defaultValues | Chainguard

1

namespaceOverride: ""

2

# commonLabels -- set of labels that will be applied to all the resources for the operator

3

commonLabels: {}

4

# commonAnnotations -- set of annotations that will be applied to all the resources for the operator

5

commonAnnotations: {}

6

deployment:

7

# look details in `kubectl explain deployment.spec.strategy`

8

strategy:

9

type: Recreate

10

crdHook:

11

# crdHook.enabled -- enable automatic CRD installation/update via pre-install/pre-upgrade hooks

12

# when disabled, CRDs must be installed manually using kubectl apply

13

enabled: true

14

image:

15

# crdHook.image.repository -- image repository for CRD installation job

16

repository: cgr.dev/chainguard-private/kubectl

17

# crdHook.image.tag -- image tag for CRD installation job

18

tag: latest-dev@sha256:398dec87b5eb669c4b86ef2249ab71ed5da16f0d6c2b525088e84dfacf59f716

19

# crdHook.image.pullPolicy -- image pull policy for CRD installation job

20

pullPolicy: IfNotPresent

21

# crdHook.imagePullSecrets -- image pull secrets for CRD installation job

22

# possible value format `[{"name":"your-secret-name"}]`,

23

# check `kubectl explain pod.spec.imagePullSecrets` for details

24

imagePullSecrets: []

25

# crdHook.resources -- resource limits and requests for CRD installation job

26

resources: {}

27

# limits:

28

# cpu: 100m

29

# memory: 128Mi

30

# requests:

31

# cpu: 100m

32

# memory: 128Mi

33

# crdHook.nodeSelector -- node selector for CRD installation job

34

nodeSelector: {}

35

# crdHook.tolerations -- tolerations for CRD installation job

36

tolerations: []

37

# crdHook.affinity -- affinity for CRD installation job

38

affinity: {}

39

# crdHook.annotations -- additional annotations for CRD installation job

40

annotations: {}

41

# crdHook.podAnnotations -- additional annotations for CRD installation job pod template

42

# useful to opt out of service mesh injection, e.g. `sidecar.istio.io/inject: "false"`

43

podAnnotations: {}

44

# crdHook.podSecurityContext -- pod-level security context for CRD installation job

45

# required by some admission policies (e.g. Kyverno `restrict-seccomp-strict`)

46

# check `kubectl explain pod.spec.securityContext` for details

47

podSecurityContext: {}

48

# runAsNonRoot: true

49

# runAsUser: 1000

50

# seccompProfile:

51

# type: RuntimeDefault

52

# crdHook.containerSecurityContext -- container security context for CRD installation job

53

# check `kubectl explain pod.spec.containers.securityContext` for details

54

containerSecurityContext: {}

55

# allowPrivilegeEscalation: false

56

# capabilities:

57

# drop:

58

# - ALL

59

# runAsNonRoot: true

60

# seccompProfile:

61

# type: RuntimeDefault

62

operator:

63

image:

64

# operator.image.registry -- optional image registry prefix (e.g. 1234567890.dkr.ecr.us-east-1.amazonaws.com)

65

registry: ""

66

# operator.image.repository -- image repository

67

repository: cgr.dev/chainguard-private/clickhouse-operator

68

# operator.image.tag -- image tag (chart's appVersion value will be used if not set)

69

tag: latest@sha256:354103f91e5d4b2a40b4aacfa652a10bd79c3e9dfac8e08e17a29a45777dbf39

70

# operator.image.pullPolicy -- image pull policy

71

pullPolicy: IfNotPresent

72

containerSecurityContext: {}

73

# operator.resources -- custom resource configuration, check `kubectl explain pod.spec.containers.resources` for details

74

resources: {}

75

# limits:

76

# cpu: 100m

77

# memory: 128Mi

78

# requests:

79

# cpu: 100m

80

# memory: 128Mi

81

82

# operator.priorityClassName -- priority class name for the clickhouse-operator deployment, check `kubectl explain pod.spec.priorityClassName` for details

83

# @default -- ""

84

priorityClassName: ""

85

# operator.env -- additional environment variables for the clickhouse-operator container in deployment

86

# possible format value `[{"name": "SAMPLE", "value": "text"}]`

87

env: []

88

# operator.livenessProbe -- optional liveness probe for the clickhouse-operator container

89

# check `kubectl explain pod.spec.containers.livenessProbe` for details

90

# example:

91

# httpGet:

92

# path: /metrics

93

# port: op-metrics

94

# initialDelaySeconds: 10

95

# periodSeconds: 10

96

livenessProbe: null

97

# operator.readinessProbe -- optional readiness probe for the clickhouse-operator container

98

# check `kubectl explain pod.spec.containers.readinessProbe` for details

99

# example:

100

# httpGet:

101

# path: /metrics

102

# port: op-metrics

103

# initialDelaySeconds: 5

104

# periodSeconds: 5

105

readinessProbe: null

106

metrics:

107

enabled: true

108

image:

109

# metrics.image.registry -- optional image registry prefix (e.g. 1234567890.dkr.ecr.us-east-1.amazonaws.com)

110

registry: ""

111

# metrics.image.repository -- image repository

112

repository: cgr.dev/chainguard-private/clickhouse-operator-metrics-exporter

113

# metrics.image.tag -- image tag (chart's appVersion value will be used if not set)

114

tag: latest@sha256:8db7a70b2929973e3a6e9a6a1eeee8102060cf030cc3a7e3f3079717a425dbf3

115

# metrics.image.pullPolicy -- image pull policy

116

pullPolicy: IfNotPresent

117

containerSecurityContext: {}

118

# metrics.resources -- custom resource configuration

119

resources: {}

120

# limits:

121

# cpu: 100m

122

# memory: 128Mi

123

# requests:

124

# cpu: 100m

125

# memory: 128Mi

126

127

# metrics.env -- additional environment variables for the deployment of metrics-exporter containers

128

# possible format value `[{"name": "SAMPLE", "value": "text"}]`

129

env: []

