ClickHouse: Implement first clickhouse impl

charts/clickhouse/.helmignore

@@ -0,0 +1,2 @@
+artifacthub-repo.yaml
+tests/

charts/clickhouse/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## [0.1.0]
+
+### Added
+
+- Initial release of the standalone ClickHouse Helm chart
+- StatefulSet deployment using official `clickhouse/clickhouse-server` image
+- Configurable `config.xml` and `users.xml` via ConfigMaps
+- Persistent storage via PVC with configurable size and storage class
+- HTTP (8123) and TCP/native (9000) service ports
+- Headless service for StatefulSet DNS
+- Optional Prometheus metrics sidecar with ServiceMonitor support
+- Optional Ingress and Gateway API HTTPRoute resources
+- Optional ServiceAccount creation
+- Liveness, readiness, and startup probes via ClickHouse `/ping` endpoint
+- Support for init SQL scripts via ConfigMap
+- `extraObjects`, `extraEnvVars`, `extraVolumes`, `extraVolumeMounts` escape hatches
+- Auto-generated credentials secret with connection URI
+- Pod and container security context defaults
+- `persistentVolumeClaimRetentionPolicy` support

charts/clickhouse/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: oci://registry-1.docker.io/cloudpirates
+  version: 2.2.0
+digest: sha256:a2168dfa04b6fbeb8ab278d891670dd5d27c51366c36853e156f07479720cefe
+generated: "2026-03-30T07:55:43.090874+02:00"

charts/clickhouse/Chart.yaml

@@ -0,0 +1,49 @@
+apiVersion: v2
+name: clickhouse
+description: The Open-Source, High Performance Columnar OLAP Database Management System
+type: application
+version: 0.1.0
+appVersion: "25.3.14.14"
+keywords:
+  - clickhouse
+  - database
+  - olap
+  - analytics
+  - columnar
+home: https://clickhouse.com
+sources:
+  - https://github.com/CloudPirates-io/helm-charts/tree/main/charts/clickhouse
+  - https://github.com/ClickHouse/ClickHouse
+maintainers:
+  - name: CloudPirates GmbH & Co. KG
+    email: [email protected]
+    url: https://www.cloudpirates.io
+dependencies:
+  - name: common
+    version: "2.2.x"
+    repository: oci://registry-1.docker.io/cloudpirates
+icon: https://a.storyblok.com/f/143071/512x512/7be3e97a51/clickhouse-logo.svg
+annotations:
+  license: Apache-2.0
+  artifacthub.io/category: database
+  artifacthub.io/containsSecurityUpdates: "false"
+  artifacthub.io/signKey: |
+    fingerprint: 6917f1a88c122cbb1de5aa55457752135bdcf95a
+    url: https://raw.githubusercontent.com/CloudPirates-io/helm-charts/refs/heads/main/cosign.pub
+  artifacthub.io/links: |
+    - name: ClickHouse
+      url: https://clickhouse.com
+    - name: Helm Chart
+      url: https://github.com/CloudPirates-io/helm-charts/tree/main/charts/clickhouse
+    - name: Application
+      url: https://github.com/ClickHouse/ClickHouse
+    - name: Docker Image
+      url: https://hub.docker.com/r/clickhouse/clickhouse-server
+    - name: Maintainer CloudPirates
+      url: https://www.cloudpirates.io
+  artifacthub.io/changes: |-
+    - kind: added
+      description: "Initial release of the ClickHouse chart"
+      links:
+        - name: "Changelog"
+          url: "https://github.com/CloudPirates-io/helm-charts/blob/main/charts/clickhouse/CHANGELOG.md"

charts/clickhouse/artifacthub-repo.yml

@@ -0,0 +1 @@
+repositoryID: XXXXXXXX

charts/clickhouse/templates/_helpers.tpl

@@ -0,0 +1,125 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "clickhouse.name" -}}
+{{- include "cloudpirates.name" . -}}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "clickhouse.fullname" -}}
+{{- include "cloudpirates.fullname" . -}}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "clickhouse.chart" -}}
+{{- include "cloudpirates.chart" . -}}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "clickhouse.labels" -}}
+{{- include "cloudpirates.labels" . -}}
+{{- end }}
+
+{{/*
+Common annotations
+*/}}
+{{- define "clickhouse.annotations" -}}
+{{- with .Values.commonAnnotations }}
+{{- toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "clickhouse.selectorLabels" -}}
+{{- include "cloudpirates.selectorLabels" . -}}
+{{- end }}
+
+{{/*
+Return the proper ClickHouse image name
+*/}}
+{{- define "clickhouse.image" -}}
+{{- include "cloudpirates.image" (dict "image" .Values.image "global" .Values.global) -}}
+{{- end }}
+
+{{/*
+Return ClickHouse credentials secret name
+*/}}
+{{- define "clickhouse.secretName" -}}
+{{- if .Values.auth.existingSecret -}}
+    {{- include "cloudpirates.tplvalues.render" (dict "value" .Values.auth.existingSecret "context" .) -}}
+{{- else -}}
+    {{- include "clickhouse.fullname" . -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Return ClickHouse admin password key
+*/}}
+{{- define "clickhouse.passwordKey" -}}
+{{- if .Values.auth.existingSecret -}}
+    {{- include "cloudpirates.tplvalues.render" (dict "value" .Values.auth.secretKeys.passwordKey "context" .) | default "clickhouse-password" -}}
+{{- else -}}
+clickhouse-password
+{{- end -}}
+{{- end }}
+
+{{/*
+Return ClickHouse configuration ConfigMap name
+*/}}
+{{- define "clickhouse.configmapName" -}}
+{{- if .Values.config.existingConfigmap -}}
+    {{- .Values.config.existingConfigmap -}}
+{{- else -}}
+    {{- printf "%s-config" (include "clickhouse.fullname" .) -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Return ClickHouse users configuration ConfigMap name
+*/}}
+{{- define "clickhouse.usersConfigmapName" -}}
+{{- if .Values.config.existingUsersConfigmap -}}
+    {{- .Values.config.existingUsersConfigmap -}}
+{{- else -}}
+    {{- printf "%s-users" (include "clickhouse.fullname" .) -}}
+{{- end -}}
+{{- end }}
+
+{{/*
+Return ClickHouse init scripts ConfigMap name
+*/}}
+{{- define "clickhouse.initdb.scriptsCM" -}}
+{{- if .Values.initdb.scriptsConfigMap -}}
+    {{- printf "%s" (tpl .Values.initdb.scriptsConfigMap $) -}}
+{{- else -}}
+    {{- printf "%s-init-scripts" (include "clickhouse.fullname" .) -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Return the proper Docker Image Registry Secret Names
+*/}}
+{{- define "clickhouse.imagePullSecrets" -}}
+{{ include "cloudpirates.images.renderPullSecrets" (dict "images" (list .Values.image) "context" .) }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "clickhouse.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "clickhouse.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/clickhouse/templates/configmap.yaml

