fix(chart): bump clickhouse to 26.8.36

CHANGELOG.md

@@ -10,6 +10,7 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ### Security
 
+- ClickHouse 26.8.36, the newest patch of the 26.8 LTS line, which updates musl, zlib and OpenSSL and clears the image's high findings.
 - `appwrite/geo` 0.3.7, which updates `symfony/http-client` to 7.4.23 and clears the image's last high finding.
 - `appwrite/postgres` 0.2.1, `appwrite/browser` 0.3.13 and `openruntimes/executor` 1.3.3, rebuilt with patched packages, which clear all of the database and executor images' critical and high findings and all but one of the browser's. 0.2.1 adds pg_cron and preloads it with pg_stat_statements on new data directories.
 - `appwrite/embedding` 0.3.2, which clears the image's critical findings and
@@ -44,6 +45,7 @@ annotation in `charts/appwrite/Chart.yaml`.
 
 ### Changed
 
+- The built-in ClickHouse's `init.sh` resets `table_readonly`, which ClickHouse 26.7 and later set on the system log tables they replace, before giving those tables a TTL. Without it the pod fails to start after the upgrade to 26.8, which also needs AVX2 on x86 nodes.
 - The browser 0.3.8 and ExifTool 0.1.1 images, as in Appwrite 2.6.2's
   `docker-compose.yml`.
 - `_APP_MEMORY_LIMIT`, new in Appwrite 2.6.2, sets the PHP memory limit of

charts/appwrite/Chart.yaml

@@ -81,7 +81,7 @@ annotations:
     - name: builds
       image: ghcr.io/open-runtimes/orchestrator/job-sidecar:5.1.0
     - name: clickhouse
-      image: docker.io/clickhouse/clickhouse-server:26.4.5-alpine
+      image: docker.io/clickhouse/clickhouse-server:26.8.36-alpine
     - name: console
       image: docker.io/appwrite/new:1.2.138-self-hosted
     - name: database

charts/appwrite/README.md

@@ -432,7 +432,7 @@ Built-in or your own.
 | clickhouse.builtin.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy. |
 | clickhouse.builtin.image.registry | string | `"docker.io"` | Image registry. |
 | clickhouse.builtin.image.repository | string | `"clickhouse/clickhouse-server"` | Image repository. |
-| clickhouse.builtin.image.tag | string | `"26.4.5-alpine"` | Image tag. |
+| clickhouse.builtin.image.tag | string | `"26.8.36-alpine"` | Image tag. |
 | clickhouse.builtin.metrics.enabled | bool | `false` | Serve ClickHouse's built-in Prometheus endpoint on port 9363 of the Service (`/metrics`). No sidecar. See docs/production.md#monitoring. |
 | clickhouse.builtin.nodeSelector | object | `{}` | Node selector. Empty inherits `defaults.nodeSelector`. |
 | clickhouse.builtin.persistence.accessModes | list | `["ReadWriteOnce"]` | Access modes. |

charts/appwrite/files/clickhouse/init.sh

@@ -14,10 +14,11 @@
   # replaced this one, or a week when the log is no longer written at all.
   # The named logs must match the ones system-log-ttl.xml removes: a log that
   # is still written gets replaced on the next restart if its TTL is altered here.
+  # ClickHouse 26.7+ marks the tables it leaves behind table_readonly, which rejects the ALTER.
   client --format TSVRaw <<'SQL' | client --multiquery
-SELECT concat('ALTER TABLE system.', stale.name, ' MODIFY TTL ', if(active.name = '', 'event_date + INTERVAL 7 DAY DELETE', splitByString(' SETTINGS ', splitByString(' TTL ', active.engine_full)[2])[1]), ';')
+SELECT concat(if(stale.readonly, concat('ALTER TABLE system.', stale.name, ' RESET SETTING table_readonly;'), ''), 'ALTER TABLE system.', stale.name, ' MODIFY TTL ', if(active.name = '', 'event_date + INTERVAL 7 DAY DELETE', splitByString(' SETTINGS ', splitByString(' TTL ', active.engine_full)[2])[1]), ';')
 FROM (
-  SELECT name, splitByChar('_', name)[-1] AS suffix, arrayStringConcat(arrayPopBack(splitByChar('_', name)), '_') AS log
+  SELECT name, match(engine_full, 'table_readonly = (1|true)') AS readonly, splitByChar('_', name)[-1] AS suffix, arrayStringConcat(arrayPopBack(splitByChar('_', name)), '_') AS log
   FROM system.tables
   WHERE database = 'system'
     AND position(engine_full, ' TTL ') = 0

charts/appwrite/values.yaml

@@ -578,7 +578,7 @@ clickhouse:
       # -- Image repository.
       repository: clickhouse/clickhouse-server
       # -- Image tag.
-      tag: 26.4.5-alpine
+      tag: 26.8.36-alpine
       # -- Image digest.
       digest: ""
       # -- Image pull policy.

hack/fixtures/external-dbs.yaml

@@ -97,7 +97,7 @@ spec:
     spec:
       containers:
         - name: clickhouse
-          image: clickhouse/clickhouse-server:26.4.5-alpine
+          image: clickhouse/clickhouse-server:26.8.36-alpine
           env:
             - {name: CLICKHOUSE_DB, value: usage}
             - {name: CLICKHOUSE_USER, value: usage}

hack/update-images.sh

@@ -7,7 +7,7 @@
 # same number of version components, so floating tags (7, 7.4, latest) and
 # pre-releases (-rc.1) are never picked. The built-in datastores stay on their
 # current major version, as in renovate.json, and ClickHouse on its current
-# year.month release (26.4.x), since each of those is a feature release.
+# year.month release (26.8.x), since each of those is a feature release.
 #
 # The images Renovate groups with Appwrite in renovate.json (the console,
 # executor, orchestrator and Appwrite's own services) are pinned to what