diff --git a/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/01_aws.md b/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/01_aws.md index 5384ebc6ca5..c5fe74e7ad4 100644 --- a/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/01_aws.md +++ b/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/01_aws.md @@ -8,21 +8,32 @@ doc_type: 'reference' --- import Image from '@theme/IdealImage'; +import byoc_private_load_balancer from '@site/static/images/cloud/reference/byoc-private-load-balancer.png'; import byoc_vpcpeering from '@site/static/images/cloud/reference/byoc-vpcpeering-1.png'; import byoc_vpcpeering2 from '@site/static/images/cloud/reference/byoc-vpcpeering-2.png'; import byoc_vpcpeering3 from '@site/static/images/cloud/reference/byoc-vpcpeering-3.png'; import byoc_vpcpeering4 from '@site/static/images/cloud/reference/byoc-vpcpeering-4.png'; -import byoc_privatelink_1 from '@site/static/images/cloud/reference/byoc-privatelink-1.png'; +import byoc_privatelink from '@site/static/images/cloud/reference/byoc-privatelink.png'; +import byoc_privatelink_aws_cross_region from '@site/static/images/cloud/reference/byoc-privatelink-aws-cross-region.png'; +import aws_private_link_pecreate from '@site/static/images/cloud/security/aws-privatelink-pe-create.png'; +import aws_private_link_endpoint_settings from '@site/static/images/cloud/security/aws-privatelink-endpoint-settings.png'; +import aws_private_link_select_vpc from '@site/static/images/cloud/security/aws-privatelink-select-vpc-and-subnets.png'; +import aws_private_link_vpc_endpoint_id from '@site/static/images/cloud/security/aws-privatelink-vpc-endpoint-id.png'; import byoc_privatelink_2 from '@site/static/images/cloud/reference/byoc-privatelink-2.png'; +import aws_private_link_pe_filters from '@site/static/images/cloud/security/aws-privatelink-pe-filters.png'; +import aws_private_link_ped_nsname from '@site/static/images/cloud/security/aws-privatelink-pe-dns-name.png'; ClickHouse BYOC on AWS supports two private connection options including VPC Peering and AWS PrivateLink. ## Prerequisites {#common-prerequisites} -Common steps required by both VPC peering and Privatelink. +Common steps required by both VPC peering and PrivateLink. ### Enable private load balancer for ClickHouse BYOC {#step-enable-private-load-balancer-for-clickhouse-byoc} -Contact ClickHouse Support to enable Private Load Balancer. + +In the ClickHouse Cloud console, enable the **Private load balancer** for your BYOC infrastructure. + +BYOC Enable Private Load Balancer ## Set up VPC peering {#aws-vpc-peering} @@ -31,6 +42,7 @@ To create or delete VPC peering for ClickHouse BYOC, follow the steps: ### Create a peering connection {#step-1-create-a-peering-connection} + 1. Navigate to the VPC Dashboard in ClickHouse BYOC account. 2. Select Peering Connections. 3. Click Create Peering Connection @@ -41,12 +53,15 @@ To create or delete VPC peering for ClickHouse BYOC, follow the steps: BYOC Create Peering Connection ### Accept the peering connection request {#step-2-accept-the-peering-connection-request} + Go to the peering account, in the (VPC -> Peering connections -> Actions -> Accept request) page customer can approve this VPC peering request. BYOC Accept Peering Connection ### Add destination to ClickHouse VPC route tables {#step-3-add-destination-to-clickhouse-vpc-route-tables} + In ClickHouse BYOC account, + 1. Select Route Tables in the VPC Dashboard. 2. Search for the ClickHouse VPC ID. Edit each route table attached to the private subnets. 3. Click the Edit button under the Routes tab. @@ -57,7 +72,9 @@ In ClickHouse BYOC account, BYOC Add route table ### Add destination to the target VPC route tables {#step-4-add-destination-to-the-target-vpc-route-tables} + In the peering AWS account, + 1. Select Route Tables in the VPC Dashboard. 