@@ -0,0 +1,71 @@
+{{- if not .Values.config.existingConfigmap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "clickhouse.configmapName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "clickhouse.labels" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations:
+    {{- include "clickhouse.annotations" . | nindent 4 }}
+  {{- end }}
+data:
+  kubernetes.xml: |
+    <?xml version="1.0"?>
+    <clickhouse>
+      <listen_host>{{ .Values.config.listenHost }}</listen_host>
+      <http_port>{{ .Values.service.httpPort }}</http_port>
+      <tcp_port>{{ .Values.service.tcpPort }}</tcp_port>
+      <max_connections>{{ .Values.config.maxConnections }}</max_connections>
+      <max_concurrent_queries>{{ .Values.config.maxConcurrentQueries }}</max_concurrent_queries>
+      <timezone>{{ .Values.config.timezone }}</timezone>
+      <logger>
+        <level>{{ .Values.config.logLevel }}</level>
+        <console>1</console>
+      </logger>
+      {{- if .Values.config.extraConfig }}
+      {{ .Values.config.extraConfig | nindent 6 }}
+      {{- end }}
+    </clickhouse>
+{{- end }}
+---
+{{- if not .Values.config.existingUsersConfigmap }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "clickhouse.usersConfigmapName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "clickhouse.labels" . | nindent 4 }}
+  {{- if .Values.commonAnnotations }}
+  annotations:
+    {{- include "clickhouse.annotations" . | nindent 4 }}
+  {{- end }}
+data:
+  kubernetes.xml: |
+    <?xml version="1.0"?>
+    <clickhouse>
+      <users>
+        <{{ .Values.auth.username }}>
+          <password replace="replace" from_env="CLICKHOUSE_PASSWORD"></password>
+          <networks>
+            <ip>::/0</ip>
+          </networks>
+          <profile>default</profile>
+          <quota>default</quota>
+          <access_management>1</access_management>
+        </{{ .Values.auth.username }}>
+      </users>
+      {{- if gt (.Values.config.maxMemoryUsage | int) 0 }}
+      <profiles>
+        <default>
+          <max_memory_usage>{{ .Values.config.maxMemoryUsage }}</max_memory_usage>
+        </default>
+      </profiles>
+      {{- end }}
+      {{- if .Values.config.extraUsersConfig }}
+      {{ .Values.config.extraUsersConfig | nindent 6 }}
+      {{- end }}
+    </clickhouse>
+{{- end }}

charts/clickhouse/templates/extraobjects.yaml

@@ -0,0 +1,4 @@
+{{- range .Values.extraObjects }}
+---
+{{- include "cloudpirates.tplvalues.render" (dict "value" . "context" $) }}
+{{- end }}

charts/clickhouse/templates/httproute.yaml

@@ -0,0 +1,69 @@
+{{- if .Values.gatewayAPI.httpRoute.enabled -}}
+{{- $fullName := include "clickhouse.fullname" . -}}
+{{- $svcPort := .Values.service.httpPort -}}
+{{- $httpRoute := .Values.gatewayAPI.httpRoute -}}
+{{- $hostnames := $httpRoute.hostnames -}}
+{{- if not $hostnames }}
+{{- $hostnames = list -}}
+{{- range .Values.ingress.hosts -}}
+{{- $hostnames = append $hostnames .host -}}
+{{- end -}}
+{{- end -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "clickhouse.labels" . | nindent 4 }}
+  {{- $annotations := merge $httpRoute.annotations .Values.commonAnnotations }}
+  {{- with $annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs:
+    {{- range $httpRoute.parentRefs }}
+    - name: {{ .name }}
+      {{- if .namespace }}
+      namespace: {{ .namespace }}
+      {{- end }}
+      {{- if .sectionName }}
+      sectionName: {{ .sectionName }}
+      {{- end }}
+    {{- end }}
+  {{- if $hostnames }}
+  hostnames:
+    {{- range $hostnames }}
+    - {{ . | quote }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- if $httpRoute.rules }}
+    {{- range $httpRoute.rules }}
+    - {{- if .matches }}
+      matches:
+        {{- range .matches }}
+        - path:
+            type: {{ .path.type }}
+            value: {{ .path.value }}
+        {{- end }}
+      {{- end }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+    {{- end }}
+    {{- else }}
+    {{- range .Values.ingress.hosts }}
+    {{- range .paths }}
+    - matches:
+        - path:
+            type: {{ if eq .pathType "Exact" }}Exact{{ else }}PathPrefix{{ end }}
+            value: {{ .path }}
+      backendRefs:
+        - name: {{ $fullName }}
+          port: {{ $svcPort }}
+    {{- end }}
+    {{- end }}
+    {{- end }}
+{{- end }}