nexoctl command reference

This reference distinguishes an implemented command from an operationally supported workflow.

Command list

Command	Description	Support status
login	Authenticate and save Control Plane credentials.	Unavailable: interactive token fields do not match the API; --api-key exposes the key in argv.
status	List projects or request detailed environment status.	Unavailable end to end: no supported CLI authentication path; detailed fields also differ.
upgrade	Check versions or request a rollout.	Unavailable: CLI request/status contracts do not match the current Control Plane.
diagnostics, diag	Collect Kubernetes status, logs, events, optional metrics, and a JSON summary.	Supported with appropriate cluster access.
support-bundle, supportbundle, support	Generate, inspect, or redact a support archive.	Collection supported; redaction is best-effort and inspection lists metadata/files only.
scaffold	Generate a pipeline-plugin project.	Available. Generated WASM workflow is not complete; Go is the documented path.
validate	Validate plugin manifest, SDK dependency, and build.	Available.
test	Validate/rebuild a plugin and attempt a smoke test at localhost:27017.	Available; a skipped smoke test is not success evidence.
publish	Package and upload a plugin.	Dry-run only recommended. API key is exposed in argv and archive contents are not allowlisted.
version, help	Print version or help.	Supported.

login

nexoctl login
nexoctl login --server https://api.nexo.io

Flags:

Flag	Description
--server	Control Plane base URL.
--api-key	API key login. Avoid: the key is visible in the process argument list and may be captured by monitoring/audit systems.

The interactive login response model expects snake-case token fields while the current Control Plane returns camel-case fields, so it does not persist a usable access token. Configuration would be stored in ~/.nexoctl/config.json with mode 0600, but that file permission does not correct the response mismatch or argv exposure.

status

nexoctl status
nexoctl status --wide

Flags: --project, --wide.

Do not use this as a supported Control Plane workflow until authentication and response models are aligned. There is no project switch command.

upgrade

Flags: --project, --env, --proxy-version, --manager-version, --check, --wait, and --timeout.

:::warning Not an operational upgrade path

The 0.2.0 CLI sends component-oriented fields while the current Control Plane requires a target environment and one bundle version. It also waits for status values that do not match the Manager acknowledgement lifecycle. Use the supported console or support-directed bundle workflow instead.

:::

diagnostics

Flags:

Flag	Default	Description
--namespace	nexo	Namespace to inspect. Pass nexo-system for the standard Edge installation.
--output	stdout	JSON output path.
--log-lines	200	Lines collected per pod.
--include-logs	true	Include pod logs.
--include-metrics	false	Attempt metrics collection.
--wide	false	Enable logs and metrics and collect 500 log lines.

nexoctl diagnostics \
  --namespace nexo-system \
  --output ./nexo-diagnostics.json

support-bundle generate

Flag	Default	Description
--namespace	nexo-system	Target namespace.
--timerange	1h	Relative collection window.
--include-logs	true	Include pod logs.
--include-metrics	true	Include metrics snapshots.
--include-config	true	Include Nexo resources and selected configuration.
--include-health	true	Include health endpoint snapshots.
--include-decisions	true	Include decision snapshots when available.
--include-events	true	Include Kubernetes events.
--redact-secrets	true	Apply built-in best-effort redaction.
--output	required	Output archive path.
--api-endpoint	empty	Optional Control Plane support-bundle endpoint.
--offline	false	Skip API generation and collect through kubeconfig.

nexoctl support-bundle generate \
  --namespace nexo-system \
  --redact-secrets=true \
  --output ./nexo-support.tar.gz

support-bundle inspect and redact

nexoctl support-bundle inspect ./nexo-support.tar.gz
nexoctl support-bundle redact \
  --output ./nexo-support-redacted.tar.gz \
  ./nexo-support.tar.gz

inspect prints the manifest and filenames; it does not scan file content for secrets. redact recognizes common key names, MongoDB URIs, bearer tokens, and selected key/value patterns. It can miss unlabelled tokens, other authorization schemes, account keys, private keys, and application-specific secrets.

Plugin commands

Command	Flags
scaffold	--name (required), `--type=request
validate	--dir
test	--plugin-path (required), --config, --verbose
publish	--api-key, --endpoint, --dir, --dry-run

publish recursively packages every file under --dir, excluding hidden directories but not hidden files. Until an allowlist/ignore mechanism and safe API-key input are implemented, use only --dry-run from a clean staging directory and inspect the archive before any separately approved upload.