Grant and Revoke SelectDB Cluster Access for Traffic Isolation - ApsaraDB for SelectDB

An ApsaraDB for SelectDB instance can contain multiple compute clusters. Each cluster is an independent pool of compute resources, letting you route different workloads to different clusters—for example, isolating read traffic from write traffic, or separating online from offline workloads.

This topic describes how to list clusters, switch between them, grant and revoke user access, and set default cluster assignments.

Important

In production, avoid renaming clusters unless necessary. Cluster names appear in queries and JDBC URLs. Renaming a cluster invalidates any permissions previously granted to it.

List clusters

SHOW CLUSTERS returns all compute clusters in the current instance.

Syntax

SHOW CLUSTERS;

Example output

+---------------+------------+-------------+
| cluster       | is_current | users       |
+---------------+------------+-------------+
| test_cluster  | FALSE      | admin, jack |
| test_cluster1 | FALSE      |             |
+---------------+------------+-------------+

Column	Description
`cluster`	Cluster name
`is_current`	Whether the current user is using this cluster
`users`	Users for whom this cluster can be specified as the default

Switch to a cluster

Use USE to select the database and compute cluster for the current session.

Syntax

USE { [catalog_name.]database_name[@cluster_name] | @cluster_name }

Parameters

Parameter	Description
`catalog_name`	The name of the catalog
`database_name`	The name of the database
`cluster_name`	The name of the cluster

If a database or cluster name is a reserved keyword, enclose it in backticks. For example:

USE @`interval`

Examples

Switch to a specific cluster only:

USE @test_cluster;

Switch to a specific database and cluster:

USE test_database@test_cluster;

Specify the database and cluster in a Java Database Connectivity (JDBC) URL:

jdbc:mysql://selectdb-cn-****:9030/test_database@test_cluster

Grant cluster access

Grant a user USAGE_PRIV on a cluster to let them run queries against it.

Syntax

GRANT USAGE_PRIV ON CLUSTER {cluster_name} TO {user}

Parameters

Parameter	Description
`cluster_name`	The name of the cluster
`user`	The username

Example 1: Grant access to an existing cluster

Grant jack access to test_cluster and verify the result:

GRANT USAGE_PRIV ON CLUSTER test_cluster TO jack;
SHOW GRANTS FOR jack\G;

Expected output:

UserIdentity: 'jack'@'%'
     Password: Yes
  GlobalPrivs: Admin_priv  (false)
 CatalogPrivs: NULL
DatabasePrivs: internal.information_schema: Select_priv  (false)
   TablePrivs: NULL
ResourcePrivs: NULL
 CloudCluster: test_cluster: Usage_priv  (false)
   CloudStage: NULL

Example 2: Grant access to a cluster that does not exist

GRANT succeeds even if the cluster does not exist. The privilege is recorded, but using the cluster fails at runtime.

GRANT USAGE_PRIV ON CLUSTER not_exist_cluster TO jack;
SHOW GRANTS FOR jack\G;

The CloudCluster field shows the privilege:

CloudCluster: not_exist_cluster: Usage_priv  (false)

Attempting to use the cluster returns an error:

USE information_schema@not_exist_cluster;

ERROR 5091 (42000): Cluster not_exist_cluster not exist

Revoke cluster access

Remove a user's USAGE_PRIV privilege on a cluster.

Syntax

REVOKE USAGE_PRIV ON CLUSTER {cluster_name} FROM {user}

Parameters

Parameter	Description
`cluster_name`	The name of the cluster
`user`	The username

Example

Revoke jack's access to test_cluster and verify:

REVOKE USAGE_PRIV ON CLUSTER test_cluster FROM jack;
SHOW GRANTS FOR jack\G;

Expected output — CloudCluster is now NULL:

UserIdentity: 'jack'@'%'
     Password: Yes
  GlobalPrivs: Admin_priv  (false)
 CatalogPrivs: NULL
DatabasePrivs: internal.information_schema: Select_priv  (false)
   TablePrivs: NULL
ResourcePrivs: NULL
 CloudCluster: NULL
   CloudStage: NULL

Set a default cluster

Setting a default cluster means users no longer need to specify @cluster_name in each query—the system routes their queries to that cluster automatically.

