Azure Private Link

In the ClickHouse Cloud console, open the service that you would like to connect via PrivateLink then navigate to **Settings**. Enter the `Resource ID` obtained from the [previous](#obtaining-private-endpoint-resourceid) step.

Note

If you want to allow access from an existing PrivateLink connection, use the existing endpoint drop-down menu.

### Option 2: API[​](#option-2-api-2 "Direct link to Option 2: API")

Set these environment variables before running any commands:

```
PROVIDER=azure
KEY_ID=<Key ID>
KEY_SECRET=<Key secret>
ORG_ID=<set ClickHouse organization ID>
ENDPOINT_ID=<Private Endpoint Resource ID>
INSTANCE_ID=<Instance ID>
```

Execute it for each service that should be available using Private Link.

Run the following command to add the Private Endpoint to the services allow list:

```
cat <<EOF | tee pl_config.json
{
  "privateEndpointIds": {
    "add": [
      "${ENDPOINT_ID:?}"
    ]
  }
}
EOF
```

You can also run the following command to remove a Private Endpoint from the services allow list:

```
cat <<EOF | tee pl_config.json
{
  "privateEndpointIds": {
    "remove": [
      "${ENDPOINT_ID:?}"
    ]
  }
}
EOF
```

After adding or removing a Private Endpoint to the services allow list, run the following command to apply it to your organization:

```
curl --silent --user "${KEY_ID:?}:${KEY_SECRET:?}" -X PATCH -H "Content-Type: application/json" "https://api.clickhouse.cloud/v1/organizations/${ORG_ID:?}/services/${INSTANCE_ID:?}" -d @pl_config.json | jq
```

## Access your ClickHouse Cloud service using Private Link[​](#access-your-clickhouse-cloud-service-using-private-link "Direct link to Access your ClickHouse Cloud service using Private Link")

Each service with Private Link enabled has a public and private endpoint. In order to connect using Private Link, you need to use a private endpoint which will be `privateDnsHostname`API or `DNS name`console taken from [Obtain Azure connection alias for Private Link](#obtain-azure-connection-alias-for-private-link).

### Obtaining the private DNS hostname[​](#obtaining-the-private-dns-hostname "Direct link to Obtaining the private DNS hostname")

#### Option 1: ClickHouse Cloud console[​](#option-1-clickhouse-cloud-console-3 "Direct link to Option 1: ClickHouse Cloud console")

In the ClickHouse Cloud console, navigate to **Settings**. Click on the **Set up private endpoint** button. In the opened flyout, copy the **DNS Name**.

#### Option 2: API[​](#option-2-api-3 "Direct link to Option 2: API")

Set the following environment variables before running any commands:

```
KEY_ID=<Key ID>
KEY_SECRET=<Key secret>
ORG_ID=<set ClickHouse organization ID>
INSTANCE_ID=<Instance ID>
```

Run the following command:

```
curl --silent --user "${KEY_ID:?}:${KEY_SECRET:?}" "https://api.clickhouse.cloud/v1/organizations/${ORG_ID:?}/services/${INSTANCE_ID:?}/privateEndpointConfig" | jq  .result
```

You should receive a response similar to the following:

```
{
  ...
  "privateDnsHostname": "xxxxxxx.<region code>.privatelink.azure.clickhouse.cloud"
}
```

In this example, connection to the `xxxxxxx.region_code.privatelink.azure.clickhouse.cloud` hostname will be routed to Private Link. Meanwhile, `xxxxxxx.region_code.azure.clickhouse.cloud` will be routed over the internet.

Use the `privateDnsHostname` to connect to your ClickHouse Cloud service using Private Link.

## Troubleshooting[​](#troubleshooting "Direct link to Troubleshooting")

### Test DNS setup[​](#test-dns-setup "Direct link to Test DNS setup")

Run the following command:

```
nslookup <dns name>
```

where "dns name" is the `privateDnsHostname`API or `DNS name`console from [Obtain Azure connection alias for Private Link](#obtain-azure-connection-alias-for-private-link)

You should receive the following response:

```
Non-authoritative answer:
Name: <dns name>
Address: 10.0.0.4
```

### Connection reset by peer[​](#connection-reset-by-peer "Direct link to Connection reset by peer")

Most likely, the Private Endpoint Resource ID wasn't added to the service allow-list. Revisit the [*Add Private Endpoint Resource ID to your services allow-list* step](#add-private-endpoint-id-to-services-allow-list).

### Private Endpoint is in pending state[​](#private-endpoint-is-in-pending-state "Direct link to Private Endpoint is in pending state")

Most likely, the Private Endpoint Resource ID wasn't added to the service allow-list. Revisit the [*Add Private Endpoint Resource ID to your services allow-list* step](#add-private-endpoint-id-to-services-allow-list).

### Test connectivity[​](#test-connectivity "Direct link to Test connectivity")

If you have problems with connecting using Private Link, check your connectivity using `openssl`. Make sure the Private Link endpoint status is `Accepted`.

OpenSSL should be able to connect (see CONNECTED in the output). `errno=104` is expected.

```
openssl s_client -connect abcd.westus3.privatelink.azure.clickhouse.cloud:9440
```

```
# highlight-next-line
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 335 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
```

### Checking private endpoint filters[​](#checking-private-endpoint-filters "Direct link to Checking private endpoint filters")

Set the following environment variables before running any commands:

```
KEY_ID=<Key ID>
KEY_SECRET=<Key secret>
ORG_ID=<please set ClickHouse organization ID>
INSTANCE_ID=<Instance ID>
```

Run the following command to check Private Endpoint filters:

```
curl --silent --user "${KEY_ID:?}:${KEY_SECRET:?}" -X GET -H "Content-Type: application/json" "https://api.clickhouse.cloud/v1/organizations/${ORG_ID:?}/services/${INSTANCE_ID:?}" | jq .result.privateEndpointIds
```

## More information[​](#more-information "Direct link to More information")

For more information about Azure Private Link, please visit [azure.microsoft.com/en-us/products/private-link](https://azure.microsoft.com/en-us/products/private-link).