---
title: "ClickHouse BYOC on Google Cloud  now Generally Available"
description: "ClickHouse Bring Your Own Cloud is now generally available on Google Cloud across all public ClickHouse Cloud Google regions without requiring a waitlist. The architecture separates the ClickHouse-managed control plane from the customer data plane, which runs entirely within the user Google Cloud project on Google Kubernetes Engine and Google Cloud Storage. An outbound-only, encrypted Tailscale zero-trust tunnel restricts control plane communication strictly to orchestration traffic, ensuring query data never leaves the customer environment. Deployment involves a three-step Terraform setup that establishes least-privilege IAM roles, configures VPC networking, and automates cluster provisioning. ClickHouse manages database and infrastructure maintenance through ArgoCD, employing a make-before-break strategy to add updated replicas before decommissioning older nodes across customizable release channels."
---

# ClickHouse BYOC on Google Cloud  now Generally Available

[Clickhouse](https://yomu.fyi/company/clickhouse) · Aashish Kohli, Yiyang Shao · Mar 31, 2026

**Type:** Announcement

## Summary

ClickHouse Bring Your Own Cloud is now generally available on Google Cloud across all public ClickHouse Cloud Google regions without requiring a waitlist. The architecture separates the ClickHouse-managed control plane from the customer data plane, which runs entirely within the user Google Cloud project on Google Kubernetes Engine and Google Cloud Storage. An outbound-only, encrypted Tailscale zero-trust tunnel restricts control plane communication strictly to orchestration traffic, ensuring query data never leaves the customer environment. Deployment involves a three-step Terraform setup that establishes least-privilege IAM roles, configures VPC networking, and automates cluster provisioning. ClickHouse manages database and infrastructure maintenance through ArgoCD, employing a make-before-break strategy to add updated replicas before decommissioning older nodes across customizable release channels.

## Context

Organizations using Google Cloud want the operational simplicity of a fully managed ClickHouse service while maintaining data residency inside their own cloud account and compliance boundary alongside workloads like BigQuery, Dataflow, and Pub/Sub.

## Approach / What changed

ClickHouse BYOC separates the ClickHouse-managed control plane in its own VPC from the customer data plane running on GKE and Google Cloud Storage inside the customer Google Cloud project. An outbound-only, encrypted Tailscale zero-trust tunnel connects the control plane to the data plane for orchestration traffic. Onboarding utilizes a three-step Terraform-based process, and infrastructure updates along with database upgrades are handled via ArgoCD using a make-before-break strategy.

## Takeaways

- ClickHouse BYOC isolates data storage and execution inside the customer Google Cloud project on GKE and GCS, while the control plane operates separately in ClickHouse's VPC.
- Control plane communication relies on an outbound-only, encrypted Tailscale zero-trust tunnel scoped exclusively to orchestration traffic, preventing query data access.
- Database and infrastructure upgrades execute in the background via ArgoCD using a make-before-break replica strategy across Fast, Regular, and Slow release channels.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Deployment](https://yomu.fyi/topic/deployment), [Google Cloud](https://yomu.fyi/topic/gcp), [Kubernetes](https://yomu.fyi/topic/kubernetes)

- Source: [Clickhouse](https://clickhouse.com/blog/byoc-gcp-ga)
- Source URL: https://clickhouse.com/blog/byoc-gcp-ga
- Ingested by Yomu: 2026-08-28T01:23:24.610Z

[Read original post](https://clickhouse.com/blog/byoc-gcp-ga)