Architecture

The two environments

Hyperlake has a control plane and customer-owned runtimes. The control plane authenticates the user, records the requested operation, applies authorization, and returns scoped connection information. The actual data query or in-cluster operation runs against the authorized customer target.

User or coding client
        |
        | CLI or local MCP stdio
        v
Hyperlake control plane  ---- authorization, approvals, audit evidence
        |
        | scoped target access
        v
Customer cloud / private cluster
        |
        +-- applications and services
        +-- catalogs and governed query engine
        +-- observability and policy data

The CLI and MCP client run on the user’s machine. The MCP bridge does not make the model a network peer of the cluster; it exposes the same approved Hyperlake operations as typed tools.

What is a deployment?

A deployment is a named application, service, or infrastructure installation running in a target environment. A cluster can contain many deployments. Installing a Helm chart may create Kubernetes deployments, services, jobs, and other resources; Helm is the packaging mechanism, while the resulting resources are the deployment.

Data path

For a governed query, Hyperlake resolves the target and authorization, then the CLI or MCP client sends the query using the target’s authorized access path. Query results are returned to the client. Secrets and bearer tokens are never printed in normal output.