NATS Cluster and Cert Manager

    If you are running Kubernetes < 1.15, use instead.

    1. apiVersion: cert-manager.io/v1alpha2
    2. kind: ClusterIssuer
    3. metadata:
    4.   name: selfsigning
    5. spec:
    6.   selfSigned: {}
    1. clusterissuer.certmanager.k8s.io/selfsigning unchanged

    Now create the certs that will match the DNS name used by the clients to connect, in this case traffic is within Kubernetes so we are using the name nats which is backed up by a headless service (here is an example of sample deployment)

    1. ---
    2. apiVersion: cert-manager.io/v1alpha2
    3. kind: Certificate
    4. metadata:
    5.   name: nats-server-tls
    6. spec:
    7.   secretName: nats-server-tls
    8.   duration: 2160h # 90 days
    9.   renewBefore: 240h # 10 days
    10.   issuerRef:
    11.     name: nats-ca
    12.     kind: Issuer
    13.   - signing
    14.   - key encipherment
    15.   - server auth
    16.   organization:
    17.   - Your organization
    18.   commonName: nats.default.svc.cluster.local
    19.   dnsNames:
    20.   - nats.default.svc
    1. ---
    2. apiVersion: cert-manager.io/v1alpha2
    3. kind: Certificate
    4. metadata:
    5.   name: nats-routes-tls
    6. spec:
    7.   secretName: nats-routes-tls
    8.   duration: 2160h # 90 days
    9.   renewBefore: 240h # 10 days
    10.   issuerRef:
    11.     name: nats-ca
    12.   usages:
    13.   - signing
    14.   - key encipherment
    15.   - server auth
    16.   - client auth
    17.   organization:
    18.   - Your organization
    19.   commonName: "*.nats-mgmt.default.svc.cluster.local"
    20.   dnsNames:
    21.   - "*.nats-mgmt.default.svc"

    Now let’s create an example NATS cluster with the operator:

    1. kubectl get pods -o wide
    1. NAME     READY   STATUS    RESTARTS   AGE   IP            NODE       NOMINATED NODE
    2. nats-1   1/1     Running   0          4s    172.17.0.8    minikube   <none>
    3. nats-2   1/1     Running   0          3s    172.17.0.9    minikube   <none>
    4. nats-3   1/1     Running   0          2s    172.17.0.10   minikube   <none>

    Follow the logs:

    1. [1] 2019/12/18 12:27:23.920417 [INF] Starting nats-server version 2.1.4
    2. [1] 2019/12/18 12:27:23.920590 [INF] Git commit [not set]
    3. [1] 2019/12/18 12:27:23.921024 [INF] Listening for client connections on 0.0.0.0:4222
    4. [1] 2019/12/18 12:27:23.921047 [INF] Server id is NDA6JC3TGEADLLBEPFAQ4BN4PM3WBN237KIXVTFCY3JSTDOSRRVOJCXN