Loading…
ClickHouse BYOC on Google Cloud now Generally Available
Aashish Kohli, Yiyang Shao
- Source
- Clickhouse
- Published
- Added to Yomu
Summary
ClickHouse Bring Your Own Cloud is now generally available on Google Cloud across all public ClickHouse Cloud Google regions without requiring a waitlist. The architecture separates the ClickHouse-managed control plane from the customer data plane, which runs entirely within the user Google Cloud project on Google Kubernetes Engine and Google Cloud Storage. An outbound-only, encrypted Tailscale zero-trust tunnel restricts control plane communication strictly to orchestration traffic, ensuring query data never leaves the customer environment. Deployment involves a three-step Terraform setup that establishes least-privilege IAM roles, configures VPC networking, and automates cluster provisioning. ClickHouse manages database and infrastructure maintenance through ArgoCD, employing a make-before-break strategy to add updated replicas before decommissioning older nodes across customizable release channels.
Context
Organizations using Google Cloud want the operational simplicity of a fully managed ClickHouse service while maintaining data residency inside their own cloud account and compliance boundary alongside workloads like BigQuery, Dataflow, and Pub/Sub.
Approach / What changed
ClickHouse BYOC separates the ClickHouse-managed control plane in its own VPC from the customer data plane running on GKE and Google Cloud Storage inside the customer Google Cloud project. An outbound-only, encrypted Tailscale zero-trust tunnel connects the control plane to the data plane for orchestration traffic. Onboarding utilizes a three-step Terraform-based process, and infrastructure updates along with database upgrades are handled via ArgoCD using a make-before-break strategy.
Takeaways
- ClickHouse BYOC isolates data storage and execution inside the customer Google Cloud project on GKE and GCS, while the control plane operates separately in ClickHouse's VPC.
- Control plane communication relies on an outbound-only, encrypted Tailscale zero-trust tunnel scoped exclusively to orchestration traffic, preventing query data access.
- Database and infrastructure upgrades execute in the background via ArgoCD using a make-before-break replica strategy across Fast, Regular, and Slow release channels.