►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Deep Dive: NATS - Waldemar Quevedo, Synadia Communications, Inc
The NATS project took a big leap in 2018 towards making it possible to be used as the core component build a global overlay network to connect services securely. In NATS v2.0, its feature set has been considerably expanded, some of these features include, gateways to create super clusters, decentralized management via JWTs and ed25519 keys for auth, subject based isolation using accounts, a new clustering protocol and system accounts for operators. In this talk you will learn how about the internals of many of these features, the current state of the project and what is the next in its roadmap.
https://sched.co/MPjx
A
Okay,
well,
thank
you
for
attending
the
deep
dive
to
nuts.
We
have
to
see
that
already
sum
up:
production
of
users
for
Nats.
We
joined
the
CN
CF
last
year
and
has
a
increasing
popularity
since
last
year,
oil
a
lot
and
more
than
a
third,
the
well
the
maintenance
into
a
project
hasn't
have
increased
and
also
the
contributors.
So
it's
a
excited
to
be
here
and
also
just
a
trivia.
Last
year
when
I
was
at
the
Q
Khan
European
Cup
in
hell,
my
laptop
broke
just
one
hour
before
then.
A
A
Eqs
I'm
a
software
engineer
at
sign
media
communications,
where
many
of
them
maintainer
for
nuts
are
working
right
now
have
been
using
database
systems
for
since
2012
I
started
with
cloud
foundry
doing
operations
with
the
ruby
version
thrown
from
Nats
and
I'm
very,
very
happy
with
the
projects
and
things
it's
a
very
fun
project
to
be
a
part
of
and
I
really
like.
The
philosophy
of
simplicity
for
nets
so
I
also
last
year,
I
groped
the
first
book
for
it,
and
you
want
to
take
a
look.
A
It's
practical
nets
and
it
covers
mainly
all
out
features
from
net
subversion.
One
so
I
need
to
start
looking
into
an
update
for
Nets
version
2.
So
in
this
talk,
two
main
things:
how
many
of
you
are
using
kubernetes?
Well,
I!
Guess:
let's
go
a
cucumber
okay
and
using
the
Nets
operator?
Well,
that's:
okay,
yeah!
So
I'll
use
quick
overview
of
the
nets
we
most
recent
merciful,
Nets
operator
is
already
for
using
the
net
to
be
two
features.
So
I'll
just
go
quick
overdose,
so
announcement,
that's
version.
A
We
launched
that
cute
cone
on
December,
so
it's
already
been
six
more
than
or
close
to
six
months
in
in
production
on
in
production,
so
we're
very
close
to
ship.
It
now
I'll
just
finish
on
the
documentation,
want
to
ship
with
documentation
from
day
one
and
this
time.
So
the
anna
has
a
date
and
just
a
little
bit
more
more
more
wait
for
for
us
tagging
the
repo,
because
everything
is
open-source
and
everything
scentmaster
and
really
do
you
want
to
check
it
out
so
questions
from
yesterday.
A
B
With
the
nets
over
the
new
nets,
v2
clustering
does
it
work,
for
example,
make
sure
that
you
don't
have
too
much
talk
between
different
Nets
streaming
servers
connected
to
different
geographically
located
Nats
clusters,
so
say
I
have
a
net
screaming
cluster
or
do
I
deploy
different
Nets?
You
mean
clusters
or
can
I
have
a
single
net
streaming
cluster
for
multiple
Nats
V
2
clusters?
What
what
would
be
but
to
be
the
general
way
of
doing
that?
Okay,.
A
So,
okay,
well
I,
I!
Guess
that
question
might
be
better
answer
when
I
talk
about
the
super
clusters,
so
the
question
well,
I
mean
we
compute
how
those
not
streaming
would
work
once
you
have
the
super
clusters:
I
guess:
yeah!
Okay,
I'll
touch
on
that
when
I
talk
about
super
clusters
in
okay,
okay,
thank
you!
So
that's
person
it's
a
very
important
release
for
for
us,
because
it's
a
Nats.
A
It's
now
taking
a
leap
from
being
technology
that
remains
within
a
single
data
center
in
a
silo
and
it's
not
can
be
used
as
a
core
component
to
be
like
global
communication
network
and
like
a
backbone
with
the
goal,
so
that
to
provide
an
always
available,
dial
tone
kind
of
like
a
global
utility
that
single
URL
that
you
can
just
connect
to
and
start
communicating,
sending
messages
requests.
