diff --git a/.vib/nats/ginkgo/nats_suite_test.go b/.vib/nats/ginkgo/nats_suite_test.go index 261134bd8b..de1d115af8 100644 --- a/.vib/nats/ginkgo/nats_suite_test.go +++ b/.vib/nats/ginkgo/nats_suite_test.go @@ -17,7 +17,7 @@ import ( var ( kubeconfig string - stsName string + releaseName string namespace string username string password string @@ -27,10 +27,10 @@ var ( func init() { flag.StringVar(&kubeconfig, "kubeconfig", "", "absolute path to the kubeconfig file") - flag.StringVar(&stsName, "name", "", "name of the primary statefulset") + flag.StringVar(&releaseName, "name", "", "name of the chart release") flag.StringVar(&namespace, "namespace", "", "namespace where the application is running") - flag.StringVar(&username, "username", "", "database user") - flag.StringVar(&password, "password", "", "database password for username") + flag.StringVar(&username, "username", "", "nats user") + flag.StringVar(&password, "password", "", "password for nats user") flag.IntVar(&timeoutSeconds, "timeout", 300, "timeout in seconds") timeout = time.Duration(timeoutSeconds) * time.Second } @@ -74,7 +74,7 @@ func createJob(ctx context.Context, c kubernetes.Interface, name string, port st Env: []v1.EnvVar{ { Name: "NATS_URL", - Value: fmt.Sprintf("nats://%s:%s", stsName, port), + Value: fmt.Sprintf("nats://%s:%s", releaseName, port), }, { Name: "NATS_USER", @@ -84,8 +84,48 @@ func createJob(ctx context.Context, c kubernetes.Interface, name string, port st Name: "NATS_PASSWORD", Value: password, }, + { + Name: "NATS_CERT", + Value: "/certs/client/tls.crt", + }, + { + Name: "NATS_KEY", + Value: "/certs/client/tls.key", + }, + { + Name: "NATS_CA", + Value: "/certs/ca/tls.crt", + }, }, SecurityContext: securityContext, + VolumeMounts: []v1.VolumeMount{ + { + Name: "ca-cert", + MountPath: "/certs/ca", + }, + { + Name: "client-cert", + MountPath: "/certs/client", + }, + }, + }, + }, + Volumes: []v1.Volume{ + { + Name: "ca-cert", + VolumeSource: v1.VolumeSource{ + Secret: &v1.SecretVolumeSource{ + SecretName: fmt.Sprintf("%s-ca-crt", releaseName), + }, + }, + }, + { + Name: "client-cert", + VolumeSource: v1.VolumeSource{ + Secret: &v1.SecretVolumeSource{ + SecretName: fmt.Sprintf("%s-client-crt", releaseName), + }, + }, }, }, }, diff --git a/.vib/nats/ginkgo/nats_test.go b/.vib/nats/ginkgo/nats_test.go index 9371bac27b..4eeafefd06 100644 --- a/.vib/nats/ginkgo/nats_test.go +++ b/.vib/nats/ginkgo/nats_test.go @@ -32,23 +32,23 @@ var _ = Describe("NATS", Ordered, func() { }) When("a bucket is created and is scaled down to 0 replicas and back up", func() { - It("should have access to the created database", func() { + It("should have access to NATS", func() { getAvailableReplicas := func(ss *appsv1.StatefulSet) int32 { return ss.Status.AvailableReplicas } getRestartedAtAnnotation := func(pod *v1.Pod) string { return pod.Annotations["kubectl.kubernetes.io/restartedAt"] } getSucceededJobs := func(j *batchv1.Job) int32 { return j.Status.Succeeded } getOpts := metav1.GetOptions{} By("checking all the replicas are available") - ss, err := c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) + ss, err := c.AppsV1().StatefulSets(namespace).Get(ctx, releaseName, getOpts) Expect(err).NotTo(HaveOccurred()) Expect(ss.Status.Replicas).NotTo(BeZero()) origReplicas := *ss.Spec.Replicas Eventually(func() (*appsv1.StatefulSet, error) { - return c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) + return c.AppsV1().StatefulSets(namespace).Get(ctx, releaseName, getOpts) }, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas))) - svc, err := c.CoreV1().Services(namespace).Get(ctx, stsName, getOpts) + svc, err := c.CoreV1().Services(namespace).Get(ctx, releaseName, getOpts) Expect(err).NotTo(HaveOccurred()) port, err := utils.SvcGetPortByName(svc, "tcp-client") @@ -57,34 +57,34 @@ var _ = Describe("NATS", Ordered, func() { // Use current time for allowing the test suite to repeat jobSuffix := time.Now().Format("20060102150405") - By("creating a job to create a new test bucket") - createDBJobName := fmt.Sprintf("%s-createbc-%s", - stsName, jobSuffix) - bucketName := fmt.Sprintf("test%s", jobSuffix) + By("creating a job to create a new KV Store Bucket") + addKVBucketJobName := fmt.Sprintf("%s-add-kv-bucket-%s", + releaseName, jobSuffix) + storeBucketName := fmt.Sprintf("test%s", jobSuffix) - err = createJob(ctx, c, createDBJobName, port, "add", bucketName) + err = createJob(ctx, c, addKVBucketJobName, port, "add", storeBucketName) Expect(err).NotTo(HaveOccurred()) Eventually(func() (*batchv1.Job, error) { - return c.BatchV1().Jobs(namespace).Get(ctx, createDBJobName, getOpts) + return c.BatchV1().Jobs(namespace).Get(ctx, addKVBucketJobName, getOpts) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) By("deleting the job once it has succeeded") - err = c.BatchV1().Jobs(namespace).Delete(ctx, createDBJobName, metav1.DeleteOptions{}) + err = c.BatchV1().Jobs(namespace).Delete(ctx, addKVBucketJobName, metav1.DeleteOptions{}) Expect(err).NotTo(HaveOccurred()) - By("puting a value into a key") - putJobName := fmt.Sprintf("%s-putbc-%s", - stsName, jobSuffix) - err = createJob(ctx, c, putJobName, port, "put", bucketName, "testKey", "testValue") + By("creating a job to put some key-value pair") + putKVJobName := fmt.Sprintf("%s-put-kv-%s", + releaseName, jobSuffix) + err = createJob(ctx, c, putKVJobName, port, "put", storeBucketName, "testKey", "testValue") Expect(err).NotTo(HaveOccurred()) Eventually(func() (*batchv1.Job, error) { - return c.BatchV1().Jobs(namespace).Get(ctx, putJobName, getOpts) + return c.BatchV1().Jobs(namespace).Get(ctx, putKVJobName, getOpts) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) By("deleting the job once it has succeeded") - err = c.BatchV1().Jobs(namespace).Delete(ctx, putJobName, metav1.DeleteOptions{}) + err = c.BatchV1().Jobs(namespace).Delete(ctx, putKVJobName, metav1.DeleteOptions{}) Expect(err).NotTo(HaveOccurred()) // Give the application some time to sync the data @@ -96,40 +96,40 @@ var _ = Describe("NATS", Ordered, func() { for i := int(origReplicas) - 1; i >= 0; i-- { Eventually(func() (*v1.Pod, error) { - return c.CoreV1().Pods(namespace).Get(ctx, fmt.Sprintf("%s-%d", stsName, i), getOpts) + return c.CoreV1().Pods(namespace).Get(ctx, fmt.Sprintf("%s-%d", releaseName, i), getOpts) }, timeout, PollingInterval).Should(WithTransform(getRestartedAtAnnotation, Not(BeEmpty()))) } Eventually(func() (*appsv1.StatefulSet, error) { - return c.AppsV1().StatefulSets(namespace).Get(ctx, stsName, getOpts) + return c.AppsV1().StatefulSets(namespace).Get(ctx, releaseName, getOpts) }, timeout, PollingInterval).Should(WithTransform(getAvailableReplicas, Equal(origReplicas))) By("creating a job to get a value for a key") - getJobName := fmt.Sprintf("%s-getbc-%s", - stsName, jobSuffix) - err = createJob(ctx, c, getJobName, port, "get", bucketName, "testKey") + getKVJobName := fmt.Sprintf("%s-get-key-%s", + releaseName, jobSuffix) + err = createJob(ctx, c, getKVJobName, port, "get", storeBucketName, "testKey") Expect(err).NotTo(HaveOccurred()) Eventually(func() (*batchv1.Job, error) { - return c.BatchV1().Jobs(namespace).Get(ctx, getJobName, getOpts) + return c.BatchV1().Jobs(namespace).Get(ctx, getKVJobName, getOpts) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) By("deleting the job once it has succeeded") - err = c.BatchV1().Jobs(namespace).Delete(ctx, getJobName, metav1.DeleteOptions{}) + err = c.BatchV1().Jobs(namespace).Delete(ctx, getKVJobName, metav1.DeleteOptions{}) Expect(err).NotTo(HaveOccurred()) - By("creating a job to get the test bucket") - deleteDBJobName := fmt.Sprintf("%s-delbc-%s", - stsName, jobSuffix) - err = createJob(ctx, c, deleteDBJobName, port, "del", bucketName, "-f") + By("creating a job to get the delete the KV Store Bucket") + deleteKVBucketJobName := fmt.Sprintf("%s-del-kv-bucket-%s", + releaseName, jobSuffix) + err = createJob(ctx, c, deleteKVBucketJobName, port, "del", storeBucketName, "-f") Expect(err).NotTo(HaveOccurred()) Eventually(func() (*batchv1.Job, error) { - return c.BatchV1().Jobs(namespace).Get(ctx, deleteDBJobName, getOpts) + return c.BatchV1().Jobs(namespace).Get(ctx, deleteKVBucketJobName, getOpts) }, timeout, PollingInterval).Should(WithTransform(getSucceededJobs, Equal(int32(1)))) By("deleting the job once it has succeeded") - err = c.BatchV1().Jobs(namespace).Delete(ctx, deleteDBJobName, metav1.DeleteOptions{}) + err = c.BatchV1().Jobs(namespace).Delete(ctx, deleteKVBucketJobName, metav1.DeleteOptions{}) Expect(err).NotTo(HaveOccurred()) }) }) diff --git a/.vib/nats/goss/goss.yaml b/.vib/nats/goss/goss.yaml deleted file mode 100644 index ab7911a0c3..0000000000 --- a/.vib/nats/goss/goss.yaml +++ /dev/null @@ -1,17 +0,0 @@ -# Copyright Broadcom, Inc. All Rights Reserved. -# SPDX-License-Identifier: APACHE-2.0 - -file: - /bitnami/nats/conf/{{ .Vars.natsFilename }}.conf: - mode: "0644" - filetype: file - exists: true - owner: root -command: - {{- $uid := .Vars.containerSecurityContext.runAsUser }} - {{- $gid := .Vars.podSecurityContext.fsGroup }} - check-user-info: - # The UID and GID should always be either the one specified as vars (always a bigger number that the default) - # or the one randomly defined by openshift (larger values). Otherwise, the chart is still using the default value. - exec: if [ $(id -u) -lt {{ $uid }} ] || [ $(id -G | awk '{print $2}') -lt {{ $gid }} ]; then exit 1; fi - exit-status: 0 diff --git a/.vib/nats/runtime-parameters.yaml b/.vib/nats/runtime-parameters.yaml index a27b35b340..315d0de35d 100644 --- a/.vib/nats/runtime-parameters.yaml +++ b/.vib/nats/runtime-parameters.yaml @@ -1,13 +1,21 @@ natsFilename: nats-testing-server auth: enabled: true - user: test_nats_client - password: ComplicatedPassword123!4 + credentials: + - user: test_nats_client + password: ComplicatedPassword123!4 cluster: auth: enabled: true user: test_nats_cluster password: ClusterPassword123!4 +tls: + enabled: true + autoGenerated: + enabled: true + engine: helm +debug: + enabled: true jetstream: enabled: true persistence: @@ -30,3 +38,8 @@ service: type: LoadBalancer resourceType: statefulset replicaCount: 2 +metrics: + containerSecurityContext: + enabled: true + runAsUser: 1002 + enabled: true diff --git a/.vib/nats/vib-verify.json b/.vib/nats/vib-verify.json index 4429bd7884..4f4143b13a 100644 --- a/.vib/nats/vib-verify.json +++ b/.vib/nats/vib-verify.json @@ -39,21 +39,6 @@ } }, "actions": [ - { - "action_id": "goss", - "params": { - "resources": { - "path": "/.vib" - }, - "tests_file": "nats/goss/goss.yaml", - "vars_file": "nats/runtime-parameters.yaml", - "remote": { - "pod": { - "workload": "sts-nats" - } - } - } - }, { "action_id": "cypress", "params": { diff --git a/bitnami/nats/CHANGELOG.md b/bitnami/nats/CHANGELOG.md index 69a6eee761..bebe2f71c2 100644 --- a/bitnami/nats/CHANGELOG.md +++ b/bitnami/nats/CHANGELOG.md @@ -1,8 +1,12 @@ # Changelog -## 8.5.4 (2025-01-23) +## 9.0.0 (2025-01-23) -* [bitnami/nats] Improve NATS routes configuration ([#31523](https://github.com/bitnami/charts/pull/31523)) +* [bitnami/nats] NATS chart based on scratch image ([#31516](https://github.com/bitnami/charts/pull/31516)) + +## 8.5.4 (2025-01-23) + +* [bitnami/nats] Improve NATS routes configuration (#31523) ([293d9e2](https://github.com/bitnami/charts/commit/293d9e20aa93cf76f020561a38f5380f55e5567b)), closes [#31523](https://github.com/bitnami/charts/issues/31523) [#30124](https://github.com/bitnami/charts/issues/30124) ## 8.5.3 (2025-01-17) diff --git a/bitnami/nats/Chart.yaml b/bitnami/nats/Chart.yaml index 5139179884..e531a4f124 100644 --- a/bitnami/nats/Chart.yaml +++ b/bitnami/nats/Chart.yaml @@ -6,7 +6,7 @@ annotations: licenses: Apache-2.0 images: | - name: nats - image: docker.io/bitnami/nats:2.10.24-debian-12-r2 + image: docker.io/bitnami/nats:2.10.24-debian-12-r3 - name: nats-exporter image: docker.io/bitnami/nats-exporter:0.16.0-debian-12-r2 apiVersion: v2 @@ -31,4 +31,4 @@ maintainers: name: nats sources: - https://github.com/bitnami/charts/tree/main/bitnami/nats -version: 8.5.4 +version: 9.0.0 diff --git a/bitnami/nats/README.md b/bitnami/nats/README.md index 72e48273a5..27a61b8b78 100644 --- a/bitnami/nats/README.md +++ b/bitnami/nats/README.md @@ -53,7 +53,7 @@ To make this process easier, the chart contains the `resourcesPreset` values, wh The Bitnami NATS chart, when upgrading, reuses the secret previously rendered by the chart or the one specified in `existingSecret`. To update credentials, use one of the following: -- Run `helm upgrade` specifying a new password in `auth.password` +- Run `helm upgrade` specifying new credentials via `auth.token` or `auth.credentials` parameters - Run `helm upgrade` specifying a new secret in `existingSecret` ### Backup and restore @@ -160,58 +160,73 @@ As an alternative, you can use of the preset configurations for pod affinity, po ### Common parameters -| Name | Description | Value | -| ------------------------ | -------------------------------------------------------------------------------------------- | --------------- | -| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | -| `nameOverride` | String to partially override common.names.fullname template (will maintain the release name) | `""` | -| `fullnameOverride` | String to fully override common.names.fullname template | `""` | -| `commonLabels` | Add labels to all the deployed resources | `{}` | -| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | -| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | -| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | -| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | -| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | -| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override common.names.name | `""` | +| `fullnameOverride` | String to fully override common.names.fullname | `""` | +| `namespaceOverride` | String to fully override common.names.namespace | `""` | +| `commonLabels` | Add labels to all the deployed resources | `{}` | +| `commonAnnotations` | Add annotations to all the deployed resources | `{}` | +| `clusterDomain` | Kubernetes Cluster Domain | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the deployment | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the deployment | `["infinity"]` | ### NATS parameters -| Name | Description | Value | -| ------------------------ | ----------------------------------------------------------------------------------------------------- | ---------------------- | -| `image.registry` | NATS image registry | `REGISTRY_NAME` | -| `image.repository` | NATS image repository | `REPOSITORY_NAME/nats` | -| `image.digest` | NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `image.pullPolicy` | NATS image pull policy | `IfNotPresent` | -| `image.pullSecrets` | NATS image pull secrets | `[]` | -| `image.debug` | Enable NATS image debug mode | `false` | -| `auth.enabled` | Switch to enable/disable client authentication | `true` | -| `auth.user` | Client authentication user | `nats_client` | -| `auth.password` | Client authentication password | `""` | -| `auth.token` | Client authentication token | `""` | -| `auth.timeout` | Client authentication timeout (seconds) | `1` | -| `auth.usersCredentials` | Client authentication users credentials collection | `[]` | -| `auth.noAuthUser` | Client authentication username from auth.usersCredentials map to be used when no credentials provided | `""` | -| `cluster.name` | Cluster name | `nats` | -| `cluster.connectRetries` | Configure number of connect retries for implicit routes, otherwise leave blank | `""` | -| `cluster.auth.enabled` | Switch to enable/disable cluster authentication | `true` | -| `cluster.auth.user` | Cluster authentication user | `nats_cluster` | -| `cluster.auth.password` | Cluster authentication password | `""` | -| `jetstream.enabled` | Switch to enable/disable JetStream | `false` | -| `jetstream.maxMemory` | Max memory usage for JetStream | `1G` | -| `debug.enabled` | Switch to enable/disable debug on logging | `false` | -| `debug.trace` | Switch to enable/disable trace debug level on logging | `false` | -| `debug.logtime` | Switch to enable/disable logtime on logging | `false` | -| `maxConnections` | Max. number of client connections | `""` | -| `maxControlLine` | Max. protocol control line | `""` | -| `maxPayload` | Max. payload | `""` | -| `writeDeadline` | Duration the server can block on a socket write to a client | `""` | -| `natsFilename` | Filename used by several NATS files (binary, configuration file, and pid file) | `nats-server` | -| `configuration` | Specify content for NATS configuration file (generated based on other parameters otherwise) | `""` | -| `existingSecret` | The name of an existing Secret with your custom configuration for NATS | `""` | -| `command` | Override default container command (useful when using custom images) | `[]` | -| `args` | Override default container args (useful when using custom images) | `[]` | -| `extraEnvVars` | Extra environment variables to be set on NATS container | `[]` | -| `extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | -| `extraEnvVarsSecret` | Secret with extra environment variables | `""` | +| Name | Description | Value | +| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | +| `image.registry` | NATS image registry | `REGISTRY_NAME` | +| `image.repository` | NATS image repository | `REPOSITORY_NAME/nats` | +| `image.digest` | NATS