Demo specification — MongoDB policy pipeline

This is the fixture and verification procedure for the MongoDB quickstart. Complete quickstart section 1 first. This demo requires licensed or approved evaluation access; it is not a public self-service installation.

Pinned scope

Item	Value
Nexo distribution	Private Preview; console-issued Nexo Edge chart
Chart interface verified	nexo-edge 0.2.0
MongoDB fixture	mongo:7.0.14
Client	mongosh
Data	Synthetic, unauthenticated, non-production only
Verification date	2026-08-12

If the console issues a different Nexo bundle, record that version with the demo result.

1. Create the disposable fixture

kubectl create namespace nexo-demo
kubectl create deployment mongo --namespace nexo-demo --image=mongo:7.0.14
kubectl expose deployment mongo --namespace nexo-demo \
  --name=mongo --port=27017 --target-port=27017
kubectl rollout status deployment/mongo --namespace nexo-demo --timeout=5m

Seed deterministic data:

kubectl exec deployment/mongo --namespace nexo-demo -- \
  mongosh --quiet nexo_demo --eval '
    db.customers.drop();
    db.customers.insertMany([
      {_id: 1, name: "Ada", segment: "evaluation"},
      {_id: 2, name: "Linus", segment: "evaluation"}
    ]);
    printjson(db.customers.find().sort({_id: 1}).toArray());
  '

Expected output contains two documents ordered by _id, with names Ada and Linus.

2. Prove the direct baseline

kubectl port-forward service/mongo 27017:27017 --namespace nexo-demo

In another terminal:

mongosh --quiet 'mongodb://127.0.0.1:27017/nexo_demo?directConnection=true' \
  --eval 'JSON.stringify(db.customers.findOne({_id: 1}))'

Expected output:

{"_id":1,"name":"Ada","segment":"evaluation"}

Stop the direct port-forward.

3. Configure and deploy Nexo

Return to quickstart section 3 and deploy with:

• target mongo.nexo-demo.svc.cluster.local:27017;
• namespace nexo-demo;
• listen port 27017;
• pipeline name mongodb-preview-demo;
• one Logging component with level=info, include_body=false, and no remote shipping configuration.

Never put a registry token, connect token, license, or real MongoDB credential in a demo manifest or transcript.

4. Verify traffic through Nexo

export PROXY_NAME='<name shown by the deployment result>'
kubectl port-forward "service/$PROXY_NAME" 27018:27017 --namespace nexo-demo

In another terminal:

mongosh --quiet 'mongodb://127.0.0.1:27018/nexo_demo?directConnection=true' \
  --eval 'JSON.stringify(db.customers.findOne({_id: 1}))'

kubectl logs --namespace nexo-demo \
  --selector "nexo.io/proxy=$PROXY_NAME" \
  --all-containers=true --since=2m |
  grep '"command":"find"'

Pass criteria:

• the client receives the same _id: 1 document as the direct baseline;
• a structured log record identifies find, nexo_demo, and customers;
• no request or response body is logged.

5. Roll back and clean up

Stop the port-forward, restore any test application to its direct URI, and follow the quickstart cleanup. The demo passes only when nexo-demo is deleted and no generated credential or install command remains in demo files or transcripts.