Skip to content

QueueManagerConnection

QueueManagerConnection is the connection descriptor every other kind references. It does not manage an MQSC object of its own — instead it holds the mqweb REST endpoint, the TLS trust settings, and a reference to the Secret that carries the administrative credentials. The Queue, Topic, Channel, ChannelAuthRule, and AuthorityRecord reconcilers all resolve their spec.connectionRef.name to a QueueManagerConnection in the same namespace and reuse its cached client (ADR-0023).

  • API group/version: messaging.mkurator.dev/v1beta1 (also served as v1alpha1 via the conversion webhook — see Custom resources).
  • Short name: qmc (kubectl get qmc).
  • Scope: namespaced; spec.credentialsSecretRef and spec.tls.caSecretRef resolve in the same namespace as the CR.

The operator validates that the endpoint is reachable and the credentials are usable, then reports the outcome through the Ready status condition. It never creates or mutates the queue manager itself.

Endpoint and REST prefix

  • spec.queueManager — the IBM MQ queue manager name (case-sensitive), e.g. QM1. Required.
  • spec.endpoint — the mqweb base URL. Must start with https:// (plain HTTP is rejected by admission validation), e.g. https://ibm-mq.ibm-mq.svc:9443. Required.
  • spec.restPrefix — the mqweb REST API path prefix. Must start with /; defaults to /ibmmq/rest/v3 when absent. Override only for a non-default mqweb deployment.

TLS trust

spec.tls configures how the operator trusts the mqweb server certificate:

  • spec.tls.caSecretRef — the production path. References a Secret containing the CA bundle that signed the mqweb certificate (accepted keys: tls.crt, ca.crt, or ca.pem). The operator adds it to the trust store and verifies the server certificate normally.
  • spec.tls.insecureSkipVerify — the dev-only escape hatch. Disables server certificate verification entirely. To set it you must also opt in with the messaging.mkurator.dev/allow-insecure-tls: "true" annotation on the CR; admission validation rejects insecureSkipVerify: true without it. Never use this against a real queue manager.

When spec.tls is omitted, the operator uses the pod's default trust store.

Credentials

spec.credentialsSecretRef references a Secret in the same namespace holding the mqweb credentials. Required.

  • Password (required key): password, or mqAdminPassword.
  • Username (optional key): username, user, or mqAdminUser. Defaults to admin when absent — admission emits a warning so the default is not silent.

Examples

Dev connection with insecureSkipVerify (note the opt-in annotation):

apiVersion: messaging.mkurator.dev/v1beta1
kind: QueueManagerConnection
metadata:
  name: qm1
  namespace: mkurator-system
  annotations:
    messaging.mkurator.dev/allow-insecure-tls: "true"
spec:
  queueManager: QM1
  endpoint: https://ibm-mq.ibm-mq.svc:9443
  tls:
    insecureSkipVerify: true
  credentialsSecretRef:
    name: mq-credentials

Production connection with a CA bundle:

apiVersion: messaging.mkurator.dev/v1beta1
kind: QueueManagerConnection
metadata:
  name: qm1
  namespace: mkurator-system
spec:
  queueManager: QM1
  endpoint: https://ibm-mq.example.svc:9443
  tls:
    caSecretRef:
      name: mqweb-ca
  credentialsSecretRef:
    name: mq-credentials

The sample is in config/samples/.

Fields

API version: messaging.mkurator.dev/v1beta1 · Kind: QueueManagerConnection

.spec

Field Type Required Description
credentialsSecretRef object yes CredentialsSecretRef references a Secret with mqweb credentials. Required key: password (mqAdminPassword is also accepted). Username is optional: username, user, or mqAdminUser (defaults to admin when absent; admission warns).
credentialsSecretRef.name string yes —
endpoint string yes Endpoint is the mqweb base URL, e.g. https://ibm-mq.ibm-mq.svc:9443
queueManager string yes QueueManager is the IBM MQ queue manager name (case-sensitive).
restPrefix string no RESTPrefix is the mqweb REST API path prefix. Defaults to /ibmmq/rest/v3.
tls object no TLS configures HTTPS trust for mqweb.
tls.caSecretRef object no CASecretRef references a Secret containing a CA bundle (key tls.crt, ca.crt, or ca.pem).
tls.insecureSkipVerify boolean no InsecureSkipVerify disables server certificate verification (dev only).

.status

Field Type Required Description
conditions []object no Conditions represent the current state of the connection.
observedGeneration integer no ObservedGeneration reflects the generation last reconciled.

Readiness

QueueManagerConnection has no MQSC object to drift-check. Its reconcile probes the endpoint with the resolved credentials and TLS settings and reports the result on the Ready condition (surfaced as the Ready/Reason print columns: kubectl get qmc). A Ready=False connection blocks the kinds that reference it — their reconcilers requeue until the connection recovers. status.observedGeneration reflects the spec generation last reconciled.

See also