This is an automated email from the ASF dual-hosted git repository.
oscerd pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 3b18f5a6be7f CAMEL-23305: camel-spiffe - new component for SPIFFE
workload identity (X.509-SVID / JWT-SVID) (#25621)
3b18f5a6be7f is described below
commit 3b18f5a6be7f8d0bc9041b2775e5beaf947e44f4
Author: Andrea Cosentino <[email protected]>
AuthorDate: Thu Aug 27 14:43:25 2026 +0200
CAMEL-23305: camel-spiffe - new component for SPIFFE workload identity
(X.509-SVID / JWT-SVID) (#25621)
New producer-only camel-spiffe component that integrates with the SPIFFE
Workload API to fetch and validate workload identity: the fetchX509Svid,
fetchJwtSvid and validateJwtSvid operations over io.spiffe:java-spiffe-core.
The WorkloadApiClient is taken from spiffeSocketPath / SPIFFE_ENDPOINT_SOCKET,
or autowired from the registry.
Co-authored-by: Claude Opus 4.8 <[email protected]>
---
bom/camel-bom/pom.xml | 5 +
catalog/camel-allcomponents/pom.xml | 5 +
.../org/apache/camel/catalog/components.properties | 1 +
.../apache/camel/catalog/components/spiffe.json | 50 +++
.../org/apache/camel/catalog/docs.properties | 1 +
.../camel/catalog/docs/spiffe-component.adoc | 89 ++++++
components/camel-spiffe/pom.xml | 67 ++++
.../spiffe/SpiffeComponentConfigurer.java | 90 ++++++
.../component/spiffe/SpiffeEndpointConfigurer.java | 74 +++++
.../component/spiffe/SpiffeEndpointUriFactory.java | 82 +++++
.../org/apache/camel/component/spiffe/spiffe.json | 50 +++
.../services/org/apache/camel/component.properties | 7 +
.../services/org/apache/camel/component/spiffe | 2 +
.../org/apache/camel/configurer/spiffe-component | 2 +
.../org/apache/camel/configurer/spiffe-endpoint | 2 +
.../org/apache/camel/urifactory/spiffe-endpoint | 2 +
.../src/main/docs/spiffe-component.adoc | 89 ++++++
.../camel/component/spiffe/SpiffeComponent.java | 64 ++++
.../component/spiffe/SpiffeConfiguration.java | 98 ++++++
.../camel/component/spiffe/SpiffeConstants.java | 45 +++
.../camel/component/spiffe/SpiffeEndpoint.java | 116 +++++++
.../camel/component/spiffe/SpiffeOperation.java | 23 ++
.../camel/component/spiffe/SpiffeProducer.java | 114 +++++++
.../camel/component/spiffe/SpiffeProducerTest.java | 149 +++++++++
components/pom.xml | 1 +
.../org/apache/camel/main/components.properties | 1 +
.../modules/ROOT/examples/json/spiffe.json | 1 +
docs/components/modules/ROOT/nav.adoc | 1 +
.../modules/ROOT/pages/spiffe-component.adoc | 1 +
.../component/ComponentsBuilderFactory.java | 14 +
.../dsl/SpiffeComponentBuilderFactory.java | 222 +++++++++++++
.../builder/endpoint/EndpointBuilderFactory.java | 1 +
.../camel/builder/endpoint/EndpointBuilders.java | 1 +
.../builder/endpoint/EndpointHeaderBuilders.java | 14 +
.../builder/endpoint/StaticEndpointBuilders.java | 42 +++
.../endpoint/dsl/SpiffeEndpointBuilderFactory.java | 347 +++++++++++++++++++++
.../camel-component-known-dependencies.properties | 1 +
parent/pom.xml | 7 +
38 files changed, 1881 insertions(+)
diff --git a/bom/camel-bom/pom.xml b/bom/camel-bom/pom.xml
index 9a749527c7f9..d70d54289386 100644
--- a/bom/camel-bom/pom.xml
+++ b/bom/camel-bom/pom.xml
@@ -2227,6 +2227,11 @@
<artifactId>camel-solr</artifactId>
<version>4.23.0-SNAPSHOT</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-spiffe</artifactId>
+ <version>4.23.0-SNAPSHOT</version>
+ </dependency>
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-splunk-hec</artifactId>
diff --git a/catalog/camel-allcomponents/pom.xml
b/catalog/camel-allcomponents/pom.xml
index 91da81f5e13c..6fe7977a95a1 100644
--- a/catalog/camel-allcomponents/pom.xml
+++ b/catalog/camel-allcomponents/pom.xml
@@ -2007,6 +2007,11 @@
<artifactId>camel-solr</artifactId>
<version>${project.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-spiffe</artifactId>
+ <version>${project.version}</version>
+ </dependency>
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-splunk-hec</artifactId>
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components.properties
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components.properties
index b65ac00d9785..e763efdc2303 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components.properties
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components.properties
@@ -341,6 +341,7 @@ smtp
smtps
snmp
solr
+spiffe
splunk-hec
spring-ai-chat
spring-ai-embeddings
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/spiffe.json
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/spiffe.json
new file mode 100644
index 000000000000..82dc8b9cc87d
--- /dev/null
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/components/spiffe.json
@@ -0,0 +1,50 @@
+{
+ "component": {
+ "kind": "component",
+ "name": "spiffe",
+ "title": "SPIFFE",
+ "description": "Fetch and validate SPIFFE workload identity (X.509-SVID
and JWT-SVID) from the SPIFFE Workload API.",
+ "deprecated": false,
+ "firstVersion": "4.23.0",
+ "label": "security",
+ "javaType": "org.apache.camel.component.spiffe.SpiffeComponent",
+ "supportLevel": "Preview",
+ "groupId": "org.apache.camel",
+ "artifactId": "camel-spiffe",
+ "version": "4.23.0-SNAPSHOT",
+ "scheme": "spiffe",
+ "extendsScheme": "",
+ "syntax": "spiffe:label",
+ "async": false,
+ "api": false,
+ "consumerOnly": false,
+ "producerOnly": true,
+ "lenientProperties": false,
+ "browsable": false,
+ "remote": true
+ },
+ "componentProperties": {
+ "audience": { "index": 0, "kind": "property", "displayName": "Audience",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The comma-separated audience(s) to request for
a JWT-SVID (fetchJwtSvid) or to validate against (validateJwtSvid). Can b [...]
+ "configuration": { "index": 1, "kind": "property", "displayName":
"Configuration", "group": "producer", "label": "", "required": false, "type":
"object", "javaType": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"deprecated": false, "autowired": false, "secret": false, "description": "The
component configuration." },
+ "lazyStartProducer": { "index": 2, "kind": "property", "displayName":
"Lazy Start Producer", "group": "producer", "label": "producer", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": false, "description":
"Whether the producer should be started lazy (on the first message). By
starting lazy you can use this to allow CamelContext and routes to startup in
situations where a producer may otherwise fail [...]
+ "operation": { "index": 3, "kind": "property", "displayName": "Operation",
"group": "producer", "label": "", "required": false, "type": "enum",
"javaType": "org.apache.camel.component.spiffe.SpiffeOperation", "enum": [
"fetchX509Svid", "fetchJwtSvid", "validateJwtSvid" ], "deprecated": false,
"autowired": false, "secret": false, "defaultValue": "fetchX509Svid",
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "descr [...]
+ "autowiredEnabled": { "index": 4, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching t [...]
+ "workloadApiClient": { "index": 5, "kind": "property", "displayName":
"Workload Api Client", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "io.spiffe.workloadapi.WorkloadApiClient",
"deprecated": false, "deprecationNote": "", "autowired": true, "secret": false,
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "description": "An existing
WorkloadApiClient to use. When set, [...]
+ "spiffeSocketPath": { "index": 6, "kind": "property", "displayName":
"Spiffe Socket Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The address of the SPIFFE Workload API
endpoint (for example {code unix:\/\/\/tmp\/agent.sock} [...]
+ },
+ "headers": {
+ "CamelSpiffeOperation": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"org.apache.camel.component.spiffe.SpiffeOperation or String", "deprecated":
false, "deprecationNote": "", "autowired": false, "secret": false,
"description": "Overrides the operation to be used by the producer.",
"constantName": "org.apache.camel.component.spiffe.SpiffeConstants#OPERATION" },
+ "CamelSpiffeAudience": { "index": 1, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The comma-separated audience(s) for the
fetchJwtSvid and validateJwtSvid operations.", "constantName":
"org.apache.camel.component.spiffe.SpiffeConstants#AUDIENCE" },
+ "CamelSpiffeToken": { "index": 2, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The JWT-SVID token to validate, for the
validateJwtSvid operation.", "constantName":
"org.apache.camel.component.spiffe.SpiffeConstants#TOKEN" },
+ "CamelSpiffeSpiffeId": { "index": 3, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The SPIFFE ID of the returned SVID.",
"constantName": "org.apache.camel.component.spiffe.SpiffeConstants#SPIFFE_ID" },
+ "CamelSpiffeExpiry": { "index": 4, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"java.util.Date", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The expiry of the returned JWT-SVID.",
"constantName": "org.apache.camel.component.spiffe.SpiffeConstants#EXPIRY" }
+ },
+ "properties": {
+ "label": { "index": 0, "kind": "path", "displayName": "Label", "group":
"producer", "label": "", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "Logical name of the endpoint" },
+ "audience": { "index": 1, "kind": "parameter", "displayName": "Audience",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The comma-separated audience(s) to request for
a JWT-SVID (fetchJwtSvid) or to validate against (validateJwtSvid). Can [...]
+ "operation": { "index": 2, "kind": "parameter", "displayName":
"Operation", "group": "producer", "label": "", "required": false, "type":
"enum", "javaType": "org.apache.camel.component.spiffe.SpiffeOperation",
"enum": [ "fetchX509Svid", "fetchJwtSvid", "validateJwtSvid" ], "deprecated":
false, "autowired": false, "secret": false, "defaultValue": "fetchX509Svid",
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "desc [...]
+ "lazyStartProducer": { "index": 3, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produc [...]
+ "workloadApiClient": { "index": 4, "kind": "parameter", "displayName":
"Workload Api Client", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "io.spiffe.workloadapi.WorkloadApiClient",
"deprecated": false, "deprecationNote": "", "autowired": true, "secret": false,
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "description": "An existing
WorkloadApiClient to use. When set [...]
+ "spiffeSocketPath": { "index": 5, "kind": "parameter", "displayName":
"Spiffe Socket Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The address of the SPIFFE Workload API
endpoint (for example {code unix:\/\/\/tmp\/agent.sock [...]
+ }
+}
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs.properties
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs.properties
index a14b0a06ef36..ff635c831e1e 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs.properties
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs.properties
@@ -585,6 +585,7 @@ soap-dataformat
solr-component
sort-eip
spel-language
+spiffe-component
split-eip
splunk-hec-component
spring-ai-chat-component
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/spiffe-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/spiffe-component.adoc
new file mode 100644
index 000000000000..61eb1bd1009d
--- /dev/null
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/spiffe-component.adoc
@@ -0,0 +1,89 @@
+= SPIFFE Component
+:doctitle: SPIFFE
+:shortname: spiffe
+:artifactid: camel-spiffe
+:description: Fetch and validate SPIFFE workload identity (X.509-SVID and
JWT-SVID) from the SPIFFE Workload API.
