Skip to content

Commit e2e7e33

Browse files
matt-aitkenmatt-aitken
committed
fix(hosting): deploy ClickHouse from the official image instead of Bitnami
The Bitnami free image catalog is EOL and its frozen bitnamilegacy archive tops out at ClickHouse 25.7.5, below the 25.8 floor the platform requires since v4.5.0. The Docker Compose stack and the Helm chart now run the official clickhouse/clickhouse-server image at 26.2, the same version the platform is developed and tested against. The Helm chart deploys ClickHouse with a chart-owned StatefulSet instead of the Bitnami subchart.
1 parent 6e943f2 commit e2e7e33

11 files changed

Lines changed: 227 additions & 37 deletions

File tree

‎docs/self-hosting/docker.mdx‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,8 @@ TRIGGER_IMAGE_TAG=v4.5.0
344344
345345
We patch the latest released version line only, so keep an eye on new releases to receive security fixes. See [Security & vulnerability reporting](/self-hosting/security).
346346
347+
You can also lock the versions of the bundled services, for example with `CLICKHOUSE_IMAGE_TAG`. If you do, or if you bring your own ClickHouse via `CLICKHOUSE_URL`, note that Trigger.dev requires ClickHouse 25.8 or newer.
348+
347349
<Note>
348350
Trigger.dev 4.5.0 is the last version we officially support for running v3 (SDK v3) tasks. If
349351
you still have v3 tasks, pin `TRIGGER_IMAGE_TAG` to exactly `v4.5.0` or [migrate to

‎docs/self-hosting/kubernetes.mdx‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,14 +257,16 @@ redis:
257257
258258
#### ClickHouse
259259
260+
<Note>Trigger.dev requires ClickHouse 25.8 or newer.</Note>
261+
260262
**Direct configuration:**
261263
262264
```yaml
263265
clickhouse:
264266
deploy: false
265267
external:
266268
host: "my-clickhouse.example.com"
267-
port: 8123
269+
httpPort: 8123
268270
username: "my-username"
269271
password: "my-password"
270272
```
@@ -276,7 +278,7 @@ clickhouse:
276278
deploy: false
277279
external:
278280
host: "my-clickhouse.example.com"
279-
port: 8123
281+
httpPort: 8123
280282
username: "my-username"
281283
existingSecret: "clickhouse-credentials"
282284
# existingSecretKey: "clickhouse-password" # default (optional)

‎hosting/docker/.env.example‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ OBJECT_STORE_SECRET_ACCESS_KEY=very-safe-password
128128
# POSTGRES_IMAGE_TAG=14
129129
# REDIS_IMAGE_TAG=7
130130
# ELECTRIC_IMAGE_TAG=1.0.13
131-
# CLICKHOUSE_IMAGE_TAG=latest
131+
# CLICKHOUSE_IMAGE_TAG=26.2
132132
# REGISTRY_IMAGE_TAG=2
133133
# MINIO_IMAGE_TAG=latest
134134
# DOCKER_PROXY_IMAGE_TAG=latest

‎hosting/docker/webapp/docker-compose.yml‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -155,18 +155,23 @@ services:
155155
start_period: 10s
156156

157157
clickhouse:
158-
image: bitnamilegacy/clickhouse:${CLICKHOUSE_IMAGE_TAG:-latest}
158+
image: clickhouse/clickhouse-server:${CLICKHOUSE_IMAGE_TAG:-26.2}
159159
restart: ${RESTART_POLICY:-unless-stopped}
160160
logging: *logging-config
161161
ports:
162162
- ${CLICKHOUSE_PUBLISH_IP:-127.0.0.1}:9123:8123
163163
- ${CLICKHOUSE_PUBLISH_IP:-127.0.0.1}:9090:9000
164+
ulimits:
165+
nofile:
166+
soft: 262144
167+
hard: 262144
164168
environment:
165-
CLICKHOUSE_ADMIN_USER: ${CLICKHOUSE_USER:-default}
166-
CLICKHOUSE_ADMIN_PASSWORD: ${CLICKHOUSE_PASSWORD:-password}
169+
CLICKHOUSE_USER: ${CLICKHOUSE_USER:-default}
170+
CLICKHOUSE_PASSWORD: ${CLICKHOUSE_PASSWORD:-password}
171+
CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
167172
volumes:
168-
- clickhouse:/bitnami/clickhouse
169-
- ../clickhouse/override.xml:/bitnami/clickhouse/etc/config.d/override.xml:ro
173+
- clickhouse-data:/var/lib/clickhouse
174+
- ../clickhouse/override.xml:/etc/clickhouse-server/config.d/override.xml:ro
170175
networks:
171176
- webapp
172177
healthcheck:
@@ -284,7 +289,7 @@ services:
284289
- webapp
285290

