This is an automated email from the ASF dual-hosted git repository.
squakez pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-k.git
The following commit(s) were added to refs/heads/main by this push:
new ffb7f8741 feat(platform): provide maven repo allow list
ffb7f8741 is described below
commit ffb7f8741ad6b3b6f371bba6de57aa1554925f7a
Author: Pasquale Congiusti <[email protected]>
AuthorDate: Thu Aug 27 08:32:59 2026 +0200
feat(platform): provide maven repo allow list
---
.github/actions/registry-setting/action.yml | 1 +
docs/modules/ROOT/pages/installation/builds.adoc | 6 +++++-
e2e/common/misc/maven_repository_test.go | 1 +
pkg/platform/env_platform.go | 9 +++++++++
pkg/platform/env_platform_test.go | 13 +++++++++++++
pkg/trait/builder.go | 6 ++++++
pkg/trait/camel.go | 7 +++++++
7 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/.github/actions/registry-setting/action.yml
b/.github/actions/registry-setting/action.yml
index 8b5bc36ed..4453ef12b 100644
--- a/.github/actions/registry-setting/action.yml
+++ b/.github/actions/registry-setting/action.yml
@@ -41,6 +41,7 @@ runs:
--from-literal=REGISTRY_ADDRESS="$KAMEL_INSTALL_REGISTRY" \
--from-literal=REGISTRY_INSECURE="true" \
--from-literal=REGISTRY_SECRET="my-registry" \
+
--from-literal=MAVEN_REPOSITORIES_ALLOWED="https://maven.repository.redhat.com/ga@id=redhat";
\
-n camel-k
E2E_TEST_REGISTRY_SECRET_COPY=true
echo "E2E_TEST_REGISTRY_SECRET_COPY=$E2E_TEST_REGISTRY_SECRET_COPY" >>
$GITHUB_ENV
diff --git a/docs/modules/ROOT/pages/installation/builds.adoc
b/docs/modules/ROOT/pages/installation/builds.adoc
index 95c6dc496..77c3ebde6 100644
--- a/docs/modules/ROOT/pages/installation/builds.adoc
+++ b/docs/modules/ROOT/pages/installation/builds.adoc
@@ -90,7 +90,11 @@ Beside the values above, you can also configure specifically
Maven using the fol
| -V,--no-transfer-progress,-Dstyle.color=never
| MAVEN_REPOSITORIES
-| Comma separated list of Maven repository definitions (Repository format:
`<repository-url>[@snapshots][@noreleases][@id=<value>][@name=<value>][@checksumpolicy=<value>]`
- appends `@`-separated attributes to configure behavior (e.g.
`http://my-nexus:8081/repository/public@id=my-repo@snapshots`)).
+| Comma separated list of default Maven repository definitions (repository
format:
`<repository-url>[@snapshots][@noreleases][@id=<value>][@name=<value>][@checksumpolicy=<value>]`
- appends `@`-separated attributes to configure behavior (e.g.
`http://my-nexus:8081/repository/public@id=my-repo@snapshots`)).
+|
+
+| MAVEN_REPOSITORIES_ALLOWED
+| Comma separated list of Maven repository definitions (repository format same
as `MAVEN_REPOSITORIES`) which are allowed to be used by final users in
Integrations.
|
|===
diff --git a/e2e/common/misc/maven_repository_test.go
b/e2e/common/misc/maven_repository_test.go
index f2b24db17..3be74c945 100644
--- a/e2e/common/misc/maven_repository_test.go
+++ b/e2e/common/misc/maven_repository_test.go
@@ -38,6 +38,7 @@ func TestRunExtraRepository(t *testing.T) {
t.Parallel()
WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) {
name := RandomizedSuffixName("java")
+ // NOTE: the repo was allow listed during operator installation
procedure
g.Expect(KamelRun(t, ctx, ns, "files/Java.java",
"--maven-repository",
"https://maven.repository.redhat.com/ga@id=redhat";,
"--dependency",
"mvn:org.jolokia:jolokia-core:1.7.1.redhat-00001",
diff --git a/pkg/platform/env_platform.go b/pkg/platform/env_platform.go
index df3258655..a12c100e8 100644
--- a/pkg/platform/env_platform.go
+++ b/pkg/platform/env_platform.go
@@ -21,6 +21,7 @@ import (
"errors"
"os"
"runtime"
+ "slices"
"strconv"
"strings"
"time"
@@ -393,3 +394,11 @@ func FromIntegrationPlatform(itp *v1.IntegrationPlatform)
Platform {
MaxRunningBuilds: itp.Status.Build.MaxRunningBuilds,
}
}
+
+// IsMavenRepoAllowed is used to verify if a given maven repository can be
used or not.
