Network and DB clusters in Managed Service for ClickHouse®

When creating a ClickHouse® cluster, you can:

• Specify a network for the entire cluster.

• Specify subnets for each host in the cluster.

• Request public access to connect to the cluster from outside Yandex Cloud.

You can create a cluster without specifying any subnets for the hosts if the availability zone selected for each host contains exactly one subnet of the cluster network.

Host name and FQDNHost name and FQDN

Managed Service for ClickHouse® generates the name of each cluster host when creating it. This name will be the host's fully qualified domain name (FQDN). The host name and, consequently, FQDN cannot be changed.

To learn how to get a host FQDN, see this guide.

To access a host within a single cloud network, use its FQDN. For more information, see the Yandex Virtual Private Cloud documentation.

Public access to a hostPublic access to a host

Any cluster host can be accessible from outside Yandex Cloud if you requested public access when creating the host.

You cannot request a public address after creating a host; however, you can replace one of the existing hosts with a new one that has a public address.

When deleting a publicly accessible host, the assigned IP address is revoked.

Security groupsSecurity groups

Security groups follow the rule that all traffic is denied unless you explicitly allow it. To connect to a cluster, configure security group rules. These rules allow traffic from certain ports, IP addresses, or other security groups. For example, a VM will not be able to connect to a cluster in the following cases:

• The VM is in the 10.128.0.0/16 subnet, whereas the inbound rules only allow 10.133.0.0/24.
• The VM is in the 10.133.0.0/24 subnet but attempts to access a port not exposed in the security group rules.

For information on how to configure security groups, see Configuring security groups.

Features of using security groups:

• Even if the cluster and host share the same security group, you still need rules allowing traffic between them to be able to connect to the cluster from the host. By default, such rules are included in the security group created along with the cloud network. These are the Self rules that allow unlimited traffic within the security group.

• Security group settings only determine whether connecting to the cluster is possible. They do not affect cluster features, such as replication, sharding, and backups.

For more information, see this Virtual Private Cloud article.

Use casesUse cases

• Setting up Yandex Cloud DNS to access managed database clusters from other cloud networks

ClickHouse® is a registered trademark of ClickHouse, Inc.