jetstream-controller-fips

packaged by Chainguard

Chainguard Container for jetstream-controller-fips

Reconciles NATS JetStream Stream, Consumer, Account, KeyValue and ObjectStore CRDs against a NATS server.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/jetstream-controller-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

FIPS Support

This is the FIPS variant of the jetstream-controller image. The jetstream-controller binary is compiled with Chainguard's Go FIPS toolchain, which routes the Go standard-library crypto (used for TLS connections to the NATS server) through a FIPS-validated OpenSSL module. FIPS images require a Chainguard FIPS subscription.

Compatibility Notes

This image is a drop-in replacement for the upstream natsio/jetstream-controller image. It ships the same jetstream-controller binary and entrypoint, so switching to the Chainguard image should not require changes to your existing Kubernetes manifests or Helm values.

Unlike the upstream image, this one runs as a non-root user (UID 65532). On startup the controller creates a temporary cache directory in its working directory, so it needs that directory to be writable. The nack Helm chart already handles this — it mounts a writable volume at /nack and sets it as the working directory — so chart-based deployments require no changes. If you run the image with a hand-written Pod/Deployment instead, mount a writable volume (for example an emptyDir) and point the container's workingDir at it.

Getting Started

Deployment is identical to the standard variant, using the NATS nack Helm Chart with the image overridden:

jetstream:
  enabled: true
  image:
    repository: cgr.dev/ORGANIZATION/jetstream-controller-fips
    tag: latest
  nats:
    url: nats://nats.default.svc:4222

helm repo add nats https://nats-io.github.io/k8s/helm/charts/
helm install nack nats/nack -f values.yaml --namespace default

Once running, the controller reconciles JetStream custom resources. For example, applying a Stream creates the corresponding stream on the NATS server:

apiVersion: jetstream.nats.io/v1beta2
kind: Stream
metadata:
  name: orders
spec:
  name: ORDERS
  subjects: ["orders.>"]
  storage: file
  replicas: 1

Once applied, wait for the controller to reconcile the resource, then confirm the stream exists on the NATS server:

# The controller sets the Ready condition after creating the stream on NATS.
kubectl wait --for=condition=Ready stream/orders --timeout=60s

# Inspect the stream directly on the server with the nats CLI.
kubectl run natsbox --rm -it --restart=Never \
  --image=cgr.dev/ORGANIZATION/nats-box:latest --command -- \
  nats --server nats://nats.default.svc:4222 stream info ORDERS

Next, bind a Consumer to the stream so messages can be delivered:

apiVersion: jetstream.nats.io/v1beta2
kind: Consumer
metadata:
  name: orders-pull
spec:
  streamName: ORDERS
  durableName: orders-pull
  deliverPolicy: all
  ackPolicy: explicit

Finally, publish a message to the stream's subject and pull it back through the consumer to confirm end-to-end delivery:

kubectl run natsbox --rm -it --restart=Never \
  --image=cgr.dev/ORGANIZATION/nats-box:latest --command -- sh -c '
    nats --server nats://nats.default.svc:4222 pub orders.received "order 1"
    nats --server nats://nats.default.svc:4222 consumer next ORDERS orders-pull --count 1
  '

For push-based delivery, create a Consumer with a deliverSubject (kept outside the stream's own subjects to avoid a delivery loop) and subscribe to it — the server pushes matching messages to that subject:

apiVersion: jetstream.nats.io/v1beta2
kind: Consumer
metadata:
  name: orders-push
spec:
  streamName: ORDERS
  durableName: orders-push
  deliverSubject: push.orders
  filterSubject: orders.pushed
  deliverPolicy: all
  ackPolicy: none

kubectl run natsbox --rm -it --restart=Never \
  --image=cgr.dev/ORGANIZATION/nats-box:latest --command -- \
  nats --server nats://nats.default.svc:4222 sub push.orders

See the nack "Creating NATS resources" guide and the NATS JetStream documentation for more examples (accounts, key-value, and object stores).

Documentation and Resources

• NACK (NATS Controllers for Kubernetes) repository
• NATS JetStream documentation
• nack Helm Chart

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.