Andrea Cosentino created CAMEL-24508:
----------------------------------------
Summary: Vault and secrets starters - early property resolution
failures are swallowed, leaving the placeholder as the value
Key: CAMEL-24508
URL: https://issues.apache.org/jira/browse/CAMEL-24508
Project: Camel
Issue Type: Improvement
Components: camel-spring-boot-starters
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
The early-resolution parsers used by the vault and secrets starters resolve
{{{{prefix:...}}}} placeholders before Spring Boot auto-configuration runs.
Each swallows per-property failures:
{code:java}
if (stringValue != null && stringValue.startsWith("{{aws:") &&
stringValue.endsWith("}}")) {
LOG.debug("decrypting and overriding property {}", key);
try {
String element = secretsManagerPropertiesFunction.apply(stringValue
.replace("{{aws:", "")
.replace("}}", ""));
props.put(key, element);
} catch (Exception e) {
// Log and do nothing
LOG.debug("failed to parse property {}. This exception is ignored.",
key, e);
}
}
{code}
(SpringBootAwsSecretsManagerPropertiesParser:97)
When the lookup fails - wrong region, missing permission, secret not found,
endpoint unreachable - nothing is put into the override property source, so the
property keeps its literal {{{{aws:...}}}} text. That literal then becomes the
effective value of whatever it configured: a password, a token, a URL. At DEBUG
the operator sees nothing at the default log level, and the application starts
as though configuration succeeded.
The same {{catch}} appears in nine files:
{code}
camel-aws-secrets-manager-starter SpringBootAwsSecretsManagerPropertiesParser
camel-azure-key-vault-starter SpringBootAzureKeyVaultPropertiesParser
camel-cyberark-vault-starter SpringBootCyberArkVaultPropertiesParser
camel-google-secret-manager-starter
SpringBootGoogleSecretManagerPropertiesParser
camel-hashicorp-vault-starter SpringBootHashicorpVaultPropertiesParser
camel-ibm-secrets-manager-starter IBMSecretsManagerVaultPropertiesParser
camel-spring-cloud-config-starter SpringBootCloudConfigPropertiesParser
camel-openapi-java-starter OpenApiAutoConfiguration
camel-springdoc-starter SpringdocAutoConfiguration
{code}
The last two are a different context and should be reviewed separately; the
seven resolution parsers share the same shape.
*Proposal*
A placeholder that matched a vault prefix but failed to resolve should fail
startup, since continuing means running with a value that is definitely wrong.
If the tolerant behaviour is needed, keep it behind an explicit
{{camel.vault.ignore-resolution-failures=true}} logged at WARN.
This changes startup behaviour for anyone currently relying on the silent
fallback, so it needs an upgrade-guide entry.
----
_This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
