SECURITY · VAULT PLUGIN
ClickVault
HashiCorp Vault database secrets engine plugin for ClickHouse. Dynamic credentials, password rotation, cluster-aware DDL.
Creates short-lived ClickHouse users on demand and rotates passwords on a schedule. Handles cluster-aware DDL with ON CLUSTER insertion.
Problem
ClickHouse lacks native dynamic credential support in Vault's database secrets engine. Teams managing ClickHouse clusters need short-lived credentials and automated password rotation without manual intervention.
Why it's hard
ClickHouse clusters use distributed DDL (ON CLUSTER) which most Vault plugins don't handle. Dynamic user creation must be atomic: if grants fail, the partially-created user must be cleaned up. Password rotation must work across replicated and non-replicated engines. The plugin must implement Vault's dbplugin.Database interface correctly while handling ClickHouse-specific syntax differences.
Security model
Key decisions
Cluster-aware DDL
ON CLUSTER insertion ensures DDL propagates across the ClickHouse cluster. Handles both Replicated and non-Replicated engine tables.
Privilege verification
Connection verification checks that the service account has the required privileges before accepting configuration.
Cleanup on failure
If user creation partially succeeds (e.g., grants fail), the plugin cleans up the partially-created user to avoid orphaned accounts.