Hard time understanding the JWT account creation

[h0jeZvgoxFepBQ2C]

Hi,

right now we are switching from rabbitmq to nats due to some issues on rabbitmq.

We would like to have following setup on our kubernetes cluster:

1. have one nats cluster for all customers (but each customer seperated as account)
2. each customer has one write credential + read only websocket clients (public website pushes)
3. authentication via JWT

with this setup, we are not sure if the accounts have to be created manually before?

In general we would like to share a static certificate/private key in all customer deployments and then dynamically create accounts+read only websocket credentials from these certificates (i guess this would be operator certificates?).

Is this possible to create dynamically accounts, just by using JWT tokens? Or do we have to create the accounts with some command line utilities before?

Sorry it my explanation is not really clear, I will make it more clear if more info is needed.

Thank you!

[derekcollison]

Do you want an account per customer?

[h0jeZvgoxFepBQ2C]

yes, the reason is that I want to have all data seperated

[derekcollison]

The longer term answer is with auth callouts, coming in 2.10.

You can do what you want today, but more work on your side during customer signup to create the account and default credentials and tie them to the client cert identity. All possible, but you will probably need some guidance from Synadia.

[h0jeZvgoxFepBQ2C]

Hm I see... another option would be to use something like a nats operator for kubernetes (f.e. like the rabbitmq cluster operator https://www.rabbitmq.com/kubernetes/operator/operator-overview.html) where you can use Custom Resource Definitions (like Vhost, Exchange,...). But I didn't found something like this for nats.. Or is there something like this existing?

[h0jeZvgoxFepBQ2C]

I see.. any estimation when 2.10 gets released?

[derekcollison]

Targeting sometime in May. You can run this from our nightly builds today. The auth callout is there in those nightly builds as well.

[h0jeZvgoxFepBQ2C]

I see, any new estimates when this arrives? :D Thank you!

[derekcollison]

We have a helm chart for kubernetes and an operator to help manage JetStream assets. But not accounts, etc.

[h0jeZvgoxFepBQ2C]

Is this now possible @derekcollison ? I see 2.10.5 is available but I'm still not sure if I understand the documentation correctly :/

[derekcollison]

Auth Callouts are possible, we have some examples and are working diligently with customers to help them fulfill their needs.

[h0jeZvgoxFepBQ2C]

Any ETA when the documentation for decentralized callouts will be available?

https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_callout

it says coming soon..