Altinity Cloud Access Management

Organizations that want to enable administrative users in their Altinity.Cloud ClickHouse® servers can do so by enabling access_management manually. This allows for administrative users to be created on the specific ClickHouse Cluster.

To add the access_management setting to an Altinity.Cloud ClickHouse Cluster:

1. Log into your Altinity.Cloud account.

2. For the cluster to modify, select Configure -> Settings.

   

3. From the Settings page, select +ADD SETTING.

   

4. Set the following options:

   1. Setting Type: Select users.d file.

   2. Filename: access_management.xml

   3. Contents: Enter the following to allow the clickhouse_operator that controls the cluster through the clickhouse-operator the ability to set administrative options:

      <clickhouse>
          <users>
              <admin>
                  <access_management>1</access_management>
              </admin>
              <clickhouse_operator>
                  <access_management>1</access_management>
              </clickhouse_operator>
          </users>
      </clickhouse>
      

   access_management=1 means that users admin, clickhouse_operator are able to create users and grant them privileges using SQL.

5. Select OK. The cluster will restart, and users can now be created in the cluster that can be granted administrative access.

6. If you are running ClickHouse 21.9 and above you can enable storing access management in ZooKeeper. in this case it will be automatically propagated to the cluster. This requires yet another configuration file:

   1. Setting Type: Select config.d file

   2. Filename: user_directories.xml

   3. Contents:

      <clickhouse>
        <user_directories replace="replace">
          <users_xml>
            <path>/etc/clickhouse-server/users.xml</path>
          </users_xml>
          <replicated>
            <zookeeper_path>/clickhouse/access/</zookeeper_path>
          </replicated>
          <local_directory>
             <path>/var/lib/clickhouse/access/</path>
          </local_directory>
        </user_directories>
      </clickhouse>