Skip to content

API Reference

Package v1alpha1 contains API schema definitions for the nauth.io v1alpha1 API group.

Account is the composite resource for the accounts API.

Appears in:

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string Account
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec AccountSpec
status AccountStatus

Appears in:

Field Description Default Validation
name string Name the child resource name MinLength: 1
Required: {}
Required: {}
uid UID UID of the child resource UID Required: {}
observedGeneration integer ObservedGeneration refers to the observed generation of the child resource. Minimum: 0
Required: {}
status AccountAdoptionStatus Status of the adoption Required: {}

Appears in:

Field Description Default Validation
status ConditionStatus Status of the adoption, one of True, False, Unknown. Enum: [True False Unknown]
Required: {}
Required: {}
desiredClaimObservedGeneration integer DesiredClaimObservedGeneration refers to the observed generation of the child resource desired claim. Minimum: 0
Optional: {}
reason string Reason contains a programmatic identifier indicating the reason for the adoption’s last transition.
The value should be a CamelCase string.
This field may not be empty.
MaxLength: 1024
MinLength: 1
Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
Required: {}
Required: {}
message string Message is a human-readable message indicating details about the adoption. MaxLength: 32768
Optional: {}

AccountAdoptions defines the status of child resources that have been adopted or are candidates for adoption by this account.

Appears in:

Field Description Default Validation
exports AccountAdoption array Exports defines adoptions of type AccountExport that are bound to the account. Optional: {}
imports AccountAdoption array Imports defines adoptions of type AccountImport that are bound to the account. Optional: {}

Appears in:

Field Description Default Validation
accountLimits AccountLimits Optional: {}
displayName string Optional: {}
signingKeys SigningKeys Optional: {}
exports Exports Optional: {}
imports Imports Optional: {}
jetStreamEnabled boolean Optional: {}
jetStreamLimits JetStreamLimits Optional: {}
natsLimits NatsLimits Optional: {}

AccountExport is a component resource for exports in the accounts API.

Appears in:

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string AccountExport
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec AccountExportSpec
status AccountExportStatus

Appears in:

Field Description Default Validation
rules AccountExportRule array Rules contains export rules that have been validated and are ready to be used by Account MinItems: 1
Required: {}
observedGeneration integer Required: {}

AccountExportList contains a list of AccountExport.

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string AccountExportList
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items AccountExport array

Appears in:

Field Description Default Validation
name string Optional: {}
subject Subject Required: {}
type ExportType Enum: [stream service]
Required: {}
responseType ResponseType Enum: [Singleton Stream Chunked]
Optional: {}
responseThreshold Duration Optional: {}
serviceLatency ServiceLatency Optional: {}
accountTokenPosition integer Optional: {}
advertise boolean Optional: {}
allowTrace boolean Optional: {}

AccountExportSpec defines the desired state of AccountExport.

Appears in:

Field Description Default Validation
accountName string AccountName refers to the Account in the same namespace to which this export applies. Required: {}
rules AccountExportRule array Rules defines the export rules for this account export. Must have at least one rule. MinItems: 1
Required: {}

AccountExportStatus defines the observed state of AccountExport.

Appears in:

Field Description Default Validation
accountID string AccountID is the ID of the account that this export is bound to. Optional: {}
desiredClaim AccountExportClaim Normalized claim for account to use Optional: {}
conditions Condition array Optional: {}
observedGeneration integer Optional: {}
reconcileTimestamp Time Optional: {}
operatorVersion string Optional: {}

AccountImport is a component resource for imports in the accounts API.

Appears in:

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string AccountImport
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec AccountImportSpec
status AccountImportStatus

Appears in:

Field Description Default Validation
rules AccountImportRuleDerived array Rules contains import rules that have been validated and are ready to be used by Account. MinItems: 1
Required: {}
observedGeneration integer Required: {}

AccountImportList contains a list of AccountImport.

