allthingssecurity opened a new pull request, #27987: URL: https://github.com/apache/camel/pull/27987
# Description [CAMEL-25702](https://issues.apache.org/jira/browse/CAMEL-25702) With `camel.vault.ibm.refreshEnabled=true`, Camel Main schedules `IBMEventStreamReloadTriggerTask` with `PeriodTaskScheduler.scheduledTask`: the task is submitted once and runs for as long as Camel runs. Its `run()` polls the IBM Event Streams topic and reloads the CamelContext when a `secret_rotated` event names a watched secret. Nothing in that loop caught an exception, so the first record the task could not read ended it: a value that is not JSON (`JsonProcessingException` rethrown as `RuntimeException`), a JSON record with `data` but no `data.event_type`, or a `secret_rotated` event without `secrets` / `secret_name` / `event_time` (`NullPointerException`). The exception went into the `Future` of the scheduler's executor, which nobody reads: nothing was logged, Camel kept running, and no later secret rotation reloaded the context, so the routes kept the old credentials until the application was restarted. Changes (`IBMEventStreamReloadTriggerTask` only): - The handling of one record moved, unchanged, into a private `onRecord` method; `run()` calls it in a `try` per record. A record that cannot be processed is skipped with a WARN line (offset, topic, message; the stack trace at DEBUG) and the loop goes on with the next record. - The `triggerReloading` flag is now local to the record; it was reset after every use before, so the behaviour is the same. What users can notice: a record of an unexpected shape is logged and skipped instead of silently ending the secret refresh. No option or default changes, so no upgrade guide entry. Tests: - New `IBMEventStreamReloadTriggerTaskTest` (one parameterized test, 3 cases), no IBM services: the task is started with a vault configuration (its `doStart` creates the Kafka consumer, which never connects); the test replaces it by a `KafkaConsumer` subclass that returns queued records, and counts reloads with a `DefaultContextReloadStrategy` subclass. One unreadable record (each of the three shapes above) is followed by a `secret_rotated` event of a watched secret; the reload must happen and the task must still be running. Every wait is bounded, no sleeps. - Without the change all 3 cases fail: `the rotation of a watched secret did not trigger a reload after the record [not json] ==> expected: <true> but was: <false>` (and the same for the two JSON records). - With the change the camel-ibm-secrets-manager unit tests pass: 6 run, 0 failures, 0 skipped. What is not changed: - An exception thrown by `KafkaConsumer.poll` itself still ends the task. The Kafka client retries connection problems inside `poll`; what it throws is an authentication, authorization or configuration error, and retrying that in a loop would need a backoff and a decision on how to report it. - Other refresh tasks are not touched: the AWS, GCP, Azure and Hashicorp ones are period tasks (each run is a new call), and the Kubernetes ones are covered by their own change. What was not run: the module's integration tests (they need IBM Cloud credentials), a real Event Streams topic. # Target - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch) # Tracking - [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it): [CAMEL-25702](https://issues.apache.org/jira/browse/CAMEL-25702). # Apache Camel coding standards and style - [x] I checked that each commit in the pull request has a meaningful subject line and body. - [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes. (I built and tested camel-ibm-secrets-manager, including the formatter and import-sort plugins. I did not run the full root build.) # AI-assisted contributions - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used. This PR was prepared with Claude Code (Claude Opus 5.5). The commit carries a `Co-Authored-By` trailer. _Claude Code on behalf of allthingssecurity_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
