oscerd opened a new pull request, #27429:
URL: https://github.com/apache/camel/pull/27429
# CAMEL-24733: camel-spiffe - integration tests against a real SPIRE agent
`camel-spiffe` had no integration tests and no test-infra module —
everything was unit-tested against a mocked
`WorkloadApiClient` / `X509Source`. That left `SpiffeSSLContextParameters`
(the class that builds the mTLS `SSLContext`
and decides which peers are accepted, the most security-critical code in the
component) never exercised against a real
Workload API.
## What this adds
**New module `test-infra/camel-test-infra-spiffe`** — mirrors
`camel-test-infra-opa`. It runs a SPIRE **server** plus
**agent** (images `ghcr.io/spiffe/spire-server|spire-agent:1.15.3`) and
exposes the Workload API Unix socket to the
test JVM, via `SpiffeServiceFactory.createSingletonService()`.
The orchestration handles the realities of attesting a host process from a
containerised agent:
- the agent runs in the **host PID namespace** (`--pid host`) so the `unix`
workload attestor can resolve the calling
test process through `/proc`;
- the Workload API socket directory is bind-mounted to a **short** host path
(the `AF_UNIX` `sun_path` limit is ~108
bytes, so a socket under a deep temp tree cannot be connected to from the
host), SELinux-shared (`:z`);
- a single registration entry is created for `unix:uid:<the test process
uid>`, so the JVM is issued
`spiffe://example.org/workload`;
- the SPIRE configs are copied into the (distroless) images, and the agent
joins with a single-use join token generated
once the server is healthy.
**Integration tests in `camel-spiffe`** (`src/test/.../integration/`):
- `SpiffeWorkloadApiIT` — fetch an X509-SVID and a JWT-SVID through the
component producer; validate a JWT-SVID against
its configured audience, and reject one minted for another audience.
- `SpiffeMutualTlsIT` — complete a real mutual-TLS handshake through
`SpiffeSSLContextParameters`, asserting that an
allow-listed peer connects and a non-allow-listed one is refused during
the handshake.
## Image/architecture constraint
The SPIRE images are published for `amd64`/`arm64` only, so `camel-spiffe`
sets `skipITs.ppc64le` / `skipITs.s390x`
(the same accommodation `camel-opa` made).
## Validation
Run locally against real SPIRE containers: **6 integration tests pass**
(plus the existing 41 unit tests). The agent
attested the host JVM, issued the SVID, and all three scenarios — SVID
fetch, JWT validation incl. wrong-audience
rejection, and the mTLS allow/deny handshake — passed.
`main` only; test-only plus the new test-infra module.
---
_Claude Code on behalf of oscerd_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