+:since: 4.23
+:supportlevel: Preview
+:tabs-sync-option:
+:component-header: Only producer is supported
+
+*Since Camel {since}*
+
+*{component-header}*
+
+The SPIFFE component integrates with the https://spiffe.io/[SPIFFE] (Secure
Production Identity Framework
+For Everyone) Workload API to provide cryptographic workload identity to Camel
routes. It talks to a local
+SPIFFE Workload API endpoint — for example the one exposed by a
https://spiffe.io/docs/latest/spire-about/[SPIRE]
+agent — to fetch and validate SVIDs (SPIFFE Verifiable Identity Documents):
+
+* *X.509-SVID*: an X.509 certificate whose SPIFFE ID is encoded as a URI SAN,
used for mutual TLS.
+* *JWT-SVID*: a JWT whose subject is the SPIFFE ID, used as a bearer token for
workload-to-workload authentication.
+
+Maven users will need to add the following dependency to their `pom.xml`.
+
+[source,xml]
+------------------------------------------------------------
+<dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-spiffe</artifactId>
+ <version>x.x.x</version>
+ <!-- use the same version as your Camel core version -->
+</dependency>
+------------------------------------------------------------
+
+== URI Format
+
+------------------------------------------------------------
+spiffe:label[?options]
+------------------------------------------------------------
+
+Where `label` is a logical name for the endpoint.
+
+// component options: START
+include::partial$component-configure-options.adoc[]
+include::partial$component-endpoint-options.adoc[]
+include::partial$component-endpoint-headers.adoc[]
+// component options: END
+
+== Workload API endpoint
+
+The address of the SPIFFE Workload API is taken from the `spiffeSocketPath`
option, or, when that is not set, from
+the standard `SPIFFE_ENDPOINT_SOCKET` environment variable — for example
`unix:///tmp/spire-agent/public/api.sock`.
+For advanced scenarios an already-configured
`io.spiffe.workloadapi.WorkloadApiClient` can be supplied through the
+`workloadApiClient` option; in that case the component neither creates nor
closes the client.
+
+== Operations
+
+The component supports the following producer operations:
+
+* `fetchX509Svid` — fetches the default X.509-SVID from the Workload API. The
message body is set to the
+`io.spiffe.svid.x509svid.X509Svid` (certificate chain, private key and SPIFFE
ID) and the `CamelSpiffeSpiffeId`
+header to its SPIFFE ID.
+* `fetchJwtSvid` — fetches a JWT-SVID for the configured `audience` (or the
`CamelSpiffeAudience` header). The
+message body is set to the JWT token string, with the `CamelSpiffeSpiffeId`
and `CamelSpiffeExpiry` headers.
+* `validateJwtSvid` — validates the JWT-SVID passed in the `CamelSpiffeToken`
header (or the body) against the
+`audience`. The message body is set to the validated
`io.spiffe.svid.jwtsvid.JwtSvid`.
+
+[NOTE]
+====
+The `fetchX509Svid` and `fetchJwtSvid` operations place sensitive key material
on the message: the `X509Svid`
+carries the workload's private key, and the JWT-SVID is a bearer token. Route
authors are trusted with Exchange
+contents, but you should avoid logging or tracing the message body for these
operations — for example via the
+`log`/`trace` components or the message-history / breadcrumb EIPs — to prevent
accidental disclosure of the key
+or token.
+====
+
+== Example
+
+Fetch a JWT-SVID for an outbound call:
+
+[source,java]
+------------------------------------------------------------
+from("direct:start")
+
.to("spiffe:identity?operation=fetchJwtSvid&audience=spiffe://example.org/backend")
+ .setHeader("Authorization", simple("Bearer ${body}"))
+ .to("http://backend.example.org/api";);
+------------------------------------------------------------
+
+include::spring-boot:partial$starter.adoc[]
diff --git a/components/camel-spiffe/pom.xml b/components/camel-spiffe/pom.xml
new file mode 100644
index 000000000000..17fa6345a0ba
--- /dev/null
+++ b/components/camel-spiffe/pom.xml
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0";
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/maven-v4_0_0.xsd";>
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>components</artifactId>
+ <version>4.23.0-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>camel-spiffe</artifactId>
+ <packaging>jar</packaging>
+
+ <name>Camel :: SPIFFE</name>
+ <description>Camel SPIFFE Workload Identity Component</description>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-support</artifactId>
+ </dependency>
+
+ <dependency>
+ <groupId>io.spiffe</groupId>
+ <artifactId>java-spiffe-core</artifactId>
+ <version>${java-spiffe-version}</version>
+ </dependency>
+
+ <!-- for testing -->
+ <dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-test-junit6</artifactId>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.mockito</groupId>
+ <artifactId>mockito-junit-jupiter</artifactId>
+ <version>${mockito-version}</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.assertj</groupId>
+ <artifactId>assertj-core</artifactId>
+ <version>${assertj-version}</version>
+ <scope>test</scope>
+ </dependency>
+ </dependencies>
+
+</project>
diff --git
a/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeComponentConfigurer.java
b/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeComponentConfigurer.java
new file mode 100644
index 000000000000..67a411d84847
--- /dev/null
+++
b/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeComponentConfigurer.java
@@ -0,0 +1,90 @@
+/* Generated by camel build tools - do NOT edit this file! */
+package org.apache.camel.component.spiffe;
+
+import javax.annotation.processing.Generated;
+import java.util.Map;
+
+import org.apache.camel.CamelContext;
+import org.apache.camel.spi.ExtendedPropertyConfigurerGetter;
+import org.apache.camel.spi.PropertyConfigurerGetter;
+import org.apache.camel.spi.ConfigurerStrategy;
+import org.apache.camel.spi.GeneratedPropertyConfigurer;
+import org.apache.camel.util.CaseInsensitiveMap;
+import org.apache.camel.support.component.PropertyConfigurerSupport;
+
+/**
+ * Generated by camel build tools - do NOT edit this file!
+ */
+@Generated("org.apache.camel.maven.packaging.EndpointSchemaGeneratorMojo")
+@SuppressWarnings("unchecked")
+public class SpiffeComponentConfigurer extends PropertyConfigurerSupport
implements GeneratedPropertyConfigurer, PropertyConfigurerGetter {
+
+ private org.apache.camel.component.spiffe.SpiffeConfiguration
getOrCreateConfiguration(SpiffeComponent target) {
+ if (target.getConfiguration() == null) {
+ target.setConfiguration(new
org.apache.camel.component.spiffe.SpiffeConfiguration());
+ }
+ return target.getConfiguration();
+ }
+
+ @Override
+ public boolean configure(CamelContext camelContext, Object obj, String
name, Object value, boolean ignoreCase) {
+ SpiffeComponent target = (SpiffeComponent) obj;
+ switch (ignoreCase ? name.toLowerCase() : name) {
+ case "audience":
getOrCreateConfiguration(target).setAudience(property(camelContext,
java.lang.String.class, value)); return true;
+ case "autowiredenabled":
+ case "autowiredEnabled":
target.setAutowiredEnabled(property(camelContext, boolean.class, value));
return true;
+ case "configuration": target.setConfiguration(property(camelContext,
org.apache.camel.component.spiffe.SpiffeConfiguration.class, value)); return
true;
+ case "lazystartproducer":
+ case "lazyStartProducer":
target.setLazyStartProducer(property(camelContext, boolean.class, value));
return true;
+ case "operation":
getOrCreateConfiguration(target).setOperation(property(camelContext,
org.apache.camel.component.spiffe.SpiffeOperation.class, value)); return true;
+ case "spiffesocketpath":
+ case "spiffeSocketPath":
getOrCreateConfiguration(target).setSpiffeSocketPath(property(camelContext,
java.lang.String.class, value)); return true;
+ case "workloadapiclient":
+ case "workloadApiClient":
getOrCreateConfiguration(target).setWorkloadApiClient(property(camelContext,
io.spiffe.workloadapi.WorkloadApiClient.class, value)); return true;
+ default: return false;
+ }
+ }
+
+ @Override
+ public String[] getAutowiredNames() {
+ return new String[]{"workloadApiClient"};
+ }
+
+ @Override
+ public Class<?> getOptionType(String name, boolean ignoreCase) {
+ switch (ignoreCase ? name.toLowerCase() : name) {
+ case "audience": return java.lang.String.class;
+ case "autowiredenabled":
+ case "autowiredEnabled": return boolean.class;
+ case "configuration": return
org.apache.camel.component.spiffe.SpiffeConfiguration.class;
+ case "lazystartproducer":
+ case "lazyStartProducer": return boolean.class;
+ case "operation": return
org.apache.camel.component.spiffe.SpiffeOperation.class;
+ case "spiffesocketpath":
+ case "spiffeSocketPath": return java.lang.String.class;
+ case "workloadapiclient":
+ case "workloadApiClient": return
io.spiffe.workloadapi.WorkloadApiClient.class;
+ default: return null;
+ }
+ }
+
+ @Override
+ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
+ SpiffeComponent target = (SpiffeComponent) obj;
+ switch (ignoreCase ? name.toLowerCase() : name) {
+ case "audience": return getOrCreateConfiguration(target).getAudience();
+ case "autowiredenabled":
+ case "autowiredEnabled": return target.isAutowiredEnabled();
+ case "configuration": return target.getConfiguration();
+ case "lazystartproducer":
+ case "lazyStartProducer": return target.isLazyStartProducer();
+ case "operation": return
getOrCreateConfiguration(target).getOperation();
+ case "spiffesocketpath":
+ case "spiffeSocketPath": return
getOrCreateConfiguration(target).getSpiffeSocketPath();
+ case "workloadapiclient":
+ case "workloadApiClient": return
getOrCreateConfiguration(target).getWorkloadApiClient();
+ default: return null;
+ }
+ }
+}
+
diff --git
a/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeEndpointConfigurer.java
b/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeEndpointConfigurer.java
new file mode 100644
index 000000000000..afa1dd20067f
--- /dev/null
+++
b/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeEndpointConfigurer.java
@@ -0,0 +1,74 @@
+/* Generated by camel build tools - do NOT edit this file! */
+package org.apache.camel.component.spiffe;
+
+import javax.annotation.processing.Generated;
+import java.util.Map;
+
+import org.apache.camel.CamelContext;
+import org.apache.camel.spi.ExtendedPropertyConfigurerGetter;
+import org.apache.camel.spi.PropertyConfigurerGetter;
+import org.apache.camel.spi.ConfigurerStrategy;
+import org.apache.camel.spi.GeneratedPropertyConfigurer;
+import org.apache.camel.util.CaseInsensitiveMap;
+import org.apache.camel.support.component.PropertyConfigurerSupport;
+
+/**
+ * Generated by camel build tools - do NOT edit this file!
