Add Beekeeper Studio Community Edition walkthrough - #23743
Conversation
ti-chi-bot
Bot
added
contribution
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Hi @hankhoffmeier. Thanks for your PR. I'm waiting for a pingcap member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Welcome @hankhoffmeier! |
ti-chi-bot
Bot
added
missing-translation-status
📝 WalkthroughWalkthroughAdded a developer guide for connecting Beekeeper Studio Community Edition to TiDB Cloud and TiDB Self-Managed deployments. The third-party support table now links to the new tutorial. ChangesBeekeeper Studio documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: 🟠 High · up to The tutorial should not merge until public TiDB Cloud connections require encryption and server verification, and the Essential endpoint and complete username instructions are corrected; otherwise users may expose credentials or be unable to connect. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Team
Run ID: 75dbd85c-2a74-46c0-9153-525836161103
⛔ Files ignored due to path filters (2)
media/develop/beekeeper-studio-connection-settings-self-hosted.pngis excluded by!**/*.pngmedia/develop/beekeeper-studio-connection-settings.pngis excluded by!**/*.png
📒 Files selected for processing (2)
develop/dev-guide-gui-beekeeper-studio.mddevelop/dev-guide-third-party-support.md
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.
| Connect to TiDB depending on the TiDB deployment option you've selected. | ||
|
|
||
| <SimpleTab> | ||
| <div label="{{{ .starter }}} or Essential"> |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift
🔎 Supported by static analysis
🏁 Script executed:
sed -n '1,75p' develop/dev-guide-gui-beekeeper-studio.mdRepository: pingcap/docs
Length of output: 3963
🤖 get_repo_knowledge executed:
get_repo_knowledge pingcap/docs /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/learnings /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/conventions
Length of output: 4069
🌐 Web query:
site:docs.pingcap.com/tidbcloud "exclusive endpoint" Essential July 1 2026 shared endpoint
💡 Result:
In TiDB Cloud, the distinction between the endpoint shared model and the endpoint exclusive model for Essential instances is based on the creation date of the instance, with July 1, 2026, serving as the cutoff date [1][2][3]. Endpoint Shared Model: - Applies to all TiDB Cloud Starter instances and TiDB Cloud Essential instances created before July 1, 2026 [1][4][3]. - In this model, a single private or public endpoint can be shared by multiple TiDB Cloud Starter or Essential instances located within the same region and VPC [1][4][3]. - When connecting to instances using this model, users are required to include a mandatory account prefix in their connection string [1][2][3]. Endpoint Exclusive Model: - Applies to TiDB Cloud Essential instances created on or after July 1, 2026 [1][2][3]. - In this model, each Essential instance is assigned its own standalone private or public endpoint [1][4][3]. - A primary benefit of this model is that it eliminates the need to include an account prefix when connecting to the instance [1][2][3]. - Users must repeat the network setup steps for each individual Essential instance they wish to connect to in this mode [1][2][4]. Please note that the endpoint exclusive model is currently only available in certain AWS regions [1][2][4]. If it is not supported for a specific instance, the shared model is used instead [1][2][4].
Citations:
- 1: https://docs.pingcap.com/tidbcloud/set-up-private-endpoint-connections-serverless/
- 2: https://docs.pingcap.com/tidbcloud/set-up-private-endpoint-connections-serverless.md
- 3: https://docs.pingcap.com/tidbcloud/serverless-private-link-connection/
- 4: https://docs.pingcap.com/tidbcloud/connect-via-standard-connection-serverless/
🏁 Script executed:
rg -n -i "exclusive endpoint|shared endpoint|July 1, 2026|Essential.*endpoint|endpoint.*Essential" --glob '*.md' .Repository: pingcap/docs
Length of output: 24575
🏁 Script executed:
sed -n '1,70p' tidb-cloud/connect-via-standard-connection-serverless.md
printf '\n--- related username/account-prefix references ---\n'
rg -n -i "account prefix|username|user name|user.*prefix|exclusive model|shared model|July 1, 2026" tidb-cloud/connect-via-standard-connection-serverless.md tidb-cloud/set-up-private-endpoint-connections-serverless.md develop/dev-guide-gui-beekeeper-studio.mdRepository: pingcap/docs
Length of output: 6240
Separate the TiDB Cloud Essential endpoint models.