130

# metrics.livenessProbe -- optional liveness probe for the metrics-exporter container

131

# check `kubectl explain pod.spec.containers.livenessProbe` for details

132

# example:

133

# httpGet:

134

# path: /metrics

135

# port: ch-metrics

136

# initialDelaySeconds: 10

137

# periodSeconds: 10

138

livenessProbe: null

139

# metrics.readinessProbe -- optional readiness probe for the metrics-exporter container

140

# check `kubectl explain pod.spec.containers.readinessProbe` for details

141

# example:

142

# httpGet:

143

# path: /metrics

144

# port: ch-metrics

145

# initialDelaySeconds: 5

146

# periodSeconds: 5

147

readinessProbe: null

148

# imagePullSecrets -- image pull secret for private images in clickhouse-operator pod

149

# possible value format `[{"name":"your-secret-name"}]`,

150

# check `kubectl explain pod.spec.imagePullSecrets` for details

151

imagePullSecrets: []

152

# podLabels -- labels to add to the clickhouse-operator pod

153

podLabels: {}

154

# podAnnotations -- annotations to add to the clickhouse-operator pod, check `kubectl explain pod.spec.annotations` for details

155

# @default -- check the `values.yaml` file

156

podAnnotations:

157

prometheus.io/port: '8888'

158

prometheus.io/scrape: 'true'

159

clickhouse-operator-metrics/port: '9999'

160

clickhouse-operator-metrics/scrape: 'true'

161

# watchNamespaces -- namespaces where the operator watches for ClickHouseInstallation resources.

162

# Sets config.yaml watch.namespaces.include (the exclude list is not exposed here). If empty, the

163

# operator watches only its own namespace (or all namespaces when running in kube-system).

164

# Use [".*"] to watch all namespaces. Entries are regexps and are Helm-templated, so avoid a literal

165

# "{{" in a namespace/regexp.

166

# Example: watchNamespaces: ["clickhouse", "my-other-namespace"]

167

watchNamespaces: []

168

# nameOverride -- override name of the chart

169

nameOverride: ""

170

# fullnameOverride -- full name of the chart.

171

fullnameOverride: ""

172

serviceAccount:

173

# serviceAccount.create -- specifies whether a service account should be created

174

create: true

175

# serviceAccount.annotations -- annotations to add to the service account

176

annotations: {}

177

# serviceAccount.name -- the name of the service account to use; if not set and create is true, a name is generated using the fullname template

178

name:

179

rbac:

180

# rbac.create -- specifies whether rbac resources should be created

181

create: true

182

# rbac.namespaceScoped -- specifies whether to create roles and rolebindings at the cluster level or namespace level

183

namespaceScoped: false

184

secret:

185

# secret.create -- create a secret with operator credentials

186

create: true

187

# secret.username -- operator credentials username

188

username: clickhouse_operator

189

# secret.password -- operator credentials password

190

password: clickhouse_operator_password

191

# nodeSelector -- node for scheduler pod assignment, check `kubectl explain pod.spec.nodeSelector` for details

192

nodeSelector: {}

193

# tolerations -- tolerations for scheduler pod assignment, check `kubectl explain pod.spec.tolerations` for details

194

tolerations: []

195

# affinity -- affinity for scheduler pod assignment, check `kubectl explain pod.spec.affinity` for details

196

affinity: {}

197

# podSecurityContext - operator deployment SecurityContext, check `kubectl explain pod.spec.securityContext` for details

198

podSecurityContext: {}

199

# topologySpreadConstraints - topologySpreadConstraints affinity for scheduler pod assignment, check `kubectl explain pod.spec.topologySpreadConstraints` for details

200

topologySpreadConstraints: []

201

serviceMonitor:

202

# serviceMonitor.enabled -- ServiceMonitor Custom resource is created for a [prometheus-operator](https://github.com/prometheus-operator/prometheus-operator)

203

# In serviceMonitor will be created two endpoints ch-metrics on port 8888 and op-metrics # 9999. Ypu can specify interval, scrapeTimeout, relabelings, metricRelabelings for each endpoint below

204

enabled: false

205

# serviceMonitor.additionalLabels -- additional labels for service monitor

206

additionalLabels: {}

207

clickhouseMetrics:

208

# serviceMonitor.interval for ch-metrics endpoint --

209

interval: 30s

210

# serviceMonitor.scrapeTimeout for ch-metrics endpoint -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

211

scrapeTimeout: ""

212

# serviceMonitor.relabelings for ch-metrics endpoint -- Prometheus [RelabelConfigs] to apply to samples before scraping

213

relabelings: []

214

# serviceMonitor.metricRelabelings for ch-metrics endpoint -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestio

215

metricRelabelings: []

216

operatorMetrics:

217

# serviceMonitor.interval for op-metrics endpoint --

218

interval: 30s

219

# serviceMonitor.scrapeTimeout for op-metrics endpoint -- Prometheus ServiceMonitor scrapeTimeout. If empty, Prometheus uses the global scrape timeout unless it is less than the target's scrape interval value in which the latter is used.

220

scrapeTimeout: ""

221

# serviceMonitor.relabelings for op-metrics endpoint -- Prometheus [RelabelConfigs] to apply to samples before scraping

222

relabelings: []

223

# serviceMonitor.metricRelabelings for op-metrics endpoint -- Prometheus [MetricRelabelConfigs] to apply to samples before ingestio

224

metricRelabelings: []

225

# configs -- clickhouse operator configs

226

# @default -- check the `values.yaml` file for the config content (auto-generated from latest operator release)

227

configs:

228

confdFiles: null

229

configdFiles:

230

01-clickhouse-01-listen.xml: |

231

232

233

234

235

236

237

238

239

<listen_host>::</listen_host>

240

<listen_host>0.0.0.0</listen_host>

241

<listen_try>1</listen_try>

242

</yandex>

243

01-clickhouse-02-logger.xml: |

244

245

246

247

248

249

250

251

252

253

<level>debug</level>

254

<log>/var/log/clickhouse-server/clickhouse-server.log</log>

255

<errorlog>/var/log/clickhouse-server/clickhouse-server.err.log</errorlog>

256

257

258

259

260

</logger>

261

</yandex>

262

01-clickhouse-03-query_log.xml: |

263

264

265

266

267

268

269

270

<query_log replace="1">

271

<database>system</database>

272

<table>query_log</table>

273

<engine>Engine = MergeTree PARTITION BY event_date ORDER BY event_time TTL event_date + interval 30 day</engine>

