From cockroachdb
Configures and hardens IP allowlists for CockroachDB Cloud clusters to restrict network access to authorized CIDR ranges. Use when tightening network security, removing overly permissive allowlist entries like 0.0.0.0/0, or setting up allowlists for a new cluster.
npx claudepluginhub cockroachdb/claude-plugin --plugin cockroachdbThis skill uses the workspace's default tool permissions.
Configures and hardens IP allowlists on CockroachDB Cloud clusters to restrict SQL and DB Console access to authorized CIDR ranges. Identifies overly permissive entries (such as `0.0.0.0/0`) and replaces them with specific, narrow ranges.
Manages Elastic Cloud Serverless network security: create, update, delete IP filters and AWS PrivateLink VPC filters. Use for restricting network access or private connectivity.
Secures ClickHouse deployments with SQL-based RBAC, restricted users, roles, row-level security, network restrictions, TLS, and audit logging. For hardening access controls.
Implements and audits GCP VPC firewall rules for network segmentation, ingress/egress restrictions, hierarchical policies, and VPC Flow Logs monitoring. For securing GCP workloads and auditing permissive rules.
Share bugs, ideas, or general feedback.
Configures and hardens IP allowlists on CockroachDB Cloud clusters to restrict SQL and DB Console access to authorized CIDR ranges. Identifies overly permissive entries (such as 0.0.0.0/0) and replaces them with specific, narrow ranges.
0.0.0.0/0 (open to all) from the IP allowlistccloud auth login)ccloud cluster listVerify access:
ccloud auth whoami
ccloud cluster list
# List all IP allowlist entries for the cluster
ccloud cluster networking allowlist list <cluster-id> -o json
Review each entry. Flag any of these as overly permissive:
0.0.0.0/0 — Open to all IPv4 addresses/8 ranges — 16 million+ addresses/16 ranges — 65,000+ addressesSee ccloud commands reference for full command syntax.
CockroachDB Cloud clusters have a maximum number of IP allowlist entries per cluster. If you need more entries than the limit allows:
/32 entries into a /24)Before modifying the allowlist, document all legitimate access sources:
| Source | CIDR | SQL Access | UI Access |
|---|---|---|---|
| Office network | 203.0.113.0/24 | Yes | Yes |
| VPN egress | 198.51.100.0/24 | Yes | Yes |
| CI/CD runners | 192.0.2.0/28 | Yes | No |
| Monitoring | 10.0.1.5/32 | Yes | No |
# Add a specific CIDR range (CIDR is a positional argument)
ccloud cluster networking allowlist create <cluster-name> <cidr> \
--sql \
--ui \
--name "<description>"
Examples:
# Office network — SQL and UI access
ccloud cluster networking allowlist create <cluster-name> 203.0.113.0/24 \
--sql \
--ui \
--name "Office network"
# CI/CD runners — SQL only
ccloud cluster networking allowlist create <cluster-name> 192.0.2.0/28 \
--sql \
--name "CI/CD runners"
# Single IP — /32 for maximum specificity
ccloud cluster networking allowlist create <cluster-name> 198.51.100.42/32 \
--sql \
--ui \
--name "Developer workstation"
# Delete the 0.0.0.0/0 entry (or other overly broad entries)
ccloud cluster networking allowlist delete <cluster-name> 0.0.0.0/0
Important: Only remove 0.0.0.0/0 after confirming your specific CIDR entries are in place and tested.
# Confirm the final allowlist
ccloud cluster networking allowlist list <cluster-id> -o json
Test connectivity from each authorized source:
# Test SQL connection from an allowed IP
cockroach sql --url "<connection-string>" -e "SELECT 1;"
# Test from a non-allowed IP (should fail)
# Attempt connection from an IP not in the allowlist — expect connection refused
Risk: Locking yourself out. Removing 0.0.0.0/0 before adding your current IP will immediately block your access.
Mitigation steps:
curl -s https://checkip.amazonaws.com/32 entry before removing broad ranges0.0.0.0/0Order of operations:
0.0.0.0/0 only after verifying all needed entries are in placeIf you lose access after removing a broad entry:
/32 or re-add 0.0.0.0/0 temporarily# Emergency: re-add 0.0.0.0/0 via ccloud (if you still have ccloud access)
ccloud cluster networking allowlist create <cluster-name> 0.0.0.0/0 \
--sql \
--ui \
--name "Emergency - temporary open access"
Skill references:
Related skills:
Official CockroachDB Documentation: