API Reference

Packages

• nauth.io/v1alpha1

nauth.io/v1alpha1

Package v1alpha1 contains API schema definitions for the nauth.io v1alpha1 API group.

Resource Types

• Account
• AccountExport
• AccountExportList
• AccountImport
• AccountImportList
• AccountList
• AccountSigningKey
• AccountSigningKeyList
• NatsCluster
• NatsClusterList
• User
• UserList

Account

Account is the composite resource for the accounts API.

Appears in:

• AccountList

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	Account
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec AccountSpec
status AccountStatus

AccountAdoption

Appears in:

• AccountAdoptions

Field	Description	Default	Validation
name string	Name the child resource name		MinLength: 1 Required
uid UID	UID of the child resource UID		Required
observedGeneration integer	ObservedGeneration refers to the observed generation of the child resource.		Minimum: 0 Required
status AccountAdoptionStatus	Status of the adoption		Required

AccountAdoptionStatus

Appears in:

• AccountAdoption

Field	Description	Default	Validation
status ConditionStatus	Status of the adoption, one of True, False, Unknown.		Enum: [True False Unknown] Required
desiredClaimObservedGeneration integer	DesiredClaimObservedGeneration refers to the observed generation of the child resource desired claim.		Minimum: 0
reason string	Reason contains a programmatic identifier indicating the reason for the adoption’s last transition. The value should be a CamelCase string. This field may not be empty.		MaxLength: 1024 MinLength: 1 Pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ Required
message string	Message is a human-readable message indicating details about the adoption.		MaxLength: 32768

AccountAdoptions

AccountAdoptions defines the status of child resources that have been adopted or are candidates for adoption by this account.

Appears in:

• AccountStatus

Field	Description	Default	Validation
exports AccountAdoption array	Exports defines adoptions of type AccountExport that are bound to the account.
imports AccountAdoption array	Imports defines adoptions of type AccountImport that are bound to the account.

AccountClaims

Appears in:

• AccountStatus

Field	Description	Default	Validation
accountLimits AccountLimits
displayName string
signingKeys SigningKeys
exports Exports
imports Imports
jetStreamEnabled boolean
jetStreamLimits JetStreamLimits
natsLimits NatsLimits

AccountExport

AccountExport is a component resource for exports in the accounts API.

Appears in:

• AccountExportList

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	AccountExport
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec AccountExportSpec
status AccountExportStatus

AccountExportClaim

Appears in:

• AccountExportStatus

Field	Description	Default	Validation
rules AccountExportRule array	Rules contains export rules that have been validated and are ready to be used by Account		MinItems: 1 Required
observedGeneration integer			Required

AccountExportList

AccountExportList contains a list of AccountExport.

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	AccountExportList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items AccountExport array

AccountExportRule

Appears in:

• AccountExportClaim
• AccountExportSpec

Field	Description	Default	Validation
name string
subject Subject			Required
type ExportType			Enum: [stream service] Required
responseType ResponseType			Enum: [Singleton Stream Chunked]
responseThreshold Duration
serviceLatency ServiceLatency
accountTokenPosition integer
advertise boolean
allowTrace boolean

AccountExportSpec

AccountExportSpec defines the desired state of AccountExport.

Appears in:

• AccountExport

Field	Description	Default	Validation
accountName string	AccountName refers to the Account in the same namespace to which this export applies.		Required
rules AccountExportRule array	Rules defines the export rules for this account export. Must have at least one rule.		MinItems: 1 Required

AccountExportStatus

AccountExportStatus defines the observed state of AccountExport.

Appears in:

• AccountExport

Field	Description	Default	Validation
accountID string	AccountID is the ID of the account that this export is bound to.
desiredClaim AccountExportClaim	Normalized claim for account to use
conditions Condition array
observedGeneration integer
reconcileTimestamp Time
operatorVersion string

AccountImport

AccountImport is a component resource for imports in the accounts API.

Appears in:

• AccountImportList

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	AccountImport
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec AccountImportSpec
status AccountImportStatus

AccountImportClaim

Appears in:

• AccountImportStatus

Field	Description	Default	Validation
rules AccountImportRuleDerived array	Rules contains import rules that have been validated and are ready to be used by Account.		MinItems: 1 Required
observedGeneration integer			Required

AccountImportList

AccountImportList contains a list of AccountImport.

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	AccountImportList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items AccountImport array

AccountImportRule

Appears in:

• AccountImportRuleDerived
• AccountImportSpec

Field	Description	Default	Validation
name string
subject Subject	Subject is the exported subject to import. It must be identical to or a subset of the exported subject.		Required
localSubject RenamingSubject	LocalSubject remaps the imported subject locally in the importing account.
type ExportType	Type defines whether the import is a stream or service import.		Enum: [stream service] Required
share boolean
allowTrace boolean

AccountImportRuleDerived

Appears in:

• AccountImportClaim

Field	Description	Default	Validation
name string
subject Subject	Subject is the exported subject to import. It must be identical to or a subset of the exported subject.		Required
localSubject RenamingSubject	LocalSubject remaps the imported subject locally in the importing account.
type ExportType	Type defines whether the import is a stream or service import.		Enum: [stream service] Required
share boolean
allowTrace boolean
account string	Account is the resolved export account ID used for this import rule.		Required

AccountImportSpec

AccountImportSpec defines the desired state of AccountImport.

Appears in:

• AccountImport

Field	Description	Default	Validation
accountName string	AccountName refers to the Account in the same namespace to which this import applies.		Required
exportAccountRef AccountRef	ExportAccountRef refers to the Account from which the exports are imported. This reference may point to an Account in another namespace.		Required
rules AccountImportRule array	Rules defines the import rules for this AccountImport.		MinItems: 1 Required

AccountImportStatus

AccountImportStatus defines the observed state of AccountImport.

Appears in:

• AccountImport

Field	Description	Default	Validation
accountID string	AccountID is the resolved ID of the Account referenced by spec.accountName.
exportAccountID string	ExportAccountID is the resolved ID of the Account referenced by spec.exportAccountRef.
desiredClaim AccountImportClaim	DesiredClaim is the normalized claim for Account to use.
conditions Condition array
observedGeneration integer
reconcileTimestamp Time
operatorVersion string

AccountLimits

Appears in:

• AccountClaims
• AccountSpec

Field	Description	Default	Validation
imports integer		-1
exports integer		-1
wildcards boolean		true
conn integer		-1
leaf integer		-1

AccountList

AccountList contains a list of Account.

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	AccountList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items Account array

AccountRef

Appears in:

• AccountImportSpec
• Import

Field	Description	Default	Validation
name string
namespace string

AccountSigningKey

AccountSigningKey manages one NATS account signing-key seed in a Kubernetes Secret. By default NAuth manages the signing key seed: it generates a new key and stores it in a Secret named spec.secretName (defaulting to -ac-sign). The Secret is owned by this resource and garbage-collected when the resource is deleted.

In observe mode (label nauth.io/management-policy=observe), NAuth only reads an existing Secret with the resolved name and derives the public key. Observed Secrets are not modified, owned, or deleted by the operator.

An Account trusts the public key by listing this resource in Account.spec.signingKeyRefs.

Appears in:

• AccountSigningKeyList

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	AccountSigningKey
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec AccountSigningKeySpec
status AccountSigningKeyStatus

AccountSigningKeyList

AccountSigningKeyList contains a list of AccountSigningKey.

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	AccountSigningKeyList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items AccountSigningKey array

AccountSigningKeyRef

AccountSigningKeyRef references a signing-key resource whose public key is trusted by the Account (and may be used to sign Users). Only AccountSigningKey is supported; Kind is reserved for future kinds (e.g. issuers).

Appears in:

• AccountSpec
• UserSpec

Field	Description	Default	Validation
kind AccountSigningKeyRefKind	Kind of the referenced resource. Defaults to AccountSigningKey.	AccountSigningKey	Enum: [AccountSigningKey]
name string	Name of the referenced resource.		MaxLength: 253 MinLength: 1 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ Required
namespace string	Namespace of the referenced resource. When empty, defaults to the referrer’s namespace. Cross-namespace references let multiple Accounts trust a shared signing key (e.g. a cluster-wide Auth Callout service).		MaxLength: 253 Pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?)?$

AccountSigningKeyRefKind

Underlying type: string

AccountSigningKeyRefKind is the kind of resource referenced as an account signing key.

