Authorization and authentication

[Sagarbud]

Hello There,

I have installed NATS on GKE cluster using Helm. How we can enable Authorization and authentication?

I have added below auth section in values.yaml file.

auth:
enabled: true
basic:
users:

• user: "admin"
  password: "PpZnPE90b3jkH6C"
• user: "appUser"
  password: "enGk0cgZUabM6bN6FXHT"

defaultPermissions:
publish: [">"]
subscribe: [">"]
When I run the below command and getting the error "nats: error: no results received, ensure the account used has system privileges and appropriate permissions"

nats context add dev-nats --server 10.0.0.1 --description "test dev" --user admin --password pass --select

nats server info

Can you please help me to resolve the issue?

[ripienaar]

Try nats account info - the nats server commands are system accounts and you'll need a system account setup.

Best place to ask these questions are probably in the slack channels

[Sagarbud]

Hello @ripienaar

Thank you for your advice
I will try your suggestion also

[caleblloyd]

The latest Helm Chart specifications are here: https://artifacthub.io/packages/helm/nats/nats

I believe your values.yaml should look something like this:

config:
  merge:
    authorization:
      default_permissions:
        publish: [">"]
        subscribe:  [">"]
      users:
        user: "admin"
      - password: "PpZnPE90b3jkH6C"
        user: "appUser"
      - password: "enGk0cgZUabM6bN6FXHT"

If you'd like, you can join the NATS Slack and ask Kubernetes related questions in the #k8s channel: https://natsio.slack.com

[Sagarbud]

Hello @caleblloyd

Thank you for your response!

I have not found config and merge option in values.yaml. Can you please guide me where should i need to add the above portion?

I am using the below NATS version
version=0.19.12

[caleblloyd]

That chart version is quite old, if this is a new install I recommend using 1.x. All of the documentation for the chart is here:

https://artifacthub.io/packages/helm/nats/nats

[Sagarbud]

Hello @caleblloyd

I am try to installing NATS version 1.1.12 with below user configuration but getting the error (nats-server: /etc/nats-config/nats.conf:3:6: error parsing accounts: unsupported type map[string]interface {})

merge:
  accounts:
    A:
      users:
        - user: a
          password: a
    B:
      users:
        - user: b
          password: b

have referred the URL for the same https://artifacthub.io/packages/helm/nats/nats/1.1.12 Also, I am using the values.yaml

Can you please guide me how i can configure user and permission for NATS?

Also, I am unable to found node-selector portion in the values.yaml for NATS and nats-box. can you please help me for the same?

[caleblloyd]

This works find for me. Also included node selector example.

config:
  merge:
    accounts:
      A:
        users:
        - {user: a, password: a}
      B:
        users:
        - {user: b, password: b}

podTemplate:
  merge:
    spec:
      nodeSelector:
        kubernetes.io/os: linux

natsBox:
  contexts:
    a:
      merge: {user: a, password: a}
    b:
      merge: {user: b, password: b}
  defaultContextName: a

  podTemplate:
    merge:
      spec:
        nodeSelector:
          kubernetes.io/os: linux

[Sagarbud]

Hello @caleblloyd

Thank you for your support.

Above section is works for me. Now, I am running the below command to set contexts but getting permission error in nats server info command.

nats context add dev-nats --server 10.250.0.71 --description "test dev" --user a --password a --select
output:
NATS Configuration Context "dev-nats"

  Description: test dev
  Server URLs: 10.250.0.71
     Username: a
     Password: *********
        Token: a
         Path: /home/sagar.bud/.config/nats/context/dev-nats.json
   Connection: OK

nats server info
Output:
nats: error: no results received, ensure the account used has system privileges and appropriate permissions

Can you help me how i can assign permission to the user?

