No description
  • Go 98.9%
  • Go Template 0.8%
  • Just 0.2%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Mikhail Lukianchenko 14da7f7a19
internal/natscluster: pin Settled on a NatsCluster whose groups are led elsewhere (#65)
* AGENTS.md: name the clusters this project runs in

* internal/natscluster: pin Settled on a NatsCluster whose groups are led elsewhere

Reproduces upeks-dev-us-east-2c, Ready=True and Settled=False/GroupsLeaderless:
its servers report stream and consumer groups whose leader sits in another
NATS cluster, so the merge records NamedLeader and leaves Leader empty.

The fixtures are its three /jsz answers cut to what the observer reads for
this case (the meta leader, account name and ID, stream and consumer names,
raft group and leader), with every name replaced.
2026-10-06 15:01:23 +02:00
.github .github, hack, docs: workflows carry readable names and run titles; the site is not built for a pull request (#22) 2026-10-04 17:13:25 +02:00
api internal/natscluster, api, docs: adding or removing auth on a running NatsCluster is held; restart-all restarts every server together (#55) 2026-10-05 15:35:08 +02:00
charts/nats-operator internal/authctl, api, docs: a system account's recovered revocation keeps the identity key across a signing key rotation (#52) 2026-10-05 15:08:20 +02:00
cmd api, charts, config, internal, docs: every API group is under nats-operator.io; the install page has the upgrade from 0.2.x (#20) 2026-10-04 15:22:01 +02:00
config internal/authctl, api, docs: a system account's recovered revocation keeps the identity key across a signing key rotation (#52) 2026-10-05 15:08:20 +02:00
docs internal/natscluster, docs: a podTemplate probe or lifecycle hook naming another handler replaces the rendered one (#62) 2026-10-05 18:29:28 +02:00
hack internal/authctl: an account JWT whose signer the servers do not list is not pushed or counted as distributed (#26) 2026-10-05 09:07:08 +02:00
internal internal/natscluster: pin Settled on a NatsCluster whose groups are led elsewhere (#65) 2026-10-06 15:01:23 +02:00
.gitignore hack/e2e-fixtures, hack/e2e, internal/e2e, docs, api: the key-holding e2e fixtures are generated into bin/e2e/fixtures on every run and no longer committed; trust JWTs in three stories come from generated patch files; the site publishes nothing under a story's e2e directory 2026-09-29 12:31:33 +02:00
.golangci.yml internal/manager, cmd, charts, hack/rbac: a namespace-scoped mode (--watch-namespaces, Roles per watched namespace, cluster-scoped and namespaced role files generated); image digests for the controllers, nats and the exporter (NatsCluster spec.image is {repository, digest}); controller-runtime's metrics filter; tolerations, priorityClassName, topologySpreadConstraints, extraArgs and env values; an optional metrics Service and ServiceMonitor; the cmd envtest collision fixed; one mapper in refindex, one pool with a preset option, the shared markers in manager; lint without checkPrivateReceivers 2026-09-28 16:09:28 +02:00
.ko.yaml .github, hack/pindigests, hack/release_test, .ko.yaml, AGENTS.md, Justfile: hack/pindigests replaces only the digest values in the packaged values.yaml; release_test asserts on step ids; the release jobs set up Go uncached; ci installs helm-unittest from the release asset checked against a pinned sha256; AGENTS.md states the manual-run condition and the first-release steps 2026-09-29 09:32:56 +02:00
AGENTS.md internal/natscluster: pin Settled on a NatsCluster whose groups are led elsewhere (#65) 2026-10-06 15:01:23 +02:00
CHANGELOG.md CHANGELOG: cut 0.5.1 (#63) 2026-10-05 18:29:29 +02:00
CONTEXT.md api, internal, docs, CONTEXT.md: "adopt" is defined, and replaces "take over" everywhere, spec.takeover included (#45) 2026-10-05 12:08:20 +02:00
go.mod Update module github.com/google/cel-go to v0.29.0 [SECURITY] (#2) 2026-10-04 12:31:13 +02:00
go.sum Update module github.com/google/cel-go to v0.29.0 [SECURITY] (#2) 2026-10-04 12:31:13 +02:00
Justfile Justfile, .github, hack/rbac, internal/sysobs: just test runs without the race detector; ci runs go test, go race and go envtest as parallel jobs (#19) 2026-10-04 14:30:30 +02:00
LICENSE Release hygiene: LICENSE (Apache-2.0), README, SECURITY.md; the release waits on ci; every action pinned by SHA, the Hugo deb by checksum, the ko base and the machine base by digest; images and chart signed and attested; govulncheck and an e2e job in CI; release-plan.sh replaced by the changelog action's outputs 2026-09-28 13:21:36 +02:00
README.md docs, internal/chart, hack, .github: the install page is a how-to guide; its values, flags, metrics and RBAC are a reference page (#18) 2026-10-04 14:10:57 +02:00
SECURITY.md .github, hack, docs: release-cut runs ci on a push to main and tags as the releaser app; release-roll builds from the pushed tag; Actions files are .yaml and actions are at version tags (#21) 2026-10-04 17:00:21 +02:00

nats-operator

nats-operator is three Kubernetes controllers that deploy NATS clusters, own their auth plane, and manage and balance JetStream. You can install all three controllers or only the ones you need.

Controllers

  • The cluster controller deploys a NATS cluster from a NatsCluster and restarts it one server at a time. It also joins NATS clusters into a supercluster, or to a hub as leaves.
  • The auth controller creates the JWT auth plane, which is a NATS operator with its accounts and users, and distributes it to the servers.
  • The JetStream controller manages streams, consumers, key-value buckets and object stores, and balances JetStream leadership and placement. It works through a NatsConnection to any NATS cluster.

Install

You need Kubernetes 1.33, Helm 3.14 and nats-server 2.15.0, or later.

To install the CRDs and all three controllers, and then test the release, run these commands with <version> replaced by a release version, such as 0.1.1:

helm install nats-operator oci://ghcr.io/mikluko/nats-operator/charts/nats-operator \
  --version <version> \
  --namespace nats-operator --create-namespace
helm test nats-operator --namespace nats-operator --logs

To leave a controller out, set cluster.enabled, auth.enabled or jetstream.enabled to false.

Then follow the quickstart to deploy a NATS cluster with JetStream.

Documentation

The site documents main. For a release, read docs/ at its tag.

Development

just generates, builds, tests and lints. just envtest runs the tests that need an API server, and just e2e runs the stories on kind. docs/README.md has the steps to build and check the documentation site.

License

Apache-2.0.