byoc: add resource pool management doc

TOC-tidb-cloud-byoc.md

@@ -40,6 +40,10 @@
   - [Joint Validation](/tidb-cloud/byoc/joint-validation.md)
   - [Security Hardening](/tidb-cloud/byoc/security-hardening.md)
   - [Multi-Region Deployment](/tidb-cloud/byoc/multi-region-deployment.md)
+- Manage Resources
+  - Resource Pools
+    - [Create a Resource Pool](/tidb-cloud/byoc/create-resource-pool-byoc.md)
+    - [Manage Resource Pools](/tidb-cloud/byoc/manage-resource-pools-byoc.md)
 - Manage Instances
   - [Create a {{{ .byoc }}} Instance](/tidb-cloud/byoc/create-tidb-instance-byoc.md)
   - Connect to Your {{{ .byoc }}} Instance

tidb-cloud/architecture-concepts.md

@@ -110,6 +110,7 @@ A TiDB Cloud BYOC deployment includes the following major components:
 
 - **TiDB Cloud control plane**: provides the TiDB Cloud console, organization and project management, billing, lifecycle orchestration, monitoring views, alerting, and maintenance workflows.
 - **BYOC data plane**: runs the TiDB service and related infrastructure in your cloud account. TiDB Cloud operates this environment based on the permissions granted during BYOC onboarding.
+- **Resource pool**: defines the underlying physical resource, network, and capacity boundary for one or more {{{ .byoc }}} instances. Each resource pool has its own capacity configuration, resource pool CIDR, high availability mode, and AWS resource tags.
 - **TiDB service VPC**: hosts TiDB service components that serve application traffic.
 - **Observability service VPC**: hosts observability components used to collect metrics, logs, and operational data for the BYOC deployment.
 - **Application VPC**: hosts your applications. You manage this VPC and configure network connectivity to access the BYOC TiDB service.

tidb-cloud/byoc/_index.md

@@ -53,7 +53,11 @@ summary: TiDB Cloud is a fully-managed Database-as-a-Service (DBaaS) that brings
 
 <LearningPath label="Maintain" icon="cloud7">
 
-[Create a {{{ .byoc }}} Instance](https://docs.tidb.io/tidbcloud/create-tidb-instance-premium/?plan=byoc)
+[Create a Resource Pool](https://docs.tidb.io/tidbcloud/create-resource-pool-byoc/?plan=byoc)
+
+[Manage Resource Pools](https://docs.tidb.io/tidbcloud/manage-resource-pools-byoc/?plan=byoc)
+
+[Create a {{{ .byoc }}} Instance](https://docs.tidb.io/tidbcloud/create-tidb-instance-byoc/?plan=byoc)
 
 [Connect to a {{{ .byoc }}} Instance](https://docs.tidb.io/tidbcloud/connect-to-tidb-instance/?plan=byoc)
 

tidb-cloud/byoc/byoc-features.md

@@ -46,10 +46,14 @@ This document lists the feature support status for TiDB Cloud BYOC.
     <td style="text-align:center;">🚧</td>
   </tr>
   <tr>
-    <td rowspan="8" style="background-color: white;">Resource management</td>
+    <td rowspan="9" style="background-color: white;">Resource management</td>
     <td>Pay as you use</td>
     <td style="text-align:center; font-size: 14px;">❌</td>
   </tr>
+  <tr>
+    <td>Resource pool management</td>
+    <td style="text-align:center;">🔒</td>
+  </tr>
   <tr>
     <td>Automatic scaling based on workload</td>
     <td style="text-align:center;">🔒</td>

tidb-cloud/byoc/byoc-initialize-service.md

@@ -5,35 +5,37 @@ summary: This document outlines the process for creating a TiDB Cloud BYOC insta
 
 # Create Your First TiDB Cloud BYOC Instance
 
-After deploying your BYOC infrastructure, create your first {{{ .byoc }}} instance and configure secure administrative access.
+After deploying your BYOC infrastructure, create a resource pool, create your first {{{ .byoc }}} instance in the resource pool, and configure secure administrative access.
 
