> ## Documentation Index > Fetch the complete documentation index at: https://clickhouse.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Helm Chart Values Reference for the configurable values of the Helm charts used to deploy ClickHouse Private. ## onprem-clickhouse-cluster Values for the chart that deploys a ClickHouse cluster, version `<>`. Set them with `--set` or a values file when running `helm install`/`helm upgrade`. | Key | Type | Default | Description | | -------------------------------------------------- | ------ | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | account.hashedPassword | string | `""` | A base64 encoded sha256 hash of password of the default (admin) user. Either `hashedPassword` or `password` must be given, but not both. See [Generating a Password](/docs/cloud/clickhouse-private/how-to/reset-passwords). | | account.password | string | `""` | The plain-text password of the default (admin) user. Either `hashedPassword` or `password` must be given, but not both. | | account.profile | object | `{}` | Specify [user profile settings](https://clickhouse.com/docs/en/operations/settings/settings-profiles) for the default (admin) user. | | account.username | string | `"default"` | The default (admin) username | | annotations | object | `{}` | Additional annotations to include on the clickhousecluster CR. | | backupConfiguration.s3.bucketName | string | `""` | The S3 bucket name for backups. When set together with `endpoint`, backups use this S3 location instead of the main `server.storage.s3` bucket. This allows backing up to a different bucket or region. | | backupConfiguration.s3.endpoint | string | `""` | The object storage endpoint for backups (e.g. `https://s3.eu-west-1.amazonaws.com`). | | backupConfiguration.s3.keyPrefix | string | `""` | The S3 key prefix for backup data. | | backupConfiguration.s3.region | string | `""` | The region of the backup S3 bucket. | | backupConfiguration.s3.type | string | `"s3"` | The object storage type for backups. | | baseConfiguration.cloud | string | `"aws"` | Cloud provider for this deployment. Determines which base configuration is loaded. | | createCluster | bool | `true` | Whether or not to create a clickhousecluster CR. You can set this to false to just install auxiliary resources that can be shared across ClickHouse clusters, such as CRDs and storage classes. | | featureFlags.disableMetadataPersistentVolumes | bool | `true` | Makes servers stateless by enabling the DatabaseDisk for system tables and disabling persistent storage volumes. Requires `enableSharedCatalog` to be `true`. Enabled by default for new installations. | | featureFlags.enableSharedCatalog | bool | `true` | Enables the Shared Catalog database engine. Enabled by default for new installations. For instances migrating from Database Replicated, see the migration guide for additional steps. | | featureFlags.migrateToSharedCatalog | bool | `false` | Enables migration to the Shared Catalog database engine. This is needed for instances previously on the Replicated database engine. For new instances this can be ignored. | | featureFlags.plainRewritableDiskForSystemTables | bool | `true` | Stores system tables (query\_log, trace\_log, etc.) on a dedicated plain rewritable object storage disk instead of the default S3 disk. This isolates system table I/O from user data and uses per-pod object storage paths that avoid cross-replica metadata overhead. | | imagePullSecrets | list | `[]` | List of image pull secrets for `clickhouse-keeper` and `clickhouse-server` pods. | | isOnPremiseInstance | bool | `false` | Whether this is an on-premise instance. When set to `true`, `server.storage.s3.region` becomes optional, allowing deployment against S3-compatible storage (e.g., MinIO) that does not require a region. Defaults to `false`. | | keeper.additionalEnvVars | list | `[]` | Set custom env var values on `clickhouse-keeper`. See [`corev1.EnvVar`](https://pkg.go.dev/k8s.io/api/core/v1#EnvVar). **Note: This field is only supported from operator version `1.16067.1` or greater.