+ */
+@Generated("org.apache.camel.maven.packaging.EndpointSchemaGeneratorMojo")
+@SuppressWarnings("unchecked")
+public class SpiffeEndpointConfigurer extends PropertyConfigurerSupport
implements GeneratedPropertyConfigurer, PropertyConfigurerGetter {
+
+ @Override
+ public boolean configure(CamelContext camelContext, Object obj, String
name, Object value, boolean ignoreCase) {
+ SpiffeEndpoint target = (SpiffeEndpoint) obj;
+ switch (ignoreCase ? name.toLowerCase() : name) {
+ case "audience":
target.getConfiguration().setAudience(property(camelContext,
java.lang.String.class, value)); return true;
+ case "lazystartproducer":
+ case "lazyStartProducer":
target.setLazyStartProducer(property(camelContext, boolean.class, value));
return true;
+ case "operation":
target.getConfiguration().setOperation(property(camelContext,
org.apache.camel.component.spiffe.SpiffeOperation.class, value)); return true;
+ case "spiffesocketpath":
+ case "spiffeSocketPath":
target.getConfiguration().setSpiffeSocketPath(property(camelContext,
java.lang.String.class, value)); return true;
+ case "workloadapiclient":
+ case "workloadApiClient":
target.getConfiguration().setWorkloadApiClient(property(camelContext,
io.spiffe.workloadapi.WorkloadApiClient.class, value)); return true;
+ default: return false;
+ }
+ }
+
+ @Override
+ public String[] getAutowiredNames() {
+ return new String[]{"workloadApiClient"};
+ }
+
+ @Override
+ public Class<?> getOptionType(String name, boolean ignoreCase) {
+ switch (ignoreCase ? name.toLowerCase() : name) {
+ case "audience": return java.lang.String.class;
+ case "lazystartproducer":
+ case "lazyStartProducer": return boolean.class;
+ case "operation": return
org.apache.camel.component.spiffe.SpiffeOperation.class;
+ case "spiffesocketpath":
+ case "spiffeSocketPath": return java.lang.String.class;
+ case "workloadapiclient":
+ case "workloadApiClient": return
io.spiffe.workloadapi.WorkloadApiClient.class;
+ default: return null;
+ }
+ }
+
+ @Override
+ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
+ SpiffeEndpoint target = (SpiffeEndpoint) obj;
+ switch (ignoreCase ? name.toLowerCase() : name) {
+ case "audience": return target.getConfiguration().getAudience();
+ case "lazystartproducer":
+ case "lazyStartProducer": return target.isLazyStartProducer();
+ case "operation": return target.getConfiguration().getOperation();
+ case "spiffesocketpath":
+ case "spiffeSocketPath": return
target.getConfiguration().getSpiffeSocketPath();
+ case "workloadapiclient":
+ case "workloadApiClient": return
target.getConfiguration().getWorkloadApiClient();
+ default: return null;
+ }
+ }
+}
+
diff --git
a/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeEndpointUriFactory.java
b/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeEndpointUriFactory.java
new file mode 100644
index 000000000000..ad61739085cb
--- /dev/null
+++
b/components/camel-spiffe/src/generated/java/org/apache/camel/component/spiffe/SpiffeEndpointUriFactory.java
@@ -0,0 +1,82 @@
+/* Generated by camel build tools - do NOT edit this file! */
+package org.apache.camel.component.spiffe;
+
+import javax.annotation.processing.Generated;
+import java.net.URISyntaxException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.camel.spi.EndpointUriFactory;
+
+/**
+ * Generated by camel build tools - do NOT edit this file!
+ */
+@Generated("org.apache.camel.maven.packaging.GenerateEndpointUriFactoryMojo")
+public class SpiffeEndpointUriFactory extends
org.apache.camel.support.component.EndpointUriFactorySupport implements
EndpointUriFactory {
+
+ private static final String BASE = ":label";
+
+ private static final Set<String> PROPERTY_NAMES;
+ private static final Set<String> SECRET_PROPERTY_NAMES;
+ private static final Set<String> ENDPOINT_IDENTITY_PROPERTY_NAMES;
+ private static final Map<String, String> MULTI_VALUE_PREFIXES;
+ static {
+ Set<String> props = new HashSet<>(6);
+ props.add("audience");
+ props.add("label");
+ props.add("lazyStartProducer");
+ props.add("operation");
+ props.add("spiffeSocketPath");
+ props.add("workloadApiClient");
+ PROPERTY_NAMES = Collections.unmodifiableSet(props);
+ SECRET_PROPERTY_NAMES = Collections.emptySet();
+ ENDPOINT_IDENTITY_PROPERTY_NAMES = Collections.emptySet();
+ MULTI_VALUE_PREFIXES = Collections.emptyMap();
+ }
+
+ @Override
+ public boolean isEnabled(String scheme) {
+ return "spiffe".equals(scheme);
+ }
+
+ @Override
+ public String buildUri(String scheme, Map<String, Object> properties,
boolean encode) throws URISyntaxException {
+ String syntax = scheme + BASE;
+ String uri = syntax;
+
+ Map<String, Object> copy = new HashMap<>(properties);
+
+ uri = buildPathParameter(syntax, uri, "label", null, false, copy);
+ uri = buildQueryParameters(uri, copy, encode);
+ return uri;
+ }
+
+ @Override
+ public Set<String> propertyNames() {
+ return PROPERTY_NAMES;
+ }
+
+ @Override
+ public Set<String> secretPropertyNames() {
+ return SECRET_PROPERTY_NAMES;
+ }
+
+ @Override
+ public Set<String> endpointIdentityPropertyNames() {
+ return ENDPOINT_IDENTITY_PROPERTY_NAMES;
+ }
+
+ @Override
+ public Map<String, String> multiValuePrefixes() {
+ return MULTI_VALUE_PREFIXES;
+ }
+
+ @Override
+ public boolean isLenientProperties() {
+ return false;
+ }
+}
+
diff --git
a/components/camel-spiffe/src/generated/resources/META-INF/org/apache/camel/component/spiffe/spiffe.json
b/components/camel-spiffe/src/generated/resources/META-INF/org/apache/camel/component/spiffe/spiffe.json
new file mode 100644
index 000000000000..82dc8b9cc87d
--- /dev/null
+++
b/components/camel-spiffe/src/generated/resources/META-INF/org/apache/camel/component/spiffe/spiffe.json
@@ -0,0 +1,50 @@
+{
+ "component": {
+ "kind": "component",
+ "name": "spiffe",
+ "title": "SPIFFE",
+ "description": "Fetch and validate SPIFFE workload identity (X.509-SVID
and JWT-SVID) from the SPIFFE Workload API.",
+ "deprecated": false,
+ "firstVersion": "4.23.0",
+ "label": "security",
+ "javaType": "org.apache.camel.component.spiffe.SpiffeComponent",
+ "supportLevel": "Preview",
+ "groupId": "org.apache.camel",
+ "artifactId": "camel-spiffe",
+ "version": "4.23.0-SNAPSHOT",
+ "scheme": "spiffe",
+ "extendsScheme": "",
+ "syntax": "spiffe:label",
+ "async": false,
+ "api": false,
+ "consumerOnly": false,
+ "producerOnly": true,
+ "lenientProperties": false,
+ "browsable": false,
+ "remote": true
+ },
+ "componentProperties": {
+ "audience": { "index": 0, "kind": "property", "displayName": "Audience",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The comma-separated audience(s) to request for
a JWT-SVID (fetchJwtSvid) or to validate against (validateJwtSvid). Can b [...]
+ "configuration": { "index": 1, "kind": "property", "displayName":
"Configuration", "group": "producer", "label": "", "required": false, "type":
"object", "javaType": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"deprecated": false, "autowired": false, "secret": false, "description": "The
component configuration." },
+ "lazyStartProducer": { "index": 2, "kind": "property", "displayName":
"Lazy Start Producer", "group": "producer", "label": "producer", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": false, "description":
"Whether the producer should be started lazy (on the first message). By
starting lazy you can use this to allow CamelContext and routes to startup in
situations where a producer may otherwise fail [...]
+ "operation": { "index": 3, "kind": "property", "displayName": "Operation",
"group": "producer", "label": "", "required": false, "type": "enum",
"javaType": "org.apache.camel.component.spiffe.SpiffeOperation", "enum": [
"fetchX509Svid", "fetchJwtSvid", "validateJwtSvid" ], "deprecated": false,
"autowired": false, "secret": false, "defaultValue": "fetchX509Svid",
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "descr [...]
+ "autowiredEnabled": { "index": 4, "kind": "property", "displayName":
"Autowired Enabled", "group": "advanced", "label": "advanced", "required":
false, "type": "boolean", "javaType": "boolean", "deprecated": false,
"autowired": false, "secret": false, "defaultValue": true, "description":
"Whether autowiring is enabled. This is used for automatic autowiring options
(the option must be marked as autowired) by looking up in the registry to find
if there is a single instance of matching t [...]
+ "workloadApiClient": { "index": 5, "kind": "property", "displayName":
"Workload Api Client", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "io.spiffe.workloadapi.WorkloadApiClient",
"deprecated": false, "deprecationNote": "", "autowired": true, "secret": false,
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "description": "An existing
WorkloadApiClient to use. When set, [...]
+ "spiffeSocketPath": { "index": 6, "kind": "property", "displayName":
"Spiffe Socket Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The address of the SPIFFE Workload API
endpoint (for example {code unix:\/\/\/tmp\/agent.sock} [...]
+ },
+ "headers": {
+ "CamelSpiffeOperation": { "index": 0, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"org.apache.camel.component.spiffe.SpiffeOperation or String", "deprecated":
false, "deprecationNote": "", "autowired": false, "secret": false,
"description": "Overrides the operation to be used by the producer.",
"constantName": "org.apache.camel.component.spiffe.SpiffeConstants#OPERATION" },
+ "CamelSpiffeAudience": { "index": 1, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The comma-separated audience(s) for the
fetchJwtSvid and validateJwtSvid operations.", "constantName":
"org.apache.camel.component.spiffe.SpiffeConstants#AUDIENCE" },
+ "CamelSpiffeToken": { "index": 2, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The JWT-SVID token to validate, for the
validateJwtSvid operation.", "constantName":
"org.apache.camel.component.spiffe.SpiffeConstants#TOKEN" },
+ "CamelSpiffeSpiffeId": { "index": 3, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"String", "deprecated": false, "deprecationNote": "", "autowired": false,
"secret": false, "description": "The SPIFFE ID of the returned SVID.",
"constantName": "org.apache.camel.component.spiffe.SpiffeConstants#SPIFFE_ID" },
+ "CamelSpiffeExpiry": { "index": 4, "kind": "header", "displayName": "",
"group": "producer", "label": "producer", "required": false, "javaType":
"java.util.Date", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "The expiry of the returned JWT-SVID.",
"constantName": "org.apache.camel.component.spiffe.SpiffeConstants#EXPIRY" }
+ },
+ "properties": {
+ "label": { "index": 0, "kind": "path", "displayName": "Label", "group":
"producer", "label": "", "required": false, "type": "string", "javaType":
"java.lang.String", "deprecated": false, "deprecationNote": "", "autowired":
false, "secret": false, "description": "Logical name of the endpoint" },
+ "audience": { "index": 1, "kind": "parameter", "displayName": "Audience",
"group": "producer", "label": "", "required": false, "type": "string",
"javaType": "java.lang.String", "deprecated": false, "autowired": false,
"secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The comma-separated audience(s) to request for
a JWT-SVID (fetchJwtSvid) or to validate against (validateJwtSvid). Can [...]
+ "operation": { "index": 2, "kind": "parameter", "displayName":
"Operation", "group": "producer", "label": "", "required": false, "type":
"enum", "javaType": "org.apache.camel.component.spiffe.SpiffeOperation",
"enum": [ "fetchX509Svid", "fetchJwtSvid", "validateJwtSvid" ], "deprecated":
false, "autowired": false, "secret": false, "defaultValue": "fetchX509Svid",
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "desc [...]
