Deployment topologies
The supported Private Preview path is a customer-managed Kubernetes environment installed from an authenticated, version-pinned command supplied by the Nexo console. Applications connect to a customer-controlled Service; Proxy workloads connect to the customer's MongoDB endpoint.
Logical components
| Component | Placement | Responsibility |
|---|---|---|
| Control Plane | Hosted management service | Identity, projects, environments, revisions, release metadata, orchestration, licensing, and status |
| Manager | Customer Kubernetes cluster | Outbound management connection, inventory, command execution, and acknowledgement |
| Operator | Customer Kubernetes cluster | Resolve supported custom resources and reconcile generated workloads |
| Proxy | Customer Kubernetes cluster | Accept MongoDB traffic and execute the supported pipeline |
| MongoDB | Customer-selected upstream | Authentication, authorization, storage, durability, and database behavior |
Connection lifecycle
- Accept the client connection.
- Establish configured TLS where supported.
- Process the MongoDB handshake and authentication passthrough.
- Select the validated active pipeline.
- Execute supported request components.
- Connect to the configured upstream and forward permitted operations.
- Execute supported response components and return the reply.
- Close or drain the connection during client disconnect or runtime shutdown.
The exact authentication, discovery, transaction, retry, compression, and drain behavior is release-specific.
Available topology
Manager-managed Kubernetes
One environment identity binds a Manager installation to a registered Kubernetes environment. Manager applies approved desired state, Operator reconciles namespaced resources, and the Proxy remains in the application traffic path. The management path is separate from MongoDB traffic.
Use this topology for both isolated evaluation and any production-readiness work. Obtain the install command from the console; do not reconstruct repository URLs, image tags, or credentials from legacy examples.
Shared Proxy service
Multiple applications can connect to a shared Nexo Service when their network, availability, identity, and policy requirements are compatible. Scale Proxy replicas and upstream capacity together, and avoid combining workloads whose blast-radius or data handling requirements require isolation.
Unavailable or contract-dependent topologies
| Legacy topology | Current status |
|---|---|
| Standalone binary on VM or bare metal | No public supported distribution or installation contract |
| Docker or Docker Compose | No public supported distribution |
| Manual application sidecar | No supported installation or lifecycle contract |
| Automatic sidecar injection | Unavailable |
| Public Helm repository | Unavailable; use the authenticated console command |
| Self-hosted Control Plane | Contract-dependent and not published as an available path |
| Air-gapped operation | Contract-dependent and not published as an available path |
| Nexo-managed database traffic service | Unavailable; the data plane is customer-hosted |
Configuration and rollout model
- Author and validate a project revision.
- Resolve it against the target environment and release bundle.
- Deliver an authorized operation to Manager.
- Reconcile the supported custom-resource graph.
- Observe rollout status and verify the active graph revision.
A successful save or deploy request proves desired-state acceptance, not runtime activation. Do not manually patch generated workloads as a normal rollout mechanism.
Ownership model
- Platform teams operate clusters, networks, releases, and shared guardrails.
- Application teams select supported pipelines and validate workload behavior.
- Security teams review identity, data handling, admission, audit, and exception controls.
- Database teams remain responsible for MongoDB availability, authorization, backups, topology, and capacity.
Next steps
- Installation and deployment modes — obtain the authenticated install command from the console.
- Kubernetes deployment settings — resource sizing, security context, scheduling, and disruption controls.
- Control Plane connectivity and targeting — how Manager maintains the management connection.
- Compatibility — supported MongoDB versions and driver behavior.
- Support — Private Preview support contacts.