ClickHouse
Last modified on January 21, 2025
Overview
This guide describes how to add a ClickHouse database as a datasource in the Admin UI. StrongDM supports HTTP, MySQL, Postgres, and TCP for connection to ClickHouse. If you want to use a Postgres client to connect to ClickHouse, simply follow the Postgres guide.
Prerequisites
To add a datasource, make sure you have met the following prerequisites:
- Properly configure an account for your database resource. If you choose to store credentials for the resource with StrongDM, have those credentials ready. When not using StrongDM, set up a Secret Store integration and be able to enter the location of the secrets required to access the resource.
- The hostname or endpoint you enter for your resource must be accessible by at least one gateway or relay. To verify this, log in to the gateway or relay and use the
nc -zv <YOUR_HOSTNAME> <YOUR_PORT>Netcat command. For example, usenc -zv testdb-01.fancy.org 5432. If your gateway server can connect to this hostname, you can proceed.
Netcat is a network analysis tool for checking various hostnames and ports by either sending data (a ping) or checking for listeners on ports. The command in the aforementioned example uses the
-z flag to check for listeners without sending data and the -v flag to show verbose output. If you do not have Netcat, you can use a package manager such as APT (Advanced Package Tool) to install it. On Linux-based distributions, run apt-get install netcat.Add a Datasource
To add your ClickHouse database as a StrongDM datasource, use the following steps.
- Log in to the Admin UI.
- Go to Resources > Datasources.
- Click Add datasource.
- For Datasource Type, select ClickHouse (HTTP), ClickHouse (MySQL), ClickHouse (TCP), or PostgreSQL. Make your selection based on the desired protocol to use to connect to ClickHouse.
- Set the configuration properties for ClickHouse (HTTP), ClickHouse (MySQL), ClickHouse (TCP), or PostgreSQL.
- Click Create to save the resource.
- Click the resource name to view status, diagnostic information, and setting details.
ClickHouse (HTTP) resource properties
Configuration properties are visible when you add a datasource or when you click to view its settings. The following table describes the settings available for the ClickHouse (HTTP) datasource type.
Both HTTP and HTTPS are supported. For HTTP, the default port value is 8123. For HTTPS, the default port value is 8443.
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Datasource Type | Required | Select Clickhouse (HTTP) |
| Bind Interface | Read only | Automatically generated IP address value in the 127.0.0.1 to 127.255.255.254 IP address range; default is 127.0.0.1; preferred bind interface value can be modified later under Settings > Port Overrides |
| Port Override | Read only | Automatically generated with a value between 1024-59999 as long as that port is not used by another resource; preferred port can be modified later under Settings > Port Overrides |
| Database | Optional | Database name you would like to connect to using this datasource |
| Secret Store | Optional | Credential store location; defaults to Strong Vault; learn more about Secret Store options |
| Username | Required | Username to utilize when connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Password | Required | Password for the user connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Username (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| Password (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| Base URL | Required | Base address of the database without the path (for example, https://www.example.com) |
| Resource Tags | Optional | Datasource tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
ClickHouse (MySQL) resource properties
Configuration properties are visible when you add a datasource or when you click to view its settings. The following table describes the settings available for the ClickHouse (MySQL) datasource type.
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Datasource Type | Required | Select ClickHouse (MySQL) |
| Hostname | Required | Hostname for your ClickHouse (MySQL) database resource; must be accessible to a gateway or relay |
| Port | Required | Port to use when connecting to your ClickHouse (MySQL) database; default port value is 9004 |
| Bind Interface | Read only | Automatically generated IP address value in the 127.0.0.1 to 127.255.255.254 IP address range; default is 127.0.0.1; preferred bind interface value can be modified later under Settings > Port Overrides |
| Port Override | Read only | Automatically generated with a value between 1024-59999 as long as that port is not used by another resource; preferred port can be modified later under Settings > Port Overrides |
| Healthcheck Database | Optional | Database used exclusively for healthchecks; note that the database sent by clients is respected otherwise |
| Secret Store | Optional | Credential store location; defaults to Strong Vault; learn more about Secret Store options |
| Username | Required | Username to utilize when connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Password | Required | Password for the user connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Username (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| Password (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| Require Native Password Authentication | Optional | If the resource requires the use of mysql_native_password for all connections, enable this option; this option is available for backwards compatibility with prior MySQL versions |
| Resource Tags | Optional | Datasource tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
ClickHouse (TCP) resource properties
Configuration properties are visible when you add a datasource or when you click to view its settings. The following table describes the settings available for the ClickHouse (TCP) datasource type.
