Channel authentication walkthrough¶
Configure channel authentication (CHLAUTH) and OAM authority records with MKurator.
Prerequisites¶
- A
QueueManagerConnectioninReadystate (see queue-and-connection.md) - A
ChannelCR for the SVRCONN channel you want to protect
ChannelAuthRule¶
ChannelAuthRule maps one-to-one to a SET CHLAUTH rule. Samples:
| Rule type | Sample |
|---|---|
ADDRESSMAP |
channelauthrule.yaml |
BLOCKUSER |
channelauthrule_blockuser.yaml |
BLOCKADDR |
channelauthrule_blockaddr.yaml |
Other ruleType values are accepted by the API and validated at MQ apply time. See
PHASE5_AUTH_SKETCH.md for the roadmap.
kubectl apply -f config/samples/messaging_v1alpha1_channelauthrule.yaml
kubectl describe channelauthrule <name>
AuthorityRecord¶
Grant OAM authorities on a queue or channel profile:
config/samples/messaging_v1alpha1_authorityrecord.yaml
Auth objects use GET/replace reconciliation (not the DISPLAY drift matrix used for queues). See ATTRIBUTE_RECONCILIATION.md.
Verify¶
Integration and kind e2e cover ADDRESSMAP and BLOCKUSER paths — see
README.md#what-ci-proves.