diff --git a/images/cloud/reference/byoc-private-load-balancer.png b/images/cloud/reference/byoc-private-load-balancer.png
new file mode 100644
index 000000000..589382475
Binary files /dev/null and b/images/cloud/reference/byoc-private-load-balancer.png differ
diff --git a/images/cloud/reference/byoc-privatelink-aws-cross-region.png b/images/cloud/reference/byoc-privatelink-aws-cross-region.png
new file mode 100644
index 000000000..0a98b9cf0
Binary files /dev/null and b/images/cloud/reference/byoc-privatelink-aws-cross-region.png differ
diff --git a/images/cloud/reference/byoc-privatelink.png b/images/cloud/reference/byoc-privatelink.png
new file mode 100644
index 000000000..1047c191b
Binary files /dev/null and b/images/cloud/reference/byoc-privatelink.png differ
diff --git a/products/bring-your-own-cloud/onboarding/network-aws.mdx b/products/bring-your-own-cloud/onboarding/network-aws.mdx
index cdc7c67a6..8f1a41fa1 100644
--- a/products/bring-your-own-cloud/onboarding/network-aws.mdx
+++ b/products/bring-your-own-cloud/onboarding/network-aws.mdx
@@ -13,10 +13,13 @@ ClickHouse BYOC on AWS supports two private connection options including VPC Pee
## Prerequisites {#common-prerequisites}
-Common steps required by both VPC peering and Privatelink.
+Common steps required by both VPC peering and PrivateLink.
### Enable private load balancer for ClickHouse BYOC {#step-enable-private-load-balancer-for-clickhouse-byoc}
-Contact ClickHouse Support to enable Private Load Balancer.
+
+In the ClickHouse Cloud console, enable the **Private load balancer** for your BYOC infrastructure.
+
+
## Set up VPC peering {#aws-vpc-peering}
@@ -25,6 +28,7 @@ To create or delete VPC peering for ClickHouse BYOC, follow the steps:
### Create a peering connection {#step-1-create-a-peering-connection}
+
1. Navigate to the VPC Dashboard in ClickHouse BYOC account.
2. Select Peering Connections.
3. Click Create Peering Connection
@@ -36,13 +40,16 @@ To create or delete VPC peering for ClickHouse BYOC, follow the steps:
### Accept the peering connection request {#step-2-accept-the-peering-connection-request}
+
Go to the peering account, in the (VPC -> Peering connections -> Actions -> Accept request) page customer can approve this VPC peering request.
### Add destination to ClickHouse VPC route tables {#step-3-add-destination-to-clickhouse-vpc-route-tables}
+
In ClickHouse BYOC account,
+
1. Select Route Tables in the VPC Dashboard.
2. Search for the ClickHouse VPC ID. Edit each route table attached to the private subnets.
3. Click the Edit button under the Routes tab.
@@ -54,7 +61,9 @@ In ClickHouse BYOC account,
### Add destination to the target VPC route tables {#step-4-add-destination-to-the-target-vpc-route-tables}
+
In the peering AWS account,
+
1. Select Route Tables in the VPC Dashboard.
2. Search for the target VPC ID.
3. Click the Edit button under the Routes tab.
@@ -70,11 +79,13 @@ In the peering AWS account,
In the ClickHouse BYOC account, you need to update the Security Group settings to allow traffic from your peered VPC. Please contact ClickHouse Support to request the addition of inbound rules that include the CIDR ranges of your peered VPC.
---
+
The ClickHouse service should now be accessible from the peered VPC.
To access ClickHouse privately, a private load balancer and endpoint are provisioned for secure connectivity from the user's peered VPC. The private endpoint follows the public endpoint format with a `-private` suffix. For example:
+
- **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-west-2.aws.byoc.clickhouse.cloud`
- **Private endpoint**: `h5ju65kv87-private.mhp0y4dmph.us-west-2.aws.byoc.clickhouse.cloud`
@@ -82,95 +93,91 @@ Optional, after verifying that peering is working, you can request the removal o
## Set up PrivateLink {#setup-privatelink}
-AWS PrivateLink provides secure, private connectivity to your ClickHouse BYOC services without requiring VPC peering or internet gateways. Traffic flows entirely within the AWS network, never traversing the public internet.