The ClickHouse (TCP) datasource type supports ClickHouse server versions 24.1.0 to 24.1.3 and versions 24.2 to 24.10.
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Datasource Type | Required | Select ClickHouse (TCP) |
| Hostname | Required | Hostname for your ClickHouse (TCP) database resource; must be accessible to a gateway or relay |
| Port | Required | Port to use when connecting to your ClickHouse (TCP) database; default port value for TCP is 9000; default port value for TCP with TLS is 9440 |
| Bind Interface | Read only | Automatically generated IP address value in the 127.0.0.1 to 127.255.255.254 IP address range; default is 127.0.0.1; preferred bind interface value can be modified later under Settings > Port Overrides |
| Port Override | Read only | Automatically generated with a value between 1024-59999 as long as that port is not used by another resource; preferred port can be modified later under Settings > Port Overrides |
| Database | Optional | Database name you would like to connect to using this datasource |
| Secret Store | Optional | Credential store location; defaults to Strong Vault; learn more about Secret Store options |
| Username | Required | Username to utilize when connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Password | Required | Password for the user connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Username (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| Password (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| TLS Required | Optional | When selected, requires TLS for connections to this resource |
| Resource Tags | Optional | Datasource tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
PostgreSQL (for ClickHouse) resource properties
To allow users to use Postgres clients to connect to ClickHouse, select PostgreSQL as the Datasource Type and set all required properties. For your convenience, the PostgreSQL resource properties are pasted here.
The PostgreSQL protocol only supports plaintext passwords. The plaintext password type must be configured on the ClickHouse server in order for the Postgres protocol to work.
| Property | Requirement | Description |
|---|---|---|
| Display Name | Required | Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >) |
| Datasource Type | Required | Select PostgreSQL |
| Hostname | Required | Hostname for the resource; must be accessible to a gateway or relay |
| Port | Required | Port to use when connecting to the resource; default port value is 9005 |
| Bind Interface | Read only | Automatically generated IP address value in the 127.0.0.1 to 127.255.255.254 IP address range; default is 127.0.0.1; preferred bind interface value can be modified later under Settings > Port Overrides |
| Port Override | Read only | Automatically generated with a value between 1024-59999 as long as that port is not used by another resource; preferred port can be modified later under Settings > Port Overrides |
| Database | Required | Database name you would like to connect to using this datasource |
| Secret Store | Optional | Credential store location; defaults to Strong Vault; learn more about Secret Store options |
| Username | Required | Username to utilize when connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Password | Required | Password for the user connecting to this datasource; displays when Secret Store integration is not configured for your organization or when StrongDM serves as the Secret Store type |
| Username (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| Password (path) | Required | Path to the secret in your Secret Store location (for example, path/to/credential?key=optionalKeyName where key argument is optional); required when using a non-StrongDM Secret Store type |
| Override Database | Optional | By default, StrongDM will limit all connections to the configured PostgreSQL database; uncheck the box to disable this option |
| Resource Tags | Optional | Datasource tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev) |
Secret Store options
By default, datasource credentials are stored in StrongDM. However, these credentials can also be saved in a secrets management tool.
Non-StrongDM options appear in the Secret Store dropdown if they are created under Network > Secret Stores. When you select another Secret Store type, its unique properties display. For more details, see Configure Secret Store Integrations.
Resource status
After a resource is created, the Admin UI displays that resource as unhealthy until the health checks run successfully. When the resource is ready, the Health icon indicates a positive, green status.
When the resource does not display a positive status, click the resource name to go to the Diagnostics tab and check for errors.