[
https://issues.apache.org/jira/browse/CAMEL-24508?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24508:
-------------------------------------
Fix Version/s: 4.23.0
> Vault and secrets starters - early property resolution failures are
> swallowed, leaving the placeholder as the value
> -------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24508
> URL: https://issues.apache.org/jira/browse/CAMEL-24508
> Project: Camel
> Issue Type: Improvement
> Components: camel-spring-boot-starters
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> The early-resolution parsers used by the vault and secrets starters resolve
> {{{{prefix:...}}}} placeholders before Spring Boot auto-configuration runs.
> Each swallows per-property failures:
> {code:java}
> if (stringValue != null && stringValue.startsWith("{{aws:") &&
> stringValue.endsWith("}}")) {
> LOG.debug("decrypting and overriding property {}", key);
> try {
> String element = secretsManagerPropertiesFunction.apply(stringValue
> .replace("{{aws:", "")
> .replace("}}", ""));
> props.put(key, element);
> } catch (Exception e) {
> // Log and do nothing
> LOG.debug("failed to parse property {}. This exception is ignored.",
> key, e);
> }
> }
> {code}
> (SpringBootAwsSecretsManagerPropertiesParser:97)
> When the lookup fails - wrong region, missing permission, secret not found,
> endpoint unreachable - nothing is put into the override property source, so
> the property keeps its literal {{{{aws:...}}}} text. That literal then
> becomes the effective value of whatever it configured: a password, a token, a
> URL. At DEBUG the operator sees nothing at the default log level, and the
> application starts as though configuration succeeded.
> The same {{catch}} appears in nine files:
> {code}
> camel-aws-secrets-manager-starter
> SpringBootAwsSecretsManagerPropertiesParser
> camel-azure-key-vault-starter SpringBootAzureKeyVaultPropertiesParser
> camel-cyberark-vault-starter SpringBootCyberArkVaultPropertiesParser
> camel-google-secret-manager-starter
> SpringBootGoogleSecretManagerPropertiesParser
> camel-hashicorp-vault-starter SpringBootHashicorpVaultPropertiesParser
> camel-ibm-secrets-manager-starter IBMSecretsManagerVaultPropertiesParser
> camel-spring-cloud-config-starter SpringBootCloudConfigPropertiesParser
> camel-openapi-java-starter OpenApiAutoConfiguration
> camel-springdoc-starter SpringdocAutoConfiguration
> {code}
> The last two are a different context and should be reviewed separately; the
> seven resolution parsers share the same shape.
> *Proposal*
> A placeholder that matched a vault prefix but failed to resolve should fail
> startup, since continuing means running with a value that is definitely
> wrong. If the tolerant behaviour is needed, keep it behind an explicit
> {{camel.vault.ignore-resolution-failures=true}} logged at WARN.
> This changes startup behaviour for anyone currently relying on the silent
> fallback, so it needs an upgrade-guide entry.
> ----
> _This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
