►
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2021 Virtual from May 4–7, 2021. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
NATS Streams and Services: From Zero to Hero - Waldemar Quevedo Salinas & Jaime Piña, Synadia Communications
NATS is high performance cloud native messaging system that allows you to build globally available and secure applications based on streams and services that are both fast and simple to operate. In this talk you will learn: how to get started with NATS streams and services, about the NATS Adaptive Edge Architecture to span clusters across different networks and clusters using leafnodes and gateway connections, followed by a deep dive into the latest features such as its JetStream persistence engine as well as how to deploy and operating NATS in Kubernetes.
https://sched.co/ekHe
A
A
So
what
is
nets?
That's
a
10
year
old
project.
Actually
it
became
the
first
commit
was
in
october
10
years
ago.
It
is
a
cloud
native
messing
system
originally
for
cloud
foundry
that
has,
as
it
trades
is,
that
it
aims
to
be
very
performant,
very
simple
and
secure
and
provide
an
always
available.
Dial
tone
has
over
30
client
languages.
Implementations
the
clients
are.
A
The
protocol
has
not
changed
a
lot.
You
know
in
this
decade.
It
has
almost
stayed
the
same
just
in
this
year.
There
are
a
couple
of
new
additions
actually
but
has
been
very
stable
protocol.
We
say
that
it
is
lightweight,
because
it
is
a
single
binary
that
has
no
extra
dependencies.
It's
a
very
small
docker
image.
A
And
after
that,
we
will
discover
the
topology
of
the
whole
cluster
and
I'll
be
able
to
do
that
reconnect
or
fail
over
to
other
clusters
and
has
a
very
simple
api
that
we're
going
to
cover
in
this
talk
as
many
clients,
unlike
with
other
projects,
most
of
these
are
maintained
by
the
official
maintainers
for
nets.
So
all
of
these
nuts.go,
which
is
the
main
implementation
for
nets,
and
that's
ruby,
which
was
the
original
one,
are
all
maintained
by
the
by
the
core
team.
A
A
You
can
also
use
services
similar
to
how
you
are
used
to
using
http,
endpoints
or
grpc
endpoints
for
receiving
machining
requests
and
sending
out
responses,
and
you
can
do
that
one-to-one
communication
with
nas
as
well,
but
thanks
to
the
pops
up
dna
that
from
the
project,
you
can
also,
for
example,
get
a
request,
single
request
and
expect
multiple
responses.
So
you
have
multiple
communication
patterns
when
using
nets,
and
you
also
have
load
balancing.
So
you
need,
you
don't
need.
A
I
don't
know
who
needs
to
hear
this,
but
you
don't
need
an
extra
service
mesh
to
get
loan
balancing
for
making
a
request
responses
and
distributing
work
and
when
using
nets,
you're
always
interacting
with
subjects
subjects.
Something
very
simple,
like
a
four
weather
subjects
where
you
can
express
different
interests,
for
example
using
wildcards
like
food.bar,
and
you
can
also
make
a
match
on
food.uh
wildcard
that
will
match
anything
on
that
at
that
level
of
the
subject.
A
Namespace
or
you
also
have
the
greater
than
wildcard
that
will
tap
into
the
traffic
and
receive
all
the
events
that
you
are
allowed
to
receive,
because
you
can
also
have
define
the
permissions
of
what
streams
are
you
are
able
to
to
consume
so
those
features
from
nets
translate
into
service
streams
and
services
and
in
terms
of
the
api
from
the
clients-
and
you
say
that
we're
using
whenever
you
use,
request
and
respond.
Those
are
we're
talking
about
services.
A
Those
are
usually
load
balanced,
using
the
queue
subscriptions,
but
you
can
use
a
q
subscription
for
either
services
or
streams
actually
and
whenever
we
do
a
regular,
pop-up,
publishing
and
broadcasting
a
message
or
having
a
stream
of
messages.
We're
of
course,
talking
about
streams,
publish
as
I
mentioned,
you
can
broadcast
messages
in
this
case,
publish
on
foo.
Anyone
that
is
connected
to
nets
and
receiving
subscribe
to
foo
will
receive
that
message
with
request
response
internally.