And
in
our
case
this
the
URL
telnet
I.
A
Will
you
can
tell
it,
but
you
need
a
proper
client
for
Nats
and
connect
dot,
ng
s,
dot
global
on
the
port.
Four
two
two:
two!
If
you
want
to
try
with
disconnect
using
the
go
client,
so
this
is
a
list
of
all
the
features
that
are
shipping
with
nice
version,
starting
with
the
and
the
most
notable
one,
which
is
the
multi-tenancy
features
and
accounts,
and
we
call
them
containers
for
messaging.
In
order
to
achieve
that,
we
had
to
there.
A
A
A
There's
a
security
and
off
enhancements
once
called
the
end
keys,
which
are
eighty
two
five,
five
one,
nine
keys,
the
superclusters
that
we're
talking
about
which
gateways
and
leaf
nodes
and
basically
class
of
clusters
system
accounts
for
operations
for
this
very
large
clusters.
When
you
can
use
use
Nats
to
be
able
to
monitor
all
of
the
service
that
are
part
of
the
network
and
the
centralized
management
instead
of
having
a
single
static
configuration
and
that
you
can,
you
can
do
reload
it
dynamically
update.
A
So
first
I
will
multi-tenancy
and
accounts,
which
are
we
like
to
say,
direct
like
containers
for
messaging
you
familiar
with
the
Nats
version.
One
authorization
features
we
have.
You
can
define
a
stanza
for
authorization
and
list
a
number
of
users
that
are
allowed
to
be
able
to
connect
into
the
system
in
this
convenient.
That
was
like
a
static
list
of
of
users
and
all
of
the
subject.
Namespaces
were
were
shirt.
A
So
if
you
wanted
to
separate
the
permissions
you
could
well,
you
could
start
using
the
permissions
definition
to
be
able
to
declare
whether
these
set
of
users
are
allowed
to
only
send
requests
on
this
subject,
but
they
are
allowed
to
be
able
to
they're
not
allowed
to
subscribe
for
actors
responders
for
these
other
service.
In
this
case,
if
you
do
the
connect
and
police
and
message,
for
example,
in
this
case,
the
user
Alice,
you
would
get
an
asynchronous
era
notification
that
it
cannot
publish
messages
and
the
other
ones
getting
a
notification
that
it
can
subscribe.
A
So
this
is
a
still
very
useful,
but
now
there's
some
more
flexible
way
to
create
like
pool
of
users
and
separating
into
multiple
accounts.
In
this
case
you
a
couple
of
accounts,
one
Acme
and
CN
CF,
and
they
have
a
single
user
for
each
one
of
the
accounts.
Now,
if
the
alleys
connects-
and
it
doesn't,
Alice
doesn't
have
to
declare
which
is
the
account
that
is
connecting,
but
rather
the
server
knows
to
which
account
it
belongs
already
by
only
sending
their
credentials.
A
So
in
this
case
the
message
is
not
forward,
so
this
can
be
a
very
easy
way
to
be
able
to
reduce
a
single
and
not
server
for
multiple
set
of
requirements,
and,
as
you
know,
that
not
server
performance
is
it's
fairly
high,
so
you
can
buy
the
Falls
around
80
million
messages
per
second
very
busy
machines.
So
you
can
start
rather
than
separating
to
multiple
clusters.
You
can
just
continue
to
use
the
same
set
of
eyepiece
or
reduce
the
same
data
sent
didn't
nuts
cluster
set
up
in
order
to
support
this
clustering.
A
The
accounts
isolation,
the
routes,
how
to
be
rewritten-
and
this
is
the
only
part
that
is
not
compatible
with
not
v1
and
deployment,
and
the
reason
for
that
is
that
well
now
to
upgrade
fournette
in
to
version
2
and
then
there
your
clients
will
have
to
have
a
disconnect
to
the
next
version
two
clusters
and
you
cannot
connect
them
version,
2
closer
to
version
1.
So
if
you're
using
Nats
operator
is
a
feature
named
extra
routes,
so
you
can
connect
to
other
clusters
so
that
you
can
drain
one
cluster
and
then
upgrading.
