mikluko/nats-operator
Watch
1
0
Fork
You've already forked nats-operator
 0
Code Issues 2 Pull requests 13 Projects Releases 8 Packages Activity Actions
8 releases 8 tags
  • v0.4.0 d680643a9b

    v0.4.0 Stable

    github-actions[bot] released this 2026-10-05 11:38:37 +00:00 | 14 commits to main since this release

    Added

    • NatsAccount.spec.limits.jetstream.tiers sets an account's JetStream limits by tier, R1 to R5 after the replica count of a stream, in place of limits for the account as a whole.
    • NatsAccount.spec.limits.jetstream, and each of its tiers, takes maxAckPending, memoryMaxStreamBytes, diskMaxStreamBytes and maxBytesRequired.
    • An import of a NatsAccount names the NatsSystemAccount of its NatsOperator under accountRef, taking account-monitoring-services or account-monitoring-streams with the account's own public key in the subject.
    • An import of a NatsAccount names its exporter by publicKey in place of accountRef, with the export's subject and type, and for a private export activation.secretKeyRef selecting the activation token the exporter issued; status.imports[].activation then reads Supplied.
    • An import of a NatsAccount takes share on a Service import and allowTrace on a Stream import.
    • NatsAccount.spec.adoption.droppedClaims and NatsSystemAccount.spec.adoption.droppedClaims, Refuse when omitted or Accept, say whether the first signing of an account the servers already hold a JWT for goes ahead where it would drop claims that JWT carries.
    • A signing key under keys.signing of a NatsAccount or a NatsSystemAccount takes scope, which makes it a scoped signing key: a role, and the permissions, connectionTypes and limits (subscriptions, payload) that the servers hold every user it signs to.
    • NatsUser.spec.role signs the user with the account's scoped signing key of that role; it excludes permissions, connectionTypes and preset. A scoped signing key signs no other user and no activation token.

    Changed

    • Each release's images and chart are signed with the certificate identity https://github.com/mikluko/nats-operator/.github/workflows/release-roll.yaml@refs/tags/v<version>, and their build provenance attestations name the signer workflow release-roll.yaml and the source ref refs/tags/v<version>; SECURITY.md has the commands for these and for releases 0.1.0 through 0.3.1.
    • A NatsAccount importing from a NatsAccount that has no public key yet is not signed until it has one; meanwhile its Ready and ReferencesResolved conditions are False with the reason ExporterPending.
    • The auth-controller user preset may publish $SYS.REQ.SERVER.PING.VARZ.
    • A NatsAccount or NatsSystemAccount adopting an account made elsewhere is not signed while the JWT the servers hold carries a claim the JWT signed from spec would not, a claim no field expresses or one the spec omits alike; it has the condition Ready False with the reason AdoptionDropsClaims naming each such claim by its JWT field path, a NatsSystemAccount's NatsOperator too, and the servers keep their JWT. A claim the spec sets to another value does not hold the signing. A JWT holding JetStream limits for a tier named other than R1 to R5 is never adopted; the reason is then TierInexpressible.

    Fixed

    • A NatsAccount signed while a server does not answer for the JWT it holds is not pushed until every server has answered; meanwhile RevocationsUnrecovered is True and Distributed is False with the reason Unreachable. A server that misses three roster polls in a row is not waited for.
    • A NatsAccount that adopts an account with no signing key keeps the revocations of the JWT the servers hold. A revocation read from the servers lists the account's identity key among its issuers, and is kept when the account's signing keys rotate.
    • A NatsSystemAccount adopting a system account made elsewhere keeps the revocations of the JWT the servers hold, and every system account JWT carries the exports account-monitoring-services and account-monitoring-streams that nsc gives one. While the servers cannot be asked at its first signing, its NatsOperator has the condition RevocationsUnrecovered True and the system account JWT is not pushed.
    • An account JWT signed by a NATS operator key that no server lists in the NATS operator JWT it runs under is not pushed, and status.distribution does not count a server that does not list the key; the NatsAccount or NatsSystemAccount then has the condition Distributed False with the reason UntrustedSigner.
    • A NatsAccount that adopts an account revoking every user, with the key *, is signed with that revocation and records it in status.revocations under the publicKey *.
    • Adding auth to a running NatsCluster rolls out one server at a time.
    Downloads