This tab combines Starter and Essential instances under one public-endpoint procedure. Essential instances can use shared or exclusive endpoints, which have different connection steps and username requirements. State which endpoint model this procedure supports, or provide separate instructions for each model. ( )
| > | ||
| > If you have created a password before, you can either use the original password or click **Reset Password** to generate a new one. | ||
|
|
||
| 5. Launch Beekeeper Studio. On the connections screen, click **New Connection**, select **TiDB** from the **Connection Type** list, and fill in the connection form: copy the **Host** and **Port** from the TiDB Cloud connection dialog, and enter the **User** and **Password** from steps 3 and 4. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🤖 get_repo_knowledge executed:
get_repo_knowledge pingcap/docs /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/learnings
Length of output: 1138
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- changed file status ---'
git status --short -- develop/dev-guide-gui-beekeeper-studio.md
printf '%s\n' '--- relevant document context ---'
sed -n '35,62p' develop/dev-guide-gui-beekeeper-studio.md
printf '%s\n' '--- nearby username and connection-string references ---'
rg -n -C 2 'User|user name|username|connection string|Host|Port|Password' develop/dev-guide-gui-beekeeper-studio.mdRepository: pingcap/docs
Length of output: 4830
🌐 Web query:
TiDB Cloud shared Starter Essential endpoint connection string username instance prefix official docs
💡 Result:
To connect to a TiDB Cloud Starter or Essential instance, you must include a unique instance prefix in your username [1][2]. When using the endpoint shared model (which applies to all Starter instances and Essential instances created before July 1, 2026), you are required to prepend this prefix to your database username [3]. For example, if your prefix is 3pTAoNNegb47Uc8 and your database user is root, the username provided in the connection string must be '3pTAoNNegb47Uc8.root' [1][2]. You must also wrap the username in quotation marks when using the command line [1][4]. For Essential instances created on or after July 1, 2026, TiDB Cloud uses an endpoint exclusive model, which eliminates the need to include the account prefix [3]. To find your unique instance prefix: 1. Navigate to the My TiDB page in the TiDB Cloud console [1][2]. 2. Click on the name of your specific instance to open its overview page [1][2]. 3. Click the Connect button in the upper-right corner [1][2]. 4. The connection dialog will display the connection string, which includes the correct prefix [1][2]. Because these instances require TLS, you should always ensure your connection string includes the necessary SSL parameters, which are also provided in the connection dialog generated by the TiDB Cloud console [3][1][5].
Citations:
- 1: https://docs.pingcap.com/tidbcloud/select-cluster-tier/
- 2: https://github.com/pingcap/docs/blob/master/tidb-cloud/select-cluster-tier.md
- 3: https://docs.pingcap.com/tidbcloud/connect-via-standard-connection-serverless/
- 4: https://docs.pingcap.com/developer/dev-guide-build-cluster-in-cloud/
- 5: https://docs.pingcap.com/tidbcloud/secure-connections-to-serverless-clusters/
🤖 get_repo_knowledge executed:
get_repo_knowledge pingcap/docs /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/conventions
Length of output: 3147
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- document introduction and procedure scope ---'
sed -n '1,40p' develop/dev-guide-gui-beekeeper-studio.md
printf '%s\n' '--- local TiDB Cloud username guidance ---'
rg -n -i -C 2 'instance prefix|username|user name|connection string' tidb-cloud develop | head -n 160Repository: pingcap/docs
Length of output: 19328
Copy the complete TiDB Cloud user name.
Step 5 references User from steps 3 and 4, but those steps do not identify it. Shared endpoints require the instance prefix in the user name, so root alone can fail.
Proposed replacement
-5. Launch Beekeeper Studio. On the connections screen, click **New Connection**, select **TiDB** from the **Connection Type** list, and fill in the connection form: copy the **Host** and **Port** from the TiDB Cloud connection dialog, and enter the **User** and **Password** from steps 3 and 4.
