05-settings-08-grants.yaml

apiVersion: clickhouse.altinity.com/v1
kind: ClickHouseInstallation
metadata:
  name: grants-example
spec:
  configuration:
    users:
      myuser/profile: readonly
      myuser/grants/query:
      # you can't combine `allow_databases` with `GRANT ... canarydb.*`
      - "GRANT SELECT,INSERT,ALTER,CREATE,DROP,TRUNCATE,OPTIMIZE,SHOW,dictGet,REMOTE ON *.*"
      myuser/allow_databases/database:
        - "canarydb"
      myuser2/profile: default
      myuser2/grants/query:
        - "GRANT limited_role"
    files:
      users.d/limited_role.xml:
        <clickhouse>
          <roles>
            <limited_role>
              <grants>
                <query>REVOKE ALL ON *.*</query>
                <query>GRANT SELECT,INSERT,ALTER,CREATE,DROP,TRUNCATE,OPTIMIZE,SHOW,dictGet ON db1.*</query>
                <query>GRANT SELECT,INSERT,ALTER,CREATE,DROP,TRUNCATE,OPTIMIZE,SHOW,dictGet ON db2.*</query>
                <query>GRANT SELECT,INSERT,ALTER,CREATE,DROP,TRUNCATE,OPTIMIZE,SHOW,dictGet ON db3.*</query>
                <query>GRANT SELECT,SHOW,dictGet,REMOTE ON *.*</query>
              </grants>
            </limited_role>
          </roles>
        </clickhouse>