nats-nats
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
################################################################################
2
# Global options
3
################################################################################
4
global:
5
image:
6
# global image pull policy to use for all container images in the chart
7
# can be overridden by individual image pullPolicy
8
pullPolicy:
9
# global list of secret names to use as image pull secrets for all pod specs in the chart
10
# secrets must exist in the same namespace
11
# https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
12
pullSecretNames: []
13
# global registry to use for all container images in the chart
14
# can be overridden by individual image registry
15
registry:
16
# global labels will be applied to all resources deployed by the chart
17
labels: {}
18
################################################################################
19
# Common options
20
################################################################################
21
# override name of the chart
22
nameOverride:
23
# override full name of the chart+release
24
fullnameOverride:
25
# override the namespace that resources are installed into
26
namespaceOverride:
27
# reference a common CA Certificate or Bundle in all nats config `tls` blocks and nats-box contexts
28
# note: `tls.verify` still must be set in the appropriate nats config `tls` blocks to require mTLS
29
tlsCA:
30
enabled: false
31
# set configMapName in order to mount an existing configMap to dir
32
configMapName:
33
# set secretName in order to mount an existing secretName to dir
34
secretName:
35
# directory to mount the configMap or secret to
36
dir: /etc/nats-ca-cert
37
# key in the configMap or secret that contains the CA Certificate or Bundle
38
key: ca.crt
39
################################################################################
40
# NATS Stateful Set and associated resources
41
################################################################################
42
43
############################################################
44
# NATS config
45
############################################################
46
config:
47
cluster:
48
enabled: false
49
port: 6222
50
# must be 2 or higher when jetstream is enabled
51
replicas: 3
52
# set to false to allow cluster nodes to advertise their addresses
53
# so that clients can reconnect without extra DNS lookups.
54
# Note: in case clients have external connectivity make sure to define the `advertise` section as well.
55
# If clients are behind a load balancer it is best to leave this as is.
56
noAdvertise: true
57
# apply to generated route URLs that connect to other pods in the StatefulSet
58
routeURLs:
59
# if both user and password are set, they will be added to route URLs
60
# and the cluster authorization block
61
user:
62
password:
63
# set to true to use FQDN in route URLs
64
useFQDN: false
65
k8sClusterDomain: cluster.local
66
tls:
67
enabled: false
68
# set secretName in order to mount an existing secret to dir
69
secretName:
70
dir: /etc/nats-certs/cluster
71
cert: tls.crt
72
key: tls.key
73
# merge or patch the tls config
74
# https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
75
merge: {}
76
patch: []
77
# merge or patch the cluster config
78
# https://docs.nats.io/running-a-nats-service/configuration/clustering/cluster_config
79
merge: {}
80
patch: []
81
jetstream:
82
enabled: false
83
fileStore:
84
enabled: true
85
dir: /data
86
############################################################
87
# stateful set -> volume claim templates -> jetstream pvc
88
############################################################
89
pvc:
90
enabled: true
91
size: 10Gi
92
storageClassName:
93
# merge or patch the jetstream pvc
94
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#persistentvolumeclaim-v1-core
95
merge: {}
96
patch: []
97
# defaults to "{{ include "nats.fullname" $ }}-js"
98
name:
99
# defaults to the PVC size
100
maxSize:
101
memoryStore:
102
enabled: false
103
# ensure that container has a sufficient memory limit greater than maxSize
104
maxSize: 1Gi
105
# merge or patch the jetstream config
106
# https://docs.nats.io/running-a-nats-service/configuration#jetstream
107
merge: {}
108
patch: []
109
nats:
110
port: 4222
111
tls:
112
enabled: false
113
# set secretName in order to mount an existing secret to dir
114