+AWS PrivateLink provides a secure and private connection to your ClickHouse BYOC services without the need for VPC peering or internet gateways. All traffic flows within the AWS network, ensuring that it never traverses the public internet.
-### Request PrivateLink Setup {#step-1-request-privatelink-setup}
+### Enable private link in ClickHouse console {#step-1-enable-private-link}
-Contact [ClickHouse Support](https://clickhouse.com/cloud/bring-your-own-cloud) to request PrivateLink setup for your BYOC deployment. No specific information is required at this stage—simply indicate that you want to set up PrivateLink connectivity.
+
+Make sure the **private load balancer** is turned on as a prerequisite.
+
-ClickHouse Support will enable the necessary infrastructure components, including **the private load balancer** and **PrivateLink service endpoint**.
+
-### Create an Endpoint in Your VPC {#step-2-create-endpoint}
-
-After ClickHouse Support has enabled PrivateLink on their side, you need to create a VPC endpoint in your client application VPC to connect to the ClickHouse PrivateLink service.
-
-1. **Obtain the Endpoint Service Name**:
- - ClickHouse Support will provide you with the Endpoint Service name
- - You can also find it in the AWS VPC console under "Endpoint Services" (filter by service name or look for ClickHouse services)
-
-
-
-2. **Create the VPC Endpoint**:
- - Navigate to the AWS VPC Console → Endpoints → Create Endpoint
- - Select "Find service by name" and enter the Endpoint Service name provided by ClickHouse Support
- - Choose your VPC and select subnets (one per availability zone is recommended)
- - **Important**: Enable "Private DNS names" for the endpoint—this is required for DNS resolution to work correctly
- - Select or create a security group for the endpoint
- - Click "Create Endpoint"
-
-
-**DNS Requirements**:
-- Enable "Private DNS names" when creating the VPC endpoint
-- Ensure your VPC has "DNS Hostnames" enabled (VPC Settings → DNS resolution and DNS hostnames)
+### Obtain endpoint "Service name" {#step-2-obtain-endpoint-service-name}
-These settings are required for the PrivateLink DNS to function correctly.
-
-
-3. **Approve the Endpoint Connection**:
- - After creating the endpoint, you need to approve the connection request
- - In the VPC Console, go to "Endpoint Connections"
- - Find the connection request from ClickHouse and click "Accept" to approve it
-
-
+1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PrivateLink.
+2. Click "Set up private endpoint".
+3. In the opened flyout, copy the `Service name` value — you'll use it in the next step. (It may take a while for the value to be generated after enabling PrivateLink.)
+
-### Add Endpoint ID to Service Allowlist {#step-3-add-endpoint-id-allowlist}
-
-Once your VPC endpoint is created and the connection is approved, you need to add the Endpoint ID to the allowlist for each ClickHouse service you want to access via PrivateLink.
-
-1. **Obtain your Endpoint ID**:
- - In the AWS VPC Console, go to Endpoints
- - Select your newly created endpoint
- - Copy the Endpoint ID (it will look like `vpce-xxxxxxxxxxxxxxxxx`)
-
-2. **Contact ClickHouse Support**:
- - Provide the Endpoint IDs to ClickHouse Support
- - Specify which ClickHouse services should allow access from this endpoint
- - ClickHouse Support will add the Endpoint ID to the service allowlist
+### Create endpoint in your network {#step-3-create-endpoint}
+
+1. Open your **own AWS console** (i.e. the AWS account where your client application is) → VPC → Endpoints → Create endpoints.
+2. Select "Endpoint services that use NLBs and GWLBs" and use `Service name` obtained from the last step.
+3. Click "Verify service".
+
+4. (Optional) If you want to establish a cross-regional connection via PrivateLink, enable the "Cross region endpoint" checkbox and specify the service region. The service region is where your BYOC infrastructure is created. Meanwhile,
+ 1. Open your **BYOC AWS console** (i.e. the AWS account where your BYOC infrastructure is created) → VPC → Endpoint services → `clickhouse-cloud-infra-xxx` → Supported regions.
+ 2. Add the region where your client application is running to the supported regions list. By default, only the region of this BYOC infrastructure is supported. You can add multiple regions if you want to connect from different regions, and ClickHouse won't change or reset these values.
+
+5. Select your VPC and subnets (one per availability zone is recommended).