2. Search for the target VPC ID. 3. Click the Edit button under the Routes tab. @@ -72,10 +89,12 @@ In the peering AWS account, In the ClickHouse BYOC account, you need to update the Security Group settings to allow traffic from your peered VPC. Please contact ClickHouse Support to request the addition of inbound rules that include the CIDR ranges of your peered VPC. --- + The ClickHouse service should now be accessible from the peered VPC. To access ClickHouse privately, a private load balancer and endpoint are provisioned for secure connectivity from the user's peered VPC. The private endpoint follows the public endpoint format with a `-private` suffix. For example: + - **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-west-2.aws.byoc.clickhouse.cloud` - **Private endpoint**: `h5ju65kv87-private.mhp0y4dmph.us-west-2.aws.byoc.clickhouse.cloud` @@ -83,92 +102,86 @@ Optional, after verifying that peering is working, you can request the removal o ## Set up PrivateLink {#setup-privatelink} -AWS PrivateLink provides secure, private connectivity to your ClickHouse BYOC services without requiring VPC peering or internet gateways. Traffic flows entirely within the AWS network, never traversing the public internet. +AWS PrivateLink provides a secure and private connection to your ClickHouse BYOC services without the need for VPC peering or internet gateways. All traffic flows within the AWS network, ensuring that it never traverses the public internet. -### Request PrivateLink Setup {#step-1-request-privatelink-setup} - -Contact [ClickHouse Support](https://clickhouse.com/cloud/bring-your-own-cloud) to request PrivateLink setup for your BYOC deployment. No specific information is required at this stage—simply indicate that you want to set up PrivateLink connectivity. - -ClickHouse Support will enable the necessary infrastructure components, including **the private load balancer** and **PrivateLink service endpoint**. - -### Create an Endpoint in Your VPC {#step-2-create-endpoint} +### Enable private link in ClickHouse console {#step-1-enable-private-link} -After ClickHouse Support has enabled PrivateLink on their side, you need to create a VPC endpoint in your client application VPC to connect to the ClickHouse PrivateLink service. - -1. **Obtain the Endpoint Service Name**: - - ClickHouse Support will provide you with the Endpoint Service name - - You can also find it in the AWS VPC console under "Endpoint Services" (filter by service name or look for ClickHouse services) - -BYOC PrivateLink Service Endpoint - -2. **Create the VPC Endpoint**: - - Navigate to the AWS VPC Console → Endpoints → Create Endpoint - - Select "Find service by name" and enter the Endpoint Service name provided by ClickHouse Support - - Choose your VPC and select subnets (one per availability zone is recommended) - - **Important**: Enable "Private DNS names" for the endpoint—this is required for DNS resolution to work correctly - - Select or create a security group for the endpoint - - Click "Create Endpoint" - -:::important -**DNS Requirements**: -- Enable "Private DNS names" when creating the VPC endpoint -- Ensure your VPC has "DNS Hostnames" enabled (VPC Settings → DNS resolution and DNS hostnames) - -These settings are required for the PrivateLink DNS to function correctly. +:::note +Make sure the **private load balancer** is turned on as a prerequisite. ::: -3. **Approve the Endpoint Connection**: - - After creating the endpoint, you need to approve the connection request - - In the VPC Console, go to "Endpoint Connections" - - Find the connection request from ClickHouse and click "Accept" to approve it +BYOC PrivateLink Enable -BYOC PrivateLink Approve +### Obtain endpoint "Service name" {#step-2-obtain-endpoint-service-name} -### Add Endpoint ID to Service Allowlist {#step-3-add-endpoint-id-allowlist} +1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PrivateLink. +2. Click "Set up private endpoint". +3. In the opened flyout, copy the `Service name` value — you'll use it in the next step. (It may take a while for the value to be generated after enabling PrivateLink.) + Private Endpoints -Once your VPC endpoint is created and the connection is approved, you need to add the Endpoint ID to the allowlist for each ClickHouse service you want to access via PrivateLink. +### Create endpoint in your network {#step-3-create-endpoint} -1. **Obtain your Endpoint ID**: - - In the AWS VPC Console, go to Endpoints - - Select your newly created endpoint - - Copy the Endpoint ID (it will look like `vpce-xxxxxxxxxxxxxxxxx`) +1. Open your **own AWS console** (i.e. the AWS account where your client application is) → VPC → Endpoints → Create endpoints. +2. Select "Endpoint services that use NLBs and GWLBs" and use `Service name` obtained from the last step. +3. Click "Verify service". + AWS PrivateLink Endpoint Settings +4. (Optional) If you want to establish a cross-regional connection via PrivateLink, enable the "Cross region endpoint" checkbox and specify the service region. The service region is where your BYOC infrastructure is created. Meanwhile, + 1. Open your **BYOC AWS console** (i.e. the AWS account where your BYOC infrastructure is created) → VPC → Endpoint services → `clickhouse-cloud-infra-xxx` → Supported regions. + 2. Add the region where your client application is running to the supported regions list. By default, only the region of this BYOC infrastructure is supported. You can add multiple regions if you want to connect from different regions, and ClickHouse won't change or reset these values. + AWS PrivateLink Cross Region Endpoint Settings +5. Select your VPC and subnets (one per availability zone is recommended). + Select VPC and subnets +6. **Important**: Enable "Private DNS names" for the endpoint — this is required for Private DNS to function correctly. + Private DNS for BYOC endpoints (using the `*.vpce.{subdomain}` format) leverages AWS PrivateLink's built-in "Private DNS names" feature. No Route53 records are required — DNS resolution happens automatically when: + - "Private DNS names" is enabled and + - "DNS Hostnames" is enabled -2. **Contact ClickHouse Support**: - - Provide the Endpoint IDs to ClickHouse Support - - Specify which ClickHouse services should allow access from this endpoint - - ClickHouse Support will add the Endpoint ID to the service allowlist + via VPC Settings → DNS resolution and DNS hostnames. -### Connect to ClickHouse via PrivateLink {#step-4-connect-via-privatelink} + This ensures that connections using the `vpce` subdomain automatically route through the PrivateLink endpoint without additional DNS configuration. -After the Endpoint ID is added to the allowlist, you can connect to your ClickHouse service using the PrivateLink endpoint. +7. (Optional) Assign Security groups/Tags. + :::note + Make sure that ports `443`, `8443`, `9440`, `3306` are allowed in the security group. + ::: +8. Click "Create endpoint", wait a moment for the endpoint to be created. +9. After creating the endpoint, copy the `Endpoint ID` value — you'll use it in the next step. + VPC Endpoint ID -The PrivateLink endpoint format is similar to the public endpoint, but includes a `vpce` subdomain. For example: +### Approve the endpoint connection {#step-4-approve-endpoint-connection} -- **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-west-2.aws.clickhouse-byoc.com` -- **PrivateLink endpoint**: `h5ju65kv87.vpce.mhp0y4dmph.us-west-2.aws.clickhouse-byoc.com` +1. Open your **BYOC VPC console** again → Endpoint services → `clickhouse-cloud-infra-xxx` → Endpoint connections. +2. Find the connection request created from your own VPC and click "Accept endpoint connection request" to approve it. + BYOC PrivateLink Approve -DNS resolution in your VPC will automatically route traffic through the PrivateLink endpoint when you use the `vpce` subdomain format. +### Add "Endpoint ID" to ClickHouse service allow list {#step-5-add-endpoint-id-to-services-allow-list} - - -### PrivateLink Access Control {#privatelink-access-control} - -Access to ClickHouse services via PrivateLink is controlled at two levels: - -1. **Istio Authorization Policy**: ClickHouse Cloud's service-level authorization policies -2. **VPC Endpoint Security Group**: The security group attached to your VPC endpoint controls which resources in your VPC can use the endpoint +1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PrivateLink. +2. Click "Set up private endpoint". +3. In the opened flyout, enter the `Endpoint ID` obtained from the last step with an optional description. +4. Click "Create endpoint". :::note -The private load balancer's "Enforce inbound rules on PrivateLink traffic" feature is disabled, so access is controlled by Istio authorization policies and your VPC endpoint's security group only. +If you want to allow access from an existing PrivateLink connection, use the existing endpoint dropdown menu. +The dropdown will show the existing PrivateLink connections to the services within the same infrastructure. ::: +Private Endpoints Filter + +### Access an instance using PrivateLink {#step-6-connect-via-privatelink} -### PrivateLink DNS {#privatelink-dns} +1. In the ClickHouse Cloud console, navigate to service's Settings page. +2. Click "Set up private endpoint". +3. In the opened flyout, copy the `DNS name`. + Private Endpoint DNS Name -PrivateLink DNS for BYOC endpoints (using the `*.vpce.{subdomain}` format) leverages AWS PrivateLink's built-in "Private DNS names" feature. No Route53 records are required—DNS resolution happens automatically when: + Access to ClickHouse services via PrivateLink is controlled at two levels: + 1. **Istio Authorization Policy**: ClickHouse Cloud's service-level authorization policies + 2. **VPC Endpoint Security Group**: The security group attached to your VPC endpoint controls which resources in your VPC can use the endpoint -- "Private DNS names" is enabled on your VPC endpoint -- Your VPC has "DNS Hostnames" enabled + :::note + The private load balancer's "Enforce inbound rules on PrivateLink traffic" feature is disabled, so access is controlled by Istio authorization policies and your VPC endpoint's security group only. + ::: -This ensures that connections using the `vpce` subdomain automatically route through the PrivateLink endpoint without additional DNS configuration. + diff --git a/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/02_gcp.md b/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/02_gcp.md index 6b81d5203d8..a2b26757a61 100644 --- a/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/02_gcp.md +++ b/docs/cloud/guides/infrastructure/01_deployment_options/byoc/03_onboarding/03_network_setup/02_gcp.md @@ -8,24 +8,29 @@ doc_type: 'reference' --- import Image from '@theme/IdealImage'; +import byoc_private_load_balancer from '@site/static/images/cloud/reference/byoc-private-load-balancer.png'; import byoc_vpcpeering from '@site/static/images/cloud/reference/byoc-vpcpeering-gcp-1.png'; import byoc_vpcpeering2 from '@site/static/images/cloud/reference/byoc-vpcpeering-gcp-2.png'; import byoc_vpcpeering3 from '@site/static/images/cloud/reference/byoc-vpcpeering-gcp-3.png'; -import byoc_privatelink_1 from '@site/static/images/cloud/reference/byoc-privatelink-gcp-1.png'; -import byoc_privatelink_2 from '@site/static/images/cloud/reference/byoc-privatelink-gcp-2.png'; -import byoc_privatelink_3 from '@site/static/images/cloud/reference/byoc-privatelink-gcp-3.png'; -import byoc_privatelink_4 from '@site/static/images/cloud/reference/byoc-privatelink-gcp-4.png'; -import byoc_privatelink_5 from '@site/static/images/cloud/reference/byoc-privatelink-gcp-5.png'; -import byoc_privatelink_6 from '@site/static/images/cloud/reference/byoc-privatelink-gcp-6.png'; +import byoc_privatelink from '@site/static/images/cloud/reference/byoc-privatelink.png'; +import gcp_privatelink_pe_create from '@site/static/images/cloud/security/gcp-privatelink-pe-create.png'; +import gcp_psc_open from '@site/static/images/cloud/security/gcp-psc-open.png'; +import gcp_psc_enable_global_access from '@site/static/images/cloud/security/gcp-psc-enable-global-access.png'; +import gcp_psc_copy_connection_id from '@site/static/images/cloud/security/gcp-psc-copy-connection-id.png'; +import gcp_privatelink_pe_filters from '@site/static/images/cloud/security/gcp-privatelink-pe-filters.png'; +import gcp_privatelink_pe_dns from '@site/static/images/cloud/security/gcp-privatelink-pe-dns.png'; -ClickHouse BYOC on GCP supports two private connection options including VPC Peering and Private Service Connect. Traffic flows entirely within the GCP network, never traversing the public internet. +ClickHouse BYOC on GCP supports two private connection options including VPC Peering and PSC (Private Service Connect). ## Prerequisites {#common-prerequisites} -Common steps required by both VPC peering and Private Service Connect. +Common steps required by both VPC peering and PSC. ### Enable private load balancer for ClickHouse BYOC {#step-enable-private-load-balancer-for-clickhouse-byoc} -Contact ClickHouse Support to enable Private Load Balancer. + +In the ClickHouse Cloud console, enable the **Private load balancer** for your BYOC infrastructure. + +BYOC Enable Private Load Balancer ## Set up VPC peering {#gcp-vpc-peering} @@ -63,79 +68,81 @@ The ClickHouse service should now be accessible from the peered VPC. ### Access ClickHouse service via peering connection {#step-2-access-ch-service-via-peering} To access ClickHouse privately, a private load balancer and endpoint are provisioned for secure connectivity