secretName:
115
dir: /etc/nats-certs/nats
116
cert: tls.crt
117
key: tls.key
118
# merge or patch the tls config
119
# https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
120
merge: {}
121
patch: []
122
leafnodes:
123
enabled: false
124
port: 7422
125
tls:
126
enabled: false
127
# set secretName in order to mount an existing secret to dir
128
secretName:
129
dir: /etc/nats-certs/leafnodes
130
cert: tls.crt
131
key: tls.key
132
# merge or patch the tls config
133
# https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
134
merge: {}
135
patch: []
136
# merge or patch the leafnodes config
137
# https://docs.nats.io/running-a-nats-service/configuration/leafnodes/leafnode_conf
138
merge: {}
139
patch: []
140
websocket:
141
enabled: false
142
port: 8080
143
tls:
144
enabled: false
145
# set secretName in order to mount an existing secret to dir
146
secretName:
147
dir: /etc/nats-certs/websocket
148
cert: tls.crt
149
key: tls.key
150
# merge or patch the tls config
151
# https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
152
merge: {}
153
patch: []
154
############################################################
155
# ingress
156
############################################################
157
# service must be enabled also
158
ingress:
159
enabled: false
160
# must contain at least 1 host otherwise ingress will not be created
161
hosts: []
162
path: /
163
pathType: Exact
164
# sets to the ingress class name
165
className:
166
# set to an existing secret name to enable TLS on the ingress; applies to all hosts
167
tlsSecretName:
168
# merge or patch the ingress
169
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#ingress-v1-networking-k8s-io
170
merge: {}
171
patch: []
172
# defaults to "{{ include "nats.fullname" $ }}-ws"
173
name:
174
# merge or patch the websocket config
175
# https://docs.nats.io/running-a-nats-service/configuration/websocket/websocket_conf
176
merge: {}
177
patch: []
178
mqtt:
179
enabled: false
180
port: 1883
181
tls:
182
enabled: false
183
# set secretName in order to mount an existing secret to dir
184
secretName:
185
dir: /etc/nats-certs/mqtt
186
cert: tls.crt
187
key: tls.key
188
# merge or patch the tls config
189
# https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
190
merge: {}
191
patch: []
192
# merge or patch the mqtt config
193
# https://docs.nats.io/running-a-nats-service/configuration/mqtt/mqtt_config
194
merge: {}
195
patch: []
196
gateway:
197
enabled: false
198
port: 7222
199
tls:
200
enabled: false
201
# set secretName in order to mount an existing secret to dir
202
secretName:
203
dir: /etc/nats-certs/gateway
204
cert: tls.crt
205
key: tls.key
206
# merge or patch the tls config
207
# https://docs.nats.io/running-a-nats-service/configuration/securing_nats/tls
208
merge: {}
209
patch: []
210
# merge or patch the gateway config
211
# https://docs.nats.io/running-a-nats-service/configuration/gateways/gateway#gateway-configuration-block
212
merge: {}
213
patch: []
214
monitor:
215
enabled: true
216
port: 8222
217
tls:
218
# config.nats.tls must be enabled also
219
# when enabled, monitoring port will use HTTPS with the options from config.nats.tls
220
# if promExporter is also enabled, consider setting promExporter.monitorDomain
221
enabled: false
222
profiling:
223
enabled: false
224
port: 65432
225
resolver:
226
enabled: false
227
dir: /data/resolver
228
############################################################
229
# stateful set -> volume claim templates -> resolver pvc
230
############################################################
231
pvc:
232
enabled: true
233
size: 1Gi
234
storageClassName:
235
# merge or patch the pvc
236
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#persistentvolumeclaim-v1-core
237
merge: {}
238
patch: []
239
# defaults to "{{ include "nats.fullname" $ }}-resolver"
240
name:
241
# merge or patch the resolver
242
# https://docs.nats.io/running-a-nats-service/configuration/securing_nats/auth_intro/jwt/resolver
243
merge: {}
244
patch: []
245
# period the server waits after entering lame duck mode before starting
246
# to evict clients
247
lameDuckGracePeriod: 10s
248
# period over which the server evicts all clients after the grace period
249
# https://docs.nats.io/running-a-nats-service/nats_admin/lame_duck_mode
250
# note: podTemplate.terminationGracePeriodSeconds should be at least
251