Validation:

• Enum: [AccountSigningKey]

Appears in:

• AccountSigningKeyRef

Field	Description
AccountSigningKey

AccountSigningKeySpec

AccountSigningKeySpec defines the desired state of AccountSigningKey.

Appears in:

• AccountSigningKey

Field	Description	Default	Validation
secretName string	SecretName names the Kubernetes Secret that holds the account signing-key seed. In managed mode (default), SecretName is optional and defaults to -ac-sign; the Secret is created and owned by this AccountSigningKey. In observe mode (label nauth.io/management-policy=observe), SecretName is required and identifies the existing Secret to read; the operator never falls back to the managed default name and never modifies the Secret. Immutable.		MaxLength: 253 Pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

AccountSigningKeyStatus

AccountSigningKeyStatus defines the observed state of AccountSigningKey.

Appears in:

• AccountSigningKey

Field	Description	Default	Validation
publicKey string	PublicKey is the resolved NATS public key (A-prefixed nkey) for this signing key.
secretName string	SecretName is the resolved name of the Secret holding the seed.
managementPolicy string	ManagementPolicy reflects the effective management policy for this resource. Empty means managed (default); “observe” means the Secret is only read.
conditions Condition array
observedGeneration integer
reconcileTimestamp Time
operatorVersion string

AccountSpec

AccountSpec defines the desired state of Account.

Appears in:

• Account

Field	Description	Default	Validation
natsClusterRef NatsClusterRef	NatsClusterRef references the NatsCluster to use for this account. If not specified, the controller uses the operator-level NATS_CLUSTER_REF when configured. Otherwise, reconciliation fails because the target NatsCluster cannot be resolved.
displayName string	DisplayName is an optional name for the NATS resource representing the account. May be derived if absent.
jetStreamEnabled boolean	JetStreamEnabled indicates whether JetStream should be explicitly enabled or disabled. If absent, JetStream will be implicitly enabled/disabled based on the effective JetStreamLimits.
accountLimits AccountLimits
exports Exports
imports Imports
jetStreamLimits JetStreamLimits
natsLimits NatsLimits
signingKeyRefs AccountSigningKeyRef array	SigningKeyRefs lists references whose public keys are trusted as additional signing keys for this account. The implicit default signing key is always present and is not listed here.		MaxItems: 64

AccountStatus

AccountStatus defines the observed state of Account.

Appears in:

• Account

Field	Description	Default	Validation
claims AccountClaims
claimsHash string	ClaimsHash is a hash of the Account JWT claims, used to determine if the claims have changed and a new JWT needs to be generated.
adoptions AccountAdoptions
conditions Condition array
observedGeneration integer
reconcileTimestamp Time
operatorVersion string

CIDRList

Underlying type: TagList

Appears in:

• UserLimits

Export

Appears in:

• Exports

Field	Description	Default	Validation
name string
subject Subject
type ExportType			Enum: [stream service]
tokenReq boolean
revocations RevocationList
responseType ResponseType			Enum: [Singleton Stream Chunked]
responseThreshold Duration
serviceLatency ServiceLatency
accountTokenPosition integer
advertise boolean
allowTrace boolean

ExportType

Underlying type: string

ExportType defines the type of import/export.

Validation:

• Enum: [stream service]

Appears in:

• AccountExportRule
• AccountImportRule
• AccountImportRuleDerived
• Export
• Import

Field	Description
stream	Stream defines the type field value for a stream “stream”
service	Service defines the type field value for a service “service”

Exports

Underlying type: Export

Appears in:

• AccountClaims
• AccountSpec

Field	Description	Default	Validation
name string
subject Subject
type ExportType			Enum: [stream service]
tokenReq boolean
revocations RevocationList
responseType ResponseType			Enum: [Singleton Stream Chunked]
responseThreshold Duration
serviceLatency ServiceLatency
accountTokenPosition integer
advertise boolean
allowTrace boolean

Import

Appears in:

