Skip to main content
Version: Next (Private Preview)

Connection pipeline operations reference

The connection pipeline CRD records intended ingress behavior and validates its schema, but the current Operator does not deliver its TLS, handshake, tenant identity, connection-limit, or authentication fields to the runtime.

The dashboard editor maps to NexoConnectionPipeline fields under tlsConfig, handshake, tenantIdentification, pooling, connectionLimits, and authentication. The Operator resolves and validates the CRD and includes it in graph-revision metadata, but intentionally omits the unconsumed connection-pipeline configuration from runtime mounts.

:::caution Validation is not enforcement

Do not treat a valid or Ready NexoConnectionPipeline as evidence that these controls are active. Configure supported listener and upstream TLS through NexoDeploymentProfile; authentication and tenant-identification enforcement described by this CRD are not available in the current runtime path.

:::

TLS Configuration​

The CRD schema accepts passthrough, terminate, and mutual modes, but these values are not delivered to the runtime in the current release.

  • mode — passthrough relays encrypted bytes and cannot inspect encrypted payloads; terminate decrypts at Nexo so policy can be enforced and then re-encrypts to the backend; mutual terminates TLS and requires/verifies a client certificate for mTLS.
  • certificateRef — Kubernetes secret reference required by operator validation whenever mode is not passthrough.
  • minVersion — must be TLS1.2 or TLS1.3.
  • cipherSuites — comma-separated in the dashboard and deployed as a string array; each configured suite must be non-empty.

Tier gating is enforced by dashboard helpers: passthrough is available on Free, terminate requires the tier configured for terminated TLS, and mutual TLS requires the tier configured for mTLS.

For deployable listener TLS, use NexoDeploymentProfile.spec.tls. For deployable upstream TLS, use NexoDeploymentProfile.spec.upstreamTLS. Keep listener and upstream certificate Secrets separate.

Handshake Settings​

Handshake settings are validated as intended future configuration but do not currently change runtime connection establishment.

  • timeout — edited as milliseconds in the dashboard and deployed as a duration string such as 10000ms; operator validation requires a positive duration.
  • maxPayloadSize — maximum handshake payload bytes; the CRD schema and operator require a value greater than zero.
  • compression — dashboard choices are none, snappy, zstd, and zlib. The CRD stores enabled algorithms as an array; none deploys as an empty list.

Tenant Identification​

Tenant-identification fields are schema-validated but are not delivered to the runtime. They do not currently establish a trusted tenant identity or isolation boundary.

  • strategy — chooses where tenant identity comes from. certificate and static are treated as safe by validation logic.
  • field — selector or literal value. For header, this is the name of a BSON field in the MongoDB OP_MSG command document that carries the tenant ID, not an HTTP or TLS header; the proxy reads that field per request. For static, it is a literal tenant ID; for certificate, a subject selector; for connectionString, a connection-string parameter. It is required by operator validation.
  • fallback — free-form fallback behavior for unknown or missing tenants: either a policy keyword such as reject/allow, or a literal fallback tenant ID. The editor offers reject/allow presets but accepts any value; blank triggers a warning.
  • securityLevel — editable in the dashboard editor; accepts empty, strict, or relaxed. Strict mode only permits certificate or static strategies, enforced by both the dashboard and operator.

connectionString and header are client-controlled and can be spoofed. More importantly, none of these strategies are enforced through this CRD in the current release. Do not use this configuration as evidence of production tenant isolation.

Pooling​

Pooling intent is tracked on the connection-pipeline CRD as validation and graph metadata only. The current Operator does not deliver these fields to the runtime, and the standalone Connection Pooler CRD is also skipped.

  • mode — none disables pooling and is the dashboard default. session and transaction are opt-in pooling modes.
  • maxServerConnections, minIdleConnections, and maxConnectionAge — accepted by the CRD for the next runtime increment, but not exposed in this compact dashboard editor.

The schema accepts transaction mode for forward compatibility, but no pooling mode on this CRD has current runtime effect.

Connection Limits​

Connection-limit fields are accepted and validated by the CRD but are not delivered to the runtime in the current release.

  • maxConnectionsGlobal — total client-facing connection budget. Dashboard helpers clamp positive values to the tier cap from connectionLimitCaps.
  • maxConnectionsPerTenant — per-tenant budget. 0 means no user-set limit; your plan's tier ceiling still applies. Independent per-tenant budgets require the tier represented by PER_TENANT_BUDGET_MIN_TIER; below that tier the dashboard pins per-tenant to global.
  • idleTimeout — optional duration such as 5m for idle client connections; leave empty for no timeout.
  • maxLifetime — optional duration such as 1h that caps connection lifetime; leave empty for no lifetime cap.
  • maxTrackedTenants — CRD field for tracked tenant count; it is accepted by the schema but not exposed in the dashboard editor.

Authentication​

Authentication settings express intended strategies but do not establish identity in the current runtime path. MongoDB authentication is passed through to the configured upstream; listener mTLS, when required, is configured on NexoDeploymentProfile.spec.tls.

  • strategy — one of passthrough, scram-sha-256, x509, or ldap.
  • secretRef — credential secret reference required by operator validation unless strategy is passthrough.
  • cacheTTL — positive duration controlling authentication cache lifetime; the dashboard warns when the value does not look like a duration.

The dashboard marks strategies returned by isUnsupportedConnectionAuthStrategy as unavailable. Even fields that pass CRD validation are not delivered to the runtime, so do not select a strategy here expecting Nexo-side authentication enforcement.

Search Nexo documentation

Type to search titles, headings, and page content.