Kubernetes

The Helm chart is the supported way to run Memcove on Kubernetes — server + Flight + reconciler, probes, ServiceAccount/IRSA, ConfigMap, and optional Ingress and NetworkPolicy. This page covers the network isolation that the chart can enable but that you must get right regardless of how you deploy. Everything environment-specific is a MEMCOVE_* setting (see Settings reference).

The trust-boundary NetworkPolicy

Because Memcove trusts a header set by the proxy, the only thing that may reach its ports is that proxy. This policy denies all ingress to the Memcove pods except from the proxy, for the MCP port (8090) and the Flight port (8815). Adapt the labels, namespace, and ports to your cluster. Restrict Trino similarly (a separate policy) so impersonation can't be sidestepped.

deploy/networkpolicy.example.yaml

# EXAMPLE NetworkPolicy — adapt to your cluster; not applied by Memcove.
#
# Memcove trusts a tenant header set by an authenticating proxy, so the ONLY thing
# that may reach its ports is that proxy. This policy denies all ingress to the
# Memcove pods except from pods labelled as the identity proxy. Replace labels,
# namespace, and ports to match your environment.
#
# Trino should be similarly restricted so that only Memcove can reach it (a separate
# policy in your Trino namespace) — otherwise impersonation can be sidestepped.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: memcove-proxy-only-ingress
  namespace: memcove # <- your namespace
spec:
  podSelector:
    matchLabels:
      app: memcove # <- your Memcove pod label
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: oidc-proxy # <- the ONLY allowed caller (your auth proxy)
      ports:
        - protocol: TCP
          port: 8090 # MCP server  (MEMCOVE_PORT)
        - protocol: TCP
          port: 8815 # Arrow Flight (MEMCOVE_FLIGHT_PORT)

Restrict Trino too

Locking down the Memcove pods is not enough. If tenants (or anything else) can reach Trino directly, per-tenant impersonation can be sidestepped. Apply an equivalent policy in your Trino namespace so only Memcove can reach it.

Values surface

When you install with the Helm chart, configuration lives in its values.yaml (and the NetworkPolicy above is a chart toggle — networkPolicy.enabled). If you'd rather build your own manifests, this flat reference maps every knob to its MEMCOVE_* env var; secrets should come from your secret manager, not committed config.

deploy/values.example.yaml

# EXAMPLE values — the Memcove config surface as a values file, for wiring into your
# own Helm chart / ArgoCD Application / Kustomize base. Every key maps to a MEMCOVE_*
# env var. Secrets (S3 keys, PG password, ticket secret) should come from your secret
# manager, not this file. Defaults live in the app; only override what you need.
memcove:
  # MCP + Flight
  port: 8090
  flight:
    port: 8815
    advertiseUri: grpc://memcove-flight.internal:8815
    ticketTtlSeconds: 300
    # ticketSecret: <from secret manager>  (MEMCOVE_FLIGHT_TICKET_SECRET)

  # Object store (bring your own S3-compatible store)
  s3:
    endpoint: https://s3.us-east-1.amazonaws.com
    region: us-east-1
    pathStyle: false
    warehouseBucket: my-memcove-warehouse
    stagingBucket: my-memcove-staging
    artifactsBucket: my-memcove-artifacts
    # accessKey / secretKey: <from secret manager>

  # Iceberg REST catalog
  iceberg:
    restUri: http://iceberg-rest.internal:8181
    warehouse: s3://my-memcove-warehouse/
    catalogName: memcove

  # Trino read/derive/export engine.
  # REQUIRES Trino server >= 431: derive's atomic replace uses the Iceberg connector's
  # CREATE OR REPLACE TABLE, which does not exist on older servers. Bring-your-own Trino
  # must be 431+ or derive replace will fail.
  trino:
    host: trino.internal
    port: 443
    httpScheme: https
    user: memcove # service principal
    catalog: iceberg
    impersonation: true # connect AS the tenant; requires a Trino grant backend

  # Postgres control-plane registry
  # pgDsn: <from secret manager>  (MEMCOVE_PG_DSN)

  # Tenancy + isolation
  tenantHeader: x-memcove-tenant # set by your auth proxy; clients cannot spoof it
  sharedSchemas: # read-only reference plane; per-domain schemas
    - ref_market
  allowedS3IngestPrefixes: [] # empty = agent s3_parquet ingest disabled (fail closed)

Deploying

The Helm chart wires up the three entry points for you. If you deploy by hand, the container commands are:

• memcove-server — the MCP control plane (Streamable HTTP, port 8090).
• memcove-flight — the Arrow Flight data plane (gRPC, port 8815), only needed if you use the streaming tools.
• memcove-reconcile — registry/catalog drift repair (run as a CronJob).

See the Production checklist before exposing anything.