feat!: add bitnami clickhouse

charts/sentry/Chart.lock

@@ -9,11 +9,8 @@ dependencies:
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 29.3.14
 - name: clickhouse
-  repository: https://sentry-kubernetes.github.io/charts
-  version: 4.0.1
-- name: zookeeper
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 11.4.11
+  repository: https://charts.bitnami.com/bitnami
+  version: 4.6.0
 - name: rabbitmq
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 11.16.2
@@ -23,5 +20,5 @@ dependencies:
 - name: nginx
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 18.2.5
-digest: sha256:f57f1f1f8d455729a7e04eb41c658530d710c9febe34844e062f084c17c1a382
-generated: "2025-07-21T06:40:24.054695705Z"
+digest: sha256:f2d82b26a693fed9ee3bd24fbcadafdacda7e525528bbbb347afceae607b2ecf
+generated: "2025-08-05T08:10:43.800821278+02:00"

charts/sentry/Chart.yaml

@@ -19,13 +19,9 @@ dependencies:
     version: 29.3.14
     condition: kafka.enabled
   - name: clickhouse
-    repository: https://sentry-kubernetes.github.io/charts
-    version: 4.0.1
+    repository: https://charts.bitnami.com/bitnami
+    version: 4.6.0
     condition: clickhouse.enabled
-  - name: zookeeper
-    repository: oci://registry-1.docker.io/bitnamicharts
-    version: 11.4.11
-    condition: zookeeper.enabled
   - name: rabbitmq
     repository: oci://registry-1.docker.io/bitnamicharts
     version: 11.16.2

charts/sentry/templates/_helper.tpl

@@ -333,7 +333,7 @@ Set ClickHouse host
 */}}
 {{- define "sentry.clickhouse.host" -}}
 {{- if .Values.clickhouse.enabled -}}
-{{- template "sentry.clickhouse.fullname" . -}}
+{{- include "clickhouse.headlessServiceName" $.Subcharts.clickhouse -}}
 {{- else -}}
 {{ required "A valid .Values.externalClickhouse.host is required" .Values.externalClickhouse.host }}
 {{- end -}}
@@ -344,7 +344,7 @@ Set ClickHouse port
 */}}
 {{- define "sentry.clickhouse.port" -}}
 {{- if .Values.clickhouse.enabled -}}
-{{- default 9000 .Values.clickhouse.clickhouse.tcp_port }}
+{{- default 9000 .Values.clickhouse.service.ports.tcp }}
 {{- else -}}
 {{ required "A valid .Values.externalClickhouse.tcpPort is required" .Values.externalClickhouse.tcpPort }}
 {{- end -}}
@@ -355,7 +355,7 @@ Set ClickHouse HTTP port
 */}}
 {{- define "sentry.clickhouse.http_port" -}}
 {{- if .Values.clickhouse.enabled -}}
-{{- default 8123 .Values.clickhouse.clickhouse.http_port }}
+{{- default 8123 .Values.clickhouse.service.ports.http }}
 {{- else -}}
 {{ required "A valid .Values.externalClickhouse.httpPort is required" .Values.externalClickhouse.httpPort }}
 {{- end -}}
@@ -377,11 +377,7 @@ Set ClickHouse User
 */}}
 {{- define "sentry.clickhouse.username" -}}
 {{- if .Values.clickhouse.enabled -}}
-  {{- if .Values.clickhouse.clickhouse.configmap.users.enabled -}}
-{{ (index .Values.clickhouse.clickhouse.configmap.users.user 0).name }}
-  {{- else -}}
-default
-  {{- end -}}
+{{ default "default" .Values.clickhouse.auth.username }}
 {{- else -}}
 {{ required "A valid .Values.externalClickhouse.username is required" .Values.externalClickhouse.username }}
 {{- end -}}
@@ -391,38 +387,22 @@ default
 Set ClickHouse Password
 */}}
 {{- define "sentry.clickhouse.password" -}}
-{{- if .Values.clickhouse.enabled -}}
-  {{- if .Values.clickhouse.clickhouse.configmap.users.enabled -}}
-{{ (index .Values.clickhouse.clickhouse.configmap.users.user 0).config.password }}
-  {{- else -}}
-  {{- end -}}
-{{- else -}}
+{{- if not .Values.clickhouse.enabled -}}
 {{ .Values.externalClickhouse.password }}
-{{- end -}}
+{{- end -}}F
 {{- end -}}
 
 {{/*
 Set ClickHouse cluster name
 */}}
 {{- define "sentry.clickhouse.cluster.name" -}}
 {{- if .Values.clickhouse.enabled -}}
-{{ .Release.Name | printf "%s-clickhouse" }}
+{{ include "clickhouse.headlessServiceName" $.Subcharts.clickhouse }}
 {{- else -}}
 {{ required "A valid .Values.externalClickhouse.clusterName is required" .Values.externalClickhouse.clusterName }}
 {{- end -}}
 {{- end -}}
 
-{{/*
-Set ClickHouse distributed cluster name
-*/}}
-{{- define "sentry.clickhouse.distributed.cluster.name" -}}
-{{- if .Values.clickhouse.enabled -}}
-{{ .Release.Name | printf "%s-clickhouse" }}
-{{- else -}}
-{{ default .Values.externalClickhouse.clusterName .Values.externalClickhouse.distributedClusterName }}
-{{- end -}}
-{{- end -}}
-
 {{/*
 Set ClickHouse secure setting
 */}}
@@ -667,6 +647,15 @@ Set external Clickhouse password from existingSecret
       name: {{ .Values.externalClickhouse.existingSecret }}
       key: {{ default "clickhouse-password" .Values.externalClickhouse.existingSecretKey }}
 {{- end }}
+{{- if not .Values.externalClickhouse.existingSecret }}
+- name: CLICKHOUSE_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ include "clickhouse.secretName" $.Subcharts.clickhouse | quote }}
+      key: {{ include "clickhouse.secretKey" $.Subcharts.clickhouse | quote }}
+{{- end }}
+- name: CLICKHOUSE_HOST
+  value: {{ include "sentry.clickhouse.host" . | quote }}
 - name: CLICKHOUSE_MAX_CONNECTIONS
   value: {{ .Values.snuba.clickhouse.maxConnections | quote }}
 {{- if .Values.ipv6 }}

charts/sentry/templates/hooks/sentry-db-check.job.yaml

@@ -13,12 +13,14 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
+  {{- if .Values.asHook }}
   annotations:
     # This is what defines this resource as a hook. Without this line, the
     # job is considered part of the release.
     "helm.sh/hook": "post-install,{{ if .Values.hooks.preUpgrade }}pre-upgrade{{ else }}post-upgrade{{ end }}"
     "helm.sh/hook-delete-policy": "{{ if .Values.hooks.removeOnSuccess }}hook-succeeded,{{ end }}before-hook-creation"
     "helm.sh/hook-weight": "-1"
+  {{- end }}
 spec:
   {{- if .Values.hooks.activeDeadlineSeconds }}
   activeDeadlineSeconds: {{ .Values.hooks.activeDeadlineSeconds }}
@@ -87,26 +89,15 @@ spec:
             CLICKHOUSE_STATUS=0
             while [ $CLICKHOUSE_STATUS -eq 0 ]; do
               CLICKHOUSE_STATUS=1
-              CLICKHOUSE_REPLICAS={{ .Values.clickhouse.enabled | ternary .Values.clickhouse.clickhouse.replicas "1" }}
-              i=0; while [ $i -lt $CLICKHOUSE_REPLICAS ]; do
                 {{- if .Values.clickhouse.enabled }}
-                CLICKHOUSE_HOST={{ $clickhouseHost }}-$i.{{ $clickhouseHost }}-headless
+                CLICKHOUSE_HOST={{ include "clickhouse.headlessServiceName" $.Subcharts.clickhouse }}
                 {{- else }}
                 CLICKHOUSE_HOST={{ .Values.externalClickhouse.host }}
                 {{- end }}
                 if ! nc -z "$CLICKHOUSE_HOST" {{ $clickhousePort }}; then
                   CLICKHOUSE_STATUS=0
                   echo "$CLICKHOUSE_HOST is not available yet"
                 fi
-                {{- if and .Values.clickhouse.enabled .Values.clickhouse.clickhouse.configmap.remote_servers.replica.backup.enabled }}
-                CLICKHOUSE_HOST={{ $clickhouseHost }}-replica-$i.{{ $clickhouseHost }}-replica-headless
-                if ! nc -z "$CLICKHOUSE_HOST" {{ $clickhousePort }}; then
-                  CLICKHOUSE_STATUS=0
-                  echo "$CLICKHOUSE_HOST is not available yet"
-                fi
-                {{- end }}
-                i=$((i+1))
-              done
               if [ "$CLICKHOUSE_STATUS" -eq 0 ]; then
                 echo "Clickhouse not ready. Sleeping for 10s before trying again"
                 sleep 10;

