[
https://issues.apache.org/jira/browse/CAMEL-24468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107769#comment-18107769
]
Andrea Cosentino commented on CAMEL-24468:
------------------------------------------
In addition to the inverted credential check in doStart() (the original scope
of this issue), the same class (IBMSecretsManagerPropertiesFunction) has two
further defects in getSecretFromSource() that the fix also addresses:
1. Secret version pinning was ignored for KV secrets. After fetching the
requested version's data, the code overwrote it with the current version's data:
{code:java}
Response<SecretVersion> secVersion =
client.getSecretVersion(getSecretVersionOptions).execute();
data = secVersion.getResult().getData();
if (ObjectHelper.isNotEmpty(data)) {
data = response.getResult().getData(); // overwrites the versioned data
with the current one
}
{code}
so requesting ibm:group:secret#field@version silently returned the current
field value. The overwrite block has been removed (the ARBITRARY/payload branch
was already correct).
2. A missing KV field returned the literal string "null" instead of falling
back to the default value. String.valueOf(data.get(subkey)) yields the string
"null" when the key is absent, which is non-empty and therefore bypassed the
isEmpty()-based default-value fallback. It now yields a real null when the
field is absent, so the provided default value is used.
_Claude Code on behalf of oscerd_
> camel-ibm-secrets-manager - fix defects in
> IBMSecretsManagerPropertiesFunction (env-var credentials rejected, secret
> version pin ignored, missing KV field returns "null")
> --------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24468
> URL: https://issues.apache.org/jira/browse/CAMEL-24468
> Project: Camel
> Issue Type: Bug
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> h3. Problem
> {{IBMSecretsManagerPropertiesFunction.doStart()}} inverts its credential
> check:
> {code:java}
> String token = System.getenv(CAMEL_VAULT_IBM_TOKEN_ENV);
> String serviceUrl = System.getenv(CAMEL_VAULT_IBM_SERVICE_URL_ENV);
> if (ObjectHelper.isEmpty(token) && ObjectHelper.isEmpty(serviceUrl)) {
> // fall back to vault config, then build the client
> } else {
> throw new RuntimeCamelException(
> "Using the IBM Secrets Manager Properties Function requires setting
> IBM Credentials and service url ...");
> }
> {code}
> The client is only built when *both* env vars are empty. So when a user sets
> the documented {{CAMEL_VAULT_IBM_TOKEN}} / {{CAMEL_VAULT_IBM_SERVICE_URL}}
> environment variables (the first configuration method described in the class
> Javadoc, and the norm in containers/Kubernetes), the condition is false,
> control goes to the else, and CamelContext startup fails with a message
> telling the user to set credentials they already set. The
> environment-variable configuration path is therefore unusable; only
> application.properties/vault-config works.
> h3. Fix
> Use the same shape as the AWS/Google secrets-manager properties functions:
> read the env vars; if both are empty fall back to the vault configuration;
> then build the client when a token and service url are available (from either
> source) and only throw when neither provides them.
> Affects main (4.23.0-SNAPSHOT).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