+ "lazyStartProducer": { "index": 3, "kind": "parameter", "displayName":
"Lazy Start Producer", "group": "producer (advanced)", "label":
"producer,advanced", "required": false, "type": "boolean", "javaType":
"boolean", "deprecated": false, "autowired": false, "secret": false,
"defaultValue": false, "description": "Whether the producer should be started
lazy (on the first message). By starting lazy you can use this to allow
CamelContext and routes to startup in situations where a produc [...]
+ "workloadApiClient": { "index": 4, "kind": "parameter", "displayName":
"Workload Api Client", "group": "advanced", "label": "advanced", "required":
false, "type": "object", "javaType": "io.spiffe.workloadapi.WorkloadApiClient",
"deprecated": false, "deprecationNote": "", "autowired": true, "secret": false,
"configurationClass": "org.apache.camel.component.spiffe.SpiffeConfiguration",
"configurationField": "configuration", "description": "An existing
WorkloadApiClient to use. When set [...]
+ "spiffeSocketPath": { "index": 5, "kind": "parameter", "displayName":
"Spiffe Socket Path", "group": "security", "label": "security", "required":
false, "type": "string", "javaType": "java.lang.String", "deprecated": false,
"autowired": false, "secret": false, "configurationClass":
"org.apache.camel.component.spiffe.SpiffeConfiguration", "configurationField":
"configuration", "description": "The address of the SPIFFE Workload API
endpoint (for example {code unix:\/\/\/tmp\/agent.sock [...]
+ }
+}
diff --git
a/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/component.properties
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/component.properties
new file mode 100644
index 000000000000..e3cc431904c2
--- /dev/null
+++
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/component.properties
@@ -0,0 +1,7 @@
+# Generated by camel build tools - do NOT edit this file!
+components=spiffe
+groupId=org.apache.camel
+artifactId=camel-spiffe
+version=4.23.0-SNAPSHOT
+projectName=Camel :: SPIFFE
+projectDescription=Camel SPIFFE Workload Identity Component
diff --git
a/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/component/spiffe
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/component/spiffe
new file mode 100644
index 000000000000..6a4a6338d286
--- /dev/null
+++
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/component/spiffe
@@ -0,0 +1,2 @@
+# Generated by camel build tools - do NOT edit this file!
+class=org.apache.camel.component.spiffe.SpiffeComponent
diff --git
a/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/configurer/spiffe-component
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/configurer/spiffe-component
new file mode 100644
index 000000000000..66fa92f5c56c
--- /dev/null
+++
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/configurer/spiffe-component
@@ -0,0 +1,2 @@
+# Generated by camel build tools - do NOT edit this file!
+class=org.apache.camel.component.spiffe.SpiffeComponentConfigurer
diff --git
a/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/configurer/spiffe-endpoint
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/configurer/spiffe-endpoint
new file mode 100644
index 000000000000..e080fcce35b4
--- /dev/null
+++
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/configurer/spiffe-endpoint
@@ -0,0 +1,2 @@
+# Generated by camel build tools - do NOT edit this file!
+class=org.apache.camel.component.spiffe.SpiffeEndpointConfigurer
diff --git
a/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/urifactory/spiffe-endpoint
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/urifactory/spiffe-endpoint
new file mode 100644
index 000000000000..65968d36a5c0
--- /dev/null
+++
b/components/camel-spiffe/src/generated/resources/META-INF/services/org/apache/camel/urifactory/spiffe-endpoint
@@ -0,0 +1,2 @@
+# Generated by camel build tools - do NOT edit this file!
+class=org.apache.camel.component.spiffe.SpiffeEndpointUriFactory
diff --git a/components/camel-spiffe/src/main/docs/spiffe-component.adoc
b/components/camel-spiffe/src/main/docs/spiffe-component.adoc
new file mode 100644
index 000000000000..61eb1bd1009d
--- /dev/null
+++ b/components/camel-spiffe/src/main/docs/spiffe-component.adoc
@@ -0,0 +1,89 @@
+= SPIFFE Component
+:doctitle: SPIFFE
+:shortname: spiffe
+:artifactid: camel-spiffe
+:description: Fetch and validate SPIFFE workload identity (X.509-SVID and
JWT-SVID) from the SPIFFE Workload API.
+:since: 4.23
+:supportlevel: Preview
+:tabs-sync-option:
+:component-header: Only producer is supported
+
+*Since Camel {since}*
+
+*{component-header}*
+
+The SPIFFE component integrates with the https://spiffe.io/[SPIFFE] (Secure
Production Identity Framework
+For Everyone) Workload API to provide cryptographic workload identity to Camel
routes. It talks to a local
+SPIFFE Workload API endpoint — for example the one exposed by a
https://spiffe.io/docs/latest/spire-about/[SPIRE]
+agent — to fetch and validate SVIDs (SPIFFE Verifiable Identity Documents):
+
+* *X.509-SVID*: an X.509 certificate whose SPIFFE ID is encoded as a URI SAN,
used for mutual TLS.
+* *JWT-SVID*: a JWT whose subject is the SPIFFE ID, used as a bearer token for
workload-to-workload authentication.
+
+Maven users will need to add the following dependency to their `pom.xml`.
+
+[source,xml]
+------------------------------------------------------------
+<dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-spiffe</artifactId>
+ <version>x.x.x</version>
+ <!-- use the same version as your Camel core version -->
+</dependency>
+------------------------------------------------------------
+
+== URI Format
+
+------------------------------------------------------------
+spiffe:label[?options]
+------------------------------------------------------------
+
+Where `label` is a logical name for the endpoint.
+
+// component options: START
+include::partial$component-configure-options.adoc[]
+include::partial$component-endpoint-options.adoc[]
+include::partial$component-endpoint-headers.adoc[]
+// component options: END
+
+== Workload API endpoint
+
+The address of the SPIFFE Workload API is taken from the `spiffeSocketPath`
option, or, when that is not set, from
+the standard `SPIFFE_ENDPOINT_SOCKET` environment variable — for example
`unix:///tmp/spire-agent/public/api.sock`.
+For advanced scenarios an already-configured
`io.spiffe.workloadapi.WorkloadApiClient` can be supplied through the
+`workloadApiClient` option; in that case the component neither creates nor
closes the client.
+
+== Operations
+
+The component supports the following producer operations:
+
+* `fetchX509Svid` — fetches the default X.509-SVID from the Workload API. The
message body is set to the
+`io.spiffe.svid.x509svid.X509Svid` (certificate chain, private key and SPIFFE
ID) and the `CamelSpiffeSpiffeId`
+header to its SPIFFE ID.
+* `fetchJwtSvid` — fetches a JWT-SVID for the configured `audience` (or the
`CamelSpiffeAudience` header). The
+message body is set to the JWT token string, with the `CamelSpiffeSpiffeId`
and `CamelSpiffeExpiry` headers.
+* `validateJwtSvid` — validates the JWT-SVID passed in the `CamelSpiffeToken`
header (or the body) against the
+`audience`. The message body is set to the validated
`io.spiffe.svid.jwtsvid.JwtSvid`.
+
+[NOTE]
+====
+The `fetchX509Svid` and `fetchJwtSvid` operations place sensitive key material
on the message: the `X509Svid`
+carries the workload's private key, and the JWT-SVID is a bearer token. Route
authors are trusted with Exchange
+contents, but you should avoid logging or tracing the message body for these
operations — for example via the
+`log`/`trace` components or the message-history / breadcrumb EIPs — to prevent
accidental disclosure of the key
+or token.
+====
+
+== Example
+
+Fetch a JWT-SVID for an outbound call:
+
+[source,java]
+------------------------------------------------------------
+from("direct:start")
+
.to("spiffe:identity?operation=fetchJwtSvid&audience=spiffe://example.org/backend")
+ .setHeader("Authorization", simple("Bearer ${body}"))
+ .to("http://backend.example.org/api";);
+------------------------------------------------------------
+
+include::spring-boot:partial$starter.adoc[]
diff --git
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeComponent.java
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeComponent.java
new file mode 100644
index 000000000000..6cbc40fd416f
--- /dev/null
+++
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeComponent.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.spiffe;
+
+import java.util.Map;
+
+import org.apache.camel.CamelContext;
+import org.apache.camel.Endpoint;
+import org.apache.camel.spi.Metadata;
+import org.apache.camel.spi.annotations.Component;
+import org.apache.camel.support.DefaultComponent;
+
+/**
+ * SPIFFE Workload Identity component.
+ */
+@Component("spiffe")
+public class SpiffeComponent extends DefaultComponent {
+
+ @Metadata
+ private SpiffeConfiguration configuration = new SpiffeConfiguration();
+
+ public SpiffeComponent() {
+ }
+
+ public SpiffeComponent(final CamelContext context) {
+ super(context);
+ }
+
+ @Override
+ protected Endpoint createEndpoint(String uri, String remaining,
Map<String, Object> parameters) throws Exception {
+ final SpiffeConfiguration epConfiguration
+ = this.configuration != null ? this.configuration.copy() : new
SpiffeConfiguration();
+
+ final SpiffeEndpoint endpoint = new SpiffeEndpoint(uri, this,
epConfiguration);
+ endpoint.setLabel(remaining);
+ setProperties(endpoint, parameters);
+ return endpoint;
+ }
+
+ /**
+ * The component configuration.
+ */
+ public SpiffeConfiguration getConfiguration() {
+ return configuration;
+ }
+
+ public void setConfiguration(SpiffeConfiguration configuration) {
+ this.configuration = configuration;
+ }
+}
diff --git
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeConfiguration.java
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeConfiguration.java
new file mode 100644
index 000000000000..e19fbe9c5eb3
--- /dev/null
+++
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeConfiguration.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.spiffe;
+
+import io.spiffe.workloadapi.WorkloadApiClient;
+import org.apache.camel.RuntimeCamelException;
+import org.apache.camel.spi.Metadata;
+import org.apache.camel.spi.UriParam;
+import org.apache.camel.spi.UriParams;
+
+@UriParams
+public class SpiffeConfiguration implements Cloneable {
+
+ @UriParam(defaultValue = "fetchX509Svid")
+ private SpiffeOperation operation = SpiffeOperation.fetchX509Svid;
+
+ @UriParam(label = "security")
+ private String spiffeSocketPath;
+
+ @UriParam
+ private String audience;
+
+ @UriParam(label = "advanced",
+ description = "An existing WorkloadApiClient to use. When set,
the component does not"
+ + " create or close its own client and
spiffeSocketPath is ignored.")
+ @Metadata(autowired = true)
+ private WorkloadApiClient workloadApiClient;
+
+ /**
+ * The operation to perform on the SPIFFE Workload API.
+ */
+ public SpiffeOperation getOperation() {
+ return operation;
+ }
+
+ public void setOperation(SpiffeOperation operation) {
+ this.operation = operation;
+ }
+
+ /**
+ * The address of the SPIFFE Workload API endpoint (for example {@code
unix:///tmp/agent.sock} or
+ * {@code tcp://127.0.0.1:8082}). When not set, the {@code
SPIFFE_ENDPOINT_SOCKET} environment variable is used.
+ */
+ public String getSpiffeSocketPath() {
+ return spiffeSocketPath;
+ }
+
+ public void setSpiffeSocketPath(String spiffeSocketPath) {
+ this.spiffeSocketPath = spiffeSocketPath;
+ }
+
+ /**
+ * The comma-separated audience(s) to request for a JWT-SVID
(fetchJwtSvid) or to validate against
+ * (validateJwtSvid). Can be overridden per-message with the {@code
CamelSpiffeAudience} header. Note that
+ * validateJwtSvid validates against a single audience, so when several
comma-separated audiences are given only the
+ * first one is used for validation; fetchJwtSvid requests all of them.