286291
volumes:
287-
clickhouse:
292+
clickhouse-data:
288293
postgres:
289294
redis:
290295
shared:

‎hosting/k8s/helm/Chart.lock‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,8 @@ dependencies:
55
- name: redis
66
repository: oci://registry-1.docker.io/bitnamicharts
77
version: 21.2.6
8-
- name: clickhouse
9-
repository: oci://registry-1.docker.io/bitnamicharts
10-
version: 9.4.4
118
- name: minio
129
repository: oci://registry-1.docker.io/bitnamicharts
1310
version: 17.0.9
14-
digest: sha256:e1b572ab8eca0cc376311398c27b1734d8a598095fccc81dd9c32b2c8b9c1149
15-
generated: "2026-05-05T10:31:58.493590751+01:00"
11+
digest: sha256:a735954c8b78fcf5b30689bdcdfed66b9be57135368ea696aff2b52ecd731474
12+
generated: "2026-07-13T16:36:15.800113+01:00"

‎hosting/k8s/helm/Chart.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,6 @@ dependencies:
2626
version: "21.2.6"
2727
repository: "oci://registry-1.docker.io/bitnamicharts"
2828
condition: redis.deploy
29-
- name: clickhouse
30-
version: "9.4.4"
31-
repository: "oci://registry-1.docker.io/bitnamicharts"
32-
condition: clickhouse.deploy
3329
- name: minio
3430
version: "17.0.9"
3531
repository: "oci://registry-1.docker.io/bitnamicharts"

‎hosting/k8s/helm/templates/_helpers.tpl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -415,7 +415,7 @@ ClickHouse hostname
415415
{{- if .Values.clickhouse.host }}
416416
{{- .Values.clickhouse.host }}
417417
{{- else if .Values.clickhouse.deploy }}
418-
{{- printf "%s-clickhouse" .Release.Name }}
418+
{{- printf "%s-clickhouse" (include "trigger-v4.fullname" .) }}
419419
{{- end }}
420420
{{- end }}
421421

@@ -439,7 +439,7 @@ hex-encoded password or percent-encode before storing in the Secret.
439439
{{- if .Values.clickhouse.deploy -}}
440440
{{- $protocol := ternary "https" "http" .Values.clickhouse.secure -}}
441441
{{- $secure := ternary "true" "false" .Values.clickhouse.secure -}}
442-
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:{{ .Values.clickhouse.auth.password }}@{{ include "trigger-v4.clickhouse.hostname" . }}:8123?secure={{ $secure }}
442+
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:{{ .Values.clickhouse.auth.password }}@{{ include "trigger-v4.clickhouse.hostname" . }}:{{ .Values.clickhouse.service.ports.http }}?secure={{ $secure }}
443443
{{- else if .Values.clickhouse.external.host -}}
444444
{{- $protocol := ternary "https" "http" .Values.clickhouse.external.secure -}}
445445
{{- $secure := ternary "true" "false" .Values.clickhouse.external.secure -}}
@@ -460,7 +460,7 @@ applies to the replication URL.
460460
{{- define "trigger-v4.clickhouse.replication.url" -}}
461461
{{- if .Values.clickhouse.deploy -}}
462462
{{- $protocol := ternary "https" "http" .Values.clickhouse.secure -}}
463-
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:{{ .Values.clickhouse.auth.password }}@{{ include "trigger-v4.clickhouse.hostname" . }}:8123
463+
{{ $protocol }}://{{ .Values.clickhouse.auth.username }}:{{ .Values.clickhouse.auth.password }}@{{ include "trigger-v4.clickhouse.hostname" . }}:{{ .Values.clickhouse.service.ports.http }}
464464
{{- else if .Values.clickhouse.external.host -}}
465465
{{- $protocol := ternary "https" "http" .Values.clickhouse.external.secure -}}
466466
{{- if .Values.clickhouse.external.existingSecret -}}

