ClickVault
HashiCorp Vault database secrets engine plugin for ClickHouse. Dynamic credentials, password rotation, cluster-aware DDL.
Creates short-lived ClickHouse users on demand and rotates passwords on a schedule.
Source lines
1,017
Test lines
979
Codecov
85.4%
CI enforced
YES
Problem
ClickHouse lacks native dynamic credential support in Vault's database secrets engine. Teams managing ClickHouse clusters need short-lived credentials and automated password rotation without manual intervention.
Why it's hard
ClickHouse clusters use distributed DDL (ON CLUSTER) which most Vault plugins don't handle. Dynamic user creation must be atomic: if grants fail, the partially-created user must be cleaned up. Password rotation must work across replicated and non-replicated engines. The plugin must implement Vault's dbplugin.Database interface correctly while handling ClickHouse-specific syntax differences.
Security model
Key decisions
Cluster-aware DDL
ON CLUSTER insertion ensures DDL propagates across the cluster. Handles both Replicated and non-Replicated engine tables.
Privilege verification
Connection verification checks that the service account has the required privileges before accepting configuration.
Cleanup on failure
If user creation partially succeeds (for example grants fail), the plugin removes the partially-created user to avoid orphaned accounts.