| account.hashedPassword | string | "" | A base64 encoded sha256 hash of password of the default (admin) user. Either hashedPassword or password must be given, but not both. See Generating a Password. |
| account.password | string | "" | The plain-text password of the default (admin) user. Either hashedPassword or password must be given, but not both. |
| account.profile | object | {} | Specify user profile settings for the default (admin) user. |
| account.username | string | "default" | The default (admin) username |
| annotations | object | {} | Additional annotations to include on the clickhousecluster CR. |
| backupConfiguration.s3.bucketName | string | "" | The S3 bucket name for backups. When set together with endpoint, backups use this S3 location instead of the main server.storage.s3 bucket. This allows backing up to a different bucket or region. |
| backupConfiguration.s3.endpoint | string | "" | The object storage endpoint for backups (e.g. https://s3.eu-west-1.amazonaws.com). |
| backupConfiguration.s3.keyPrefix | string | "" | The S3 key prefix for backup data. |
| backupConfiguration.s3.region | string | "" | The region of the backup S3 bucket. |
| backupConfiguration.s3.type | string | "s3" | The object storage type for backups. |
| baseConfiguration.cloud | string | "aws" | Cloud provider for this deployment. Determines which base configuration is loaded. |
| createCluster | bool | true | Whether or not to create a clickhousecluster CR. You can set this to false to just install auxiliary resources that can be shared across ClickHouse clusters, such as CRDs and storage classes. |
| featureFlags.disableMetadataPersistentVolumes | bool | true | Makes servers stateless by enabling the DatabaseDisk for system tables and disabling persistent storage volumes. Requires enableSharedCatalog to be true. Enabled by default for new installations. |
| featureFlags.enableSharedCatalog | bool | true | Enables the Shared Catalog database engine. Enabled by default for new installations. For instances migrating from Database Replicated, see the migration guide for additional steps. |
| featureFlags.migrateToSharedCatalog | bool | false | Enables migration to the Shared Catalog database engine. This is needed for instances previously on the Replicated database engine. For new instances this can be ignored. |
| featureFlags.plainRewritableDiskForSystemTables | bool | true | Stores system tables (query_log, trace_log, etc.) on a dedicated plain rewritable object storage disk instead of the default S3 disk. This isolates system table I/O from user data and uses per-pod object storage paths that avoid cross-replica metadata overhead. |
| imagePullSecrets | list | [] | List of image pull secrets for clickhouse-keeper and clickhouse-server pods. |
| isOnPremiseInstance | bool | false | Whether this is an on-premise instance. When set to true, server.storage.s3.region becomes optional, allowing deployment against S3-compatible storage (e.g., MinIO) that does not require a region. Defaults to false. |
| keeper.additionalEnvVars | list | [] | Set custom env var values on clickhouse-keeper. See corev1.EnvVar. Note: This field is only supported from operator version 1.16067.1 or greater. |
| keeper.annotations | object | {} | Additional annotations to include on the clickhouse-keeper pods. |
| keeper.arm64 | bool | true | Whether or not clickhouse-keeper is preferred to run on arm64. See the arm64 section for details. |
| keeper.config | object | {} | Overrides for the default clickhouse-keeper configurations. |
| keeper.image.repository | string | "" | The docker repository that hosts the clickhouse-keeper image. |
| keeper.image.tag | string | nil | The docker image tag to deploy for clickhouse-keeper. |
| keeper.loggerConfig.jsonLogs | bool | false | Whether or not clickhouse-keeper will log in JSON format. |
| keeper.loggerConfig.loggerLevel | string | "trace" | The logging level of clickhouse-keeper. |
| keeper.openSSL.enabled | bool | false | Enables openSSL settings for clickhouse-keeper. See the OpenSSL section for more details. |
| keeper.openSSL.required | bool | false | Require TLS connections in clickhouse-keeper. See the OpenSSL section for more details. |
| keeper.openSSL.secret.caKey | string | "ca.crt" | The key in the secret that contains the CA certificate. Defaults to ca.crt. |
| keeper.openSSL.secret.certKey | string | "keeper.crt" | The key in the secret that contains the keeper certificate (public key). Defaults to tls.crt. |
| keeper.openSSL.secret.keyKey | string | "keeper.key" | The key in the secret that contains the keeper private key. Defaults to tls.key. |
| keeper.openSSL.secret.name | string | "" | The name of the Kubernetes secret containing the TLS certificates for clickhouse-keeper. Defaults to ${CLUSTER_NAME}-keeper-cert-secret. See the OpenSSL section for more details. |
| keeper.podPolicy.nodeSelector.clickhouseGroup | string | "keeper" | This value must match the node labels of the keeper node group excluding the -arm64 suffix, if using arm64. |
| keeper.podPolicy.resources | object | {} | Memory and CPU limits and requests for the clickhouse-keeper pods. |
