Skip to content

AuthorityRecord

AuthorityRecord manages a single object authority record (AUTHREC) on an existing IBM MQ queue manager. Each record maps to one SET AUTHREC MQSC command that grants a principal or group a set of authorities over a named object profile (a queue, channel, topic, or the queue manager itself). The operator reconciles the desired grant through mqweb and reports drift via status conditions; it does not create the queue manager or the object the record authorises.

  • API group/version: messaging.mkurator.dev/v1beta1 (also served as v1alpha1 via the conversion webhook — see Custom resources).
  • Short name: auth (kubectl get auth).
  • Scope: namespaced; spec.connectionRef resolves in the same namespace (ADR-0023).

Like ChannelAuthRule, the auth kinds expose their MQSC parameters as typed fields only — there is no free-form spec.attributes map.

Identity: profile, object type, and grantee

An authority record is keyed by three things:

  • spec.profile — the object (or generic profile) the grant applies to, e.g. a queue name APP.ORDERS. Maps to PROFILE('…'). Names with the SYSTEM. or AMQ prefix are reserved and rejected by admission validation.
  • spec.objectType — the MQ object class the profile names. Maps to OBJTYPE(...).
spec.objectType MQSC OBJTYPE Applies to
QUEUE QUEUE Local/remote/alias/model queues
CHANNEL CHANNEL Channels
TOPIC TOPIC Administrative topic objects
QMGR QMGR The queue manager itself
NAMESPAC NAMESPAC Namespaces
PROCESS PROCESS Process definitions
NLIST NLIST Namelists
  • The grantee — exactly one of spec.principal (PRINCIPAL('…'), a user ID) or spec.group (GROUP('…'), an OS/LDAP group). The two are mutually exclusive; admission validation rejects a record that sets both or neither (ADR-0025).

spec.authorities is the non-empty set of authorities granted (AUTHADD(...)), e.g. GET, PUT, CONNECT, INQ, BROWSE. The list is a set — order is not significant and duplicates are collapsed.

Examples

Grant a principal GET/PUT on a queue profile:

apiVersion: messaging.mkurator.dev/v1beta1
kind: AuthorityRecord
metadata:
  name: app-orders-get-put
  namespace: mkurator-system
spec:
  connectionRef:
    name: qm1
  profile: APP.ORDERS
  objectType: QUEUE
  principal: app
  authorities:
    - GET
    - PUT

Grant a group CONNECT on the queue manager:

apiVersion: messaging.mkurator.dev/v1beta1
kind: AuthorityRecord
metadata:
  name: ops-qmgr-connect
  namespace: mkurator-system
spec:
  connectionRef:
    name: qm1
  profile: qm1
  objectType: QMGR
  group: mqops
  authorities:
    - CONNECT

The sample is in config/samples/.

Fields

API version: messaging.mkurator.dev/v1beta1 · Kind: AuthorityRecord

.spec

Field Type Required Description
adoptionPolicy enum(Adopt, AdoptIfMatching, FailIfExists) no AdoptionPolicy controls behaviour when the MQ object already exists on first reconcile.
authorities []string yes Authorities maps to AUTHADD(...) — e.g. GET, PUT, CONNECT.
connectionRef object yes ConnectionRef names a QueueManagerConnection in the same namespace.
connectionRef.name string yes —
deletionPolicy enum(Delete, Orphan) no DeletionPolicy controls MQ cleanup when the CR is deleted.
group string no Group maps to GROUP('…'). Mutually exclusive with Principal.
objectType enum(QUEUE, CHANNEL, TOPIC, QMGR, NAMESPAC, PROCESS, NLIST) yes ObjectType maps to OBJTYPE(...).
principal string no Principal maps to PRINCIPAL('…'). Mutually exclusive with Group.
profile string yes Profile maps to PROFILE('…') — queue, channel, or other object name.
suspend boolean no Suspend pauses MQ reconciliation for this object. Status shows Synced=False ReasonSuspended.

.status

Field Type Required Description
conditions []object no Conditions represent the current state of the authority record.
desiredMQSC string no DesiredMQSC is a debug/GitOps aid: the SET AUTHREC AUTHADD(...) line equivalent to what the operator applies via mqweb. Not authoritative; do not use this field to drive cluster apply or drift detection.
lastSyncTime string no LastSyncTime is set when the object last reconciled successfully.
message string no Message is a short, user-facing summary of reconcile state (especially when Synced=False).
mqObjectExists boolean no MQObjectExists is true when the IBM MQ object was last observed on the queue manager.
observedGeneration integer no ObservedGeneration reflects the generation last successfully synced.

MQSC mapping and drift

Each typed field folds into a parameter of the SET AUTHREC command. The operator drift-checks the parameters it manages and re-applies on divergence. The full per-kind matrix lives in ATTRIBUTE_RECONCILIATION.md.

Typed field MQSC parameter Notes
profile PROFILE('…') Object or generic profile name
objectType OBJTYPE(...) Object class the profile names
principal PRINCIPAL('…') Grantee user ID (exclusive with group)
group GROUP('…') Grantee group (exclusive with principal)
authorities AUTHADD(...) Set of authorities to grant

On delete, the operator removes the granted authorities (SET AUTHREC AUTHRMV(...)) unless deletionPolicy: Orphan is set.

See also