‎hosting/k8s/helm/templates/clickhouse.yaml‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
{{- if .Values.clickhouse.deploy }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ include "trigger-v4.fullname" . }}-clickhouse-config
6+
labels:
7+
{{- $component := "clickhouse" }}
8+
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
9+
data:
10+
{{- range $filename, $content := .Values.clickhouse.configdFiles }}
11+
{{ $filename }}: |
12+
{{- $content | nindent 4 }}
13+
{{- end }}
14+
---
15+
apiVersion: apps/v1
16+
kind: StatefulSet
17+
metadata:
18+
name: {{ include "trigger-v4.fullname" . }}-clickhouse
19+
labels:
20+
{{- $component := "clickhouse" }}
21+
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
22+
spec:
23+
replicas: 1
24+
serviceName: {{ include "trigger-v4.fullname" . }}-clickhouse
25+
selector:
26+
matchLabels:
27+
{{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 6 }}
28+
template:
29+
metadata:
30+
annotations:
31+
checksum/config: {{ .Values.clickhouse.configdFiles | toYaml | sha256sum }}
32+
{{- with .Values.clickhouse.podAnnotations }}
33+
{{- toYaml . | nindent 8 }}
34+
{{- end }}
35+
labels:
36+
{{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 8 }}
37+
spec:
38+
{{- with .Values.global.imagePullSecrets }}
39+
imagePullSecrets:
40+
{{- toYaml . | nindent 8 }}
41+
{{- end }}
42+
{{- with .Values.clickhouse.podSecurityContext }}
43+
securityContext:
44+
{{- toYaml . | nindent 8 }}
45+
{{- end }}
46+
containers:
47+
- name: clickhouse
48+
{{- with .Values.clickhouse.securityContext }}
49+
securityContext:
50+
{{- toYaml . | nindent 12 }}
51+
{{- end }}
52+
image: "{{ .Values.global.imageRegistry | default .Values.clickhouse.image.registry }}/{{ .Values.clickhouse.image.repository }}:{{ .Values.clickhouse.image.tag }}{{ with .Values.clickhouse.image.digest }}@{{ . }}{{ end }}"
53+
imagePullPolicy: {{ .Values.clickhouse.image.pullPolicy }}
54+
env:
55+
- name: CLICKHOUSE_USER
56+
value: {{ .Values.clickhouse.auth.username | quote }}
57+
- name: CLICKHOUSE_PASSWORD
58+
value: {{ .Values.clickhouse.auth.password | quote }}
59+
- name: CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT
60+
value: "1"
61+
ports:
62+
- name: http
63+
containerPort: 8123
64+
protocol: TCP
65+
- name: native
66+
containerPort: 9000
67+
protocol: TCP
68+
{{- if .Values.clickhouse.livenessProbe.enabled }}
69+
livenessProbe:
70+
httpGet:
71+
path: /ping
72+
port: http
73+
initialDelaySeconds: {{ .Values.clickhouse.livenessProbe.initialDelaySeconds }}
74+
periodSeconds: {{ .Values.clickhouse.livenessProbe.periodSeconds }}
75+
timeoutSeconds: {{ .Values.clickhouse.livenessProbe.timeoutSeconds }}
76+
failureThreshold: {{ .Values.clickhouse.livenessProbe.failureThreshold }}
77+
successThreshold: {{ .Values.clickhouse.livenessProbe.successThreshold }}
78+
{{- end }}
79+
{{- if .Values.clickhouse.readinessProbe.enabled }}
80+
readinessProbe:
81+
httpGet:
82+
path: /ping
83+
port: http
84+
initialDelaySeconds: {{ .Values.clickhouse.readinessProbe.initialDelaySeconds }}
85+
periodSeconds: {{ .Values.clickhouse.readinessProbe.periodSeconds }}
86+
timeoutSeconds: {{ .Values.clickhouse.readinessProbe.timeoutSeconds }}
87+
failureThreshold: {{ .Values.clickhouse.readinessProbe.failureThreshold }}
88+
successThreshold: {{ .Values.clickhouse.readinessProbe.successThreshold }}
89+
{{- end }}
90+
resources:
91+
{{- toYaml .Values.clickhouse.resources | nindent 12 }}
92+
volumeMounts:
93+
- name: data
94+
mountPath: /var/lib/clickhouse
95+
- name: logs
96+
mountPath: /var/log/clickhouse-server
97+
{{- /* Mount each override file individually: shadowing the whole
98+
config.d directory would remove the image's built-in
99+
docker_related_config.xml, which makes the server listen on
100+
0.0.0.0 instead of localhost only. */}}
101+
{{- range $filename, $_ := .Values.clickhouse.configdFiles }}
102+
- name: config
103+
mountPath: /etc/clickhouse-server/config.d/{{ $filename }}
104+
subPath: {{ $filename }}
105+
{{- end }}
106+
volumes:
107+
- name: config
108+
configMap:
109+
name: {{ include "trigger-v4.fullname" . }}-clickhouse-config
110+
- name: logs
111+
emptyDir: {}
112+
{{- if not .Values.clickhouse.persistence.enabled }}
113+
- name: data
114+
emptyDir: {}
115+
{{- end }}
116+
{{- if .Values.clickhouse.persistence.enabled }}
117+
volumeClaimTemplates:
118+
- metadata:
119+
name: data
120+
{{- if .Values.clickhouse.persistence.retain }}
121+
annotations:
122+
helm.sh/resource-policy: keep
123+
{{- end }}
124+
spec:
125+
accessModes:
126+
- {{ .Values.clickhouse.persistence.accessMode }}
127+
resources:
128+
requests:
129+
storage: {{ .Values.clickhouse.persistence.size }}
130+
{{- $storageClass := .Values.clickhouse.persistence.storageClass | default .Values.global.storageClass }}
131+
{{- if $storageClass }}
132+
storageClassName: {{ $storageClass }}
133+
{{- end }}
134+
{{- end }}
135+
---
136+
apiVersion: v1
137+
kind: Service
138+
metadata:
139+
name: {{ include "trigger-v4.fullname" . }}-clickhouse
140+
labels:
141+
{{- $component := "clickhouse" }}
142+
{{- include "trigger-v4.componentLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
143+
spec:
144+
type: {{ .Values.clickhouse.service.type }}
145+
ports:
146+
- port: {{ .Values.clickhouse.service.ports.http }}
147+
targetPort: http
148+
protocol: TCP
149+
name: http
150+
- port: {{ .Values.clickhouse.service.ports.native }}
151+
targetPort: native
152+
protocol: TCP
153+
name: native
154+
selector:
155+
{{- include "trigger-v4.componentSelectorLabels" (dict "Chart" .Chart "Release" .Release "Values" .Values "component" $component) | nindent 4 }}
156+
{{- end }}