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string AccountImportList
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items AccountImport array

Appears in:

Field Description Default Validation
name string Optional: {}
subject Subject Subject is the exported subject to import.
It must be identical to or a subset of the exported subject.
Required: {}
localSubject RenamingSubject LocalSubject remaps the imported subject locally in the importing account. Optional: {}
type ExportType Type defines whether the import is a stream or service import. Enum: [stream service]
Required: {}
share boolean Optional: {}
allowTrace boolean Optional: {}

Appears in:

Field Description Default Validation
name string Optional: {}
subject Subject Subject is the exported subject to import.
It must be identical to or a subset of the exported subject.
Required: {}
localSubject RenamingSubject LocalSubject remaps the imported subject locally in the importing account. Optional: {}
type ExportType Type defines whether the import is a stream or service import. Enum: [stream service]
Required: {}
share boolean Optional: {}
allowTrace boolean Optional: {}
account string Account is the resolved export account ID used for this import rule. Required: {}

AccountImportSpec defines the desired state of AccountImport.

Appears in:

Field Description Default Validation
accountName string AccountName refers to the Account in the same namespace to which this import applies. Required: {}
exportAccountRef AccountRef ExportAccountRef refers to the Account from which the exports are imported.
This reference may point to an Account in another namespace.
Required: {}
rules AccountImportRule array Rules defines the import rules for this AccountImport. MinItems: 1
Required: {}

AccountImportStatus defines the observed state of AccountImport.

Appears in:

Field Description Default Validation
accountID string AccountID is the resolved ID of the Account referenced by spec.accountName. Optional: {}
exportAccountID string ExportAccountID is the resolved ID of the Account referenced by spec.exportAccountRef. Optional: {}
desiredClaim AccountImportClaim DesiredClaim is the normalized claim for Account to use. Optional: {}
conditions Condition array Optional: {}
observedGeneration integer Optional: {}
reconcileTimestamp Time Optional: {}
operatorVersion string Optional: {}

Appears in:

Field Description Default Validation
imports integer -1 Optional: {}
exports integer -1 Optional: {}
wildcards boolean true Optional: {}
conn integer -1 Optional: {}
leaf integer -1 Optional: {}

AccountList contains a list of Account.

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string AccountList
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Account array

Appears in:

Field Description Default Validation
name string
namespace string

AccountSpec defines the desired state of Account.

Appears in:

Field Description Default Validation
natsClusterRef NatsClusterRef NatsClusterRef references the NatsCluster to use for this account.
If not specified, the controller uses the operator-level NATS_CLUSTER_REF when configured.
Otherwise, reconciliation fails because the target NatsCluster cannot be resolved.
Optional: {}
displayName string DisplayName is an optional name for the NATS resource representing the account. May be derived if absent. Optional: {}
jetStreamEnabled boolean JetStreamEnabled indicates whether JetStream should be explicitly enabled or disabled.
If absent, JetStream will be implicitly enabled/disabled based on the effective JetStreamLimits.
Optional: {}
accountLimits AccountLimits Optional: {}
exports Exports Optional: {}
imports Imports Optional: {}
jetStreamLimits JetStreamLimits Optional: {}
natsLimits NatsLimits Optional: {}

AccountStatus defines the observed state of Account.

Appears in:

Field Description Default Validation
claims AccountClaims Optional: {}
claimsHash string ClaimsHash is a hash of the Account JWT claims, used to determine if the claims have changed and a new JWT needs to be generated. Optional: {}
adoptions AccountAdoptions Optional: {}
conditions Condition array Optional: {}
observedGeneration integer Optional: {}
reconcileTimestamp Time Optional: {}
operatorVersion string Optional: {}

Underlying type: TagList

Appears in:

Appears in:

Field Description Default Validation
name string
subject Subject
type ExportType Enum: [stream service]
tokenReq boolean
revocations RevocationList
responseType ResponseType Enum: [Singleton Stream Chunked]
responseThreshold Duration
serviceLatency ServiceLatency
accountTokenPosition integer
advertise boolean
allowTrace boolean

Underlying type: string

ExportType defines the type of import/export.