+
+6. **Important**: Enable "Private DNS names" for the endpoint — this is required for Private DNS to function correctly.
+ Private DNS for BYOC endpoints (using the `*.vpce.{subdomain}` format) leverages AWS PrivateLink's built-in "Private DNS names" feature. No Route53 records are required — DNS resolution happens automatically when:
+ - "Private DNS names" is enabled and
+ - "DNS Hostnames" is enabled
+
+ via VPC Settings → DNS resolution and DNS hostnames.
+
+ This ensures that connections using the `vpce` subdomain automatically route through the PrivateLink endpoint without additional DNS configuration.
+
+7. (Optional) Assign Security groups/Tags.
+
+ Make sure that ports `443`, `8443`, `9440`, `3306` are allowed in the security group.
+
+8. Click "Create endpoint", wait a moment for the endpoint to be created.
+9. After creating the endpoint, copy the `Endpoint ID` value — you'll use it in the next step.
+
-### Connect to ClickHouse via PrivateLink {#step-4-connect-via-privatelink}
+### Approve the endpoint connection {#step-4-approve-endpoint-connection}
-After the Endpoint ID is added to the allowlist, you can connect to your ClickHouse service using the PrivateLink endpoint.
-
-The PrivateLink endpoint format is similar to the public endpoint, but includes a `vpce` subdomain. For example:
-
-- **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-west-2.aws.clickhouse-byoc.com`
-- **PrivateLink endpoint**: `h5ju65kv87.vpce.mhp0y4dmph.us-west-2.aws.clickhouse-byoc.com`
-
-DNS resolution in your VPC will automatically route traffic through the PrivateLink endpoint when you use the `vpce` subdomain format.
+1. Open your **BYOC VPC console** again → Endpoint services → `clickhouse-cloud-infra-xxx` → Endpoint connections.
+2. Find the connection request created from your own VPC and click "Accept endpoint connection request" to approve it.
+
-
-
-### PrivateLink Access Control {#privatelink-access-control}
-
-Access to ClickHouse services via PrivateLink is controlled at two levels:
+
+### Add "Endpoint ID" to ClickHouse service allow list {#step-5-add-endpoint-id-to-services-allow-list}
-1. **Istio Authorization Policy**: ClickHouse Cloud's service-level authorization policies
-2. **VPC Endpoint Security Group**: The security group attached to your VPC endpoint controls which resources in your VPC can use the endpoint
+1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PrivateLink.
+2. Click "Set up private endpoint".
+3. In the opened flyout, enter the `Endpoint ID` obtained from the last step with an optional description.
+4. Click "Create endpoint".
-The private load balancer's "Enforce inbound rules on PrivateLink traffic" feature is disabled, so access is controlled by Istio authorization policies and your VPC endpoint's security group only.
+If you want to allow access from an existing PrivateLink connection, use the existing endpoint dropdown menu.
+The dropdown will show the existing PrivateLink connections to the services within the same infrastructure.
+
+
+
+### Access an instance using PrivateLink {#step-6-connect-via-privatelink}
-### PrivateLink DNS {#privatelink-dns}
-
-PrivateLink DNS for BYOC endpoints (using the `*.vpce.{subdomain}` format) leverages AWS PrivateLink's built-in "Private DNS names" feature. No Route53 records are required—DNS resolution happens automatically when:
+1. In the ClickHouse Cloud console, navigate to service's Settings page.
+2. Click "Set up private endpoint".
+3. In the opened flyout, copy the `DNS name`.
+
-- "Private DNS names" is enabled on your VPC endpoint
-- Your VPC has "DNS Hostnames" enabled
+ Access to ClickHouse services via PrivateLink is controlled at two levels:
+ 1. **Istio Authorization Policy**: ClickHouse Cloud's service-level authorization policies
+ 2. **VPC Endpoint Security Group**: The security group attached to your VPC endpoint controls which resources in your VPC can use the endpoint
-This ensures that connections using the `vpce` subdomain automatically route through the PrivateLink endpoint without additional DNS configuration.
+
+ The private load balancer's "Enforce inbound rules on PrivateLink traffic" feature is disabled, so access is controlled by Istio authorization policies and your VPC endpoint's security group only.
+
+
+
diff --git a/products/bring-your-own-cloud/onboarding/network-gcp.mdx b/products/bring-your-own-cloud/onboarding/network-gcp.mdx
index 3ede624d5..6b23d1570 100644
--- a/products/bring-your-own-cloud/onboarding/network-gcp.mdx
+++ b/products/bring-your-own-cloud/onboarding/network-gcp.mdx
@@ -9,14 +9,17 @@ doc_type: 'reference'
import { Image } from "/snippets/components/Image.jsx";
-ClickHouse BYOC on GCP supports two private connection options including VPC Peering and Private Service Connect. Traffic flows entirely within the GCP network, never traversing the public internet.
+ClickHouse BYOC on GCP supports two private connection options including VPC Peering and PSC (Private Service Connect).
## Prerequisites {#common-prerequisites}
-Common steps required by both VPC peering and Private Service Connect.
+Common steps required by both VPC peering and PSC.
### Enable private load balancer for ClickHouse BYOC {#step-enable-private-load-balancer-for-clickhouse-byoc}
-Contact ClickHouse Support to enable Private Load Balancer.
+
+In the ClickHouse Cloud console, enable the **Private load balancer** for your BYOC infrastructure.
+
+
## Set up VPC peering {#gcp-vpc-peering}
@@ -55,84 +58,86 @@ The ClickHouse service should now be accessible from the peered VPC.
### Access ClickHouse service via peering connection {#step-2-access-ch-service-via-peering}
To access ClickHouse privately, a private load balancer and endpoint are provisioned for secure connectivity from the user's peered VPC. The private endpoint follows the public endpoint format with a `-private` suffix. For example:
+
- **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-east1.gcp.byoc.clickhouse.cloud`
- **Private endpoint**: `h5ju65kv87-private.mhp0y4dmph.us-east1.gcp.byoc.clickhouse.cloud`
-## Set up PSC (Private Service Connect) {#gcp-psc}
+## Set up PSC (Private Service Connect) {#setup-psc}
-GCP PSC (Private Service Connect) provides secure, private connectivity to your ClickHouse BYOC services without requiring VPC peering or internet gateways.
+GCP PSC (Private Service Connect) provides a secure and private connection to your ClickHouse BYOC services without the need for VPC peering or internet gateways. All traffic flows within the GCP network, ensuring that it never traverses the public internet.
-### Request PSC service setup {#step-1-request-psc-setup}
+### Enable private link in ClickHouse console {#step-1-enable-private-link}
-Contact [ClickHouse Support](https://clickhouse.com/cloud/bring-your-own-cloud) to request PSC service setup for your BYOC deployment. No specific information is required at this stage—simply indicate that you want to set up PSC connectivity.
+
+Make sure the **private load balancer** is turned on as a prerequisite.
+
-ClickHouse Support will enable the necessary infrastructure components, including **the private load balancer** and **PSC Service**.
+
-### Obtain GCP PSC service name and DNS name {#step-2-obtain-gcp-service-attachment-and-dns-name-for-private-service-connect}
-
-ClickHouse Support will provide you with the PSC Service name. You can also obtain it in the ClickHouse Cloud console, under "Organization" -> "Infrastructure", click into the infra name to see the details.
+### Obtain endpoint "Service name" {#step-2-obtain-endpoint-service-name}
-
-
-
-You can also find the PSC service name in the GCP Private Service Connect console under "Published services" (filter by service name or look for ClickHouse services)
-
-
-
+1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PSC.
+2. Click "Set up private endpoint".
+3. In the opened flyout, copy the `Service name` and `DNS name` value — you'll use them in the next step. (It may take a while for the value to be generated after enabling private link.)
+
-### Create a PSC endpoint in your network {#step-3-create-endpoint}
-
-After ClickHouse Support has enabled PSC service on their side, you need to create a PSC endpoint in your client application network to connect to the ClickHouse PSC service.
-
-1. **Create the PSC Endpoint**:
-- Navigate to the GCP Console -> Network Services → Private Service Connect → Connect Endpoint
-- Select "Published service" for "Target" and input the PSC service name obtained at last step to "Target details"
-- Input a valid endpoint name
-- Choose your network and select subnets (This is the network where your client application will be connecting from)
-- Choose or create a new IP address for the endpoint, the IP address needs to be used by step [Set private DNS name for endpoint](#step-4-set-private-dns-name-for-endpoint)
-- Click "Add Endpoint", wait a moment for the endpoint to be created.
