Skip to content

fix: emit CH_* ClickHouse connection keys in the clickhouse chart#289

Merged
NitinKumar004 merged 4 commits into
mainfrom
feat/clickhouse-ch-env-vars
Jun 9, 2026
Merged

fix: emit CH_* ClickHouse connection keys in the clickhouse chart#289
NitinKumar004 merged 4 commits into
mainfrom
feat/clickhouse-ch-env-vars

Conversation

@NitinKumar004

@NitinKumar004 NitinKumar004 commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Description

The ClickHouse chart's per-service connection ConfigMap/Secret emitted MySQL-style DB_* keys, which the consuming service doesn't read — so an app attaching to this chart got no usable connection.

This switches them to the CH_* keys the service reads (which it combines into GoFr's ClickHouse Hosts, see gofr.dev/docs/datasources/clickhouse):

Key Location Value
CH_HOST ConfigMap <release>-clickhouse
CH_PORT ConfigMap 9000 (native TCP)
CH_USER ConfigMap provisioned user
CH_DATABASE ConfigMap the database
CH_PASSWORD Secret provisioned password

The consumer forms CH_HOST:CH_PORT as GoFr's Hosts. CH_USER lives in the ConfigMap (not sensitive); CH_PASSWORD in the Secret. Upgrade-preservation reads CH_USER from the existing ConfigMap and CH_PASSWORD from the existing Secret, so credentials stay stable across upgrades.

Chart bumped to v0.0.2, re-packaged, index regenerated.

Type of Change

  • Bug fix (connection keys didn't match the consuming service)

Testing (local minikube)

With services: [{name: aggregator, database: zopnight_aggregator}]:

init pod: Succeeded
ConfigMap: CH_HOST=ch-clickhouse  CH_PORT=9000  CH_USER=aggregator_vuzo  CH_DATABASE=zopnight_aggregator
Secret keys: CH_PASSWORD
GoFr Hosts (CH_HOST:CH_PORT): ch-clickhouse:9000
connect with CH_USER/CH_PASSWORD/CH_DATABASE -> aggregator_vuzo
helm upgrade -> CH_USER preserved, CH_PASSWORD preserved
  • helm lint passes; docs/index.yaml digest matches docs/clickhouse-v0.0.2.tgz

Checklist

  • helm lint passes
  • Verified end-to-end on a local cluster (incl. upgrade preservation)
  • README Connection Config updated

The per-service connection ConfigMap/Secret used MySQL-style DB_* keys,
which GoFr's ClickHouse datasource doesn't read, so apps couldn't connect.
Switch to the keys GoFr documents (https://gofr.dev/docs/datasources/clickhouse):

- ConfigMap: HOSTS (host:port, native 9000), USERNAME, DATABASE.
- Secret: PASSWORD, USERNAME (USERNAME kept here too so the generated
  credentials survive helm upgrade via lookup).
- README Connection Config updated; bump chart to v0.0.2 + re-index.
…name

The upgrade-preservation lookup only read the new USERNAME/PASSWORD keys,
so upgrading a release that still had the old DB_USER/DB_PASSWORD secret
keys would miss them and regenerate credentials (rotating the password and
orphaning the existing ClickHouse user). Fall back to the legacy DB_* keys
so the rename preserves existing credentials. Re-package + re-index.
@NitinKumar004

Copy link
Copy Markdown
Contributor Author

Added upgrade-safety in 560362f: the credential-preservation lookup now falls back to the legacy DB_USER/DB_PASSWORD secret keys, so upgrading an existing release across the DB_*→GoFr key rename preserves the generated user/password (no rotation, no orphaned ClickHouse user).

Verified on minikube: installed published v0.0.1 (DB_* keys) → upgraded to this v0.0.2 → same user/password preserved and the original user still authenticates (currentUser()=aggregator_l0or, currentDatabase()=zopnight_aggregator).

USERNAME is not sensitive, so it belongs in the connection ConfigMap;
the Secret now holds only PASSWORD. Upgrade-preservation reads the
username back from the existing ConfigMap and the password from the
existing Secret, so credentials stay stable across upgrades. Drops the
earlier legacy-key fallback. Re-package + re-index.
Emit the CH_* keys the consuming service reads: CH_HOST + CH_PORT (the
app combines them into GoFr's ClickHouse Hosts), CH_USER, CH_DATABASE in
the ConfigMap and CH_PASSWORD in the Secret. Upgrade-preservation reads
CH_USER from the ConfigMap and CH_PASSWORD from the Secret. README +
re-package + re-index.
@NitinKumar004 NitinKumar004 changed the title fix: emit GoFr ClickHouse connection keys in the clickhouse chart fix: emit CH_* ClickHouse connection keys in the clickhouse chart Jun 9, 2026

@arunesh-j arunesh-j left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ✅

Fixes the connection-key mismatch from v0.0.1 (emitted MySQL-style DB_* keys that the consuming ClickHouse service doesn't read):

  • ConfigMap now emits CH_HOST / CH_PORT / CH_USER / CH_DATABASE; Secret emits CH_PASSWORD. No lingering DB_* refs.
  • Upgrade-preservation is correct for the new layout: CH_USER read back from the existing ConfigMap (plaintext), CH_PASSWORD from the existing Secret (b64dec); init SQL uses the same $username/$password.
  • Object names are unchanged, so the #288 envFrom wiring keeps working.
  • helm lint passes; version bumped 0.0.1 → 0.0.2; packaging correct (docs/clickhouse-v0.0.2.tgz digest matches index.yaml: 2681560f…).

Note (non-blocking): the CH_* names are a contract with the consuming service code (outside this repo) — GoFr's public docs example uses unprefixed HOSTS/USERNAME/PASSWORD/DATABASE, so worth a final confirm that the service template reads CH_* and joins CH_HOST:CH_PORT into GoFr's Hosts.

Approving.

@NitinKumar004 NitinKumar004 merged commit 23d88a5 into main Jun 9, 2026
1 check passed
@NitinKumar004 NitinKumar004 deleted the feat/clickhouse-ch-env-vars branch June 9, 2026 06:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants