Repository navigation
Conversation
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A NATS server in operator (JWT) mode authenticates a client with a user JWT and an NKey seed. oCIS could connect to NATS only with a username and a password. All NATS connections now accept JWT credentials: events, caches, persistent stores, the service registry, and the health checks. - OCIS_NATS_CREDS_FILE: the path of a .creds file (nats.UserCredentials). The file is read again on each reconnect. - OCIS_NATS_CREDS: the content of a .creds file (nats.UserCredentialBytes). It takes precedence over the file. - Each events, cache and store struct has the fields CredsFile and Creds with a per-service override, for example PROXY_EVENTS_CREDS_FILE. - The registry reads MICRO_REGISTRY_AUTH_CREDS_FILE and MICRO_REGISTRY_AUTH_CREDS. If they are empty, it uses the OCIS_NATS_* variables. - store.Credentials is passed next to each store.Authentication call. The revaconfig maps pass the new reva keys. - The new checks.NewNatsCheckWithConfig uses the authentication and TLS settings of the service. The NATS health checks connected without credentials and without TLS before. This change needs the reva commit with pkg/natsauth and the natsjs plugin with the NatsOptions option. go.mod and vendor/ follow when these changes are pushed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…check The proxy health check used Events.Cluster, the cluster ID of the event system, as the NATS address. The check thus never reached the NATS server. The check now uses Events.Endpoint. The proxy uses NATS only to publish events, and an empty endpoint disables the events. So the check returns no error when the endpoint is empty. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-users streams The search service and the storage-users event stream build stream.NatsConfig field by field. They did not set CredsFile and Creds, so these two connections did not use the JWT credentials. The NATS server rejected them with "Authorization Violation". A test of "ocis server" against a NATS server in operator mode found this. The compiler cannot find a missing field in a struct literal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…cluster The nats service README did not tell that the embedded nats service cannot run in operator (JWT) mode. Add a section that describes the .creds variables, the registry variables, and the steps to use an external NATS cluster in JWT mode. Add the same note to the changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
go-masker copies a field without a mask tag unchanged, also a nested struct. A mask:"password" tag thus has an effect only when every parent field on the path has mask:"struct". Several parent fields did not have this tag, and some secret fields had no mask tag. - Add mask:"struct" to the proxy fields OIDC, OIDC.UserinfoCache, PreSignedURL, PreSignedURL.SigningKeys, ServiceAccount and Events, and to the shared Commons.Cache field. - Add mask:"password" to the AuthPassword fields of the proxy and of the shared cache, and to ServiceAccountSecret. - Add a test that sets a marker in every secret field of the proxy config and checks that the debug output does not show it. The test also fails when a secret-like field has no mask:"password" tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Each config has two fields for the NATS credentials: CredsFile (OCIS_NATS_CREDS_FILE;<SERVICE>_..._CREDS_FILE) and Creds (OCIS_NATS_CREDS;<SERVICE>_..._CREDS). envdecode sets each field on its own, and the content always won. Example: OCIS_NATS_CREDS set globally and GRAPH_CACHE_CREDS_FILE set for the service. The graph cache then used the global content and ignored the service file. The registry already used a different rule: the registry variables take precedence over the global variables. Use the registry rule everywhere. After envdecode decodes a struct, it resolves each CredsFile/Creds pair: when the file comes from a more specific environment variable than the content, the content is cleared. In the same scope the content still wins. A value from the config file has the lowest scope, because environment variables override the config file. Update the descriptions of the Creds fields, the nats README, and the changelog. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
storeOptions checked the NATS credentials and called os.Exit(1) on an error. ReconnectedCB calls Init, and Init runs storeOptions again. If a reconnect happened while a rotated .creds file was only partly written, the service stopped. In the same path, nats.UserCredentials reads the file once when the option is applied. When this read failed, the error was ignored and the connection had no credentials. Now only the first call checks the credentials, at startup. Later calls do not check the file. For a file, they set the JWT callbacks without a read. The callbacks read the file on each connect, so a partly written file fails only that connect attempt, and NATS retries it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ache The create home cache of the gateway (create_personal_space_cache_config) got the NATS credentials, but it had no TLS settings. With TLS on the NATS server, this cache could not connect. Add CreateHomeCacheEnableTLS, CreateHomeCacheTLSInsecure and CreateHomeCacheTLSRootCACertificate with the same variables as the provider cache, and pass them to reva. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
|
I gave it a test with this helmfile based testbed https://github.com/owncloud-koko/ocis-charts/pull/70 and it runs fine for me so far. Is there anything specific I can test? |
Remove the service-specific NATS credentials variables. Only OCIS_NATS_CREDS_FILE and OCIS_NATS_CREDS remain. The service registry also uses these two variables and no longer reads MICRO_REGISTRY_AUTH_CREDS_FILE and MICRO_REGISTRY_AUTH_CREDS. Remove the envdecode logic that let the more specific scope win, because only one scope remains. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
A NATS server in operator (JWT) mode authenticates a client with a user JWT and an NKey seed. Before this change, oCIS could connect to NATS only with a username and a password. Thus oCIS could not use a shared NATS cluster with one NATS account for each instance.
This PR adds JWT authentication for all NATS connections: events, caches, persistent stores, the service registry, and the health checks.
New configuration
OCIS_NATS_CREDS_FILE.credsfile (nats.UserCredentials). The client reads the file again on each reconnect, so a rotated JWT works without a restart.OCIS_NATS_CREDS.credsfile (nats.UserCredentialBytes). Use it when you cannot mount a file. It takes precedence overOCIS_NATS_CREDS_FILE.ocis.yamlfile.natsservice does not support JWT mode. Use an external NATS cluster andOCIS_EXCLUDE_RUN_SERVICES=nats.services/nats/README.mddescribes the steps.Changes
CredsFileandCredsfields in 17 events structs, 18 cache and store structs, and the shared cache.Credshas themask:"password"tag.store.Credentials(...)next to eachstore.Authentication(...)call. The revaconfig maps pass the new reva keys.ocis-pkg/natsjsregistry/registry.go: JWT credentials for the registry.ocis-pkg/checks/checknats.go: the newNewNatsCheckWithConfiguses the authentication and TLS settings of the service. Before this change, the NATS health checks connected without credentials and without TLS.nats.gov1.54.0,go 1.26.10.Dependencies
pkg/natsauth, events, stores).NatsOptionsoption for theevents/natsjsplugin.go.moduses a temporaryreplacetogithub.com/2403905/plugins. Do not merge before kobergj/plugins#3 and owncloud/reva#782 are merged andgo.modpoints to the final commits.How Has This Been Tested?
ocis-pkg/checks: health check against a NATS server in operator mode, with the creds file, the creds content, username and password, and invalid credsocis-pkg/natsjsregistry: the registry reads the global variables, and it checks the credentials only at startupservices/proxy/pkg/server/debug: the debug output masks every secret valuenats-serverin operator mode.ocis serverwithOCIS_EXCLUDE_RUN_SERVICES=nats,OCIS_CACHE_STORE=nats-js-kv, andOCIS_PERSISTENT_STORE=nats-js-kv.OCIS_NATS_CREDSand once withOCIS_NATS_CREDS_FILE.Types of changes
Checklist
services/nats/README.md)🤖 Generated with Claude Code