+5. Launch Beekeeper Studio. On the connections screen, click **New Connection**, select **TiDB** from the **Connection Type** list, and fill in the connection form: copy the **Host**, **Port**, and **User** from the connection string shown in the TiDB Cloud connection dialog, and enter the **Password** from step 4.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| 5. Launch Beekeeper Studio. On the connections screen, click **New Connection**, select **TiDB** from the **Connection Type** list, and fill in the connection form: copy the **Host** and **Port** from the TiDB Cloud connection dialog, and enter the **User** and **Password** from steps 3 and 4. | |
| 5. Launch Beekeeper Studio. On the connections screen, click **New Connection**, select **TiDB** from the **Connection Type** list, and fill in the connection form: copy the **Host**, **Port**, and **User** from the connection string shown in the TiDB Cloud connection dialog, and enter the **Password** from step 4. |
|
|
||
| 6. Turn on the **Enable SSL** toggle, since {{{ .starter }}} and Essential require an encrypted connection. | ||
|
|
||
| Unlike some GUI clients, Beekeeper Studio does not require you to manually download or select a CA certificate here — by default it trusts the server's certificate, so enabling SSL is enough. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🤖 get_repo_knowledge executed:
get_repo_knowledge pingcap/docs /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/conventions
Length of output: 3712
🏁 Script executed:
#!/bin/bash
set -eu
file='develop/dev-guide-gui-beekeeper-studio.md'
printf '%s\n' '--- target file ---'
sed -n '35,125p' "$file"
printf '%s\n' '--- related repository guidance ---'
rg -n -i -C 2 'Beekeeper Studio|Enable SSL|CA cert|CA Cert|certificate verification|rejectUnauthorized|server certificate' develop docs 2>/dev/null | head -240Repository: pingcap/docs
Length of output: 35017
🌐 Web query:
Beekeeper Studio documentation SSL connection CA certificate trust server certificate verification default
💡 Result:
In Beekeeper Studio, SSL connection behavior and certificate verification are primarily managed through the connection configuration settings [1][2]. By default, when you enable SSL, Beekeeper Studio is configured to "Trust the server," which means it will connect over SSL without requiring you to provide your own certificate files [1][2]. In this default mode, the application does not perform strict verification of the server's certificate, which allows it to function with self-signed certificates [1][3]. Beekeeper Studio supports three main approaches to SSL configuration: 1. Trust the server: This is the default setting. It enables SSL encryption but does not verify the server's certificate [1][2]. 2. Required Cert (CA/Client Cert): You provide your own certificate files (CA, client certificate, or key file) but leave the "Reject Unauthorized" option disabled [1][2]. This maintains the encrypted connection while providing custom certificates without enforcing full validation [3]. 3. Verified Cert (Full Verification): You provide the necessary certificate files and enable the "Reject Unauthorized" option [1][2]. This enforces full TLS verification against the provided certificates [3]. When "Reject Unauthorized" is disabled, Beekeeper Studio effectively ignores certificate validation errors, such as those caused by self-signed certificates or invalid certificate chains [3]. Conversely, enabling "Reject Unauthorized" mandates that the server certificate be strictly validated [1][3]. For specific database types like SQL Server, additional specialized options for "Strict" (validate certificate) and certificate pinning may be available depending on the driver and version [4].
Citations:
- 1: https://docs.beekeeperstudio.io/user_guide/connecting/connecting/
- 2: https://github.com/beekeeper-studio/beekeeper-studio/blob/master/docs/user_guide/connecting/connecting.md
- 3: https://docs.beekeeperstudio.io/user_guide/connecting/trino/
- 4: https://docs.beekeeperstudio.io/user_guide/connecting/sql-server/
🏁 Script executed:
#!/bin/bash
set -eu
file='develop/dev-guide-gui-beekeeper-studio.md'
sed -n '35,125p' "$file"Repository: pingcap/docs
Length of output: 5975
🏁 Script executed:
#!/bin/bash
set -eu
sed -n '50,115p' develop/dev-guide-gui-beekeeper-studio.mdRepository: pingcap/docs
Length of output: 4763
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target lines ---'