‎hosting/k8s/helm/templates/tests/test-clickhouse.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ spec:
1616
args:
1717
- |
1818
echo "Testing ClickHouse HTTP interface..."
19-
curl -f --user "{{ .Values.clickhouse.auth.adminUser }}:{{ .Values.clickhouse.auth.adminPassword }}" "http://{{ include "trigger-v4.fullname" . }}-clickhouse:{{ .Values.clickhouse.service.ports.http }}/ping"
19+
curl -f --user "{{ .Values.clickhouse.auth.username }}:{{ .Values.clickhouse.auth.password }}" "http://{{ include "trigger-v4.clickhouse.hostname" . }}:{{ .Values.clickhouse.service.ports.http }}/ping"
2020
echo "ClickHouse test completed successfully"
2121
{{- end }}

‎hosting/k8s/helm/values-production-example.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@ redis:
7171
memory: 512Mi
7272

7373
# Production ClickHouse
74+
# The bundled ClickHouse serves plain HTTP inside the cluster. For TLS,
75+
# use an external ClickHouse (deploy: false) with secure: true (see below).
7476
clickhouse:
75-
# Set to true to enable TLS/secure connections in production
76-
secure: true
7777
persistence:
7878
enabled: true
7979
size: 100Gi

0 commit comments

Comments
 (0)