+ */
+ public String getAudience() {
+ return audience;
+ }
+
+ public void setAudience(String audience) {
+ this.audience = audience;
+ }
+
+ /**
+ * An already-configured {@link WorkloadApiClient} to use instead of
letting the endpoint create one.
+ */
+ public WorkloadApiClient getWorkloadApiClient() {
+ return workloadApiClient;
+ }
+
+ public void setWorkloadApiClient(WorkloadApiClient workloadApiClient) {
+ this.workloadApiClient = workloadApiClient;
+ }
+
+ public SpiffeConfiguration copy() {
+ try {
+ return (SpiffeConfiguration) super.clone();
+ } catch (CloneNotSupportedException e) {
+ throw new RuntimeCamelException(e);
+ }
+ }
+}
diff --git
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeConstants.java
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeConstants.java
new file mode 100644
index 000000000000..9091a159efef
--- /dev/null
+++
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeConstants.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.spiffe;
+
+import org.apache.camel.spi.Metadata;
+
+public final class SpiffeConstants {
+ private static final String HEADER_PREFIX = "CamelSpiffe";
+
+ @Metadata(label = "producer", description = "Overrides the operation to be
used by the producer.",
+ javaType = "org.apache.camel.component.spiffe.SpiffeOperation or
String")
+ public static final String OPERATION = HEADER_PREFIX + "Operation";
+
+ @Metadata(label = "producer",
+ description = "The comma-separated audience(s) for the
fetchJwtSvid and validateJwtSvid operations.",
+ javaType = "String")
+ public static final String AUDIENCE = HEADER_PREFIX + "Audience";
+
+ @Metadata(label = "producer", description = "The JWT-SVID token to
validate, for the validateJwtSvid operation.",
+ javaType = "String")
+ public static final String TOKEN = HEADER_PREFIX + "Token";
+
+ @Metadata(label = "producer", description = "The SPIFFE ID of the returned
SVID.", javaType = "String")
+ public static final String SPIFFE_ID = HEADER_PREFIX + "SpiffeId";
+
+ @Metadata(label = "producer", description = "The expiry of the returned
JWT-SVID.", javaType = "java.util.Date")
+ public static final String EXPIRY = HEADER_PREFIX + "Expiry";
+
+ private SpiffeConstants() {
+ }
+}
diff --git
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeEndpoint.java
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeEndpoint.java
new file mode 100644
index 000000000000..03b3f3aed9a9
--- /dev/null
+++
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeEndpoint.java
@@ -0,0 +1,116 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.spiffe;
+
+import io.spiffe.workloadapi.DefaultWorkloadApiClient;
+import io.spiffe.workloadapi.WorkloadApiClient;
+import org.apache.camel.Category;
+import org.apache.camel.Component;
+import org.apache.camel.Consumer;
+import org.apache.camel.Processor;
+import org.apache.camel.Producer;
+import org.apache.camel.spi.Metadata;
+import org.apache.camel.spi.UriEndpoint;
+import org.apache.camel.spi.UriParam;
+import org.apache.camel.spi.UriPath;
+import org.apache.camel.support.DefaultEndpoint;
+import org.apache.camel.util.ObjectHelper;
+
+/**
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID) from
the SPIFFE Workload API.
+ */
+@UriEndpoint(firstVersion = "4.23.0", scheme = "spiffe", title = "SPIFFE",
+ syntax = "spiffe:label", producerOnly = true, category = {
Category.SECURITY },
+ headersClass = SpiffeConstants.class)
+public class SpiffeEndpoint extends DefaultEndpoint {
+
+ @UriPath(description = "Logical name of the endpoint")
+ @Metadata(required = false)
+ private String label;
+
+ @UriParam
+ private SpiffeConfiguration configuration;
+
+ private WorkloadApiClient workloadApiClient;
+ private boolean ownClient;
+
+ public SpiffeEndpoint(final String uri, final Component component, final
SpiffeConfiguration configuration) {
+ super(uri, component);
+ this.configuration = configuration;
+ }
+
+ @Override
+ protected void doStart() throws Exception {
+ super.doStart();
+ if (configuration.getWorkloadApiClient() != null) {
+ workloadApiClient = configuration.getWorkloadApiClient();
+ ownClient = false;
+ } else if
(ObjectHelper.isNotEmpty(configuration.getSpiffeSocketPath())) {
+ workloadApiClient = DefaultWorkloadApiClient.newClient(
+ DefaultWorkloadApiClient.ClientOptions.builder()
+
.spiffeSocketPath(configuration.getSpiffeSocketPath())
+ .build());
+ ownClient = true;
+ } else {
+ // uses the SPIFFE_ENDPOINT_SOCKET environment variable
+ workloadApiClient = DefaultWorkloadApiClient.newClient();
+ ownClient = true;
+ }
+ }
+
+ @Override
+ protected void doStop() throws Exception {
+ if (ownClient && workloadApiClient != null) {
+ workloadApiClient.close();
+ }
+ workloadApiClient = null;
+ super.doStop();
+ }
+
+ @Override
+ public Producer createProducer() throws Exception {
+ return new SpiffeProducer(this);
+ }
+
+ @Override
+ public Consumer createConsumer(Processor processor) throws Exception {
+ throw new UnsupportedOperationException("Consumer not supported");
+ }
+
+ public String getLabel() {
+ return label;
+ }
+
+ public void setLabel(String label) {
+ this.label = label;
+ }
+
+ /**
+ * The endpoint configuration.
+ */
+ public SpiffeConfiguration getConfiguration() {
+ return configuration;
+ }
+
+ public void setConfiguration(SpiffeConfiguration configuration) {
+ this.configuration = configuration;
+ }
+
+ public WorkloadApiClient getWorkloadApiClient() {
+ return workloadApiClient;
+ }
+}
diff --git
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeOperation.java
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeOperation.java
new file mode 100644
index 000000000000..8d66bb7506b4
--- /dev/null
+++
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeOperation.java
@@ -0,0 +1,23 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.spiffe;
+
+public enum SpiffeOperation {
+ fetchX509Svid,
+ fetchJwtSvid,
+ validateJwtSvid
+}
diff --git
a/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeProducer.java
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeProducer.java
new file mode 100644
index 000000000000..f66c2f16df06
--- /dev/null
+++
b/components/camel-spiffe/src/main/java/org/apache/camel/component/spiffe/SpiffeProducer.java
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.spiffe;
+
+import java.util.Arrays;
+
+import io.spiffe.svid.jwtsvid.JwtSvid;
+import io.spiffe.svid.x509svid.X509Svid;
+import io.spiffe.workloadapi.WorkloadApiClient;
+import org.apache.camel.Exchange;
+import org.apache.camel.Message;
+import org.apache.camel.support.DefaultProducer;
+import org.apache.camel.util.ObjectHelper;
+
+public class SpiffeProducer extends DefaultProducer {
+
+ public SpiffeProducer(final SpiffeEndpoint endpoint) {
+ super(endpoint);
+ }
+
+ @Override
+ public SpiffeEndpoint getEndpoint() {
+ return (SpiffeEndpoint) super.getEndpoint();
+ }
+
+ @Override
+ public void process(Exchange exchange) throws Exception {
+ final WorkloadApiClient client = getEndpoint().getWorkloadApiClient();
+ switch (determineOperation(exchange)) {
+ case fetchX509Svid -> fetchX509Svid(client, exchange);
+ case fetchJwtSvid -> fetchJwtSvid(client, exchange);
+ case validateJwtSvid -> validateJwtSvid(client, exchange);
+ default -> throw new IllegalArgumentException("Unsupported
operation");
+ }
+ }
+
+ private void fetchX509Svid(WorkloadApiClient client, Exchange exchange)
throws Exception {
+ X509Svid svid = client.fetchX509Context().getDefaultSvid();
+ Message message = getMessageForResponse(exchange);
+ message.setBody(svid);
+ message.setHeader(SpiffeConstants.SPIFFE_ID,
svid.getSpiffeId().toString());
+ }
+
+ private void fetchJwtSvid(WorkloadApiClient client, Exchange exchange)
throws Exception {
+ String[] audiences = resolveAudiences(exchange);
+ JwtSvid svid = audiences.length > 1
+ ? client.fetchJwtSvid(audiences[0],
Arrays.copyOfRange(audiences, 1, audiences.length))
+ : client.fetchJwtSvid(audiences[0]);
+ Message message = getMessageForResponse(exchange);
+ message.setBody(svid.getToken());
+ message.setHeader(SpiffeConstants.SPIFFE_ID,
svid.getSpiffeId().toString());
+ message.setHeader(SpiffeConstants.EXPIRY, svid.getExpiry());
+ }
+
+ private void validateJwtSvid(WorkloadApiClient client, Exchange exchange)
throws Exception {
+ String token = exchange.getIn().getHeader(SpiffeConstants.TOKEN,
String.class);
+ if (ObjectHelper.isEmpty(token)) {
+ token = exchange.getIn().getBody(String.class);
+ }
+ if (ObjectHelper.isEmpty(token)) {
+ throw new IllegalArgumentException(
+ "A JWT-SVID token is required for validateJwtSvid (set the
CamelSpiffeToken header or the body)");
+ }
+ String[] audiences = resolveAudiences(exchange);
+ JwtSvid svid = client.validateJwtSvid(token, audiences[0]);
+ Message message = getMessageForResponse(exchange);
+ message.setBody(svid);
+ message.setHeader(SpiffeConstants.SPIFFE_ID,
svid.getSpiffeId().toString());
+ }
+
+ private SpiffeOperation determineOperation(Exchange exchange) {
+ SpiffeOperation operation
+ = exchange.getIn().getHeader(SpiffeConstants.OPERATION,
SpiffeOperation.class);
+ return operation != null ? operation :
getEndpoint().getConfiguration().getOperation();
+ }
+
+ private String[] resolveAudiences(Exchange exchange) {
+ String audience = exchange.getIn().getHeader(SpiffeConstants.AUDIENCE,
String.class);
+ if (ObjectHelper.isEmpty(audience)) {
+ audience = getEndpoint().getConfiguration().getAudience();
+ }
+ if (ObjectHelper.isEmpty(audience)) {
+ throw new IllegalArgumentException(
+ "At least one audience is required (set the audience
option or the CamelSpiffeAudience header)");
+ }
+ String[] parts = Arrays.stream(audience.split(","))
+ .map(String::trim)
+ .filter(s -> !s.isEmpty())
+ .toArray(String[]::new);
+ if (parts.length == 0) {
+ throw new IllegalArgumentException(
+ "At least one non-blank audience is required (set the
audience option or the CamelSpiffeAudience header)");
+ }
+ return parts;
+ }
+
+ private static Message getMessageForResponse(Exchange exchange) {
+ return exchange.getMessage();
+ }
+}
diff --git
a/components/camel-spiffe/src/test/java/org/apache/camel/component/spiffe/SpiffeProducerTest.java
b/components/camel-spiffe/src/test/java/org/apache/camel/component/spiffe/SpiffeProducerTest.java
new file mode 100644
index 000000000000..2f05a90163a4
--- /dev/null
+++
