ClickHouse Operator configuration guide

### Custom users in configuration[​](#custom-users-in-configuration "Direct link to Custom users in configuration")

Configure additional users in configuration files.

Create a ConfigMap and Secret for user:

```
apiVersion: v1
kind: ConfigMap
metadata:
  name: user-config
data:
  reader.yaml: |
    users:
      reader:
        password:
          - '@from_env': READER_PASSWORD
        profile: default
        grants:
          - query: "GRANT SELECT ON *.*"
---
apiVersion: v1
kind: Secret
metadata:
  name: reader-password
data:
  password: "c2VjcmV0LXBhc3N3b3Jk"  # base64("secret-password")
```

Add custom configuration to ClickHouseCluster:

```
spec:
  podTemplate:
    volumes:
      - name: reader-user
        configMap:
          name: user-config
  containerTemplate:
    env:
      - name: READER_PASSWORD
        valueFrom:
          secretKeyRef:
            name: reader-password
            key: password
    volumeMounts:
      - mountPath: /etc/clickhouse-server/users.d/
        name: reader-user
        readOnly: true
```

### Database sync[​](#database-sync "Direct link to Database sync")

Enable automatic database synchronization for new replicas:

```
spec:
  settings:
    enableDatabaseSync: true  # Default: true
```

When enabled, the operator synchronizes Replicated and integration tables to new replicas.

## Custom configuration[​](#custom-configuration "Direct link to Custom configuration")

### Embedded extra configuration[​](#embedded-extra-configuration "Direct link to Embedded extra configuration")

Instead of mounting custom configuration files, you can directly specify additional ClickHouse configuration options.

Add custom ClickHouse configuration using `extraConfig`:

```
spec:
  settings:
    extraConfig:
      background_pool_size: 20
```

#### Useful links:[​](#useful-links "Direct link to Useful links:")

- [YAML configuration examples](/docs/operations/configuration-files#example-1)
- [All server settings](/docs/operations/server-configuration-parameters/settings)

### Embedded extra users configuration[​](#embedded-extra-users-configuration "Direct link to Embedded extra users configuration")

You can also specify additional ClickHouse users configuration using `extraUsersConfig`. This is useful for defining users, profiles, quotas, and grants directly in the cluster specification.

```
spec:
  settings:
    extraUsersConfig:
      users:
        analyst:
          password:
            - '@from_env': ANALYST_PASSWORD
          profile: "readonly"
          quota: "default"
      profiles:
        readonly:
          readonly: 1
          max_memory_usage: 10000000000
      quotas:
        default:
          interval:
            duration: 3600
            queries: 1000
            errors: 100
```

Note

The `extraUsersConfig` is stored in k8s ConfigMap object. Avoid plain text secrets there.

#### See [documentation](/docs/operations/settings/settings-users) for all supported ClickHouse users configuration options.[​](#see-documentation-for-all-supported-clickhouse-users-configuration-options "Direct link to see-documentation-for-all-supported-clickhouse-users-configuration-options")

### Configuration example[​](#configuration-example "Direct link to Configuration example")

Complete configuration example:

```
apiVersion: clickhouse.com/v1alpha1
kind: KeeperCluster
metadata:
  name: sample
spec:
  replicas: 3
  dataVolumeClaimSpec:
    storageClassName: <storage-class-name>
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 10Gi
  podTemplate:
    topologyZoneKey: topology.kubernetes.io/zone
    nodeHostnameKey: kubernetes.io/hostname
  containerTemplate:
    resources:
      requests:
        cpu: "2"
        memory: "4Gi"
      limits:
        cpu: "4"
        memory: "8Gi"
  settings:
    tls:
      enabled: true
      required: true
      serverCertSecret:
        name: <keeper-certificate-secret>
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: default-user-password
data:
  # secret-password
  password: "..." # sha256 hex of the password
---
apiVersion: clickhouse.com/v1alpha1
kind: ClickHouseCluster
metadata:
  name: sample
spec:
  replicas: 2
  dataVolumeClaimSpec:
    storageClassName: <storage-class-name>
    accessModes:
      - ReadWriteOnce
    resources:
      requests:
        storage: 200Gi
  keeperClusterRef:
    name: sample
  podTemplate:
    topologyZoneKey: topology.kubernetes.io/zone
    nodeHostnameKey: kubernetes.io/hostname
  settings:
    tls:
      enabled: true
      required: true
      serverCertSecret:
        name: clickhouse-cert
    defaultUserPassword:
      passwordType: password_sha256_hex
      configMap:
        key: password
        name: default-password
```

- [ClickHouseCluster configuration](#clickhousecluster-configuration)
  - [Basic configuration](#basic-configuration)- [Replicas and shards](#replicas-and-shards)- [Keeper integration](#keeper-integration)- [KeeperCluster configuration](#keepercluster-configuration)- [Storage configuration](#storage-configuration)- [Pod configuration](#pod-configuration)
        - [Automatic topology spread and affinity](#automatic-topology-spread-and-affinity)- [Manual configuration](#manual-configuration)- [See API Reference for all supported Pod template options.](#see-api-reference-for-all-supported-pod-template-options)- [Container configuration](#container-configuration)
          - [Custom image](#custom-image)- [Container resources](#container-resources)- [Environment variables](#environment-variables)- [Volume mounts](#volume-mounts)- [See API Reference for all supported Container template options.](#see-api-reference-for-all-supported-container-template-options)- [TLS/SSL configuration](#tls-ssl-configuration)
            - [Configure secure endpoints](#configure-secure-endpoints)- [SSL certificate secret format](#ssl-certificate-secret-format)- [ClickHouse-Keeper communication over TLS](#clickhouse-keeper-communication-over-tls)- [ClickHouse settings](#clickhouse-settings)
              - [Default user password](#default-user-password)- [Custom users in configuration](#custom-users-in-configuration)- [Database sync](#database-sync)- [Custom configuration](#custom-configuration)
                - [Embedded extra configuration](#embedded-extra-configuration)- [Embedded extra users configuration](#embedded-extra-users-configuration)- [Configuration example](#configuration-example)

Was this page helpful?