This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch camel-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.18.x by this push:
new c0ce22d1e0de CAMEL-24468 + CAMEL-24470: camel-ibm-secrets-manager
credential/version-pin fixes (backport to camel-4.18.x) (#25736)
c0ce22d1e0de is described below
commit c0ce22d1e0defa4aed09b1ea26122a930e1afc8c
Author: Andrea Cosentino <[email protected]>
AuthorDate: Wed Aug 26 09:10:27 2026 +0200
CAMEL-24468 + CAMEL-24470: camel-ibm-secrets-manager credential/version-pin
fixes (backport to camel-4.18.x) (#25736)
* CAMEL-24468: camel-ibm-secrets-manager - fix multiple defects in
IBMSecretsManagerPropertiesFunction (env-var credentials, version pinning,
missing KV field) (#25640)
* CAMEL-24468: camel-ibm-secrets-manager - fix inverted credential check so
the environment-variable configuration works
IBMSecretsManagerPropertiesFunction.doStart() only built the SecretsManager
client when both CAMEL_VAULT_IBM_TOKEN and CAMEL_VAULT_IBM_SERVICE_URL were
empty, and threw otherwise. So setting those documented environment
variables
(the first configuration method in the class Javadoc, and the norm in
containers) made CamelContext startup fail with a message telling the user
to
set credentials they had already set.
Read the environment variables, fall back to the vault configuration only
when
both are empty, then build the client when a token and service URL are
available from either source, throwing only when neither provides them.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
* CAMEL-24468: camel-ibm-secrets-manager - keep the secret version and fix
the missing-field default in IBMSecretsManagerPropertiesFunction
getSecretFromSource() fetched the requested secret version's data and then
overwrote it with the current version's data, so version pinning
(ibm:group:secret#field@version) was silently ignored for KV secrets. It
also
returned the literal string "null" for a missing KV field, which is
non-empty
and therefore bypassed the default-value fallback. Keep the versioned data
and
null-guard the field lookup so the provided default value is used when the
field
is absent. The ARBITRARY/payload branch was already correct.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Signed-off-by: Andrea Cosentino <[email protected]>
---------
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
* CAMEL-24470: camel-ibm-secrets-manager - honor Event Stream credentials
from environment variables in the reload trigger task (#25648)
IBMEventStreamReloadTriggerTask.doStart() inverted the credential-resolution
logic: after reading the CAMEL_VAULT_IBM_EVENTSTREAM_* environment
variables it
built the Kafka consumer only when they were all empty and threw otherwise,
so
supplying the documented environment variables always failed at startup
with the
exact message claiming those variables were required. Resolve the
credentials
from the environment variables when present, fall back to the vault
configuration otherwise, keep defaulting the username to "token" when not
supplied, and only throw when a required value is still missing.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
---------
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>
---
.../manager/IBMSecretsManagerPropertiesFunction.java | 12 ++++--------
.../manager/vault/IBMEventStreamReloadTriggerTask.java | 13 +++++++------
2 files changed, 11 insertions(+), 14 deletions(-)
diff --git
a/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/IBMSecretsManagerPropertiesFunction.java
b/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/IBMSecretsManagerPropertiesFunction.java
index 0c6dbce177cc..b63deca23517 100644
---
a/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/IBMSecretsManagerPropertiesFunction.java
+++
b/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/IBMSecretsManagerPropertiesFunction.java
@@ -100,6 +100,8 @@ public class IBMSecretsManagerPropertiesFunction extends
ServiceSupport implemen
token = ibmVaultConfiguration.getToken();
serviceUrl = ibmVaultConfiguration.getServiceUrl();
}
+ }
+ if (ObjectHelper.isNotEmpty(token) &&
ObjectHelper.isNotEmpty(serviceUrl)) {
IamAuthenticator iamAuthenticator = new IamAuthenticator.Builder()
.apikey(token)
.build();
@@ -212,14 +214,8 @@ public class IBMSecretsManagerPropertiesFunction extends
ServiceSupport implemen
Response<SecretVersion> secVersion =
client.getSecretVersion(getSecretVersionOptions).execute();
data = secVersion.getResult().getData();
}
- if (ObjectHelper.isNotEmpty(data)) {
- data = response.getResult().getData();
- }
- if (ObjectHelper.isNotEmpty(subkey)) {
- returnValue = String.valueOf(data.get(subkey));
- } else {
- returnValue = null;
- }
+ Object subValue = data.get(subkey);
+ returnValue = subValue != null ? String.valueOf(subValue) :
null;
if (ObjectHelper.isEmpty(returnValue)) {
returnValue = defaultValue;
}
diff --git
a/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/vault/IBMEventStreamReloadTriggerTask.java
b/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/vault/IBMEventStreamReloadTriggerTask.java
index fde6214e6e25..276e1df3f7ba 100644
---
a/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/vault/IBMEventStreamReloadTriggerTask.java
+++
b/components/camel-ibm/camel-ibm-secrets-manager/src/main/java/org/apache/camel/component/ibm/secrets/manager/vault/IBMEventStreamReloadTriggerTask.java
@@ -119,15 +119,16 @@ public class IBMEventStreamReloadTriggerTask extends
ServiceSupport implements C
groupId = ibmVaultConfiguration.getEventStreamGroupId();
topic = ibmVaultConfiguration.getEventStreamTopic();
if (ObjectHelper.isEmpty(username)) {
- if
(ObjectHelper.isNotEmpty(ibmVaultConfiguration.getEventStreamUsername())) {
- username =
ibmVaultConfiguration.getEventStreamUsername();
- } else {
- username = "token";
- }
+ username = ibmVaultConfiguration.getEventStreamUsername();
}
password = ibmVaultConfiguration.getEventStreamPassword();
}
- } else {
+ }
+ if (ObjectHelper.isEmpty(username)) {
+ username = "token";
+ }
+ if (ObjectHelper.isEmpty(bootstrapServers) ||
ObjectHelper.isEmpty(groupId) || ObjectHelper.isEmpty(topic)
+ || ObjectHelper.isEmpty(password)) {
throw new RuntimeCamelException(
"Using the IBM Secrets Refresh Task requires setting IBM
Event Stream bootstrap servers, topic, groupId, username and password as
application properties or environment variables");
}
