v3.18.0

v3.18.0 promotes ClickHouse's role-management resources — clickhouse_role, clickhouse_role_assignment, and the clickhouse_roles data source — to general availability, so you can manage custom RBAC roles and assignments without opting into alpha features. It also expands ClickPipes with exactly-once delivery for Kafka sources and new object-storage load controls (skip_initial_load / start_after), plus config-time validation that stops CDC pipes from being left outside Terraform state when scaling is misconfigured. Rounding things out, there's a new GCP Private Service Connect example and further hardening of the alpha Managed Postgres support.

✨ New Features

• Role management is now generally available: the clickhouse_role and clickhouse_role_assignment resources and the clickhouse_roles data source have graduated out of alpha. You can define custom RBAC roles and assign them to users and API keys with stable, supported resources that no longer emit an alpha warning (#589).
• Exactly-once delivery for Kafka ClickPipes: the Kafka source on clickhouse_clickpipe now accepts an exactly_once flag, so you can enable exactly-once semantics directly from Terraform (#581).
• Load controls for object storage ClickPipes: object storage pipes now support skip_initial_load and start_after, letting you skip the one-time backfill or start ingestion from a given point. The provider validates that skip_initial_load requires queue_url and cannot be combined with start_after (#590).
• GCP Private Service Connect example: a full, end-to-end example for connecting to ClickHouse over GCP Private Service Connect, matching the existing AWS and Azure private-endpoint examples (#523).

🔧 Improvements

• CDC ClickPipes reject invalid scaling at plan time: setting a scaling block on Postgres, MySQL, or MongoDB CDC pipes now fails validation with a message pointing you to clickhouse_clickpipe_cdc_infrastructure for CDC sizing. This prevents a created pipe from being left outside Terraform state when the scaling step is rejected (#583).
• Clearer guidance for MySQL replication mechanisms: the replication_mechanism documentation now notes that non-GTID mechanisms such as FILE_POS require the FT_ORG_CLICKPIPES_MYSQL_REPLICATION_SELECT organization feature to be enabled by ClickHouse support, so you aren't surprised by an API error at create time (#580).

🧪 Experimental Features

• Managed Postgres (clickhouse_postgres_service, alpha): creating a read replica immediately after its primary finishes provisioning now retries until the parent's first backup completes, instead of intermittently failing with Parent server is not ready for read replicas. There are no backups, yet. (#598). Resource and end-to-end examples were
  also added for the service (#562). This resource ships in the regular release but is still in alpha and may change in future provider versions.

📦 Build / Testing / Packaging

• e2e cleanup now sweeps leftover Managed Postgres services: the per-run test cleanup deletes suffix-matched Managed Postgres services (replicas before primaries), so a flaky run can no longer leak primaries until the test org hits its service limit (#597).

---

Changelog

• aa167af Bump provider version in examples to 3.18.0
• adf28a7 fix(postgres): retry replica create until parent has a backup (#598)
• 09754e1 fix(e2e): sweep leftover Managed Postgres services in cleanup (#597)
• eaeff0a Add ClickPipes object storage load options (#590)
• eb2cc64 feat(role-management): move resources to GA (#589)
• 69b48f9 feat: add GCP Private Service Connect example (#523)
• 530e4d0 Prevent CDC ClickPipe scaling leaks (#583)
• 08277c8 docs(clickpipes): note MySQL FILE_POS replication requires a feature flag (#580)
• b5cf7df chore(deps): bump anthropics/claude-code-action from 1.0.134 to 1.0.153 (#582)
• 2b3b30a chore(deps): bump k8s.io/apimachinery from 0.36.1 to 0.36.2 (#579)
• 09c9bf9 chore(deps): bump hashicorp/setup-terraform from 3.1.2 to 4.0.1 (#569)
• fa01c85 chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#570)
• e9ab0f8 feat(clickpipe): add exactly_once to Kafka source (#581)
• 7b0efea docs(postgres): add resource example + examples/full e2e for clickhouse_postgres_service (#562)