b/components/camel-spiffe/src/test/java/org/apache/camel/component/spiffe/SpiffeProducerTest.java
@@ -0,0 +1,149 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.spiffe;
+
+import java.util.Date;
+
+import io.spiffe.spiffeid.SpiffeId;
+import io.spiffe.svid.jwtsvid.JwtSvid;
+import io.spiffe.svid.x509svid.X509Svid;
+import io.spiffe.workloadapi.WorkloadApiClient;
+import io.spiffe.workloadapi.X509Context;
+import org.apache.camel.BindToRegistry;
+import org.apache.camel.Exchange;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+class SpiffeProducerTest extends CamelTestSupport {
+
+ @BindToRegistry("client")
+ private final WorkloadApiClient client = mock(WorkloadApiClient.class);
+
+ private SpiffeId spiffeId(String id) {
+ SpiffeId spiffeId = mock(SpiffeId.class);
+ when(spiffeId.toString()).thenReturn(id);
+ return spiffeId;
+ }
+
+ @Test
+ void fetchX509Svid() throws Exception {
+ SpiffeId id = spiffeId("spiffe://example.org/workload");
+ X509Svid svid = mock(X509Svid.class);
+ when(svid.getSpiffeId()).thenReturn(id);
+ X509Context ctx = mock(X509Context.class);
+ when(ctx.getDefaultSvid()).thenReturn(svid);
+ when(client.fetchX509Context()).thenReturn(ctx);
+
+ Exchange out =
template.request("spiffe:test?workloadApiClient=#client&operation=fetchX509Svid",
e -> {
+ });
+
+ assertThat(out.getMessage().getBody()).isSameAs(svid);
+
assertThat(out.getMessage().getHeader(SpiffeConstants.SPIFFE_ID)).isEqualTo("spiffe://example.org/workload");
+ }
+
+ @Test
+ void fetchJwtSvid() throws Exception {
+ SpiffeId id = spiffeId("spiffe://example.org/workload");
+ Date expiry = new Date();
+ JwtSvid svid = mock(JwtSvid.class);
+ when(svid.getToken()).thenReturn("the-jwt-token");
+ when(svid.getSpiffeId()).thenReturn(id);
+ when(svid.getExpiry()).thenReturn(expiry);
+ when(client.fetchJwtSvid("my-audience")).thenReturn(svid);
+
+ Exchange out = template.request(
+
"spiffe:test?workloadApiClient=#client&operation=fetchJwtSvid&audience=my-audience",
e -> {
+ });
+
+
assertThat(out.getMessage().getBody(String.class)).isEqualTo("the-jwt-token");
+
assertThat(out.getMessage().getHeader(SpiffeConstants.SPIFFE_ID)).isEqualTo("spiffe://example.org/workload");
+
assertThat(out.getMessage().getHeader(SpiffeConstants.EXPIRY)).isEqualTo(expiry);
+ }
+
+ @Test
+ void fetchJwtSvidAudienceFromHeader() throws Exception {
+ SpiffeId id = spiffeId("spiffe://example.org/workload");
+ JwtSvid svid = mock(JwtSvid.class);
+ when(svid.getToken()).thenReturn("tok");
+ when(svid.getSpiffeId()).thenReturn(id);
+ when(client.fetchJwtSvid("aud-from-header")).thenReturn(svid);
+
+ Exchange out =
template.request("spiffe:test?workloadApiClient=#client&operation=fetchJwtSvid",
+ e -> e.getIn().setHeader(SpiffeConstants.AUDIENCE,
"aud-from-header"));
+
+ assertThat(out.getMessage().getBody(String.class)).isEqualTo("tok");
+ }
+
+ @Test
+ void validateJwtSvid() throws Exception {
+ SpiffeId id = spiffeId("spiffe://example.org/client");
+ JwtSvid svid = mock(JwtSvid.class);
+ when(svid.getSpiffeId()).thenReturn(id);
+ when(client.validateJwtSvid("incoming-token",
"my-audience")).thenReturn(svid);
+
+ Exchange out = template.request(
+
"spiffe:test?workloadApiClient=#client&operation=validateJwtSvid&audience=my-audience",
+ e -> e.getIn().setHeader(SpiffeConstants.TOKEN,
"incoming-token"));
+
+ assertThat(out.getMessage().getBody()).isSameAs(svid);
+
assertThat(out.getMessage().getHeader(SpiffeConstants.SPIFFE_ID)).isEqualTo("spiffe://example.org/client");
+ }
+
+ @Test
+ void fetchJwtSvidWithoutAudienceFails() {
+ Exchange out =
template.request("spiffe:test?workloadApiClient=#client&operation=fetchJwtSvid",
e -> {
+ });
+ assertThat(out.isFailed()).isTrue();
+
assertThat(out.getException()).isInstanceOf(IllegalArgumentException.class);
+ }
+
+ @Test
+ void fetchJwtSvidMultipleAudiences() throws Exception {
+ SpiffeId id = spiffeId("spiffe://example.org/workload");
+ JwtSvid svid = mock(JwtSvid.class);
+ when(svid.getToken()).thenReturn("multi-tok");
+ when(svid.getSpiffeId()).thenReturn(id);
+ // the additional audiences are passed as varargs after the first one;
the comma-separated
+ // header value is split and trimmed by the producer, and blank
entries (the ", ," below) are dropped
+ when(client.fetchJwtSvid("aud1", "aud2", "aud3")).thenReturn(svid);
+
+ Exchange out =
template.request("spiffe:test?workloadApiClient=#client&operation=fetchJwtSvid",
+ e -> e.getIn().setHeader(SpiffeConstants.AUDIENCE, "aud1, ,
aud2, aud3"));
+
+
assertThat(out.getMessage().getBody(String.class)).isEqualTo("multi-tok");
+ }
+
+ @Test
+ void validateJwtSvidTokenFromBody() throws Exception {
+ SpiffeId id = spiffeId("spiffe://example.org/client");
+ JwtSvid svid = mock(JwtSvid.class);
+ when(svid.getSpiffeId()).thenReturn(id);
+ when(client.validateJwtSvid("body-token",
"my-audience")).thenReturn(svid);
+
+ // no CamelSpiffeToken header -> the producer falls back to the
message body
+ Exchange out = template.request(
+
"spiffe:test?workloadApiClient=#client&operation=validateJwtSvid&audience=my-audience",
+ e -> e.getIn().setBody("body-token"));
+
+ assertThat(out.getMessage().getBody()).isSameAs(svid);
+
assertThat(out.getMessage().getHeader(SpiffeConstants.SPIFFE_ID)).isEqualTo("spiffe://example.org/client");
+ }
+}
diff --git a/components/pom.xml b/components/pom.xml
index 83ca8890067b..7f0d30b7f8a3 100644
--- a/components/pom.xml
+++ b/components/pom.xml
@@ -301,6 +301,7 @@
<module>camel-snmp</module>
<module>camel-soap</module>
<module>camel-solr</module>
+ <module>camel-spiffe</module>
<module>camel-splunk-hec</module>
<module>camel-sql</module>
<module>camel-ssh</module>
diff --git
a/core/camel-main/src/generated/resources/org/apache/camel/main/components.properties
b/core/camel-main/src/generated/resources/org/apache/camel/main/components.properties
index b65ac00d9785..e763efdc2303 100644
---
a/core/camel-main/src/generated/resources/org/apache/camel/main/components.properties
+++
b/core/camel-main/src/generated/resources/org/apache/camel/main/components.properties
@@ -341,6 +341,7 @@ smtp
smtps
snmp
solr
+spiffe
splunk-hec
spring-ai-chat
spring-ai-embeddings
diff --git a/docs/components/modules/ROOT/examples/json/spiffe.json
b/docs/components/modules/ROOT/examples/json/spiffe.json
new file mode 120000
index 000000000000..5a8af5a4caf0
--- /dev/null
+++ b/docs/components/modules/ROOT/examples/json/spiffe.json
@@ -0,0 +1 @@
+../../../../../../components/camel-spiffe/src/generated/resources/META-INF/org/apache/camel/component/spiffe/spiffe.json
\ No newline at end of file
diff --git a/docs/components/modules/ROOT/nav.adoc
b/docs/components/modules/ROOT/nav.adoc
index 96a0625b52e0..b2268e075fe0 100644
--- a/docs/components/modules/ROOT/nav.adoc
+++ b/docs/components/modules/ROOT/nav.adoc
@@ -356,6 +356,7 @@
** xref:smpp-component.adoc[SMPP]
** xref:snmp-component.adoc[SNMP]
** xref:solr-component.adoc[Solr]
+** xref:spiffe-component.adoc[SPIFFE]
** xref:splunk-hec-component.adoc[Splunk HEC]
** xref:spring-summary.adoc[Spring]
*** xref:spring-batch-component.adoc[Spring Batch]
diff --git a/docs/components/modules/ROOT/pages/spiffe-component.adoc
b/docs/components/modules/ROOT/pages/spiffe-component.adoc
new file mode 120000
index 000000000000..07c7a874240c
--- /dev/null
+++ b/docs/components/modules/ROOT/pages/spiffe-component.adoc
@@ -0,0 +1 @@
+../../../../../components/camel-spiffe/src/main/docs/spiffe-component.adoc
\ No newline at end of file
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/ComponentsBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/ComponentsBuilderFactory.java
index bb1d23e71d3e..8b309c3d2a11 100644
---
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/ComponentsBuilderFactory.java
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/ComponentsBuilderFactory.java
@@ -4608,6 +4608,20 @@ public interface ComponentsBuilderFactory {
static SolrComponentBuilderFactory.SolrComponentBuilder solr() {
return SolrComponentBuilderFactory.solr();
}
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * @return the dsl builder
+ */
+ static SpiffeComponentBuilderFactory.SpiffeComponentBuilder spiffe() {
+ return SpiffeComponentBuilderFactory.spiffe();
+ }
/**
* Splunk HEC (camel-splunk-hec)
* The splunk component allows publishing events in Splunk using the HTTP
diff --git
a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/SpiffeComponentBuilderFactory.java
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/SpiffeComponentBuilderFactory.java
new file mode 100644
index 000000000000..f5a35a3bd920
--- /dev/null
+++
b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/SpiffeComponentBuilderFactory.java
@@ -0,0 +1,222 @@
+/* Generated by camel build tools - do NOT edit this file! */
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.builder.component.dsl;
+
+import javax.annotation.processing.Generated;
+import org.apache.camel.Component;
+import org.apache.camel.builder.component.AbstractComponentBuilder;
+import org.apache.camel.builder.component.ComponentBuilder;
+import org.apache.camel.component.spiffe.SpiffeComponent;
+
+/**
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID) from
+ * the SPIFFE Workload API.
+ *
+ * Generated by camel build tools - do NOT edit this file!
+ */
+@Generated("org.apache.camel.maven.packaging.ComponentDslMojo")
+public interface SpiffeComponentBuilderFactory {
+
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * @return the dsl builder
+ */
+ static SpiffeComponentBuilder spiffe() {
+ return new SpiffeComponentBuilderImpl();
+ }
+
+ /**
+ * Builder for the SPIFFE component.
+ */
+ interface SpiffeComponentBuilder extends ComponentBuilder<SpiffeComponent>
{
+
+ /**
+ * The comma-separated audience(s) to request for a JWT-SVID
+ * (fetchJwtSvid) or to validate against (validateJwtSvid). Can be
+ * overridden per-message with the CamelSpiffeAudience header. Note
that
+ * validateJwtSvid validates against a single audience, so when several
+ * comma-separated audiences are given only the first one is used for
+ * validation; fetchJwtSvid requests all of them.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: producer
+ *
+ * @param audience the value to set
+ * @return the dsl builder
+ */
+ default SpiffeComponentBuilder audience(java.lang.String audience) {
+ doSetProperty("audience", audience);
+ return this;
+ }
+
+ /**
+ * The component configuration.