image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `image.pullPolicy` | NATS image pull policy | `IfNotPresent` | +| `image.pullSecrets` | NATS image pull secrets | `[]` | +| `auth.enabled` | Switch to enable/disable client authentication | `true` | +| `auth.token` | Client authentication token | `""` | +| `auth.credentials` | Client authentication users credentials collection. Ignored if `auth.token` is set | `[]` | +| `auth.noAuthUser` | No authenticated access will be associated with this user. It must be one of the available under `auth.credentials` map array. No authenticated access will be denied if unset. | `""` | +| `auth.timeout` | Client authentication timeout (seconds) | `1` | +| `tls.enabled` | Enable TLS configuration for NATS | `false` | +| `tls.autoGenerated.enabled` | Enable automatic generation of TLS certificates | `true` | +| `tls.autoGenerated.engine` | Mechanism to generate the certificates (allowed values: helm, cert-manager) | `helm` | +| `tls.autoGenerated.certManager.existingIssuer` | The name of an existing Issuer to use for generating the certificates (only for `cert-manager` engine) | `""` | +| `tls.autoGenerated.certManager.existingIssuerKind` | Existing Issuer kind, defaults to Issuer (only for `cert-manager` engine) | `""` | +| `tls.autoGenerated.certManager.keyAlgorithm` | Key algorithm for the certificates (only for `cert-manager` engine) | `RSA` | +| `tls.autoGenerated.certManager.keySize` | Key size for the certificates (only for `cert-manager` engine) | `2048` | +| `tls.autoGenerated.certManager.duration` | Duration for the certificates (only for `cert-manager` engine) | `2160h` | +| `tls.autoGenerated.certManager.renewBefore` | Renewal period for the certificates (only for `cert-manager` engine) | `360h` | +| `tls.ca` | CA certificate for TLS. Ignored if `tls.existingCASecret` is set | `""` | +| `tls.existingCASecret` | The name of an existing Secret containing the CA certificate for TLS | `""` | +| `tls.server.cert` | TLS certificate for NATS servers. Ignored if `tls.server.existingSecret` is set | `""` | +| `tls.server.key` | TLS key for NATS servers. Ignored if `tls.server.existingSecret` is set | `""` | +| `tls.server.existingSecret` | The name of an existing Secret containing the TLS certificates for NATS servers | `""` | +| `tls.client.cert` | TLS certificate for NATS clients. Ignored if `tls.client.existingSecret` is set | `""` | +| `tls.client.key` | TLS key for NATS clients. Ignored if `tls.client.existingSecret` is set | `""` | +| `tls.client.existingSecret` | The name of an existing Secret containing the TLS certificates for NATS clients | `""` | +| `cluster.name` | Cluster name | `nats` | +| `cluster.connectRetries` | Configure number of connect retries for implicit routes, otherwise leave blank | `""` | +| `cluster.auth.enabled` | Switch to enable/disable cluster authentication | `true` | +| `cluster.auth.user` | Cluster authentication user | `nats_cluster` | +| `cluster.auth.password` | Cluster authentication password | `""` | +| `jetstream.enabled` | Switch to enable/disable JetStream | `false` | +| `jetstream.maxMemory` | Max memory usage for JetStream | `1G` | +| `debug.enabled` | Switch to enable/disable debug on logging | `false` | +| `debug.trace` | Switch to enable/disable trace debug level on logging | `false` | +| `debug.logtime` | Switch to enable/disable logtime on logging | `false` | +| `maxConnections` | Max. number of client connections | `""` | +| `maxControlLine` | Max. protocol control line | `""` | +| `maxPayload` | Max. payload | `""` | +| `writeDeadline` | Duration the server can block on a socket write to a client | `""` | +| `natsFilename` | Filename used by several NATS files (binary, configuration file, and pid file) | `nats-server` | +| `configuration` | Specify content for NATS configuration file (generated based on other parameters otherwise) | `""` | +| `existingSecret` | Name of an existing secret with your custom configuration for NATS | `""` | +| `command` | Override default container command (useful when using custom images) | `[]` | +| `args` | Override default container args (useful when using custom images) | `[]` | +| `extraEnvVars` | Extra environment variables to be set on NATS container | `[]` | +| `extraEnvVarsCM` | ConfigMap with extra environment variables | `""` | +| `extraEnvVarsSecret` | Secret with extra environment variables | `""` | ### NATS deployment/statefulset parameters @@ -221,7 +236,7 @@ As an alternative, you can use of the preset configurations for pod affinity, po | `replicaCount` | Number of NATS nodes | `1` | | `schedulerName` | Use an alternate scheduler, e.g. "stork". | `""` | | `priorityClassName` | Name of pod priority class | `""` | -| `updateStrategy.type` | StrategyType. Can be set to RollingUpdate or OnDelete | `RollingUpdate` | +| `updateStrategy.type` | NATS deployment/statefulset update strategy type | `RollingUpdate` | | `podManagementPolicy` | StatefulSet pod management policy | `OrderedReady` | | `containerPorts.client` | NATS client container port | `4222` | | `containerPorts.cluster` | NATS cluster container port | `6222` | @@ -332,46 +347,62 @@ As an alternative, you can use of the preset configurations for pod affinity, po ### Metrics parameters -| Name | Description | Value | -| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | -| `metrics.enabled` | Enable Prometheus metrics via exporter side-car | `false` | -| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` | -| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` | -| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | -| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` | -| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | -| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | -| `metrics.customLivenessProbe` | Override default liveness probe | `{}` | -| `metrics.customReadinessProbe` | Override default readiness probe | `{}` | -| `metrics.image.registry` | Prometheus metrics exporter image registry | `REGISTRY_NAME` | -| `metrics.image.repository` | Prometheus metrics exporter image repository | `REPOSITORY_NAME/nats-exporter` | -| `metrics.image.digest` | NATS Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | -| `metrics.image.pullPolicy` | Prometheus metrics image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Prometheus metrics image pull secrets | `[]` | -| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` | -| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | -| `metrics.containerPorts.http` | Prometheus metrics exporter port | `7777` | -| `metrics.flags` | Flags to be passed to Prometheus metrics | `[]` | -| `metrics.service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` | -| `metrics.service.port` | Prometheus metrics service port | `7777` | -| `metrics.service.loadBalancerIP` | Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank | `""` | -| `metrics.service.annotations` | Annotations for Prometheus metrics service | `{}` | -| `metrics.service.labels` | Labels for Prometheus metrics service | `{}` | -| `metrics.serviceMonitor.enabled` | Specify if a ServiceMonitor will be deployed for Prometheus Operator | `false` | -| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `monitoring` | -| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | -| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` | -| `metrics.serviceMonitor.interval` | How frequently to scrape metrics | `""` | -| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | -| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | -| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | -| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | +| Name | Description | Value | +| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | +| `metrics.enabled` | Enable Prometheus metrics via exporter side-car | `false` | +| `metrics.image.registry` | Prometheus metrics exporter image registry | `REGISTRY_NAME` | +| `metrics.image.repository` | Prometheus metrics exporter image repository | `REPOSITORY_NAME/nats-exporter` | +| `metrics.image.digest` | NATS Exporter image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` | +| `metrics.image.pullPolicy` | Prometheus metrics image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Prometheus metrics image pull secrets | `[]` | +| `metrics.livenessProbe.enabled` | Enable livenessProbe | `true` | +| `metrics.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `15` | +| `metrics.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `metrics.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `metrics.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `metrics.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `metrics.readinessProbe.enabled` | Enable readinessProbe | `true` | +| `metrics.