From 75d13485046fbe6b91aa1df610d90e5bf45ea6cb Mon Sep 17 00:00:00 2001 From: sdairs Date: Tue, 15 Sep 2026 16:42:51 +0100 Subject: [PATCH] docs: explain GCP ClickPipes workload identity context --- README.md | 9 +++++---- crates/clickhousectl/src/cloud/clickpipes.rs | 13 +++++++++---- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 6dbba6c2..aca49cfe 100644 --- a/README.md +++ b/README.md @@ -1868,10 +1868,11 @@ clickhousectl cloud clickpipe create kafka \ --kafka-read-committed false ``` -GCP workload identity is in private preview and must be enabled for the -organization. Once enabled, get the service's ClickPipes principal, grant that -GCP service account access to the source resources, then create the pipe -without a customer key: +GCP workload identity is in private preview for ClickHouse Cloud services +hosted on GCP and must be enabled for the organization. `clickpipe context get` +reports whether it is supported and ready, and returns the service's ClickPipes +principal. Grant that GCP service account access to the source resources, then +create the pipe without a customer key: ```bash clickhousectl cloud clickpipe context get diff --git a/crates/clickhousectl/src/cloud/clickpipes.rs b/crates/clickhousectl/src/cloud/clickpipes.rs index e1bed58e..54481b35 100644 --- a/crates/clickhousectl/src/cloud/clickpipes.rs +++ b/crates/clickhousectl/src/cloud/clickpipes.rs @@ -369,7 +369,12 @@ CONTEXT FOR AGENTS: command: ClickPipeSettingsCommands, }, - /// Get service capabilities and workload identity + /// Inspect GCP workload identity support and principal + #[command(after_help = "\ +CONTEXT FOR AGENTS: + Only applies to ClickHouse Cloud services hosted on GCP. + Use `get` before create to verify readiness and obtain the service principal. + Grant that principal access to GCS, GCMK, Pub/Sub or BigQuery source resources.")] Context { #[command(subcommand)] command: ClickPipeContextCommands, @@ -409,8 +414,8 @@ CONTEXT FOR AGENTS: CONTEXT FOR AGENTS: For kafka, kinesis, object-storage and pubsub, get --column from `clickhousectl cloud clickpipe schema-discover `. - GCP workload identity is private preview: run `clickpipe context get`, grant - its principal source access, then pass --auth SERVICE_ACCOUNT_WORKLOAD_IDENTITY. + GCP workload identity is private preview for GCS, GCMK, Pub/Sub and BigQuery: + run `clickpipe context get`, grant its principal access, then pass --auth SERVICE_ACCOUNT_WORKLOAD_IDENTITY. The source must be reachable from ClickPipes; allow the static egress IPs: https://clickhouse.com/docs/integrations/clickpipes/networking/static-ips Prints the pipe's name, ID and state; it is not ready to query yet. @@ -502,7 +507,7 @@ impl ClickPipeCommands { #[derive(Subcommand)] pub enum ClickPipeContextCommands { - /// Get ClickPipes service context + /// Get GCP workload identity readiness and principal Get { /// Service ID service_id: String,