NexoTenantIsolation
:::tip Reconciled
The selected Operator registers this Kind. Runtime effect still requires a valid reference from the owning Proxy graph and a compatible runtime component.
:::
This page documents the current development contract. Schema acceptance, Operator reconciliation, and runtime enforcement are separate claims; the status above is authoritative.
API identity
| Property | Value |
|---|---|
| Kind | NexoTenantIsolation |
| API group | nexo.io |
| Version | v1alpha1 |
| Resource | nexotenantisolations |
| Short name | nti |
| Scope | Namespaced |
| Operator support | Reconciled |
Purpose and relationships
Declares tenant identification, routing, and cross-tenant isolation policy.
It has runtime effect only when a NexoPipeline referenced by a NexoProxy includes this object in a compatible phase and the selected Operator/runtime bundle supports the contract.
Spec field reference
The table is derived from the installed Nexo Edge CRD OpenAPI schema. “Not declared” means the schema publishes no default. A missing schema description is reported explicitly rather than inferred from implementation.
| Field | Type | Required | Default | Schema description |
|---|---|---|---|---|
spec.identificationStrategy | string | No | Not declared | No description is declared in the CRD schema. Allowed values: field, header, jwt, connection. |
spec.fieldPath | string | No | Not declared | No description is declared in the CRD schema. |
spec.headerName | string | No | Not declared | No description is declared in the CRD schema. |
spec.jwtClaimPath | string | No | Not declared | No description is declared in the CRD schema. |
spec.connectionMetadataKey | string | No | Not declared | No description is declared in the CRD schema. |
spec.unidentifiedRequestBehavior | string | No | Not declared | No description is declared in the CRD schema. Allowed values: reject, allow_warning, route_default. |
spec.rejectUnidentified | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.logViolations | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.crossTenantBlocking | string | No | Not declared | No description is declared in the CRD schema. Allowed values: strict, audit, disabled. |
spec.perTenantRateLimit | object | No | Not declared | No description is declared in the CRD schema. |
spec.perTenantRateLimit.requestsPerSecond | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.perTenantRateLimit.maxConnections | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.allowlist | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.denylist | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.tenantRouting | array<object> | No | Not declared | No description is declared in the CRD schema. |
spec.tenantRouting[].tenantId | string | No | Not declared | No description is declared in the CRD schema. |
spec.tenantRouting[].target | string | No | Not declared | No description is declared in the CRD schema. |
spec.defaultTarget | string | No | Not declared | No description is declared in the CRD schema. |
spec.dedicatedPools | object | No | Not declared | No description is declared in the CRD schema. |
spec.dedicatedPools.enabled | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.dedicatedPools.poolSize | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.dataResidency | array<object> | No | Not declared | No description is declared in the CRD schema. |
spec.dataResidency[].tenantPattern | string | No | Not declared | No description is declared in the CRD schema. |
spec.dataResidency[].allowedRegions | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.breachAlerting | object | No | Not declared | No description is declared in the CRD schema. |
spec.breachAlerting.enabled | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.breachAlerting.webhookUrl | string | No | Not declared | No description is declared in the CRD schema. |
spec.mode | string | No | Not declared | No description is declared in the CRD schema. Allowed values: database, collection_prefix, auth_user, header. |
spec.routing | object | No | Not declared | No description is declared in the CRD schema. |
spec.default_target | object | No | Not declared | No description is declared in the CRD schema. |
spec.default_target.name | string | No | Not declared | No description is declared in the CRD schema. |
spec.default_target.address | string | No | Not declared | No description is declared in the CRD schema. |
spec.default_target.tls | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.allow_unknown_tenants | boolean | No | Not declared | No description is declared in the CRD schema. |
spec.blocklist | array<string> | No | Not declared | No description is declared in the CRD schema. |
spec.default_rate_limit | integer (int32) | No | Not declared | No description is declared in the CRD schema. Minimum: 0. |
spec.prevent_cross_tenant | boolean | No | Not declared | No description is declared in the CRD schema. |
Status fields and conditions
| Field | Type | Required | Default | Schema description |
|---|---|---|---|---|
status.ready | boolean | No | Not declared | No description is declared in the CRD schema. |
status.observedGeneration | integer (int64) | No | Not declared | No description is declared in the CRD schema. |
status.configHash | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions | array<object> | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].type | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].status | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].reason | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].message | string | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].lastTransitionTime | string (date-time) | No | Not declared | No description is declared in the CRD schema. |
status.conditions[].observedGeneration | integer (int64) | No | Not declared | No description is declared in the CRD schema. |
A Ready or configHash value proves that the Operator accepted/hashed the object; it does not by itself prove runtime execution or policy enforcement.
Reconciliation and watch behavior
The registered controller validates the resource and records status. Data-path changes are applied only when the relevant NexoProxy controller rebuilds or reloads the owning graph.
At startup, the current NexoProxy controller installs a typed watch when the CRD is discoverable. A CRD installed after Operator startup requires an Operator restart before that reference watch is added.
Runtime execution effect
The router/policy runtime derives an authenticated tenant boundary, blocks cross-tenant access, and may choose a tenant target.
Example
Use placeholders and validate in a non-production namespace first. For schema-only or ineffective kinds, this example is for schema inspection only and must not be used as evidence of enforcement.
apiVersion: nexo.io/v1alpha1
kind: NexoTenantIsolation
metadata:
name: <tenant-policy-name>
namespace: <namespace>
spec:
identificationStrategy: connection
connectionMetadataKey: <authenticated-tenant-key>
unidentifiedRequestBehavior: reject
crossTenantBlocking: strict
Update and reconciliation caveats
- Apply component and pipeline changes before expecting the owning NexoProxy graph to change.
- Check metadata.generation, status.observedGeneration when present, and the owning Proxy graphRevision/appliedRevision after every update.
- A successful kubectl apply proves only schema admission; inspect Operator conditions, generated configuration, rollout state, and runtime behavior separately.
Release-specific limitations
- The API is v1alpha1 and has no conversion webhook or second served version.
- The CRD schema is retained by Helm and can outlive the Operator release that installed it.
- Current documentation can describe unreleased development behavior; verify the exact deployed bundle and image digests.
Inspect with kubectl
kubectl get nexotenantisolations --namespace <namespace>
kubectl describe nexotenantisolations <name> --namespace <namespace>
kubectl get nexotenantisolations <name> --namespace <namespace> -o yaml
kubectl get crd nexotenantisolations.nexo.io -o yaml
For resources participating in a Proxy graph, also inspect:
kubectl get nexoproxy <proxy-name> --namespace <namespace> \
-o jsonpath='{.status.phase}{" graph="}{.status.graphRevision}{" applied="}{.status.appliedRevision}{"\n"}'
kubectl get nexopipeline <pipeline-name> --namespace <namespace> -o yaml