** | | keeper.annotations | object | `{}` | Additional annotations to include on the `clickhouse-keeper` pods. | | keeper.arm64 | bool | `true` | Whether or not `clickhouse-keeper` is preferred to run on arm64. See the [arm64](/docs/cloud/clickhouse-private/reference/infrastructure-requirements) section for details. | | keeper.config | object | `{}` | Overrides for the default `clickhouse-keeper` configurations. | | keeper.image.repository | string | `""` | The docker repository that hosts the `clickhouse-keeper` image. | | keeper.image.tag | string | `nil` | The docker image tag to deploy for `clickhouse-keeper`. | | keeper.loggerConfig.jsonLogs | bool | `false` | Whether or not `clickhouse-keeper` will log in JSON format. | | keeper.loggerConfig.loggerLevel | string | `"trace"` | The logging level of `clickhouse-keeper`. | | keeper.openSSL.enabled | bool | `false` | Enables openSSL settings for `clickhouse-keeper`. See the [OpenSSL](/docs/cloud/clickhouse-private/explanation/pki-and-mtls) section for more details. | | keeper.openSSL.required | bool | `false` | Require TLS connections in `clickhouse-keeper`. See the [OpenSSL](/docs/cloud/clickhouse-private/explanation/pki-and-mtls) section for more details. | | keeper.openSSL.secret.caKey | string | `"ca.crt"` | The key in the secret that contains the CA certificate. Defaults to `ca.crt`. | | keeper.openSSL.secret.certKey | string | `"keeper.crt"` | The key in the secret that contains the keeper certificate (public key). Defaults to `tls.crt`. | | keeper.openSSL.secret.keyKey | string | `"keeper.key"` | The key in the secret that contains the keeper private key. Defaults to `tls.key`. | | keeper.openSSL.secret.name | string | `""` | The name of the Kubernetes secret containing the TLS certificates for `clickhouse-keeper`. Defaults to `${CLUSTER_NAME}-keeper-cert-secret`. See the [OpenSSL](/docs/cloud/clickhouse-private/explanation/pki-and-mtls) section for more details. | | keeper.podPolicy.nodeSelector.clickhouseGroup | string | `"keeper"` | **This value must match the node labels of the keeper node group** excluding the `-arm64` suffix, if using arm64. | | keeper.podPolicy.resources | object | `{}` | Memory and CPU limits and requests for the `clickhouse-keeper` pods. | | keeper.replicaCount | int | `3` | The number of `clickhouse-keeper` replicas to provision. It is not recommended to change this value as `clickhouse-keeper` relies on a quorum. Can be set to `0` for child instances, which share the parent cluster's Keeper ensemble. | | keeper.storage.resources.requests | string | `"10Gi"` | Size of (EBS) disk to provision per `clickhouse-keeper` replica. | | keeper.storage.storageClassName | string | `""` | Override the storage class for `clickhouse-keeper` disks. When empty, the default for the selected cloud is used (`gp3-encrypted` for AWS and `premium-rwo` for GCP). | | keeper.tolerations | list | `[]` | Set to add tolerations to `clickhouse-keeper` pods. See [Taints and Tolerations](/docs/cloud/clickhouse-private/reference/infrastructure-requirements). | | loadBalancer.hostname | string | `""` | Set to public hostname, if one is needed. Required if `loadBalancer.type` is not `none`. | | loadBalancer.type | string | `"none"` | Type of loadbalancer being used. Can be `public`, `internal`, or `none`. | | name | string | `""` | Overrides name of the cluster. By default the Helm release name is used. Must match `^[a-z]+-[a-z]{2}-[0-9]{2}$` (e.g. `default-eu-01`). | | resourceQuota.enabled | bool | `true` | Whether or not to create a ResourceQuota limiting the namespace to a single ClickHouseCluster. The operator assumes one ClickHouseCluster per namespace; this quota enforces it at the API server level. Deploying multiple ClickHouseClusters in the same namespace WILL lead to issues. | | server.additionalConfigConstraints | list | `[]` | Set additional server config constraints. | | server.additionalEnvVars | list | `[]` | Set custom env var values on `clickhouse-server`. See [`corev1.EnvVar`](https://pkg.go.dev/k8s.io/api/core/v1#EnvVar). | | server.annotations | object | `{}` | Additional annotations to include on the `clickhouse-server` pods. | | server.arm64 | bool | `true` | Whether or not `clickhouse-server` is preferred to run on arm64. See the [arm64](/docs/cloud/clickhouse-private/reference/infrastructure-requirements) section for details. | | server.config | object | `{}` | Overrides for the default `clickhouse-server` configurations. Configure `remote_servers` here to use the Distributed table engine or cluster table function. | | server.excludeConfigConstraints | list | `[]` | Remove specific additional server config constraints. | | server.image.repository | string | `""` | The docker repository that hosts the `clickhouse-server` image. | | server.image.tag | string | `nil` | The docker image tag to deploy for `clickhouse-server`. This corresponds to the version of ClickHouse in the image. | | server.loggerConfig.jsonLogs | bool | `false` | Whether or not `clickhouse-server` will log in JSON format. | | server.loggerConfig.loggerLevel | string | `"trace"` | The logging level of `clickhouse-server`. | | server.openSSL.enabled | bool | `false` | Enables openSSL settings for `clickhouse-server`. See the [OpenSSL](/docs/cloud/clickhouse-private/explanation/pki-and-mtls) section for more details. | | server.openSSL.required | bool | `false` | Require TLS connections in `clickhouse-server`. See the [OpenSSL](/docs/cloud/clickhouse-private/explanation/pki-and-mtls) section for more details. | | server.openSSL.secret.caKey | string | `"ca.crt"` | The key in the secret that contains the CA certificate. Defaults to `ca.crt`. | | server.openSSL.secret.certKey | string | `"server.crt"` | The key in the secret that contains the server certificate (public key). Defaults to `tls.crt`. | | server.openSSL.secret.keyKey | string | `"server.key"` | The key in the secret that contains the server private key. Defaults to `tls.key`. | | server.openSSL.secret.name | string | `""` | The name of the Kubernetes secret containing the TLS certificates for `clickhouse-server`. Defaults to `${CLUSTER_NAME}-server-cert-secret`. See the [OpenSSL](/docs/cloud/clickhouse-private/explanation/pki-and-mtls) section for more details. | | server.podPolicy.nodeSelector.clickhouseGroup | string | `"server"` | **This value must match the node labels of the server node group** excluding the `-arm64` suffix, if using arm64. | | server.podPolicy.resources | object | `{}` | Memory and CPU limits and requests for the `clickhouse-server` pods. | | server.prometheus.user.create | bool | `true` | Whether or not to create the user that should be used for scraping custom Prometheus metrics. | | server.prometheus.user.password | string | `""` | The plain-text password of the user that should be used for scraping custom Prometheus metrics. | | server.prometheus.user.username | string | `"prometheus-internal"` | The username of the user that should be used for scraping custom Prometheus metrics. | | server.replicaCount | int | `3` | The number of `clickhouse-server` replicas to provision. Should be a minimum of 3 for high-availability. | | server.ssdCacheConfiguration.bytesPerGiRAM | string | `"0"` | Calculates the size of the cache disk based on pod resources. Not used if `cacheDiskSize` is set. This value changes based on instance type so please choose carefully. If unsure what value to use, just use `cacheDiskSize`. | | server.ssdCacheConfiguration.cacheDiskSize | string | `""` | The size of the cache disk. Takes precedence over `bytesPerGiRAM`. Set this value to 80-90% of the SSD cache disk size if you are unsure what value to use for `bytesPerGiRAM`. | | server.ssdCacheConfiguration.hostPathBaseDirectory | string | `""` | Override the host path base directory for SSD cache. Only used when `isOnEmptyDir` is false. When empty, the operator applies its own default (`/nvme/disk/`). Setting this field makes the pair (`hostPathBaseDirectory`, `isOnEmptyDir`) authoritative: the per-cloud base configuration's values for both are discarded, so a GCP base default of `isOnEmptyDir: true` cannot silently shadow a customer-provided host path. | | server.ssdCacheConfiguration.isOnEmptyDir | string | `nil` | Override whether the SSD cache uses an emptyDir volume. GKE natively supports SSDs as ephemeral storage, so the GCP base configuration sets this to true. When null, the default for the selected cloud is used. Setting this field (to `true` or `false`) makes the pair (`hostPathBaseDirectory`, `isOnEmptyDir`) authoritative: the per-cloud base configuration's values for both are discarded. | | server.storage.resources.requests | string | `"30Gi"` | Size of (EBS) disk to provision per `clickhouse-server` replica. | | server.storage.s3.bucketName | string | `""` | The s3 bucket name where the service data will be stored. This bucket should be in the same region as the ClickHouse cluster. This bucket can be used by multiple ClickHouse clusters. | | server.storage.s3.endpoint | string | `""` | The object storage endpoint (e.g. `https://s3.us-west-2.amazonaws.com`). Defaults to the `us-west-2` regional S3 endpoint when `baseConfiguration.cloud` is `aws`, and to `https://storage.googleapis.com` when it is `gcp`; must be set explicitly for Azure. | | server.storage.s3.keyPrefix | string | `""` | The s3 key prefix for data stored by this ClickHouse cluster in the s3 bucket. **This must be unique across all ClickHouse clusters sharing the same s3 bucket** and must be in the format `ch-s3-{uuid}`. **Must be left empty when `baseConfiguration.cloud` is `azure`.