Correct the cluster setting name for external connection and changefe…

…ed privilege (#18240)

src/current/_includes/releases/v23.1/v23.1.0-alpha.2.md

@@ -50,7 +50,7 @@ We chose a default of `25h` originally to accommodate daily incremental backups
 - The `CONTROLCHANGEFEED` [role option](https://www.cockroachlabs.com/docs/v23.1/alter-role#role-options) will be deprecated in the future (see issue [#94757](https://github.com/cockroachdb/cockroach/issues/94757)). With this change, usages of the `CONTROLCHANGEFEED` role option will come with a deprecation warning. Its existing behavior remains the same. The `SELECT` and `CHANGEFEED` privileges will be used for changefeeds henceforth:
    - The `SELECT` privilege on a set of tables allows a user to run core changefeeds against them.
    - The `CHANGEFEED` privilege on a set of tables allows a user to run enterprise changefeeds on them, and also manage the underlying changefeed job (ie. view, pause, cancel, and resume the job).
-   Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.enforce_external_connections` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it.  Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796]
+   Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.require_external_connection_sink.enabled` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it.  Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796]
 - Changefeeds created/altered with a `metrics_label` set while `server.child_metrics.enabled` is set to `false` will now provide the user a notice upon creation. [#94948][#94948]
 - Fix a bug in [`ALTER CHANGEFEED`](https://www.cockroachlabs.com/docs/v23.1/alter-changefeed) that would panic when altering changefeeds to remove a table that has already been dropped. [#95739][#95739]
 - Reduced the default size of scan RPC replies to improve cluster stability during changefeed accounting for transient memory. [#95798][#95798]

src/current/_includes/releases/v23.1/v23.1.0.md

@@ -480,7 +480,7 @@ The following changes should be reviewed prior to upgrading. Default cluster set
 - The `CONTROLCHANGEFEED` [role option](https://www.cockroachlabs.com/docs/v23.1/alter-role#role-options) will be deprecated in the future (see issue [#94757](https://github.com/cockroachdb/cockroach/issues/94757)). With this change, usages of the `CONTROLCHANGEFEED` role option will come with a deprecation warning. Its existing behavior remains the same. The `SELECT` and `CHANGEFEED` privileges will be used for changefeeds henceforth:
    - The `SELECT` privilege on a set of tables allows a user to run core changefeeds against them.
    - The `CHANGEFEED` privilege on a set of tables allows a user to run enterprise changefeeds on them, and also manage the underlying changefeed job (ie. view, pause, cancel, and resume the job).
-   Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.enforce_external_connections` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it.  Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796]
+   Notably, a new [cluster setting](https://www.cockroachlabs.com/docs/v23.1/cluster-settings) `changefeed.permissions.require_external_connection_sink.enabled` is added and set to `false` by default. Enabling this setting restricts users with `CHANGEFEED` on a set of tables to create enterprise changefeeds into external connections only. To use a given external connection, a user typically needs the `USAGE` privilege on it.  Note that `ALTER DEFAULT PRIVILEGES` can be used with both the `CHANGEFEED` and `SELECT` privileges to assign coarse-grained permissions (i.e., assign permissions to all tables in a schema rather than manually assign them for each table). [#94796][#94796]
 - Deprecated the `PGDUMP` and `MYSQLDUMP` formats for [`IMPORT`](https://www.cockroachlabs.com/docs/v23.1/import). They are still present, but will be removed in a future release. See the [Migration Overview](https://www.cockroachlabs.com/docs/v23.1/migration-overview) page for alternatives. [#96386][#96386]
 
 <h4 id="v23-1-0-known-limitations">Known limitations</h4>

src/current/_includes/v23.1/cdc/ext-conn-cluster-setting.md

@@ -1 +1 @@
-{% include_cached new-in.html version="v23.1" %} To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.enforce_external_connections` cluster setting. When you enable this setting, users with the {% if page.name == "create-changefeed.md" %} `CHANGEFEED` privilege {% else %} [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) {% endif %} on a set of tables can only create changefeeds into {% if page.name == "create-external-connection.md" %} external connections {% else %} [external connections]({% link {{ page.version.version }}/create-external-connection.md %}) {% endif %}.
+{% include_cached new-in.html version="v23.1" %} To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.require_external_connection_sink.enabled` cluster setting. When you enable this setting, users with the {% if page.name == "create-changefeed.md" %} `CHANGEFEED` privilege {% else %} [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) {% endif %} on a set of tables can only create changefeeds into {% if page.name == "create-external-connection.md" %} external connections {% else %} [external connections]({% link {{ page.version.version }}/create-external-connection.md %}) {% endif %}.

src/current/_includes/v23.1/cdc/privilege-model.md

@@ -1,5 +1,5 @@
 {{site.data.alerts.callout_info}}
-Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds. 
+Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds.
 