274

<flush_interval_milliseconds>7500</flush_interval_milliseconds>

275

</query_log>

276

<query_thread_log remove="1"/>

277

</yandex>

278

01-clickhouse-04-part_log.xml: |

279

280

281

282

283

284

285

286

<part_log replace="1">

287

<database>system</database>

288

289

<engine>Engine = MergeTree PARTITION BY event_date ORDER BY event_time TTL event_date + interval 30 day</engine>

290

<flush_interval_milliseconds>7500</flush_interval_milliseconds>

291

</part_log>

292

</yandex>

293

01-clickhouse-05-trace_log.xml: |-

294

295

296

297

298

299

300

301

<trace_log replace="1">

302

<database>system</database>

303

<table>trace_log</table>

304

<engine>Engine = MergeTree PARTITION BY event_date ORDER BY event_time TTL event_date + interval 30 day</engine>

305

<flush_interval_milliseconds>7500</flush_interval_milliseconds>

306

</trace_log>

307

</yandex>

308

files:

309

config.yaml:

310

# IMPORTANT

311

# This file is auto-generated

312

# Do not edit this file - all changes would be lost

313

# Edit appropriate template in the following folder:

314

# deploy/builder/templates-config

315

# IMPORTANT

316

#

317

# Template parameters available:

318

# WATCH_NAMESPACES=

319

# CH_USERNAME_PLAIN=

320

# CH_PASSWORD_PLAIN=

321

# CH_CREDENTIALS_SECRET_NAMESPACE=

322

# CH_CREDENTIALS_SECRET_NAME=clickhouse-operator

323

# VERBOSITY=1

324

325

################################################

326

##

327

## Watch section

328

##

329

################################################

330

watch:

331

# Namespaces where clickhouse-operator watches for events.

332

# Concurrently running operators should watch on different namespaces.

333

# `include` and `exclude` accept literal namespace names or regexp patterns.

334

# Empty `include` watches the operator's own namespace (or all namespaces when

335

# the operator runs in `kube-system`); use [".*"] to force watch-all elsewhere.

336

# Empty `exclude` matches none. `exclude` is applied after `include`.

337

namespaces:

338

include: []

339

340

# Behavior when ClickHouseOperatorConfiguration changes: none | restart

341

configuration:

342

onChange: restart

343

clickhouse:

344

configuration:

345

################################################

346

##

347

## Configuration files section

348

##

349

################################################

350

file:

351

# Each 'path' can be either absolute or relative.

352

# In case path is absolute - it is used as is

353

# In case path is relative - it is relative to the folder where configuration file you are reading right now is located.

354

path:

355

# Path to the folder where ClickHouse configuration files common for all instances within a CHI are located.

356

common: chi/config.d

357

# Path to the folder where ClickHouse configuration files unique for each instance (host) within a CHI are located.

358

host: chi/conf.d

359

# Path to the folder where ClickHouse configuration files with users' settings are located.

360

# Files are common for all instances within a CHI.

361

user: chi/users.d

362

################################################

363

##

364

## Configuration users section

365

##

366

################################################

367

user:

368

# Default settings for user accounts, created by the operator.

369

# IMPORTANT. These are not access credentials or settings for 'default' user account,

370

# it is a template for filling out missing fields for all user accounts to be created by the operator,

371

# with the following EXCEPTIONS:

372

# 1. 'default' user account DOES NOT use provided password, but uses all the rest of the fields.

373

# Password for 'default' user account has to be provided explicitly, if to be used.

374

# 2. CHOP user account DOES NOT use:

375

# - profile setting. It uses predefined profile called 'clickhouse_operator'

376

# - quota setting. It uses empty quota name.

377

# - networks IP setting. Operator specifies 'networks/ip' user setting to match operators' pod IP only.

378

# - password setting. Password for CHOP account is used from 'clickhouse.access.*' section

379

default:

380

# Default values for ClickHouse user account(s) created by the operator

381

# 1. user/profile - string

382

# 2. user/quota - string

383

# 3. user/networks/ip - multiple strings

384

# 4. user/password - string

385

# These values can be overwritten on per-user basis.

386

profile: "default"

387

quota: "default"

388

networksIP:

389

- "::1"

390

- "127.0.0.1"

391

password: "default"

392

################################################

393

##

394

## Configuration network section

395

##

396

################################################

397

network:

398

# Default host_regexp to limit network connectivity from outside

399

hostRegexpTemplate: "(chi-{chi}-[^.]+\\d+-\\d+|clickhouse\\-{chi})\\.{namespace}\\.svc\\.cluster\\.local$"

400

################################################

401

##

402

## Configuration restart policy section

403

## Configuration restart policy describes what configuration changes require ClickHouse restart

404

##

405

################################################

406

configurationRestartPolicy:

407

rules:

408

# IMPORTANT!

409

# Special version of "*" - default version - has to satisfy all ClickHouse versions.

410

# Default version will also be used in case ClickHouse version is unknown.

411

# ClickHouse version may be unknown due to host being down - for example, because of incorrect "settings" section.

412

# ClickHouse is not willing to start in case incorrect/unknown settings are provided in config file.

413

- version: "*"

414

rules:

415

# see https://kb.altinity.com/altinity-kb-setup-and-maintenance/altinity-kb-server-config-files/#server-config-configxml-sections-which-dont-require-restart

416

# to be replaced with "select * from system.server_settings where changeable_without_restart = 'No'"

417

- settings/*: "yes"

418

# single values

419

- settings/access_control_path: "no"

420

- settings/dictionaries_config: "no"

421

- settings/max_server_memory_*: "no"

422

- settings/max_*_to_drop: "no"

423

- settings/max_concurrent_queries: "no"

424

- settings/models_config: "no"

425

- settings/user_defined_executable_functions_config: "no"

426

# structured XML

427

- settings/logger/*: "no"

428

- settings/macros/*: "no"

429

- settings/remote_servers/*: "no"

430

- settings/user_directories/*: "no"

431

# these settings should not lead to pod restarts

432

- settings/display_secrets_in_show_and_select: "no"

433

- zookeeper/*: "no"

434

- files/*.xml: "yes"

435

- files/config.d/*.xml: "yes"

436

- files/config.d/*dict*.xml: "no"

437

- files/config.d/*no_restart*: "no"

438

# exceptions in default profile

439

- profiles/default/background_*_pool_size: "yes"