• Imports

Field	Description	Default	Validation
accountRef AccountRef	AccountRefName references the account used to create the user.
name string
subject Subject	Subject field in an import is always from the perspective of the initial publisher - in the case of a stream it is the account owning the stream (the exporter), and in the case of a service it is the account making the request (the importer).
account string
localSubject RenamingSubject	Local subject used to subscribe (for streams) and publish (for services) to. This value only needs setting if you want to change the value of Subject. If the value of Subject ends in > then LocalSubject needs to end in > as well. LocalSubject can contain $ wildcard references where number references the nth wildcard in Subject. The sum of wildcard reference and * tokens needs to match the number of * token in Subject.
type ExportType			Enum: [stream service]
share boolean
allowTrace boolean

Imports

Underlying type: Import

Appears in:

• AccountClaims
• AccountSpec

Field	Description	Default	Validation
accountRef AccountRef	AccountRefName references the account used to create the user.
name string
subject Subject	Subject field in an import is always from the perspective of the initial publisher - in the case of a stream it is the account owning the stream (the exporter), and in the case of a service it is the account making the request (the importer).
account string
localSubject RenamingSubject	Local subject used to subscribe (for streams) and publish (for services) to. This value only needs setting if you want to change the value of Subject. If the value of Subject ends in > then LocalSubject needs to end in > as well. LocalSubject can contain $ wildcard references where number references the nth wildcard in Subject. The sum of wildcard reference and * tokens needs to match the number of * token in Subject.
type ExportType			Enum: [stream service]
share boolean
allowTrace boolean

JetStreamLimits

Appears in:

• AccountClaims
• AccountSpec

Field	Description	Default	Validation
memStorage integer		-1
diskStorage integer		-1
streams integer		-1
consumer integer		-1
maxAckPending integer		-1
memMaxStreamBytes integer		-1
diskMaxStreamBytes integer		-1
maxBytesRequired boolean		false

NatsCluster

NatsCluster is the Schema for the natsclusters API

Appears in:

• NatsClusterList

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	NatsCluster
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec NatsClusterSpec
status NatsClusterStatus

NatsClusterList

NatsClusterList contains a list of NatsCluster

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	NatsClusterList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items NatsCluster array

NatsClusterRef

NatsClusterRef references a NatsCluster resource

Appears in:

• AccountSpec

Field	Description	Default	Validation
name string	Name of the NatsCluster
namespace string	Namespace of the NatsCluster

NatsClusterSpec

NatsClusterSpec defines the desired state of NatsCluster

Appears in:

• NatsCluster

Field	Description	Default	Validation
url string	URL is the NATS server URL for this cluster. Mutually exclusive with urlFrom.
urlFrom URLFromReference	URLFrom loads the NATS URL from a ConfigMap or Secret. Mutually exclusive with url.
operatorSigningKeySecretRef SecretKeyReference
systemAccountUserCredsSecretRef SecretKeyReference

NatsClusterStatus

NatsClusterStatus defines the observed state of NatsCluster.

Appears in:

• NatsCluster

Field	Description	Default	Validation
conditions Condition array
observedGeneration integer
reconcileTimestamp Time
operatorVersion string

NatsLimits

Appears in:

• AccountClaims
• AccountSpec
• UserClaims
• UserSpec

Field	Description	Default	Validation
subs integer		-1
data integer		-1
payload integer		-1

Permission

Permission defines allow/deny subjects

Appears in:

• Permissions

Field	Description	Default	Validation
allow StringList
deny StringList

Permissions

Permissions are used to restrict subject access, either on a user or for everyone on a server by default

Appears in:

• UserClaims
• UserSpec

Field	Description	Default	Validation
pub Permission
sub Permission
resp ResponsePermission

RenamingSubject

Underlying type: Subject

Appears in:

• AccountImportRule
• AccountImportRuleDerived
• Import

ResponsePermission

ResponsePermission can be used to allow responses to any reply subject that is received on a valid subscription.