A
All
this
is
all
pops
up
so
you're
using
a
unique
inboxes
to
announce
that
you
want
to
ex
you're
expecting
a
single
response
on
your
client
inbox.
So
that's
you
can
get
one-to-one
communication
that
way
and
you
can
also
do
load
balancing
by
using
the
q
subscriptions
by
defining
a,
for
example,
like
a
worker
group,
so
these
set
of
subscribers
are
going
to
be
able
to
load
balance
the
work
amongst
them,
and
so
those
were
features
that
has
been
since
the
beginning
with
nets
v1
in
nazi
v2.
A
The
project
took
a
leap
where
we're
not
only
talking
about
being
the
nuts
within
a
single
silo.
Now
you
are
we're
considering
nats
as
part
of
like
a
much
larger
part
of
a
much
larger
system
of
connected
devices
and
also
workloads,
for
example.
Now
it
has
a
nas
xv2,
it's
a
multi-tenant,
a
multi-region.
A
So
in
this
case,
have
the
acme
and
cncf
they
are
exporting
and
importing
services
from
each
other
and
from
if
you
subscribe
from
imports
greater
than
you
can
receive
all
the
messages
that
it
is
exporting
from
acme
accounts
and
the
same
with
streams.
So
the
services
from
let's
say
acme
account,
can
be
imported
and
mounted
as
an
api
within
your
own
subject:
namespace
and
interact
in
the
dev
in
in
your
own
local
account
with
the
service
from
another
place.
A
So
there's
a
many
data
sharing
features
and
parts
of
the
nas
v2
deploying
so
launch,
and
also
very
interesting
from
that
is
that
we
have
more
availability
available
network
topologies.
Also
now
you
can
have
very
complex
network
topologies
using
that's
gateway
connections
for
creating
clusters
of
clusters,
so
you
have
like
a
hybrid
make
a
hybrid
setup,
a
super
multi-region
cluster
with
different
kubernetes
and,
let's
say
in
different
regions.
A
You
can
also
have
and
leaf
nodes
connected
to
with
edge
connections
to
any
part
of
those
larger
super
cluster,
and
these
can
have
its
own
off
mechanisms
that
are
different
from
the
the
ones
that
are
part
of
the
super
cluster
and
they
can
be
basic
chain.
So
you
can
have
map
better
not
supposed
to
how
it
fits
your
organization.
A
A
You
have
a
net
super
cluster
which
has
a
that
tends
to
be
in
the
cloud,
for
example,
or
in
this
case,
but
one
very
cool
demo
that
we
saw
is
that
is
using
the
ground
as
the
main
cluster
and
then
satellites
have
a
leaf
node
connections
connected
to
the
ground
and
be
able
to
through
the
leaf
node
connections,
exchange
messages
to
each
other.
But
all
of
them
are
different.
A
So
the
rest
of
this
talk
we're
going
to
go
over
how
some
of
the
internals
of
nats.chat
application.
This
is
like
the
third
iteration
that
we
have
gone
through
this
demo
and
we're
using
some
of
the
latest
features
for
nets.
Are
you
familiar
with
some
of
the
previous
thoughts
from
nets?
Maybe
you
have
seen
the
cli
ui
that
you
can
use
to
able
to
talk
to
the
other
users
using
some
of
the
latest
features
from
nets
to
do
the
same,
but
with
websockets.
A
So
you
have
a
websocket,
a
single
page
application
that
is
gonna.
Give
you
a
ui
for
able
to
send
messages,
and
these
are
all
streams.
Each
one
of
these.
The
users
will
have
its
own
credentials,
provisioned
to
them
on
the
fly
to
able
to
publish
messages
on
one
of
the
general
rooms
and
also
have
its
own
dms
and
we're
using
the
unique
public
key
for
each
one
of
the
users
to
get
those
and
send
some
basic
hardwaring
events
for
receiving
the
messages.
A
A
What's
going
to
happen,
is
that
it's
going
to
make
a
request
through
the
websocket
connection,
to
nets
and
expecting
some
credentials
unique
credentials
to
for
this
cluster
that
are
going
to
be
couple
to
your
username
and
the
way
we
have
done?
This
is
by
creating
two
different
accounts.