nl -ba develop/dev-guide-gui-beekeeper-studio.md | sed -n '50,65p;103,116p'
printf '%s\n' '--- repository references ---'
rg -n -i -C 2 'Beekeeper Studio|Enable SSL|CA cert|CA Cert' . --glob '!node_modules' --glob '!dist' | head -200Repository: pingcap/docs
Length of output: 17646
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
p = Path("develop/dev-guide-gui-beekeeper-studio.md")
lines = p.read_text().splitlines()
for n in list(range(54, 63)) + list(range(106, 114)):
print(f"{n+1}: {lines[n]}")
PYRepository: pingcap/docs
Length of output: 1705
🏁 Script executed:
#!/bin/bash
set -eu
for url in \
'https://docs.beekeeperstudio.io/user_guide/connection_options/' \
'https://docs.beekeeperstudio.io/user_guide/connection_options/ssl/' \
'https://www.beekeeperstudio.io/docs/connection-options'; do
echo "--- $url ---"
curl -L --max-time 10 -sS "$url" 2>/dev/null | tr '\n' ' ' | sed 's/<[^>]*>/ /g' | grep -oiE '.{0,180}(SSL|certificate|CA cert|verify).{0,300}' | head -10 || true
doneRepository: pingcap/docs
Length of output: 359
🌐 Web query:
site:docs.beekeeperstudio.io SSL "CA Certificate" "Verify" Beekeeper Studio
💡 Result:
To verify an SSL CA certificate in Beekeeper Studio, you must configure the SSL settings within your connection configuration. Beekeeper Studio provides three main modes for managing SSL connections, which correspond to the level of verification you require [1][2]. 1. Trust the server: This mode enables SSL without requiring any certificate files. It connects over HTTPS but does not verify the server's certificate, which allows connections to servers using self-signed certificates [1][2]. 2. Required Cert (Provide a CA certificate): Use this mode when your server uses a certificate signed by a private CA. You must provide the CA certificate file in the connection form. In this configuration, you should typically leave the Reject Unauthorized option unchecked [1][2]. 3. Verified Cert (Full certificate verification): This mode enforces full TLS verification. You must provide the CA certificate and, if required, a client certificate and key file. You must also enable the Reject Unauthorized option to ensure the certificate is fully validated [1][2]. In the connection settings, these options align with common database sslmode flags, where enabling Reject Unauthorized corresponds to stricter verification settings like verify-full [2]. If you are importing a connection URL that begins with https://, Beekeeper Studio will generally enable SSL automatically, allowing you to then provide your specific CA files as needed [1].
Citations:
- 1: https://docs.beekeeperstudio.io/user_guide/connecting/trino/
- 2: https://docs.beekeeperstudio.io/user_guide/connecting/connecting/
🌐 Web query:
Beekeeper Studio 4.3.0 connection SSL "Trust the server" "Reject Unauthorized" documentation
💡 Result:
In Beekeeper Studio, the SSL "Reject Unauthorized" setting controls whether the application enforces strict verification of the server's TLS/SSL certificate [1][2]. Its behavior depends on your configuration: 1. Default Behavior (Trust the server): By default, when you enable SSL without providing your own certificate files, Beekeeper Studio "trusts the server" [1][3]. This means it will connect over SSL/TLS but will not verify the validity of the server's certificate [2]. This mode is compatible with self-signed certificates [2][4]. 2. Reject Unauthorized (Disabled): If you provide custom certificate files (such as a CA certificate) but leave "Reject Unauthorized" unchecked, Beekeeper Studio will attempt to use those certificates but will not strictly reject the connection if the server certificate does not perfectly match [2]. 3. Reject Unauthorized (Enabled): If you check "Reject Unauthorized," Beekeeper Studio enforces full TLS verification [1][2]. In this mode, the application requires a valid, trusted certificate chain [2]. If the server provides a self-signed certificate or one that does not match the provided CA/verification parameters, the connection will be rejected [2][5]. For environments requiring high security, you should provide the appropriate CA certificate file and enable "Reject Unauthorized" to ensure the identity of the server is strictly verified [1][6]. Conversely, for local development or environments using self-signed certificates where full verification is not possible, you should typically leave "Reject Unauthorized" unchecked or rely on the default "trust the server" configuration [2][4].
