KarhutlaSQL — Flight SQL Server Architecture Diagram

Governance in the server

Default-deny per-table privileges (policy YAML)
Tag-based column masking & RLS via AST rewrite
MCP channel always capped by the ai_sandbox profile
Every gateway and job runs as a Flight SQL statement

Execution

Results streamed as Arrow chunks (64 MB buffer)
Per-identity result cache, snapshot invalidation
Per-team quotas + chargeback

Compliance

Per-column PII access history (WORM Parquet)
Signed report runs + DuckLake time travel
Session kills propagated to every instance via the archive

Runtime stack (Go, open source)

Apache Arrow arrow-go v18 — Arrow, Flight SQL, Parquet
DuckDB 1.5.6 via duckdb-go (CGO, static)
grpc-go + protobuf · otelgrpc
pg_query_go (PostgreSQL parser) for authz & rewrite
go-oidc · golang-jwt · x/oauth2 · bcrypt
Prometheus client_golang · OpenTelemetry SDK
minio-go · MCP go-sdk · cobra · viper · yaml.v3
pgproto3 (pgx) · robfig/cron
Vue 3 · apache-arrow JS (embedded web UI)

Infrastructure & integrations

Keycloak (OIDC IdP) · HashiCorp Vault Transit
PostgreSQL 17 + MinIO for DuckLake
DuckDB extensions: ducklake · postgres_scanner · httpfs · vss · sqlite
Prometheus + Grafana · OTLP collector
Apache Airflow + Great Expectations 1.x
Unity Catalog OSS (metadata catalog)

Build, deploy & test

Docker distroless · Docker Compose · Helm · kind
goreleaser · golangci-lint · govulncheck · syft (SBOM)
pytest · adbc-driver-flightsql · pyarrow
Arrow Flight SQL JDBC driver (smoke test)
VitePress + GitHub Pages · Archify (diagram)