> For the complete documentation index, see [llms.txt](https://docs.decube.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.decube.io/warehouses/clickhouse.md).

# ClickHouse (BETA)

Connect your ClickHouse database to decube to ingest catalog metadata and track view table lineage

ClickHouse is a column oriented database built for high volume analytical workloads. Connecting it to decube brings your ClickHouse schemas, tables, columns, and views into the Catalog, and maps how your view tables depend on the data underneath them.

## Supported Capabilities

{% tabs %}
{% tab title="Supported Capabilities" %}
**General**

* **Metadata** — metadata extraction and display of asset information (tables, columns, schemas). Types collected: Schema, Table, Column, View
* **View Table** — view tables, which are virtual tables based on SQL queries

**Lineage**

* **View Table Lineage** — tracks virtual tables (views) and their data dependencies
  {% endtab %}

{% tab title="Not Supported" %}
**General**

* Profiling
* Preview
* Data Quality (Classic)
* Data Quality V2 — not supported yet
* External Table
* Stored Procedure
  {% endtab %}
  {% endtabs %}

## Connection Requirements

To connect ClickHouse, provide decube with credentials for your database. At a minimum, decube requires:

* `username`
* `password`
* `host address`
* `host port`

A database is not required. decube maps a ClickHouse database to the Schema asset type, so you control which databases to ingest through the whitelist and blacklist schema settings.

Use the `source name` to recognise this particular source inside the decube application.

{% hint style="success" %}
Create a dedicated read only user for this credential. The steps below set up a custom user with least privilege access.
{% endhint %}

## Configuring a Custom ClickHouse User

A dedicated database user follows the principle of least privilege. decube gets only the permissions it needs to read your metadata, and nothing that widens your database exposure.

### 1. Create the decube user

Log in to your ClickHouse instance (Self-Hosted or Cloud) with an administrative account and run:

```sql
-- Create the dedicated service user, keep note of the username and password
CREATE USER DECUBE IDENTIFIED WITH sha256_password BY '<password>';
```

### 2. Grant the required permissions

decube requires the following grants on the `DECUBE` user to ingest catalog metadata:

```sql
GRANT SELECT ON system.databases TO DECUBE;
GRANT SELECT ON system.tables TO DECUBE;
GRANT SELECT ON system.columns TO DECUBE;
GRANT SELECT ON *.* TO DECUBE;
```

## Security

If security measures protect access to your database, whitelist the decube IP addresses. See [IP whitelisting](https://docs.decube.io/how-to-connect-data-sources/enabling-vpc-access/ip-whitelisting) for the address list, and [enabling VPC access](https://docs.decube.io/how-to-connect-data-sources/enabling-vpc-access) for the full set of connectivity options.

## Encryption and SSL Configuration (HTTPS)

decube connects to ClickHouse over HTTPS when you turn on the **Enable SSL** toggle.

If your enterprise database or cloud environment enforces custom CA verification, select **Use Customer CA Cert** and upload your `.pem` or `.crt` certificate file.