The NATS Server can make good use of TLS for securing various connections, including some modes where NATS servers talk directly to each other. When you configure the server to verify the certificate of a peer, you provide a path to a Certificate Authority bundle file, to act as a trust anchor. So far, so normal.

In environments such as Kubernetes, it’s common for a certificate management process to create a Kubernetes secret, containing a key, a certificate, and a copy of the issuer’s certificate as ca.pem. So far, so normal.

Overview

At Synadia we have the goal of unifying all cloud, edge, and IoT communications. We guide companies in their journey from where they are today toward efficiently operating a secure and resilient modern distributed communications system and leverage the NATS.io project to get them there. Derek Collison, creator of NATS, founded Synadia which stewards the NATS project.

We see users deploy NATS in ways that fit into a few buckets - a single cluster k8s deployment, a cluster of NATS servers in the cloud, on VMs, or on bare metal. As companies grow we see many multi-regional deployments spread out geographically, in data centers, across cloud providers or more often now with hybrid deployments.

On April 16th, 2020 we had our first NATS conference, NATS Connect!. It was virtual of course as we are living in some interesting times, however the NATS ecosystem continues to amaze us and the conference exceeded all of our expectations. There will always be things we can improve, and we encourage your feedback, but for our first go we were pleasantly surprised!

NATS has transformed itself in the last three years. It has gone from a simple, but rock solid and performant, messaging technology to a true connective technology useful for advanced modern distributed systems that extend beyond a single datacenter or cloud region. NATS has evolved to provide advanced security, true multi-tenancy, and the ability to construct any network topology to suit one’s needs. It also allows a NATS system to be shared, within an organization or at a global scale, and still be easily extended by users and account owners who can run their own servers and define their own security. Meaning you can have both a shared utility SaaS model with multi-tenancy and folks who still want to run their own NATS servers.

Appsecco is a security-focused company out of London specializing in Application and Data Security for cloud-based companies. At almost 4-years-old, Appsecco has clients ranging from major global financial institutions and professional services firms to leading international retailers and retail brands and from large scale, heavy engineering companies to cutting edge technology companies across the globe.

Why Appsecco Chose NATS

Appsecco is working on security workflow automation to deliver improved and effective application security services to their clients. Due to the nature of the problem, we modeled workflows in terms of independent units (security tools) packaged as docker containers running on Kubernetes. To orchestrate the various units required for a workflow, we required a messaging service that is lightweight yet flexible enough to support primitives like consumer groups, wild card subscriptions, failure resiliency, low latency, and high throughput.

Once again, Dale Bingham of Cingulara adds to his series on using NATS for a service mesh type of implementations in your applications by contributing his thoughts on load balancing on APIs and services when you have more than one service answering requests or responding to events.

Read the full article Using NATS to Implement Service Mesh Functionality Part 4: Load Balancing and Routing Control .

More About the Author

Dale Bingham is the CTO of Cingulara. Software Geek by trade. Father of three daughters. Husband. Lover of newer tech where it fits. Follow at https://www.cingulara.com/ @cingulara

In this, the 3rd part of Dale Bingham’s series on “Using NATS to Implement Service Mesh Functionality”, Dale speaks about how to have similar service mesh benefits, usage and design when using the NATS messaging system as your communication backbone. As with anything dealing with software engineering, there are pros and cons to deciding on languages, infrastructure, and design models. It is always great to have alternatives and new ways of looking to solve problems.

Our team is always working to bring you features to improve your NATS experience. Take a look at the following features in the latest releases of NATS Server and a sneak peek into JetStream!

Response Only Permissions

NATS Server v2.0.4

For services, the authorization for responding to requests usually included wildcards for _INBOX.> and possibly $GR.> with a supercluster for sending responses. What we really wanted was the ability to allow a service responder to only respond to the reply subject it was sent. We have now implemented this and it’s in the current release. See PR - https://github.com/nats-io/nats-server/pull/1081

Dale Bingham of Cingulara is back with part 2 of his article about using NATS to implement Service Mesh functionality. This time, Dale takes on Security. In this post, Dale dives into the introduction of NKeys, JWTs, and the Operator — Account — Users security model. Comparing and contrasting the NATS model with the security model of mainstream service meshes. Read the full article Using NATS To Implement Service Mesh, Part 2: Security .

Can you use the power and simplicity of NATS to create a service mesh without all the heavy overhead and complexity of current service meshes?

Dale Bingham thinks so. Read about how he uses his experience and some of the new features of NATS 2.0 to do just that in part 1 of this 4 part series. Using NATS to Implement Service Mesh Functionality, Part 1: Service Discovery

More About the Author

Dale Bingham is the CTO of Cingulara. Software Geek by trade. Father of three daughters. Husband. Lover of newer tech where it fits. Follow at https://www.cingulara.com/ @cingulara

Often times, blogs or articles with titles like this one will contain bad news. That isn’t the case here! We’re sharing the results of our security review, and how that bolsters our new security features in the upcoming NATS server 2.0 release, expected in Q2 2019.

Security Audit

In November of last year, the CNCF sponsored Cure53 to perform a security audit of the NATS server and some of the more popular NATS clients. We setup a secure server for Cure53 to attack and they analyzed our source code.