Problems, use cases, and product boundaries
Nexo 0.2.0 is a licensed Private Preview bundle that places a policy pipeline between MongoDB-compatible clients and an upstream MongoDB endpoint. It can centralize selected logging, metrics, request, and response behavior without moving those controls into every application.
Problem framing
The product is intended to help with compatibility policy, wire-level visibility, governance consistency, traffic experiments, and repeated database work. In 0.2.0, however, the installed schema set is larger than the executable runtime:
- the chart installs 24 CRDs, while the pinned Operator registers 18;
- the Proxy does not execute router or connection phases;
- Access Control is reconciled but ineffective because rendered fields do not match the Proxy contract;
- several catalog concepts are schema-only or dashboard-only.
0.2.0 request path
- A client connects to the Nexo Service.
- Proxy decodes supported OP_MSG traffic.
- Executable request components run in configured order.
- Proxy connects directly to
NexoProxy.spec.targetAddress. - MongoDB returns the response.
- Executable response components process the reply.
Do not infer complete authentication, transaction, retryable-write, change-stream, compression, discovery, or command coverage.
Use-case boundaries
Legacy clients
Version Compatibility is available, but 0.2.0 has no published guarantee of arbitrary
OP_QUERY translation, every old driver, or every server topology. Use only combinations
covered by release-specific evidence.
Traffic splitting and migration
Traffic Split and Tenant Isolation are reconciled, but the router phase is not executed. Read/Write Split is schema-only. They cannot enforce 0.2.0 migration routing. Shadow Traffic is executable but sends plaintext MongoDB wire payloads to its configured target.
Canary changes
The commercial model contains canary concepts, but no immutable 0.2.0 automatic rollback, threshold, or bake-time contract is published. Stage changes using explicit workload checks and the approved deployment workflow.
Tenant isolation
Unavailable as a data-path guarantee because the 0.2.0 router phase is not executed. Use database-native authorization.
Audit and compliance
Audit Log is executable. Configure destinations and body capture carefully; captured material can contain sensitive data. 0.2.0 does not certify SOC 2, HIPAA, ISO 27001, PCI DSS, GDPR, or any customer workload.
Performance
MongoDB Cache, Rate Limiting, Query Rewrite, Query Size Limit, and pooling in the
standalone Proxy capability have release-specific behavior. Index Advisor and Query
Guard are schema-only; Read/Write Split is not executable. Legacy claims about automatic
killOp, explain plans, Redis invalidation, stale refresh, and quantified savings are
unverified.
Legacy capability map
| Legacy topic | 0.2.0 status |
|---|---|
| Extensible pipeline | Bundle-pinned built-ins only; no supported public marketplace |
| Version compatibility | Available component with limited published compatibility evidence |
| Traffic management | Router phase unavailable; Shadow Traffic is the executable exception |
| Observability | Logging and Metrics available; X-Ray has no dedicated CRD |
| Caching | MongoDB Cache available |
| Security | PII Masking and Audit available; Access Control ineffective; Tenant Isolation and Field Encryption unavailable |
| Marketplace | Sample cards only |
Legacy example inventory
The simplified Go step interface, YAML plugin chain, weighted traffic split, Redis cache, marketplace CLI, tenant-filter injection, local binary/Docker quick install, and minimal JSON pipeline examples are preserved as historical designs. They are not valid 0.2.0 configuration unless an exact field is documented by the corresponding 0.2.0 component guide. Router, public marketplace, standalone, and Docker examples are unavailable.
Comparison context
ProxySQL targets MySQL, PgBouncer targets PostgreSQL pooling, Envoy is general purpose,
and mongos is MongoDB's sharded-cluster router. These distinctions do not establish
benchmark, security, or completeness superiority for Nexo 0.2.0.
Legacy documentation
Native shared-library plugins, sandbox permissions, complete bidirectional step execution, compression bridging, double authentication, automatic failover, distributed tracing, cryptographically signed audit storage, public binaries, Docker, and production customer-scale claims are not part of the verified 0.2.0 boundary.