BYOC Network Security

### Management Services Access[​](#management-services-access "Direct link to Management Services Access")

By default, ClickHouse management services access your BYOC Kubernetes cluster via the EKS API server's public IP address, which is restricted to ClickHouse's NAT gateway IP addresses only.

**Optional Private Endpoint Configuration**:

- You can configure the EKS API server to use only a private endpoint
- In this case, management services access the API server via Tailscale (similar to human troubleshooting access)
- Public access is kept as a backup mechanism for emergency investigation and support needs

### Network Traffic Flow[​](#tailscale-traffic-flow "Direct link to Network Traffic Flow")

**Tailscale Connection Flow**:

1. Tailscale agent in EKS cluster → Tailscale coordination server (outbound)
2. Tailscale agent on engineer's machine → Tailscale coordination server (outbound)
3. Direct or relayed connection established between agents
4. Encrypted traffic flows through the established tunnel
5. Nginx pod in EKS terminates TLS and routes to internal services

**No Customer Data Transmission**:

- Tailscale connections are used only for management and troubleshooting
- Query traffic and customer data never flow through Tailscale
- All customer data remains within your VPC

### Monitoring and Auditing[​](#tailscale-monitoring "Direct link to Monitoring and Auditing")

Both ClickHouse and customers can audit Tailscale access activity:

- **ClickHouse Monitoring**: ClickHouse monitors access requests and logs all Tailscale connections
- **Customer Auditing**: Customers can track activity from ClickHouse engineers within their own systems
- **Query Logs**: All system table access via Tailscale is logged in ClickHouse's `query_log` table

For more technical details about how Tailscale is implemented in BYOC, see the [Building ClickHouse BYOC on AWS blog post](https://clickhouse.com/blog/building-clickhouse-byoc-on-aws#tailscale-connection).

## Network boundaries[​](#network-boundaries "Direct link to Network boundaries")

This section covers different network traffic to and from the customer BYOC VPC:

- **Inbound**: Traffic entering the customer BYOC VPC.
- **Outbound**: Traffic originating from the customer BYOC VPC and sent to an external destination.
- **Public**: A network endpoint accessible from the public internet.
- **Private**: A network endpoint accessible only through private connections, such as VPC peering, VPC Private Link, or Tailscale.

**Istio ingress is deployed behind an AWS NLB to accept ClickHouse client traffic.**

*Inbound, Public or Private*

The Istio ingress gateway terminates TLS. The certificate, provisioned by CertManager with Let's Encrypt, is stored as a secret within the EKS cluster. Traffic between Istio and ClickHouse is [encrypted by AWS](https://docs.aws.amazon.com/whitepapers/latest/logical-separation/encrypting-data-at-rest-and--in-transit.html#:~:text=All%20network%20traffic%20between%20AWS,supported%20Amazon%20EC2%20instance%20types) since they reside in the same VPC.

By default, ingress is publicly accessible with IP allow list filtering. Customers can configure VPC peering to make it private and disable public connections. We highly recommend setting up an [IP filter](/docs/cloud/security/setting-ip-filters) to restrict access.

### Troubleshooting access[​](#troubleshooting-access "Direct link to Troubleshooting access")

*Inbound, Private*

ClickHouse Cloud engineers require troubleshooting access via Tailscale. They're provisioned with just-in-time certificate-based authentication for BYOC deployments.

### Billing scraper[​](#billing-scraper "Direct link to Billing scraper")

*Outbound, Private*

The Billing scraper collects billing data from ClickHouse and sends it to an S3 bucket owned by ClickHouse Cloud.

It runs as a sidecar alongside the ClickHouse server container, periodically scraping CPU and memory metrics. Requests within the same region are routed through VPC gateway service endpoints.

### Alerts[​](#alerts "Direct link to Alerts")

*Outbound, Public*

AlertManager is configured to send alerts to ClickHouse Cloud when the customer's ClickHouse cluster is unhealthy.

Metrics and logs are stored within the customer's BYOC VPC. Logs are currently stored locally in EBS. In a future update, they will be stored in LogHouse, a ClickHouse service within the BYOC VPC. Metrics use a Prometheus and Thanos stack, stored locally in the BYOC VPC.

### Service state[​](#service-state "Direct link to Service state")

*Outbound, Public*

State Exporter sends ClickHouse service state information to an SQS owned by ClickHouse Cloud.

- [Connections between ClickHouse Control Plane and Your BYOC VPC](#connection-between-clickhouse-and-byoc)- [Tailscale Private Network](#tailscale-private-network)
    - [Overview](#tailscale-overview)- [How Tailscale Works in BYOC](#how-tailscale-works)- [Network Connection Process](#tailscale-connection-process)- [Security Features](#tailscale-security)- [Troubleshooting Access via Tailscale](#troubleshooting-access-tailscale)- [Management Services Access](#management-services-access)- [Network Traffic Flow](#tailscale-traffic-flow)- [Monitoring and Auditing](#tailscale-monitoring)- [Network boundaries](#network-boundaries)
      - [Troubleshooting access](#troubleshooting-access)- [Billing scraper](#billing-scraper)- [Alerts](#alerts)- [Service state](#service-state)

Was this page helpful?