ClickHouse user for Renta

Renta signs in to ClickHouse as a regular user and works only inside the database you specify in the connection. This page lists the privileges that account needs and the statements that grant them.

Run the statements from an account that has access management rights, such as the cluster admin. In a managed service, create the user in the provider console first and then grant privileges over SQL.

What Renta runs in your database

Every privilege below maps to a statement the connector issues during a pipeline run.

Create the user

Pick a name and a password, and create the account.

CREATE USER renta IDENTIFIED WITH sha256_password BY 'your-strong-password';

Use the same name and password in the User and Password fields of the ClickHouse connection in Renta.

Grant privileges in the database

Renta creates and rewrites its own tables, so grant the table privileges on the database that the connection points to.

GRANT
    SELECT,
    INSERT,
    ALTER TABLE,
    CREATE TABLE,
    DROP TABLE,
    TRUNCATE
ON default.*
TO renta;

Replace default with your database. A grant on the whole database covers the tables of every pipeline you add later.

To keep the account narrower, grant the same set on each destination table by name. Take the names from the Table name field of every pipeline that writes into this database.

GRANT
    SELECT,
    INSERT,
    ALTER TABLE,
    CREATE TABLE,
    DROP TABLE,
    TRUNCATE
ON default.renta_sessions
TO renta;

GRANT
    SELECT,
    INSERT,
    ALTER TABLE,
    CREATE TABLE,
    DROP TABLE,
    TRUNCATE
ON default.renta_events
TO renta;

Allow reading from Renta storage

Renta writes the extracted rows as Parquet files and loads them with the url table function, so the account also needs two global privileges.

GRANT
    CREATE TEMPORARY TABLE,
    URL
ON *.*
TO renta;

ClickHouse 25.7 and newer renamed the source privileges. On those versions, grant the reading right explicitly.

GRANT READ ON URL TO renta;

The server itself must also be allowed to reach the storage host. If the config contains a remote_url_allow_hosts section, add storage.googleapis.com to it.

<remote_url_allow_hosts>
    <host>storage.googleapis.com</host>
</remote_url_allow_hosts>

Check the result

Read back what the account holds before you create the connection.

SHOW GRANTS FOR renta;

Then open the ClickHouse destination page in Renta and click Save on the connection form. Renta runs a test query against the database and reports a permission problem immediately.