In ClickHouse, a settings profile is a collection of settings grouped under the same name. By default, there is a profile
readonly that allows only read queries. This is from
<yandex> <!-- Profiles of settings. --> <profiles> ... <!-- Profile that allows only read queries. --> <readonly> <readonly>1</readonly> </readonly> </profiles> ...
So to create a read-only user we just have to:
CREATE USER username IDENTIFIED WITH plaintext_password BY 'qwerty' SETTINGS PROFILE 'readonly' GRANT SHOW TABLES, SELECT ON database.* TO username