What is Nexo?
Nexo 0.2.0 is a Private Preview policy enforcement proxy for MongoDB. Applications connect to the Proxy instead of directly to MongoDB, and an ordered pipeline processes supported MongoDB traffic.
:::danger 0.2.0 execution boundary
The connection and router phases are not executed by the pinned 0.2.0 Proxy.
NexoFilter is reconciled but ineffective because the Operator-rendered fields do not
match the Proxy contract. Several other CRDs are schema-only. Use the
0.2.0 component catalog as the authoritative execution matrix.
:::
Why place policy in the traffic path?
A MongoDB-aware intermediary can centralize concerns that otherwise drift across applications: compatibility behavior, traffic measurement, request limits, audit, masking, query transformation, caching, and connection management.
The approach does not eliminate application validation or MongoDB-native identity, authorization, replication, and topology controls.
Request lifecycle
- A client establishes a MongoDB connection to the Proxy.
- The Proxy decodes supported wire messages and correlates requests.
- Executable request-phase steps inspect, modify, reject, or observe the request.
- The request is sent to the configured upstream MongoDB endpoint.
- Executable response-phase steps process the correlated response.
- The response is returned to the client.
The installed schema contains connection and router concepts that this release does not execute. Schema admission and Ready status are not proof of data-path behavior.
0.2.0 capability summary
| Capability | 0.2.0 status |
|---|---|
| Logging and Metrics | Reconciled and executable |
| Query Size Limit and Version Compatibility | Executable; owning-Proxy reconciliation may be required |
| Rate Limiting and Query Rewrite | Reconciled and executable |
| Cache | Executable, but unsuitable for multi-tenant use in this release |
| Shadow Traffic | Executable; upstream shadow transport is plaintext |
| PII Masking and Audit | Reconciled and executable with documented data-handling risks |
| Connection Pipeline | Schema installed but connection phase not executed |
Access Control (NexoFilter) | Reconciled but ineffective |
| Query Guard, Index Advisor, Field Encryption | Schema only |
| Read/Write Split | Schema only; router phase not executed |
| Traffic Split and Tenant Isolation | Reconciled but ineffective because router phase is not executed |
See each component page and CRD reference for exact fields and caveats.
Architecture
- Proxy: handles MongoDB data traffic and executable pipeline steps.
- Operator: reconciles the 0.2.0 CRDs and Proxy workloads.
- Manager: connects the environment and performs approved operations.
- Control Plane: stores desired configuration and environment state.
- nexoctl: supports the documented diagnostic and development workflows.
The pinned Operator build is 20260611.352-008260c; this documentation must not be used
to infer later behavior.
Common evaluation use cases
- Observe MongoDB command volume, latency, and errors.
- Apply executable request limits and rate controls.
- Test version-compatibility behavior against a disposable fixture.
- Evaluate query rewrite, masking, or audit behavior using synthetic data.
- Evaluate cache only where authorization scope and invalidation are safe.
Do not evaluate 0.2.0 Tenant Isolation, Traffic Split, Read/Write Split, Field Encryption, Query Guard, or Access Control as active security or routing controls.
Deployment
Use the documented Manager-managed Kubernetes workflow and pinned release artifacts. Legacy public installer, Docker Compose, standalone, sidecar, marketplace, air-gap, and self-hosted Control Plane claims are not supported 0.2.0 installation paths.
Start evaluating
- Review protocol maturity.
- Select only components marked executable.
- Follow the MongoDB quickstart.
- Verify the active graph revision and data-path behavior.
- Apply the production checklist.
For release-specific entitlements and retired commercial claims, see Pricing.