gnodet opened a new pull request, #26845: URL: https://github.com/apache/camel/pull/26845
## Summary Implements `SecretRotationAware` in `JdbcComponent` (camel-jdbc) and `SqlComponent` (camel-sql) so that JDBC connection pools evict stale connections when vault-backed database credentials are rotated. ## Root Cause `JdbcComponent` and `SqlComponent` both use a `DataSource` that is typically a registry bean (HikariCP pool, DBCP2 pool, etc.). This bean is **not** recreated during a vault-triggered context reload: `DefaultContextReloadStrategy.reloadAllRoutes()` clears the endpoint registry and restarts routes, but the DataSource bean persists with connections authenticated against the old password. New connections checked out from the pool after rotation continue to use the old credentials until the pool discards them naturally (e.g. on expiry or validation failure). ## Fix Both components now implement `SecretRotationAware`. The `onSecretRotation()` callback: 1. Collects all reachable `DataSource` instances: registry beans + the component's own `dataSource` field (if set). 2. For each DataSource, attempts **HikariCP `softEvictConnections()`** via reflection — this marks existing connections for eviction while allowing in-flight queries to complete, then the pool recreates them with the new credentials. 3. Falls back gracefully for non-HikariCP pools: logs that connections will be replaced on their natural expiry cycle. No compile-time dependency on HikariCP is added. The callback uses reflection so neither `camel-jdbc` nor `camel-sql` needs a new dependency. Other well-known pools (DBCP2 `BasicDataSource`, c3p0, Tomcat JDBC) validate on borrow by default and will discard stale connections automatically; the log message makes this visible to operators. ## Tests New unit tests in each module: - `JdbcComponentSecretRotationAwareTest` (6 tests) - `SqlComponentSecretRotationAwareTest` (6 tests) Each covers: interface assertion, HikariCP-like pool eviction, generic pool (no throw), registry DataSource eviction, component-owned DataSource eviction, no DataSource configured (no throw). ## Related - CAMEL-24636: `SecretRotationAware` SPI added to camel-core - CAMEL-24639: camel-http — docs only (no SPI needed; credentials flow into per-endpoint configurers cleared by route reload) - CAMEL-24637: camel-jms — same pattern, in progress --- _Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
