Skip to main content
ClickHouse BYOC on Azure supports private connectivity via Azure Private Link.

​
Prerequisites

​
Enable private load balancer for ClickHouse BYOC

In the ClickHouse Cloud console, enable the Private load balancer for your BYOC infrastructure. Azure Private Link provides a secure and private connection to your ClickHouse BYOC services. All traffic flows within the Azure network, ensuring that it never traverses the public internet.
2

Obtain endpoint Service name

  1. In the ClickHouse Cloud console, navigate to the service’s Settings page that you would like to connect to via Private Link.
  2. Click “Set up private endpoint”.
  3. In the opened flyout, copy the Service name (the Private Link service alias) and DNS name values — you’ll use them in the next steps. (It may take a while for the values to be generated after enabling Private Link.)
3

Create a private endpoint in your network

  1. Open your own Azure Portal (i.e. the Azure subscription where your client application is) → Network Foundation → Private endpoints → Create.
  2. On the Basics tab, choose the subscription, resource group, name, and region for the private endpoint. The region should be the region of the VNet your client application connects from.
  3. On the Resource tab, select Connect to an Azure resource by resource ID or alias and enter the Service name obtained from the last step.
  4. On the Virtual Network tab, choose the virtual network and subnet where the private endpoint will be created. Optionally, attach an application security group to filter traffic to the private endpoint.
  5. Continue through the remaining tabs and click Create. The Connection status of the created private endpoint will be in a Pending state until you add its Resource ID to the ClickHouse service allow list in the next steps.
  6. Open the network interface associated with the private endpoint and copy the Private IPv4 address — you’ll use it in the DNS setup step.
4

Add the private endpoint Resource ID to ClickHouse service allow list

To obtain the private endpoint Resource ID, open the private endpoint created earlier in the Azure Portal and click JSON View, then copy the top-level id field (the Resource ID shown at the top of the view, in the form /subscriptions/.../providers/Microsoft.Network/privateEndpoints/<name>). Don’t use the nested id fields inside the properties object:
  1. In the ClickHouse Cloud console, navigate to the service’s Settings page that you would like to connect to via Private Link.
  2. Click “Set up private endpoint”.
  3. In the opened flyout, enter the Resource ID obtained above into the Endpoint ID field with an optional description.
  4. Click “Create endpoint”.
If you want to allow access from an existing Private Link connection, use the existing endpoint dropdown menu. The dropdown will show the existing Private Link connections to the services within the same infrastructure.
No manual approval in the Azure Portal is required — once the Resource ID is added to the allow list, the endpoint connection is automatically approved, and its LinkID is automatically added to the Istio AuthorizationPolicy for the ClickHouse service. The Connection status of the private endpoint in your subscription changes to Approved.
5

Set private DNS name for endpoint

There are various ways to configure DNS. Please set up DNS according to your specific use case.
You need to point all subdomains (wildcard) of the “DNS name” (everything after the service ID, e.g. privatelink.mhp0y4dmph.westus3.azure.clickhouse-byoc.com) to the private endpoint IP address. This ensures that services/components within your VNet can resolve it properly. A typical setup using Azure Private DNS:
  1. Create a Private DNS zone named after the “DNS name” without the leading service ID, for example privatelink.mhp0y4dmph.westus3.azure.clickhouse-byoc.com.
  2. In the zone, create a wildcard record set: for Name type *, and for IP Address enter the private endpoint IP address copied earlier.
  3. Link the Private DNS zone to your virtual network so clients in the VNet can resolve the zone.
Verify the DNS setup from a host inside your VNet — the “DNS name” should resolve to the private endpoint IP:
Last modified on August 6, 2026