Properly handle secure and verify on clickhouse

charts/clickhouse/values.yaml

@@ -372,7 +372,7 @@ initContainers:
     image:
       registry: docker.io
       repository: busybox
-      tag: 1.35
+      tag: 1.37
       pullPolicy: IfNotPresent
     command:
       - /bin/sh

charts/k8s-infra/templates/otel-agent/tests/test-connection.yaml

@@ -10,7 +10,7 @@ metadata:
 spec:
   containers:
     - name: wget
-      image: {{ default "docker.io" .Values.global.imageRegistry }}/busybox:1.35
+      image: {{ default "docker.io" .Values.global.imageRegistry }}/busybox:1.37
       command: ['wget']
       args: ['{{ include "otelAgent.fullname" . }}:{{ $healthCheckPort.servicePort }}']
   restartPolicy: Never

charts/k8s-infra/templates/otel-deployment/tests/test-connection.yaml

@@ -12,7 +12,7 @@ metadata:
 spec:
   containers:
     - name: wget
-      image: {{ default "docker.io" .Values.global.imageRegistry }}/busybox:1.35
+      image: {{ default "docker.io" .Values.global.imageRegistry }}/busybox:1.37
       command: ['wget']
       args: ['{{ include "otelDeployment.fullname" . }}:{{ $healthCheckPort.servicePort }}']
   restartPolicy: Never

charts/signoz/README.md

@@ -395,7 +395,7 @@ image:
     pullPolicy: IfNotPresent
     registry: docker.io
     repository: busybox
-    tag: 1.35
+    tag: 1.37
 resources: {}</pre>
 </div>
             </td>

charts/signoz/templates/_clickhouse.tpl

@@ -4,9 +4,9 @@ Common ClickHouse ENV variables and helpers used by SigNoz
 
 {{- define "schemamigrator.url" -}}
 {{- if .Values.clickhouse.enabled -}}
-{{- printf "%v:%v" ( include "clickhouse.servicename" . ) ( include "clickhouse.tcpPort" . ) -}}
+{{- printf "%v:%v?%v" ( include "clickhouse.servicename" . ) ( include "clickhouse.tcpPort" . ) ( include "clickhouse.clickHouseDsnParams" . ) -}}
 {{- else -}}
-{{- printf "%v:%v" ( required "externalClickhouse.host is required if not clickhouse.enabled" .Values.externalClickhouse.host ) ( default 9000 .Values.externalClickhouse.tcpPort ) -}}
+{{- printf "%v:%v?%v" ( required "externalClickhouse.host is required if not clickhouse.enabled" .Values.externalClickhouse.host ) ( default 9000 .Values.externalClickhouse.tcpPort ) ( include "clickhouse.clickHouseDsnParams" . ) -}}
 {{- end -}}
 {{- end -}}
 
@@ -36,6 +36,8 @@ Common ClickHouse ENV variables and helpers used by SigNoz
   value: {{ .Values.clickhouse.secure | quote }}
 - name: CLICKHOUSE_VERIFY
   value: {{ .Values.clickhouse.verify | quote }}
+- name: CLICKHOUSE_SKIP_VERIFY
+  value: {{ not .Values.clickhouse.verify | quote }}
 {{- else -}}
 - name: CLICKHOUSE_HOST
   value: {{ required "externalClickhouse.host is required if not clickhouse.enabled" .Values.externalClickhouse.host | quote }}
@@ -67,6 +69,8 @@ Common ClickHouse ENV variables and helpers used by SigNoz
   value: {{ .Values.externalClickhouse.secure | quote }}
 - name: CLICKHOUSE_VERIFY
   value: {{ .Values.externalClickhouse.verify | quote }}
+- name: CLICKHOUSE_SKIP_VERIFY
+  value: {{ not .Values.externalClickhouse.verify | quote }}
 {{- end }}
 {{- end }}
 
@@ -89,6 +93,8 @@ Minimized ClickHouse ENV variables for user credentials
   value: {{ .Values.clickhouse.password | quote }}
 - name: CLICKHOUSE_SECURE
   value: {{ .Values.clickhouse.secure | quote }}
+- name: CLICKHOUSE_VERIFY
+  value: {{ .Values.clickhouse.verify | quote }}
 {{- else -}}
 - name: CLICKHOUSE_HOST
   value: {{ required "externalClickhouse.host is required if not clickhouse.enabled" .Values.externalClickhouse.host | quote }}
@@ -112,6 +118,8 @@ Minimized ClickHouse ENV variables for user credentials
 {{- end }}
 - name: CLICKHOUSE_SECURE
   value: {{ .Values.externalClickhouse.secure | quote }}
+- name: CLICKHOUSE_VERIFY
+  value: {{ .Values.externalClickhouse.verify | quote }}
 {{- end }}
 {{- end }}
 