Validation:

  • Enum: [stream service]

Appears in:

Field Description
stream Stream defines the type field value for a stream “stream”
service Service defines the type field value for a service “service”

Underlying type: Export

Appears in:

Field Description Default Validation
name string
subject Subject
type ExportType Enum: [stream service]
tokenReq boolean
revocations RevocationList
responseType ResponseType Enum: [Singleton Stream Chunked]
responseThreshold Duration
serviceLatency ServiceLatency
accountTokenPosition integer
advertise boolean
allowTrace boolean

Appears in:

Field Description Default Validation
accountRef AccountRef AccountRefName references the account used to create the user.
name string
subject Subject Subject field in an import is always from the perspective of the
initial publisher - in the case of a stream it is the account owning
the stream (the exporter), and in the case of a service it is the
account making the request (the importer).
account string
localSubject RenamingSubject Local subject used to subscribe (for streams) and publish (for services) to.
This value only needs setting if you want to change the value of Subject.
If the value of Subject ends in > then LocalSubject needs to end in > as well.
LocalSubject can contain $ wildcard references where number references the nth wildcard in Subject.
The sum of wildcard reference and * tokens needs to match the number of * token in Subject.
type ExportType Enum: [stream service]
share boolean
allowTrace boolean

Underlying type: Import

Appears in:

Field Description Default Validation
accountRef AccountRef AccountRefName references the account used to create the user.
name string
subject Subject Subject field in an import is always from the perspective of the
initial publisher - in the case of a stream it is the account owning
the stream (the exporter), and in the case of a service it is the
account making the request (the importer).
account string
localSubject RenamingSubject Local subject used to subscribe (for streams) and publish (for services) to.
This value only needs setting if you want to change the value of Subject.
If the value of Subject ends in > then LocalSubject needs to end in > as well.
LocalSubject can contain $ wildcard references where number references the nth wildcard in Subject.
The sum of wildcard reference and * tokens needs to match the number of * token in Subject.
type ExportType Enum: [stream service]
share boolean
allowTrace boolean

Appears in:

Field Description Default Validation
memStorage integer -1 Optional: {}
diskStorage integer -1 Optional: {}
streams integer -1 Optional: {}
consumer integer -1 Optional: {}
maxAckPending integer -1 Optional: {}
memMaxStreamBytes integer -1 Optional: {}
diskMaxStreamBytes integer -1 Optional: {}
maxBytesRequired boolean false Optional: {}

NatsCluster is the Schema for the natsclusters API

Appears in:

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string NatsCluster
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec NatsClusterSpec
status NatsClusterStatus

NatsClusterList contains a list of NatsCluster

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string NatsClusterList
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items NatsCluster array

NatsClusterRef references a NatsCluster resource

Appears in:

Field Description Default Validation
name string Name of the NatsCluster
namespace string Namespace of the NatsCluster Optional: {}

NatsClusterSpec defines the desired state of NatsCluster

Appears in:

Field Description Default Validation
url string URL is the NATS server URL for this cluster. Mutually exclusive with urlFrom. Optional: {}
urlFrom URLFromReference URLFrom loads the NATS URL from a ConfigMap or Secret. Mutually exclusive with url. Optional: {}
operatorSigningKeySecretRef SecretKeyReference
systemAccountUserCredsSecretRef SecretKeyReference

NatsClusterStatus defines the observed state of NatsCluster.

