Pipeline Builder workflow

Pipeline Builder is the visual editing surface for Nexo policy pipelines. The editor auto-saves pipeline state, but edits do not change the active data path until validation passes and the user completes the Deploy workflow.

Build a draft

1. Open the target project and environment.
2. Create a pipeline or open an existing pipeline.
3. Select supported components from the catalog.
4. Place components in the applicable request, response, router, or connection phase.
5. Configure each component and resolve validation warnings.
6. Review the generated Kubernetes resources in the deployment dialog.

The available catalog depends on entitlement, protocol, and installed release. A visible legacy or sample card is not evidence that the installed bundle can deploy it.

Ordering rules

Request components execute in their listed order before the upstream operation. Response components execute in their listed order after the upstream response. A component that rejects an operation terminates that path.

Practical ordering principles:

• Put access control and hard request limits before expensive transformation or observation.
• Establish authenticated tenant identity before tenant-aware rate limits, cache keys, routing, or masking policy.
• Apply request rewrites before components that must evaluate the rewritten value.
• Apply response masking before logging or audit sinks that could capture protected fields.
• Keep metrics and low-risk aggregate observation near the end of each applicable path.

There is no universal safe order. Validate administrative commands, reads, writes, transactions, errors, and large BSON messages for the intended sequence.

Validation

Builder validation can detect missing required fields, invalid references, phase mismatch, unsupported combinations, and release-specific availability. Server-side and Operator validation remain authoritative; a draft that renders in the browser can still be rejected before activation.

Deploy and verify

Deploying applies the generated desired state through the supported control path:

1. Review the generated CRDs and deployment target.
2. Confirm Deploy through the supported console workflow.
3. Wait for Manager and Operator acknowledgement.
4. Confirm the active graph revision and runtime health.
5. Run representative connectivity and policy checks.

Import or export is a configuration transfer mechanism, not proof that the target environment supports every referenced component. Use the release and configuration rollback surfaces explicitly published by the installed bundle.

0.2.0 boundaries

The 0.2.0 Proxy renders router and connection phases but does not execute them. Several installed CRD schemas are also not registered by the pinned Operator. Use the component catalog and Operator CRD catalog before deploying a 0.2.0 pipeline.

Next steps

• Component catalog — supported components by tier and release.
• Operator CRD catalog — NexoProxy, NexoPipeline, NexoConnectionPipeline, and related CRD reference.
• Deployment topologies — understand the deployment shape before deploying a pipeline.
• Production checklist — pre-go-live review including pipeline validation.
• Support — Private Preview support contacts.