Andrea Cosentino created CAMEL-24733:
----------------------------------------
Summary: camel-spiffe - add integration tests against a real SPIRE
agent
Key: CAMEL-24733
URL: https://issues.apache.org/jira/browse/CAMEL-24733
Project: Camel
Issue Type: Test
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
h2. Problem
{{camel-spiffe}} has *no integration tests and no test-infra module*:
{noformat}
camel-spiffe ITs: (none) test-infra: NONE
camel-opa ITs: OpaIT, OpaBearerTokenIT test-infra: camel-test-infra-opa
{noformat}
Everything is unit-tested against a mocked {{WorkloadApiClient}} /
{{X509Source}}. That means {{SpiffeSSLContextParameters}} - the class that
builds the mTLS {{SSLContext}} and decides which peers are accepted, and so the
most security-critical code in the component - has never run against a real
Workload API.
The gaps that mocks structurally cannot cover:
* the {{X509Source}} lifecycle against a live endpoint (lazy creation, the
{{initTimeout}} bound, close-on-shutdown, cache invalidation on restart)
* whether the {{SSLContextDecorator}} wrapping actually preserves
{{clientAuthentication}} / {{cipherSuites}} / {{secureSocketProtocols}} on a
real handshake - a defect of exactly this kind was found by review during
CAMEL-24571 and fixed without a test that would catch a regression
* whether {{acceptedSpiffeIds}} really rejects a peer outside the allow-list,
and {{acceptAnySpiffeId}} really accepts one inside the trust domain
* SVID rotation
h2. Proposal
Add {{test-infra/camel-test-infra-spiffe}} running a SPIRE server plus agent,
mirroring {{camel-test-infra-opa}}, and ITs that:
* fetch an X509-SVID and a JWT-SVID from the real Workload API
* validate a JWT-SVID, and reject one minted for another audience
* complete a real mTLS handshake through {{SpiffeSSLContextParameters}},
asserting both that an allow-listed peer connects and that a non-allow-listed
one is refused
Note the image constraint from the Camel guidelines: prefer {{mirror.gcr.io}}
or {{quay.io}} over Docker Hub, and check {{amd64}}/{{ppc64le}}/{{s390x}}
availability - {{camel-opa}} had to set {{skipITs.ppc64le}} and
{{skipITs.s390x}} for the same reason.
h2. Scope
{{main}} only. Test-only, plus a new test-infra module.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
