Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
4 Skipped Deployments
|
dhtclk
requested changes
May 8, 2026
Collaborator
dhtclk
left a comment
dhtclk
left a comment
There was a problem hiding this comment.
Some nits on sentence casing and standardization.
|
|
||
| Lastly, **`data-plane-mgmt`** allows a ClickHouse Cloud Control Plane component to reconcile necessary custom resources, such as `ClickHouseCluster` and the Istio Virtual Service/Gateway. | ||
|
|
||
| ## GCP Service Accounts {#gcp-service-accounts} |
Collaborator
There was a problem hiding this comment.
Suggested change
| ## GCP Service Accounts {#gcp-service-accounts} | |
| ## GCP service accounts {#gcp-service-accounts} |
Sentence casing
| - **Storage**: Used to manage Cloud Storage buckets used for ClickHouse backups, shared state, and monitoring data. | ||
| - **IAM Role**: Manages service accounts and custom roles inside the project. This role does not grant the ability to create service account keys, bind organization policies, or touch any resources in other projects. | ||
|
|
||
| ### Additional Service Accounts created by the controller {#additional-service-accounts-created-by-the-controller} |
Collaborator
There was a problem hiding this comment.
Suggested change
| ### Additional Service Accounts created by the controller {#additional-service-accounts-created-by-the-controller} | |
| ### Additional service accounts created by the controller {#additional-service-accounts-created-by-the-controller} |
|
|
||
| ### Additional Service Accounts created by the controller {#additional-service-accounts-created-by-the-controller} | ||
|
|
||
| In addition to the `clickhouse-management` service account created via Terraform as part of onboarding; when you provision your first BYOC service, ClickHouse’s control plane (authenticating as `clickhouse-management`) creates additional service accounts in your project for specific in-cluster workloads. Each of these is created with a narrow, single-purpose permission set. |
Collaborator
There was a problem hiding this comment.
Suggested change
| In addition to the `clickhouse-management` service account created via Terraform as part of onboarding; when you provision your first BYOC service, ClickHouse’s control plane (authenticating as `clickhouse-management`) creates additional service accounts in your project for specific in-cluster workloads. Each of these is created with a narrow, single-purpose permission set. | |
| In addition to the `clickhouse-management` service account created via Terraform as part of onboarding. When you provision your first BYOC service, ClickHouse’s control plane (authenticating as `clickhouse-management`) creates additional service accounts in your project for specific in-cluster workloads. Each of these is created with a narrow, single-purpose permission set. |
Small nit, but semicolon is not proper grammar here.
|
|
||
| ### Bootstrap service account {#bootstrap-service-account} | ||
|
|
||
| The bootstrap Service Account is granted project-scoped custom roles with the following permissions: |
Collaborator
There was a problem hiding this comment.
Suggested change
| The bootstrap Service Account is granted project-scoped custom roles with the following permissions: | |
| The bootstrap service account is granted project-scoped custom roles with the following permissions: |
Comment on lines
+60
to
+67
| - **GKE Node Runtime Identity** | ||
| - Attached to every GKE node virtual machine in your BYOC cluster. | ||
| - Used by kubelet, node-local agents, and the Cloud Operations collectors to emit logs and metrics, and by the image pulling subsystem to download container images. | ||
| - **Billing scraper identity** | ||
| - Used by standalone scraper workload to collect billing telemetry. | ||
| - **Monitoring Identity** | ||
| - Target identity for the monitoring stack running in your cluster. Used to read/write long-term metric storage in a GCS bucket dedicated to this deployment. | ||
| - **ClickHouse runtime management identity** |
Collaborator
There was a problem hiding this comment.
Suggested change
| - **GKE Node Runtime Identity** | |
| - Attached to every GKE node virtual machine in your BYOC cluster. | |
| - Used by kubelet, node-local agents, and the Cloud Operations collectors to emit logs and metrics, and by the image pulling subsystem to download container images. | |
| - **Billing scraper identity** | |
| - Used by standalone scraper workload to collect billing telemetry. | |
| - **Monitoring Identity** | |
| - Target identity for the monitoring stack running in your cluster. Used to read/write long-term metric storage in a GCS bucket dedicated to this deployment. | |
| - **ClickHouse runtime management identity** | |
| - **GKE node runtime identity** | |
| - Attached to every GKE node virtual machine in your BYOC cluster. | |
| - Used by kubelet, node-local agents, and the Cloud Operations collectors to emit logs and metrics, and by the image pulling subsystem to download container images. | |
| - **Billing scraper identity** | |
| - Used by standalone scraper workload to collect billing telemetry. | |
| - **Monitoring identity** | |
| - Target identity for the monitoring stack running in your cluster. Used to read/write long-term metric storage in a GCS bucket dedicated to this deployment. | |
| - **ClickHouse runtime management identity** |
Use consistent sentence casing here.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds reference documentation for BYOC privilege for GCP.
Checklist