Skip to main content

How stardelt works

One picture of the whole platform: who talks to what, and why. Open it on its own page to zoom.

How stardelt works: people, scripts, notebooks and AI assistants sign in once with Keycloak and talk to one front door, stardelt Nova. Nova asks the Trino SQL engine, the Lakekeeper catalog and Airflow for them. Table files live in SeaweedFS. The stardelt Operator, CloudNativePG, ingress and cert-manager run on Kubernetes underneath.

Dashed boxes are optional or switch on per install. Services lists exactly what an install contains today.

Read the picture from the top​

  1. You and your tools. A person works in the browser (the Nova interface), a script or a CI job uses the stardelt command line or the Python package, an AI assistant uses the local MCP server, a notebook runs in JupyterHub. All of them sign in once.
  2. One front door: Nova. The interface and the public API are the same thing: the command line, the Python package and the MCP tools are generated from the one OpenAPI contract Nova publishes (/api/openapi.json, described in the API reference). A feature that exists in the interface exists in the API.
  3. Engines and apps. Trino answers SQL. Airflow runs scheduled pipelines and sends their SQL to Trino. Superset draws dashboards from Trino. Spark Connect takes the heavy jobs. Nova asks them for you; notebooks talk to the engines directly with your token.
  4. Catalog and access. Lakekeeper is the Iceberg catalog: it knows which tables exist and which files belong to them, and every engine asks it first. OpenFGA, when it is on, decides who may see which table.
  5. Storage. Tables are open Iceberg files (Parquet) in SeaweedFS, or in your own S3. Nothing is locked into a stardelt format.
  6. Control plane. The stardelt Operator reads small resources (PlatformInstance, Lakehouse, Catalog, Pipeline, ...) and installs and wires the services above. CloudNativePG keeps the Postgres databases; ingress-nginx and cert-manager give every service its HTTPS name. All of it runs on a Kubernetes cluster you bring.

Five things to remember​

  • One sign-in. Your OIDC provider (Keycloak, deployed by stardelt, or your own) holds users and groups. The browser uses the sign-in page, the command line uses the device code flow (stardelt login), and the same token reaches Nova, Trino and the catalog. See Identity.
  • One API. Whatever you can click, you can call. See Python, command line and agents.
  • Nova acts as you. With sign-in on, your token goes on to the engines, so what you may read is decided by the engine and the catalog for you, not by Nova's own power.
  • Plugs, not a monolith. The engine, the catalog, the identity provider and the object store are replaceable behind open contracts (SQL, the Iceberg REST catalog, OIDC, S3).
  • Known limits. Results Nova keeps in memory are capped (100 000 rows or about 64 MiB per statement); storage credentials are one platform key today, not yet one short-lived key per person.

Where to go next​

I want to ...Read
Try itQuickstart
Install it for realPrerequisites
Go from a source to a dashboardSource to dashboard
Keep source credentials out of pipelinesConnections
Run SQL on a scheduleSchedule SQL
Keep notebooks and pipelines in GitNotebooks and pipelines in git
Publish pipelines from Git to a stagePublish pipelines from Git
See what was run and why it failedQuery log
Use it from a script, CI or an AI assistantPython, command line and agents
Know what is installed and what is only plannedServices
Understand who may do whatSecurity model