from the user's peered VPC. The private endpoint follows the public endpoint format with a `-private` suffix. For example: + - **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-east1.gcp.byoc.clickhouse.cloud` - **Private endpoint**: `h5ju65kv87-private.mhp0y4dmph.us-east1.gcp.byoc.clickhouse.cloud` -## Set up PSC (Private Service Connect) {#gcp-psc} +## Set up PSC (Private Service Connect) {#setup-psc} -GCP PSC (Private Service Connect) provides secure, private connectivity to your ClickHouse BYOC services without requiring VPC peering or internet gateways. +GCP PSC (Private Service Connect) provides a secure and private connection to your ClickHouse BYOC services without the need for VPC peering or internet gateways. All traffic flows within the GCP network, ensuring that it never traverses the public internet. -### Request PSC service setup {#step-1-request-psc-setup} - -Contact [ClickHouse Support](https://clickhouse.com/cloud/bring-your-own-cloud) to request PSC service setup for your BYOC deployment. No specific information is required at this stage—simply indicate that you want to set up PSC connectivity. +### Enable private link in ClickHouse console {#step-1-enable-private-link} -ClickHouse Support will enable the necessary infrastructure components, including **the private load balancer** and **PSC Service**. - -### Obtain GCP PSC service name and DNS name {#step-2-obtain-gcp-service-attachment-and-dns-name-for-private-service-connect} - -ClickHouse Support will provide you with the PSC Service name. You can also obtain it in the ClickHouse Cloud console, under "Organization" -> "Infrastructure", click into the infra name to see the details. +:::note +Make sure the **private load balancer** is turned on as a prerequisite. +::: -BYOC PSC Endpoint -BYOC PSC Endpoint +BYOC PrivateLink Enable -You can also find the PSC service name in the GCP Private Service Connect console under "Published services" (filter by service name or look for ClickHouse services) +### Obtain endpoint "Service name" {#step-2-obtain-endpoint-service-name} -BYOC PSC Endpoint -BYOC PSC Endpoint +1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PSC. +2. Click "Set up private endpoint". +3. In the opened flyout, copy the `Service name` and `DNS name` value — you'll use them in the next step. (It may take a while for the value to be generated after enabling private link.) + Private Endpoints -### Create a PSC endpoint in your network {#step-3-create-endpoint} +### Create endpoint in your network {#step-3-create-endpoint} -After ClickHouse Support has enabled PSC service on their side, you need to create a PSC endpoint in your client application network to connect to the ClickHouse PSC service. +1. Open your **own GCP console** (i.e. the GCP account where your client application is) → Network Services → Private Service Connect → Connected Endpoints. +2. Open the Private Service Connect creation dialog by clicking the "Connect Endpoint" button. + Open Private Service Connect in Google Cloud console +3. Input the following fields: + - **Target**: use `Published service` + - **Target service**: use `Service name` obtained from the last step + - **Endpoint name**: input a valid endpoint name + - **Network/Subnetwork**: choose the network you want to use for the connection; this is the network where your client application will be connecting from + - **IP address**: choose or create a new IP address for the endpoint; the IP address needs to be used by step [Set private DNS name for endpoint](#step-5-set-private-dns-name-for-endpoint) + - (optional) **Enable global access**: enable it if you want to make the endpoint available from any region + Enable Global Access for Private Service Connect + - Click "ADD ENDPOINT" button to create the endpoint. -1. **Create the PSC Endpoint**: -- Navigate to the GCP Console -> Network Services → Private Service Connect → Connect Endpoint -- Select "Published service" for "Target" and input the PSC service name obtained at last step to "Target details" -- Input a valid endpoint name -- Choose your network and select subnets (This is the network where your client application will be connecting from) -- Choose or create a new IP address for the endpoint, the IP address needs to be used by step [Set private DNS name for endpoint](#step-4-set-private-dns-name-for-endpoint) -- Click "Add Endpoint", wait a moment for the endpoint to be created. -- The endpoint status should become "Accepted", contact ClickHouse support if it's not auto-accepted. +4. The Status column will change from Pending to Accepted once the connection is approved. +5. After creating the endpoint, copy the `PSC Connection ID` value — you'll use it in the next step. + Copy PSC Connection ID -BYOC PSC endpoint creation +### Add "Endpoint ID" to ClickHouse service allow list {#step-4-add-endpoint-id-to-services-allow-list} -2. **Obtain PSC Connection ID**: -- Click into the endpoint detail and obtain the "PSC Connection ID" to be used by step [Add endpoint's PSC Connection ID to service allowlist](#step-5-add-endpoint-id-allowlist) +1. In the ClickHouse Cloud console, navigate to the service's Settings page that you would like to connect to via PSC. +2. Click "Set up private endpoint". +3. In the opened flyout, enter the `PSC Connection ID` obtained from the last step into the `Endpoint ID` field with an optional description. +4. Click "Create endpoint". -BYOC PSC endpoint detail +:::note +If you want to allow access from an existing PSC connection, use the existing endpoint dropdown menu. +The dropdown will show the existing PSC connections to the services within the same infrastructure. +::: +Private Endpoints Filter -### Set private DNS name for endpoint {#step-4-set-private-dns-name-for-endpoint} +### Set private DNS name for endpoint {#step-5-set-private-dns-name-for-endpoint} :::note There are various ways to configure DNS. Please set up DNS according to your specific use case. ::: -You need to point all subdomains (wildcard) of the "DNS name", taken from [Obtain GCP PSC service name and DNS name](#step-2-obtain-gcp-service-attachment-and-dns-name-for-private-service-connect) step, to GCP PSC endpoint IP address. This ensures that services/components within your VPC/Network can resolve it properly. - -### Add endpoint's PSC Connection ID to service allowlist {#step-5-add-endpoint-id-allowlist} - -Once your PSC endpoint is created and the status is "Accepted", you need to add the Endpoint's PSC Connection ID to the allowlist for **each ClickHouse service** you want to access via PSC. - -**Contact ClickHouse Support**: -- Provide the Endpoint's PSC Connection IDs to ClickHouse Support -- Specify which ClickHouse services should allow access from this endpoint -- ClickHouse Support will add the Endpoint Connection IDs to the service allowlist - -### Connect to ClickHouse via PSC {#step-6-connect-via-psc-endpoint} - -After the Endpoint Connection IDs is added to the allowlist, you can connect to your ClickHouse service using the PSC endpoint. +You need to point all subdomains (wildcard) of the "DNS name" to GCP PSC endpoint IP address. This ensures that services/components within your VPC/Network can resolve it properly. -The PSC endpoint format is similar to the public endpoint, but includes a `p` subdomain. For example: +### Access an instance using PSC {#step-6-connect-via-psc} -- **Public endpoint**: `h5ju65kv87.mhp0y4dmph.us-east1.gcp.clickhouse-byoc.com` -- **PSC endpoint**: `h5ju65kv87.p.mhp0y4dmph.us-east1.gcp.clickhouse-byoc.com` +1. In the ClickHouse Cloud console, navigate to service's Settings page. +2. Click "Set up private endpoint". +3. In the opened flyout, copy the `DNS name`. + Private Endpoint DNS Name + :::note + Access to ClickHouse services via PSC is controlled by ClickHouse Cloud's service-level **Istio Authorization Policy**. + ::: diff --git a/static/images/cloud/reference/byoc-private-load-balancer.png b/static/images/cloud/reference/byoc-private-load-balancer.png new file mode 100644 index 00000000000..58938247597 Binary files /dev/null and b/static/images/cloud/reference/byoc-private-load-balancer.png differ diff --git a/static/images/cloud/reference/byoc-privatelink-aws-cross-region.png b/static/images/cloud/reference/byoc-privatelink-aws-cross-region.png new file mode 100644 index 00000000000..0a98b9cf0b0 Binary files /dev/null and b/static/images/cloud/reference/byoc-privatelink-aws-cross-region.png differ diff --git a/static/images/cloud/reference/byoc-privatelink.png b/static/images/cloud/reference/byoc-privatelink.png new file mode 100644 index 00000000000..1047c191b54 Binary files /dev/null and b/static/images/cloud/reference/byoc-privatelink.png differ