So
actually
all
the
users
are
going
to
be
within
this
kubecon
account.
A
A
A
We
have
a
simple
installer
for
nse
here
and
there's
a
is
another
script
able
to
get
some
initial
setup
of
accounts.
I
have
a
directory
tree
under
your
folder,
but
we're
actually
not
using
those
accounts.
We
have
created
a
chat
account
and
an
admin
account.
In
this
case.
You
can
use
nsc
to
describe
the
permissions.
A
I
have
the
imports
and
and
have
the
experts
and
imports
to
the
other
account,
and
something
you
can
see
from
this
output
is
that
we
have
something
that
starts
with
a
it's
a
an
account,
and
in
this
case
we
have
another
signing
key
which
is
used
in
case
you
don't
want
to
be
coupled
to
on
a
single
pair
of
keys.
You
can
have
multiple
sending
keys
and
revoke
them,
as
you
want
to
be
able
in
case
one
of
them
get
leaked.
A
Then
you
revoke
that
signing
key,
remove
it
from
the
jwt
definition
and
do
the
upload
to
the
net
server,
and
that
way
you
can
purge
that
signing
key
and
we
using
nsc.
We
can
create
a
users.
In
this
case,
we
only
have
users
as
part
of
the
admin
account,
because
we
need
a
couple
of
one
to
able
to
make
those
requests,
and
mostly
for
the
ui
to
get
updates
as
well
and
the
very
simple
credentials
that
you
can
use
to
make
requests.
A
So
we
do
those
imports
and
in
the
following
the
reason
you
can
how
to
do
it
on
on
your
own,
and
once
we
have
all
that
set
up
we're
going
to
create
a
configuration
for
the
resolver.
In
this
case,
I'm
going
to
a
embedded
nut
account
server
within
nuts.
Within
within
nets
and
we're
gonna
upload,
this
configuration
to
kubernetes
so
that
all
the
net
servers
are
can
be,
can
act
as
a
decentralized
authority
of
the
jwts.
A
We
set
up
a
couple
of
nets,
let's
encrypt
certificates
and
do
the
upload
of
some
of
these
credentials
that
we're
gonna
be
using
to
be
able
to
provision
there.
The
clusters
do
the
upload
of
the
we
need
to
do
the
upload
to
fit
to
the
net
server.
What
is
the
latest
state
for
some
of
the
generalities
so
to
save
some
time?
I
I
really
have
done
some
of
these,
so
I
can
show
you
how
it
works.
A
Which
you
can,
I
can
start
match
connections
and
if
I
do
the
same
to
the
next,
the
websocket
port,
in
this
case
453,
I
will
get
a
similar
info
line,
but
not
just
for
the
websockets
and
expecting
for
me
to
send
the
credentials.
So
it's
going
to
disconnect
me
so
I'm
gonna
show
you
the
a
little
bit
of
the
code
of
the
how
we
are
issuing
the
credentials,
which
is
actually
quite
straight
forward
in
terms
of
the
nuts
api.
A
A
And
whenever
I
make
a
request
to
using
those
bootstrapping
credentials,
I'm
gonna
get
a
new
set
of
credentials
that
I
can
then
use
to
want
to
log
into
the
chat.
So
now
I'm
gonna
log
into
the
chat
hyphen
s
using
these
new
credentials,
my
credits,
so
I'm
connecting
to
the
system
and
that's
it.
So
this
part
of
the
provision
there
is
creating
the
username
generating
new
user
credentials
that
have
just
used
dynamically
to
able
to
connect
to
the
system
and
announce
the
the
revoker.
A
B
So
how
did
we
do
this?
Well,
let's
go
look
at
the
code
now
so
to
start
off,
there
is
a
nas
websocket
library
that
you
can
use
in
your
projects.
Nat's
chat
is
a
react
app.
So
that's
what
I'm
using
here.
The
imports
just
three
imports.
One
used
to
connect
the
string.
Codec
is
just
used
to
translate
between
javascript
string
and
a
javascript
uint
array,
and
then
you
have
the
credentials
authenticator.
B
B
B
And
finally,
once
we
have
our
new
full
user
creds,
we
call
connect
again,
but
this
time
with
our
real
user
creds,
and
this
will
authenticate
us
with
the
net
server.