 ## Create a BYOC instance
 
-You can now provision TiDB instances directly via the TiDB Cloud console.
+You can now provision resource pools and TiDB instances directly via the TiDB Cloud console.
 
-1. Initiate instance creation. Log in to the [TiDB Cloud console](https://tidbcloud.com/) and follow the [BYOC instance creation workflow](/tidb-cloud/byoc/create-tidb-instance-byoc.md) to create a new instance.
+1. Create a resource pool. Log in to the [TiDB Cloud console](https://tidbcloud.com/) and follow the instructions in [Create a Resource Pool](/tidb-cloud/byoc/create-resource-pool-byoc.md) to create a resource pool in the target cloud provider and region.
 
-2. Select the region and specifications that match your workload requirements.
+2. After the resource pool becomes **Active**, follow the instructions in [Create a {{{ .byoc }}} Instance](/tidb-cloud/byoc/create-tidb-instance-byoc.md) to create a new instance in the resource pool.
 
-    * Initial Setup Time: The creation of the **first instance** typically takes approximately **1 hour** as the system initializes the Kubernetes environment.
-    * Subsequent instances: Creating additional instances in the same region will only take a few minutes.
+    * Initial setup time: creating the **first resource pool** in a region might take approximately **1 hour** as the system initializes the Kubernetes environment.
+    * Subsequent instances: creating additional instances in an active resource pool usually takes only a few minutes.
 
 3. Consult with your TiDB Cloud representative to determine the appropriate Request Unit (RU) settings for your initial connectivity and functional tests. They will recommend a configuration based on your specific testing requirements.
 
-## Restore data from Amazon S3 to your new instance
+## Restore data from Amazon S3 to a new BYOC instance
 
-After preparing your backup file in Amazon S3, you can proceed to restore the data to your newly created TiDB Cloud BYOC instance.
+After preparing your backup file in Amazon S3, you can restore the data to a new {{{ .byoc }}} instance in an active resource pool.
 
 1. Configure Amazon S3 Access (AK/SK).
 
     To allow TiDB Cloud to read your S3 backup, you must configure external storage access by generating an AWS Access Key ID and Secret Access Key (AK/SK) with the appropriate S3 read permissions.
 
     For detailed instructions, see [Configure Amazon S3 access using an AWS Access Key](/tidb-cloud/configure-external-storage-access.md#configure-amazon-s3-access-using-an-aws-access-key).
 
-2. Execute the Restore Process.
+2. Execute the restore process.
 
     Once the access keys are configured, you can initiate the restore job from the TiDB Cloud console.
 
+    During restore, select an active resource pool in the target cloud provider and region.
+
     For step-by-step restoration procedures, see [Restore backups from cloud storage](/tidb-cloud/premium/backup-and-restore-premium.md#restore-backups-from-cloud-storage).
 
 ## Configure secure administrative access
@@ -49,4 +51,4 @@ For deployment and verification steps, see [Configure a Bastion Host for {{{ .by
 
 ## What's next
 
-After you create your first {{{ .byoc }}} instance and configure secure administrative access, continue with [TiDB Cloud BYOC Joint Validation](/tidb-cloud/byoc/joint-validation.md) to validate connectivity, observability, security, and alerting.
+After you create your first resource pool and {{{ .byoc }}} instance and configure secure administrative access, continue with [TiDB Cloud BYOC Joint Validation](/tidb-cloud/byoc/joint-validation.md) to validate connectivity, observability, security, and alerting.