Appears in:

• Permissions

Field	Description	Default	Validation
max integer
ttl Duration

ResponseType

Underlying type: string

ResponseType is used to store an export response type

Validation:

• Enum: [Singleton Stream Chunked]

Appears in:

• AccountExportRule
• Export

RevocationList

Underlying type: object

Appears in:

• Export

SamplingRate

Underlying type: integer

Appears in:

• ServiceLatency

SecretKeyReference

SecretKeyReference contains information to locate a secret in the same namespace

Appears in:

• NatsClusterSpec

Field	Description	Default	Validation
name string	Name of the Secret.		Required
key string	Key in the Secret, when not specified an implementation-specific default key is used.

ServiceLatency

Appears in:

• AccountExportRule
• Export

Field	Description	Default	Validation
sampling SamplingRate
results Subject

SigningKey

Appears in:

• SigningKeys

Field	Description	Default	Validation
key string

SigningKeys

Underlying type: SigningKey

Appears in:

• AccountClaims

Field	Description	Default	Validation
key string

StringList

Underlying type: string array

StringList is a wrapper for an array of strings

Appears in:

• Permission

Subject

Underlying type: string

Subject is a string that represents a NATS subject

Appears in:

• AccountExportRule
• AccountImportRule
• AccountImportRuleDerived
• Export
• Import
• RenamingSubject
• ServiceLatency

TagList

Underlying type: string array

TagList is a unique array of lower case strings All tag list methods lower case the strings in the arguments

Appears in:

• CIDRList

TimeRange

TimeRange is used to represent a start and end time

Appears in:

• UserLimits

Field	Description	Default	Validation
start string
end string

URLFromKind

Underlying type: string

URLFromKind is the type of resource to load the NATS URL from.

Validation:

• Enum: [ConfigMap Secret]

Appears in:

• URLFromReference

Field	Description
ConfigMap
Secret

URLFromReference

URLFromReference describes how to load the NATS URL from a ConfigMap or Secret.

Appears in:

• NatsClusterSpec

Field	Description	Default	Validation
kind URLFromKind	Kind is the type of resource to load from: ConfigMap or Secret.		Enum: [ConfigMap Secret] Required
name string	Name of the ConfigMap or Secret.		Required
namespace string	Namespace of the resource. When empty, defaults to the NatsCluster’s namespace.
key string	Key in the ConfigMap or Secret whose value is the NATS URL.		Required

User

User is the Schema for the users API.

Appears in:

• UserList

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	User
metadata ObjectMeta	Refer to Kubernetes API documentation for fields of metadata.
spec UserSpec
status UserStatus

UserClaims

Appears in:

• UserStatus

Field	Description	Default	Validation
accountName string	Deprecated. Will be removed in a future release (>v0.5.0). Ref: https://github.com/WirelessCar/nauth/issues/102
displayName string	DisplayName is an optional name for the NATS resource representing the user.
expiresAt Time	ExpiresAt is the absolute time when the generated user JWT expires.
permissions Permissions
natsLimits NatsLimits
userLimits UserLimits

UserLimits

Appears in:

• UserClaims
• UserSpec

Field	Description	Default	Validation
src CIDRList	Src is a comma separated list of CIDR specifications
times TimeRange array
timesLocation string

UserList

UserList contains a list of User.

Field	Description	Default	Validation
apiVersion string	nauth.io/v1alpha1
kind string	UserList
metadata ListMeta	Refer to Kubernetes API documentation for fields of metadata.
items User array

UserSpec

UserSpec defines the desired state of User.

Appears in:

• User

Field	Description	Default	Validation
accountName string	AccountName references the account used to create the user.
displayName string	DisplayName is an optional name for the NATS resource representing the user. May be derived if absent.
expiresAt Time	ExpiresAt is an optional absolute time when the generated user JWT expires.
permissions Permissions
userLimits UserLimits
natsLimits NatsLimits
signingKeyRef AccountSigningKeyRef	SigningKeyRef optionally references the signing key used to sign this User’s JWT. When absent, the Account’s implicit signing key is used. The referenced AccountSigningKey’s public key must appear in Account.status.claims.signingKeys at reconciliation time.

UserStatus

UserStatus defines the observed state of User.

Appears in:

• User

Field	Description	Default	Validation
conditions Condition array
claims UserClaims
observedGeneration integer
reconcileTimestamp Time
operatorVersion string