@@ -225,9 +233,17 @@ Return the ClickHouse Traces URL
 
 {{- define "clickhouse.clickHouseUrl" -}}
 {{- if .Values.clickhouse.enabled -}}
-  {{- include "clickhouse.servicename" . }}:{{ include "clickhouse.tcpPort" . }}/?username=$(CLICKHOUSE_USER)&password=$(CLICKHOUSE_PASSWORD)
+  {{- include "clickhouse.servicename" . }}:{{ include "clickhouse.tcpPort" . }}/?username=$(CLICKHOUSE_USER)&password=$(CLICKHOUSE_PASSWORD)&{{ include "clickhouse.clickHouseDsnParams" . }}
+{{- else -}}
+  {{- required "externalClickhouse.host is required if using external clickhouse" .Values.externalClickhouse.host }}:{{ include "clickhouse.tcpPort" . }}/?username=$(CLICKHOUSE_USER)&password=$(CLICKHOUSE_PASSWORD)&{{ include "clickhouse.clickHouseDsnParams" . }}
+{{- end -}}
+{{- end -}}
+
+{{- define "clickhouse.clickHouseDsnParams" -}}
+{{- if .Values.clickhouse.enabled -}}
+{{- trimSuffix "&" (printf "secure=%v&skip_verify=%v&%v" ( default false .Values.clickhouse.secure ) ( not ( default false .Values.clickhouse.verify ) ) ( default "" .Values.clickhouse.dsnParams )) -}}
 {{- else -}}
-  {{- required "externalClickhouse.host is required if using external clickhouse" .Values.externalClickhouse.host }}:{{ include "clickhouse.tcpPort" . }}/?username=$(CLICKHOUSE_USER)&password=$(CLICKHOUSE_PASSWORD)
+{{- trimSuffix "&" (printf "secure=%v&skip_verify=%v&%v" ( default false .Values.externalClickhouse.secure ) ( not ( default false .Values.externalClickhouse.verify ) ) ( default "" .Values.externalClickhouse.dsnParams )) -}}
 {{- end -}}
 {{- end -}}
 

charts/signoz/templates/_helpers.tpl

@@ -524,6 +524,13 @@ imagePullSecrets:
 {{- end }}
 {{- end }}
 
+{{/*
+Generate --no-check-certificate flag based on CLICKHOUSE_VERIFY environment variable
+*/}}
+{{- define "wget.clickhouse.noVerifyFlag" -}}
+$(if [ "${CLICKHOUSE_VERIFY}" = "false" ]; then echo "--no-check-certificate"; fi)
+{{- end -}}
+
 
 {{/* 
 Create Env

charts/signoz/templates/otel-collector/deployment.yaml

@@ -82,7 +82,7 @@ spec:
           command:
             - sh
             - -c
-            - until wget --user "${CLICKHOUSE_USER}:${CLICKHOUSE_PASSWORD}" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
+            - until wget {{ include "wget.clickhouse.noVerifyFlag" $ }} --user "${CLICKHOUSE_USER}:${CLICKHOUSE_PASSWORD}" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
           {{- end }}
           resources:
             {{- toYaml .Values.otelCollector.initContainers.init.resources | nindent 12 }}

charts/signoz/templates/schema-migrator/migrations-async.yaml

@@ -43,7 +43,7 @@ spec:
           command:
             - sh
             - -c
-            - until wget --user "$(CLICKHOUSE_USER):$(CLICKHOUSE_PASSWORD)" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
+            - until wget {{ include "wget.clickhouse.noVerifyFlag" $ }} --user "$(CLICKHOUSE_USER):$(CLICKHOUSE_PASSWORD)" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
           {{- end }}
           resources:
             {{- toYaml .Values.schemaMigrator.initContainers.init.resources | nindent 12 }}

charts/signoz/templates/schema-migrator/migrations-sync.yaml

@@ -42,7 +42,7 @@ spec:
           command:
             - sh
             - -c
-            - until wget --user "$(CLICKHOUSE_USER):$(CLICKHOUSE_PASSWORD)" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
+            - until wget {{ include "wget.clickhouse.noVerifyFlag" $ }} --user "$(CLICKHOUSE_USER):$(CLICKHOUSE_PASSWORD)" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
           {{- end }}
           resources:
             {{- toYaml .Values.schemaMigrator.initContainers.init.resources | nindent 12 }}

charts/signoz/templates/signoz/statefulset.yaml

@@ -61,7 +61,7 @@ spec:
           command:
             - sh
             - -c
-            - until wget --user "${CLICKHOUSE_USER}:${CLICKHOUSE_PASSWORD}" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
+            - until wget {{ include "wget.clickhouse.noVerifyFlag" $ }} --user "${CLICKHOUSE_USER}:${CLICKHOUSE_PASSWORD}" --spider -q {{ include "clickhouse.httpUrl" $ }}{{ .endpoint }}; do echo -e "{{ .waitMessage }}"; sleep {{ .delay }}; done; echo -e "{{ .doneMessage }}";
           {{- end }}
           resources:
             {{- toYaml .init.resources | nindent 12 }}

