Bug 58357 - NATS passwords cannot start with a number
Summary: NATS passwords cannot start with a number
Status: RESOLVED WONTFIX
Alias: None
Product: Nubus
Classification: Unclassified
Component: Provisioning
Version: unspecified
Hardware: Other Mac OS X 10.1
: P5 normal
Target Milestone: ---
Assignee: Nubus maintainers
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-05-28 19:20 CEST by Thomas Kintscher
Modified: 2025-05-28 19:21 CEST (History)
0 users

See Also:
What kind of report is it?: Bug Report
What type of bug is this?: 2: Improvement: Would be a product improvement
Who will be affected by this bug?: 5: Will affect all installed domains
How will those affected feel about the bug?: 1: Nuisance – not a big deal but noticeable
User Pain: 0.057
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Kintscher univentionstaff 2025-05-28 19:20:14 CEST
Passwords used for communication with the NATS backend, i.e. the passwords of the Provisioning consumers, must not start with a number.

Otherwise NATS will fail to parse its configuration file correctly.
Comment 1 Thomas Kintscher univentionstaff 2025-05-28 19:20:27 CEST
We are aware of the limitation and have documented this in the manual:
https://docs.software-univention.de/nubus-kubernetes-operation/1.x/en/configuration/nats.html#configure-the-secrets

> All NATS password strings must start with a character: [a-zA-Z].


A(n incomplete) selection of upstream issues of the same kind:

- nats-io/nats-server#5189
- nats-io/nats-server#3431
- nats-io/nats-server#885
- nats-io/nats-server#6891

It was evaluated if this can be fixed, but we decided that any attempt at fixing this would make the situation worse.

We need to load the password from environment variables.
If we put password = "$PW" into the NATS config, it will get expanded to password = "$PW" (literally).
If we put password = $PW into the NATS config, it will get expanded to e.g. password = 123abc, which triggers the problem.

One would have to ensure that the quotes are present inside the environment variable, e.g. $PW = "123abc".
Now the problem is that you cannot use K8s secrets anymore, unless the operator sticks the " inside the secret, which is really inconvenient.

Therefore the decision was made to document the limitation, until it is fixed upstream.