nexoctl how-tos

Access Control Plane workflows

Do not use nexoctl login, status, or upgrade as current operational workflows. Interactive login does not decode the Control Plane token response, API-key mode exposes the key in process arguments, and status/upgrade response contracts are not aligned. Use the Nexo console.

For upgrades, follow the supported console upgrade and rollback workflow.

Collect diagnostics

nexoctl diagnostics \
  --namespace nexo-system \
  --log-lines 200 \
  --output ./nexo-diagnostics.json

Use --wide for metrics and 500 log lines. Diagnostics can contain workload names, addresses, events, and logs; handle the output as sensitive operational data.

Generate and review a support bundle

nexoctl support-bundle generate \
  --namespace nexo-system \
  --timerange 1h \
  --redact-secrets=true \
  --output ./nexo-support.tar.gz

nexoctl support-bundle inspect ./nexo-support.tar.gz

Built-in redaction is best-effort, and inspect does not scan content. Before transfer:

1. Extract the archive into a restricted temporary directory.
2. Review every included file with your organization's approved secret scanner or DLP process.
3. Manually review logs and configuration for customer data, credentials, private keys, authorization headers, and application-specific secrets.
4. If any uncertainty remains, do not send the bundle; contact Nexo support for a narrower collection procedure.

To run another built-in redaction pass, put flags before the input archive:

nexoctl support-bundle redact \
  --output ./nexo-support-redacted.tar.gz \
  ./nexo-support.tar.gz

Develop and package a plugin safely

nexoctl scaffold --name example-step --type request --lang go
cd example-step
go mod tidy
make build
nexoctl validate
nexoctl test --plugin-path ./example-step.so

The smoke test targets a Proxy on localhost:27017; a skipped test does not prove compatibility.

For packaging, copy only intended release files to a clean staging directory, then use:

nexoctl publish --dir ./plugin-staging --dry-run

List and extract the generated archive, then review every file. Do not include .env, .npmrc, cloud credentials, signing keys, local configuration, test data, or unrelated source artifacts. Live upload is not recommended until publish supports safe credential input and an archive allowlist/ignore mechanism.