Connecter ClickHouse à Lutril
Lutril connects to ClickHouse Cloud with an API key pair and reads your organization members with every role they hold, system and custom alike. Access is time boxed from both ends: a grant invites somebody or adds one role to a membership they already have, and the deadline removes exactly that role or the membership. The role picker is live, so the custom roles your organization defined appear alongside the built in ones instead of being hidden behind a fixed list.
Accès demandés
- control-plane:organization:view (list the organization members and its roles)
- control-plane:organization:manage (invite, add a role for a time boxed grant, remove it again, and remove a membership)
Étapes de configuration
- 1
Sign in to the ClickHouse Cloud console as an organization admin and open Organization, then API keys.
Open the ClickHouse Cloud console - 2
Create a key with the control-plane:organization:manage permission. A view only key will list members and change nothing, which reads like a broken integration rather than a missing permission.
ClickHouse Cloud API - 3
Copy the key ID and the key secret straight away. ClickHouse shows the secret once.
- 4
Find your organization ID. It is the UUID in your ClickHouse Cloud organization address.
- 5
In Lutril, connect ClickHouse and paste the key ID, the key secret and the organization ID.
- 6
To time box ClickHouse access, set the access levels on the ClickHouse app in your catalogue to the role names your organization uses. Lutril resolves a name or a role ID against the live role list, and a value that matches nothing is refused rather than quietly replaced with a default, so nobody is granted a role they did not ask for.
List available roles - 7
A grant adds exactly one role and keeps every other role the person holds. The deadline re-reads the membership and removes only the role the grant added, so a role somebody else granted inside the window survives and a role the person held before Lutril saw them is never taken away.
- 8
Lutril never writes ClickHouse's older single role field. ClickHouse deprecated it in favour of assigned role IDs and freezes it at its pre-migration value for an organization that has moved to custom roles, so writing it would be meaningless at best.
Update an organization member - 9
Removing somebody takes them out of the organization and leaves their ClickHouse account alone, so the next grant invites them back.
Où le créer
Documentation officielle
Connectez-vous à Lutril pour brancher ClickHouse, ou réservez une démo et nous le mettons en place avec vous. Sans slides.