This is an automated email from the ASF dual-hosted git repository. Croway pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-spring-boot.git
commit 5c3c8dba508b653e481d122c8752f1377d0d8433 Author: croway <[email protected]> AuthorDate: Sun Nov 8 10:44:27 2026 +0100 CAMEL-25675: camel-spring-boot - Hashicorp Vault options to log in with AppRole, Kubernetes or JWT Adds camel.vault.hashicorp.authentication, role-id, secret-id, role, jwt, jwt-file and auth-mount-path, which Camel added to HashicorpVaultConfiguration, so that VaultConfigurationPropertiesMappingTest passes again. authentication defaults to token, as in Camel, because the properties are copied onto the Camel configuration including the null ones. --- .../src/main/docs/spring-boot.json | 43 ++++++++++ .../HashicorpVaultConfigurationProperties.java | 98 ++++++++++++++++++++++ 2 files changed, 141 insertions(+) diff --git a/core/camel-spring-boot/src/main/docs/spring-boot.json b/core/camel-spring-boot/src/main/docs/spring-boot.json index c80272e3689..776ab315ad8 100644 --- a/core/camel-spring-boot/src/main/docs/spring-boot.json +++ b/core/camel-spring-boot/src/main/docs/spring-boot.json @@ -1944,6 +1944,19 @@ "sourceType": "org.apache.camel.spring.boot.vault.GcpVaultConfigurationProperties", "defaultValue": false }, + { + "name": "camel.vault.hashicorp.auth-mount-path", + "type": "java.lang.String", + "description": "The path the login method is mounted at in hashicorp vault (without auth\/), when it is not the default path of the login method: approle, kubernetes or jwt", + "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" + }, + { + "name": "camel.vault.hashicorp.authentication", + "type": "java.lang.String", + "description": "How to log in to hashicorp vault: token (a fixed token), approle (a role ID and a secret ID), kubernetes (the service account token of the pod) or jwt (a JWT, such as a workload identity token). Camel renews the token before it expires, and logs in again when the token can no longer be renewed.", + "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties", + "defaultValue": "token" + }, { "name": "camel.vault.hashicorp.cloud", "type": "java.lang.Boolean", @@ -1957,6 +1970,18 @@ "description": "The Hashicorp Vault Host for accessing the service", "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" }, + { + "name": "camel.vault.hashicorp.jwt", + "type": "java.lang.String", + "description": "The JWT to log in with, for the jwt and kubernetes logins. For a JWT that is replaced over time, such as a projected service account token, use jwtFile instead.", + "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" + }, + { + "name": "camel.vault.hashicorp.jwt-file", + "type": "java.lang.String", + "description": "The file to read the JWT from at every login, for the jwt and kubernetes logins. The kubernetes login reads \/var\/run\/secrets\/kubernetes.io\/serviceaccount\/token when neither jwt nor jwtFile is set.", + "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" + }, { "name": "camel.vault.hashicorp.namespace", "type": "java.lang.String", @@ -1983,12 +2008,30 @@ "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties", "defaultValue": 60000 }, + { + "name": "camel.vault.hashicorp.role", + "type": "java.lang.String", + "description": "The hashicorp vault role to log in as, for the kubernetes and jwt logins. The jwt login can leave it out when the login method has a default role.", + "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" + }, + { + "name": "camel.vault.hashicorp.role-id", + "type": "java.lang.String", + "description": "The role ID of the AppRole, for the approle login", + "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" + }, { "name": "camel.vault.hashicorp.scheme", "type": "java.lang.String", "description": "The Hashicorp Vault Scheme for accessing the service", "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" }, + { + "name": "camel.vault.hashicorp.secret-id", + "type": "java.lang.String", + "description": "The secret ID of the AppRole, for the approle login", + "sourceType": "org.apache.camel.spring.boot.vault.HashicorpVaultConfigurationProperties" + }, { "name": "camel.vault.hashicorp.secrets", "type": "java.lang.String", diff --git a/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/vault/HashicorpVaultConfigurationProperties.java b/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/vault/HashicorpVaultConfigurationProperties.java index 86a21d0968a..f08bc2038b9 100644 --- a/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/vault/HashicorpVaultConfigurationProperties.java +++ b/core/camel-spring-boot/src/main/java/org/apache/camel/spring/boot/vault/HashicorpVaultConfigurationProperties.java @@ -22,11 +22,53 @@ import org.springframework.boot.context.properties.ConfigurationProperties; @ConfigurationProperties(prefix = "camel.vault.hashicorp") public class HashicorpVaultConfigurationProperties { + /** + * How to log in to hashicorp vault: token (a fixed token), approle (a role ID and a secret ID), kubernetes (the + * service account token of the pod) or jwt (a JWT, such as a workload identity token). Camel renews the token + * before it expires, and logs in again when the token can no longer be renewed. + */ + @Metadata(defaultValue = "token", enums = "token,approle,kubernetes,jwt") + private String authentication = "token"; + /** * The Hashicorp Vault Token for accessing the service */ private String token; + /** + * The role ID of the AppRole, for the approle login + */ + private String roleId; + + /** + * The secret ID of the AppRole, for the approle login + */ + private String secretId; + + /** + * The hashicorp vault role to log in as, for the kubernetes and jwt logins. The jwt login can leave it out when the + * login method has a default role. + */ + private String role; + + /** + * The JWT to log in with, for the jwt and kubernetes logins. For a JWT that is replaced over time, such as a + * projected service account token, use jwtFile instead. + */ + private String jwt; + + /** + * The file to read the JWT from at every login, for the jwt and kubernetes logins. The kubernetes login reads + * /var/run/secrets/kubernetes.io/serviceaccount/token when neither jwt nor jwtFile is set. + */ + private String jwtFile; + + /** + * The path the login method is mounted at in hashicorp vault (without auth/), when it is not the default path of + * the login method: approle, kubernetes or jwt + */ + private String authMountPath; + /** * The Hashicorp Vault Host for accessing the service */ @@ -67,6 +109,14 @@ public class HashicorpVaultConfigurationProperties { */ private String secrets; + public String getAuthentication() { + return authentication; + } + + public void setAuthentication(String authentication) { + this.authentication = authentication; + } + public String getToken() { return token; } @@ -75,6 +125,54 @@ public class HashicorpVaultConfigurationProperties { this.token = token; } + public String getRoleId() { + return roleId; + } + + public void setRoleId(String roleId) { + this.roleId = roleId; + } + + public String getSecretId() { + return secretId; + } + + public void setSecretId(String secretId) { + this.secretId = secretId; + } + + public String getRole() { + return role; + } + + public void setRole(String role) { + this.role = role; + } + + public String getJwt() { + return jwt; + } + + public void setJwt(String jwt) { + this.jwt = jwt; + } + + public String getJwtFile() { + return jwtFile; + } + + public void setJwtFile(String jwtFile) { + this.jwtFile = jwtFile; + } + + public String getAuthMountPath() { + return authMountPath; + } + + public void setAuthMountPath(String authMountPath) { + this.authMountPath = authMountPath; + } + public String getHost() { return host; }
