oscerd opened a new pull request, #26098:
URL: https://github.com/apache/camel/pull/26098
Second increment of the `camel-spiffe` component (CAMEL-23305, shipped in
4.23.0). Adds
`SpiffeSSLContextParameters`, an `SSLContextParameters` whose `SSLContext`
is backed by the SPIFFE
Workload API (via `io.spiffe:java-spiffe-provider`) with automatic
X.509-SVID rotation, so any Camel
component that accepts an `sslContextParameters` reference (camel-http,
camel-netty-http, camel-jetty,
camel-vertx-http, ...) can obtain zero-trust mutual TLS.
## Highlights
- **Honours the inherited `SSLContextParameters` configuration.** The SPIFFE
`SSLContext` is wrapped with
the same decorator the parent uses, so
`serverParameters.clientAuthentication`, `cipherSuites` and
`secureSocketProtocols` still apply — a server correctly requests and
validates the peer SVID rather
than silently accepting unauthenticated peers.
- **Fail-closed peer authentication:** either an `acceptedSpiffeIds`
allow-list or `acceptAnySpiffeId`
(the two are mutually exclusive); configuring neither is rejected.
- **Lifecycle-safe:** the `X509Source` is created lazily (bounded by
`initTimeout`, default 30s), closed
on `CamelContext` shutdown, and the cached context is invalidated at the
same time so a restarted
context rebuilds a fresh source.
- Property-placeholder resolution on all options; base handshake protocol
from `secureSocketProtocol`
(default `TLSv1.3`).
## Testing
- 5 unit tests: fail-closed validation, SPIFFE-ID parsing,
accept-any/allow-list mutual exclusion,
blank-only allow-list rejection, and fast-fail on an unreachable Workload
API.
- A full mTLS handshake requires a running SPIFFE Workload API (e.g. a SPIRE
agent), so it is left as a
manual/integration verification rather than a CI test.
- Full-reactor build is green.
## Docs
Adds a "Mutual TLS with SPIFFE (SSLContextParameters)" section to the
component page with a wiring example.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_017EbUBfDPznQECWRbY5cr2n
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
