Skip to main content
A ClickHouse account stores the credentials for one ClickHouse user. Members connect in the browser or through the Infisical CLI, and Infisical records every statement they run. ClickHouse has two interfaces, and an account can use either or both:
  • HTTP: port 8123, or 8443 with TLS (the browser and HTTP clients, such as JDBC tools, clickhouse-connect, and curl, use this interface)
  • Native protocol: port 9000, or 9440 with TLS (clickhouse-client and other native drivers use this interface)

​
Prerequisites

  • The Admin role on the folder you’ll add the account to
  • A ClickHouse user for Infisical to sign in as
  • TLS turned on for both interfaces or for neither, because SSL Enabled applies to both
  • A gateway that can reach the ports you use (to use the native protocol, the gateway must be recent enough to support it)
  • A ClickHouse account template

​
Grant the user permissions

A session can do whatever the ClickHouse user can do, so grant the user only what the account’s users need:
The account’s Database only sets the database that a session starts in. A session can read every database that the user has a grant on, so limit access with grants instead. Sessions start with the user’s default roles. To switch to another role, run SET ROLE in the session.

​
Create the account

1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder and a ClickHouse Account Template, then select Next.
3
Enter a Name and the connection details:Set at least one of the two ports. If you turn on SSL Enabled, use the TLS ports.
4
Enter the credentials:
5
Select Create. Infisical checks the connection through the gateway before it saves the account, and if the check fails, the error names the port that failed.

​
Connect

To open a session, follow Connect to an account.
The browser needs the account to have an HTTP Port. If the account only has a Native Port, use the CLI.The browser session has a table browser and a SQL editor:
  • The table browser lists databases where it lists schemas for other account types, because ClickHouse databases don’t contain schemas
  • The table browser can’t edit rows, because ClickHouse applies row changes in the background; to change rows, run ALTER TABLE ... UPDATE or DELETE FROM in the SQL editor
  • The table browser shows the first 1,000 rows of a result
  • The browser stops a statement after 30 seconds
For a long query or a full result set, use the CLI.

​
Recording and command blocking

Infisical records every statement in a session and its outcome. To see them, open the session and go to Session Logs. The template’s Command Blocking patterns apply to ClickHouse statements. If a statement matches a pattern, Infisical rejects the statement before it reaches ClickHouse and records the rejection. Command blocking only matches the text of each statement, so it can’t stop SQL that a statement builds while it runs. For restrictions that must always hold, use ClickHouse grants. If the template uses command blocking, Infisical also rejects an HTTP request if:
  • The request body is larger than 1 MB (send large inserts in smaller batches)
  • The request body is compressed with anything other than gzip or deflate

​
Next steps

Sessions

Review and end the connections that people and agents make to your accounts.

Access requests

Require approval before a member can use a sensitive account.