A
Well,
the
interest
is
being
forwarded
to
the
other
Nats
members
from
Nats
cluster,
and
you
see
that
there
is
now
this
dollar
G
account.
So,
even
if
you're
not
explicitly
using
accounts,
you
already
part
of
an
account
if
you,
if
you
start
using
NetSuite
to
us
if
it
were
not
be
one.
What
actually
is
happening
is
that
you're
using
the
global
account
where
all
day
known
well
implicitly
using
the
global
account.
A
So
the
next
feature
is
that
sharing
actually
daily
sharing
data
between
these
accounts.
For
this
you
use
the
streams
of
services.
Abstractions
again,
services
is
what
we
know
in
Nats
as
any
endpoint
that
is
any
subscription,
then
from
a
requester,
is
expecting
a
response.
That
is
a
single
response.
That
is
a
that
is
a
service,
and
a
stream
is
essentially
just
a
subscription
that
from
what
you
can
consume
events.
A
In
case
of
using
in
this
case,
we
have
a
couple
of
two
accounts:
the
Acme
and
CNCs
accounts
with
an
Alice
and
Bob
users.
You
need
to
very
similar
to
like
in
containers.
You
need
to
export
the
port's
that
you
want
other
services
to
connect.
You
need
to
export
what
are
the
subjects
that
other
accounts
are
being
able
to
mount
into
their
or
their
own
isolated
name,
something
like
spaces.
So
in
this
case
the
Acme
account
is
exporting.
A
There
is
making
available
the
hello
subject
and
then
the
CN
CF
account
it
is
importing
from
the
Acme
account
the
subject,
hello
and
mounting
that
subject
into
the
CNC
F
dot,
hello
subject.
So
considering
that
and
isolated
pieces
now
the
skew
subscription,
then
it's
a
that
is
acting
as
a
service.
We
have
the
hello
subscription
using
the
worker
queue
group
that
is
expecting
a
request
with
an
reply
inbox
then
this
from
this
intensive
account.
You
make
a
request
on
the
CNC
F
dot,
hello
subject.
A
A
Similarly,
you
we
can
declare
in
the
exports
the
this
is
a
stream
that
you
are
making
available
for
other
accounts
under
the
Acme
dot,
full
wall
cart,
and
then
the
scenes
of
agency
of
account
can't
import
that
this
stream,
that
belongs
from
the
Acme
account
into
imports
namespace.
So
now
any
message
that
gets
published
under
the
Ahmed
dot
full
water.
Anything
that
matches
with
a
full
welcome
in
this
case
would
be
hello,
but
it
could
be
any
number
of
subject
separated
by
that,
but
I
thought
they
would
be
consumed
by
the
other.
A
Cn
CF
account
under
the
imports,
dot,
full-wall
card,
okay.
So
so
far
we
have
you
still
been
using
the
users
and
basic
user
and
password
credential
study
configuration
within
that
server.
We
have
a
new
technology
named
n
T's,
which
are
based
on
eighty
two,
five,
five,
one,
nine
very
short
keys-
and
these
are
we
added
some
a
couple
of
encoding
for
the
from
for
the
wrong
8255
one
nine
keys
tutorial
to
make
them
easy
to
use,
and
this
is
what
you
can
like.
A
You
can
use
this
public
and
private
key
mechanism
to
authenticate
the
users
instead
of
the
basic
users,
so
there
is
a
n
key
tool
that
you
can
use
and
go
get
to
able
to
get
the
generate
these
private
keys.
This
is
an
example
of
creating
a
user
key.
You
can
see
that
starts
with
an
S.
You
said
seat
that
can
act
as
a
private
key.
A
Instead,
what
you
can
use
to
generate
the
key
pair
that
you
can
use
to
sign
messages
and
payloads
or
verify
the
the
payload
in
from
this
seed,
you
can
create
a
public
account
and
the
public
account
is
that
the
one
that
is
well
actually
gets
transmitted
today
to
the
nav
server,
for
example,
but
the
not
server
doesn't
hold
any
private
keys
whatsoever.
Also
it
doesn't
have.
A
So
it's
an
example
of
replacing
the
users
user
basic
and
password
that
we
have
with
the
end
keys.
So
you
declare
in
the
still
using
static
configuration.
You
declare
the
public
key
for
from
the
empty
and
I
just
have
commented
here.
Then
what
is
the
seat,
but
the
seat?
