[
https://issues.apache.org/jira/browse/CAMEL-24736?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24736 started by Andrea Cosentino.
------------------------------------------------
> camel-opa - OpaSecurityPolicy has no health check for the OPA server
> --------------------------------------------------------------------
>
> Key: CAMEL-24736
> URL: https://issues.apache.org/jira/browse/CAMEL-24736
> Project: Camel
> Issue Type: Improvement
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> h2. Problem
> CAMEL-24644 added a producer health check so an unreachable OPA server is
> visible before it fails traffic. It covers the {{opa:}} producer only -
> {{OpaSecurityPolicy}} has none:
> {noformat}
> $ grep -rn "HealthCheck" components/camel-opa/src/main/java/.../opa/security/
> (no match)
> {noformat}
> That is the wrong way round. Both paths fail closed when OPA is unreachable,
> but the security policy is the stricter of the two: a producer merely records
> a deny verdict the route can inspect, while {{OpaSecurityPolicy}} throws
> {{CamelAuthorizationException}} and stops the exchange outright. The path
> that hard-fails every message has no health signal at all.
> This was raised as an open question in CAMEL-24644 ("worth considering
> whether the check belongs on OpaSecurityPolicy too - it has the same exposure
> but no endpoint to hang a producer health check on") and never resolved.
> h2. Why it is not just a copy-paste
> {{OpaProducer}} registers into the {{producers}} repository because it *is* a
> producer. {{OpaSecurityPolicy}} is a bean wrapped around a route segment; it
> has no endpoint and no producer. It needs either registration into a
> different repository or a small {{HealthCheckRepository}} of its own, keyed
> so that two policies pointing at different servers stay distinct - the same
> id-collision trap CAMEL-24717 had to fix, and with the same requirement that
> the id not carry {{bearerToken}}.
> h2. Scope
> {{main}} only. Additive.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