440

- profiles/default/max_*_for_server: "yes"

441

- version: "21.*"

442

rules:

443

- settings/logger: "yes"

444

#################################################

445

##

446

## Access to ClickHouse instances

447

##

448

################################################

449

access:

450

# Possible values for 'scheme' are:

451

# 1. http - force http to be used to connect to ClickHouse instances

452

# 2. https - force https to be used to connect to ClickHouse instances

453

# 3. Auto - either http or https is selected based on open ports

454

scheme: "Auto"

455

# ClickHouse credentials (username, password and port) to be used by the operator to connect to ClickHouse instances.

456

# These credentials are used for:

457

# 1. Metrics requests

458

# 2. Schema maintenance

459

# User with these credentials can be specified in additional ClickHouse .xml config files,

460

# located in 'clickhouse.configuration.file.path.user' folder

461

username: ""

462

password: ""

463

# Inline PEM CA bundle the operator uses to verify ClickHouse server TLS.

464

rootCA: ""

465

# Alternate source for rootCA — a Secret in the operator's namespace.

466

# Mutually exclusive with the inline rootCA above (inline wins). Empty

467

# `name` = not used (no-op). When `key` is empty, the operator tries

468

# "ca.crt" then "tls.crt". Resolved once at config load (an operator

469

# restart picks up a rotated Secret).

470

rootCASecretRef:

471

472

key: ""

473

# Location of the k8s Secret with username and password to be used by the operator to connect to ClickHouse instances.

474

# Can be used instead of explicitly specified username and password available in sections:

475

# - clickhouse.access.username

476

# - clickhouse.access.password

477

# Secret should have two keys:

478

# 1. username

479

# 2. password

480

secret:

481

# Empty `namespace` means that k8s secret would be looked in the same namespace where operator's pod is running.

482

namespace: ""

483

# Empty `name` means no k8s Secret would be looked for

484

485

# Port where to connect to ClickHouse instances to

486

port: 8123

487

# Timeouts used to limit connection and queries from the operator to ClickHouse instances

488

# Specified in seconds.

489

timeouts:

490

# Timout to setup connection from the operator to ClickHouse instances. In seconds.

491

connect: 5

492

# Timout to perform SQL query from the operator to ClickHouse instances. In seconds.

493

query: 4

494

################################################

495

##

496

## Addons specifies additional configuration sections

497

## Should it be called something like "templates"?

498

##

499

################################################

500

addons:

501

rules:

502

- version: "*"

503

spec:

504

configuration:

505

users:

506

profiles:

507

quotas:

508

settings:

509

files:

510

- version: ">= 23.3"

511

spec:

512

configuration:

513

###

514

### users.d is global while description depends on CH version which may vary on per-host basis

515

### In case of global-ness this may be better to implement via auto-templates

516

###

517

### As a solution, this may be applied on the whole cluster based on any of its hosts

518

###

519

### What to do when host is just created? CH version is not known prior to CH started and user config is required before CH started.

520

### We do not have any info about the cluster on initial creation

521

###

522

users:

523

"{clickhouseOperatorUser}/access_management": 1

524

"{clickhouseOperatorUser}/named_collection_control": 1

525

"{clickhouseOperatorUser}/show_named_collections": 1

526

"{clickhouseOperatorUser}/show_named_collections_secrets": 1

527

profiles:

528

quotas:

529

settings:

530

files:

531

- version: ">= 23.5"

532

spec:

533

configuration:

534

users:

535

profiles:

536

clickhouse_operator/format_display_secrets_in_show_and_select: 1

537

quotas:

538

settings:

539

##

540

## this may be added on per-host basis into host's conf.d folder

541

##

542

display_secrets_in_show_and_select: 1

543

files:

544

#################################################

545

##

546

## Metrics collection

547

##

548

################################################

549

metrics:

550

# Timeouts used to limit connection and queries from the metrics exporter to ClickHouse instances

551

# Specified in seconds.

552

timeouts:

553

# Timeout used to limit metrics collection request. In seconds.

554

# Upon reaching this timeout metrics collection is aborted and no more metrics are collected in this cycle.

555

# All collected metrics are returned.

556

collect: 9

557

# Regexp to match tables in system database to fetch metrics from.

558

# Multiple tables can be matched using regexp. Matched tables are merged using merge() table function.

559

# Default is "^(metrics|custom_metrics)$" which fetches from both system.metrics and system.custom_metrics.

560

tablesRegexp: "^(metrics|custom_metrics)$"

561

# List of regexps to match ClickHouse metrics to exclude from collection/export.

562

# Regexps match internal metric names before Prometheus normalization and prefixing.

563

# Default is the per-CPU OS metrics filter shown below; set to [] to disable.

564

excludeRegexp:

565

- "^metric\\.(OS.*CPU[0-9]+|CPUFrequencyMHz_[0-9]+)$"

566

keeper:

567

configuration:

568

################################################

569

##

570

## Configuration files section

571

##

572

################################################

573

file:

574

# Each 'path' can be either absolute or relative.

575

# In case path is absolute - it is used as is

576

# In case path is relative - it is relative to the folder where configuration file you are reading right now is located.

577

path:

578

# Path to the folder where Keeper configuration files common for all instances within a CHK are located.

579

common: chk/keeper_config.d

580

# Path to the folder where Keeper configuration files unique for each instance (host) within a CHK are located.

581

host: chk/conf.d

582

# Path to the folder where Keeper configuration files with users' settings are located.

583

# Files are common for all instances within a CHI.

584

user: chk/users.d

585

################################################

586

##

587

## Security Section

588

##

589

## Operator-wide security toggles. All fields default to unset / permissive so

590

## upgrades from earlier versions preserve identical behavior. Set explicit

591

## values here to tighten the operator's outbound TLS posture; CHIs may further

592

## override per-cluster via spec.configuration.clusters[].security.

593

##

594

## Three orthogonal axes govern this section:

595

## 1. security.policy — TLS-hardening master switch (Permissive | Enforced)

596

## 2. security.fips.enforced — FIPS cryptographic-module gate (bool)

597

## 3. security.images.policy — Workload image-tag governance (Permissive | FIPSRequired)

598

## Each axis is independent: enabling one does not enable the others.

599

##

600

## See docs/chi-examples/70-chop-config.yaml for a fully-annotated example

601

## and docs/security_hardening.md for the design + per-knob semantics.

602

##

603

################################################

604

security:

605

clickhouse:

606

tls:

607

# Strict | None | "" (preserve legacy InsecureSkipVerify=true)

608

verify: ""

609

# "1.2" | "1.3" | "" (Go stdlib default)

610

minVersion: ""

611

# SNI / cert-name override; default = dial host

612

serverName: ""

613

# Inline PEM CA bundle (or base64-wrapped)

614

rootCA: ""

615

# Alternate source — Secret in operator namespace. Mutually exclusive

616

# with the inline rootCA above. Empty `name` = not used (no-op).

617

# When `key` is empty, the operator tries "ca.crt" then "tls.crt".

618

rootCASecretRef:

619

620

key: ""

621

zookeeper:

622

tls:

623

verify: ""

624

minVersion: ""

625

kubernetes:

626

tls:

627

# Strict refuses an insecure kubeconfig at startup

628

verify: ""

629

# Floors the K8s API client transport TLS version; coerced to 1.3 under FIPS/Enforced

630

minVersion: ""

631

ipc:

632

# Plain (default) | Secure (loopback + X-CHOP-Token)

633

mode: Plain

634

# Defaults to 127.0.0.1 when mode=Secure

635

bindHost: ""

636

# Defaults to /etc/clickhouse-operator-ipc/token

637

tokenPath: ""

638

# Operator-wide TLS-hardening master switch. ONLY governs TLS posture across

639

# CH / ZK / K8s transports — NOT the FIPS cryptographic-module gate (see

640

# security.fips.enforced below for that, orthogonal axis).

641

#

642

# Permissive (default) preserves 0.27.0 behavior — no coercion, no rejection.

643

# Enforced coerces all TLS knobs above to their Strict positions at startup:

644

# - clickhouse.tls.verify=Strict, clickhouse.tls.minVersion=1.3

645

# - zookeeper.tls.verify=Strict, zookeeper.tls.minVersion=1.3

646

# - kubernetes.tls.verify=Strict, kubernetes.tls.minVersion=1.3

647

# - ipc.mode=Secure

648

# - clickhouse.access.scheme: http is coerced to https

649

# Enforced also rejects CHIs that cannot be served in a hardened posture

650

# (e.g. plaintext external ZooKeeper, ZK digest auth).

651

#

652

# Independent of the Go FIPS toolchain — works on non-FIPS builds for pure

653

# TLS hardening. Combine with security.fips.enforced=true for full FIPS

654

# cryptographic-module enforcement.

655

policy: Permissive

656

# FIPS cryptographic-module enforcement. Orthogonal to security.policy.

657

# Default operator and metrics-exporter images are FIPS-compatible —

658

# built with GOFIPS140=v1.0.0 and run with GODEBUG=fips140=on, so

659

# crypto/fips140.Enabled() returns true at runtime.

660

# When enforced=true, the operator Fatals at startup unless the binary

661

# reports crypto/fips140 Enabled — guards against accidentally running

662

# a non-FIPS rebuild in a hardened deployment.

663

fips:

664

enforced: false

665

images:

666

# Workload image-tag governance gate. Today's only non-default value is

667

# FIPSRequired (admission rejects CRs whose CH/Keeper images lack 'fips'

668

# in tag; post-Ready SELECT version() must contain 'fips' or CR aborts).

669

# Orthogonal to security.policy and security.fips.enforced.

670

# See docs/security_hardening_fips.md → "security.images.policy: FIPSRequired"

671

# for the full policy matrix + detection details + recovery procedure.

672

policy: Permissive

673

################################################

674

##

675

## Template(s) management section

676

##

677

################################################

678

template:

679

chi:

680

# CHI template updates handling policy

681

# Possible policy values:

682

# - ReadOnStart. Accept CHIT updates on the operator's start only.

683

# - ApplyOnNextReconcile. Accept CHIT updates at all time. Apply new CHITs on next regular reconcile of the CHI

684

policy: ApplyOnNextReconcile

685

# Path to the folder where ClickHouseInstallation templates .yaml manifests are located.

686

# Templates are added to the list of all templates and used when CHI is reconciled.

687

# Templates are applied in sorted alpha-numeric order.

688

path: chi/templates.d

689

chk:

690

# CHK template updates handling policy

691

# Possible policy values:

692

# - ReadOnStart. Accept CHIT updates on the operators start only.

693

# - ApplyOnNextReconcile. Accept CHIT updates at all time. Apply new CHITs on next regular reconcile of the CHI

694

policy: ApplyOnNextReconcile

695

# Path to the folder where ClickHouseInstallation templates .yaml manifests are located.

696

# Templates are added to the list of all templates and used when CHI is reconciled.

697

# Templates are applied in sorted alpha-numeric order.

698

path: chk/templates.d

699

################################################

700

##

701

## Reconcile section

702

##

703

################################################

704

reconcile:

705

# Reconcile runtime settings

706

runtime:

707

# Max number of concurrent CHI reconciles in progress

708

reconcileCHIsThreadsNumber: 10

709

# Max number of concurrent CHK reconciles in progress

710

reconcileCHKsThreadsNumber: 1

711

# The operator reconciles shards concurrently in each CHI with the following limitations:

712

# 1. Number of shards being reconciled (and thus having hosts down) in each CHI concurrently

713

# can not be greater than 'reconcileShardsThreadsNumber'.

714

# 2. Percentage of shards being reconciled (and thus having hosts down) in each CHI concurrently

715

# can not be greater than 'reconcileShardsMaxConcurrencyPercent'.

716

# 3. The first shard is always reconciled alone. Concurrency starts from the second shard and onward.

717

# Thus limiting number of shards being reconciled (and thus having hosts down) in each CHI by both number and percentage

718

719

# Max number of concurrent shard reconciles within one cluster in progress

720

reconcileShardsThreadsNumber: 5

721

# Max percentage of concurrent shard reconciles within one cluster in progress

722

reconcileShardsMaxConcurrencyPercent: 50

723

# Reconcile StatefulSet scenario

724

statefulSet:

725

# Create StatefulSet scenario

726

create:

727

# What to do in case created StatefulSet is not in 'Ready' after `reconcile.statefulSet.update.timeout` seconds

728

# Possible options:

729

# 1. abort - abort the process, do nothing with the problematic StatefulSet, leave it as it is,

730

# do not try to fix or delete or update it, just abort reconcile cycle.

731

# Do not proceed to the next StatefulSet(s) and wait for an admin to assist.

732

# 2. delete - delete newly created problematic StatefulSet and follow 'abort' path afterwards.

733

# 3. ignore - ignore an error, pretend nothing happened, continue reconcile and move on to the next StatefulSet.

734

onFailure: ignore

735

# Update StatefulSet scenario

736

update:

737

# How many seconds to wait for created/updated StatefulSet to be 'Ready'

738

timeout: 300

739

# How many seconds to wait between checks/polls for created/updated StatefulSet status

740

pollInterval: 5

741

# What to do in case updated StatefulSet is not in 'Ready' after `reconcile.statefulSet.update.timeout` seconds

742

# Possible options:

743

# 1. abort - abort the process, do nothing with the problematic StatefulSet, leave it as it is,

744

# do not try to fix or delete or update it, just abort reconcile cycle.

745

# Do not proceed to the next StatefulSet(s) and wait for an admin to assist.

746

# 2. rollback - delete Pod and rollback StatefulSet to previous Generation.

747

# Pod would be recreated by StatefulSet based on rollback-ed StatefulSet configuration.

748

# Follow 'abort' path afterwards.

749

# 3. ignore - ignore an error, pretend nothing happened, continue reconcile and move on to the next StatefulSet.

750

onFailure: abort

751

# Recreate StatefulSet scenario

752

recreate:

753

# What to do in case operator is in need to recreate StatefulSet?

754

# Possible options:

755

# 1. abort - abort the process, do nothing with the problematic StatefulSet, leave it as it is,

756

# do not try to fix or delete or update it, just abort reconcile cycle.

757

# Do not proceed to the next StatefulSet(s) and wait for an admin to assist.

758

# 2. recreate - proceed and recreate StatefulSet.

759

760

# Triggered when PVC data loss or missing volumes are detected

761

onDataLoss: recreate

762

# Triggered when StatefulSet update fails or StatefulSet is not ready

763

onUpdateFailure: recreate

764

# Reconcile Host scenario

765

host:

766

# The operator during reconcile procedure should wait for a ClickHouse host to achieve the following conditions:

767

wait:

768

# Whether the operator during reconcile procedure should wait for a ClickHouse host:

769

# - to be excluded from a ClickHouse cluster

770

# - to complete all running queries

771

# - to be included into a ClickHouse cluster

772

# respectfully before moving forward with host reconcile

773

774

queries: true

775

include: false

776

# The operator during reconcile procedure should wait for replicas to catch-up

777

# replication delay a.k.a replication lag for the following replicas

778

replicas:

779

# All replicas (new and known earlier) are explicitly requested to wait for replication to catch-up

780

all: no

781

# New replicas only are requested to wait for replication to catch-up

782

new: yes

783

# Replication catch-up is considered to be completed as soon as replication delay

784

# a.k.a replication lag - calculated as "MAX(absolute_delay) FROM system.replicas"

785

# is within this specified delay (in seconds)

786

delay: 10

787

probes:

788

# Whether the operator during host launch procedure should wait for startup probe to succeed.

789

# In case probe is unspecified wait is assumed to be completed successfully.

790

# Default option value is to do not wait.

791

startup: no

792

# Whether the operator during host launch procedure should wait for readiness probe to succeed.

793

# In case probe is unspecified wait is assumed to be completed successfully.

794

# Default option value is to wait.

795

readiness: yes

796

# The operator during reconcile procedure should drop the following entities:

797

drop:

798

replicas:

799

# Whether the operator during reconcile procedure should drop replicas when replica is deleted

800

onDelete: yes

801

# Whether the operator during reconcile procedure should drop replicas when replica volume is lost

802

onLostVolume: yes

803

# Whether the operator during reconcile procedure should drop active replicas when replica is deleted or recreated

804

active: no

805

################################################

806

##

807

## Coordination with external systems during reconcile

808

##

809

################################################

810

coordination:

811

keeper:

812

# How long the operator waits for a referenced ClickHouseKeeper to become ready

813

# before aborting CHI reconcile. In seconds.

814

readyTimeout: 120

815

# Reaction when a referenced CHK resource changes:

816

# none — do nothing (default, backward-compatible)

817

# reconcile — trigger CHI reconcile

818

# onKeeperResourceUpdate: none

819

################################################

820

##

821

## Auto-recovery from aborted reconcile

822

##

823

################################################

824

recovery:

825

# Recovery scopes keyed by the CHI .status.status they apply to.

826

# Each scope contains on<Event>: <action> mappings that apply while the CHI

827

# is in that status. Multi-scope design anticipates future states beyond Aborted

828

# (e.g. Failed, Broken).

829

onStatus:

830

# Recovery for a CHI whose .status.status is Aborted (reconcile did not complete)

831

# when one of its host pods transitions to Ready — auto-resumes the reconcile.

832

aborted:

833

# Action when a pod belonging to an Aborted CHI transitions to Ready:

834

# retry (default) — re-enqueue the CHI for reconcile

835

# none — do nothing, CHI stays Aborted

836

onPodReady: retry

837

# Future events (not yet implemented):

838

# onKeeperReady: retry — retry when a referenced CHK becomes ready

839

# onOperatorRestart: retry — sweep Aborted CHIs on operator startup

840

# Recovery for a CHI whose .status.status is Completed (fully reconciled) when one

841

# of its host pods regresses to Ready=False and stays NotReady (sustained) without

842

# crashing — auto-heals stuck hosts.

843

completed:

844

# Action when a Completed CHI's pod flips Ready=True -> Ready=False and

845

# stays NotReady for at least onPodNotReadyThreshold:

846

# none (default) — do nothing

847

# retry — re-enqueue the CHI so the stuck host is force-restarted

848

# OFF by default: force-recreating a Completed CHI's pod is destructive — it can

849

# interrupt a replica's in-progress recovery and means hard downtime for a

850

# single-replica shard. Opt in with `retry` only where that trade-off is acceptable.

851

onPodNotReady: none

852

# Minimum duration a pod must stay Ready=False before recovery fires, once enabled

853

# (Go duration string; default 5m). Raise it for slow-recovering replicas.

854

onPodNotReadyThreshold: 5m

855

# Future scopes (not yet implemented):

856

# failed:

857

# onPodReady: retry

858

# broken:

859

# onPodReady: retry

860

# Future global policy knobs (not yet implemented) — flat peers of `onStatus`,

861

# apply across all recovery scopes:

862

#

863

# Global kill-switch for auto-recovery:

864

# enabled: true

865

#

866

# Cap on consecutive auto-recovery attempts before giving up:

867

# retries: 5

868

#

869

# Minimum time between auto-recovery attempts for the same CHI:

870

# cooldown: 30s

871

#

872

# Exponential backoff for auto-recovery attempts:

873

# backoff:

874

# duration: 5s

875

# factor: 2

876

# maxDuration: 2m

877

################################################

878

##

879

## Annotations management section

880

##

881

################################################

882

annotation:

883

# Applied when:

884

# 1. Propagating annotations from the CHI's `metadata.annotations` to child objects' `metadata.annotations`,

885

# 2. Propagating annotations from the CHI Template's `metadata.annotations` to CHI's `metadata.annotations`,

886

# Include annotations from the following list:

887

# Applied only when not empty. Empty list means "include all, no selection"

888

include: []

889

# Exclude annotations from the following list:

890

891

################################################

892

##

893

## Labels management section

894

##

895

################################################

896

label:

897

# Applied when:

898

# 1. Propagating labels from the CHI's `metadata.labels` to child objects' `metadata.labels`,

899

# 2. Propagating labels from the CHI Template's `metadata.labels` to CHI's `metadata.labels`,

900

# Include labels from the following list:

901

# Applied only when not empty. Empty list means "include all, no selection"

902

include: []

903

# Exclude labels from the following list:

904

# Applied only when not empty. Empty list means "nothing to exclude, no selection"

905

906

# Whether to append *Scope* labels to StatefulSet and Pod.

907

# Full list of available *scope* labels check in 'labeler.go'

908

# LabelShardScopeIndex

909

# LabelReplicaScopeIndex

910

# LabelCHIScopeIndex

911

# LabelCHIScopeCycleSize

912

# LabelCHIScopeCycleIndex

913

# LabelCHIScopeCycleOffset

914

# LabelClusterScopeIndex

915

# LabelClusterScopeCycleSize

916

# LabelClusterScopeCycleIndex

917

# LabelClusterScopeCycleOffset

918

appendScope: "no"

919

################################################

920

##

921

## Metrics management section

922

##

923

################################################

924

metrics:

925

labels:

926

927

################################################

928

##

929

## Status management section

930

##

931

################################################

932

status:

933

fields:

934

action: false

935

actions: false

936

error: true

937

errors: true

938

################################################

939

##

940

## StatefulSet management section

941

##

942

################################################

943

statefulSet:

944

revisionHistoryLimit: 0

945

################################################

946

##

947

## Pod management section

948

##

949

################################################

950

pod:

951

# Grace period for Pod termination.

952

# How many seconds to wait between sending

953

# SIGTERM and SIGKILL during Pod termination process.

954

# Increase this number is case of slow shutdown.

955

terminationGracePeriod: 30

956

################################################

957

##

958

## Log parameters section

959

##

960

################################################

961

logger:

962

logtostderr: "true"

963

alsologtostderr: "false"

964

v: "1"

965

stderrthreshold: ""

966

vmodule: ""

967

log_backtrace_at: ""

968

templatesdFiles:

969

001-templates.json.example: |

970

{

971

"apiVersion": "clickhouse.altinity.com/v1",

972

"kind": "ClickHouseInstallationTemplate",

973

"metadata": {

974

"name": "01-default-volumeclaimtemplate"

975

},

976

"spec": {

977

"templates": {

978

"volumeClaimTemplates": [

979

{

980

"name": "chi-default-volume-claim-template",

981

"spec": {

982

"accessModes": [

983

"ReadWriteOnce"

984

],

985

"resources": {

986

"requests": {

987

"storage": "2Gi"

988

}

989

}

990

}

991

}

992

],

993

"podTemplates": [

994

{

995

"name": "chi-default-oneperhost-pod-template",

996

"distribution": "OnePerHost",

997

"spec": {

998

"containers" : [

999

{

1000

"name": "clickhouse",

1001

"image": "clickhouse/clickhouse-server:23.8",

1002

"ports": [

1003

{

1004

"name": "http",

1005

"containerPort": 8123

1006

},

1007

{

1008

"name": "client",

1009

"containerPort": 9000

1010

},

1011

{

1012

"name": "interserver",

1013

"containerPort": 9009

1014

}

1015

]

1016

}

1017

]

1018

}

1019

}

1020

]

1021

}

1022

}

1023

}

1024

default-pod-template.yaml.example: |

1025

apiVersion: "clickhouse.altinity.com/v1"

1026

kind: "ClickHouseInstallationTemplate"

1027

metadata:

1028

1029

spec:

1030

templates:

1031

podTemplates:

1032

- name: default-oneperhost-pod-template

1033

distribution: "OnePerHost"

1034

default-storage-template.yaml.example: |

1035

apiVersion: "clickhouse.altinity.com/v1"

1036

kind: "ClickHouseInstallationTemplate"

1037

metadata:

1038

1039

spec:

1040

templates:

1041

volumeClaimTemplates:

1042

- name: default-storage-template-2Gi

1043

spec:

1044

accessModes:

1045

- ReadWriteOnce

1046

resources:

1047

requests:

1048

storage: 2Gi

1049

readme: |-

1050

Templates in this folder are packaged with an operator and available via 'useTemplate'

1051

usersdFiles:

1052

01-clickhouse-operator-profile.xml: |

1053

1054

1055

1056

1057

1058

1059

<!--

1060

#

1061

# Template parameters available:

1062

#

1063

-->

1064

1065

1066

1067

<clickhouse_operator>

1068

<log_queries>0</log_queries>

1069

<skip_unavailable_shards>1</skip_unavailable_shards>

1070

<http_connection_timeout>10</http_connection_timeout>

1071

<max_concurrent_queries_for_all_users>0</max_concurrent_queries_for_all_users>

1072

<os_thread_priority>0</os_thread_priority>

1073

</clickhouse_operator>

1074

</profiles>

1075

</yandex>

1076

02-clickhouse-default-profile.xml: |-

1077

1078

1079

1080

1081

1082

1083

1084

1085

1086

<os_thread_priority>2</os_thread_priority>

1087

<log_queries>1</log_queries>

1088

<connect_timeout_with_failover_ms>1000</connect_timeout_with_failover_ms>

1089

<distributed_aggregation_memory_efficient>1</distributed_aggregation_memory_efficient>

1090

<parallel_view_processing>1</parallel_view_processing>

1091

<do_not_merge_across_partitions_select_final>1</do_not_merge_across_partitions_select_final>

1092

<load_balancing>nearest_hostname</load_balancing>

1093

<prefer_localhost_replica>0</prefer_localhost_replica>

1094

1095

</default>

1096

</profiles>

1097

</yandex>

1098

keeperConfdFiles: null

1099

keeperConfigdFiles:

1100

01-keeper-01-default-config.xml: |

1101

1102

1103

1104

1105

1106

1107

1108

<asynchronous_metrics_keeper_metrics_only>1</asynchronous_metrics_keeper_metrics_only>

1109

<keeper_server>

1110

<coordination_settings>

1111

<async_replication>1</async_replication>

1112

<min_session_timeout_ms>10000</min_session_timeout_ms>

1113

<operation_timeout_ms>10000</operation_timeout_ms>

1114

<raft_logs_level>information</raft_logs_level>

1115

<session_timeout_ms>100000</session_timeout_ms>

1116

<use_xid_64>1</use_xid_64>

1117

</coordination_settings>

1118

<hostname_checks_enabled>true</hostname_checks_enabled>

1119

<log_storage_path>/var/lib/clickhouse-keeper/coordination/logs</log_storage_path>

1120

<snapshot_storage_path>/var/lib/clickhouse-keeper/coordination/snapshots</snapshot_storage_path>

1121

<storage_path>/var/lib/clickhouse-keeper</storage_path>

1122

<tcp_port>2181</tcp_port>

1123

<!--

1124

Four-letter-word command allowlist.

1125

1126

Set explicitly to the upstream-default list so the operator-rendered

1127

liveness probe (which sends `ruok` over TCP and expects `imok`) keeps

1128

working even if a user adds their own keeper_server settings.

1129

1130

Without this, a user override that restricts the allowlist

1131

(e.g. `four_letter_word_white_list: "mntr,stat"` for security)

1132

would silently disable `ruok` → liveness probe always fails → CrashLoopBackOff.

1133

1134

The list mirrors ClickHouse Keeper's compiled-in default; users who want a

1135

stricter list can override this value, but they must keep `ruok` if they

1136

also use the default operator probes.

1137

-->

1138

<four_letter_word_white_list>conf,cons,crst,envi,ruok,srst,srvr,stat,wchs,dirs,mntr,isro</four_letter_word_white_list>

1139

</keeper_server>

1140

<listen_host>::</listen_host>

1141

<listen_host>0.0.0.0</listen_host>

1142

<listen_try>1</listen_try>

1143

1144

1145

<level>information</level>

1146

</logger>

1147

<max_connections>4096</max_connections>

1148

</clickhouse>

1149

01-keeper-02-readiness.xml: |

1150

1151

1152

1153

1154

1155

1156

1157

<keeper_server>

1158

<http_control>

1159

1160

1161

<endpoint>/ready</endpoint>

1162

</readiness>

1163

</http_control>

1164

</keeper_server>

1165

</clickhouse>

1166

01-keeper-03-enable-reconfig.xml: |-

1167

1168

1169

1170

1171

1172

1173

1174

<keeper_server>

1175

<enable_reconfiguration>false</enable_reconfiguration>

1176

</keeper_server>

1177

</clickhouse>

1178

keeperTemplatesdFiles:

1179

readme: |-

1180

Templates in this folder are packaged with an operator and available via 'useTemplate'

1181

keeperUsersdFiles: null

1182

# additionalResources -- list of additional resources to create (processed via `tpl` function),

1183

# useful for create ClickHouse clusters together with clickhouse-operator.

1184

# check `kubectl explain chi` for details

1185

additionalResources: []

1186

# - |

1187

# apiVersion: v1

1188

# kind: ConfigMap

1189

# metadata:

1190

# name: {{ include "altinity-clickhouse-operator.fullname" . }}-cm

1191

# namespace: {{ include "altinity-clickhouse-operator.namespace" . }}

1192

# - |

1193

# apiVersion: v1

1194

# kind: Secret

1195

# metadata:

1196

# name: {{ include "altinity-clickhouse-operator.fullname" . }}-s

1197

# namespace: {{ include "altinity-clickhouse-operator.namespace" . }}

1198

# stringData:

1199

# mykey: my-value

1200

# - |

1201

# apiVersion: clickhouse.altinity.com/v1

1202

# kind: ClickHouseInstallation

1203

# metadata:

1204

# name: {{ include "altinity-clickhouse-operator.fullname" . }}-chi

1205

# namespace: {{ include "altinity-clickhouse-operator.namespace" . }}

1206

# spec:

1207

# configuration:

1208

# clusters:

1209

# - name: default

1210

# layout:

1211

# shardsCount: 1

1212

1213

dashboards:

1214

# dashboards.enabled -- provision grafana dashboards as configMaps (can be synced by grafana dashboards sidecar https://github.com/grafana/helm-charts/blob/grafana-8.3.4/charts/grafana/values.yaml#L778 )

1215

enabled: false

1216

# dashboards.additionalLabels -- labels to add to a secret with dashboards

1217

additionalLabels:

1218

# dashboards.additionalLabels.grafana_dashboard - will watch when official grafana helm chart sidecar.dashboards.enabled=true

1219

grafana_dashboard: ""

1220

# dashboards.annotations -- annotations to add to a secret with dashboards

1221

annotations:

1222

# dashboards.annotations.grafana_folder -- folder where will place dashboards, requires define values in official grafana helm chart sidecar.dashboards.folderAnnotation: grafana_folder

1223

grafana_folder: clickhouse-operator

1224

clickhouse-operator

The trusted source for open source

Product

Solutions

Customers

Resources

Company