Helm Chart Values | ClickHouse Docs

Reference for the configurable values of the Helm charts used to deploy ClickHouse Private.

onprem-clickhouse-cluster

Values for the chart that deploys a ClickHouse cluster, version 1.8.7. Set them with --set or a values file when running helm install/helm upgrade.

Key	Type	Default	Description
account.hashedPassword	string	`""`	A base64 encoded sha256 hash of password of the default (admin) user. Either `hashedPassword` or `password` must be given, but not both. See Generating a Password.
account.password	string	`""`	The plain-text password of the default (admin) user. Either `hashedPassword` or `password` must be given, but not both.
account.profile	object	`{}`	Specify user profile settings for the default (admin) user.
account.username	string	`"default"`	The default (admin) username
annotations	object	`{}`	Additional annotations to include on the clickhousecluster CR.
backupConfiguration.s3.bucketName	string	`""`	The S3 bucket name for backups. When set together with `endpoint`, backups use this S3 location instead of the main `server.storage.s3` bucket. This allows backing up to a different bucket or region.
backupConfiguration.s3.endpoint	string	`""`	The object storage endpoint for backups (e.g. `https://s3.eu-west-1.amazonaws.com`).
backupConfiguration.s3.keyPrefix	string	`""`	The S3 key prefix for backup data.
backupConfiguration.s3.region	string	`""`	The region of the backup S3 bucket.
backupConfiguration.s3.type	string	`"s3"`	The object storage type for backups.
baseConfiguration.cloud	string	`"aws"`	Cloud provider for this deployment. Determines which base configuration is loaded.
createCluster	bool	`true`	Whether or not to create a clickhousecluster CR. You can set this to false to just install auxiliary resources that can be shared across ClickHouse clusters, such as CRDs and storage classes.
featureFlags.disableMetadataPersistentVolumes	bool	`true`	Makes servers stateless by enabling the DatabaseDisk for system tables and disabling persistent storage volumes. Requires `enableSharedCatalog` to be `true`. Enabled by default for new installations.
featureFlags.enableSharedCatalog	bool	`true`	Enables the Shared Catalog database engine. Enabled by default for new installations. For instances migrating from Database Replicated, see the migration guide for additional steps.
featureFlags.migrateToSharedCatalog	bool	`false`	Enables migration to the Shared Catalog database engine. This is needed for instances previously on the Replicated database engine. For new instances this can be ignored.
featureFlags.plainRewritableDiskForSystemTables	bool	`true`	Stores system tables (query_log, trace_log, etc.) on a dedicated plain rewritable object storage disk instead of the default S3 disk. This isolates system table I/O from user data and uses per-pod object storage paths that avoid cross-replica metadata overhead.
imagePullSecrets	list	`[]`	List of image pull secrets for `clickhouse-keeper` and `clickhouse-server` pods.
isOnPremiseInstance	bool	`false`	Whether this is an on-premise instance. When set to `true`, `server.storage.s3.region` becomes optional, allowing deployment against S3-compatible storage (e.g., MinIO) that does not require a region. Defaults to `false`.
keeper.additionalEnvVars	list	`[]`	Set custom env var values on `clickhouse-keeper`. See `corev1.EnvVar`. Note: This field is only supported from operator version `1.16067.1` or greater.
keeper.annotations	object	`{}`	Additional annotations to include on the `clickhouse-keeper` pods.
keeper.arm64	bool	`true`	Whether or not `clickhouse-keeper` is preferred to run on arm64. See the arm64 section for details.
keeper.config	object	`{}`	Overrides for the default `clickhouse-keeper` configurations.
keeper.image.repository	string	`""`	The docker repository that hosts the `clickhouse-keeper` image.
keeper.image.tag	string	`nil`	The docker image tag to deploy for `clickhouse-keeper`. Leave unset to deploy the tested and validated version pinned by this chart release; set it only to deviate from that version, or to select a `-fips` build.
