MQ

mq.yml

apiVersion: v1
kind: Pod
metadata:
  name: mq
spec:
  containers:
  - image: ibmcom/mq:9.1.5.0-r2
    name: mq
    env:
      - name: LICENSE
        value: accept
      - name: MQ_QMGR_NAME
        value: QM1
      - name: MQ_ENABLE_EMBEDDED_WEB_SERVER
        value: "false"
    resources: {}
    volumeMounts:
    - name: workdir
      mountPath: "/etc/mqm"
  initContainers:
  - image: busybox:1.32.0
    name: init-queues
    command:
      - "/bin/sh"
      - "-c"
      - |
        cat <<'EOF' > /work-dir/10-dev.mqsc.tpl

        * Developer queues
        DEFINE QLOCAL('DEV.QUEUE.1') REPLACE
        DEFINE QLOCAL('DEV.QUEUE.2') REPLACE
        DEFINE QLOCAL('DEV.QUEUE.3') REPLACE
        DEFINE QLOCAL('DEV.QUEUE.4') REPLACE
        DEFINE QLOCAL('DEV.QUEUE.5') REPLACE
        DEFINE QLOCAL('DEV.QUEUE.6') REPLACE
        DEFINE QLOCAL('DEV.DEAD.LETTER.QUEUE') REPLACE

        * Use a different dead letter queue, for undeliverable messages
        ALTER QMGR DEADQ('DEV.DEAD.LETTER.QUEUE')

        * Developer topics
        DEFINE TOPIC('DEV.BASE.TOPIC') TOPICSTR('dev/') REPLACE

        * Developer connection authentication
        DEFINE AUTHINFO('DEV.AUTHINFO') AUTHTYPE(IDPWOS) CHCKCLNT(REQDADM) CHCKLOCL(OPTIONAL) ADOPTCTX(YES) REPLACE
        ALTER QMGR CONNAUTH('DEV.AUTHINFO')
        REFRESH SECURITY(*) TYPE(CONNAUTH)

        * Developer channels (Application + Admin)
        * Developer channels (Application + Admin)
        DEFINE CHANNEL('DEV.ADMIN.SVRCONN') CHLTYPE(SVRCONN) REPLACE
        DEFINE CHANNEL('DEV.APP.SVRCONN') CHLTYPE(SVRCONN) MCAUSER('app') REPLACE

        * Developer channel authentication rules
        SET CHLAUTH('*') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) DESCR('Back-stop rule - Blocks everyone') ACTION(REPLACE)
        SET CHLAUTH('DEV.APP.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(CHANNEL) CHCKCLNT({{ .ChckClnt }}) DESCR('Allows connection via APP channel') ACTION(REPLACE)
        SET CHLAUTH('DEV.ADMIN.SVRCONN') TYPE(BLOCKUSER) USERLIST('nobody') DESCR('Allows admins on ADMIN channel') ACTION(REPLACE)
        SET CHLAUTH('DEV.ADMIN.SVRCONN') TYPE(USERMAP) CLNTUSER('admin') USERSRC(CHANNEL) DESCR('Allows admin user to connect via ADMIN channel') ACTION(REPLACE)
        SET CHLAUTH('DEV.ADMIN.SVRCONN') TYPE(USERMAP) CLNTUSER('admin') USERSRC(MAP) MCAUSER ('mqm') DESCR ('Allow admin as MQ-admin') ACTION(REPLACE)

        * Developer authority records
        SET AUTHREC PRINCIPAL('app') OBJTYPE(QMGR) AUTHADD(CONNECT,INQ)
        SET AUTHREC PROFILE('DEV.**') PRINCIPAL('app') OBJTYPE(QUEUE) AUTHADD(BROWSE,GET,INQ,PUT)
        SET AUTHREC PROFILE('DEV.**') PRINCIPAL('app') OBJTYPE(TOPIC) AUTHADD(PUB,SUB)
        EOF
    volumeMounts:
    - name: workdir
      mountPath: "/work-dir"
  - image: busybox:1.32.0
    name: init-htpasswd
    command:
      - "/bin/sh"
      - "-c"
      - |
        cat <<'EOF' > /work-dir/mq.htpasswd
        admin:$2y$05$M/C1U62RZ6q1kv4E7.S7ueNESJmFe85RsZcoMUReRXUDB8QcP3yqS
        app:$2y$05$BnbPtcjXTjk5JRJ8gzHqIuHgoQbLF3qtbPV3Q3tLyr0XJNg.7dkxW
        EOF
    volumeMounts:
    - name: workdir
      mountPath: "/work-dir"
  - image: busybox:1.32.0
    name: init-tls
    command:
      - "/bin/sh"
      - "-c"
      - |
        cat <<'EOF' > /work-dir/15-tls.mqsc.tpl
        ALTER QMGR SSLKEYR('{{ .SSLKeyR }}')
        ALTER QMGR CERTLABL('{{ .CertificateLabel }}')
        REFRESH SECURITY(*) TYPE(SSL)
        EOF
    volumeMounts:
    - name: workdir
      mountPath: "/work-dir"
  - image: busybox:1.32.0
    name: init-ini
    command:
      - "/bin/sh"
      - "-c"
      - |
        cat <<'EOF' > /work-dir/qm-service-component.ini
        ServiceComponent:
            Service=AuthorizationService
            Name=Dev.HtpAuth.Service
            Module=/opt/mqm/lib64/amqpasdev.so
            ComponentDataSize=0
        ServiceComponent:
          Service=AuthorizationService
          Name=MQSeries.UNIX.auth.service
          Module=amqzfu
          ComponentDataSize=0
        EOF
    volumeMounts:
    - name: workdir
      mountPath: "/work-dir"
  volumes:
  - name: workdir
    emptyDir: {}