Phase 5 — authority and channel-auth API sketch¶

Planning document for MKurator Phase 5 (ROADMAP.md). It maps reference MQSC from ibm-messaging/mq-gitops-samples qmdemo-mqsc-config-map.yaml (mirrored in test/e2e/fixtures/channel-auth-prereq.mqsc) and patterns in IBM_MQ_OBJECTS.md to CRD fields.

Already shipped (Phase 4): the Channel CRD reconciles DEFINE CHANNEL … CHLTYPE(SVRCONN) with drift detection. See INSTALL_AND_USE.md and ATTRIBUTE_RECONCILIATION.md.

Shipped on main (Phase 5):

ChannelAuthRule — SET CHLAUTH with ACTION(REPLACE) / ACTION(REMOVE) on delete
AuthorityRecord — SET AUTHREC with AUTHADD / AUTHRMV(ALL) on delete
Samples: config/samples/ · integration tests in test/integration/mq/

Remaining: optional integration breadth for additional AUTHREC profiles, CI proof on release tag, and roadmap items outside Phase 5 — see ROADMAP.md.

MKurator reconciles Phase 5 objects via the existing mqweb /mqsc path (ADR-0002), not via IBM’s ConfigMap-at- QueueManager bootstrap model.

Reference MQSC (gitops basic deployment)¶

Source: IBM mq-gitops-samples (Apache-2.0 header in upstream file). MKurator e2e fixture: test/e2e/fixtures/channel-auth-prereq.mqsc.

DEFINE CHANNEL('DEV.APP.SVRCONN.0TLS') CHLTYPE(SVRCONN) TRPTYPE(TCP) +
  MCAUSER('app') SSLCIPH('') SSLCAUTH(OPTIONAL) REPLACE

SET CHLAUTH('DEV.APP.SVRCONN.0TLS') TYPE(ADDRESSMAP) ADDRESS('*') +
  USERSRC(CHANNEL) CHCKCLNT(REQUIRED) +
  DESCR('Allows connection via APP channel') ACTION(REPLACE)

The DEFINE CHANNEL portion is covered by the shipped Channel CRD. The SET CHLAUTH portion is covered by ChannelAuthRule.

Shipped resources¶

`ChannelAuthRule` (CHLAUTH)¶

CRD field	MQSC	Maps from gitops example
`spec.connectionRef`	—
`spec.channelName`	channel name in `SET CHLAUTH('…')`	`DEV.APP.SVRCONN.0TLS`
`spec.ruleType`	`TYPE`	`ADDRESSMAP`
`spec.address`	`ADDRESS`	`*`
`spec.userSource`	`USERSRC`	`CHANNEL`
`spec.checkClient`	`CHCKCLNT`	`REQUIRED`
`spec.description`	`DESCR`

Reconcile: SET CHLAUTH(...) ACTION(REPLACE); delete: SET CHLAUTH(...) ACTION(REMOVE).

Samples and CI today: ADDRESSMAP, BLOCKUSER, and BLOCKADDR in config/Helm default samples; all six ruleType values exercised in Docker integration GET/delete and kind e2e (see README.md#what-ci-proves).

`ruleType`	Typical use	MKurator today
`ADDRESSMAP`	Map client address to user source	Shipped — `spec.address`, `userSource`, `checkClient`; samples + tests
`BLOCKUSER`	`USERLIST` — deny privileged IDs	Shipped — `spec.userList`; samples + tests
`USERMAP`	Map `CLNTUSER` to `MCAUSER`	Shipped — `spec.clientUser`, `userSource`, `mcaUser`; integration + kind e2e
`SSLPEERMAP`	Map TLS DN	Shipped — `spec.sslPeerName`, `userSource`, `mcaUser`; integration + kind e2e
`QMGRMAP`	Map remote QM name	Shipped — `spec.remoteQueueManager`, `userSource`, `mcaUser`; integration + kind e2e
`BLOCKADDR`	Block IPs at listener	Shipped — `spec.address` (`ADDRLIST` on SET); default sample + integration + kind e2e

`AuthorityRecord` (OAM — `SET AUTHREC`)¶

CRD field	MQSC
`spec.connectionRef`	—
`spec.profile`	`PROFILE('…')` queue or channel name
`spec.objectType`	`OBJTYPE` — `QUEUE`, `CHANNEL`, …
`spec.principal` / `spec.group`	`PRINCIPAL` / `GROUP`
`spec.authorities`	`AUTHADD` list — `GET`, `PUT`, `CONNECT`, …

Reconcile: SET AUTHREC ... AUTHADD(...) ACTION(REPLACE); delete: SET AUTHREC ... AUTHRMV(ALL).

`MQAdmin` port (shipped)¶

SetChannelAuth(ctx context.Context, spec ChannelAuthSpec) error
DeleteChannelAuth(ctx context.Context, spec ChannelAuthSpec) error
SetAuthority(ctx context.Context, spec AuthoritySpec) error
DeleteAuthority(ctx context.Context, spec AuthoritySpec) error

Adapter implementation: internal/adapter/mqrest/auth.go via RunMQSC / runCommand.

GET paths (shipped): GetChannelAuth and GetAuthority run DISPLAY CHLAUTH / DISPLAY AUTHREC. Reconcilers replace-on-diff when observed state differs from spec (unless messaging.mkurator.dev/drift-policy=observe-only). Parsed CHLAUTH fields: address / addrlist, userlist, clntuser, sslpeer, qmname, mcauser, usersrc, chckclnt, descr (rule-type-specific; see ATTRIBUTE_RECONCILIATION.md#channelauthrule--chlauth-get). Observe-only behaviour: ATTRIBUTE_RECONCILIATION.md#observe-only-drift-policy.

What we are not copying from IBM samples¶

IBM pattern	MKurator approach
`spec.queueManager.mqsc` ConfigMap on `QueueManager`	Per-object CRs + continuous reconcile
Dynamic MQSC volume reload (gitops `queue-manager-deployment`)	Operator observes CR spec generation
IBM MQ Operator webhook / OLM install	Out of scope — MKurator targets existing mqweb

E2e and fixtures¶

Channel/auth MQSC used to validate mqweb lives under test/e2e/fixtures/. Queue/Topic/Channel/auth reconcile e2e is in test/e2e/mq_e2e_test.go. Remaining Phase 5 items are tracked in ROADMAP.md.