oscerd commented on PR #29638: URL: https://github.com/apache/camel/pull/29638#issuecomment-6819170727
Pushed `CAMEL-26831: Address review feedback - the policy takes the component configuration, publishes the identity as a property only, and logs what kind of failure it saw` (d3b57e93bac6) on top of 11354a2a8cf3: 1. **autowired / component configuration:** `autowired = true` is gone from `workloadApiClient` (it did nothing on a bean, as you say; the bean metadata says `false` now). `wrap()` starts from the configuration of the `spiffe` component, so `camel.component.spiffe.*` settings and a client autowired on the component apply to the policy; `workloadApiClient` and `spiffeSocketPath` set on the policy take precedence, and the endpoint is created on the context's component rather than a private one. The option descriptions say so, and `policyUsesTheClientOfTheComponentWhenItSetsNone` covers it. 2. **Identity as a property only:** in the policy path `recordIdentity` sets `CamelSpiffeJwtIdentity` only; the producer keeps setting `CamelSpiffeSpiffeId`/`CamelSpiffeExpiry` as its documented output. The policy section of the page says the property is the value to check further down the route, and the allowed-case test asserts that the headers are absent. 3. **Failures:** the processor logs the class of the failure at DEBUG for a `JwtSvidException` or a missing token, and at WARN, with the "is the Workload API reachable?" hint, for anything else, so an agent outage is distinguishable from a 401 storm. The producer path is left as it is: whether the SDK message can carry the credential I could not establish, so the cautious comment stays. 4. **IT case:** not added in this round; the unit tests cover the acceptance criteria and a `.policy(...)` case in `SpiffeWorkloadApiIT` is a reasonable follow-up. 5. **Audience parsing:** one helper, `SpiffeJwtValidator.audiences(configured, how)`, used by the validator, the policy and the producer, and the rationale comments are back in the validator: why the audience never comes from the header, why Bearer is checked before the body, why every configured audience is tried. camel-spiffe module: 57 tests, 0 failures. Review re-requested. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