+func IsMavenRepoAllowed(mavenRepo string) bool {
+ csvRepos := GetEnvOrDefault("MAVEN_REPOSITORIES_ALLOWED",
maven.DefaultMavenRepositories)
+ allowedRepos := strings.Split(csvRepos, ",")
+
+ return slices.Contains(allowedRepos, mavenRepo)
+}
diff --git a/pkg/platform/env_platform_test.go
b/pkg/platform/env_platform_test.go
index 468dd0ecf..19ade81c8 100644
--- a/pkg/platform/env_platform_test.go
+++ b/pkg/platform/env_platform_test.go
@@ -23,6 +23,7 @@ import (
"time"
v1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1"
+ "github.com/apache/camel-k/v2/pkg/util/maven"
"github.com/stretchr/testify/assert"
)
@@ -245,3 +246,15 @@ func TestBuilderTasksEnabled_Empty(t *testing.T) {
// empty string is not "false" – treat as enabled
assert.False(t, BuilderTasksEnabled())
}
+
+func TestMavenRepoAllowed(t *testing.T) {
+ t.Setenv("MAVEN_REPOSITORIES_ALLOWED", "repo1,repo2")
+ assert.True(t, IsMavenRepoAllowed("repo1"))
+ assert.True(t, IsMavenRepoAllowed("repo2"))
+ assert.False(t, IsMavenRepoAllowed("repo3"))
+}
+
+func TestMavenRepoAllowedDefault(t *testing.T) {
+ assert.True(t, IsMavenRepoAllowed(maven.DefaultMavenRepositories))
+ assert.False(t, IsMavenRepoAllowed("repo3"))
+}
diff --git a/pkg/trait/builder.go b/pkg/trait/builder.go
index c999c5ab4..e2bf4aab1 100644
--- a/pkg/trait/builder.go
+++ b/pkg/trait/builder.go
@@ -376,11 +376,17 @@ func (t *builderTrait) builderTask(e *Environment,
taskConf *v1.BuildConfigurati
// Add Maven repositories defined in the IntegrationKit or Integration
if e.IntegrationKit != nil {
for _, repo := range e.IntegrationKit.Spec.Repositories {
+ if !platform.IsMavenRepoAllowed(repo) {
+ return nil, fmt.Errorf("maven repository %s is
not allowed by the operator", repo)
+ }
maven.Repositories = append(maven.Repositories,
mvn.NewRepository(repo))
}
}
if e.Integration != nil {
for _, repo := range e.Integration.Spec.Repositories {
+ if !platform.IsMavenRepoAllowed(repo) {
+ return nil, fmt.Errorf("maven repository %s is
not allowed by the operator", repo)
+ }
maven.Repositories = append(maven.Repositories,
mvn.NewRepository(repo))
}
}
diff --git a/pkg/trait/camel.go b/pkg/trait/camel.go
index 7cd76e053..8fc6e14f5 100644
--- a/pkg/trait/camel.go
+++ b/pkg/trait/camel.go
@@ -200,6 +200,13 @@ func (t *camelTrait) loadOrCreateCatalog(e *Environment)
error {
extraRepositories =
append(extraRepositories, e.IntegrationKit.Spec.Repositories...)
}
}
+ // verify extra repos are allowed
+ for _, repo := range extraRepositories {
+ if !platform.IsMavenRepoAllowed(repo) {
+ return fmt.Errorf("maven repository %s
is not allowed by the operator", repo)
+ }
+ }
+
catalog, err = camel.CreateCatalog(e.Ctx, e.Client,
catalogNamespace,
mavenSpec, platform.DefaultBuildTimeout,
runtime, extraRepositories, operatorId)
if err != nil {
