Onboarding

​

Prerequisites

• Your connector endpoint and enrollment token, provided by ClickHouse during onboarding (see Step 1).
• Egress on port 443 to https://<subdomain>.<connector-domain> and https://<subdomain>.enroll.<connector-domain>, plus releases.clicklink.clickhouse.com and Amazon ECR Public at install time. When any of these are unreachable, see air-gapped and mirrored installs.
• A reachable ClickHouse native listener from where the connector runs: secure (9440) or plaintext (9000), auto-detected on Kubernetes.
• ClickHouse admin access for provisioning: a passwordless default user, a password (prompted, or supplied with --ch-admin-password-stdin), or an operator-managed instance, where provisioning switches to CR injection and needs no password.
• cosign wherever you download release artifacts. The installer always verifies the SHA-256 checksum, adds cosign signature verification when cosign is installed, and refuses to proceed without it if you set CLICKLINK_REQUIRE_COSIGN=1.

• Any conformant Kubernetes cluster.
• A kubeconfig that can create and read the connector namespace, apply Secrets, exec into your ClickHouse pods (provisioning runs clickhouse-client in-pod), create ServiceAccounts, Roles, and RoleBindings, and install the chart.
• A default StorageClass, or a class to pass with --storage-class; the troubleshooter keeps state on a PersistentVolumeClaim.
• Image pull access: cluster nodes must be able to pull the public ECR image, or a mirror you host.

• Any systemd Linux host, amd64 or arm64. Linux builds run in FIPS mode.
• Root access for the installer and for init.
• Free ports 8080, 8082, and 8084 (health) and 9090, 9092, and 9094 (metrics), plus 8443 when the support-session gateway is enabled.
• Admin access to a Kubernetes API server for provisioning, supplied by a kubeconfig on the host, by --server and --ca-data, or at the prompts. Access bundles are anchored to Kubernetes ServiceAccounts on both targets.

​

Install and enroll

https://<subdomain>.<connector-domain>

curl -fsSL https://releases.clicklink.clickhouse.com/install.sh | bash

curl -fsSL https://releases.clicklink.clickhouse.com/install.sh | sudo bash -s -- --host

clicklink clctl init --enroll https://<subdomain>.<connector-domain> --target helm

clicklink clctl init --handoff handoff.yaml --target helm \
  --instance name=<name>,host=<service-host>,port=9440,secure=true,database=default,namespace=<clickhouse-namespace> \
  --operators '<operator-email-1>,<operator-email-2>' \
  --storage-class <storage-class> \
  --ch-admin-password-stdin < admin-password.txt

sudo clicklink clctl init --enroll https://<subdomain>.<connector-domain>

CONNECTOR_NAMESPACE='clicklink'   # the connector namespace you chose at init
kubectl get pods -n "${CONNECTOR_NAMESPACE}"

sudo clicklink clctl preflight

rm handoff.yaml        # workstation (Kubernetes installs)
sudo rm handoff.yaml   # VM host (init ran as root, so the file is root-owned)

​

Air-gapped and mirrored installs

​

Manual download and verification

CLICKLINK_VERSION="$(curl -fsSL https://releases.clicklink.clickhouse.com/latest-version.txt)"
# Or pin a specific release: CLICKLINK_VERSION='v0.9.0'
CLICKLINK_TARBALL="clicklink-${CLICKLINK_VERSION}-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/').tar.gz"
for suffix in '' .sha256 .sig .crt; do
  curl -fsSLO "https://releases.clicklink.clickhouse.com/${CLICKLINK_TARBALL}${suffix}"
done
if command -v sha256sum >/dev/null; then
  sha256sum -c "${CLICKLINK_TARBALL}.sha256"
else
  shasum -a 256 -c "${CLICKLINK_TARBALL}.sha256"
fi

cosign verify-blob \
  --certificate "${CLICKLINK_TARBALL}.crt" \
  --signature "${CLICKLINK_TARBALL}.sig" \
  --certificate-identity-regexp "^https://github\.com/ClickHouse/data-plane-clicklink/\.github/workflows/release\.yaml@refs/tags/v" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  "${CLICKLINK_TARBALL}"

tar -xzf "${CLICKLINK_TARBALL}"
sudo install -m 0755 clicklink /usr/local/bin/clicklink

​

If something fails