How the system selects a default cluster (when none is set)

If no default cluster is assigned, the system automatically picks a cluster with an active backend that the user has permission to access. This selection is stable within a session but may change between sessions if:

The user loses permission to the previous default cluster (selection must change).
A cluster is created or deleted (selection must change).
The previous default cluster has no active backend (selection may change).

To avoid unexpected behavior, periodically verify that the intended default cluster is still accessible.

Syntax

-- Set a default cluster for the current user
SET PROPERTY 'default_cloud_cluster' = '{clusterName}';

-- Set a default cluster for another user (requires admin)
SET PROPERTY FOR {user} 'default_cloud_cluster' = '{clusterName}';

Parameters

Parameter	Description
`clusterName`	The name of the cluster
`user`	The username. Setting another user's property requires admin permissions.

Example 1: Set a default cluster for the current user

SET PROPERTY 'default_cloud_cluster' = 'test_cluster';
SHOW PROPERTY;

Expected output:

+------------------------+-------------------------------+
| Key                    | Value                         |
+------------------------+-------------------------------+
| cpu_resource_limit     | -1                            |
| default_cloud_cluster  | test_cluster                  |
| exec_mem_limit         | -1                            |
| load_mem_limit         | -1                            |
| max_query_instances    | -1                            |
| max_user_connections   | 100                           |
| quota.high             | 800                           |
| quota.low              | 100                           |
| quota.normal           | 400                           |
| resource.cpu_share     | 1000                          |
| resource.hdd_read_iops | 80                            |
| resource.hdd_read_mbps | 30                            |
| resource.io_share      | 1000                          |
| resource.ssd_read_iops | 1000                          |
| resource.ssd_read_mbps | 30                            |
| resource_tags          |                               |
| sql_block_rules        |                               |
+------------------------+-------------------------------+

Example 2: Set a default cluster for another user (admin required)

Create a user with the admin role, then check their default cluster:

CREATE USER jack IDENTIFIED BY '123456' DEFAULT ROLE "admin";
SHOW PROPERTY FOR jack;

Expected output:

+------------------------+-------------------------------+
| Key                    | Value                         |
+------------------------+-------------------------------+
| cpu_resource_limit     | -1                            |
| default_cloud_cluster  | test_cluster1                 |
| exec_mem_limit         | -1                            |
| load_mem_limit         | -1                            |
| max_query_instances    | -1                            |
| max_user_connections   | 100                           |
| quota.high             | 800                           |
| quota.low              | 100                           |
| quota.normal           | 400                           |
| resource.cpu_share     | 1000                          |
| resource.hdd_read_iops | 80                            |
| resource.hdd_read_mbps | 30                            |
| resource.io_share      | 1000                          |
| resource.ssd_read_iops | 1000                          |
| resource.ssd_read_mbps | 30                            |
| resource_tags          |                               |
| sql_block_rules        |                               |
+------------------------+-------------------------------+

Example 3: Set a non-existent cluster as the default

If the specified cluster does not exist, the command fails immediately:

SET PROPERTY 'default_cloud_cluster' = 'not_exist_cluster';

ERROR 5091 (42000): errCode = 2, detailMessage = Cluster not_exist_cluster not exist, use SQL 'SHOW CLUSTERS' to get a valid cluster

Run SHOW CLUSTERS to see all available clusters:

SHOW CLUSTERS;

+---------------+------------+-------------+
| cluster       | is_current | users       |
+---------------+------------+-------------+
| test_cluster  | FALSE      | admin, jack |
| test_cluster1 | FALSE      |             |
+---------------+------------+-------------+

FAQ

I get "No cloud cluster name selected." when connecting. What should I do?

Grant the user USAGE_PRIV on at least one cluster. See Grant cluster access.