Nexo Operator
Nexo Operator is the Kubernetes reconciliation engine for Nexo Edge. It watches Nexo custom resources supported by the bundled build, validates their desired graph, and continuously converges generated Deployments, Services, ConfigMaps, and referenced Secrets toward the approved state.
Responsibilities
| Responsibility | What Operator does |
|---|---|
| Type registration | Registers the 18 nexo.io kinds supported by the chart-pinned Operator; six additional CRD schemas are installed but not registered. |
| Validation | Validates managed signatures, resource-specific fields, references, and readiness for registered resources before rendering workloads. |
| Graph resolution | Resolves NexoProxy, NexoDeploymentProfile, NexoPipeline, router, and supported request/response/connection step references into one runtime graph. |
| Workload reconciliation | Creates and updates Proxy Deployments, Services, routing/step ConfigMaps, and image-pull Secret copies. |
| Drift correction | Reconciles changes continuously and reports observed generation, readiness, phase, conditions, and configuration hashes. |
| Resource ownership | Uses Kubernetes ownership relationships so generated namespaced resources follow the lifecycle of their NexoProxy. |
| Runtime composition | Renders ingress, egress, and supported step containers in the Proxy pod and mounts configured TLS Secrets. |
Features
Declarative pipeline graph
NexoPipeline orders request, response, router, and connection component references.
NexoProxy binds the graph to an upstream address, deployment profile, and license.
Operator resolves registered references before it changes the runtime.
Signed resource and graph validation
Operator validates managed-resource signatures and each registered type's fields,
requires referenced resources to report ready, and computes a graph revision before
rendering the workload. Reconciliation errors are surfaced through NexoProxy status.
Kubernetes-native status
Nexo resources use the status subresource. Depending on the kind, status includes readiness, phase, observed generation, conditions, configuration hash, graph revision, or replica counts.
Health and scale controls
Operator exposes health and readiness probes, Prometheus metrics, and optional leader election for a multi-replica controller deployment.
Installed custom resources
The Nexo Edge 0.2.0 chart installs 24 namespaced CRDs in the nexo.io API group. All
currently expose a single served and storage version, v1alpha1.
Installing a schema does not mean the chart-pinned Operator reconciles that kind. See the CRD catalog for the per-kind reconciled versus schema-only matrix.
Changes
Current 0.2.0 schema baseline
NexoPipelineexposes ordered request, response, router, and connection references, but a reference is usable only when the bundled Operator reconciles the target kind.NexoConnectionPipelineis installed as a schema but is not reconciled by the chart-pinned Operator.NexoDeploymentProfilerecords the approved runtime image and step catalog used to render a deployment.- Query guard and field encryption schemas are installed but not reconciled by the chart-pinned Operator; PII masking, traffic split, tenant isolation, and the documented observability resources are reconciled.
- CRDs carry
helm.sh/resource-policy: keep; uninstalling the Helm release intentionally retains schemas until a cluster administrator removes them.
Schema change policy
Because the current API is v1alpha1, fields can change between Preview bundles. The
release notes must identify added or removed kinds, reconciliation support, field
changes, required migration, and rollback constraints. The current Manager does not
report a CRD schema fingerprint, so operators must verify the installed chart and
Operator support matrix explicitly.