Merge branch 'main' into visual_testing

Author: gingerwizard

docs/en/cloud/bestpractices/partitioningkey.md

@@ -4,7 +4,7 @@ sidebar_label: Choose a Low Cardinality Partitioning Key
 title: Choose a Low Cardinality Partitioning Key
 ---
 
-When you send an insert statement (that should contain many rows - see [section above](#ingest-data-in-bulk)) to a table in ClickHouse Cloud, and that
+When you send an insert statement (that should contain many rows - see [section above](/docs/en/optimize/bulk-inserts)) to a table in ClickHouse Cloud, and that
 table is not using a [partitioning key](/docs/en/engines/table-engines/mergetree-family/custom-partitioning-key.md) then all row data from that insert is written into a new part on storage:
 
 ![compression block diagram](images/partitioning-01.png)

docs/en/cloud/manage/scaling.md

@@ -86,6 +86,8 @@ In the **Settings** page, you can also choose whether or not to allow automatic
 
 :::note
 In certain special cases, for instance when a service has a high number of parts, the service will not be idled automatically.
+
+The service may enter an idle state where it suspends refreshes of [refreshable materialized views](/docs/en/materialized-view/refreshable-materialized-view), consumption from [S3Queue](/docs/en/engines/table-engines/integrations/s3queue), and scheduling of new merges. Existing merge operations will complete before the service transitions to the idle state. To ensure continuous operation of refreshable materialized views and S3Queue consumption, disable the idle state functionality.
 :::
 
 :::danger When not to use automatic idling

docs/en/cloud/security/cloud-authentication.md

@@ -116,7 +116,7 @@ ClickHouse Cloud also supports security assertion markup language (SAML) single
 Use the SHA256_hash method when [creating user accounts](/docs/en/sql-reference/statements/create/user.md) to secure passwords.
 
 **TIP:** Since users with less than administrative privileges cannot set their own password, ask the user to hash their password using a generator
-such as [this one](https://tools.keycdn.com/sha256-online-generator) before providing it to the admin to setup the account. Passwords should follow the [requirements](#establish-strong-passwords) listed above.
+such as [this one](https://tools.keycdn.com/sha256-online-generator) before providing it to the admin to setup the account. Passwords should follow the [requirements](#password-settings) listed above.
 
 ```
 CREATE USER userName IDENTIFIED WITH sha256_hash BY 'hash';

docs/en/cloud/security/gcp-private-service-connect.md

@@ -108,7 +108,7 @@ In the Google Cloud console, navigate to **Network services -> Private Service C
 Open the Private Service Connect creation dialog by clicking on the **Connect Endpoint** button.
 
 - **Target**: use **Published service**
-- **Target service**: use **endpointServiceId** from [Obtain GCP service attachment for Private Service Connect](#obtain-gcp-service-attachment-for-private-service-connect) step.
+- **Target service**: use **endpointServiceId** from [Obtain GCP service attachment for Private Service Connect](#obtain-gcp-service-attachment-and-dns-name-for-private-service-connect) step.
 - **Endpoint name**: set a name for the PSC **Endpoint name**.
 - **Network/Subnetwork/IP address**: Choose the network you want to use for the connection. You will need to create an IP address or use an existing one for the Private Service Connect endpoint. In our example, we precreated an address with the name **your-ip-address** and assigned IP address `10.128.0.2`
 - To make the endpoint available from any region, you can enable the **Enable global access** checkbox.

docs/en/integrations/data-ingestion/clickpipes/object-storage.md

@@ -145,6 +145,11 @@ Service Accounts for GCS aren't directly supported. HMAC (IAM) Credentials must
 The Service Account permissions attached to the HMAC credentials should be `storage.objects.list` and `storage.objects.get`.
 
 ## F.A.Q.
+
 - **Does ClickPipes support GCS buckets prefixed with `gs://`?**
 
 No. For interoprability reasons we ask you to replace your `gs://` bucket prefix with `https://storage.googleapis.com/`.
+
+- **What permissions does a GCS public bucket require?**
+
+`allUsers` requires appropriate role assignment. The `roles/storage.objectViewer` role must be granted at the bucket level. This role provides the `storage.objects.list` permission, which allows ClickPipes to list all objects in the bucket which is required for onboarding and ingestion. This role also includes the `storage.objects.get` permission, which is required to read or download individual objects in the bucket. See: [Google Cloud Access Control](https://cloud.google.com/storage/docs/access-control/iam-roles) for further information.

docs/en/integrations/data-ingestion/clickpipes/postgres/faq.md

@@ -63,4 +63,44 @@ Please refer to the [ClickPipes for Postgres: Schema Changes Propagation Support
 
 ### What are the costs for ClickPipes for Postgres CDC?
 
-During the preview, ClickPipes is free of cost. Post-GA, pricing is still to be determined. The goal is to make the pricing reasonable and highly competitive compared to external ETL tools.
+During the preview, ClickPipes is free of cost. Post-GA, pricing is still to be determined. The goal is to make the pricing reasonable and highly competitive compared to external ETL tools.
+
+### My replication slot size is growing or not decreasing; what might be the issue?
+
+If you're noticing that the size of your Postgres replication slot keeps increasing or isn’t coming back down, it usually means that **WAL (Write-Ahead Log) records aren’t being consumed (or “replayed”) quickly enough** by your CDC pipeline or replication process. Below are the most common causes and how you can address them.
+
+1. **Sudden Spikes in Database Activity**  
+   - Large batch updates, bulk inserts, or significant schema changes can quickly generate a lot of WAL data.  
+   - The replication slot will hold these WAL records until they are consumed, causing a temporary spike in size.
+
+2. **Long-Running Transactions**  
+   - An open transaction forces Postgres to keep all WAL segments generated since the transaction began, which can dramatically increase slot size.  
+   - Set `statement_timeout` and `idle_in_transaction_session_timeout` to reasonable values to prevent transactions from staying open indefinitely:
+     ```sql
+     SELECT 
+         pid,
+         state,
+         age(now(), xact_start) AS transaction_duration,
+         query AS current_query
+     FROM 
+         pg_stat_activity
+     WHERE 
+         xact_start IS NOT NULL
+     ORDER BY 
+         age(now(), xact_start) DESC;
+     ```
+     Use this query to identify unusually long-running transactions.
+
+3. **Maintenance or Utility Operations (e.g., `pg_repack`)**  
+   - Tools like `pg_repack` can rewrite entire tables, generating large amounts of WAL data in a short time.  
+   - Schedule these operations during slower traffic periods or monitor your WAL usage closely while they run.
+
+4. **VACUUM and VACUUM ANALYZE**  
+   - Although necessary for database health, these operations can create extra WAL traffic—especially if they scan large tables.  
+   - Consider using autovacuum tuning parameters or scheduling manual VACUUMs during off-peak hours.
+
+5. **Replication Consumer Not Actively Reading the Slot**  
+   - If your CDC pipeline (e.g., ClickPipes) or another replication consumer stops, pauses, or crashes, WAL data will accumulate in the slot.  
+   - Ensure your pipeline is continuously running and check logs for connectivity or authentication errors.
+
+For an excellent deep dive into this topic, check out our blog post: [Overcoming Pitfalls of Postgres Logical Decoding](https://blog.peerdb.io/overcoming-pitfalls-of-postgres-logical-decoding#heading-beware-of-replication-slot-growth-how-to-monitor-it).