oscerd opened a new pull request, #29619: URL: https://github.com/apache/camel/pull/29619
## Summary Second of three PRs for [CAMEL-25675](https://issues.apache.org/jira/browse/CAMEL-25675), after #29235. The Vault clients of the `hashicorp-vault` endpoint, the `hashicorp:` properties function and the secret refresh task had no TLS settings: with `https` they trusted only what the JVM trusts, and could not present a client certificate. This PR adds TLS settings and the `cert` login. - `trustStore` and `trustStorePassword`: the certificates to trust, such as the CA of a Vault with a private CA. A PKCS12 or JKS trust store, or a PEM file with the CA certificates (the file of the Vault CLI's `VAULT_CACERT`). - `keyStore` and `keyStorePassword`: the TLS client certificate and its key, presented to Vault. A PKCS12 or JKS key store, or a PEM file with the certificate and an unencrypted key in PKCS#8, or PKCS#1 for RSA. - `authentication=cert`: Spring Vault's `ClientCertificateAuthentication`, with `role` as the name of the certificate role and `authMountPath` for another mount than `cert`. It needs `keyStore` and the `https` scheme, which the validation checks. - The options exist on the endpoint and as `camel.vault.hashicorp.*`; the properties function also reads `CAMEL_HASHICORP_VAULT_TRUST_STORE`, `..._TRUST_STORE_PASSWORD`, `..._KEY_STORE` and `..._KEY_STORE_PASSWORD`. The two passwords are `security = "secret"`; camel-main already masks `keystorepassword` and `truststorepassword` in its logs. - The TLS context is set on the same `SimpleClientHttpRequestFactory` as before (only when a store is set), for the login client and the data client alike. Host name verification is unchanged. These are dedicated options rather than Camel's `SSLContextParameters` / `camel.ssl`: camel-main binds `camel.ssl.*` after the `camel.main.*` options, so a `hashicorp:` placeholder in a `camel.main` option, or in `camel.ssl` itself, would start the properties function before the global TLS context exists. ## Not in this PR - PR3: the cloud logins `aws-iam`, `azure-msi`, `gcp-gce` and `gcp-iam`. - camel-spring-boot mirrors `camel.vault.hashicorp.*` by hand and needs a follow-up there. ## Tests - `HashicorpVaultTlsTest`, against a fake Vault over HTTPS (JDK `HttpsServer`, test certificates in `src/test/resources/.../tls`, made with OpenSSL and valid for 100 years): trust with PEM and with PKCS12, no trust without the trust store, the cert login with a PEM key in PKCS#8 and in PKCS#1 and with PKCS12 (the fake records the client certificate it receives), a custom mount path, validation and unreadable stores. - `HashicorpVaultClientSettingsTest`: the TLS settings from the environment variables and from the configuration. - `HashicorpVaultTlsIT`: Vault in development mode with TLS (`-dev-tls`); its PKI engine issues the client certificate; the properties function logs in with `cert`, and the endpoint reads a secret through the trust store. - All 67 unit tests pass, and all 38 integration tests of the module pass against `mirror.gcr.io/hashicorp/vault:2.2.1` and against `quay.io/openbao/openbao:2.7.2` (OpenBao names the dev TLS files the same). Full reactor build (`mvn clean install -DskipTests -DskipITs`) with the regenerated files committed. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