[caleblloyd]

Add a System Account and use that one:

config:
  merge:
    system_account: SYS
    accounts:
      A:
        users:
        - {user: a, password: a}
      B:
        users:
        - {user: b, password: b}
      SYS:
        users:
        - {user: sys, password: sys}

podTemplate:
  merge:
    spec:
      nodeSelector:
        kubernetes.io/os: linux

natsBox:
  contexts:
    a:
      merge: {user: a, password: a}
    b:
      merge: {user: b, password: b}
    sys:
      merge: {user: sys, password: sys}
  defaultContextName: sys

  podTemplate:
    merge:
      spec:
        nodeSelector:
          kubernetes.io/os: linux

[Sagarbud]

Hello @caleblloyd

Thank you for the update.

I have added the SYS account but still getting the same error. I have attached screen capture for your reference. Moreover, How i can assign permission to other user(like a and b). I want to create one system user and other developer user.

[wallyqs]

you need to select the context, nats context select

[Sagarbud]

Hello @wallyqs

I have used the command then run the nats server info command but getting the same issue. Also, How i can assign permission to other user(like a and b). I want to create one system user and other developer user.

[Sagarbud]

Hello @caleblloyd and @wallyqs

Can you please help me to resolve above permission issue?

[caleblloyd]

Refer to the NATS Docs: https://docs.nats.io/running-a-nats-service/configuration/securing_nats/accounts

Anything under that section can go in config.merge if you convert it to YAML format.

[Sagarbud]

Hello @caleblloyd

I have referred your provided document but did not understand how i can add permission block in values.yaml

I want to create one system user (which i need provide all access) and other developer user(which i need to assign only publish and subscribe rights on all `topics).

`################################################################################

Global options

################################################################################
global:
image:
# global image pull policy to use for all container images in the chart
# can be overridden by individual image pullPolicy
pullPolicy:
# global list of secret names to use as image pull secrets for all pod specs in the chart
# secrets must exist in the same namespace
# https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
pullSecretNames: []
# global registry to use for all container images in the chart
# can be overridden by individual image registry
registry:

global labels will be applied to all resources deployed by the chart

labels: {}

################################################################################

Common options

################################################################################

override name of the chart

nameOverride:

override full name of the chart+release

fullnameOverride:

override the namespace that resources are installed into

namespaceOverride:

reference a common CA Certificate or Bundle in all nats config tls blocks and nats-box contexts

note: tls.verify still must be set in the appropriate nats config tls blocks to require mTLS

tlsCA:
enabled: false

set configMapName in order to mount an existing configMap to dir

configMapName:

set secretName in order to mount an existing secretName to dir

secretName:

directory to mount the configMap or secret to

dir: /etc/nats-ca-cert

key in the configMap or secret that contains the CA Certificate or Bundle

key: ca.crt

################################################################################

NATS Stateful Set and associated resources

################################################################################

############################################################

NATS config

############################################################
config:
cluster:
enabled: true
port: 6222
# must be 2 or higher when jetstream is enabled
replicas: 2

# apply to generated route URLs that connect to other pods in the StatefulSet
routeURLs:
  # if both user and password are set, they will be added to route URLs
  # and the cluster authorization block
  user: a
  password: a
  # set to true to use FQDN in route URLs
  useFQDN: false
  k8sClusterDomain: cluster.local

tls:
  enabled: false
  # set secretName in order to mount an existing secret to dir
  secretName:
  dir: /etc/nats-certs/cluster
  cert: tls.crt
  key: tls.key
  # merge or patch the tls config
  # https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
  merge: {}
  patch: []

# merge or patch the cluster config
# https://docs.nats.io/running-a-nats-service/configuration/clustering/cluster_config

merge:
system_account: SYS
accounts:
A:
users:
- {user: a, password: a}
B:
users:
- {user: b, password: b}
SYS:
users:
- {user: admin, password: changeit}
patch: []
`

Currently, I have added below portion in values.yaml

Thank you in advance.

[Sagarbud]

Hello @caleblloyd,

Can you please help me to resolve the issue?