API Reference

Packages

• nauth.io/v1alpha1

nauth.io/v1alpha1

Package v1alpha1 contains the schema definitions for NAuth custom resources (see Kubernetes API conventions).

Kubernetes Resource Conventions

All NAuth CRDs are standard Kubernetes resources and include:

• apiVersion: API group/version, for example nauth.io/v1alpha1
• kind: resource type, for example Account, User, or NatsCluster
• metadata: Kubernetes object metadata (name, namespace, labels, annotations, etc.). See Kubernetes ObjectMeta

Resource Types

• Account
• AccountList
• User
• UserList
• NatsCluster
• NatsClusterList

Account

Account is the schema for accounts.

Field	Type	Required	Notes
apiVersion	string	Yes	nauth.io/v1alpha1
kind	string	Yes	Account
metadata	ObjectMeta	Yes	Kubernetes metadata
spec	AccountSpec	No	Desired state
status	AccountStatus	No	Observed state

AccountSpec

Field	Type	Required	Notes
natsClusterRef	NatsClusterRef	No	Explicit NatsCluster reference
displayName	string	No	Optional account display name
accountLimits	AccountLimits	No	Account-level limits
exports	Export[]	No	Account exports
imports	Import[]	No	Account imports
jetStreamLimits	JetStreamLimits	No	JetStream limits
natsLimits	NatsLimits	No	NATS limits

AccountStatus

Field	Type	Required	Notes
claims	AccountClaims	No	Effective account claims
conditions	metav1.Condition[]	No	Standard Kubernetes conditions
observedGeneration	int64	No	Last observed generation
reconcileTimestamp	metav1.Time	No	Last reconcile timestamp
operatorVersion	string	No	Operator version that reconciled the resource

AccountClaims

Field	Type
accountLimits	AccountLimits
displayName	string
signingKeys	SigningKey[]
exports	Export[]
imports	Import[]
jetStreamLimits	JetStreamLimits
natsLimits	NatsLimits

AccountLimits

Field	Type	Default
imports	int64	-1
exports	int64	-1
wildcards	bool	true
conn	int64	-1
leaf	int64	-1

JetStreamLimits

Field	Type	Default
memStorage	int64	-1
diskStorage	int64	-1
streams	int64	-1
consumer	int64	-1
maxAckPending	int64	-1
memMaxStreamBytes	int64	-1
diskMaxStreamBytes	int64	-1
maxBytesRequired	bool	false

SigningKey

Field	Type
key	string

User

User is the schema for users.

Field	Type	Required	Notes
apiVersion	string	Yes	nauth.io/v1alpha1
kind	string	Yes	User
metadata	ObjectMeta	Yes	Kubernetes metadata
spec	UserSpec	No	Desired state
status	UserStatus	No	Observed state

UserSpec

Field	Type	Required	Notes
accountName	string	Yes	Referenced account name
displayName	string	No	Optional user display name
permissions	Permissions	No	Publish/subscribe/response permissions
userLimits	UserLimits	No	User limits
natsLimits	NatsLimits	No	NATS limits

UserStatus

Field	Type	Required	Notes
conditions	metav1.Condition[]	No	Standard Kubernetes conditions
claims	UserClaims	No	Effective user claims
observedGeneration	int64	No	Last observed generation
reconcileTimestamp	metav1.Time	No	Last reconcile timestamp
operatorVersion	string	No	Operator version that reconciled the resource

UserClaims

Field	Type	Notes
accountName	string	Deprecated
displayName	string	Effective display name
permissions	Permissions	Effective permissions
natsLimits	NatsLimits	Effective NATS limits
userLimits	UserLimits	Effective user limits

NatsCluster

NatsCluster is the schema for cluster connection configuration and secret references.

Field	Type	Required	Notes
apiVersion	string	Yes	nauth.io/v1alpha1
kind	string	Yes	NatsCluster
metadata	ObjectMeta	Yes	Kubernetes metadata
spec	NatsClusterSpec	No	Desired state
status	NatsClusterStatus	No	Observed state

NatsClusterSpec

Validation rule: exactly one of url or urlFrom must be specified.

Field	Type	Required	Notes
url	string	Conditional	Direct NATS URL. Mutually exclusive with urlFrom
urlFrom	URLFromReference	Conditional	Indirect URL source. Mutually exclusive with url
operatorSigningKeySecretRef	SecretKeyReference	Yes	Operator signing key secret reference
systemAccountUserCredsSecretRef	SecretKeyReference	Yes	System account user creds secret reference

NatsClusterStatus

Field	Type	Required	Notes
conditions	metav1.Condition[]	No	Standard Kubernetes conditions
observedGeneration	int64	No	Last observed generation
reconcileTimestamp	metav1.Time	No	Last reconcile timestamp
operatorVersion	string	No	Operator version that reconciled the resource

Shared Types

NatsClusterRef

Field	Type	Required	Notes
name	string	Yes	NatsCluster name
namespace	string	No	NatsCluster namespace

URLFromReference

Field	Type	Required	Notes
kind	URLFromKind	Yes	ConfigMap or Secret
name	string	Yes	Source object name
namespace	string	No	Defaults to the NatsCluster namespace
key	string	Yes	Key containing the URL value

URLFromKind

Enum values:

• ConfigMap
• Secret

SecretKeyReference

Field	Type	Required
name	string	Yes
key	string	No

NatsLimits

Field	Type	Default
subs	int64	-1
data	int64	-1
payload	int64	-1

Permissions

Field	Type
pub	Permission
sub	Permission
resp	ResponsePermission

Permission

Field	Type
allow	string[]
deny	string[]

ResponsePermission

Field	Type
max	int
ttl	duration

UserLimits

Field	Type	Notes
src	string[]	CIDR allow list
times	TimeRange[]	Allowed time windows
timesLocation	string	Timezone location

TimeRange

Field	Type
start	string
end	string

Export

Field	Type	Notes
name	string
subject	string
type	enum (stream, service)
tokenReq	bool
revocations	map[string]int64
responseType	enum (Singleton, Stream, Chunked)	Service exports only
responseThreshold	duration
serviceLatency	ServiceLatency
accountTokenPosition	uint
advertise	bool
allowTrace	bool

Import

Field	Type	Required	Notes
accountRef	AccountRef	Yes	Referenced account resource
name	string	No
subject	string	No	Exported subject to import
account	string	No	Raw account id
localSubject	string	No	Local remapped subject
type	enum (stream, service)	No
share	bool	No
allowTrace	bool	No

ServiceLatency

Field	Type	Required
sampling	int	Yes
results	string	Yes

AccountRef

Field	Type	Required
name	string	Yes
namespace	string	Yes

List Types

AccountList

Contains a list of Account.

UserList

Contains a list of User.

NatsClusterList

Contains a list of NatsCluster.