internal/natscluster, api, docs: adding or removing auth on a running NatsCluster is held; restart-all restarts every server together #55

Merged

mikluko merged 3 commits from mikluko/octant/2401-auth-transition into main

2026-10-05 13:35:08 +00:00

mikluko commented

2026-10-05 13:28:35 +00:00

(Migrated from github.com)

A rollout that adds or removes auth on a running NatsCluster is held: every server stays on the config it runs, Progressing False with reason AuthChangeBlocked, status.rollout.pending naming the servers. The annotation cluster.nats-operator.io/restart-all restarts them all at once, past the gate and paused, and is cleared once read, as force-step is; the rollout then waits on the gate and ends once every server is Ready and Settled. Recreating the NatsCluster stays the other way out.

Removing auth splits the same way, read from nats-server 2.15.0 and not run live: every server pins a route to its own system account (opts.go:6056-6072), $SYS without auth and the system account's key with it, and the receiving side closes a route pinned to an account it cannot look up (route.go:2142-2149). An operator-mode server fetches only account keys; one without auth has no resolver. Both directions are held alike.

A cluster already stalled by 0.4.0 (one server restarted on auth) is held too, and restart-all restarts only the servers still off the target.

The story 2 section names the annotation in prose rather than a kubectl annotate command, since docs/STYLE.md asks for a command to be run against a live cluster first.

Fixes #39

A rollout that adds or removes `auth` on a running `NatsCluster` is held: every server stays on the config it runs, `Progressing` False with reason `AuthChangeBlocked`, `status.rollout.pending` naming the servers. The annotation `cluster.nats-operator.io/restart-all` restarts them all at once, past the gate and `paused`, and is cleared once read, as `force-step` is; the rollout then waits on the gate and ends once every server is Ready and Settled. Recreating the `NatsCluster` stays the other way out. Removing `auth` splits the same way, read from nats-server 2.15.0 and not run live: every server pins a route to its own system account (`opts.go:6056-6072`), `$SYS` without `auth` and the system account's key with it, and the receiving side closes a route pinned to an account it cannot look up (`route.go:2142-2149`). An operator-mode server fetches only account keys; one without `auth` has no resolver. Both directions are held alike. A cluster already stalled by 0.4.0 (one server restarted on `auth`) is held too, and `restart-all` restarts only the servers still off the target. The story 2 section names the annotation in prose rather than a `kubectl annotate` command, since `docs/STYLE.md` asks for a command to be run against a live cluster first. Fixes #39