nats_kv
Cache key/value pairs in a NATS key-value bucket.
-
Common
-
Advanced
caches:
nats_kv:
urls: [] # No default (required)
bucket: "" # No default (required)caches:
nats_kv:
urls: [] # No default (required)
max_reconnects: "" # No default (optional)
bucket: "" # No default (required)
tls:
enabled: false
skip_cert_verify: false
enable_renegotiation: false
root_cas: ""
root_cas_file: ""
client_certs: []
tls_handshake_first: false
auth:
nkey_file: "" # No default (optional)
nkey: "" # No default (optional)
user_credentials_file: "" # No default (optional)
user_jwt: "" # No default (optional)
user_nkey_seed: "" # No default (optional)
user: "" # No default (optional)
password: "" # No default (optional)
token: "" # No default (optional)Connection name
When monitoring and managing a production NATS system, it is often useful to know which connection a message was sent or received from. To achieve this, set the connection name option when creating a NATS connection. Redpanda Connect can then automatically set the connection name to the NATS component label, so that monitoring tools between NATS and Redpanda Connect can stay in sync.
Authentication
A number of Redpanda Connect components use NATS services. Each of these components support optional, advanced authentication parameters for NKeys and user credentials.
For an in-depth guide, see the NATS documentation.
NKeys
NATS server can use NKeys in several ways for authentication. The simplest approach is to configure the server
with a list of user’s public keys. The server can then generate a challenge for each connection request from a client, and the client must respond to the challenge by signing it with its private NKey, configured in the nkey_file or nkey field.
For more details, see the NATS documentation.
User credentials
NATS server also supports decentralized authentication based on JSON Web Tokens (JWTs). When a server is configured to use this authentication scheme, clients need a user JWT and a corresponding NKey secret to connect.
You can use either of the following methods to supply the user JWT and NKey secret:
-
In the
user_credentials_filefield, enter the path to a file containing both the private key and the JWT. You can generate the file using the nsc tool. -
In the
user_jwtfield, enter a plain text JWT, and in theuser_nkey_seedfield, enter the plain text NKey seed or private key.
For more details about authentication using JWTs, see the NATS documentation.
Fields
auth.nkey
The NKey seed.
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
# Examples:
nkey: UDXU4RCSJNZOIQHZNWXHXORDPRTGNJAHAHFRGZNEEJCPQTT2M7NLCNF4auth.nkey_file
An optional file containing a NKey seed.
Type: string
# Examples:
nkey_file: ./seed.nkauth.password
An optional plain text password (given along with the corresponding user name).
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
auth.token
An optional plain text token.
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
auth.user
An optional plain text user name (given along with the corresponding user password).
Type: string
auth.user_credentials_file
An optional file containing user credentials which consist of an user JWT and corresponding NKey seed.
Type: string
# Examples:
user_credentials_file: ./user.credsauth.user_jwt
An optional plain text user JWT (given along with the corresponding user NKey Seed).
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
auth.user_nkey_seed
An optional plain text user NKey Seed (given along with the corresponding user JWT).
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
max_reconnects
The maximum number of times to attempt to reconnect to the server. If negative, it will never stop trying to reconnect.
Type: int
tls.client_certs[]
A list of client certificates to use. For each certificate either the fields cert and key, or cert_file and key_file should be specified, but not both.
Type: object
Default: []
# Examples:
client_certs:
- cert: foo
key: bar
# ---
client_certs:
- cert_file: ./example.pem
key_file: ./example.keytls.client_certs[].key
A plain text certificate key to use.
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
Default: ""
tls.client_certs[].password
A plain text password for when the private key is password encrypted in PKCS#1 or PKCS#8 format. The obsolete pbeWithMD5AndDES-CBC algorithm is not supported for the PKCS#8 format.
Because the obsolete pbeWithMD5AndDES-CBC algorithm does not authenticate the ciphertext, it is vulnerable to padding oracle attacks that can let an attacker recover the plaintext.
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
Default: ""
# Examples:
password: foo
# ---
password: ${KEY_PASSWORD}tls.enable_renegotiation
Whether to allow the remote server to repeatedly request renegotiation. Enable this option if you’re seeing the error message local error: tls: no renegotiation.
Type: bool
Default: false
tls.root_cas
An optional root certificate authority to use. This is a string, representing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
|
This field contains sensitive information that usually shouldn’t be added to a configuration directly. For more information, see Manage Secrets before adding it to your configuration. |
Type: string
Default: ""
# Examples:
root_cas: |-
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----tls.root_cas_file
An optional path of a root certificate authority file to use. This is a file, often with a .pem extension, containing a certificate chain from the parent trusted root certificate, to possible intermediate signing certificates, to the host certificate.
Type: string
Default: ""
# Examples:
root_cas_file: ./root_cas.pemtls.skip_cert_verify
Whether to skip server side certificate verification.
Type: bool
Default: false