tidb-cloud/byoc/byoc-onboarding-overview.md

@@ -18,7 +18,7 @@ The TiDB Cloud BYOC deployment process is a collaborative effort between your or
 | [Phase 1: Environment preparation](/tidb-cloud/byoc/byoc-prepare-environment-aws.md) | Customer | Prepare the AWS foundation required for deployment. This includes creating a dedicated AWS account, configuring Route 53 hosted zones, and setting up the private certificate authority (PCA). |
 | [Phase 2: IAM bootstrapping](/tidb-cloud/byoc/byoc-configure-iam-permissions.md) | Customer | Execute the provided bootstrapping scripts to install the necessary IAM roles and policies. This authorizes the TiDB Cloud Control Plane to securely manage resources within your AWS account. |
 | [Phase 3: Automated region deployment](/tidb-cloud/byoc/byoc-automated-deployment.md) | TiDB Cloud | Once IAM permissions are verified, TiDB Cloud automatically provisions the VPC, EKS clusters, and control plane resources. Note: This process is **fully automated** and requires no customer intervention. |
-| [Phase 4: Service initialization](/tidb-cloud/byoc/byoc-initialize-service.md) | Customer | Create your TiDB instance via the console. Subsequently, [configure a Bastion Host](/tidb-cloud/byoc/byoc-configure-bastion-host.md) and authentication scripts to establish secure maintenance channels (Tailscale) and observability pipelines. Note: You may also choose to establish maintenance channels using your own custom methods. |
+| [Phase 4: Service initialization](/tidb-cloud/byoc/byoc-initialize-service.md) | Customer | Create a resource pool and then create your TiDB instance in the resource pool via the console. After that, [configure a bastion host](/tidb-cloud/byoc/byoc-configure-bastion-host.md) and authentication scripts to establish secure maintenance channels (Tailscale) and observability pipelines. Note: You may also choose to establish maintenance channels using your own custom methods. |
 | [Phase 5: Validation](/tidb-cloud/byoc/joint-validation.md) | Joint | Both teams collaborate to validate connectivity, verify metric collection, and confirm system health to ensure the BYOC environment is ready for use. |
 
 > **Note:**

tidb-cloud/byoc/byoc-prepare-environment-aws.md

@@ -117,33 +117,35 @@ Perform the following steps:
 
 ## Step 6. Plan network CIDR ranges
 
-Before starting the BYOC deployment, plan dedicated CIDR ranges for the TiDB cluster and observability (O11Y) infrastructure. This planning must be evaluated on a **per-region** basis.
+Before starting the BYOC deployment, plan dedicated private CIDR ranges for observability (O11Y) infrastructure and resource pools. Use a prefix length between `/16` and `/22`.
 
-The CIDR ranges will be used by TiDB Cloud to provision the required AWS networking resources for the BYOC environment.
+Each BYOC deployment region has one O11Y CIDR. Resource pool CIDR is configured for each resource pool when you create it. Plan these CIDR ranges before deployment so that the BYOC environment and future resource pools can be provisioned without network conflicts.
 
 Prepare the following information:
 
 | Item | Description | Example |
 | ----- | ----- | ----- |
-| TiDB Cluster CIDR | CIDR range reserved for TiDB cluster and dataplane resources. | `10.10.0.0/16` |
-| O11Y CIDR | CIDR range reserved for observability infrastructure and related services. | `10.20.0.0/16` |
+| O11Y CIDR | CIDR range reserved for observability infrastructure and related services in the deployment region. | `10.1.0.0/22` |
+| Resource pool CIDR | CIDR range reserved for a resource pool. Each resource pool has its own CIDR, which cannot be modified after the resource pool is created. | `10.10.0.0/16` |
 
-When planning the CIDR ranges, ensure that:
+**CIDR planning rules & constraints**
 
-**CIDR Planning Rules & Constraints:** When planning the CIDR ranges, ensure you strictly follow these connectivity rules:
+When planning CIDR ranges, make sure to comply with the following connectivity rules:
 
-1. **Internal Isolation:** The TiDB Cluster CIDR and O11Y CIDR within the same environment must not overlap with each other.
+- **Internal isolation:** In the same region, resource pool CIDRs must not overlap with the O11Y CIDR or with one another.
 