| keeper.replicaCount | int | 3 | The number of clickhouse-keeper replicas to provision. It is not recommended to change this value as clickhouse-keeper relies on a quorum. Can be set to 0 for child instances, which share the parent cluster’s Keeper ensemble. |
| keeper.storage.resources.requests | string | "10Gi" | Size of (EBS) disk to provision per clickhouse-keeper replica. |
| keeper.storage.storageClassName | string | "" | Override the storage class for clickhouse-keeper disks. When empty, the default for the selected cloud is used (gp3-encrypted for AWS and premium-rwo for GCP). |
| keeper.tolerations | list | [] | Set to add tolerations to clickhouse-keeper pods. See Taints and Tolerations. |
| loadBalancer.hostname | string | "" | Set to public hostname, if one is needed. Required if loadBalancer.type is not none. |
| loadBalancer.type | string | "none" | Type of loadbalancer being used. Can be public, internal, or none. |
| name | string | "" | Overrides name of the cluster. By default the Helm release name is used. Must match ^[a-z]+-[a-z]{2}-[0-9]{2}$ (e.g. default-eu-01). |
| resourceQuota.enabled | bool | true | Whether or not to create a ResourceQuota limiting the namespace to a single ClickHouseCluster. The operator assumes one ClickHouseCluster per namespace; this quota enforces it at the API server level. Deploying multiple ClickHouseClusters in the same namespace WILL lead to issues. |
| server.additionalConfigConstraints | list | [] | Set additional server config constraints. |
| server.additionalEnvVars | list | [] | Set custom env var values on clickhouse-server. See corev1.EnvVar. |
| server.annotations | object | {} | Additional annotations to include on the clickhouse-server pods. |
| server.arm64 | bool | true | Whether or not clickhouse-server is preferred to run on arm64. See the arm64 section for details. |
| server.config | object | {} | Overrides for the default clickhouse-server configurations. Configure remote_servers here to use the Distributed table engine or cluster table function. |
| server.excludeConfigConstraints | list | [] | Remove specific additional server config constraints. |
| server.image.repository | string | "" | The docker repository that hosts the clickhouse-server image. |
| server.image.tag | string | nil | The docker image tag to deploy for clickhouse-server. This corresponds to the version of ClickHouse in the image. |
| server.loggerConfig.jsonLogs | bool | false | Whether or not clickhouse-server will log in JSON format. |
| server.loggerConfig.loggerLevel | string | "trace" | The logging level of clickhouse-server. |
| server.openSSL.enabled | bool | false | Enables openSSL settings for clickhouse-server. See the OpenSSL section for more details. |
| server.openSSL.required | bool | false | Require TLS connections in clickhouse-server. See the OpenSSL section for more details. |
| server.openSSL.secret.caKey | string | "ca.crt" | The key in the secret that contains the CA certificate. Defaults to ca.crt. |
| server.openSSL.secret.certKey | string | "server.crt" | The key in the secret that contains the server certificate (public key). Defaults to tls.crt. |
| server.openSSL.secret.keyKey | string | "server.key" | The key in the secret that contains the server private key. Defaults to tls.key. |
| server.openSSL.secret.name | string | "" | The name of the Kubernetes secret containing the TLS certificates for clickhouse-server. Defaults to ${CLUSTER_NAME}-server-cert-secret. See the OpenSSL section for more details. |
| server.podPolicy.nodeSelector.clickhouseGroup | string | "server" | This value must match the node labels of the server node group excluding the -arm64 suffix, if using arm64. |
| server.podPolicy.resources | object | {} | Memory and CPU limits and requests for the clickhouse-server pods. |
| server.prometheus.user.create | bool | true | Whether or not to create the user that should be used for scraping custom Prometheus metrics. |
| server.prometheus.user.password | string | "" | The plain-text password of the user that should be used for scraping custom Prometheus metrics. |
| server.prometheus.user.username | string | "prometheus-internal" | The username of the user that should be used for scraping custom Prometheus metrics. |
| server.replicaCount | int | 3 | The number of clickhouse-server replicas to provision. Should be a minimum of 3 for high-availability. |
| server.ssdCacheConfiguration.bytesPerGiRAM | string | "0" | Calculates the size of the cache disk based on pod resources. Not used if cacheDiskSize is set. This value changes based on instance type so please choose carefully. If unsure what value to use, just use cacheDiskSize. |
| server.ssdCacheConfiguration.cacheDiskSize | string | "" | The size of the cache disk. Takes precedence over bytesPerGiRAM. Set this value to 80-90% of the SSD cache disk size if you are unsure what value to use for bytesPerGiRAM. |
| server.ssdCacheConfiguration.hostPathBaseDirectory | string | "" | Override the host path base directory for SSD cache. Only used when isOnEmptyDir is false. When empty, the operator applies its own default (/nvme/disk/). Setting this field makes the pair (hostPathBaseDirectory, isOnEmptyDir) authoritative: the per-cloud base configuration’s values for both are discarded, so a GCP base default of isOnEmptyDir: true cannot silently shadow a customer-provided host path. |
