allthingssecurity opened a new pull request, #27669: URL: https://github.com/apache/camel/pull/27669
# Description [CAMEL-25518](https://issues.apache.org/jira/browse/CAMEL-25518) With `camel.vault.hashicorp.refreshEnabled=true`, the refresh task also tracks the secrets the `hashicorp:` properties function resolved (the documented behaviour when `camel.vault.hashicorp.secrets` is not set). Two problems: - The function recorded `hashicorp:kv:db#password` as `db`. The task reads a name without an engine from the `secret` engine, so it polled `secret/metadata/db`, got nothing, and an update of a secret in any other engine never triggered a reload. - The task's first run only records the version it sees. It runs one refresh period (60 s by default) after startup, so an update in that window became the baseline and the application kept the old value. This change records the secret in the format of `camel.vault.hashicorp.secrets`, which the task already parses: `engine:secret`, or only `secret` for the default `secret` engine (so the names of those secrets do not change). It also remembers the version the function resolved (from `data.metadata.version`, not when a specific `@version` was requested), and the task starts from that version for a secret it has not seen yet. The recorded set and the new version map are concurrent collections, as the task reads them from its own thread. New public method: `HashicorpVaultPropertiesFunction.getSecretVersion(String)`. The component docs (and their catalog copy) and the 4.23 upgrade guide describe the change, including the new names of secrets of other engines in `getSecrets()` and in the task's updates. Tests: - New `HashicorpVaultReloadTriggerTaskTest` with a small in-process fake of the Vault KV v2 HTTP API (JDK `HttpServer`, no container): an update in the `kv` engine, an update before the first check, the recorded names, a secret resolved at a specific version (`@1`) that must not be compared with that version, and an unchanged secret that must not trigger a reload (the last two pass without the change too; they guard against a reload caused by the remembered version). - Without the change: `the refresh task must read the metadata of the engine the secret was resolved from, but read [secret/metadata/db, secret/metadata/db]`, `the application resolved version 1 but version 2 was not detected, updates: {}`, and the recorded names are `db` and `api` instead of `kv:db` and `api`. - With the change, the camel-hashicorp-vault unit tests pass (7). The ITs need a Vault container; I did not run them. Found with a TLA+ model of startup resolution, secret updates and the refresh runs: "after a complete check run with no update since it started, the application uses the current version of every secret" is violated for a `kv` secret (12 steps) and for an update before the first check (8 steps). I then reproduced both with the real classes. Affected: 4.17.0 and later (the refresh was added by CAMEL-22676). # Target - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch) # Tracking - [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it). # Apache Camel coding standards and style - [x] I checked that each commit in the pull request has a meaningful subject line and body. - [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes. (I built and tested camel-hashicorp-vault, including the formatter and import-sort plugins, and updated the catalog copy of the component page. I did not run the full root build.) # AI-assisted contributions - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used. This PR was prepared with Claude Code (Claude Opus 5.5). The commit carries a `Co-Authored-By` trailer. _Claude Code on behalf of allthingssecurity_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
