oscerd opened a new pull request, #29145: URL: https://github.com/apache/camel/pull/29145
Fixes [CAMEL-26562](https://issues.apache.org/jira/browse/CAMEL-26562). The `opa` and `openfga` components have `useGlobalSslContextParameters`: an endpoint without its own `sslContextParameters` then uses the context-wide `SSLContextParameters`, the one camel-main builds from `camel.ssl.*`. `OpaSecurityPolicy` and `OpenFgaSecurityPolicy` had no such option and ignored the component's, so a policy reaching a TLS-protected OPA or OpenFGA server needed an `SSLContextParameters` bean of its own even when the global one was exactly right. In YAML that meant repeating the key store and trust store configuration as a nested bean. Their javadoc said the global context "cannot be resolved automatically", but the policy has the `CamelContext` where it matters: `beforeWrap` takes it from the route and builds the `SSLContext` there. ### Change Both policies get `useGlobalSslContextParameters` (default `false`), with the endpoints' precedence: 1. an explicit `sslContextParameters` wins; 2. otherwise, with the option on, `camelContext.getSSLContextParameters()`; 3. otherwise no TLS configuration, so the JVM default, as before. The OPA policy does not use it in `wasm` mode, where there is no server (as with `sslContextParameters`). The javadoc and both component pages, which said the component option has no effect on the policy, now point at the policy's own option. The default is unchanged, so no upgrade-guide entry. ### Tests `OpaSecurityPolicyGlobalSslTest` and `OpenFgaSecurityPolicyGlobalSslTest` (a recording `SSLContextParameters` shows which configuration `beforeWrap` builds its `SSLContext` from): - the global parameters are used when the option is on; - they are ignored by default; - the policy's own `sslContextParameters` win over the global ones; - with the option on and no global parameters, the policy still starts (JVM default). Removing the fallback from `OpaSecurityPolicy.createSslContext` makes `usesTheGlobalSslContextParametersWhenAskedTo` fail (`Expecting AtomicInteger(0) to have value: 1`). Full reactor (`clean install -DskipTests`) green; camel-opa (116) and camel-openfga (133) unit tests green. ### Note CAMEL-26559 (#29144) adds `@Metadata` to the fields of both policies and moves `OpenFgaSecurityPolicy` onto fields of its own. Whichever of the two lands second needs a rebase. Measured with `git merge-tree`: only `OpenFgaSecurityPolicy.java` conflicts; `OpaSecurityPolicy.java` merges on its own. After the rebase the new field needs its `@Metadata`, and `useGlobalSslContextParameters` goes into the `POLICY_ONLY` set of `OpenFgaSecurityPolicyOptionsTest`. Related YAML work: CAMEL-26560 (#29138), CAMEL-26561 (#29137). _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
