Network and database clusters in Managed Service for ClickHouse®

When creating a ClickHouse® cluster, you can:

• Specify a network for the cluster.

• Specify subnets for each host in the cluster.

• Request public access to connect to the cluster from outside Yandex Cloud.

You can create a cluster without specifying any subnets for hosts if the availability zone for each host contains only one subnet of the cluster network.

Host name and FQDNHost name and FQDN

Managed Service for ClickHouse® generates a name for each cluster host when creating it. This name will be the host's fully qualified domain name (FQDN). You cannot change the host name and, consequently, FQDN.

For how to get a host FQDN, see this guide.

To access a host within a single cloud network, use its FQDN. For more information, see this Yandex Virtual Private Cloud guide.

Public access to a hostPublic access to a host

You can make any cluster host accessible from outside Yandex Cloud by requesting public access when creating the host.

You cannot request a public address after creating the host; however, you can replace one of the existing hosts with a new one that has a public address.

When deleting a publicly accessible host, the allocated IP address is revoked.

Security groupsSecurity groups

Security groups follow the rule that all traffic is denied unless you explicitly allow it. To connect to a cluster, configure security group rules. These rules allow traffic from certain ports, IP addresses, or other security groups. For example, a VM will not be able to connect to a cluster in the following cases:

• The VM is in the 10.128.0.0/16 subnet, whereas the inbound rules only allow 10.133.0.0/24.
• The VM is in the 10.133.0.0/24 subnet but attempts to access a port not exposed in the security group rules.

For information on how to configure security groups, see Configuring security groups.

Features of using security groups:

• Even if the cluster and host share the same security group, you still need rules allowing traffic between them to be able to connect to the cluster from the host. By default, such rules are included in the security group created along with the cloud network. These are the Self rules that allow unlimited traffic within the security group.

• Security group settings only determine whether connecting to the cluster is possible. They do not affect cluster features, such as replication, sharding, and backups.

For more information, see this Virtual Private Cloud article.

Use casesUse cases

• Setting up Yandex Cloud DNS to access managed database clusters from other cloud networks

ClickHouse® is a registered trademark of ClickHouse, Inc.