-2. **VPC Peering Rule:**
+- **VPC peering rule:**
 
-    * **Cannot Overlap:** Anything that will be peered *cannot* overlap. If you plan to establish VPC Peering between the TiDB Cluster VPC and your existing application VPCs, on-premises networks, or VPNs, the CIDR ranges must be strictly de-conflicted.
-    * **Can Overlap:** Things that will *never* be peered can safely overlap with the TiDB Cloud BYOC environment.
+    * **Cannot overlap:** The O11Y CIDR and any resource pool CIDR must not overlap with your existing application VPCs, on-premises networks, or VPN networks.
+    * **Customer responsibility:** TiDB Cloud cannot detect conflicts with customer-managed networks. You are responsible for planning and verifying these CIDR ranges before deployment or before creating a resource pool.
 
-3. **Cross-Cluster Replication (Critical):** If you plan to deploy multiple TiDB clusters (whether in the same region or across different regions) and eventually want to **replicate data between them** (for example, using TiCDC for Disaster Recovery or data consolidation), their respective TiDB Cluster CIDR ranges **must be de-conflicted**.
+- **Cross-region CIDR planning:** Resource pool CIDRs in different regions can overlap. However, use non-overlapping CIDRs for resource pools that require cross-region connectivity or replication.
+
+- **Cross-resource pool replication (critical):** If you plan to deploy multiple resource pools and might need to **replicate data between instances in different resource pools** (for example, using TiCDC for disaster recovery or data consolidation), their respective resource pool CIDR ranges **must not overlap**.
 
 Provide the planned CIDR ranges to your TiDB Cloud representative before the automated region deployment starts.
 
-## Summary: Required information
+## Summary: required information
 
 Fill out the table below with the information gathered in steps above and share it with your TiDB Cloud representative to initiate the deployment.
 
@@ -157,7 +159,7 @@ Fill out the table below with the information gathered in steps above and share
 | **Availability Zones** | 3 AZs or single AZ per region (specify names and ID) | **Us-east-1:** `us-east-1a`, `use1-az1`, `us-east-1b`, `use1-az2`, `us-east-1c`, `use1-az4`; **Us-east-2:** `us-east-2a`, `use2-az1`, `us-east-2b`, `use2-az2`, `us-east-2c`, `use2-az3`; **Us-west-2:** `us-west-2a`, `usw2-az1` | Step 3. Note to meet the AZ quantity requirement for **each** selected region. |
 | **Subordinate CA ARN** | AWS ACM Private CA ARN | `arn:aws:acm-pca:us-west-2:123456789012:ca/abcd-1234` | Step 5. The ARN can be shared across multiple regions. |
 | **Hosted Zone Names & Host Zone ID** | TiDB Cluster Zone, Observability (O11Y) Zone | **Hosted TiDB cluster zone name:** `clusters.byoc-0929.pingcap.net`; **Hosted TiDB cluster zone ID:** `Z1039122VAY4T8UNWR8E`. **Hosted O11Y zone name:** `o11y.byoc-0929.pingcap.net`; **Hosted O11Y zone ID:** `Z10389823CTXFNM7VG79P`. | Step 4. The zone names and IDs can be shared across multiple regions. |
-| **CIDR** | Customer-planned CIDR range for the TiDB cluster, Customer-planned CIDR range for the O11Y cluster | **TiDB cluster CIDR:** `10.10.0.0/16`; **O11Y cluster CIDR:** `10.20.0.0/16` | Step 6 |
+| **CIDR** | Customer-planned CIDR ranges for O11Y infrastructure and resource pools | **O11Y CIDR:** `10.1.0.0/22`; **Resource pool CIDR:** `10.10.0.0/16` | Step 6 |
 | **Image Sync Region** | Region ID chosen for image synchronization | `us-west-2` | Refer to [image synchronization](/tidb-cloud/byoc/byoc-automated-deployment.md#step-1-image-synchronization) for details. |
 
 ## Review and increase AWS service quotas