Secure a Managed ClickHouse® service
You can secure your Managed ClickHouse® service in a few different ways, for example by restricting network access and enabling service termination protection.
Restrict network access to your service
One of the most fundamental ways to keep your service secure is managing its network access properly. Access is controlled by the service IP filter, which lists the CIDR blocks allowed to connect. Set it when you create the service, or update it at any time:
echo '{"ip-filter":["203.0.113.0/24"]}' | \
exo x update-dbaas-service-clickhouse my-clickhouse -z ch-gva-2Read the current filter back with:
exo x get-dbaas-service-clickhouse my-clickhouse -z ch-gva-2 -q '"ip-filter"'Note
The IP filter applies to every interface of the service, including the Prometheus scrape endpoint. A connection from an address that is not allowed times out rather than returning an authentication error.
Protect a service from termination
Exoscale services can be protected against accidental deletion or powering off by enabling the Termination Protection feature.
echo '{"termination-protection":true}' | \
exo x update-dbaas-service-clickhouse my-clickhouse -z ch-gva-2Note
Termination Protection has no effect on service migrations or upgrades.
Terminate a protected service
Before terminating a protected service, disable Termination Protection for this service:
echo '{"termination-protection":false}' | \
exo x update-dbaas-service-clickhouse my-clickhouse -z ch-gva-2Note
Running out of free Exoscale sign-up credits stops your services unless a payment method has been added to your Exoscale organization.