Loading post…
ClickhouseAashish Kohli, Yiyang ShaoAnnouncement
ClickHouse BYOC on Google Cloud now Generally Available
Summary
ClickHouse Bring Your Own Cloud is now generally available on Google Cloud across all public ClickHouse Cloud Google regions without requiring a waitlist. The architecture separates the ClickHouse-managed control plane from the customer data plane, which runs entirely within the user Google Cloud project on Google Kubernetes Engine and Google Cloud Storage. An outbound-only, encrypted Tailscale zero-trust tunnel restricts control plane communication strictly to orchestration traffic, ensuring query data never leaves the customer environment. Deployment involves a three-step Terraform setup that establishes least-privilege IAM roles, configures VPC networking, and automates cluster provisioning. ClickHouse manages database and infrastructure maintenance through ArgoCD, employing a make-before-break strategy to add updated replicas before decommissioning older nodes across customizable release channels.
Context
Organizations using Google Cloud want the operational simplicity of a fully managed ClickHouse service while maintaining data residency inside their own cloud account and compliance boundary alongside workloads like BigQuery, Dataflow, and Pub/Sub.
Approach / What changed
ClickHouse BYOC separates the ClickHouse-managed control plane in its own VPC from the customer data plane running on GKE and Google Cloud Storage inside the customer Google Cloud project. An outbound-only, encrypted Tailscale zero-trust tunnel connects the control plane to the data plane for orchestration traffic. Onboarding utilizes a three-step Terraform-based process, and infrastructure updates along with database upgrades are handled via ArgoCD using a make-before-break strategy.
Takeaways
ClickHouse BYOC isolates data storage and execution inside the customer Google Cloud project on GKE and GCS, while the control plane operates separately in ClickHouse's VPC.
Control plane communication relies on an outbound-only, encrypted Tailscale zero-trust tunnel scoped exclusively to orchestration traffic, preventing query data access.
Database and infrastructure upgrades execute in the background via ArgoCD using a make-before-break replica strategy across Fast, Regular, and Slow release channels.
Source and freshness
- Source
- clickhouse.com
- Published
- Added to Yomu
- Last updated
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.