** | | server.storage.s3.region | string | `""` | The region of the bucket. Defaults to `us-west-2` when `baseConfiguration.cloud` is `aws` and to `auto` when it is `gcp`; must be set explicitly for Azure (or set `isOnPremiseInstance: true` to omit it from the rendered CRD). | | server.storage.storageClassName | string | `""` | Override the storage class for `clickhouse-server` disks. When empty, the default for the selected cloud is used (`gp3-encrypted` for AWS and `standard-rwo` for GCP). | | server.tolerations | list | `[]` | Set to add tolerations to `clickhouse-server` pods. See [Taints and Tolerations](/docs/cloud/clickhouse-private/reference/infrastructure-requirements). | | server.useAzureWorkloadIdentity | bool | `true` | When `baseConfiguration.cloud` is `azure`, adds the `azure.workload.identity/use: "true"` pod label so Azure AD workload identity is enabled on `clickhouse-server` pods. Ignored for aws/gcp. Set to `false` to opt out. | | server.useCustomReplicaRules | bool | `false` | Defaults to false to use AdditionalEnvVars on the ClickhouseCluster CRD for setting server environment variables. Enable to allow setting of environment variables through custom replica rules if the operator version is below `1.12213.1`. Note that custom environment variables on this version of the operator can cause issues with scale-in operations, so it is recommended to upgrade. | | server.users.profiles | object | `{}` | Override default [user profile settings](https://clickhouse.com/docs/en/operations/settings/settings-profiles) for ClickHouse users. Settings are merged with base configuration. Some settings may be restricted by config constraints. To allow certain settings, add them to `server.additionalConfigConstraints`. Example: `server.users.profiles.default.allow_experimental_full_text_index: true`. | | serviceAccount.annotations | object | `{}` | Annotations to include on the service account. It is highly recommended to use [IRSA](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). See [IAM Roles for Service Accounts](/docs/cloud/clickhouse-private/tutorials/deploy-aws) for details. | | serviceAccount.create | bool | `true` | Whether or not to create the service account used by `clickhouse-server`. Each ClickHouse cluster deployment should use their own service account. | | serviceAccount.name | string | `""` | Overrides name of the service account. If no name is provided, it will generate one from the cluster `name`. | | storageClass.allowedTopologies | list | `[]` | Topology restrictions for dynamic provisioning. Used to constrain which zones/regions volumes can be provisioned in. See [Kubernetes StorageClass allowedTopologies](https://kubernetes.io/docs/concepts/storage/storage-classes/#allowed-topologies). | | storageClass.annotations | object | `{}` | Annotations to include on the generated storage class. Rendered only when non-empty. | | storageClass.create | bool | `false` | Whether or not to create a storage class that both server and keeper will use. If using some custom storage class, this can be disabled. | | storageClass.labels | object | `{}` | Extra labels merged over the common chart labels on the generated storage class. | | storageClass.name | string | `""` | Name of the generated storage class. When empty, the cloud default is used (`gp3-encrypted` for AWS, `premium-ssd-v2` for Azure). No default exists for GCP; a GCP deployment with `create: true` must set this explicitly. | | storageClass.parameters | object | `{}` | Provisioner parameters passed to the CSI driver. When empty, the cloud default is used (AWS: `encrypted: "true"`, `fstype: ext4`, `type: gp3`; Azure: `cachingMode: None`, `fstype: ext4`, `skuName: PremiumV2_LRS`). If set, this map fully replaces the cloud default (specify every key). No default exists for GCP. | | storageClass.provisioner | string | `""` | CSI provisioner. When empty, the cloud default is used (`ebs.csi.aws.com` for AWS, `disk.csi.azure.com` for Azure). No default exists for GCP; a GCP deployment with `create: true` must set this explicitly. |