charts/sentry/templates/hooks/sentry-db-init.job.yaml

@@ -8,12 +8,14 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
+  {{- if .Values.asHook }}
   annotations:
     # This is what defines this resource as a hook. Without this line, the
     # job is considered part of the release.
     "helm.sh/hook": "post-install,{{ if .Values.hooks.preUpgrade }}pre-upgrade{{ else }}post-upgrade{{ end }}"
     "helm.sh/hook-delete-policy": "{{ if .Values.hooks.removeOnSuccess }}hook-succeeded,{{ end }}before-hook-creation"
     "helm.sh/hook-weight": "6"
+  {{- end }}
 spec:
   {{- if .Values.hooks.activeDeadlineSeconds }}
   activeDeadlineSeconds: {{ .Values.hooks.activeDeadlineSeconds }}

charts/sentry/templates/hooks/sentry-secret-create.yaml

@@ -8,9 +8,11 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
+  {{- if .Values.asHook }}
   annotations:
     "helm.sh/hook": "pre-install"
     "helm.sh/hook-weight": "3"
+  {{- end }}
 type: Opaque
 data:
   key: {{ randAlphaNum 50 | b64enc | quote }}

charts/sentry/templates/hooks/snuba-db-init.job.yaml

@@ -9,12 +9,14 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
+  {{- if .Values.asHook }}
   annotations:
     # This is what defines this resource as a hook. Without this line, the
     # job is considered part of the release.
     "helm.sh/hook": "post-install,{{ if .Values.hooks.preUpgrade }}pre-upgrade{{ else }}post-upgrade{{ end }}"
     "helm.sh/hook-delete-policy": "{{ if .Values.hooks.removeOnSuccess }}hook-succeeded,{{ end }}before-hook-creation"
     "helm.sh/hook-weight": "3"
+  {{- end }}
 spec:
   {{- if .Values.hooks.activeDeadlineSeconds }}
   activeDeadlineSeconds: {{ .Values.hooks.activeDeadlineSeconds }}

charts/sentry/templates/hooks/snuba-migrate.job.yaml

@@ -9,12 +9,14 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
+  {{- if .Values.asHook }}
   annotations:
     # This is what defines this resource as a hook. Without this line, the
     # job is considered part of the release.
     "helm.sh/hook": "post-install,{{ if .Values.hooks.preUpgrade }}pre-upgrade{{ else }}post-upgrade{{ end }}"
     "helm.sh/hook-delete-policy": "{{ if .Values.hooks.removeOnSuccess }}hook-succeeded,{{ end }}before-hook-creation"
     "helm.sh/hook-weight": "5"
+  {{- end }}
 spec:
   {{- if .Values.hooks.activeDeadlineSeconds }}
   activeDeadlineSeconds: {{ .Values.hooks.activeDeadlineSeconds }}

charts/sentry/templates/hooks/user-create.yaml

@@ -8,10 +8,12 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
+  {{- if .Values.asHook }}
   annotations:
     "helm.sh/hook": "post-install,{{ if .Values.hooks.preUpgrade }}pre-upgrade{{ else }}post-upgrade{{ end }}"
     "helm.sh/hook-delete-policy": "{{ if .Values.hooks.removeOnSuccess }}hook-succeeded,{{ end }}before-hook-creation"
     "helm.sh/hook-weight": "9"
+  {{- end }}
 spec:
   {{- if .Values.hooks.activeDeadlineSeconds }}
   activeDeadlineSeconds: {{ .Values.hooks.activeDeadlineSeconds }}

charts/sentry/templates/sentry/worker/deployment-sentry-worker.yaml

@@ -8,6 +8,11 @@ metadata:
     chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
     release: "{{ .Release.Name }}"
     heritage: "{{ .Release.Service }}"
+  annotations:
+    meta.helm.sh/release-name: "{{ .Release.Name }}"
+    meta.helm.sh/release-namespace: "{{ .Release.Namespace }}"
+    "helm.sh/hook": "post-install,post-upgrade"
+    "helm.sh/hook-weight": "25"
 spec:
   revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
   selector:

charts/sentry/templates/snuba/_helper-snuba.tpl

@@ -31,6 +31,17 @@ settings.py: |
     KAFKA_TOPIC_MAP[topic.value] = f"{SENTRY_CHARTS_KAFKA_TOPIC_PREFIX}{topic.value}"
   {{- end }}
 
