gnodet commented on PR #26845: URL: https://github.com/apache/camel/pull/26845#issuecomment-5828854615
@Croway **Why scan all DataSources**: the `SecretRotationAware` callback is advisory — it says "a secret changed somewhere" but does not say _which_ secret. This is by design (see the `SecretRotationAware` Javadoc: "The callback is advisory: it says that a reload was triggered, not which secrets changed"). Since the component does not know which DataSource had its credentials rotated, it evicts all visible pools. `softEvictConnections()` is a no-op for connections that are still valid (HikariCP validates on borrow), so over-eviction is harmless — the only cost is that idle connections get replaced slightly earlier. As for ownership: `camel-jdbc` and `camel-sql` are the consumers of those DataSources. They are the components that will fail if stale connections remain in the pool after rotation, so they are the natural place to trigger eviction. The DataSource itself (a pool library class like `HikariDataSource`) cannot implement `SecretRotationAware` — it is a third-party class and does not know about Camel's SPI. A wrapper bean could do it, but that pushes the burden onto every user to register a custom `SecretRotationAware` bean for each DataSource — the whole point of this PR is to make it work out of the box. **DBCP2**: you are right that DBCP2 does not pick up password changes after initialization. That is a DBCP2 limitation, not something this PR introduces — the fallback path logs that the pool does not support explicit eviction and relies on natural connection expiry + validation. If we want to support DBCP2 specifically, we would need to call `setPassword()` + `restart()` on `BasicDataSource`, which is a separate concern. Same as Agroal, this can be a follow-up. **Full rotation test**: see the reply above — happy to add it as a follow-up JIRA, but it is a significant test-infra addition (Testcontainers + PostgreSQL + multiple pool vendors) that should not gate this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