charts/signoz/templates/signoz/tests/test-connection.yaml

@@ -9,7 +9,7 @@ metadata:
 spec:
   containers:
     - name: wget
-      image: {{ default "docker.io" .Values.global.imageRegistry }}/busybox:1.35
+      image: {{ default "docker.io" .Values.global.imageRegistry }}/busybox:1.37
       command: ['wget']
       args: ['http://{{ include "signoz.url" . }}/api/v1/health?live=1']
       # NOTE: replace the path with version or healthcheck URL after the implementation

charts/signoz/values.yaml

@@ -250,6 +250,10 @@ clickhouse:
   # @section -- ClickHouse Settings
   # @default -- false
   verify: false
+  # clickhouse.dsnParams -- Additional DSN parameters for ClickHouse connection.
+  # @section -- ClickHouse Settings
+  # @default -- ""
+  dsnParams: ""
   # clickhouse.externalZookeeper -- Configuration for an external Zookeeper.
   # @section -- Zookeeper Settings
   # @default -- {}
@@ -374,7 +378,7 @@ clickhouse:
       image:
         registry: docker.io
         repository: busybox
-        tag: 1.35
+        tag: 1.37
         pullPolicy: IfNotPresent
       command:
         - /bin/sh
@@ -741,6 +745,10 @@ externalClickhouse:
   # externalClickhouse.tcpPort - TCP port of the external ClickHouse instance.
   # @default - 9000
   tcpPort: 9000
+  # externalClickhouse.dsnParams -- Additional DSN parameters for external ClickHouse connection.
+  # @section -- External ClickHouse
+  # @default -- ""
+  dsnParams: ""
 # signoz -- Default values for SigNoz.
 # @section -- SigNoz
 # @default -- "Please checkout the default values in values.yml"
@@ -880,7 +888,7 @@ signoz:
       image:
         registry: docker.io
         repository: busybox
-        tag: 1.35
+        tag: 1.37
         pullPolicy: IfNotPresent
       # signoz.initContainers.init.command - Command settings for the init container.
       # @default -- "Please checkout the default values in values.yml"
@@ -904,7 +912,7 @@ signoz:
       image:
         registry: docker.io
         repository: busybox
-        tag: 1.35
+        tag: 1.37
         pullPolicy: IfNotPresent
       # signoz.initContainers.migration.args - Arguments for the migration container's command.
       # @default -- []
@@ -1135,7 +1143,7 @@ schemaMigrator:
       image:
         registry: docker.io
         repository: busybox
-        tag: 1.35
+        tag: 1.37
         pullPolicy: IfNotPresent
       # schemaMigrator.initContainers.init.command - Command settings for the init container.
       # @default -- "Please checkout the default values in values.yml"
@@ -1316,7 +1324,7 @@ otelCollector:
       image:
         registry: docker.io
         repository: busybox
-        tag: 1.35
+        tag: 1.37
         pullPolicy: IfNotPresent
       # otelCollector.initContainers.init.command - Command settings for the init container.
       # @default -- "Please checkout the default values in values.yml"
@@ -1901,24 +1909,24 @@ otelCollector:
         endpoint: localhost:1777
     exporters:
       clickhousetraces:
-        datasource: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_TRACE_DATABASE}
+        datasource: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_TRACE_DATABASE}?secure=${env:CLICKHOUSE_SECURE}&skip_verify=${env:CLICKHOUSE_SKIP_VERIFY}
         low_cardinal_exception_grouping: ${env:LOW_CARDINAL_EXCEPTION_GROUPING}
         use_new_schema: true
       signozclickhousemetrics:
-        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_DATABASE}
+        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_DATABASE}?secure=${env:CLICKHOUSE_SECURE}&skip_verify=${env:CLICKHOUSE_SKIP_VERIFY}
         timeout: 45s
       clickhouselogsexporter:
-        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_LOG_DATABASE}
+        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_LOG_DATABASE}?secure=${env:CLICKHOUSE_SECURE}&skip_verify=${env:CLICKHOUSE_SKIP_VERIFY}
         timeout: 10s
         use_new_schema: true
       metadataexporter:
-        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/signoz_metadata
+        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/signoz_metadata?secure=${env:CLICKHOUSE_SECURE}&skip_verify=${env:CLICKHOUSE_SKIP_VERIFY}
         timeout: 10s
         tenant_id: ${env:TENANT_ID}
         cache:
           provider: in_memory
       signozclickhousemeter:
-        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_METER_DATABASE}
+        dsn: tcp://${env:CLICKHOUSE_USER}:${env:CLICKHOUSE_PASSWORD}@${env:CLICKHOUSE_HOST}:${env:CLICKHOUSE_PORT}/${env:CLICKHOUSE_METER_DATABASE}?secure=${env:CLICKHOUSE_SECURE}&skip_verify=${env:CLICKHOUSE_SKIP_VERIFY}
         timeout: 45s
         sending_queue:
           enabled: false