NexoTenantIsolation
:::danger Ineffective in 0.2.0
The 0.2.0 Operator registers and reconciles this Kind, but the pinned Proxy does not execute the router phase. It provides no tenant-isolation boundary.
:::
This page documents the 0.2.0 Private Preview. Schema acceptance, Operator reconciliation, and runtime enforcement are separate claims; the status above is authoritative.
API identity
| Property | Value |
|---|---|
| Kind | NexoTenantIsolation |
| API group | nexo.io |
| Version | v1alpha1 |
| Resource | nexotenantisolations |
| Short name | nti |
| Scope | Namespaced |
| Operator support | Ineffective in 0.2.0 |
Purpose and relationships
Declares tenant identification, routing, and cross-tenant isolation policy.
A NexoPipeline can reference this object and the Operator can record status, but the pinned 0.2.0 Proxy does not execute router-phase components. Use database-native authorization and application controls for tenant boundaries.
Spec field reference
The table is derived from the installed Nexo Edge CRD OpenAPI schema. “Not declared” means the schema publishes no default. A missing schema description is reported explicitly rather than inferred from implementation.
| Field | Type | Required | Default | Schema description |
|---|---|---|---|---|
spec.identificationStrategy | string | No | Not declared | No description is declared in the CRD schema. Allowed values: field, header, jwt, connection. |
spec.fieldPath | string | No | Not declared | No description is declared in the CRD schema. |
spec.headerName | string | No | Not declared | No description is declared in the CRD schema. |
spec.jwtClaimPath | string | No | Not declared | No description is declared in the CRD schema. |
spec.connectionMetadataKey | string | No | Not declared | No description is declared in the CRD schema. |
spec.unidentifiedRequestBehavior | string | No | Not declared | No description is declared in the CRD schema. Allowed values: reject, allow_warning, route_default. |
spec.rejectUnidentified | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.logViolations | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.crossTenantBlocking | string | No | Not declared | No description is declared in the CRD schema. Allowed values: strict, audit, disabled. |
spec.perTenantRateLimit | object | No | Not declared | No description is declared in the CRD schema. |
spec.perTenantRateLimit.requestsPerSecond | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.perTenantRateLimit.maxConnections | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.allowlist | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.denylist | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.tenantRouting | array<object> | No | Not declared | No description is declared in the CRD schema. |
spec.tenantRouting[].tenantId | string | No | Not declared | No description is declared in the CRD schema. |
spec.tenantRouting[].target | string | No | Not declared | No description is declared in the CRD schema. |
spec.defaultTarget | string | No | Not declared | No description is declared in the CRD schema. |
spec.dedicatedPools | object | No | Not declared | No description is declared in the CRD schema. |
spec.dedicatedPools.enabled | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.dedicatedPools.poolSize | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.dataResidency | array<object> | No | Not declared | No description is declared in the CRD schema. |
spec.dataResidency[].tenantPattern | string | No | Not declared | No description is declared in the CRD schema. |
spec.dataResidency[].allowedRegions | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.breachAlerting | object | No | Not declared | No description is declared in the CRD schema. |
spec.breachAlerting.enabled | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.breachAlerting.webhookUrl | string | No | Not declared | No description is declared in the CRD schema. |
spec.mode | string | No | Not declared | No description is declared in the CRD schema. Allowed values: database, collection_prefix, auth_user, header. |
spec.routing | object | No | Not declared | No description is declared in the CRD schema. |
spec.default_target | object | No | Not declared | No description is declared in the CRD schema. |
spec.default_target.name | string | No | Not declared | No description is declared in the CRD schema. |
spec.default_target.address | string | No | Not declared | No description is declared in the CRD schema. |
spec.default_target.tls | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.allow_unknown_tenants | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.blocklist | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.default_rate_limit | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.prevent_cross_tenant | boolean | No | Not declared | No description is declared in the CRD schema. |
Status fields and conditions
| Field | Type | Required | Default | Schema description |
|---|---|---|---|---|
status.ready | boolean | No | Not declared | No description is declared in the CRD schema. |
status.observedGeneration | integer (int64) | No | Not declared | No description is declared in the CRD schema. |
status.configHash | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions | array<object> | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].type | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].status | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].reason | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].message | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].lastTransitionTime | string (date-time) | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].observedGeneration | integer (int64) | No | Not declared | No description is declared in the CRD schema. |
A Ready or configHash value proves that the Operator accepted/hashed the object; it does not by itself prove runtime execution or policy enforcement.
Reconciliation and watch behavior
The registered controller validates the resource and records status. Data-path changes are applied only when the relevant NexoProxy controller rebuilds or reloads the owning graph.
The Kind has its own status controller, but it is absent from the pinned NexoProxy watch list. After an update, explicitly requeue the owning NexoProxy and verify graphRevision/appliedRevision.
Runtime execution effect
None in the pinned 0.2.0 data path. It does not derive a tenant boundary, block cross-tenant access, enforce tenant quotas, or select tenant targets.
Example
Use placeholders and validate in a non-production namespace first. For schema-only or ineffective kinds, this example is for schema inspection only and must not be used as evidence of enforcement.
apiVersion: nexo.io/v1alpha1
kind: NexoTenantIsolation
metadata:
name: <tenant-policy-name>
namespace: <namespace>
spec:
identificationStrategy: connection
connectionMetadataKey: <authenticated-tenant-key>
unidentifiedRequestBehavior: reject
crossTenantBlocking: strict
Update and reconciliation caveats
- This example is for schema inspection only. It does not create a tenant security boundary in the pinned 0.2.0 Proxy.
- Apply component and pipeline changes before expecting the owning NexoProxy graph to change.
- Check metadata.generation, status.observedGeneration when present, and the owning Proxy graphRevision/appliedRevision after every update.
- A successful kubectl apply proves only schema admission; inspect Operator conditions, generated configuration, rollout state, and runtime behavior separately.
Release-specific limitations
- The pinned 0.2.0 Proxy does not execute router-phase components, so this CRD provides no runtime tenant-isolation enforcement.
- The API is v1alpha1 and has no conversion webhook or second served version.
- The CRD schema is retained by Helm and can outlive the Operator release that installed it.
- This immutable page describes Nexo Edge 0.2.0 with Operator 008260c and Proxy 7064b41; later behavior must not be inferred.
Inspect with kubectl
kubectl get nexotenantisolations --namespace <namespace>
kubectl describe nexotenantisolations <name> --namespace <namespace>
kubectl get nexotenantisolations <name> --namespace <namespace> -o yaml
kubectl get crd nexotenantisolations.nexo.io -o yaml
For resources participating in a Proxy graph, also inspect:
kubectl get nexoproxy <proxy-name> --namespace <namespace> \
-o jsonpath='{.status.phase}{" graph="}{.status.graphRevision}{" applied="}{.status.appliedRevision}{"\n"}'
kubectl get nexopipeline <pipeline-name> --namespace <namespace> -o yaml