# lameDuckGracePeriod + lameDuckDuration + 20s shutdown overhead
252
lameDuckDuration: 30s
253
# adds a prefix to the server name, which defaults to the pod name
254
# helpful for ensuring server name is unique in a super cluster
255
serverNamePrefix: ""
256
# merge or patch the nats config
257
# https://docs.nats.io/running-a-nats-service/configuration
258
# following special rules apply
259
# 1. strings that start with << and end with >> will be unquoted
260
# use this for variables and numbers with units
261
# 2. keys ending in $include will be switched to include directives
262
# keys are sorted alphabetically, use prefix before $includes to control includes ordering
263
# paths should be relative to /etc/nats-config/nats.conf
264
# example:
265
#
266
# merge:
267
# $include: ./my-config.conf
268
# zzz$include: ./my-config-last.conf
269
# server_name: nats
270
# authorization:
271
# token: << $TOKEN >>
272
# jetstream:
273
# max_memory_store: << 1GB >>
274
#
275
# will yield the config:
276
# {
277
# include ./my-config.conf;
278
# "authorization": {
279
# "token": $TOKEN
280
# },
281
# "jetstream": {
282
# "max_memory_store": 1GB
283
# },
284
# "server_name": "nats",
285
# include ./my-config-last.conf;
286
# }
287
merge: {}
288
patch: []
289
############################################################
290
# stateful set -> pod template -> nats container
291
############################################################
292
container:
293
image:
294
repository: chainguard-private/nats
295
tag: 2.14.6
296
pullPolicy:
297
registry: cgr.dev
298
# if digest is provided, it overrides tag (example: "sha256:abcdef1234567890")
299
digest: sha256:0aa61ef7920aec1151f71c55c98d38b285bada881e0be227beb47df88ddffb8e
300
# if fullImageName is provided, it overrides registry, repository, tag, and digest
301
fullImageName:
302
# container port options
303
# must be enabled in the config section also
304
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#containerport-v1-core
305
ports:
306
nats: {}
307
leafnodes: {}
308
websocket: {}
309
mqtt: {}
310
cluster: {}
311
gateway: {}
312
monitor: {}
313
profiling: {}
314
# map with key as env var name, value can be string or map
315
# example:
316
#
317
# env:
318
# GOMEMLIMIT: 7GiB
319
# TOKEN:
320
# valueFrom:
321
# secretKeyRef:
322
# name: nats-auth
323
# key: token
324
env: {}
325
# probes are only applied when config.monitor is enabled
326
# scheme is set to HTTPS automatically when config.monitor.tls is enabled
327
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#probe-v1-core
328
startupProbe:
329
httpGet:
330
path: /healthz
331
port: monitor
332
initialDelaySeconds: 10
333
timeoutSeconds: 5
334
periodSeconds: 10
335
successThreshold: 1
336
failureThreshold: 90
337
readinessProbe:
338
httpGet:
339
path: /healthz?js-server-only=true
340
port: monitor
341
initialDelaySeconds: 10
342
timeoutSeconds: 5
343
periodSeconds: 10
344
successThreshold: 1
345
failureThreshold: 3
346
livenessProbe:
347
httpGet:
348
path: /healthz?js-enabled-only=true
349
port: monitor
350
initialDelaySeconds: 10
351
timeoutSeconds: 5
352
periodSeconds: 30
353
successThreshold: 1
354
failureThreshold: 3
355
# merge or patch the container
356
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
357
merge: {}
358
patch: []
359
# container resources
360
resources: {}
361
# requests:
362
# cpu: 100m
363
# memory: 128Mi
364
# limits:
365
# cpu: 100m
366
# memory: 128Mi
367
############################################################
368
# stateful set -> pod template -> reloader container
369
############################################################
370
reloader:
371
enabled: true
372
image:
373
repository: chainguard-private/nats-server-config-reloader
374
tag: 0.24.0
375
pullPolicy:
376
registry: cgr.dev
377
digest: sha256:b4323535761ce07548bcc87b749eb4f5f22713a69d088e8abdbb48eb09dd2949
378
fullImageName:
379
# env var map, see nats.env for an example
380
env: {}
381
# all nats container volume mounts with the following prefixes
382
# will be mounted into the reloader container
383
natsVolumeMountPrefixes:
384
- /etc/
385
# merge or patch the container
386
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
387
merge: {}
388
patch: []
389
############################################################
390
# stateful set -> pod template -> prom-exporter container
391
############################################################
392
# config.monitor must be enabled
393
promExporter:
394
enabled: false
395
image:
396
repository: chainguard-private/prometheus-nats-exporter
397
tag: 0.20.2
398
pullPolicy:
399
registry: cgr.dev
400
digest: sha256:c554ea9123576f945f6e07ec85cb594c76542d80aea4a10b5d6c194b79d1f4d0
401
fullImageName:
402
port: 7777
403
# if config.monitor.tls.enabled is set to true, monitorDomain must be set to the common name
404
# or a SAN used in the tls certificate
405
monitorDomain: localhost
406
# env var map, see nats.env for an example
407
env: {}
408
# merge or patch the container
409
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
410
merge: {}
411
patch: []
412
############################################################
413
# prometheus pod monitor
414
############################################################
415
podMonitor:
416
enabled: false
417
# merge or patch the pod monitor
418
# https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.PodMonitor
419
merge: {}
420
patch: []
421
# defaults to "{{ include "nats.fullname" $ }}"
422
name:
423
############################################################
424
# service
425
############################################################
426
service:
427
enabled: true
428
# service port options
429
# additional boolean field enable to control whether port is exposed in the service
430
# must be enabled in the config section also
431
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#serviceport-v1-core
432
ports:
433
nats:
434
enabled: true
435
leafnodes:
436
enabled: true
437
websocket:
438
enabled: true
439
mqtt:
440
enabled: true
441
cluster:
442
enabled: false
443
gateway:
444
enabled: false
445
monitor:
446
enabled: false
447
profiling:
448
enabled: false
449
# merge or patch the service
450
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
451
merge: {}
452
patch: []
453
# defaults to "{{ include "nats.fullname" $ }}"
454
name:
455
############################################################
456
# other nats extension points
457
############################################################
458
459
# stateful set
460
statefulSet:
461
# merge or patch the stateful set
462
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#statefulset-v1-apps
463
merge: {}
464
patch: []
465
# defaults to "{{ include "nats.fullname" $ }}"
466
name:
467
# stateful set -> pod template
468
podTemplate:
469
# adds a hash of the ConfigMap as a pod annotation
470
# this will cause the StatefulSet to roll when the ConfigMap is updated
471
# set to true to force pod rollouts on config changes instead of using the reloader for hot updates
472
configChecksumAnnotation: false
473
# how long to wait for graceful shutdown
474
# should be at least config.lameDuckGracePeriod + config.lameDuckDuration
475
# + 20s shutdown overhead
476
terminationGracePeriodSeconds: 60
477
# map of topologyKey: topologySpreadConstraint
478
# labelSelector will be added to match StatefulSet pods
479
#
480
# topologySpreadConstraints:
481
# kubernetes.io/hostname:
482
# maxSkew: 1
483
#
484
topologySpreadConstraints: {}
485
# merge or patch the pod template
486
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#pod-v1-core
487
merge: {}
488
patch: []
489
# headless service
490
headlessService:
491
# merge or patch the headless service
492
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#service-v1-core
493
merge: {}
494
patch: []
495
# defaults to "{{ include "nats.fullname" $ }}-headless"
496
name:
497
# config map
498
configMap:
499
# merge or patch the config map
500
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#configmap-v1-core
501
merge: {}
502
patch: []
503
# defaults to "{{ include "nats.fullname" $ }}-config"
504
name:
505
# pod disruption budget
506
podDisruptionBudget:
507
enabled: true
508
# merge or patch the pod disruption budget
509
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#poddisruptionbudget-v1-policy
510
merge: {}
511
patch: []
512
# defaults to "{{ include "nats.fullname" $ }}"
513
name:
514
# service account
515
serviceAccount:
516
enabled: false
517
# merge or patch the service account
518
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#serviceaccount-v1-core
519
merge: {}
520
patch: []
521
# defaults to "{{ include "nats.fullname" $ }}"
522
name:
523
############################################################
