfaceVpcEndpointProps.html
- 7: https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_ec2/InterfaceVpcEndpoint.html
Document the subnet constraints.
AWS interface endpoints allow only one subnet per Availability Zone, and the endpoint service must support each selected Availability Zone.
Committable replacement
- 5. In **Subnets**, select the availability zones and subnets where you want to create the VPC endpoint.
+ 5. In **Subnets**, select one subnet per Availability Zone, and select only Availability Zones supported by the endpoint service.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| 5. In **Subnets**, select the availability zones and subnets where you want to create the VPC endpoint. | |
| 5. In **Subnets**, select one subnet per Availability Zone, and select only Availability Zones supported by the endpoint service. |
🧰 Tools
🪛 LanguageTool
[style] ~49-~49: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...rk settings**, select your VPC. 5. In Subnets, select the availability zo...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
Sources: Path instructions, MCP tools
1 participant
What is changed, added or deleted? (Required)
Which TiDB version(s) do your changes apply to? (Required)
Tips for choosing the affected version(s):
By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.
For details, see tips for choosing the affected versions.
What is the related PR or file link(s)?
AI agent involvement
Do your changes match any of the following descriptions?
Summary by CodeRabbit