+ *
+ * The option is a:
+ *
<code>org.apache.camel.component.spiffe.SpiffeConfiguration</code>
type.
+ *
+ * Group: producer
+ *
+ * @param configuration the value to set
+ * @return the dsl builder
+ */
+ default SpiffeComponentBuilder
configuration(org.apache.camel.component.spiffe.SpiffeConfiguration
configuration) {
+ doSetProperty("configuration", configuration);
+ return this;
+ }
+
+
+ /**
+ * Whether the producer should be started lazy (on the first message).
+ * By starting lazy you can use this to allow CamelContext and routes
to
+ * startup in situations where a producer may otherwise fail during
+ * starting and cause the route to fail being started. By deferring
this
+ * startup to be lazy then the startup failure can be handled during
+ * routing messages via Camel's routing error handlers. Beware that
when
+ * the first message is processed then creating and starting the
+ * producer may take a little time and prolong the total processing
time
+ * of the processing.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: producer
+ *
+ * @param lazyStartProducer the value to set
+ * @return the dsl builder
+ */
+ default SpiffeComponentBuilder lazyStartProducer(boolean
lazyStartProducer) {
+ doSetProperty("lazyStartProducer", lazyStartProducer);
+ return this;
+ }
+
+
+ /**
+ * The operation to perform on the SPIFFE Workload API.
+ *
+ * The option is a:
+ *
<code>org.apache.camel.component.spiffe.SpiffeOperation</code> type.
+ *
+ * Default: fetchX509Svid
+ * Group: producer
+ *
+ * @param operation the value to set
+ * @return the dsl builder
+ */
+ default SpiffeComponentBuilder
operation(org.apache.camel.component.spiffe.SpiffeOperation operation) {
+ doSetProperty("operation", operation);
+ return this;
+ }
+
+
+ /**
+ * Whether autowiring is enabled. This is used for automatic autowiring
+ * options (the option must be marked as autowired) by looking up in
the
+ * registry to find if there is a single instance of matching type,
+ * which then gets configured on the component. This can be used for
+ * automatic configuring JDBC data sources, JMS connection factories,
+ * AWS Clients, etc.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: true
+ * Group: advanced
+ *
+ * @param autowiredEnabled the value to set
+ * @return the dsl builder
+ */
+ default SpiffeComponentBuilder autowiredEnabled(boolean
autowiredEnabled) {
+ doSetProperty("autowiredEnabled", autowiredEnabled);
+ return this;
+ }
+
+ /**
+ * An existing WorkloadApiClient to use. When set, the component does
+ * not create or close its own client and spiffeSocketPath is ignored.
+ *
+ * The option is a:
+ * <code>io.spiffe.workloadapi.WorkloadApiClient</code>
+ * type.
+ *
+ * Group: advanced
+ *
+ * @param workloadApiClient the value to set
+ * @return the dsl builder
+ */
+ default SpiffeComponentBuilder
workloadApiClient(io.spiffe.workloadapi.WorkloadApiClient workloadApiClient) {
+ doSetProperty("workloadApiClient", workloadApiClient);
+ return this;
+ }
+
+ /**
+ * The address of the SPIFFE Workload API endpoint (for example {code
+ * unix:///tmp/agent.sock} or {code tcp://127.0.0.1:8082}). When not
+ * set, the SPIFFE_ENDPOINT_SOCKET environment variable is used.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param spiffeSocketPath the value to set
+ * @return the dsl builder
+ */
+ default SpiffeComponentBuilder spiffeSocketPath(java.lang.String
spiffeSocketPath) {
+ doSetProperty("spiffeSocketPath", spiffeSocketPath);
+ return this;
+ }
+ }
+
+ class SpiffeComponentBuilderImpl
+ extends AbstractComponentBuilder<SpiffeComponent>
+ implements SpiffeComponentBuilder {
+ @Override
+ protected SpiffeComponent buildConcreteComponent() {
+ return new SpiffeComponent();
+ }
+ private org.apache.camel.component.spiffe.SpiffeConfiguration
getOrCreateConfiguration(SpiffeComponent component) {
+ if (component.getConfiguration() == null) {
+ component.setConfiguration(new
org.apache.camel.component.spiffe.SpiffeConfiguration());
+ }
+ return component.getConfiguration();
+ }
+ @Override
+ protected boolean setPropertyOnComponent(
+ Component component,
+ String name,
+ Object value) {
+ switch (name) {
+ case "audience": getOrCreateConfiguration((SpiffeComponent)
component).setAudience((java.lang.String) value); return true;
+ case "configuration": ((SpiffeComponent)
component).setConfiguration((org.apache.camel.component.spiffe.SpiffeConfiguration)
value); return true;
+ case "lazyStartProducer": ((SpiffeComponent)
component).setLazyStartProducer((boolean) value); return true;
+ case "operation": getOrCreateConfiguration((SpiffeComponent)
component).setOperation((org.apache.camel.component.spiffe.SpiffeOperation)
value); return true;
+ case "autowiredEnabled": ((SpiffeComponent)
component).setAutowiredEnabled((boolean) value); return true;
+ case "workloadApiClient":
getOrCreateConfiguration((SpiffeComponent)
component).setWorkloadApiClient((io.spiffe.workloadapi.WorkloadApiClient)
value); return true;
+ case "spiffeSocketPath":
getOrCreateConfiguration((SpiffeComponent)
component).setSpiffeSocketPath((java.lang.String) value); return true;
+ default: return false;
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilderFactory.java
index dee82feca50e..afcf9637b588 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilderFactory.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilderFactory.java
@@ -349,6 +349,7 @@ public interface EndpointBuilderFactory
org.apache.camel.builder.endpoint.dsl.SnmpEndpointBuilderFactory.SnmpBuilders,
org.apache.camel.builder.endpoint.dsl.Sns2EndpointBuilderFactory.Sns2Builders,
org.apache.camel.builder.endpoint.dsl.SolrEndpointBuilderFactory.SolrBuilders,
+
org.apache.camel.builder.endpoint.dsl.SpiffeEndpointBuilderFactory.SpiffeBuilders,
org.apache.camel.builder.endpoint.dsl.SplunkHECEndpointBuilderFactory.SplunkHECBuilders,
org.apache.camel.builder.endpoint.dsl.SpringAiChatEndpointBuilderFactory.SpringAiChatBuilders,
org.apache.camel.builder.endpoint.dsl.SpringAiEmbeddingsEndpointBuilderFactory.SpringAiEmbeddingsBuilders,
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilders.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilders.java
index ba9959f47e27..e542df33d6e7 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilders.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointBuilders.java
@@ -346,6 +346,7 @@ public interface EndpointBuilders
org.apache.camel.builder.endpoint.dsl.SnmpEndpointBuilderFactory,
org.apache.camel.builder.endpoint.dsl.Sns2EndpointBuilderFactory,
org.apache.camel.builder.endpoint.dsl.SolrEndpointBuilderFactory,
+ org.apache.camel.builder.endpoint.dsl.SpiffeEndpointBuilderFactory,
org.apache.camel.builder.endpoint.dsl.SplunkHECEndpointBuilderFactory,
org.apache.camel.builder.endpoint.dsl.SpringAiChatEndpointBuilderFactory,
org.apache.camel.builder.endpoint.dsl.SpringAiEmbeddingsEndpointBuilderFactory,
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointHeaderBuilders.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointHeaderBuilders.java
index b4a692b9e4f4..6a742870d0d2 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointHeaderBuilders.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/EndpointHeaderBuilders.java
@@ -3510,6 +3510,20 @@ public class EndpointHeaderBuilders {
public static SolrEndpointBuilderFactory.SolrHeaderNameBuilder solr() {
return SolrEndpointBuilderFactory.SolrHeaderNameBuilder.INSTANCE;
}
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * @return the dsl builder for the headers' name.
+ */
+ public static SpiffeEndpointBuilderFactory.SpiffeHeaderNameBuilder
spiffe() {
+ return SpiffeEndpointBuilderFactory.SpiffeHeaderNameBuilder.INSTANCE;
+ }
/**
* Splunk HEC (camel-splunk-hec)
* The splunk component allows publishing events in Splunk using the HTTP
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/StaticEndpointBuilders.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/StaticEndpointBuilders.java
index 3e8f7dc5cf0f..74ec4d16bca6 100644
---
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/StaticEndpointBuilders.java
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/StaticEndpointBuilders.java
@@ -15385,6 +15385,48 @@ public class StaticEndpointBuilders {
public static SolrEndpointBuilderFactory.SolrEndpointBuilder solr(String
componentName, String path) {
return SolrEndpointBuilderFactory.endpointBuilder(componentName, path);
}
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * Syntax: <code>spiffe:label</code>
+ *
+ * Path parameter: label
+ * Logical name of the endpoint
+ *
+ * @param path label
+ * @return the dsl builder
+ */
+ public static SpiffeEndpointBuilderFactory.SpiffeEndpointBuilder
spiffe(String path) {
+ return spiffe("spiffe", path);
+ }
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * Syntax: <code>spiffe:label</code>
+ *
+ * Path parameter: label
+ * Logical name of the endpoint
+ *
+ * @param componentName to use a custom component name for the endpoint
+ * instead of the default name
+ * @param path label
+ * @return the dsl builder
+ */
+ public static SpiffeEndpointBuilderFactory.SpiffeEndpointBuilder
spiffe(String componentName, String path) {
+ return SpiffeEndpointBuilderFactory.endpointBuilder(componentName,
path);
+ }
/**
* Splunk HEC (camel-splunk-hec)
* The splunk component allows publishing events in Splunk using the HTTP
diff --git
a/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/SpiffeEndpointBuilderFactory.java
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/SpiffeEndpointBuilderFactory.java
new file mode 100644
index 000000000000..b24adceb3542
--- /dev/null
+++
b/dsl/camel-endpointdsl/src/generated/java/org/apache/camel/builder/endpoint/dsl/SpiffeEndpointBuilderFactory.java
@@ -0,0 +1,347 @@
+/* Generated by camel build tools - do NOT edit this file! */
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.builder.endpoint.dsl;
+
+import java.util.*;
+import java.util.concurrent.*;
+import java.util.function.*;
+import java.util.stream.*;
+import javax.annotation.processing.Generated;
+import org.apache.camel.builder.EndpointConsumerBuilder;
+import org.apache.camel.builder.EndpointProducerBuilder;
+import org.apache.camel.builder.endpoint.AbstractEndpointBuilder;
+
+/**
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID) from
+ * the SPIFFE Workload API.
+ *
+ * Generated by camel build tools - do NOT edit this file!
+ */
+@Generated("org.apache.camel.maven.packaging.EndpointDslMojo")
+public interface SpiffeEndpointBuilderFactory {
+
+ /**
+ * Builder for endpoint for the SPIFFE component.