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `metrics.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `metrics.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `metrics.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `metrics.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `metrics.customLivenessProbe` | Override default liveness probe | `{}` | +| `metrics.customReadinessProbe` | Override default readiness probe | `{}` | +| `metrics.containerSecurityContext.enabled` | Enabled containers' Security Context | `true` | +| `metrics.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` | +| `metrics.containerSecurityContext.runAsUser` | Set containers' Security Context runAsUser | `1001` | +| `metrics.containerSecurityContext.runAsGroup` | Set containers' Security Context runAsGroup | `1001` | +| `metrics.containerSecurityContext.runAsNonRoot` | Set container's Security Context runAsNonRoot | `true` | +| `metrics.containerSecurityContext.privileged` | Set container's Security Context privileged | `false` | +| `metrics.containerSecurityContext.readOnlyRootFilesystem` | Set container's Security Context readOnlyRootFilesystem | `true` | +| `metrics.containerSecurityContext.allowPrivilegeEscalation` | Set container's Security Context allowPrivilegeEscalation | `false` | +| `metrics.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` | +| `metrics.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` | +| `metrics.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if metrics.resources is set (metrics.resources is recommended for production). | `nano` | +| `metrics.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` | +| `metrics.containerPorts.http` | Prometheus metrics exporter port | `7777` | +| `metrics.flags` | Flags to be passed to Prometheus metrics | `[]` | +| `metrics.service.type` | Kubernetes service type (`ClusterIP`, `NodePort` or `LoadBalancer`) | `ClusterIP` | +| `metrics.service.port` | Prometheus metrics service port | `7777` | +| `metrics.service.loadBalancerIP` | Use serviceLoadBalancerIP to request a specific static IP, otherwise leave blank | `""` | +| `metrics.service.annotations` | Annotations for Prometheus metrics service | `{}` | +| `metrics.service.labels` | Labels for Prometheus metrics service | `{}` | +| `metrics.serviceMonitor.enabled` | Specify if a ServiceMonitor will be deployed for Prometheus Operator | `false` | +| `metrics.serviceMonitor.namespace` | Namespace in which Prometheus is running | `monitoring` | +| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | +| `metrics.serviceMonitor.jobLabel` | The name of the label on the target service to use as the job name in Prometheus | `""` | +| `metrics.serviceMonitor.interval` | How frequently to scrape metrics | `""` | +| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | +| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | +| `metrics.serviceMonitor.selector` | Prometheus instance selector labels | `{}` | ### Persistence parameters | Name | Description | Value | | -------------------------------------------------- | ------------------------------------------------------------------------------ | ------------------- | -| `persistence.enabled` | Enable NATS data persistence using PVC(s) | `false` | +| `persistence.enabled` | Enable NATS data persistence using PVCs (only for statefulset resourceType) | `false` | | `persistence.storageClass` | PVC Storage Class for NATS data volume | `""` | | `persistence.accessModes` | PVC Access modes | `["ReadWriteOnce"]` | | `persistence.size` | PVC Storage Request for NATS data volume | `8Gi` | @@ -393,7 +424,7 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm ```console helm install my-release \ - --set auth.enabled=true,auth.user=my-user,auth.password=T0pS3cr3t \ + --set auth.enabled=true,auth.credentials[0].user=my-user,auth.credentials[0].password=T0pS3cr3t \ oci://REGISTRY_NAME/REPOSITORY_NAME/nats ``` @@ -418,6 +449,17 @@ Find more information about how to deal with common errors related to Bitnami's ## Upgrading +### To 9.0.0 + +This major versions ships by default a new NATS image version that dramatically reduces the image given there's no distro and it simply includes the NATS binary on top of a scratch base image. As a consequence, there's no shell available in the image and debugging actions must be