Appears in:

Field Description Default Validation
conditions Condition array Optional: {}
observedGeneration integer Optional: {}
reconcileTimestamp Time Optional: {}
operatorVersion string Optional: {}

Appears in:

Field Description Default Validation
subs integer -1 Optional: {}
data integer -1 Optional: {}
payload integer -1 Optional: {}

Permission defines allow/deny subjects

Appears in:

Field Description Default Validation
allow StringList Optional: {}
deny StringList Optional: {}

Permissions are used to restrict subject access, either on a user or for everyone on a server by default

Appears in:

Field Description Default Validation
pub Permission Optional: {}
sub Permission Optional: {}
resp ResponsePermission Optional: {}

Underlying type: Subject

Appears in:

ResponsePermission can be used to allow responses to any reply subject that is received on a valid subscription.

Appears in:

Field Description Default Validation
max integer Optional: {}
ttl Duration Optional: {}

Underlying type: string

ResponseType is used to store an export response type

Validation:

  • Enum: [Singleton Stream Chunked]

Appears in:

Underlying type: object

Appears in:

Underlying type: integer

Appears in:

SecretKeyReference contains information to locate a secret in the same namespace

Appears in:

Field Description Default Validation
name string Name of the Secret. Required: {}
key string Key in the Secret, when not specified an implementation-specific default key is used. Optional: {}

Appears in:

Field Description Default Validation
sampling SamplingRate
results Subject

Appears in:

Field Description Default Validation
key string

Underlying type: SigningKey

Appears in:

Field Description Default Validation
key string

Underlying type: string array

StringList is a wrapper for an array of strings

Appears in:

Underlying type: string

Subject is a string that represents a NATS subject

Appears in:

Underlying type: string array

TagList is a unique array of lower case strings All tag list methods lower case the strings in the arguments

Appears in:

TimeRange is used to represent a start and end time

Appears in:

Field Description Default Validation
start string
end string

Underlying type: string

URLFromKind is the type of resource to load the NATS URL from.

Validation:

  • Enum: [ConfigMap Secret]

Appears in:

Field Description
ConfigMap
Secret

URLFromReference describes how to load the NATS URL from a ConfigMap or Secret.

Appears in:

Field Description Default Validation
kind URLFromKind Kind is the type of resource to load from: ConfigMap or Secret. Enum: [ConfigMap Secret]
Required: {}
name string Name of the ConfigMap or Secret. Required: {}
namespace string Namespace of the resource. When empty, defaults to the NatsCluster’s namespace. Optional: {}
key string Key in the ConfigMap or Secret whose value is the NATS URL. Required: {}

User is the Schema for the users API.

Appears in:

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string User
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec UserSpec
status UserStatus

Appears in:

Field Description Default Validation
accountName string Deprecated. Will be removed in a future release (>v0.5.0). Ref: https://github.com/WirelessCar/nauth/issues/102 Optional: {}
displayName string DisplayName is an optional name for the NATS resource representing the user. Optional: {}
expiresAt Time ExpiresAt is the absolute time when the generated user JWT expires. Optional: {}
permissions Permissions Optional: {}
natsLimits NatsLimits Optional: {}
userLimits UserLimits Optional: {}

Appears in:

Field Description Default Validation
src CIDRList Src is a comma separated list of CIDR specifications Optional: {}
times TimeRange array Optional: {}
timesLocation string Optional: {}

UserList contains a list of User.

Field Description Default Validation
apiVersion string nauth.io/v1alpha1
kind string UserList
kind string Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Optional: {}
apiVersion string APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Optional: {}
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items User array

UserSpec defines the desired state of User.

Appears in:

Field Description Default Validation
accountName string AccountName references the account used to create the user.
displayName string DisplayName is an optional name for the NATS resource representing the user. May be derived if absent. Optional: {}
expiresAt Time ExpiresAt is an optional absolute time when the generated user JWT expires. Optional: {}
permissions Permissions Optional: {}
userLimits UserLimits Optional: {}
natsLimits NatsLimits Optional: {}

UserStatus defines the observed state of User.

Appears in:

Field Description Default Validation
conditions Condition array Optional: {}
claims UserClaims Optional: {}
observedGeneration integer Optional: {}
reconcileTimestamp Time Optional: {}
operatorVersion string Optional: {}