NexoConnectionPipeline
:::danger Schema only — no 0.2.0 reconciliation or enforcement
The 0.2.0 chart installs this schema, but pinned Operator 008260c does not register or reconcile the Kind. Creating the object cannot enforce policy.
:::
This page documents the 0.2.0 Private Preview. Schema acceptance, Operator reconciliation, and runtime enforcement are separate claims; the status above is authoritative.
API identity
| Property | Value |
|---|---|
| Kind | NexoConnectionPipeline |
| API group | nexo.io |
| Version | v1alpha1 |
| Resource | nexoconnectionpipelines |
| Short name | ncpl |
| Scope | Namespaced |
| Operator support | Schema only — no 0.2.0 reconciliation or enforcement |
Purpose and relationships
Declares connection-layer TLS, handshake, identity, authentication, limits, and pooling policy.
When supported, NexoProxy references it directly through spec.connectionPipelineRef; it is separate from the request/response step lists in NexoPipeline.
Spec field reference
The table is derived from the installed Nexo Edge CRD OpenAPI schema. “Not declared” means the schema publishes no default. A missing schema description is reported explicitly rather than inferred from implementation.
| Field | Type | Required | Default | Schema description |
|---|---|---|---|---|
spec.tlsConfig | object | No | Not declared | No description is declared in the CRD schema. |
spec.tlsConfig.mode | string | No | Not declared | No description is declared in the CRD schema. Allowed values: terminate, passthrough, mutual. |
spec.tlsConfig.certificateRef | object | No | Not declared | No description is declared in the CRD schema. |
spec.tlsConfig.certificateRef.name | string | Yes | Not declared | No description is declared in the CRD schema. |
spec.tlsConfig.minVersion | string | No | Not declared | No description is declared in the CRD schema. Allowed values: TLS1.2, TLS1.3. |
spec.tlsConfig.cipherSuites | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.handshake | object | No | Not declared | No description is declared in the CRD schema. |
spec.handshake.timeout | string | No | Not declared | No description is declared in the CRD schema. |
spec.handshake.maxPayloadSize | integer (int64) | No | Not declared | No description is declared in the CRD schema. Minimum: 1. |
spec.handshake.compression | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.tenantIdentification | object | No | Not declared | No description is declared in the CRD schema. |
spec.tenantIdentification.strategy | string | No | Not declared | No description is declared in the CRD schema. Allowed values: connectionString, certificate, header, static. |
spec.tenantIdentification.field | string | No | Not declared | No description is declared in the CRD schema. |
spec.tenantIdentification.fallback | string | No | Not declared | No description is declared in the CRD schema. |
spec.tenantIdentification.securityLevel | string | No | Not declared | No description is declared in the CRD schema. Allowed values: ``, strict, relaxed. |
spec.connectionLimits | object | No | Not declared | No description is declared in the CRD schema. |
spec.connectionLimits.maxConnectionsPerTenant | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.connectionLimits.maxConnectionsGlobal | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.connectionLimits.idleTimeout | string | No | Not declared | No description is declared in the CRD schema. |
spec.connectionLimits.maxLifetime | string | No | Not declared | No description is declared in the CRD schema. |
spec.connectionLimits.maxTrackedTenants | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.authentication | object | No | Not declared | No description is declared in the CRD schema. |
spec.authentication.strategy | string | No | Not declared | No description is declared in the CRD schema. Allowed values: scram-sha-256, x509, ldap, passthrough. |
spec.authentication.secretRef | object | No | Not declared | No description is declared in the CRD schema. |
spec.authentication.secretRef.name | string | Yes | Not declared | No description is declared in the CRD schema. |
spec.authentication.cacheTTL | string | No | Not declared | No description is declared in the CRD schema. |
spec.pooling | object | No | Not declared | No description is declared in the CRD schema. |
spec.pooling.mode | string | No | "none" | No description is declared in the CRD schema. Allowed values: ``, none, session, transaction. |
spec.pooling.maxServerConnections | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.pooling.minIdleConnections | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.pooling.maxConnectionAge | string | No | Not declared | No description is declared in the CRD schema. |
spec.proxyRef | object | No | Not declared | No description is declared in the CRD schema. |
spec.proxyRef.name | string | Yes | Not declared | No description is declared in the CRD schema. |
Status fields and conditions
| Field | Type | Required | Default | Schema description |
|---|---|---|---|---|
status.phase | string | No | Not declared | No description is declared in the CRD schema. Allowed values: Pending, Ready, Failed. |
status.ready | boolean | No | Not declared | No description is declared in the CRD schema. |
status.observedGeneration | integer (int64) | No | Not declared | No description is declared in the CRD schema. |
status.configHash | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions | array<object> | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].type | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].status | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].reason | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].message | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].lastTransitionTime | string (date-time) | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].observedGeneration | integer (int64) | No | Not declared | No description is declared in the CRD schema. |
Although the schema may expose status fields, the pinned Operator does not populate them.
Reconciliation and watch behavior
Pinned Operator 008260c has no type registration or controller for this Kind. No status controller runs and no NexoProxy graph resolver can consume it as a typed component.
There is no watch for this Kind in the pinned Operator.
Runtime execution effect
None in 0.2.0. The pinned Operator cannot consume the object, so the installed schema has no data-path effect.
Example
Use placeholders and validate in a non-production namespace first. For schema-only or ineffective kinds, this example is for schema inspection only and must not be used as evidence of enforcement.
apiVersion: nexo.io/v1alpha1
kind: NexoConnectionPipeline
metadata:
name: <connection-policy-name>
namespace: <namespace>
spec:
tlsConfig:
mode: passthrough
pooling:
mode: none
Update and reconciliation caveats
- Apply component and pipeline changes before expecting the owning NexoProxy graph to change.
- Check metadata.generation, status.observedGeneration when present, and the owning Proxy graphRevision/appliedRevision after every update.
- A successful kubectl apply proves only schema admission; inspect Operator conditions, generated configuration, rollout state, and runtime behavior separately.
Release-specific limitations
- The API is v1alpha1 and has no conversion webhook or second served version.
- The CRD schema is retained by Helm and can outlive the Operator release that installed it.
- This immutable page describes Nexo Edge 0.2.0 with Operator 008260c and Proxy 7064b41; later behavior must not be inferred.
Inspect with kubectl
kubectl get nexoconnectionpipelines --namespace <namespace>
kubectl describe nexoconnectionpipelines <name> --namespace <namespace>
kubectl get nexoconnectionpipelines <name> --namespace <namespace> -o yaml
kubectl get crd nexoconnectionpipelines.nexo.io -o yaml
For resources participating in a Proxy graph, also inspect:
kubectl get nexoproxy <proxy-name> --namespace <namespace> \
-o jsonpath='{.status.phase}{" graph="}{.status.graphRevision}{" applied="}{.status.appliedRevision}{"\n"}'
kubectl get nexopipeline <pipeline-name> --namespace <namespace> -o yaml