performed using sidecars or equivalent mechanisms. + +Also, the default path for storing JetStream data is `/data/jetstream` instead of `/data/jetstream/jetstream` to avoid stuttering. If you're upgrading from an existing installation with persisted data, you'll have to edit the JetStream's "store_dir" configuration property so it's compatible with your previous data. + +Finally, the following changes are also introduced on chart parameters in this major version update: + +- `auth.usersCredentials` is renamed to `auth.credentials`. +- `auth.user` and `auth.password` are deprecated in favor of `auth.credentials`. + ### To 8.5.0 This version introduces image verification for security purposes. To disable it, set `global.security.allowInsecureImages` to `true`. More details at [GitHub issue](https://github.com/bitnami/charts/issues/30850). @@ -500,4 +542,4 @@ Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and -limitations under the License. \ No newline at end of file +limitations under the License. diff --git a/bitnami/nats/templates/NOTES.txt b/bitnami/nats/templates/NOTES.txt index b4e76371d1..537ce6d496 100644 --- a/bitnami/nats/templates/NOTES.txt +++ b/bitnami/nats/templates/NOTES.txt @@ -7,6 +7,7 @@ Did you know there are enterprise versions of the Bitnami catalog? For enhanced ** Please be patient while the chart is being deployed ** {{- if .Values.diagnosticMode.enabled }} + The chart has been deployed in diagnostic mode. All probes have been disabled and the command has been overwritten with: command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 4 }} @@ -16,14 +17,6 @@ Get the list of pods by executing: kubectl get pods --namespace {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }} -Access the pod you want to debug by executing - - kubectl exec --namespace {{ .Release.Namespace }} -ti -- bash - -In order to replicate the container startup scripts execute this command: - - /opt/bitnami/scripts/nats/entrypoint.sh - {{- else }} {{- if or (contains .Values.service.type "LoadBalancer") (contains .Values.service.type "nodePort") }} @@ -54,9 +47,13 @@ NATS can be accessed via port {{ .Values.service.ports.client }} on the followin To get the authentication credentials, run: - export NATS_USER=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | grep -m 1 user | awk '{print $2}' | tr -d '"') - export NATS_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | grep -m 1 password | awk '{print $2}' | tr -d '"') + {{- if .Values.auth.token }} + export NATS_TOKEN=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*token: "\([^"]*\)".*/\1/p' | head -n 1) + {{- else }} + export NATS_USER=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*user: "\([^"]*\)".*/\1/p' | head -n 1) + export NATS_PASS=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ include "common.names.fullname" . }} -o jsonpath='{.data.*}' | base64 -d | sed -n 's/.*password: "\([^"]*\)".*/\1/p' | head -n 1) echo -e "Client credentials:\n\tUser: $NATS_USER\n\tPassword: $NATS_PASS" + {{- end }} {{- end }} @@ -64,20 +61,62 @@ NATS monitoring service can be accessed via port {{ .Values.service.ports.monito {{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local -You can create a Golang pod to be used as a NATS client: +You can create a pod to be used as a NATS client: - kubectl run {{ include "common.names.fullname" . }}-client --restart='Never' --env="NATS_USER=$NATS_USER" --env="NATS_PASS=$NATS_PASS" --image docker.io/bitnami/golang --namespace {{ .Release.Namespace }} --command -- sleep infinity - kubectl exec --tty -i {{ include "common.names.fullname" . }}-client --namespace {{ .Release.Namespace }} -- bash - GO111MODULE=off go get github.com/nats-io/nats.go - cd $GOPATH/src/github.com/nats-io/nats.go/examples/nats-pub && go install && cd - cd $GOPATH/src/github.com/nats-io/nats.go/examples/nats-echo && go install && cd - {{- if .Values.auth.enabled }} - nats-echo -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} SomeSubject - nats-pub -s nats://$NATS_USER:$NATS_PASS@{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} -reply Hi SomeSubject "Hi everyone" - {{- else }} - nats-echo -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} SomeSubject - nats-pub -s nats://{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.ports.client }} -reply Hi SomeSubject "Hi everyone" - {{- end }} + cat <