---
apiVersion: nats.io/v1alpha2
kind: NatsCluster
metadata:
  name: example-nats-cluster
spec:
  size: 3
  version: "2.1.7"
  pod:
    volumeMounts:
    - name: user-credentials
      mountPath: /etc/nats-creds
      readOnly: true
  leafnodeConfig:
    remotes:
    - url: nats://1.2.3.4:7422
      credentials: /etc/nats-creds/user.ncreds
  template:
    spec:
      volumes:
      - name: user-credentials
        secret:
          secretName: user-credentials

---
apiVersion: "nats.io/v1alpha2"
kind: "NatsCluster"
metadata:
  name: "tls-nats"
spec:
  # Number of nodes in the cluster
  size: 3

  tls:
    # Certificates to secure the NATS client connections
    serverSecret: "nats-server-tls"

    # Name of the CA in serverSecret
    serverSecretCAFileName: "ca.crt"

    # Name of the key in serverSecret
    serverSecretKeyFileName: "tls.key"

    # Name of the certificate in serverSecret
    serverSecretCertFileName: "tls.crt"

    cipherSuites:
      - TLS_...

    curvePreferences:
      - example...

---
apiVersion: "nats.io/v1alpha2"
kind: "NatsCluster"
metadata:
  name: "nats-super-cluster"

spec:
  size: 3
  version: "edge-v2.0.0-RC12"
  serverImage: "synadia/nats-server"

  natsConfig:
    debug: true
    trace: true

  tls:
    # TLS timeout for client connections
    clientsTLSTimeout: 5

    # TLS timeout for gateway connections
    gatewaysTLSTimeout: 5

    # Certificates to secure the NATS client connections:
    serverSecret: "nats-server-tls"
    serverSecretCAFileName: "ca.crt"
    serverSecretKeyFileName: "tls.key"
    serverSecretCertFileName: "tls.crt"

    # Certificates to secure the routes.
    gatewaySecret: "nats-gateways-tls"
    gatewaySecretCAFileName: "ca.crt"
    gatewaySecretKeyFileName: "tls.key"
    gatewaySecretCertFileName: "tls.crt"

    # Certificates to secure the leafnode.
    leafnodeSecret: "nats-leafnodes-tls"
    leafnodeSecretCAFileName: "ca.crt"
    leafnodeSecretKeyFileName: "tls.key"
    leafnodeSecretCertFileName: "tls.crt"

  pod:
    enableClientsHostPort: true
    advertiseExternalIP: true

  gatewayConfig:
    name: example
    hostPort: 32328

    gateways:
    - name: example
      url: nats://example.com:32328

  leafnodeConfig:
    hostPort: 4224

  operatorConfig:
    secret: operator-jwt
    systemAccount: "AASYS..."
    resolver: URL(https://example.com/jwt/v1/accounts/)

  template:
    spec:
      # Required to be able to lookup public ip address from a server.
      serviceAccountName: "nats-server"

apiVersion: "nats.io/v1alpha2"
kind: "NatsCluster"
metadata:
  name: nats-auth-file-example
  namespace: default
spec:
  size: 1
  version: "1.4.1"

  natsConfig:
    maxPayload: 20971520

  pod:
    enableConfigReload: true

    volumeMounts:
      - name: authconfig
        mountPath: /etc/nats-config/authconfig

  auth:
    # Needs to be under /etc/nats-config where nats looks
    # for its config file, or it won't be able to be included
    # by /etc/nats-config/gnatsd.conf
    clientsAuthFile: "authconfig/auth.json"

  template:
    spec:
      initContainers:
        - name: secret-getter
          image: "busybox"
          command: ["sh", "-c", "echo 'users = [ { user: 'foo', pass: 'bar' } ]' > /etc/nats-config/authconfig/auth.json"]
          volumeMounts:
            - name: authconfig
              mountPath: /etc/nats-config/authconfig
      volumes:
        - name: authconfig
          emptyDir: {}

apiVersion: "nats.io/v1alpha2"
kind: "NatsCluster"
metadata:
  name: "nats"
spec:
  size: 3
  serverImage: "nats"
  version: "1.4.1"

  tls:
    verify: true
    serverSecret: "nats-certs"