How Icebreaker is delivered

Icebreaker is not software you install and run end-to-end. The platform is delivered in two cooperating parts:

• The Icebreaker control plane is hosted by Icebreaker as multi-tenant SaaS. You sign in to it, manage your accounts and agents, and configure what should run in your cluster.
• The data plane runs entirely inside your own Kubernetes cluster, in your VPC. It is where queries actually execute. Source data, query plans, and query results never leave your cloud account.

The two are connected by a single outbound connection from a lightweight Icebreaker Agent you install in your cluster.

Icebreaker hosts and operates:

• The admin UI you sign in to.
• The authoritative registry of your accounts, users, agents, Data Servers, Capacity Policies, and catalogs.
• Aggregated job monitoring, execution metrics, and billing / metering.
• The Icebreaker Agent connection endpoint your cluster connects to.

You do not deploy or operate any of these.

You bring:

• An AWS account.
• An EKS cluster.
• An Iceberg catalog (see Catalog integration).
• Network egress from your cluster to Icebreaker’s hosted control plane.
• IAM permissions that let the Icebreaker Agent manage workloads, and that let query pods read source data and write results.

You install:

• The Icebreaker Agent via Helm. The Icebreaker Agent connects to the Icebreaker control plane and reconciles desired state into your cluster.

That’s it from your side. Data Servers, query pods, and Capacity Policies are created in your cluster automatically based on what you configure through the Icebreaker admin UI.

The Icebreaker Agent makes an outbound WebSocket connection to the Icebreaker control plane and authenticates with a token issued to your account.

• The control plane pushes desired state to the Icebreaker Agent: which Data Servers should exist, which Capacity Policies should be configured, etc.
• The Icebreaker Agent pushes actual state back: what currently exists in your cluster, with per-query execution metrics.

No inbound connection from Icebreaker to your cluster is required. The data plane is reachable only by your SQL clients, on a connection URL you configure (see Networking and ingress).

• Your data never leaves your cloud account. Source data, query plans, query results, and intermediate state stay in your S3 buckets and your cluster. The control plane sees only aggregated metadata.
• You keep control of cluster, IAM, and network. Icebreaker does not have credentials in your AWS account.
• You get a managed admin experience. No control plane to deploy, patch, upgrade, or be on call for.
• Your FinOps levers stay yours. Icebreaker runs queries on EC2 capacity you already pay for — including Reserved Instances, Savings Plans, and Spot — rather than acting as a compute reseller.