Adds opt-in support for connecting to ClickHouse Cloud services over their private endpoint (AWS PrivateLink / GCP Private Service Connect / Azure Private Link) instead of the public endpoint.
What's new
- New env var
CLICKHOUSE_CLOUD_USE_PRIVATE_DNS(defaultfalse). When enabled, each Cloud service's data-plane host is resolved to its private DNS hostname. - The hostname is fetched per service from the control-plane endpoint
GET /v1/organizations/{org}/services/{id}/privateEndpointConfig— a control-plane call that never wakes an idle service. - Resolved hostnames are cached (positive 300s, negative 30s) and fall back to the public endpoint when no private endpoint is configured or the lookup fails.
- The private host also feeds the idle-wake
/ping, so wake actions stay on the private network too.
Enable only when chadmin runs inside the VPC/network where the private DNS hostname resolves.
Upgrade
No action required — the feature is off by default. To turn it on, set CLICKHOUSE_CLOUD_USE_PRIVATE_DNS=true.
Docker images (multi-arch amd64/arm64):
bun4uk/chadmin:2.1.0/bun4uk/chadmin:latestghcr.io/bun4uk/chadmin:2.1.0/ghcr.io/bun4uk/chadmin:latest