ChannelAuthRule¶

ChannelAuthRule manages a single channel authentication record (CHLAUTH) on an existing IBM MQ queue manager. Each rule maps to one SET CHLAUTH MQSC command against a named channel (or channel pattern), controlling which inbound connections are allowed, blocked, or mapped to an MCA user. The operator reconciles the desired rule through mqweb and reports drift via status conditions; it does not create the queue manager or the channel the rule protects.

API group/version: messaging.mkurator.dev/v1beta1 (also served as v1alpha1 via the conversion webhook — see Custom resources).
Short name: car (kubectl get car).
Scope: namespaced; spec.connectionRef resolves in the same namespace (ADR-0023).

Unlike Queue, Topic, and Channel, the auth kinds expose their MQSC parameters as typed fields only — there is no free-form spec.attributes map. Which fields apply depends on spec.ruleType.

Rule types¶

spec.ruleType selects the CHLAUTH TYPE(...) and, with it, the set of fields that apply:

`spec.ruleType`	MQSC `TYPE`	Purpose	Key fields
`ADDRESSMAP`	`ADDRESSMAP`	Map or filter connections by IP address / hostname pattern	`address`, `userSource`, `mcaUser`, `checkClient`
`USERMAP`	`USERMAP`	Map an asserted client user ID to an MCA user	`clientUser`, `userSource`, `mcaUser`
`QMGRMAP`	`QMGRMAP`	Map connections from a remote queue manager	`remoteQueueManager`, `userSource`, `mcaUser`
`SSLPEERMAP`	`SSLPEERMAP`	Map connections by TLS certificate distinguished name	`sslPeerName`, `userSource`, `mcaUser`
`BLOCKUSER`	`BLOCKUSER`	Block a list of user IDs on the channel	`userList`
`BLOCKADDR`	`BLOCKADDR`	Block a list of IP addresses at the listener	`address`

spec.userSource (CHANNEL / MAP / NOACCESS) governs how the mapped identity is resolved; spec.checkClient (REQUIRED / OPTIONAL / ASQMGR / REQDADM / ASCHL) controls client-side authentication for ADDRESSMAP rules.

Examples¶

An address-map rule allowing connections on an application channel:

apiVersion: messaging.mkurator.dev/v1beta1
kind: ChannelAuthRule
metadata:
  name: dev-app-addressmap
  namespace: mkurator-system
spec:
  connectionRef:
    name: qm1
  channelName: DEV.APP.SVRCONN.0TLS
  ruleType: ADDRESSMAP
  address: "*"
  userSource: CHANNEL
  checkClient: REQUIRED
  description: Allows connection via APP channel

A user-map rule pinning an asserted client user to a fixed MCA user:

apiVersion: messaging.mkurator.dev/v1beta1
kind: ChannelAuthRule
metadata:
  name: app-usermap
  namespace: mkurator-system
spec:
  connectionRef:
    name: qm1
  channelName: DEV.APP.SVRCONN
  ruleType: USERMAP
  clientUser: appclient
  userSource: MAP
  mcaUser: appsvc
  description: Map appclient to the appsvc service account

The ADDRESSMAP sample is in config/samples/.

Fields¶

API version: messaging.mkurator.dev/v1beta1 · Kind: ChannelAuthRule

`.spec`¶

Field	Type	Required	Description
`address`	string	no	Address maps to ADDRESS(...) for ADDRESSMAP and BLOCKADDR rules.
`adoptionPolicy`	enum(Adopt, AdoptIfMatching, FailIfExists)	no	AdoptionPolicy controls behaviour when the MQ object already exists on first reconcile.
`channelName`	string	yes	ChannelName is the IBM MQ channel name in SET CHLAUTH('…').
`checkClient`	enum(REQUIRED, ASQMGR, REQDADM, ASCHL, OPTIONAL)	no	CheckClient maps to CHCKCLNT(...) for ADDRESSMAP rules.
`clientUser`	string	no	ClientUser maps to CLNTUSER(...) for USERMAP rules.
`connectionRef`	object	yes	ConnectionRef names a QueueManagerConnection in the same namespace.
`connectionRef.name`	string	yes	—
`deletionPolicy`	enum(Delete, Orphan)	no	DeletionPolicy controls MQ cleanup when the CR is deleted.
`description`	string	no	Description maps to DESCR(...).
`mcaUser`	string	no	McaUser maps to MCAUSER(...) for USERMAP (USERSRC MAP), SSLPEERMAP (USERSRC MAP), QMGRMAP (USERSRC MAP), and ADDRESSMAP (USERSRC MAP) rules.
`remoteQueueManager`	string	no	RemoteQueueManager maps to QMNAME(...) for QMGRMAP rules (remote partner queue manager name).
`ruleType`	enum(ADDRESSMAP, BLOCKUSER, USERMAP, SSLPEERMAP, QMGRMAP, BLOCKADDR)	yes	RuleType maps to CHLAUTH TYPE(...).
`sslPeerName`	string	no	SslPeerName maps to SSLPEER(...) for SSLPEERMAP rules (TLS certificate DN pattern).
`suspend`	boolean	no	Suspend pauses MQ reconciliation for this object. Status shows Synced=False ReasonSuspended.
`userList`	string	no	UserList maps to USERLIST(...) for BLOCKUSER rules.
`userSource`	enum(CHANNEL, NOACCESS, MAP)	no	UserSource maps to USERSRC(...) for ADDRESSMAP, USERMAP, SSLPEERMAP, and QMGRMAP rules.

`.status`¶

Field	Type	Required	Description
`conditions`	[]object	no	Conditions represent the current state of the rule.
`desiredMQSC`	string	no	DesiredMQSC is a debug/GitOps aid: the SET CHLAUTH ACTION(REPLACE) line equivalent to what the operator applies via mqweb. Not authoritative; do not use this field to drive cluster apply or drift detection.
`lastSyncTime`	string	no	LastSyncTime is set when the object last reconciled successfully.
`message`	string	no	Message is a short, user-facing summary of reconcile state (especially when Synced=False).
`mqObjectExists`	boolean	no	MQObjectExists is true when the IBM MQ object was last observed on the queue manager.
`observedGeneration`	integer	no	ObservedGeneration reflects the generation last successfully synced.

MQSC mapping and drift¶

Each typed field folds into a parameter of the SET CHLAUTH command for the rule's ruleType. The operator drift-checks the parameters it manages and re-applies on divergence. The full per-kind matrix lives in ATTRIBUTE_RECONCILIATION.md.

Typed field	MQSC parameter	Applies to	Notes
`channelName`	`SET CHLAUTH('…')`	all	Channel name or pattern the rule protects
`ruleType`	`TYPE(...)`	all	Selects the CHLAUTH rule kind
`address`	`ADDRESS(...)`	`ADDRESSMAP`, `BLOCKADDR`	IP address / hostname pattern
`userSource`	`USERSRC(...)`	mapping rules	`CHANNEL` / `MAP` / `NOACCESS`
`mcaUser`	`MCAUSER(...)`	mapping rules	MCA user asserted when `userSource: MAP`
`checkClient`	`CHCKCLNT(...)`	`ADDRESSMAP`	`REQUIRED` / `OPTIONAL` / `ASQMGR` / `REQDADM` / `ASCHL`
`clientUser`	`CLNTUSER(...)`	`USERMAP`	Asserted client user ID to map
`remoteQueueManager`	`QMNAME(...)`	`QMGRMAP`	Remote queue manager name / pattern
`sslPeerName`	`SSLPEER(...)`	`SSLPEERMAP`	TLS certificate distinguished name
`userList`	`USERLIST(...)`	`BLOCKUSER`	User IDs to block
`description`	`DESCR(...)`	all	Free-text rule description

Admission validation rejects field combinations that do not apply to the chosen ruleType (ADR-0025); for example, clientUser is only valid on USERMAP and address on ADDRESSMAP / BLOCKADDR.