Azure Private Link

Open the network interface associated with Private Endpoint and copy the **Private IPv4 address**(10.0.0.4 in this example), you will need this information in the next steps.

### Option 2: Using Terraform to create a private endpoint in Azure[​](#option-2-using-terraform-to-create-a-private-endpoint-in-azure "Direct link to Option 2: Using Terraform to create a private endpoint in Azure")

Use the template below to use Terraform to create a Private Endpoint:

```
resource "azurerm_private_endpoint" "example_clickhouse_cloud" {
  name                = var.pe_name
  location            = var.pe_location
  resource_group_name = var.pe_resource_group_name
  subnet_id           = var.pe_subnet_id

  private_service_connection {
    name                              = "test-pl"
    private_connection_resource_alias = "<data from 'Obtain Azure connection alias for Private Link' step>"
    is_manual_connection              = true
  }
}
```

### Obtaining the Private Endpoint Resource ID[​](#obtaining-private-endpoint-resourceid "Direct link to Obtaining the Private Endpoint Resource ID")

In order to use Private Link, you need to add the Private Endpoint connection Resource ID to your service allow list.

The Private Endpoint Resource ID is exposed in the Azure Portal. Open the Private Endpoint created in the previous step and click **JSON View**:

Under properties, find `id` field and copy this value:

**Preferred method: Using Resource ID**

**Legacy method: Using resourceGUID**
You can still use the resourceGUID for backward compatibility. Find the `resourceGuid` field and copy this value:

## Setting up DNS for Private Link[​](#setting-up-dns-for-private-link "Direct link to Setting up DNS for Private Link")

You will need to create a Private DNS zone (`${location_code}.privatelink.azure.clickhouse.cloud`) and attach it to your VNet to access resources via Private Link.

### Create Private DNS zone[​](#create-private-dns-zone "Direct link to Create Private DNS zone")

**Option 1: Using Azure portal**

Please follow this guide to [create an Azure private DNS zone using the Azure Portal](https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal).

**Option 2: Using Terraform**

Use the following Terraform template to create a Private DNS zone:

```
resource "azurerm_private_dns_zone" "clickhouse_cloud_private_link_zone" {
  name                = "${var.location}.privatelink.azure.clickhouse.cloud"
  resource_group_name = var.resource_group_name
}
```

### Create a wildcard DNS record[​](#create-a-wildcard-dns-record "Direct link to Create a wildcard DNS record")

Create a wildcard record and point to your Private Endpoint:

**Option 1: Using Azure Portal**

1. Open the `MyAzureResourceGroup` resource group and select the `${region_code}.privatelink.azure.clickhouse.cloud` private zone.
2. Select + Record set.
3. For Name, type `*`.
4. For IP Address, type the IP address you see for Private Endpoint.
5. Select **OK**.

**Option 2: Using Terraform**

Use the following Terraform template to create a wildcard DNS record:

```
resource "azurerm_private_dns_a_record" "example" {
  name                = "*"
  zone_name           = var.zone_name
  resource_group_name = var.resource_group_name
  ttl                 = 300
  records             = ["10.0.0.4"]
}
```

### Create a virtual network link[​](#create-a-virtual-network-link "Direct link to Create a virtual network link")

To link the private DNS zone to a virtual network, you'll need to create a virtual network link.

**Option 1: Using Azure Portal**

Please follow this guide to [link the virtual network to your private DNS zone](https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal#link-the-virtual-network).

**Option 2: Using Terraform**

Note

There are various ways to configure DNS. Please set up DNS according to your specific use case.

You need to point "DNS name", taken from [Obtain Azure connection alias for Private Link](#obtain-azure-connection-alias-for-private-link) step, to Private Endpoint IP address. This ensures that services/components within your VPC/Network can resolve it properly.

