Skip to content
This repository has been archived by the owner on Feb 6, 2024. It is now read-only.

Make profile and quotas optional for users #13

Open
amarao opened this issue May 8, 2018 · 2 comments
Open

Make profile and quotas optional for users #13

amarao opened this issue May 8, 2018 · 2 comments

Comments

@amarao
Copy link
Contributor

amarao commented May 8, 2018

Hello.

Next improvement is a bit more intrusive and I'd like to discuss it beforehand.
I want to make profile and quota optional, by using default value (clickhouse_default_user_profile=default, and clickhouse_default_user_quota=default).

Moreover, I have two more ideas:

  1. To make networks defaulting to 0.0.0.0/0 and ::/0.
  2. To use clickhouse_dbs as default for clickhouse_users_custom[user].dbs.

Is it OK or it's too daring and insecure?

My goal is to have a very small config for initial use:

    clickhouse_dbs:
     - name: somedatabase
    clickhouse_users_custom:
     - name: someuser
       password: somepassword
@AlexeySetevoi
Copy link
Owner

AlexeySetevoi commented May 8, 2018

Hi, Amarao. Thanks for your contribution. Thanks for discussing first :)
About using default profile and quota - i think this usefull, no any problem.

About defaulting 0.0.0.0/0 and ::/0:
My cons:

  • Default behaviour of clickhouse(out-of-box) - listen only localhost and localhost6. This expected behaviour, and expected user expirience from main product, and addons(like this role) must not break it.

  • I think this is totaly insecure. All we remember about open mysql, mongo and other unpassworded software on default ports. I think its important dont extend security impact field. Any expirienced user can redefine 1 time in playbook clickhouse_listen_host_default var and use listen 0.0.0.0/0 default behaviour.

About clickhouse_dbs - you want create on every database same user?

@amarao
Copy link
Contributor Author

amarao commented May 9, 2018

  1. Thanks, I'll send PR shortly.
  2. You are right. How about defaulting user.networks to clickhouse_listen_host_custom if it is defined, and to localhost (0/0, ::/0) if no?
  3. After some thoughts: may be we can default to database with the name equal to username?

My goal is to make list of variables as small as possible by providing reasonable defaults.

amarao added a commit to amarao/ansible-clickhouse that referenced this issue May 9, 2018
Now clickhouse_default_user_profile and clickhouse_default_user_quota
are used if any user in clickhouse_users_custom have profile or quota
field specified.

Those values are set to 'default' which corresponds to default
values for clickhouse: default quota, default profile.
Example of a shorter user definition:

 clickhouse_users_custom:
  - name: "someuser",
    password: "somepassword",
    networks:
     - 192.168.0.0/24
     - 10.0.0.0/8
    dbs:
     somedatabase:

Partially-closes: AlexeySetevoi#13
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants