All settings on this page are optional — the defaults produce a working deployment. Set them as inputs to the Terraform module.

Data retention (TTL)

ClickHouse retains trace data for a fixed window, after which old data is dropped automatically.

ClickHouse users

The platform provisions these ClickHouse SQL users:

Each user's password is generated by the module and stored in AWS Secrets Manager (KMS-encrypted), then synced into the cluster by the External Secrets Operator.

Read-only user

To provision the optional readonly_user (SELECT-only, profile readonly_settings with readonly = 2 — SELECT plus per-session SET, so JDBC clients such as DataGrip connect cleanly):

helm = {
  chart_registry = "oci://registry-1.docker.io/montecarlodata"
  chart_version  = "1.5.0"

  clickhouse = {
    readonly_user = {
      enabled = true
      # password = "..."  # optional; omit to auto-generate
    }
  }
}

Its password ARN is exposed as the clickhouse_readonly_user_credentials_secret_arn output.

Resource sizing

Each managed workload exposes optional Kubernetes resource requests/limits via helm.<workload>.resources. Omit a workload (or a requests/limits map) to use the chart defaults — start modest in development and tune up for production.

helm = {
  chart_registry = "oci://registry-1.docker.io/montecarlodata"
  chart_version  = "1.5.0"

  clickhouse = {
    resources = {
      requests = { cpu = "2", memory = "8Gi" }
      limits   = { cpu = "4", memory = "16Gi" }
    }
  }
  opentelemetry_collector = {
    resources = {
      requests = { memory = "2Gi" }
      limits   = { memory = "6Gi" }
    }
  }
  llm_worker = {
    resources = {
      requests = { cpu = "500m", memory = "1Gi" }
      limits   = { cpu = "2", memory = "4Gi" }
    }
  }
}

requests and limits are maps keyed by Kubernetes resource name (cpu, memory, ephemeral-storage, etc.); either can be omitted independently.

Node groups (new-cluster path)

On the new-cluster path, you can size the node groups the workloads run on:

Storage

ClickHouse data is stored on an EBS-backed persistent volume.

Network access

By default the ClickHouse and OpenTelemetry Collector Network Load Balancers are internal, but accept traffic from any source that can route to them. Restrict the source ranges to harden access:

TLS

TLS is enabled by default. The OpenTelemetry Collector and ClickHouse NLB endpoints are TLS-terminated using ACM certificates that the module provisions for your otel_collector_domain and clickhouse_domain. Traffic between the Collector and ClickHouse inside the cluster is secured with certificates issued by cert-manager.

Evaluation (Amazon Bedrock)

The LLM worker invokes models through Amazon Bedrock. By default it targets your deployment region.