Repository navigation
fix(rybbit): grant clickhouse access_management for rybbit_query provisioning - #226
Merged
Merged
Conversation
…isioning Upstream's backend runs provisionQueryUser() on every startup to create the least-privilege rybbit_query user (powers custom SQL queries and dashboard cards) via SQL against the main ClickHouse connection. That requires access_management on that connection, which upstream's own compose grants via CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1 - missing here since apps/clickhouse-26.5.yml is a generic multi-app template and shouldn't grant this by default. Override it on rybbit's own clickhouse service instead, merged in via include: (verified against a scratch copy of apps/ with docker compose config - the override's environment: key merges into the template's own environment map rather than replacing it, same as every other field the template declares). The failure mode without this is non-fatal and silent: core dashboards/sites/session-replay keep working, only custom SQL queries/dashboard cards fail closed, logged but not surfaced anywhere flightdeck would see. Fixes #225 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
apps/rybbit/docker-compose.yml'sclickhouseservice (via../clickhouse-26.5.yml) didn't setCLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT=1, which upstream's own compose doesprovisionQueryUser()on every startup, creating the least-privilegerybbit_queryuser that powers custom SQL queries/dashboard cards - this requiresaccess_managementon the main ClickHouse connectionclickhouse-26.5.ymlis a generic multi-app template, so granting this globally there would hand every app's default ClickHouse user elevated rights it doesn't need - overridden on rybbit's ownclickhouseservice instead, merged in viainclude:Not addressed here (per the issue's own lower-priority flags)
26.5here vs upstream's26.3.17.4) - not yet confirmed as an actual problem, just worth someone double-checking separatelyCLICKHOUSE_QUERY_PASSWORD,DEPLOYMENT,LITE_DASHBOARD,OPENROUTER_API_KEY,OPENROUTER_MODEL,CLUSTER_WORKERS) - all have safe fallbacks upstream, so left out of this fix to keep it focusedCloses #225
Test plan
apps/(never touching the real repo'sapps/rybbit/.env, which doesn't exist locally anyway):docker compose configconfirms the override'senvironment:key merges intoclickhouse-26.5.yml's own environment map (CLICKHOUSE_DB,CLICKHOUSE_PASSWORD, and nowCLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"all present together), rather than replacing it - every other field from the template (configs,healthcheck,volumes,networks,image) is preserved unchanged🤖 Generated with Claude Code