MongoDB quickstart

:::caution Private Preview

Nexo does not currently have a self-service public installer, public chart registry, or GA release. This workflow is for licensed customers and approved evaluations invited to the Nexo console.

:::

This guide uses the Nexo Edge chart 0.2.0 interface and was verified against source on 2026-08-12. If the console issues a newer approved bundle, use its exact generated version and command rather than changing them manually.

Prerequisites

• A licensed Nexo account or approved evaluation invitation with a verified email.
• Permission to create a project and environment in the Nexo console.
• A non-production Kubernetes cluster, with Helm 3 and kubectl configured for it.
• Permission to install cluster-scoped CRDs and create namespaces and Helm releases.
• mongosh for connection checks.
• A MongoDB target reachable from the proxy namespace. The linked demo creates a disposable MongoDB Community 7.0.14 target.

Keep the direct MongoDB URI available. It is the application rollback path.

1. Create the licensed evaluation environment

1. Sign in to the Nexo console and open Onboarding.
2. Enter the evaluation project name, choose Observability, and continue. Onboarding creates that project and provisions its connect token. In the current Preview, the selected template may not pre-populate the pipeline.
3. Open Connect, select the same project, and add a development environment.
4. Generate the registry token and record the expiry shown by the console. The current default can be as long as 90 days, so plan to revoke it after the evaluation.
5. Copy the complete authenticated Helm command displayed by Connect.

The generated command logs Helm in to the issued registry and installs the issued nexo-edge chart with the control-plane URL, connect token, license token, and image-pull credential. Those values are secret or customer-specific. The Preview command places credentials in shell arguments, so run it only from an isolated, trusted administrator host with shell history disabled. Same-host users may be able to observe process arguments while it runs. Do not use this installer on a shared jump host or paste the command into chat, tickets, CI variables, logs, or committed scripts. If this boundary is unacceptable, stop and request an approved secret-delivery procedure from Nexo. This public page intentionally does not reproduce the values.

Disable history for this terminal, run the copied command unchanged, then verify:

set +o history
export NEXO_SYSTEM_NAMESPACE=nexo-system

helm status nexo-edge --namespace "$NEXO_SYSTEM_NAMESPACE"
kubectl rollout status deployment/nexo-manager \
  --namespace "$NEXO_SYSTEM_NAMESPACE" --timeout=5m
kubectl rollout status deployment/nexo-operator \
  --namespace "$NEXO_SYSTEM_NAMESPACE" --timeout=5m

Expected result: Helm reports STATUS: deployed, both deployments report successfully rolled out, and Connect shows the environment as active.

2. Create the disposable target

Complete sections 1 and 2 of the MongoDB policy pipeline demo to create, seed, and baseline the fixture. Its upstream address is:

mongo.nexo-demo.svc.cluster.local:27017

3. Configure and deploy the proxy

1. Add the Free-tier Logging component.
2. Set level to info, leave include_body disabled, and leave remote shipping unconfigured. Logging writes structured operation records to the proxy output.
3. Select Deploy, then choose the connected development environment.
4. Create or select a MongoDB target endpoint using the address above, with TLS and authentication disabled only for this isolated fixture.
5. Set pipeline name mongodb-preview-demo, proxy namespace nexo-demo, and listen port 27017.
6. Review the generated manifests and select Deploy Now.

Record the proxy name from the deployment result:

export PROXY_NAMESPACE=nexo-demo
export PROXY_NAME='<name shown by the deployment result>'

kubectl get nexoproxy "$PROXY_NAME" --namespace "$PROXY_NAMESPACE"
kubectl get service "$PROXY_NAME" --namespace "$PROXY_NAMESPACE"
kubectl wait --for=condition=Ready pod \
  --selector "nexo.io/proxy=$PROXY_NAME" \
  --namespace "$PROXY_NAMESPACE" --timeout=5m

Expected result: NexoProxy reports Running, a same-named ClusterIP Service exposes port 27017, and the proxy pod becomes Ready.

4. Connect and prove the policy path

In one terminal:

kubectl port-forward "service/$PROXY_NAME" 27018:27017 \
  --namespace "$PROXY_NAMESPACE"

In another terminal:

mongosh --quiet 'mongodb://127.0.0.1:27018/nexo_demo?directConnection=true' \
  --eval 'JSON.stringify(db.customers.findOne({_id: 1}))'

kubectl logs --namespace "$PROXY_NAMESPACE" \
  --selector "nexo.io/proxy=$PROXY_NAME" \
  --all-containers=true --since=2m |
  grep '"command":"find"'

Expected client output includes the synthetic customer with _id: 1. Expected proxy output includes a structured log record for find on nexo_demo.customers. Timestamps, connection IDs, response fields, and durations vary.

Rollback and cleanup

1. Restore the application's original direct MongoDB URI.
2. To test configuration rollback, remove Logging and deploy again before teardown.
3. Use Connect → Uninstall and wait for the demo deployment to be removed.
4. Remove the licensed edge installation and disposable namespace:

helm uninstall nexo-edge --namespace nexo-system
kubectl delete namespace nexo-system --wait=true
kubectl delete namespace nexo-demo --wait=true

The chart intentionally retains Nexo CRDs. On a shared cluster, leave them in place until a cluster administrator confirms that no Nexo installation or custom resource uses them:

kubectl api-resources --api-group=nexo.io -o name |
  while read -r resource; do kubectl get "$resource" --all-namespaces; done
kubectl get crd -o name | grep '\.nexo\.io$'

For a dedicated disposable evaluation cluster, deleting the cluster is the safest full cleanup. If the dedicated cluster must remain and the first command confirms there are no Nexo custom resources, remove the retained CRDs:

kubectl get crd -o name |
  grep '\.nexo\.io$' |
  while read -r crd; do kubectl delete "$crd"; done

Never run that CRD deletion command on a shared cluster. There, have the cluster administrator remove CRDs only after checking every Nexo installation and namespace.

5. Revoke the registry token; do not merely wait for its displayed expiry. Do not retain generated install commands in source control, tickets, shell history, or transcripts.

If a check fails, keep the application on its direct URI and use the troubleshooting index. Do not route production traffic through this Private Preview workflow.