+  SENTRY_DISTRIBUTED_CLICKHOUSE_TABLES = True
+
+  # Migration settings for distributed ClickHouse
+  MIGRATIONS_LOCK_TIMEOUT = int(env("MIGRATIONS_LOCK_TIMEOUT", "600"))
+  MIGRATIONS_BATCH_SIZE = int(env("MIGRATIONS_BATCH_SIZE", "1"))
+
+  # ClickHouse distributed settings
+  CLICKHOUSE_MUTATIONS_SYNC = int(env("CLICKHOUSE_MUTATIONS_SYNC", "1"))
+  CLICKHOUSE_ALTER_SYNC = int(env("CLICKHOUSE_ALTER_SYNC", "1"))
+  CLICKHOUSE_REPLICATION_ALTER_PARTITIONS_SYNC = int(env("CLICKHOUSE_REPLICATION_ALTER_PARTITIONS_SYNC", "2"))
+
   # Clickhouse Options
   CLUSTERS = [
     {
@@ -77,11 +88,11 @@ settings.py: |
       {{- if and .Values.externalClickhouse.singleNode (not .Values.clickhouse.enabled) }}
       "single_node": True,
       {{- else }}
-      "single_node": False,
+      "single_node": True, # IDK why this is needed, but it is required for the clickhouse client to work
       {{- end }}
       {{- if or .Values.clickhouse.enabled (not .Values.externalClickhouse.singleNode) }}
-      "cluster_name": {{ include "sentry.clickhouse.cluster.name" . | quote }},
-      "distributed_cluster_name": {{ include "sentry.clickhouse.distributed.cluster.name" . | quote }},
+      "cluster_name": {{ default "default" .Values.clickhouse.clusterName | quote }},
+      "distributed_cluster_name": {{ default "default" .Values.clickhouse.clusterName | quote }},
       {{- end }}
     },
   ]

charts/sentry/templates/snuba/secret-snuba-env.yaml

@@ -12,9 +12,6 @@ data:
   CLICKHOUSE_PORT: {{ include "sentry.clickhouse.port" . | b64enc | quote }}
   CLICKHOUSE_DATABASE: {{ include "sentry.clickhouse.database" . | b64enc | quote }}
   CLICKHOUSE_USER: {{ include "sentry.clickhouse.username" . | b64enc | quote }}
-{{- if not .Values.externalClickhouse.existingSecret }}
-  CLICKHOUSE_PASSWORD: {{ include "sentry.clickhouse.password" . | b64enc | quote }}
-{{- end }}
 {{- if .Values.externalClickhouse.secure }}
   CLICKHOUSE_SECURE: {{ include "sentry.clickhouse.secure" . | b64enc | quote }}
 {{- end }}

charts/sentry/values.yaml

@@ -35,7 +35,7 @@ user:
 # recommended to set false for updating the helm chart afterwards,
 # as you will have some downtime on each update if it's a hook
 # deploys relay & snuba consumers as post hooks
-asHook: true
+asHook: false
 
 images:
   sentry:
@@ -2269,48 +2269,6 @@ config:
 
 clickhouse:
   enabled: true
-  nodeSelector: {}
-  # tolerations: []
-  clickhouse:
-    replicas: "1"
-    configmap:
-      remote_servers:
-        internal_replication: true
-        replica:
-          backup:
-            enabled: false
-      zookeeper_servers:
-        enabled: true
-        config:
-          - index: "clickhouse"
-            hostTemplate: "{{ .Release.Name }}-zookeeper-clickhouse"
-            port: "2181"
-      users:
-        enabled: false
-        user:
-          # the first user will be used if enabled
-          - name: default
-            config:
-              password: ""
-              networks:
-                - ::/0
-              profile: default
-              quota: default
-
-    persistentVolumeClaim:
-      enabled: true
-      dataPersistentVolume:
-        enabled: true
-        accessModes:
-          - "ReadWriteOnce"
-        storage: "30Gi"
-
-  ## Use this to enable an extra service account
-  # serviceAccount:
-  #   annotations: {}
-  #   enabled: false
-  #   name: "sentry-clickhouse"
-  #   automountServiceAccountToken: true
 
 ## This value is only used when clickhouse.enabled is set to false
 ##
@@ -2337,20 +2295,6 @@ externalClickhouse:
   ##
   # distributedClusterName: distributed_test_shard_localhost
 
-# Settings for Zookeeper.
-# See https://github.com/bitnami/charts/tree/master/bitnami/zookeeper
-zookeeper:
-  enabled: true
-  image:
-    repository: bitnamilegacy/zookeeper
-  nameOverride: zookeeper-clickhouse
-  replicaCount: 1
-  nodeSelector: {}
-  # tolerations: []
-  ## When increasing the number of exceptions, you need to increase persistence.size
-  # persistence:
-  #   size: 8Gi
-
 # Settings for Kafka.
 # See https://github.com/bitnami/charts/tree/master/bitnami/kafka
 kafka: