Install the ClickHouse Operator with Helm

This guide covers installing the ClickHouse Operator using Helm charts.

This guide covers installing the ClickHouse Operator using Helm charts.

Prerequisites

• Kubernetes cluster v1.28.0 or later
• Helm v3.0 or later
• kubectl configured to communicate with your cluster

Install Helm

If you don’t have Helm installed:

curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

Verify installation:

helm version

Install the Operator

By default Helm chart deploys ClickHouse Operator with webhooks enabled and requires cert-manager installed.

helm install cert-manager oci://quay.io/jetstack/charts/cert-manager -n cert-manager --create-namespace --set crds.enabled=true

From OCI Helm repository

Install the latest release

    helm install clickhouse-operator oci://ghcr.io/clickhouse/clickhouse-operator-helm \
       --create-namespace \
       -n clickhouse-operator-system

Install a specific operator version

    helm install clickhouse-operator oci://ghcr.io/clickhouse/clickhouse-operator-helm \
       --create-namespace \
       -n clickhouse-operator-system \
       --set manager.image.tag=<operator version>

From Local Chart

Clone the repository and install from the local chart:

git clone https://github.com/ClickHouse/clickhouse-operator.git
cd clickhouse-operator
helm install clickhouse-operator ./dist/chart

Watch specific namespaces

By default the operator watches all namespaces. Set controller.watchNamespaces to limit it. Entries are rendered as templates, so {{ .Release.Namespace }} resolves to the release namespace and can be combined with static namespaces:

controller:
  watchNamespaces:
    - "{{ .Release.Namespace }}"
    - team-a

On the command line, --set parses braces as list syntax, so use --set-json (Helm v3.10 or later): --set-json 'controller.watchNamespaces=["{{ .Release.Namespace }}"]'.

To watch only the release namespace with namespace-scoped RBAC:

controller:
  watchNamespaces:
    - "{{ .Release.Namespace }}"
rbac:
  namespaced: true

With rbac.namespaced: true the manager’s permissions become a Role/RoleBinding in the release namespace, so watching other namespaces requires cluster-scoped RBAC (the default).

Configuration options

For advanced configuration options, refer to the values.yaml file in the Helm chart