Proper way to configure Leaf Nodes to only export some subjects

[humphd]

I'm trying to connect a bunch of nats instances in our cluster back to a global nats using Leaf Nodes. However, I only want to send a subset of messages (e.g., define a single pattern to sync, ignore the rest) going to the leaf node instances back to the global nats.

In the docs I see mention of deny_exports and deny_imports, but I can't really find any examples of people using this how I intend. My goal would be to do something where I default to exclude everything, then add an exception for one pattern.

Is this possible? If not, are there better ways to achieve this approach?

[derekcollison]

Soliciting leafnodes should provide authentication information for when they connect to the hub. Just put permissions on that user from the hub side the restricts what that user (the one that was used to form the leafnode connection) can and can not do.

[humphd]

@derekcollison fantastic, this is working for me. I appreciate you taking the time to help me with this.

[Hitesh-Agrawal]

@derekcollison @humphd
This doesn't seem to work for me.
I have following in my nats hub ( relevant config from my nats config file from both nats hub and nats leaf)

NATS HUB CONFIG FILE BELOW

`leafnodes {
listen: 0.0.0.0:7422
authorization {
user: "leafuser"
password: "test"
}
}

authorization: {
users = [
{
user: default_user
permissions: {
publish: ">"
subscribe: ">"
}
}
{
user: leafuser
password: "test"
permissions: {
publish: {
deny: ">"
},
subscribe: {
allow: ">"
}
}
}
]
}

no_auth_user: default_user
`

======================

On the leaf node I have following

NATS LEAF CONFIG FILE BELOW

`leafnodes {
remotes = [
{
urls: [
"nats-leaf://leafuser:[email protected]:7422",
]
},
]
}

`

Now when I publish something on the leaf node using

./nats pub cli.demo "hello from leaf node" --server nats://nats-leaf.test.local

I still see it on the nats hub

./nats sub cli.demo --server nats://nats-hub.test.local
04:30:37 Subscribing on cli.demo

[#1] Received on "cli.demo"
hello from leaf node

Shouldn't this be denied on the hub with a config of
{ user: leafuser password: "test" permissions: { publish: { deny: ">" }, subscribe: { allow: ">" } } }