| server.ssdCacheConfiguration.isOnEmptyDir | string | nil | Override whether the SSD cache uses an emptyDir volume. GKE natively supports SSDs as ephemeral storage, so the GCP base configuration sets this to true. When null, the default for the selected cloud is used. Setting this field (to true or false) makes the pair (hostPathBaseDirectory, isOnEmptyDir) authoritative: the per-cloud base configuration’s values for both are discarded. |
| server.storage.resources.requests | string | "30Gi" | Size of (EBS) disk to provision per clickhouse-server replica. |
| server.storage.s3.bucketName | string | "" | The s3 bucket name where the service data will be stored. This bucket should be in the same region as the ClickHouse cluster. This bucket can be used by multiple ClickHouse clusters. |
| server.storage.s3.endpoint | string | "" | The object storage endpoint (e.g. https://s3.us-west-2.amazonaws.com). Defaults to the us-west-2 regional S3 endpoint when baseConfiguration.cloud is aws, and to https://storage.googleapis.com when it is gcp; must be set explicitly for Azure. |
| server.storage.s3.keyPrefix | string | "" | The s3 key prefix for data stored by this ClickHouse cluster in the s3 bucket. This must be unique across all ClickHouse clusters sharing the same s3 bucket and must be in the format ch-s3-{uuid}. Must be left empty when baseConfiguration.cloud is azure. |
| server.storage.s3.region | string | "" | The region of the bucket. Defaults to us-west-2 when baseConfiguration.cloud is aws and to auto when it is gcp; must be set explicitly for Azure (or set isOnPremiseInstance: true to omit it from the rendered CRD). |
| server.storage.storageClassName | string | "" | Override the storage class for clickhouse-server disks. When empty, the default for the selected cloud is used (gp3-encrypted for AWS and standard-rwo for GCP). |
| server.tolerations | list | [] | Set to add tolerations to clickhouse-server pods. See Taints and Tolerations. |
| server.useAzureWorkloadIdentity | bool | true | When baseConfiguration.cloud is azure, adds the azure.workload.identity/use: "true" pod label so Azure AD workload identity is enabled on clickhouse-server pods. Ignored for aws/gcp. Set to false to opt out. |
| server.useCustomReplicaRules | bool | false | Defaults to false to use AdditionalEnvVars on the ClickhouseCluster CRD for setting server environment variables. Enable to allow setting of environment variables through custom replica rules if the operator version is below 1.12213.1. Note that custom environment variables on this version of the operator can cause issues with scale-in operations, so it is recommended to upgrade. |
| server.users.profiles | object | {} | Override default user profile settings for ClickHouse users. Settings are merged with base configuration. Some settings may be restricted by config constraints. To allow certain settings, add them to server.additionalConfigConstraints. Example: server.users.profiles.default.allow_experimental_full_text_index: true. |
| serviceAccount.annotations | object | {} | Annotations to include on the service account. It is highly recommended to use IRSA. See IAM Roles for Service Accounts for details. |
| serviceAccount.create | bool | true | Whether or not to create the service account used by clickhouse-server. Each ClickHouse cluster deployment should use their own service account. |
| serviceAccount.name | string | "" | Overrides name of the service account. If no name is provided, it will generate one from the cluster name. |
| storageClass.allowedTopologies | list | [] | Topology restrictions for dynamic provisioning. Used to constrain which zones/regions volumes can be provisioned in. See Kubernetes StorageClass allowedTopologies. |
| storageClass.annotations | object | {} | Annotations to include on the generated storage class. Rendered only when non-empty. |
| storageClass.create | bool | false | Whether or not to create a storage class that both server and keeper will use. If using some custom storage class, this can be disabled. |
| storageClass.labels | object | {} | Extra labels merged over the common chart labels on the generated storage class. |
| storageClass.name | string | "" | Name of the generated storage class. When empty, the cloud default is used (gp3-encrypted for AWS, premium-ssd-v2 for Azure). No default exists for GCP; a GCP deployment with create: true must set this explicitly. |
| storageClass.parameters | object | {} | Provisioner parameters passed to the CSI driver. When empty, the cloud default is used (AWS: encrypted: "true", fstype: ext4, type: gp3; Azure: cachingMode: None, fstype: ext4, skuName: PremiumV2_LRS). If set, this map fully replaces the cloud default (specify every key). No default exists for GCP. |
| storageClass.provisioner | string | "" | CSI provisioner. When empty, the cloud default is used (ebs.csi.aws.com for AWS, disk.csi.azure.com for Azure). No default exists for GCP; a GCP deployment with create: true must set this explicitly. |
