Configuring Endpoint Connections

The Endpoint Connections Configuration dialog makes it easy to configure your ClickHouse cluster’s connections to the world:

Figure 1 - The Endpoint Connections Configuration dialog

Here are the details of these fields:

Endpoints

This are the endpoints of your cluster. The public endpoint is enabled by default, but you can also have a private endpoint and a VPC endpoint. Contact Altinity support to configure a private or VPC endpoint.

Protocols

Port 9440 enables the ClickHouse binary protocol and port 8443 enables HTTP connections. Clicking the icon displays a message with the requirements for opening a port for MySQL connections:

Figure 2 - Requirements for opening a port for MySQL connections

If MySQL connections are available, the checkbox will be active. Selecting it gives you a dropdown list of available ports:

Figure 3 - Activating a MySQL connection and selecting a port

NOTE: Within your environment, you must use a different port for each cluster with a MySQL connection. The dropdown list of ports will only show the unused (aka available) ports.

Alternate Endpoints

You can define alternate endpoints for your cluster. Click the button to add a new endpoint. The name of the alternate endpoint can contain lowercase letters, numbers, and hyphens. It must start with a letter, and it cannot end with a hyphen.

Figure 4 – Defining Alternate Endpoints

The first alternate endpoint in Figure 4 is managed by Altinity. The default public endpoint for your cluster is cluster-name.environment-name.altinity.cloud. You can also define an alternate endpoint named <whatever>.environment-name.altinity.cloud. When you save your changes, mydata.sample-envt.altinity.com is another endpoint for your cluster.

You can also create an endpoint that uses your organization’s domain, such as sales-data.example.com instead ofsample-cluster.sample-envt.altinity.cloud as shown in Figure 1 above. You can then use that endpoint as the ClickHouse access point in your applications. With that approach, pointing the alternate endpoint to another cluster lets you switch the cluster your applications are using without changing the applications at all.

Altinity needs to generate a certificate for any alternate endpoint it doesn’t manage. The first step in the process is to create the appropriate DNS records in your domain. Given an alternate endpoint of sales-data.example.com and an Altinity.Cloud endpoint of sample-cluster.sample-envt.altinity.cloud, you’ll need these records:

• Required, define the endpoint itself: CNAME sales-data.example.com. sample-cluster.sample-envt.altinity.cloud Notice that this record contains the name of the cluster; the other records do not.
• Required, define the ACME challenge record: CNAME _acme-challenge.example.com. sample-envt.altinity.cloud
• Optional, used by the public load balancer: CNAME *.example.com. _.sample-envt.altinity.cloud
• Optional, used by the internal load balancer: CNAME *.internal.example.com. _.internal.sample-envt.altinity.cloud
• Optional, used by VCPE: CNAME *.vcpe.example.com. _.vcpe.sample-envt.altinity.cloud

Once you define these records in your domain, it will take some time for those records to become effective, and it will take some time for Altinity.Cloud to generate the certificate for the alternate endpoint. Contact Altinity Support if you have any issues getting the new endpoint to work.

The Health check checkbox tells the ACM whether it should try to connect to ClickHouse via that endpoint as part of its health checks. The checkbox is disabled for endpoints managed by Altinity (mydata.sample-envt.altinity.cloud in Figure 4); for endpoints that use other domains, you have the option of including that endpoint as a health check. If anything is wrong for a given endpoint (including the temporary problem of DNS records and certificates that haven’t been propagated and generated yet), that health check will fail when you first save the new endpoint:

Figure 5 - A failing health check on an alternate endpoint

Once a certificate has been generated for the alternate endpoint, the health check will pass.

Zone Awareness

When Zone Awareness is enabled, Altinity.Cloud keeps traffic between client connections and your ClickHouse cluster in a single availability zone whenever possible. This allows you to avoid cross-zone hops.

However, if all of your client connections come from a single zone, this feature will route all requests to a single ClickHouse node. In that case, turning Zone Awareness off will ensure that your load balancer will distribute requests across all the nodes in the cluster.

Allowed IPs

If enabled, only ClickHouse applications or clients coming from addresses in the IP restrictions text box can connect to your cluster. You can specify individual IP address or ranges of addresses in CIDR format. Separate each entry with commas or newlines. You can also define your list of allowed IPs by clicking the button to upload a text or CSV file, or you can drag and drop a .txt or .csv file onto the dialog.

Disabling IP restrictions means any application can connect to your ClickHouse cluster from any IP address. This is not recommended.

NOTE: The Allowed IPs restriction only applies to ClickHouse applications or clients. Anyone with the proper credentials can access the Altinity Cloud Manager UI from any IP address.

Datadog Integration

You can use Datadog to monitor your ClickHouse cluster. The Datadog options are only enabled if your cluster’s environment is enabled for Datadog support. See the section Enabling Datadog at the environment level for the details. Be aware that you must have the appropriate privileges to edit an environment’s settings, so you may need to contact your administrator.