+ */
+ public interface SpiffeEndpointBuilder
+ extends
+ EndpointProducerBuilder {
+ default AdvancedSpiffeEndpointBuilder advanced() {
+ return (AdvancedSpiffeEndpointBuilder) this;
+ }
+
+ /**
+ * The comma-separated audience(s) to request for a JWT-SVID
+ * (fetchJwtSvid) or to validate against (validateJwtSvid). Can be
+ * overridden per-message with the CamelSpiffeAudience header. Note
that
+ * validateJwtSvid validates against a single audience, so when several
+ * comma-separated audiences are given only the first one is used for
+ * validation; fetchJwtSvid requests all of them.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: producer
+ *
+ * @param audience the value to set
+ * @return the dsl builder
+ */
+ default SpiffeEndpointBuilder audience(String audience) {
+ doSetProperty("audience", audience);
+ return this;
+ }
+ /**
+ * The operation to perform on the SPIFFE Workload API.
+ *
+ * The option is a:
+ * <code>org.apache.camel.component.spiffe.SpiffeOperation</code> type.
+ *
+ * Default: fetchX509Svid
+ * Group: producer
+ *
+ * @param operation the value to set
+ * @return the dsl builder
+ */
+ default SpiffeEndpointBuilder
operation(org.apache.camel.component.spiffe.SpiffeOperation operation) {
+ doSetProperty("operation", operation);
+ return this;
+ }
+ /**
+ * The operation to perform on the SPIFFE Workload API.
+ *
+ * The option will be converted to a
+ * <code>org.apache.camel.component.spiffe.SpiffeOperation</code> type.
+ *
+ * Default: fetchX509Svid
+ * Group: producer
+ *
+ * @param operation the value to set
+ * @return the dsl builder
+ */
+ default SpiffeEndpointBuilder operation(String operation) {
+ doSetProperty("operation", operation);
+ return this;
+ }
+ /**
+ * The address of the SPIFFE Workload API endpoint (for example {code
+ * unix:///tmp/agent.sock} or {code tcp://127.0.0.1:8082}). When not
+ * set, the SPIFFE_ENDPOINT_SOCKET environment variable is used.
+ *
+ * The option is a: <code>java.lang.String</code> type.
+ *
+ * Group: security
+ *
+ * @param spiffeSocketPath the value to set
+ * @return the dsl builder
+ */
+ default SpiffeEndpointBuilder spiffeSocketPath(String
spiffeSocketPath) {
+ doSetProperty("spiffeSocketPath", spiffeSocketPath);
+ return this;
+ }
+ }
+
+ /**
+ * Advanced builder for endpoint for the SPIFFE component.
+ */
+ public interface AdvancedSpiffeEndpointBuilder
+ extends
+ EndpointProducerBuilder {
+ default SpiffeEndpointBuilder basic() {
+ return (SpiffeEndpointBuilder) this;
+ }
+
+ /**
+ * Whether the producer should be started lazy (on the first message).
+ * By starting lazy you can use this to allow CamelContext and routes
to
+ * startup in situations where a producer may otherwise fail during
+ * starting and cause the route to fail being started. By deferring
this
+ * startup to be lazy then the startup failure can be handled during
+ * routing messages via Camel's routing error handlers. Beware that
when
+ * the first message is processed then creating and starting the
+ * producer may take a little time and prolong the total processing
time
+ * of the processing.
+ *
+ * The option is a: <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: producer (advanced)
+ *
+ * @param lazyStartProducer the value to set
+ * @return the dsl builder
+ */
+ default AdvancedSpiffeEndpointBuilder lazyStartProducer(boolean
lazyStartProducer) {
+ doSetProperty("lazyStartProducer", lazyStartProducer);
+ return this;
+ }
+ /**
+ * Whether the producer should be started lazy (on the first message).
+ * By starting lazy you can use this to allow CamelContext and routes
to
+ * startup in situations where a producer may otherwise fail during
+ * starting and cause the route to fail being started. By deferring
this
+ * startup to be lazy then the startup failure can be handled during
+ * routing messages via Camel's routing error handlers. Beware that
when
+ * the first message is processed then creating and starting the
+ * producer may take a little time and prolong the total processing
time
+ * of the processing.
+ *
+ * The option will be converted to a <code>boolean</code> type.
+ *
+ * Default: false
+ * Group: producer (advanced)
+ *
+ * @param lazyStartProducer the value to set
+ * @return the dsl builder
+ */
+ default AdvancedSpiffeEndpointBuilder lazyStartProducer(String
lazyStartProducer) {
+ doSetProperty("lazyStartProducer", lazyStartProducer);
+ return this;
+ }
+ /**
+ * An existing WorkloadApiClient to use. When set, the component does
+ * not create or close its own client and spiffeSocketPath is ignored.
+ *
+ * The option is a:
<code>io.spiffe.workloadapi.WorkloadApiClient</code>
+ * type.
+ *
+ * Group: advanced
+ *
+ * @param workloadApiClient the value to set
+ * @return the dsl builder
+ */
+ default AdvancedSpiffeEndpointBuilder
workloadApiClient(io.spiffe.workloadapi.WorkloadApiClient workloadApiClient) {
+ doSetProperty("workloadApiClient", workloadApiClient);
+ return this;
+ }
+ /**
+ * An existing WorkloadApiClient to use. When set, the component does
+ * not create or close its own client and spiffeSocketPath is ignored.
+ *
+ * The option will be converted to a
+ * <code>io.spiffe.workloadapi.WorkloadApiClient</code> type.
+ *
+ * Group: advanced
+ *
+ * @param workloadApiClient the value to set
+ * @return the dsl builder
+ */
+ default AdvancedSpiffeEndpointBuilder workloadApiClient(String
workloadApiClient) {
+ doSetProperty("workloadApiClient", workloadApiClient);
+ return this;
+ }
+ }
+
+ public interface SpiffeBuilders {
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and
JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * @return the dsl builder for the headers' name.
+ */
+ default SpiffeHeaderNameBuilder spiffe() {
+ return SpiffeHeaderNameBuilder.INSTANCE;
+ }
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and
JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * Syntax: <code>spiffe:label</code>
+ *
+ * Path parameter: label
+ * Logical name of the endpoint
+ *
+ * @param path label
+ * @return the dsl builder
+ */
+ default SpiffeEndpointBuilder spiffe(String path) {
+ return SpiffeEndpointBuilderFactory.endpointBuilder("spiffe",
path);
+ }
+ /**
+ * SPIFFE (camel-spiffe)
+ * Fetch and validate SPIFFE workload identity (X.509-SVID and
JWT-SVID)
+ * from the SPIFFE Workload API.
+ *
+ * Category: security
+ * Since: 4.23
+ * Maven coordinates: org.apache.camel:camel-spiffe
+ *
+ * Syntax: <code>spiffe:label</code>
+ *
+ * Path parameter: label
+ * Logical name of the endpoint
+ *
+ * @param componentName to use a custom component name for the endpoint
+ * instead of the default name
+ * @param path label
+ * @return the dsl builder
+ */
+ default SpiffeEndpointBuilder spiffe(String componentName, String
path) {
+ return SpiffeEndpointBuilderFactory.endpointBuilder(componentName,
path);
+ }
+
+ }
+ /**
+ * The builder of headers' name for the SPIFFE component.
+ */
+ public static class SpiffeHeaderNameBuilder {
+ /**
+ * The internal instance of the builder used to access to all the
+ * methods representing the name of headers.
+ */
+ public static final SpiffeHeaderNameBuilder INSTANCE = new
SpiffeHeaderNameBuilder();
+
+ /**
+ * Overrides the operation to be used by the producer.
+ *
+ * The option is a: {@code
+ * org.apache.camel.component.spiffe.SpiffeOperation or String} type.
+ *
+ * Group: producer
+ *
+ * @return the name of the header {@code SpiffeOperation}.
+ */
+ public String spiffeOperation() {
+ return "CamelSpiffeOperation";
+ }
+ /**
+ * The comma-separated audience(s) for the fetchJwtSvid and
+ * validateJwtSvid operations.
+ *
+ * The option is a: {@code String} type.
+ *
+ * Group: producer
+ *
+ * @return the name of the header {@code SpiffeAudience}.
+ */
+ public String spiffeAudience() {
+ return "CamelSpiffeAudience";
+ }
+ /**
+ * The JWT-SVID token to validate, for the validateJwtSvid operation.
+ *
+ * The option is a: {@code String} type.
+ *
+ * Group: producer
+ *
+ * @return the name of the header {@code SpiffeToken}.
+ */
+ public String spiffeToken() {
+ return "CamelSpiffeToken";
+ }
+ /**
+ * The SPIFFE ID of the returned SVID.
+ *
+ * The option is a: {@code String} type.
+ *
+ * Group: producer
+ *
+ * @return the name of the header {@code SpiffeSpiffeId}.
+ */
+ public String spiffeSpiffeId() {
+ return "CamelSpiffeSpiffeId";
+ }
+ /**
+ * The expiry of the returned JWT-SVID.
+ *
+ * The option is a: {@code java.util.Date} type.
+ *
+ * Group: producer
+ *
+ * @return the name of the header {@code SpiffeExpiry}.
+ */
+ public String spiffeExpiry() {
+ return "CamelSpiffeExpiry";
+ }
+ }
+ static SpiffeEndpointBuilder endpointBuilder(String componentName, String
path) {
+ class SpiffeEndpointBuilderImpl extends AbstractEndpointBuilder
implements SpiffeEndpointBuilder, AdvancedSpiffeEndpointBuilder {
+ public SpiffeEndpointBuilderImpl(String path) {
+ super(componentName, path);
+ }
+ }
+ return new SpiffeEndpointBuilderImpl(path);
+ }
+}
\ No newline at end of file
diff --git
a/dsl/camel-kamelet-main/src/generated/resources/camel-component-known-dependencies.properties
b/dsl/camel-kamelet-main/src/generated/resources/camel-component-known-dependencies.properties
index 18962cbad48a..ea97ee9e1da1 100644
---
a/dsl/camel-kamelet-main/src/generated/resources/camel-component-known-dependencies.properties
+++
b/dsl/camel-kamelet-main/src/generated/resources/camel-component-known-dependencies.properties
@@ -347,6 +347,7 @@
org.apache.camel.component.smooks.SmooksComponent=camel:smooks
org.apache.camel.component.smpp.SmppComponent=camel:smpp
org.apache.camel.component.snmp.SnmpComponent=camel:snmp
org.apache.camel.component.solr.SolrComponent=camel:solr
+org.apache.camel.component.spiffe.SpiffeComponent=camel:spiffe
org.apache.camel.component.splunkhec.SplunkHECComponent=camel:splunk-hec
org.apache.camel.component.spring.batch.SpringBatchComponent=camel:spring-batch
org.apache.camel.component.spring.jdbc.SpringJdbcComponent=camel:spring-jdbc
diff --git a/parent/pom.xml b/parent/pom.xml
index 30342fc24b3a..e14c7018b785 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -273,6 +273,8 @@
<jactl-version>2.9.2</jactl-version>
<jasypt-version>1.9.3</jasypt-version>
<java-grok-version>0.2.1</java-grok-version>
+ <java-spiffe-version>0.8.17</java-spiffe-version>
+ <java-util-version>4.110.0</java-util-version>
<jnats-version>2.26.2</jnats-version>
<javacc-maven-plugin-version>3.2.0</javacc-maven-plugin-version>
<javapoet-version>0.19.0</javapoet-version>
@@ -2708,6 +2710,11 @@
<artifactId>camel-solr</artifactId>
<version>${project.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-spiffe</artifactId>
+ <version>${project.version}</version>
+ </dependency>
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-splunk-hec</artifactId>