You
actually
have
to
be
very
careful,
it's
a
secret
essentially,
so
you
have
to
be
careful
how
to
manage
that
and
basically
they
never
make
it
public.
A
So
now
that
we
have
our
M
keys
and
have
a
public
and
private
key
way
of
authenticating
with
the
server
the
next
piece
making
the
static
configuration
and
the
centralized
for
this,
we
used
a
JWT
s
web
tokens,
so
you
can
represent
the
identities
that
belong
to
the
system.
So
you
have
a
sparse
automated
the
fields
from
the
JWT.
There
is
the
which
account
this
user
belongs
to
you.
What
is
the
public
M
key?
There
are
some
more
metadata
like
friendly
names
and
the
permissions
that
this
account
has
and
some
exploration
our
parameters
as
well.
A
The
net
account
server
so
now,
then,
that
server
to
get
it
gets
configured
with
our
resolver,
which
is
an
HTTP
client,
makes
a
single
get
to
to
fetch
a
publicly
available
and
a
JWT
in
order
to
validate
whether
this
user
is
can't
connect
to
the
system.
The
idea
is
that
these
endpoints
will
eventually
be
part
of
our
CDN,
and
so
you
can
even
thanks
to
the
CDN
that
request
gets
handled
by
the
closest
server
to
you.
So
this
is
not
like
private
data.
A
The
complete
documentation
for
all
these
tooling
is
going
greater.
Well
just
so,
you
can
really
start
checking
out
the
repos
that
are
part
of
not
SIA
organization,
so
in
a
nutshell,
how
it
works
with
them
in
keys
and
abilities
that
as
a
client,
you
start
the
connection
the
service
center
in
for
protocol
back
with
a
challenge.
You
as
a
client
then
send
the
connect
request
that
they
connect
payload
signing
the
challenge
with
the
private
entity
that
you
have
and
you
provide
the
public
and
key
and
in
this
case,
will
be
part
of
the
JWT.
A
This
an
example
of
the
flow
there's
an
announced
gets
sent
by
the
server
it's
a
the
fool.
Jwt
gets
added
as
a
part
of
the
JSON
payload
from
connect,
and
this
is
the
signature
that
you
give
sent
back
to
the
server
okay.
So
now
about
super
clusters
and
basically
cluster
for
clusters,
the
clusters
of
clusters
and
rely
on
technology
named
the
gateways
and
the
gateway
is
a
new
type
of
connection
that
can
be
either
outbound
or
inbound.
So
in
this
case
there
is
only
pair
data
center.
A
This
is
an
example
of
well.
They
treat
different
data
centers
when
you
connect
to
them
and
they
announce
to
you
whether
they
available
clusters,
then
for
that
data
center.
So
then
you
come
from
Amster
and
you
get
three
different
public,
IPs
and
NYC.
You
can
add
two
different
as
well,
and
then,
if
you
publish
from
the
third
one,
then
the
message
will
get
routed
to
the
other
data
centers
above
and
this
is
goes
in
line
to
the
original
question
about
not
streaming
the
queue
subscriptions
for
when
you're
juicing,
cute
and
super
clusters.
A
A
Let's
say
you
have
an
they
fail
and
then
another
to
some
center
good
failover,
basically
even
if
they're
very
far
so,
but
by
by
the
by
by
default,
it
will
try
talking.
Where
is
the
closest
subscriber
consumer
that
can
reply
to
the
message.
So
in
this
case,
it
was
only
until
the
the
two
queue
subscriptions
that
belong
to
the
Amsterdam
data
center
failed
when
they
a
New
York
a
data
center
I
started
to
handling
the
traffic
yeah.
It
does
it
by
well.
It
is
a
word
of
the
round
with
times
from
the
Binghamton
protocol.
A
A
So
it
means
on
top
of
the
previous
pieces,
there
an
other
dimension,
and
there
is
an
extra
type
of
a
network
topology
using
our
leaf
nodes,
which
is
when
your
client,
you
can
use
like
double
clients
to
connect
to
their
super
clusters
without
having
to
rely
on
the
n
keys
or
this
other
feature.
So
you
can
just
have
this
extra
leaf.
Node
handle
that
for
you.
