Operator configuration validation
:::caution Next documentation
The rendered-runtime schema gate described here was added after the 0.2.0 Private Preview. The pinned 0.2.0 Operator does not provide this guarantee.
:::
Operator resolves the desired graph and renders component configuration before it changes the Proxy workload. For component types with a registered runtime schema, it validates that rendered configuration first.
Reconciliation sequence
- Resolve
NexoProxy, pipeline, deployment profile, and component references. - Render each supported component into its dedicated configuration.
- Validate rendered values against the registered runtime schema.
- Stop reconciliation on invalid configuration.
- Write generated ConfigMaps and workload changes only after required validation passes.
This ordering prevents a known-invalid configuration from being written and then discovered only after a pod restart.
Validation outcomes
| Outcome | Result |
|---|---|
| Schema registered and configuration valid | Reconciliation continues. |
| Schema registered and configuration invalid | Reconciliation fails closed and reports an error. |
| No schema registered for the rendered type | Reconciliation can only apply the other type-specific checks available in that bundle. |
Operator compiles registered schemas at startup. A malformed bundled schema is a release defect and must prevent that validation registry from being treated as healthy.
Observability
Use resource conditions, reconciliation errors, events, and the Operator configuration validation failure metric to identify rejected desired state. Preserve the failed revision and sanitized validation message when opening a support case.
Release coverage
Rendered-runtime schema coverage remains release-specific. Consult release notes and resource conditions before assuming a component is protected by this gate.