keeper.loggerConfig.jsonLogs	bool	`false`	Whether or not `clickhouse-keeper` will log in JSON format.
keeper.loggerConfig.loggerLevel	string	`"trace"`	The logging level of `clickhouse-keeper`.
keeper.openSSL.enabled	bool	`false`	Enables openSSL settings for `clickhouse-keeper`. See the OpenSSL section for more details.
keeper.openSSL.required	bool	`false`	Require TLS connections in `clickhouse-keeper`. See the OpenSSL section for more details.
keeper.openSSL.secret.caKey	string	`"ca.crt"`	The key in the secret that contains the CA certificate. Defaults to `ca.crt`.
keeper.openSSL.secret.certKey	string	`"keeper.crt"`	The key in the secret that contains the keeper certificate (public key). Defaults to `tls.crt`.
keeper.openSSL.secret.keyKey	string	`"keeper.key"`	The key in the secret that contains the keeper private key. Defaults to `tls.key`.
keeper.openSSL.secret.name	string	`""`	The name of the Kubernetes secret containing the TLS certificates for `clickhouse-keeper`. Defaults to `${CLUSTER_NAME}-keeper-cert-secret`. See the OpenSSL section for more details.
keeper.podPolicy.nodeSelector.clickhouseGroup	string	`"keeper"`	This value must match the node labels of the keeper node group excluding the `-arm64` suffix, if using arm64.
keeper.podPolicy.resources	object	`{}`	Memory and CPU limits and requests for the `clickhouse-keeper` pods.
keeper.replicaCount	int	`3`	The number of `clickhouse-keeper` replicas to provision. It is not recommended to change this value as `clickhouse-keeper` relies on a quorum. Can be set to `0` for child instances, which share the parent cluster’s Keeper ensemble.
keeper.storage.resources.requests	string	`"10Gi"`	Size of (EBS) disk to provision per `clickhouse-keeper` replica.
keeper.storage.storageClassName	string	`""`	Override the storage class for `clickhouse-keeper` disks. When empty, the default for the selected cloud is used (`gp3-encrypted` for AWS and `premium-rwo` for GCP).
keeper.tolerations	list	`[]`	Set to add tolerations to `clickhouse-keeper` pods. See Taints and Tolerations.
loadBalancer.hostname	string	`""`	Set to public hostname, if one is needed. Required if `loadBalancer.type` is not `none`.
loadBalancer.type	string	`"none"`	Type of loadbalancer being used. Can be `public`, `internal`, or `none`.
name	string	`""`	Overrides name of the cluster. By default the Helm release name is used. Must match `^[a-z]+-[a-z]{2}-[0-9]{2}$` (e.g. `default-eu-01`).
resourceQuota.enabled	bool	`true`	Whether or not to create a ResourceQuota limiting the namespace to a single ClickHouseCluster. The operator assumes one ClickHouseCluster per namespace; this quota enforces it at the API server level. Deploying multiple ClickHouseClusters in the same namespace WILL lead to issues.
server.additionalConfigConstraints	list	`[]`	Set additional server config constraints.
server.additionalEnvVars	list	`[]`	Set custom env var values on `clickhouse-server`. See `corev1.EnvVar`.
server.annotations	object	`{}`	Additional annotations to include on the `clickhouse-server` pods.
server.arm64	bool	`true`	Whether or not `clickhouse-server` is preferred to run on arm64. See the arm64 section for details.
server.config	object	`{}`	Overrides for the default `clickhouse-server` configurations. Configure `remote_servers` here to use the Distributed table engine or cluster table function.
server.excludeConfigConstraints	list	`[]`	Remove specific additional server config constraints.
server.image.repository	string	`""`	The docker repository that hosts the `clickhouse-server` image.
server.image.tag	string	`nil`	The docker image tag to deploy for `clickhouse-server`, corresponding to the version of ClickHouse in the image. Leave unset to deploy the tested and validated version pinned by this chart release; set it only to deviate from that version, or to select a `-fips` build.
