Skip to content

Ansible manage clickhouse settings profiles #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
aagbsn wants to merge 8 commits into
base: main
Choose a base branch
from
+23 −13
Draft

Ansible manage clickhouse settings profiles #420

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
9f86d7f
Apply stricter constraints on oonimeasurements user queries
hellais Apr 17, 2026
d9addca
Reduce max rows to 50k
hellais Apr 17, 2026
d442c90
raise oonimeasuremenets max memory
aagbsn Apr 27, 2026
7e52d43
Merge remote-tracking branch 'origin/main' into oonimeasurements-limits
aagbsn Apr 29, 2026
a5fd688
Merge remote-tracking branch 'origin/raise_oonimeasurements_max_memor…
aagbsn Apr 29, 2026
b7a4246
enable clickhouse_role_manage_settings_profiles and clickhouse_role_m…
aagbsn Apr 29, 2026
798b0c2
fix user password misconfiguration
aagbsn Apr 30, 2026
3773e15
sql managed users does NOT read var password_sha256_hex nor hash pass…
aagbsn Apr 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 23 additions & 13 deletions ansible/group_vars/clickhouse/vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,7 @@ clickhouse_distributed_ddl:
cleanup_delay_period: 60
max_tasks_in_queue: 1000

clickhouse_role_manage_settings_profiles: True
clickhouse_default_profiles:
default:
readonly: 2
Expand Down Expand Up @@ -226,37 +227,45 @@ clickhouse_default_users:
profile: write
quota: default

clickhouse_role_manage_users: true
clickhouse_role_manage_users: True
clickhouse_custom_users:
- user:
name: oonimeasurements
password_type: sha256_password
password: "{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/clickhouse_oonimeasurements_password', profile='oonidevops_user_prod') }}"
password_type: sha256_hash
password: "{{ lookup('amazon.aws.aws_ssm', '/oonidevops/secrets/clickhouse_oonimeasurements_password', profile='oonidevops_user_prod') | hash('sha256') }}"
networks:
- "IP '0.0.0.0/0'"
settings:
# 500 MB
- "max_memory_usage = 501001000"
# 1 GB
- "max_memory_usage = 1001001000"
# 60 seconds
- "max_execution_time = 30"
# 500 GB
- "max_bytes_to_read = 501001001000"
# 5 B
- "max_rows_to_read = 5001001000"
# 5s
- "timeout_before_checking_execution_speed = 5"
# 50k
- "max_result_rows = 51000"
profile:
- readonly
quota: "oonimeasurements"
databases: [ooni]

# TODO: this quota was created by hand since it wasn't working in the idealista playbook
clickhouse_role_manage_quotas: false
clickhouse_role_manage_quotas: True
clickhouse_custom_quotas:
# quota over a 10 minute window
- quota:
name: oonimeasurements
settings:
- "INTERVAL 10 minute MAX queries = 12000, MAX errors = 1000, MAX execution_time = 1000"
to:
- oonimeasurements
duration: 600
queries: 12000
errors: 1000
result_rows: 0
read_rows: 0
execution_time: 1000

clickhouse_role_manage_grants: true
clickhouse_role_manage_roles: true
clickhouse_role_manage_grants: True
clickhouse_custom_grants:
- on:
databases: [ooni]
Expand All @@ -268,6 +277,7 @@ clickhouse_custom_grant_roles:
- roles: [oonimeasurements]
to: [oonimeasurements]

clickhouse_role_manage_roles: True
clickhouse_custom_roles:
- role:
name: oonimeasurements
Expand Down
Loading