Account Resolver TLS (Docker)

[Ryner51]

• Defect
• [ X ] Feature Request or Change Proposal

Defects

Make sure that these boxes are checked before submitting your issue -- thank you!

• Included nats-server -DV output
• Included a [Minimal, Complete, and Verifiable example] (https://stackoverflow.com/help/mcve)

Versions of nats-server and affected client libraries used:

2.0.4

OS/Container environment:

Docker Image

Steps or code to reproduce the issue:

resolver: URL(http://:/jwt/v1/accounts/)

Expected result:

Nats should be able to connect to the account resolver using HTTPS with Docker Images.

Actual result:

/etc/stan/nats-secret.conf:2:1: could not fetch <"https://nats-account-service.eventhorizon.svc.cluster.local:9090/jwt/v1/accounts/">: Get https://nats-account-service.eventhorizon.svc.cluster.local:9090/jwt/v1/accounts/: x509: certificate signed by unknown authority

Feature Requests

Allow configuration to pass in trusted cert in configuration

Use Case:

Using a Docker Image to deploy FT to K8S

Proposed Change:

Allow configuration to pass in trusted cert in configuration

Who Benefits From The Change(s)?

Deployment to K8S with Account Server HTTPS Traffic

Alternative Approaches

Create own Docker image with base image, other than Scratch, that pulls in static binaries and then place trusted CA's in OS.

[ronaldslc]

I thought this was solved with introduction of resolver_tls using:

resolver_tls: {
  ca_file: <path>
}

But it seems it doesn't work, because the code assumes resolver_tls is for Client TLS authentication, and does not assign CA to RootCAs pool in the golang code.

The only current alternative is to set

resolver_tls: {
  insecure: true
}

Which is not recommended for production. And so the original alternative above is the only viable method, which is to update the OS CA store.

The documentation: https://docs.nats.io/nats-server/configuration/securing_nats/jwt/resolver is currently misleading.

I've forked the NATS helm chart to add resolver TLS CA to achieve this in kubernetes configuration instead of rebuilding and hosting a docker image.