server.loggerConfig.jsonLogs	bool	`false`	Whether or not `clickhouse-server` will log in JSON format.
server.loggerConfig.loggerLevel	string	`"trace"`	The logging level of `clickhouse-server`.
server.openSSL.enabled	bool	`false`	Enables openSSL settings for `clickhouse-server`. See the OpenSSL section for more details.
server.openSSL.required	bool	`false`	Require TLS connections in `clickhouse-server`. See the OpenSSL section for more details.
server.openSSL.secret.caKey	string	`"ca.crt"`	The key in the secret that contains the CA certificate. Defaults to `ca.crt`.
server.openSSL.secret.certKey	string	`"server.crt"`	The key in the secret that contains the server certificate (public key). Defaults to `tls.crt`.
server.openSSL.secret.keyKey	string	`"server.key"`	The key in the secret that contains the server private key. Defaults to `tls.key`.
server.openSSL.secret.name	string	`""`	The name of the Kubernetes secret containing the TLS certificates for `clickhouse-server`. Defaults to `${CLUSTER_NAME}-server-cert-secret`. See the OpenSSL section for more details.
server.podPolicy.nodeSelector.clickhouseGroup	string	`"server"`	This value must match the node labels of the server node group excluding the `-arm64` suffix, if using arm64.
server.podPolicy.resources	object	`{}`	Memory and CPU limits and requests for the `clickhouse-server` pods.
server.prometheus.user.create	bool	`true`	Whether or not to create the user that should be used for scraping custom Prometheus metrics.
server.prometheus.user.password	string	`""`	The plain-text password of the user that should be used for scraping custom Prometheus metrics.
server.prometheus.user.username	string	`"prometheus-internal"`	The username of the user that should be used for scraping custom Prometheus metrics.
server.replicaCount	int	`3`	The number of `clickhouse-server` replicas to provision. Should be a minimum of 3 for high-availability.
server.ssdCacheConfiguration.bytesPerGiRAM	string	`"0"`	Calculates the size of the cache disk based on pod resources. Not used if `cacheDiskSize` is set. This value changes based on instance type so please choose carefully. If unsure what value to use, just use `cacheDiskSize`.
server.ssdCacheConfiguration.cacheDiskSize	string	`""`	The size of the cache disk. Takes precedence over `bytesPerGiRAM`. Set this value to 80-90% of the SSD cache disk size if you are unsure what value to use for `bytesPerGiRAM`.
server.ssdCacheConfiguration.hostPathBaseDirectory	string	`""`	Override the host path base directory for SSD cache. Only used when `isOnEmptyDir` is false. When empty, the operator applies its own default (`/nvme/disk/`). Setting this field makes the pair (`hostPathBaseDirectory`, `isOnEmptyDir`) authoritative: the per-cloud base configuration’s values for both are discarded, so a GCP base default of `isOnEmptyDir: true` cannot silently shadow a customer-provided host path.
server.ssdCacheConfiguration.isOnEmptyDir	string	`nil`	Override whether the SSD cache uses an emptyDir volume. GKE natively supports SSDs as ephemeral storage, so the GCP base configuration sets this to true. When null, the default for the selected cloud is used. Setting this field (to `true` or `false`) makes the pair (`hostPathBaseDirectory`, `isOnEmptyDir`) authoritative: the per-cloud base configuration’s values for both are discarded.
server.storage.resources.requests	string	`"30Gi"`	Size of (EBS) disk to provision per `clickhouse-server` replica.
server.storage.s3.bucketName	string	`""`	The s3 bucket name where the service data will be stored. This bucket should be in the same region as the ClickHouse cluster. This bucket can be used by multiple ClickHouse clusters.