Citations:
- 1: https://docs.beekeeperstudio.io/user_guide/connecting/connecting/
- 2: https://docs.beekeeperstudio.io/user_guide/connecting/trino/
- 3: https://github.com/beekeeper-studio/beekeeper-studio/blob/340575e5/apps/studio/src/components/connection/CommonSsl.vue
- 4: https://docs.beekeeperstudio.io/user_guide/connecting/sql-server/
- 5: GitHub issue 510 in beekeeper-studio/beekeeper-studio (link omitted to avoid creating a cross-reference)
- 6: GitHub issue 4420 in beekeeper-studio/beekeeper-studio (link omitted to avoid creating a cross-reference)
🌐 Web query:
site:github.com/beekeeper-studio/beekeeper-studio "Trust the server" "Reject Unauthorized"
💡 Result:
In the context of database connection management (specifically within applications like Beekeeper Studio), the terms "Trust the server" and "Reject Unauthorized" relate to how the client verifies the SSL/TLS certificate provided by the database server [1][2]. Trust the server This setting (often the default) allows a client to establish an encrypted SSL/TLS connection with a database server without requiring the user to provide or verify a specific certificate [1][2]. When this is active, the client encrypts the connection but does not perform strict validation of the server's identity, meaning it will accept a self-signed certificate or a certificate that might not be trusted by a standard Certificate Authority (CA) [1]. Reject Unauthorized This is a security setting that, when enabled, forces the client to strictly verify the server's SSL/TLS certificate against known trusted CAs [1][2]. - When "Reject Unauthorized" is enabled, the connection will fail if the server presents a certificate that cannot be verified (e.g., self-signed, expired, or issued by an untrusted CA) [1][3]. - When "Reject Unauthorized" is disabled (or explicitly set to false), the client will ignore validation errors, effectively trusting any certificate presented by the server [1][2]. These concepts are critical for balancing convenience and security. Enabling "Reject Unauthorized" is the recommended practice for production environments to prevent man-in-the-middle (MITM) attacks by ensuring the server is who it claims to be [3]. "Trust the server" (or disabling "Reject Unauthorized") is typically used in development or testing environments where self-signed certificates are common [4][1][5].
Citations:
- 1: https://github.com/beekeeper-studio/beekeeper-studio/blob/master/docs/user_guide/connecting/connecting.md
- 2: https://github.com/beekeeper-studio/beekeeper-studio/blob/340575e5/docs/user_guide/connecting/connecting.md
- 3: GitHub issue 595 in beekeeper-studio/beekeeper-studio (link omitted to avoid creating a cross-reference)
- 4: https://github.com/beekeeper-studio/beekeeper-studio/blob/340575e5/apps/studio/src/components/connection/CommonSsl.vue
- 5: GitHub issue 3482 in beekeeper-studio/beekeeper-studio (link omitted to avoid creating a cross-reference)
Require verified TLS for cloud connections. Beekeeper Studio’s default Trust the server mode encrypts traffic but does not validate server identity. For both instructions, enable Reject Unauthorized and use the TiDB Cloud CA certificate or a trusted system CA; otherwise, an impersonating server may be accepted.
📍 Affects 1 file
develop/dev-guide-gui-beekeeper-studio.md#L59-L59(this comment)develop/dev-guide-gui-beekeeper-studio.md#L111-L111
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🔎 Supported by static analysis
🏁 Script executed:
#!/bin/bash
set -e
printf '%s\n' '--- target file ---'
sed -n '45,120p' develop/dev-guide-gui-beekeeper-studio.md
printf '%s\n' '--- relevant repository conventions/links ---'
rg -n -i 'Beekeeper|certificate|CA certificate|SSL|TiDB Cloud' develop README.md .github 2>/dev/null | head -120Repository: pingcap/docs
Length of output: 27278
🌐 Web query:
Beekeeper Studio documentation connecting Trust the server SSL certificate verification CA certificate
💡 Result:
In Beekeeper Studio, SSL certificate verification and CA certificate configuration are managed within the connection settings, typically under the SSL section [1][2][3]. Beekeeper Studio generally offers three primary modes for SSL connectivity [1][4]: 1. Trust the Server (Default): Beekeeper Studio connects using SSL but does not perform verification of the server's certificate [1][3]. This is the simplest option and supports self-signed certificates [3]. 2. Required Cert (Reject Unauthorized Disabled): You provide your own certificate files (CA, client certificate, or key) but disable rejectUnauthorized, meaning the application will not strictly enforce verification [1][4]. 3. Verified Cert (Reject Unauthorized Enabled): You provide the necessary certificate files and enable rejectUnauthorized, which enforces full TLS/SSL certificate verification [1][4][3]. When configuring these options, you can specify an optional CA Certificate file (CA Cert) path, along with client certificate and key files, in the advanced SSL settings [2][3][5]. Special Note for SQL Server: SQL Server connections include a specific "Trust Server Certificate" checkbox [6][7]. This is a distinct setting required by the underlying SQL Server driver [7][8]. If you encounter connection issues with SQL Server even after configuring SSL, enabling this checkbox is often necessary to allow connections when the server uses a self-signed or otherwise untrusted certificate [6][7][8]. If you still experience issues (such as "unable to get local issuer certificate"), ensure your client environment (e.g., Windows/macOS/Linux) has the appropriate CA bundle, or consider using the NODE_EXTRA_CA_CERTS environment variable to point to the correct certificate authority bundle [9].
