Editing a role

If you have a ClickHouse® role, you can edit role inheritance and permission blocks.

Once a role is created, you cannot edit role name (spec.name) and cluster name (spec.cluster).

Using the CLIUsing the CLI

1. Get the list of roles in the project: kubectl get clickhouserole -n <project_name>.
2. Open the resource for editing: kubectl edit clickhouserole <resource_name> -n <project_name>.
3. Edit the spec.membership and spec.grants fields and save the file.

Each time a resource is edited, grants are recreated in ClickHouse®: the current set of privileges is revoked and a new one from spec.grants is applied. Role inheritance is synchronized based on spec.membership.

For a full list of allowed privileges for each block type, see Allowed privileges.

Using the management consoleUsing the management console

1. If you have not opened a project yet, select one.

2. In the left-hand menu, select ClickHouse® Clusters.

3. Select a cluster.

4. Navigate to the Roles tab.

5. Click the role name to open the card. The General tab shows inheritance, permission blocks, and status. To view the resource manifest, go to the YAML tab.

6. Click Edit.

7. Edit the roles in the Inherit roles from field and the permission blocks in the Access permissions section:

   • To add a permission block, click Add.
   • To delete a permission block, click Delete next to the block.
   • To change the block type, select a different value in the Permissions for switch. Fields not belonging to the new type get cleared.

8. Click Save.