Skip to content

clickhouse

import "vault-plugin-database-clickhouse"

Package clickhouse implements a HashiCorp Vault database secrets plugin for ClickHouse.

The plugin creates and rotates database users from Vault role statements. Cluster names for ON CLUSTER DDL come from Vault config or from system.clusters.

Index

Constants

Plugin and Vault database config keys.

const (
    // TypeName is the name passed to vault plugin register.
    TypeName = "clickhouse"
    // ConfigKeyCluster is the optional Vault database config key for ON CLUSTER DDL.
    ConfigKeyCluster = "cluster"
    // ConfigKeyUsernameTemplate is the optional Vault username template key.
    ConfigKeyUsernameTemplate = "username_template"
    // DefaultChangePasswordStatement is used when UpdateUser password statements are empty.
    DefaultChangePasswordStatement = "ALTER USER '{{username}}' IDENTIFIED WITH plaintext_password BY '{{password}}' ON CLUSTER '{{cluster}}';"
    // DefaultChangeExpirationStatement is used when UpdateUser expiration statements are empty.
    DefaultChangeExpirationStatement = "ALTER USER '{{username}}' VALID UNTIL '{{expiration}}' ON CLUSTER '{{cluster}}';"
    // ExpirationFormat is the ClickHouse VALID UNTIL timestamp layout.
    ExpirationFormat = "2006-01-02 15:04:05"
    // DefaultUserNameTemplate generates Vault dynamic usernames when none is configured.
    DefaultUserNameTemplate = `{{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 8) (.RoleName | truncate 8) (random 20) (unix_time) | truncate 63 }}`
)

func New

func New() (interface{}, error)

New returns a Vault database plugin backed by ClickHouse.

type Clickhouse

Clickhouse implements dbplugin.Database for ClickHouse.

type Clickhouse struct {
    *connutil.SQLConnectionProducer
    // contains filtered or unexported fields
}

func (*Clickhouse) DeleteUser

func (p *Clickhouse) DeleteUser(ctx context.Context, req dbplugin.DeleteUserRequest) (dbplugin.DeleteUserResponse, error)

DeleteUser drops a user with custom revocation statements or the built-in DROP USER path.

func (*Clickhouse) Initialize

func (p *Clickhouse) Initialize(ctx context.Context, req dbplugin.InitializeRequest) (dbplugin.InitializeResponse, error)

Initialize parses config, opens the admin connection, and stores cluster and username settings.

func (*Clickhouse) NewUser

func (p *Clickhouse) NewUser(ctx context.Context, req dbplugin.NewUserRequest) (dbplugin.NewUserResponse, error)

NewUser runs creation statements and returns the generated Vault username.

func (*Clickhouse) Type

func (p *Clickhouse) Type() (string, error)

Type reports the plugin name registered with Vault.

func (*Clickhouse) UpdateUser

func (p *Clickhouse) UpdateUser(ctx context.Context, req dbplugin.UpdateUserRequest) (dbplugin.UpdateUserResponse, error)

UpdateUser changes password and/or expiration for an existing ClickHouse user.

Generated by gomarkdoc