### Verify DNS setup[​](#verify-dns-setup "Direct link to Verify DNS setup")

`xxxxxxxxxx.westus3.privatelink.azure.clickhouse.cloud` domain should be pointed to the Private Endpoint IP. (10.0.0.4 in this example).

```
nslookup xxxxxxxxxx.westus3.privatelink.azure.clickhouse.cloud.
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: xxxxxxxxxx.westus3.privatelink.azure.clickhouse.cloud
Address: 10.0.0.4
```

## Add the Private Endpoint Resource ID to your ClickHouse Cloud organization[​](#add-the-private-endpoint-id-to-your-clickhouse-cloud-organization "Direct link to Add the Private Endpoint Resource ID to your ClickHouse Cloud organization")

### Option 1: ClickHouse Cloud console[​](#option-1-clickhouse-cloud-console-1 "Direct link to Option 1: ClickHouse Cloud console")

To add an endpoint to the organization, proceed to the [Add the Private Endpoint Resource ID to your services allow list](#add-private-endpoint-id-to-services-allow-list) step. Adding the Private Endpoint Resource ID using the ClickHouse Cloud console to the services allow list automatically adds it to organization.

To remove an endpoint, open **Organization details -> Private Endpoints** and click the delete button to remove the endpoint.

### Option 2: API[​](#option-2-api-1 "Direct link to Option 2: API")

Set the following environment variables before running any commands:

```
PROVIDER=azure
KEY_ID=<Key ID>
KEY_SECRET=<Key secret>
ORG_ID=<set ClickHouse organization ID>
ENDPOINT_ID=<Private Endpoint Resource ID>
REGION=<region code, use Azure format>
```

Set the `ENDPOINT_ID` environment variable using data from the [Obtaining the Private Endpoint Resource ID](#obtaining-private-endpoint-resourceid) step.

Run the following command to add the Private Endpoint:

```
cat <<EOF | tee pl_config_org.json
{
  "privateEndpoints": {
    "add": [
      {
        "cloudProvider": "azure",
        "id": "${ENDPOINT_ID:?}",
        "description": "Azure private endpoint",
        "region": "${REGION:?}"
      }
    ]
  }
}
EOF
```

You can also run the following command to remove a Private Endpoint:

```
cat <<EOF | tee pl_config_org.json
{
  "privateEndpoints": {
    "remove": [
      {
        "cloudProvider": "azure",
        "id": "${ENDPOINT_ID:?}",
        "region": "${REGION:?}"
      }
    ]
  }
}
EOF
```

After adding or removing a Private Endpoint, run the following command to apply it to your organization:

```
curl --silent --user "${KEY_ID:?}:${KEY_SECRET:?}" -X PATCH -H "Content-Type: application/json" "https://api.clickhouse.cloud/v1/organizations/${ORG_ID:?}" -d @pl_config_org.json
```

## Add the Private Endpoint Resource ID to your services allow list[​](#add-private-endpoint-id-to-services-allow-list "Direct link to Add the Private Endpoint Resource ID to your services allow list")

By default, a ClickHouse Cloud service isn't available over a Private Link connection even if the Private Link connection is approved and established. You need to explicitly add the Private Endpoint Resource ID for each service that should be available using Private Link.

### Option 1: ClickHouse Cloud console[​](#option-1-clickhouse-cloud-console-2 "Direct link to Option 1: ClickHouse Cloud console")

In the ClickHouse Cloud console, open the service that you would like to connect via PrivateLink then navigate to **Settings**. Enter the `Resource ID` obtained from the [previous](#obtaining-private-endpoint-resourceid) step.

Note

If you want to allow access from an existing PrivateLink connection, use the existing endpoint drop-down menu.

### Option 2: API[​](#option-2-api-2 "Direct link to Option 2: API")

Set these environment variables before running any commands:

```
PROVIDER=azure
KEY_ID=<Key ID>
KEY_SECRET=<Key secret>
ORG_ID=<set ClickHouse organization ID>
ENDPOINT_ID=<Private Endpoint Resource ID>
INSTANCE_ID=<Instance ID>
```

Execute it for each service that should be available using Private Link.