Managed ClickHouse Service

ClickHouse is an open source high-performance and column-oriented SQL database management system (DBMS). It is used for online analytical processing (OLAP).

Backup orchestration

Two backup paths coexist on the chart; pick one per release.

Recommended: BackupClass + Plan via the Altinity strategy

The cluster-scoped Altinity strategy (strategy.backups.cozystack.io/v1alpha1) wraps Altinity’s clickhouse-backup in a one-shot batch/v1.Job per BackupJob / RestoreJob. It is engine-aware (FREEZE + upload), supports both in-place and targetApplicationRef (to-copy) restore, and does not require any in-chart CronJob.

Wiring per release:

1. Set backup.enabled: true plus the s3* (or s3CredentialsSecret.name) fields on the chart values. The chart materialises a Secret named <release>-backup-s3 carrying bucket coordinates and credentials. That Secret is consumed by the chart-emitted clickhouse-backup sidecar (rendered into the ClickHouseInstallation Pod by templates/clickhouse.yaml); the strategy Pod itself is a curl/jq client that reaches the sidecar’s HTTP API on port 7171 and never reads the Secret directly.
2. Cluster admin one-time installs an Altinity strategy and a BackupClass that maps apps.cozystack.io/ClickHouse to it (see examples/backups/clickhouse/01-create-strategy.sh and 02-create-backupclass.sh).
3. Tenant creates a Plan (cron schedule) or submits an ad-hoc BackupJob referencing the BackupClass. Restoring is a RestoreJob referencing the resulting Backup; omit targetApplicationRef for in-place, set it to a second ClickHouse instance for to-copy.

Bringing your own S3 credentials Secret

Setting backup.s3CredentialsSecret.name makes the chart skip the materialisation of <release>-backup-s3 and points the sidecar at the referenced Secret instead. The Secret must hold the five S3 fields as separate string keys, not a JSON blob; the per-key field names default to bucketName / endpoint / region / accessKey / secretKey and can be remapped via backup.s3CredentialsSecret.{bucketKey,endpointKey,…}.

Example:

apiVersion: v1
kind: Secret
metadata:
  name: my-s3-creds
  namespace: tenant-test
type: Opaque
stringData:
  bucketName: my-clickhouse-archive
  endpoint:   https://s3.example.org
  region:     us-east-1
  accessKey:  AKIAIOSFODNN7EXAMPLE
  secretKey:  wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
---
# In ClickHouse values.yaml:
backup:
  enabled: true
  s3CredentialsSecret:
    name: my-s3-creds

The Cozystack Bucket app’s BucketInfo Secret (bucket-<name>-<user>, single BucketInfo key holding a JSON blob) is not directly consumable as s3CredentialsSecret. Either let the chart read the raw values via backup.s3* (as examples/backups/clickhouse/03-create-bucket.sh does — extract coordinates from BucketInfo and pass them to the chart values), or materialise an intermediate Secret with the five string keys above.

Legacy: chart-emitted Restic CronJob

The chart still ships a CronJob that streams per-table SHOW CREATE TABLE

• SELECT * FORMAT TabSeparated into a Restic repository. This path is kept for backward compatibility; new installations should prefer the BackupClass flow above.

To opt in:

1. Set backup.enabled: true, backup.schedule: "0 2 * * *" (or another non-empty cron), backup.s3* and backup.resticPassword.

2. To restore manually:

   restic -r s3:s3.example.org/clickhouse-backups/table_name snapshots
   restic -r s3:s3.example.org/clickhouse-backups/table_name restore latest --target /tmp/
   

   For more details, read Restic: Effective Backup from Stdin.

The legacy backup.schedule, backup.cleanupStrategy, and backup.resticPassword values are deprecated and will be removed once the Altinity strategy is the default in all reference deployments. The chart-emitted CronJob renders only when backup.schedule is non-empty.

Parameters

Common parameters

Application-specific parameters

Backup parameters

ClickHouse Keeper parameters

Parameter examples and reference

resources and resourcesPreset

resources sets explicit CPU and memory configurations for each replica. When left empty, the preset defined in resourcesPreset is applied.

resources:
  cpu: 4000m
  memory: 4Gi

resourcesPreset sets named CPU and memory configurations for each replica. This setting is ignored if the corresponding resources value is set.