mikluko/nats-operator
Watch
1
0
Fork
You've already forked nats-operator
 0
Code Issues 2 Pull requests 13 Projects Releases 8 Packages Activity Actions
8 releases 8 tags
  • v0.5.0 41e6c7a4d5

    v0.5.0 Stable

    github-actions[bot] released this 2026-10-05 15:16:03 +00:00 | 3 commits to main since this release

    Added

    • A NatsOperator has the condition SigningKeyUntrusted, True with the reason UntrustedSigner while a server does not list its active signing key in the NATS operator JWT it runs under, naming the key and how many servers do not list it, and False with the reason SignerTrusted otherwise.
    • An importer of a private export of a NatsAccount takes publicKey in place of kind and name, for an account no NatsAccount describes; the auth controller mints its activation token into status.exports[].importers[].activationToken. A key it mints no token for leaves Ready False with the reason ActivationsUnsigned.
    • A NatsOperator lists the revocations of the system account JWT it signs, each with its issuers, in status.systemAccount.revocations.
    • The annotation cluster.nats-operator.io/restart-all on a NatsCluster restarts every server at once on a config that adds or removes auth.

    Changed

    • Breaking: a server whose VARZ reports no NATS operator JWT, as one configured by trusted_keys does, or that does not answer VARZ is no longer counted in status.distribution.current, and the NatsAccount or NatsSystemAccount reads Distributed False with the reason TrustUnknown naming how many servers do not say; a system user of the auth-controller preset signed before 0.4.0 lacks the VARZ permission until its creds are reissued, and a trusted_keys server reads so until it runs under a NATS operator JWT.
    • A NatsOperator reads SigningKeyUntrusted Unknown with the reason TrustUnknown while no server is known not to list its active signing key and a server does not say.

    Fixed

    • Adding or removing auth on a running NatsCluster holds every server on the config it runs, with Progressing False and the reason AuthChangeBlocked, in place of a rollout that stalled at its first server.
    • A server's startup probe is /healthz?js-meta-only=true in place of /healthz, and passes once its JetStream is current with a meta leader; the change restarts every server of every NatsCluster once, one at a time through the rollout gate.
    • An httpGet, tcpSocket or grpc handler in a podTemplate probe or lifecycle hook that omits port keeps the rendered port, in place of port 0.
    • The revocation of a deleted or denied NatsUser whose status.publicKey is the publicKey of its spec lists the account's identity key among its issuers, and is kept after every signing key it lists is rotated out.
    • A revocation that a NatsSystemAccount takes from the JWT the servers hold lists the system account's identity key among its issuers, and is kept after its signing keys are rotated out.
    • A NatsCluster with jetstream, no jetstream.domain and gateway.remotes naming another member creates no server whose data volume claim is older than the NatsCluster, and renders no change to the gateway remotes, the domain or jetstream of servers that lead a JetStream meta group of their own; it reads Progressing False with the reason OwnMetaGroup. Such a change to servers that cannot be observed waits, with Progressing False and the reason ObservationFailed.
    Downloads