cloud: add changefeed OSS configuration for premium. - #23585
Conversation
ti-chi-bot
Bot
added
contribution
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe changefeed cloud storage guide now separates Dedicated and Premium instructions. It adds Premium destination guidance and Dedicated instructions for configuring Alibaba Cloud OSS, including bucket setup, RAM permissions, credentials, and destination fields. ChangesCloud storage documentation
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: 🟡 Moderate · up to The change adds Alibaba Cloud OSS guidance for Premium, but the current text can hide the setup from Premium users, blocks a prerequisite with a broken link, and recommends OSS access without clear bucket/prefix scoping or AccessKey rotation. These gaps can prevent successful setup or encourage overly broad credential access, so the PR is not merge-ready until the documentation is corrected or explicitly accepted. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 9a250efc-20e7-4bb8-8ebf-75e4472c3ea5
📒 Files selected for processing (1)
tidb-cloud/changefeed-sink-to-cloud-storage.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
qiancai
added
translation/no-need
ti-chi-bot
Bot
removed
the
missing-translation-status
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
tidb-cloud/changefeed-sink-to-cloud-storage.md (1)
189-189: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winFix the broken bucket-creation link.
The linked page currently returns Alibaba Cloud’s 404 page. The current bucket-creation document uses a different path. (alibabacloud.com)
Committable replacement
- 1. Create an OSS bucket in the same region as your TiDB cluster. For detailed instructions, see [Create buckets](https://www.alibabacloud.com/help/en/oss/user-guide/create-buckets). + 1. Create an OSS bucket in the same region as your TiDB cluster. For detailed instructions, see [Create a bucket](https://www.alibabacloud.com/help/en/oss/user-guide/create-a-bucket-4).As per path instructions, run
./scripts/verify-links.shfor link-sensitive Markdown changes when practical.Source: Path instructions
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b730e093-b151-4ab8-bd30-448b665da478
📒 Files selected for processing (1)
tidb-cloud/changefeed-sink-to-cloud-storage.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
qiancai
changed the title
There was a problem hiding this comment.
♻️ Duplicate comments (2)
tidb-cloud/changefeed-sink-to-cloud-storage.md (2)
194-206:⚠️ Potential issue | 🟠 MajorScope OSS permissions and document AccessKey rotation.
Lines 195-200 list OSS actions but do not restrict them to the changefeed bucket and prefix. Alibaba Cloud requires bucket-level authorization for
oss:ListObjects; object actions can be limited to a specific prefix. Add a custom policy with anoss:Prefixcondition and prefix-scoped object resources. Also document secure storage and rotation of the AccessKey pair. (alibabacloud.com)Committable replacements
- 3. Grant the RAM user OSS permissions. For the required permissions, see [OSS permissions and access control](https://www.alibabacloud.com/help/en/oss/user-guide/permissions-and-access-control-overview). The RAM user needs at least the following permissions: - - - `oss:ListObjects` - - `oss:GetObject` - - `oss:PutObject` - - `oss:DeleteObject` + 3. Attach a custom RAM policy that follows least privilege. Scope `oss:ListObjects` to `acs:oss:*:*:<BucketName>` and restrict it with an `oss:Prefix` condition for `<prefix>/`. Scope `oss:GetObject`, `oss:PutObject`, and `oss:DeleteObject` to `acs:oss:*:*:<BucketName>/<prefix>/*`. For policy examples, see [Control OSS access with RAM policies](https://www.alibabacloud.com/help/en/oss/user-guide/access-control-base-on-ram-policy).- **Access Key Secret**: enter the AccessKey Secret from the RAM user. + + > **Note:** + > + > Store the AccessKey pair securely. To rotate it, create a new AccessKey pair, update and verify the changefeed, then disable and delete the old pair.As per path instructions, “for every actionable issue, provide a GitHub committable suggestion block” when the replacement is contiguous.
Sources: Path instructions, MCP tools
39-43:⚠️ Potential issue | 🟠 MajorUse one plan scope for the Alibaba Cloud OSS flow.
Line 41 advertises Alibaba Cloud OSS for TiDB Cloud Premium, but Lines 186-209 render the OSS instructions only for
plan="dedicated". Premium readers cannot see the required setup. Line 212 also describes only a Dedicated connection and omits Alibaba Cloud OSS. Confirm the intended plan, then use the same plan scope in the wrapper and completion text.As per path instructions, a regular review comment is appropriate because the fix “needs clarification from the author.”
Also applies to: 186-187
Source: Path instructions
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ac713597-9be0-4818-9061-f8020ce4463d
📒 Files selected for processing (1)
tidb-cloud/changefeed-sink-to-cloud-storage.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
ti-chi-bot
Bot
added
size/L
|
@sdojjy: adding LGTM is restricted to approvers and reviewers in OWNERS files. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
[LGTM Timeline notifier]Timeline:
|
Co-authored-by: Grace Cai <qqzczy@126.com>
|
@ginkgoch: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
First-time contributors' checklist
What is changed, added or deleted? (Required)
Add document for guiding changefeed to sink to Alicloud OSS on cloud premium.
Which TiDB version(s) do your changes apply to? (Required)
Tips for choosing the affected version(s):
By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.
For details, see tips for choosing the affected versions.
What is the related PR or file link(s)?
AI agent involvement
Do your changes match any of the following descriptions?
Summary by CodeRabbit