kubeless trigger nats publish needs direct access

[sebgoa]

seems we don't use a proxy to get to the nats broker.

So if we run in the cloud, we need to open the broker to the world to be able to reach it with the convenience function kubeless trigger nats publish

I would rather do a proxy under the hood to avoid this security hole.

[murali-reddy]

kubeless trigger nats publish just takes URL for NATS cluster, there is no assumption on where NATS service is running (in-cluster or outside cluster).

I can keep the default behaviour is to assume the NATS is running as nats.nats-io.svc.cluster.local:4222 and proxy to it. --url can be specified explicilty to override the default behaviour.

[sebgoa]

I believe that realistically, nats admin would not open the broker without any type of auth/security.

So sine we use the kubeless cli has a convenience for testing/debugging, proxying is an ok mechanism

[xydinesh]

I think issue I'm running into related to this. I have a nats cluster name "nats" in "nats-io" namespace. I can't reach it via following command.

kubeless trigger nats publish --url nats://nats.nats-io.svc.cluster.local:4222 --topic test --message "Hello World"

FATA[0000] nats: no servers available for connection

I think, kubeless function deployed in the cluster can access the nats cluster. Not sure why I'm getting an error.

[andresmgot]

hi @xydinesh, the url nats.nats-io.svc.cluster.local is internal for the cluster so you cannot access it from the outside with that.

That command kubeless trigger nats publish is used mostly for testing purposes in our side. If you want to use that command, you can expose the nats service (kubectl edit svc -n nats nats) and change the type of service to a NodePort. That way you will be able to reach the cluster with CLUSTER_IP:NODE_PORT as the URL. Note that doing that will leave your cluster exposed to anyone without authentication which is discouraged for anything other than testing.

[xydinesh]

@andresmgot Got it. Thanks ! Didn't realize kubeless trigger nats publish trying to access nats.nats-io.svc.cluster.local.

[mpalumbo7]

FWIW, I was able to use kubectl port-forward to bind the NATS port to my localhost.

$ kubectl -n kubeless port-forward svc/nats 4222:4222
Forwarding from 127.0.0.1:4222 -> 4222
Forwarding from [::1]:4222 -> 4222
Handling connection for 4222

Which allows me to use:

$ kubeless trigger nats publish --url nats://localhost:4222 --topic hello-world --message "Hello World!"
INFO[0000] Published [hello-world] : 'Hello World!'