Citations:
- 1: https://docs.beekeeperstudio.io/user_guide/connecting/connecting/
- 2: https://github.com/beekeeper-studio/beekeeper-studio/blob/340575e5/apps/studio/src/components/connection/CommonSsl.vue
- 3: https://docs.beekeeperstudio.io/user_guide/connecting/trino/
- 4: https://github.com/beekeeper-studio/beekeeper-studio/blob/master/docs/user_guide/connecting/connecting.md
- 5: https://deepwiki.com/beekeeper-studio/beekeeper-studio/5.1-connection-configuration
- 6: https://docs.beekeeperstudio.io/user_guide/connecting/sql-server/
- 7: GitHub issue 1124 in beekeeper-studio/beekeeper-studio (link omitted to avoid creating a cross-reference)
- 8: GitHub issue 1154 in beekeeper-studio/beekeeper-studio (link omitted to avoid creating a cross-reference)
- 9: GitHub issue 3482 in beekeeper-studio/beekeeper-studio (link omitted to avoid creating a cross-reference)
🤖 get_repo_knowledge executed:
get_repo_knowledge pingcap/docs /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/conventions
Length of output: 3712
🏁 Script executed:
#!/bin/bash
set -e
sed -n '45,120p' develop/dev-guide-gui-beekeeper-studio.mdRepository: pingcap/docs
Length of output: 5130
Require server-certificate verification for these public connections.
Beekeeper Studio's default Trust the server mode enables SSL without authenticating the server. Update lines 59 and 111 to require certificate verification, using the TiDB Cloud CA certificate where needed.
|
|
||
| 7. Launch Beekeeper Studio. On the connections screen, click **New Connection**, select **TiDB** from the **Connection Type** list, and fill in the connection form: copy and paste the **Host**, **Port**, and **Username** from the connection dialog, and enter the password of the {{{ .premium }}} instance. | ||
|
|
||
| Leave **Enable SSL** off. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🔎 Supported by static analysis
🤖 get_repo_knowledge executed:
get_repo_knowledge pingcap/docs /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/conventions /tmp/coderabbit-repo-knowledge/pingcap-docs-9c73f70c/learnings
Length of output: 4452
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- target document ---'
cat -n develop/dev-guide-gui-beekeeper-studio.md | sed -n '1,125p'
printf '%s\n' '--- repository status and focused diff ---'
git status --short
git diff -- develop/dev-guide-gui-beekeeper-studio.md
printf '%s\n' '--- nearby documentation security terminology ---'
rg -n -C 2 'Enable SSL|CA Cert|certificate|TLS|Public|Premium' develop docs 2>/dev/null | head -n 160Repository: pingcap/docs
Length of output: 26015
Enable SSL for the public Premium connection.
Step 6 selects Public, but this instruction disables TLS. A successful connection can send credentials and database traffic without encryption. Enable SSL and configure the TiDB Cloud CA certificate to verify the server.
Proposed replacement
- Leave **Enable SSL** off.
+ Turn on **Enable SSL**. To verify the server certificate, download the CA certificate from the TiDB Cloud connection dialog and select it in the **CA Cert (optional)** field.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Leave **Enable SSL** off. | |
| Turn on **Enable SSL**. To verify the server certificate, download the CA certificate from the TiDB Cloud connection dialog and select it in the **CA Cert (optional)** field. |
1 participant
First-time contributors' checklist
What is changed, added, or deleted? (Required)
Added a "Connect to TiDB with Beekeeper Studio" tutorial page and linked it from the GUI tools table, replacing the "N/A" Tutorial cell for Beekeeper Studio.Closes #18009
Disclosure: I'm an operations contractor for Beekeeper Studio. I tested this walkthrough end-to-end against a TiDB Cloud Starter cluster and a local tiup playground cluster before writing it up.
Which TiDB version(s) do your changes apply to? (Required)
Tips for choosing the affected version(s):
By default, CHOOSE MASTER ONLY so your changes will be applied to the next TiDB major or minor releases. If your PR involves a product feature behavior change or a compatibility change, CHOOSE THE AFFECTED RELEASE BRANCH(ES) AND MASTER.
For details, see tips for choosing the affected versions.
What is the related PR or file link(s)?
AI agent involvement
Do your changes match any of the following descriptions?
Summary by CodeRabbit