All settings on this page are optional — the defaults produce a working deployment. Set them as inputs to the Terraform module.

Data retention (TTL)

ClickHouse retains trace data for a fixed window, after which old data is dropped automatically.

ClickHouse users

The platform provisions a least-privilege ClickHouse user model — one SQL user per access path, each scoped to exactly the operations it performs:

schema_owner, otel, llm_worker, and monte_carlo are always provisioned. readonly_user and admin are opt-in.

Each user's password is generated by the module and stored in AWS Secrets Manager (KMS-encrypted), then synced into the cluster by the External Secrets Operator. Each user has its own secret, exposed as a clickhouse_<user>_credentials_secret_arn output.

Read-only user

To provision the optional readonly_user (SELECT-only, profile readonly_settings with readonly = 2 — SELECT plus per-session SET, so JDBC clients such as DataGrip connect cleanly):

helm = {
  chart_registry = "oci://registry-1.docker.io/montecarlodata"
  chart_version  = "2.0.0"

  clickhouse = {
    readonly_user = {
      enabled = true
      # password = "..."  # optional; omit to auto-generate
    }
  }
}

Its password ARN is exposed as the clickhouse_readonly_user_credentials_secret_arn output.

Ingest user lock-down

otel defaults to read/write so the migration to the monte_carlo user is non-breaking. After Monte Carlo connects as monte_carlo (see Connect to Monte Carlo), set clickhouse.otel.restrict_grants = true (chart >= 2.0.0) to tighten otel to INSERT-only on the telemetry source tables. Normalization keeps working because the materialized views run as schema_owner, not otel.

Break-glass admin user

The admin superuser is opt-in and, by default, reachable only over loopback (pod-exec) — it is never on a network path. Enable it for break-glass DBA access:

helm = {
  chart_registry = "oci://registry-1.docker.io/montecarlodata"
  chart_version  = "2.0.0"

  clickhouse = {
    admin = {
      enabled = true
      # password = "..."  # optional; omit to auto-generate
    }
  }
}

Its password ARN is exposed as the clickhouse_admin_credentials_secret_arn output (null when disabled). Requires chart version >= 2.0.0.

Resource sizing

Each managed workload exposes optional Kubernetes resource requests/limits via helm.<workload>.resources. Omit a workload (or a requests/limits map) to use the chart defaults — start modest in development and tune up for production.

helm = {
  chart_registry = "oci://registry-1.docker.io/montecarlodata"
  chart_version  = "2.0.0"

  clickhouse = {
    resources = {
      requests = { cpu = "2", memory = "8Gi" }
      limits   = { cpu = "4", memory = "16Gi" }
    }
  }
  opentelemetry_collector = {
    resources = {
      requests = { memory = "2Gi" }
      limits   = { memory = "6Gi" }
    }
  }
  llm_worker = {
    resources = {
      requests = { cpu = "500m", memory = "1Gi" }
      limits   = { cpu = "2", memory = "4Gi" }
    }
  }
}

requests and limits are maps keyed by Kubernetes resource name (cpu, memory, ephemeral-storage, etc.); either can be omitted independently.

Node groups (new-cluster path)

On the new-cluster path, you can size the node groups the workloads run on:

Storage

ClickHouse data is stored on an EBS-backed persistent volume.

Network access

By default the ClickHouse and OpenTelemetry Collector Network Load Balancers are internal, but accept traffic from any source that can route to them. Restrict the source ranges to harden access:

TLS

TLS is enabled by default. The OpenTelemetry Collector and ClickHouse NLB endpoints are TLS-terminated using ACM certificates that the module provisions for your otel_collector_domain and clickhouse_domain. Traffic between the Collector and ClickHouse inside the cluster is secured with certificates issued by cert-manager.

Evaluation (Amazon Bedrock)

The LLM worker invokes models through Amazon Bedrock. By default it targets your deployment region.