-- The endpoint status should become "Accepted", contact ClickHouse support if it's not auto-accepted.
-
-
-
-2. **Obtain PSC Connection ID**:
-- Click into the endpoint detail and obtain the "PSC Connection ID" to be used by step [Add endpoint's PSC Connection ID to service allowlist](#step-5-add-endpoint-id-allowlist)
-
-
+### Create endpoint in your network {#step-3-create-endpoint}
+
+1. Open your **own GCP console** (i.e. the GCP account where your client application is) → Network Services → Private Service Connect → Connected Endpoints.
+2. Open the Private Service Connect creation dialog by clicking the "Connect Endpoint" button.
+
+3. Input the following fields:
+ - **Target**: use `Published service`
+ - **Target service**: use `Service name` obtained from the last step
+ - **Endpoint name**: input a valid endpoint name
+ - **Network/Subnetwork**: choose the network you want to use for the connection; this is the network where your client application will be connecting from
+ - **IP address**: choose or create a new IP address for the endpoint; the IP address needs to be used by step [Set private DNS name for endpoint](#step-5-set-private-dns-name-for-endpoint)
+ - (optional) **Enable global access**: enable it if you want to make the endpoint available from any region
+
+ - Click "ADD ENDPOINT" button to create the endpoint.
+
+4. The Status column will change from Pending to Accepted once the connection is approved.
+5. After creating the endpoint, copy the `PSC Connection ID` value — you'll use it in the next step.
+
-### Set private DNS name for endpoint {#step-4-set-private-dns-name-for-endpoint}
+### Add "Endpoint ID" to ClickHouse service allow list {#step-4-add-endpoint-id-to-services-allow-list}
+
+1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PSC.
+2. Click "Set up private endpoint".
+3. In the opened flyout, enter the `PSC Connection ID` obtained from the last step into the `Endpoint ID` field with an optional description.
+4. Click "Create endpoint".
-There are various ways to configure DNS. Please set up DNS according to your specific use case.
+If you want to allow access from an existing PSC connection, use the existing endpoint dropdown menu.
+The dropdown will show the existing PSC connections to the services within the same infrastructure.
-
-You need to point all subdomains (wildcard) of the "DNS name", taken from [Obtain GCP PSC service name and DNS name](#step-2-obtain-gcp-service-attachment-and-dns-name-for-private-service-connect) step, to GCP PSC endpoint IP address. This ensures that services/components within your VPC/Network can resolve it properly.
+
-### Add endpoint's PSC Connection ID to service allowlist {#step-5-add-endpoint-id-allowlist}
+### Set private DNS name for endpoint {#step-5-set-private-dns-name-for-endpoint}
-Once your PSC endpoint is created and the status is "Accepted", you need to add the Endpoint's PSC Connection ID to the allowlist for **each ClickHouse service** you want to access via PSC.
+
+There are various ways to configure DNS. Please set up DNS according to your specific use case.
+
-**Contact ClickHouse Support**:
-- Provide the Endpoint's PSC Connection IDs to ClickHouse Support
-- Specify which ClickHouse services should allow access from this endpoint
-- ClickHouse Support will add the Endpoint Connection IDs to the service allowlist
+You need to point all subdomains (wildcard) of the "DNS name" to GCP PSC endpoint IP address. This ensures that services/components within your VPC/Network can resolve it properly.
-### Connect to ClickHouse via PSC {#step-6-connect-via-psc-endpoint}
-
-After the Endpoint Connection IDs is added to the allowlist, you can connect to your ClickHouse service using the PSC endpoint.
-
-The PSC endpoint format is similar to the public endpoint, but includes a `p` subdomain. For example:
-
-- **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-east1.gcp.clickhouse-byoc.com`
-- **PSC endpoint**: `h5ju65kv87.p.mhp0y4dmph.us-east1.gcp.clickhouse-byoc.com`
+### Access an instance using PSC {#step-6-connect-via-psc}
+
+1. In the ClickHouse Cloud console, navigate to service's Settings page.
+2. Click "Set up private endpoint".
+3. In the opened flyout, copy the `DNS name`.
+
+
+ Access to ClickHouse services via PSC is controlled by ClickHouse Cloud's service-level **Istio Authorization Policy**.
+