NATS Documentation

The nsc tool is used to build and manage NATS account configurations. It provides capabilities for managing the lifecycle of NATS security entities and their permissions.

Key capabilities include:

• Entity Management: Create and edit Operators, Accounts, and Users.
• Permissions: Manage publish and subscribe permissions for Users.
• Exports/Imports: Define Service and Stream exports from an account and reference Service/Streams from other accounts.
• Access Control: Generate Activation tokens for private services or streams and generate User credential files.
• Inspection: Describe Operators, Accounts, Users, and Activations.
• JWT Management: Push and pull account JWTs to/from an account JWTs server.

NATS provides a multi-layered security model covering encryption, authentication, authorization, and multi-tenancy:

• Encryption: Connections can be encrypted using TLS.
• Authentication: Supports multiple methods including Tokens, Username/Password, TLS Certificates, NKEY with Challenge, and Decentralized JWT.
• Authorization: Authenticated clients are identified as users with specific permissions (authorizations) to interact with subjects.
• Multi-tenancy: Use Accounts to create independent subject namespaces. You can control the import/export of messages and services between accounts.
• Data at Rest: The JetStream persistence layer supports encryption at rest.

The NATS ecosystem provides a variety of specialized tools for managing, monitoring, and benchmarking NATS servers. These tools cover the full lifecycle of NATS operations, including configuration, security, and performance tuning.

Key tools include:

• nats CLI: For interacting with and managing NATS servers.
• nk: For generating NKeys (security credentials).
• nsc: For configuring Operators, Accounts, and Users.
• nats account server (nas): For serving Account JWTs.
• nats top: For real-time monitoring of NATS Server performance.
• nats-bench: For benchmarking NATS Server performance.
• prometheus-nats-exporter: For exporting NATS server metrics to Prometheus and visualizing them in Grafana.

A NATS client is an application that connects to a NATS server using a connection URL and authenticates via a credential file. While the nats-server does not include clients, several essential tools are available for managing and interacting with NATS infrastructure:

• nats CLI: The primary tool for testing, monitoring, and managing NATS (local servers, leaf nodes, clusters, or super-clusters).
• nsc CLI: Used to manage account attributes and user JWT tokens.
• nk: A tool and library used to manage Nkeys.
• Client Libraries: Most language-specific client libraries include sample programs for publishing, subscribing, and request-reply patterns.

The NATS server supports several methods for authenticating clients:

• Token Authentication: Using a shared token.
• Plain Text Username/Password: Standard credentials.
• Bcrypted Username/Password: Securely hashed credentials.
• TLS Certificate: Using mutual TLS (mTLS) for authentication.
• NKEY with Challenge: Using NKEY-based asymmetric cryptography.
• Decentralized JWT Authentication: A decentralized model where account and user information is stored in a resolver rather than the server configuration file.

NATS provides a multi-layered security model to protect your messaging infrastructure. To fully secure a NATS deployment, you should implement the following three layers:

1. Encryption (TLS): Protect data in transit by encrypting connections between clients and servers, or between NATS servers in a cluster, using TLS.
2. Authentication: Ensure that only known and verified clients can connect to the NATS server.
3. Authorization: Control what authenticated clients are allowed to do by restricting the specific subjects they can publish to or subscribe from.

While managing JetStream configuration (such as Streams and Consumers) directly within your application code is a common pattern, you can also pre-create these resources using external automation tools. Supported methods for managing JetStream configuration include:

• NATS CLI: Using configuration files to define and apply settings.
• Terraform: Using the NATS provider for Infrastructure as Code (IaC).
• GitHub Actions: Automating configuration deployment via CI/CD.
• Kubernetes JetStream Controller: Managing JetStream resources natively within a Kubernetes cluster.