A
What
similar
and
system
events
it's
an
very
helpful
feature,
be
able
to
do
in
operations
for
this
mesh
of
clusters
and
in
our
case,
because
you
use
not
cluster
super
cluster,
that
comp
is
composed
from
around
seven
different
and
different
torrontés
regions
and
aks
and
little
G
K,
and
so,
rather
than
doing
operations
with
multiple
keep
CTL
commands.
We
just
rely
on
just
more
Nats
table
to
collect
all
of
the
requests
and
monitor
using
their
the
system
account.
That
is,
that
gives
you
this
ability
a
number
of
a
number
of
steps
from
the
server.
A
A
And
also
answer
this
was
quite
a
while
ago,
but
it
is
getting
shipped
with
nasturtium
to
it
is
the
lame-duck
mode
when,
by
sending
a
user
to
signal
to
the
to
the
server
now
the
servers
are
going
to
gradually
be
disconnecting.
All
of
the
clients
are
connected
to,
so
they
can
reconnect
to
any
other
available
node
without
so
that
that
it
is
held
to
be
able
to
drain
traffic
form
from
one
for
doing
updates
to
nuts.
A
A
This
is
how
the
manifest
looks
like
when
you
want
to
order
the
way
we're
right
now
recommend
it
to.
If
you
want
to
create
a
super
cluster,
so
the
publicly
available
clouds.
We
use
the
host
port
to
be
able
to
bind
a
single
port
to
each
one
of
the
machines,
so
you
have
to.
If
you
want
to
have
external
access
with
the
operator,
you
need
to
ensure
that
the
as
part
of
the
nodes
metadata
from
the
cubelets
there
is
the
external
IP.
A
So
nuts
operator
creates
three
well
in
this
case.
Is
size
3,
so
you
would
create
a
3
node
cluster
and
it
assigns
a
single
a
record
for
each
one
of
the
nodes,
which
is
very
important
if
you
want
to
setup
TLS,
because
you
need
to
create
a
wildcard
certificate
that
matches
this
in
this
case
would
be
the
NAD
super
cluster
MGMT
and
now
in
that's
part
of
the
reason
in
the
nuts
operator,
and
someone
contributed
how
to
do
that
using
the
cert
manager
and
that's
an
super
useful.
A
This
is
what
I
mentioned
about
the
external
IP
metadata
has
to
be
available.
The
way
this
is
this
is
also
relying
on
having
a
service
account
that
has
enough
permissions
to
be
able
to
resolve
the
external
IP.
It's
just
an
initializer
container
that
finds
one.
What
is
the
IP
from
the
current
net
server
node?
What
it's
has
been
deployed
and
then
sets
that
at
runtime
so
that
it
can
advertise?
What
is
the
IP
address?
A
It's
something
I
really
involved,
or
it
does
but
automated
with
the
operator,
but
this
is
very
useful
so
that
you
can
your
clients
if
you're
connected
and
externally
they
can
discover
the
other
publicly
available
endpoints
without
relying
on
DNS
anymore
and
for
the
trusted
operator
and
setup.
There
are
basically
three
different
parameters
in
to
set
which
are
the
system
account,
which
is
the
world.
The
blessed
account
that
you
can
use
to
be
able
to
monitor
the
servers,
the
special
secret
that
contains
them.
A
Well,
they
private
key.
What
with
them
for
well
for
for
the
trusted
server
setup
and
the
end
point
from
where
it's
going
to
where
it's
going
to
be
validating,
that
the
generalities
that
it
gets,
what
you
want
to
be
fetching
the
edge
abilities
or
the
Nats
account
server.
And
this
is
what
I
mentioned
about
that.
A
simple
tool
that
you
can
use.
Some
just
using
the
system
account
and
the
super
clusters
and
Enki's
table
to
discover
what
are
the
current
available
and
notes
as
part
of
their
closer.
D
B
C
A
C
A
Full
a
full
mesh
means
that
the
closed
Nats
cluster,
the
next
closer
it's
for
high
availability
purposes,
for
example
each
one
of
these
nuts
clusters,
small
nut
clusters,
trade-
they
they
are
a
full
mesh,
so
full
mesh
one
hub
and
then
the
nap.
The
super
clusters
they're
not
full
mesh,
but
have
the
outbound
connections
in
yeah.
But
the
communication
with
four
nuts
the
cornets
is
a
stateless,
so
it
wouldn't
have
their
issues
and
timestamps
or
yeah.