524
# natsBox
525
#
526
# NATS Box Deployment and associated resources
527
############################################################
528
natsBox:
529
enabled: true
530
############################################################
531
# NATS contexts
532
############################################################
533
contexts:
534
default:
535
creds:
536
# set contents in order to create a secret with the creds file contents
537
contents:
538
# set secretName in order to mount an existing secret to dir
539
secretName:
540
# defaults to /etc/nats-creds/<context-name>
541
dir:
542
key: nats.creds
543
nkey:
544
# set contents in order to create a secret with the nkey file contents
545
contents:
546
# set secretName in order to mount an existing secret to dir
547
secretName:
548
# defaults to /etc/nats-nkeys/<context-name>
549
dir:
550
key: nats.nk
551
# used to connect with client certificates
552
tls:
553
# set secretName in order to mount an existing secret to dir
554
secretName:
555
# defaults to /etc/nats-certs/<context-name>
556
dir:
557
cert: tls.crt
558
key: tls.key
559
# merge or patch the context
560
# https://docs.nats.io/using-nats/nats-tools/nats_cli#nats-contexts
561
merge: {}
562
patch: []
563
# name of context to select by default
564
defaultContextName: default
565
############################################################
566
# deployment -> pod template -> nats-box container
567
############################################################
568
container:
569
image:
570
repository: chainguard-private/nats-box
571
tag: 0.19.7
572
pullPolicy:
573
registry: cgr.dev
574
digest: sha256:28e34cb49ef1282d8c2893c700ad6780f651ec411e859fed8cdd5faf21f52926
575
fullImageName:
576
resources: {}
577
# env var map, see nats.env for an example
578
env: {}
579
# merge or patch the container
580
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#container-v1-core
581
merge: {}
582
patch: []
583
############################################################
584
# other nats-box extension points
585
############################################################
586
587
# deployment
588
deployment:
589
# merge or patch the deployment
590
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#deployment-v1-apps
591
merge: {}
592
patch: []
593
# defaults to "{{ include "nats.fullname" $ }}-box"
594
name:
595
# deployment -> pod template
596
podTemplate:
597
# merge or patch the pod template
598
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#pod-v1-core
599
merge: {}
600
patch: []
601
# contexts secret
602
contextsSecret:
603
# merge or patch the context secret
604
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#secret-v1-core
605
merge: {}
606
patch: []
607
# defaults to "{{ include "nats.fullname" $ }}-box-contexts"
608
name:
609
# contents secret
610
contentsSecret:
611
# merge or patch the contents secret
612
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#secret-v1-core
613
merge: {}
614
patch: []
615
# defaults to "{{ include "nats.fullname" $ }}-box-contents"
616
name:
617
# service account
618
serviceAccount:
619
enabled: false
620
# merge or patch the service account
621
# https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#serviceaccount-v1-core
622
merge: {}
623
patch: []
624
# defaults to "{{ include "nats.fullname" $ }}-box"
625
name:
626
################################################################################
627
# Extra user-defined resources
628
################################################################################
629
#
630
# add arbitrary user-generated resources
631
# example:
632
#
633
# config:
634
# websocket:
635
# enabled: true
636
# extraResources:
637
# - apiVersion: networking.istio.io/v1beta1
638
# kind: VirtualService
639
# metadata:
640
# name:
641
# $tplYaml: >
642
# {{ include "nats.fullname" $ | quote }}
643
# labels:
644
# $tplYaml: |
645
# {{ include "nats.labels" $ }}
646
# spec:
647
# hosts:
648
# - demo.nats.io
649
# gateways:
650
# - my-gateway
651
# http:
652
# - name: default
653
# match:
654
# - name: root
655
# uri:
656
# exact: /
657
# route:
658
# - destination:
659
# host:
660
# $tplYaml: >
661
# {{ .Values.service.name | quote }}
662
# port:
663
# number:
664
# $tplYaml: >
665
# {{ .Values.config.websocket.port }}
666
#
667
extraResources: []
668
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.