 There is continued support for the [legacy privilege model](#legacy-privilege-model) for changefeeds in v23.1, however it **will be removed** in a future release of CockroachDB. We recommend implementing the new privilege model that follows in this section for all changefeeds.
 {{site.data.alerts.end}}
@@ -13,7 +13,7 @@ GRANT CHANGEFEED ON TABLE example_table TO user;
 
 When you grant a user the `CHANGEFEED` privilege on a set of tables, they can:
 
-- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables. 
+- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables.
 - {% include_cached new-in.html version="v23.1" %} Manage the changefeed jobs running on the tables using the [`SHOW CHANGEFEED JOB`]({% link {{ page.version.version }}/show-jobs.md %}#show-changefeed-jobs), [`PAUSE JOB`]({% link {{ page.version.version }}/pause-job.md %}), [`RESUME JOB`]({% link {{ page.version.version }}/resume-job.md %}), and [`CANCEL JOB`](cancel-job.html) commands.
 
 These users will be able to create changefeeds, but they will not be able to run a `SELECT` query on that data directly. However, they could still read this data indirectly if they have read access to the [sink]({% link {{ page.version.version }}/changefeed-sinks.md %}).
@@ -24,10 +24,10 @@ These users will be able to create changefeeds, but they will not be able to run
 
 The following summarizes the operations users can run when they have changefeed privileges on a table:
 
-Granted privileges | Usage 
+Granted privileges | Usage
 -------------------+-------
 `CHANGEFEED` | Create changefeeds on tables.<br>Manage changefeed jobs on tables.
-`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.<br>Manage changefeed jobs on tables.<br>**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.enforce_external_connections=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections.
+`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.<br>Manage changefeed jobs on tables.<br>**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.require_external_connection_sink.enabled=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections.
 `SELECT` | Create a sinkless changefeed that emits messages to a SQL client.
 **Deprecated** `CONTROLCHANGEFEED` role option + `SELECT` | Create changefeeds on tables.
 

src/current/_includes/v23.2/cdc/ext-conn-cluster-setting.md

@@ -1 +1 @@
-To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.enforce_external_connections` cluster setting. When you enable this setting, users with the [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) on a set of tables can only create changefeeds into [external connections]({% link {{ page.version.version }}/create-external-connection.md %}).
+To restrict a user's access to changefeed data and sink credentials, enable the `changefeed.permissions.require_external_connection_sink.enabled` cluster setting. When you enable this setting, users with the [`CHANGEFEED` privilege]({% link {{ page.version.version }}/create-changefeed.md %}#required-privileges) on a set of tables can only create changefeeds into [external connections]({% link {{ page.version.version }}/create-external-connection.md %}).

src/current/_includes/v23.2/cdc/privilege-model.md

@@ -1,5 +1,5 @@
 {{site.data.alerts.callout_info}}
-Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds. 
+Starting in v22.2, CockroachDB introduces a new [system-level privilege model]({% link {{ page.version.version }}/security-reference/authorization.md %}#supported-privileges) that provides finer control over a user's privilege to work with the database, including creating and managing changefeeds.
 
 There is continued support for the [legacy privilege model](#legacy-privilege-model) for changefeeds in v23.1, however it **will be removed** in a future release of CockroachDB. We recommend implementing the new privilege model that follows in this section for all changefeeds.
 {{site.data.alerts.end}}
@@ -13,7 +13,7 @@ GRANT CHANGEFEED ON TABLE example_table TO user;
 
 When you grant a user the `CHANGEFEED` privilege on a set of tables, they can:
 
-- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables. 
+- Create changefeeds on the target tables even if the user does **not** have the [`CONTROLCHANGEFEED` role option]({% link {{ page.version.version }}/alter-role.md %}#role-options) or the `SELECT` privilege on the tables.
 - Manage the changefeed jobs running on the tables using the [`SHOW CHANGEFEED JOB`]({% link {{ page.version.version }}/show-jobs.md %}#show-changefeed-jobs), [`PAUSE JOB`]({% link {{ page.version.version }}/pause-job.md %}), [`RESUME JOB`]({% link {{ page.version.version }}/resume-job.md %}), and [`CANCEL JOB`](cancel-job.html) commands.
 
 These users will be able to create changefeeds, but they will not be able to run a `SELECT` query on that data directly. However, they could still read this data indirectly if they have read access to the [sink]({% link {{ page.version.version }}/changefeed-sinks.md %}).
@@ -24,10 +24,10 @@ These users will be able to create changefeeds, but they will not be able to run
 
 The following summarizes the operations users can run when they have changefeed privileges on a table:
 
-Granted privileges | Usage 
+Granted privileges | Usage
 -------------------+-------
 `CHANGEFEED` | Create changefeeds on tables.<br>Manage changefeed jobs on tables.
-`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.<br>Manage changefeed jobs on tables.<br>**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.enforce_external_connections=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections.
+`CHANGEFEED` + [`USAGE`]({% link {{ page.version.version }}/create-external-connection.md %}#required-privileges) on external connection | Create changefeeds on tables to an external connection URI.<br>Manage changefeed jobs on tables.<br>**Note:** If you need to manage access to changefeed sink URIs, set the `changefeed.permissions.require_external_connection_sink.enabled=true` cluster setting. This will mean that users with these privileges can **only** create changefeeds on external connections.
 `SELECT` | Create a sinkless changefeed that emits messages to a SQL client.
 **Deprecated** `CONTROLCHANGEFEED` role option + `SELECT` | Create changefeeds on tables.