oscerd commented on PR #29708: URL: https://github.com/apache/camel/pull/29708#issuecomment-6825681245
Thanks, all applied in f177c76b0e55: 1. **IRSA and the `sts` module.** The Cloud logins section and the Javadoc now say that a web identity token needs `software.amazon.awssdk:sts`, and an SSO profile `sso` and `ssooidc`. The validation also fails when a web identity token file is set (`AWS_WEB_IDENTITY_TOKEN_FILE` or `aws.webIdentityTokenFile`, read with the SDK's own `SdkSystemSetting`) and `StsWebIdentityCredentialsProviderFactory` is missing, so a pod cannot fall through to the node's role. A test covers it: the test classpath has `auth` but not `sts`. 2. **Default signing region.** Without `awsRegion` and `awsStsEndpoint`, the request is now signed for `us-east-1`, as `vault login -method=aws` does. With a regional `awsStsEndpoint` and no `awsRegion`, the region of the SDK default chain is kept. The tests set the SDK region to `eu-west-1` (signed for `us-east-1` with the global endpoint) and to `eu-central-1` (signed for it with the regional endpoint). 3. **`role` is optional for aws-iam.** Spring Vault leaves it out of the login body, and a test checks that it is not sent. Azure and GCP still require it. 4. **Docs example.** The Cloud logins section has a `camel.vault.hashicorp.*` example with a regional endpoint. Nits: the kubernetes case uses `validateRole`, and the environment variable paragraph is rewrapped. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
