Skip to content

Explain the GCP scope of ClickPipe workload identity context #960

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sdairs merged 2 commits into from
Sep 17, 2026
+14 −8
Merged

Explain the GCP scope of ClickPipe workload identity context #960

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
75d1348
docs: explain GCP ClickPipes workload identity context
sdairs Sep 15, 2026
b264b5c
Merge current parent into PR #960 to synchronize stack
sdairs Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1860,10 +1860,11 @@ clickhousectl cloud clickpipe create kafka <service-id> \
--kafka-read-committed false
```

GCP workload identity is in private preview and must be enabled for the
organization. Once enabled, get the service's ClickPipes principal, grant that
GCP service account access to the source resources, then create the pipe
without a customer key:
GCP workload identity is in private preview for ClickHouse Cloud services
hosted on GCP and must be enabled for the organization. `clickpipe context get`
reports whether it is supported and ready, and returns the service's ClickPipes
principal. Grant that GCP service account access to the source resources, then
create the pipe without a customer key:

```bash
clickhousectl cloud clickpipe context get <service-id>
Expand Down
13 changes: 9 additions & 4 deletions crates/clickhousectl/src/cloud/clickpipes.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,7 +369,12 @@ CONTEXT FOR AGENTS:
command: ClickPipeSettingsCommands,
},

/// Get service capabilities and workload identity
/// Inspect GCP workload identity support and principal
#[command(after_help = "\
CONTEXT FOR AGENTS:
Only applies to ClickHouse Cloud services hosted on GCP.
Use `get` before create to verify readiness and obtain the service principal.
Grant that principal access to GCS, GCMK, Pub/Sub or BigQuery source resources.")]
Context {
#[command(subcommand)]
command: ClickPipeContextCommands,
Expand Down Expand Up @@ -409,8 +414,8 @@ CONTEXT FOR AGENTS:
CONTEXT FOR AGENTS:
For kafka, kinesis, object-storage and pubsub, get --column from
`clickhousectl cloud clickpipe schema-discover <source> <service-id>`.
GCP workload identity is private preview: run `clickpipe context get`, grant
its principal source access, then pass --auth SERVICE_ACCOUNT_WORKLOAD_IDENTITY.
GCP workload identity is private preview for GCS, GCMK, Pub/Sub and BigQuery:
run `clickpipe context get`, grant its principal access, then pass --auth SERVICE_ACCOUNT_WORKLOAD_IDENTITY.
The source must be reachable from ClickPipes; allow the static egress IPs:
https://clickhouse.com/docs/integrations/clickpipes/networking/static-ips
Prints the pipe's name, ID and state; it is not ready to query yet.
Expand Down Expand Up @@ -502,7 +507,7 @@ impl ClickPipeCommands {

#[derive(Subcommand)]
pub enum ClickPipeContextCommands {
/// Get ClickPipes service context
/// Get GCP workload identity readiness and principal
Get {
/// Service ID
service_id: String,
Expand Down