Move ClickHouse credentials to K8s Secret #33

New Issue

claude · 2026-03-12T21:23:08+01:00

claude commented

2026-03-12 21:23:08 +01:00

Problem

ClickHouse credentials are hardcoded in plaintext in deploy/clickhouse.yaml (CLICKHOUSE_USER=cameleer, CLICKHOUSE_PASSWORD=cameleer_dev). With the new NodePort service (30123, 30900), ClickHouse is now reachable from the network, making this a security concern.

Solution

Create a K8s Secret for ClickHouse credentials (similar to cameleer-auth secret pattern)
Update the ClickHouse StatefulSet to reference the secret via secretKeyRef
Add the secret creation to the CI deploy step (idempotent --dry-run=client | kubectl apply)
Consider also adding a NetworkPolicy to restrict ClickHouse access to known pods/IPs

Priority

High — exposed credentials on the network.

## Problem ClickHouse credentials are hardcoded in plaintext in `deploy/clickhouse.yaml` (`CLICKHOUSE_USER=cameleer`, `CLICKHOUSE_PASSWORD=cameleer_dev`). With the new NodePort service (`30123`, `30900`), ClickHouse is now reachable from the network, making this a security concern. ## Solution - Create a K8s Secret for ClickHouse credentials (similar to `cameleer-auth` secret pattern) - Update the ClickHouse StatefulSet to reference the secret via `secretKeyRef` - Add the secret creation to the CI deploy step (idempotent `--dry-run=client | kubectl apply`) - Consider also adding a NetworkPolicy to restrict ClickHouse access to known pods/IPs ## Priority High — exposed credentials on the network.

claude commented

2026-03-12 22:10:01 +01:00

Priority increased: ClickHouse is now exposed externally via NodePort (30123/30900) with plaintext credentials (cameleer/cameleer_dev) in the StatefulSet env vars. Moving to K8s Secrets should be done before any production use.

Priority increased: ClickHouse is now exposed externally via NodePort (30123/30900) with plaintext credentials (`cameleer`/`cameleer_dev`) in the StatefulSet env vars. Moving to K8s Secrets should be done before any production use.

claude commented

2026-03-13 10:57:48 +01:00

Implemented: ClickHouse credentials moved to K8s secret clickhouse-credentials. Both deploy/server.yaml and deploy/clickhouse.yaml now use secretKeyRef. CI deploy step creates the secret idempotently from CLICKHOUSE_USER and CLICKHOUSE_PASSWORD Gitea CI secrets.

Prerequisite: Add CLICKHOUSE_USER and CLICKHOUSE_PASSWORD as Gitea CI secrets before next deploy.

Implemented: ClickHouse credentials moved to K8s secret `clickhouse-credentials`. Both `deploy/server.yaml` and `deploy/clickhouse.yaml` now use `secretKeyRef`. CI deploy step creates the secret idempotently from `CLICKHOUSE_USER` and `CLICKHOUSE_PASSWORD` Gitea CI secrets. **Prerequisite:** Add `CLICKHOUSE_USER` and `CLICKHOUSE_PASSWORD` as Gitea CI secrets before next deploy.

claude closed this issue

2026-03-13 10:57:54 +01:00

claude referenced this issue from a commit

2026-03-13 10:59:20 +01:00

Move ClickHouse credentials to K8s Secret and add health probes

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cameleer/cameleer-server#33