Kimo Bridge overview

Kimo Bridge is a small package, kimo-bridge, that you run next to your database. It opens one outbound, mutually authenticated TLS connection to Kimo and keeps it open. Kimo sends queries down that connection; the bridge checks them against a local policy, runs them under a read-only role and returns the results. You open no inbound ports and Kimo never holds your database credentials. The product page at /bridge has an animated walkthrough.

Architecture

1. 1Enrollment. On first start the bridge generates a key pair on your host and exchanges a one-time kbt_ token for a short-lived client certificate. The private key never leaves the host.
2. 2Tunnel. The bridge dials bridge.eu.getkimo.com or bridge.us.getkimo.com on TCP 443 and negotiates TLS 1.3 with mutual authentication.
3. 3Query. A dashboard tile, alert or Ask Kimo question compiles to SQL in Kimo’s semantic layer and is pushed down the open tunnel as a signed request.
4. 4Policy. The bridge parses the SQL, rejects anything that is not a read, checks every table and column against the allow-list, appends row filters and applies limits.
5. 5Execution. The query runs on your database under the role you created. Aggregations happen there, so usually only a handful of rows come back.
6. 6Audit. The bridge appends an entry to its local, hash-chained audit log and mirrors it to Activity.

Bridge, Cloud and Hybrid mode

Each source behind a bridge has its own mode. You can mix them freely and change a source with one line and a kimo-bridge reload.

Supported sources

Next steps

• Install the bridge with Docker, Helm or the static binary.
• Read the configuration reference for every kimo-bridge.yaml key.
• Share Bridge security with your security team, or the long-form security model guide.