So
then,
if
we
were
able
to
get
into
this,
then
call
that
means
we
were
able
to
authenticate
the
new
credentials
work
and
we
are.
We
can
access
the
the
real
chat
room
area
and
we're
saving
the
creds,
for
example,
here
in
local
storage,
but
you
might
be
able
to
store
them
somewhere
else.
B
Also,
I'm
using
the
like
premise,
syntax,
but
the
nats
websocket
library
fully
supports
async
in
a
way
in
case.
Anyone
was
curious
about
that.
So
that's
how
we
got
here
to
this
to
this
area.
So
now,
when
we
get
to
the
this,
the
chat
room.
What
happens
next
well?
The
very
first
thing
that
happens
is
this
is
like
when
the
page
loads,
if
you're
not
familiar
with
react
javascript.
B
Basically,
we
connect
again
so
using
the
full
credits
that
we
got
from
the
welcome
page
and
then
here's
where
we
set
up
some
streams.
While
I
had
to
mention
these
earlier
as
well,
so
we
have
a
couple
different
streams.
We
have
a
stream
of
messages
for
the
kubecon
channel.
It's
this
channel
right
here.
B
We
we
also
have
the
nets
channel
and
the
general
channel,
and
additionally,
we
have
the
online
status,
so
every
user,
when
they
log
into
the
app,
will
send
us
heartbeats
and
that's
how
we
know
who's
online.
As
you
can
see
here,
wally
qs2
is
online
and
he
sent
a
message:
yeah
cool
so
and
then.
Finally,
the
last
stream
that
we
set
up
with
the
websockets
is
the
dms
stream.
B
So
this
is
where
we
can
receive
messages,
while
you
can
send
messages
to
my
public
key
and
the
public
key
is
taken
from
the
credentials
file
that
the
netser
that
the
provisioner
gave
to
us
and
that's
where
I
can
receive
streams.
The
heartbeats
this
is
happen
here.
So
it's
just
a
simple
publish
on
an
online
topic
and
then
I'm
just
sending
people
my
info,
my
public,
key
and
stuff,
like
that.
B
The
interesting
part
when
that
wall
is
going
to
show
in
a
bit
is
how
we
handle
revoking.
Is
here
so
we're
going
to
be
connected
to
the
application
and
as
soon
as
wally
hits
the
revoke
button,
this
callback
will
be
invoked,
which
will
mean
that
we've
been
revoked.
So
when
a
user
is
revoked
from
the
system,
they
receive
a
notification
and
the
application
can
handle
that.
B
But
how
that
works
is
I
mean
pretty
much
the
same
as
we've
seen
so
far?
We
connect
using
the
credentials.
Wally
will
show
that
and
again
we
have
a
stream.
We
set
up
a
stream
to
receive
updates
for
provisioned
users.
So
that
way
the
screen
gets
populated
with
you
know
the
current
users
that
the
system
knows,
and
then
we
have
another
math
service
where
we
just
ask
the
system.
This
is
when
the
page
loads
we'll
ask
the
system.
You
know.
B
Okay,
tell
me
everyone,
you
know
about
right
now,
and
then
we
just
saved
that
data
and
yeah.
That's
that's
pretty
much
it
for
the
code.
It's
not
too
difficult.
It's
just
nothing
too
complex,
it's
just
connect
and
then
you
can
set
up
your
streams
or
you
can
do
your
services
and
that's
it.
So
I
think
wally
is
going
to
show
us
how
to
do
revoking
next
so
I'll
hand
it
back
to
him
thanks
jaime.
A
A
So
we
make
that
update
because
we're
using
the
latest
not
service
that
now
has
an
embeddedness
account
server.
We
don't
need
extra
components.
Everything
is
going
to
happen
in
the
in
the
nuts
notes
and
it's
going
to
be
share
the
latest
state
of
that
jwt
and
that's
it
for
the
demo
and
we'll
be
standing
by
this.
This
server
is
going
to
be
alive
during
the
kubecon
as
well,
so
feel
free
to
try
it
and
we'll
stand
by
for
the
q.
A
thank
you.