Creating a role

If you have a ClickHouse® cluster, you can create a role in it using a custom ClickhouseRole resource.

You can configure the following for your role:

• Role inheritance (spec.membership).
• Permission blocks (spec.grants) for four types of ClickHouse® objects: databases, tables, named collections, and user and role administration.

The ClickhouseRole resource must reside in the same namespace as the ClickhouseCluster cluster. The resource name must follow this pattern: <cluster_name>-<user_name>.

Using the CLIUsing the CLI

1. Create the ClickhouseRole resource file, e.g., using the touch clickhouserole.yaml command.

2. Open the file and paste the configuration below into it:

   Role with read permissions

   Role with inheritance and table permissions

   apiVersion: clickhouse.stackland.yandex.cloud/v1alpha1
   kind: ClickhouseRole
   metadata:
     name: <cluster_name>-reader
   spec:
     cluster: <cluster_name>
     name: reader
     grants:
       - database:
           name: <database_name>
           privileges:
             - SELECT
   

   apiVersion: clickhouse.stackland.yandex.cloud/v1alpha1
   kind: ClickhouseRole
   metadata:
     name: <cluster_name>-writer
   spec:
     cluster: <cluster_name>
     name: writer
     membership:
       - reader
     grants:
       - database:
           name: <database_name>
           privileges:
             - SELECT
             - INSERT
             - CREATE TABLE
             - ALTER TABLE
       - table:
           database: <database_name>
           table: <table_name>
           privileges:
             - SELECT
             - INSERT
   

   Where:

   • spec.cluster: ClickhouseCluster cluster name.
   • spec.name: ClickHouse® role name.
   • spec.membership: Optional list of roles from which this role inherits permissions. The list contains spec.name values of other ClickhouseRole resources.
   • spec.grants: List of permission blocks. Each block must specify exactly one of the following fields: database, table, namedCollection, or access.

3. Apply the manifest: kubectl apply -f clickhouserole.yaml -n <project_name>.

Allowed privilegesAllowed privileges

The allowed privileges vary depending on the permission block type. Values must match the CRD exactly, including spaces in multi-word privileges.

Using the management consoleUsing the management console

1. If you have not opened a project yet, select one.

2. In the left-hand menu, select ClickHouse® Clusters.

3. Select the cluster.

4. Navigate to the Roles tab.

5. Click Create.

6. Fill out the fields as follows:

   • Role name: Role name in ClickHouse®.
   • Inherit roles from: Optional list of roles of the same cluster from which the new role inherits permissions. You can specify multiple roles.

7. Under Access permissions, configure the permissions. By default, one permission block is available:

   • In the Permissions for selector, select the object type: Database, Table, Named collection, or User and role administration.
   • For the Database type, select a database and privileges.
   • For the Table type, select a database, specify a table name, and select privileges.
   • For the Named collection and User and role administration types, only select privileges.

   To add another permission block, click Add. To delete a permission block, click Delete next to the block.

   For a list of allowed privileges for each block type, see Allowed privileges.

8. Click Create.

Done. The role will now appear in the list of roles on the Role tab.