server.storage.s3.endpoint	string	`""`	The object storage endpoint (e.g. `https://s3.us-west-2.amazonaws.com`). Defaults to the `us-west-2` regional S3 endpoint when `baseConfiguration.cloud` is `aws`, and to `https://storage.googleapis.com` when it is `gcp`; must be set explicitly for Azure.
server.storage.s3.keyPrefix	string	`""`	The s3 key prefix for data stored by this ClickHouse cluster in the s3 bucket. This must be unique across all ClickHouse clusters sharing the same s3 bucket and must be in the format `ch-s3-{uuid}`. Must be left empty when `baseConfiguration.cloud` is `azure`.
server.storage.s3.region	string	`""`	The region of the bucket. Defaults to `us-west-2` when `baseConfiguration.cloud` is `aws` and to `auto` when it is `gcp`; must be set explicitly for Azure (or set `isOnPremiseInstance: true` to omit it from the rendered CRD).
server.storage.storageClassName	string	`""`	Override the storage class for `clickhouse-server` disks. When empty, the default for the selected cloud is used (`gp3-encrypted` for AWS and `standard-rwo` for GCP).
server.tolerations	list	`[]`	Set to add tolerations to `clickhouse-server` pods. See Taints and Tolerations.
server.useAzureWorkloadIdentity	bool	`true`	When `baseConfiguration.cloud` is `azure`, adds the `azure.workload.identity/use: "true"` pod label so Azure AD workload identity is enabled on `clickhouse-server` pods. Ignored for aws/gcp. Set to `false` to opt out.
server.useCustomReplicaRules	bool	`false`	Defaults to false to use AdditionalEnvVars on the ClickhouseCluster CRD for setting server environment variables. Enable to allow setting of environment variables through custom replica rules if the operator version is below `1.12213.1`. Note that custom environment variables on this version of the operator can cause issues with scale-in operations, so it is recommended to upgrade.
server.users.profiles	object	`{}`	Override default user profile settings for ClickHouse users. Settings are merged with base configuration. Some settings may be restricted by config constraints. To allow certain settings, add them to `server.additionalConfigConstraints`. Example: `server.users.profiles.default.allow_experimental_full_text_index: true`.
serviceAccount.annotations	object	`{}`	Annotations to include on the service account. It is highly recommended to use IRSA. See IAM Roles for Service Accounts for details.
serviceAccount.create	bool	`true`	Whether or not to create the service account used by `clickhouse-server`. Each ClickHouse cluster deployment should use their own service account.
serviceAccount.name	string	`""`	Overrides name of the service account. If no name is provided, it will generate one from the cluster `name`.
storageClass.allowedTopologies	list	`[]`	Topology restrictions for dynamic provisioning. Used to constrain which zones/regions volumes can be provisioned in. See Kubernetes StorageClass allowedTopologies.
storageClass.annotations	object	`{}`	Annotations to include on the generated storage class. Rendered only when non-empty.
storageClass.create	bool	`false`	Whether or not to create a storage class that both server and keeper will use. If using some custom storage class, this can be disabled.
storageClass.labels	object	`{}`	Extra labels merged over the common chart labels on the generated storage class.
storageClass.name	string	`""`	Name of the generated storage class. When empty, the cloud default is used (`gp3-encrypted` for AWS, `premium-ssd-v2` for Azure). No default exists for GCP; a GCP deployment with `create: true` must set this explicitly.
storageClass.parameters	object	`{}`	Provisioner parameters passed to the CSI driver. When empty, the cloud default is used (AWS: `encrypted: "true"`, `fstype: ext4`, `type: gp3`; Azure: `cachingMode: None`, `fstype: ext4`, `skuName: PremiumV2_LRS`). If set, this map fully replaces the cloud default (specify every key). No default exists for GCP.
storageClass.provisioner	string	`""`	CSI provisioner. When empty, the cloud default is used (`ebs.csi.aws.com` for AWS, `disk.csi.azure.com` for Azure). No default exists for GCP; a GCP deployment with `create: true` must set this explicitly.