Andrea Cosentino created CAMEL-26559:
----------------------------------------
Summary: camel-opa/openfga/spiffe - add the security policy beans
to the bean catalog
Key: CAMEL-26559
URL: https://issues.apache.org/jira/browse/CAMEL-26559
Project: Camel
Issue Type: Improvement
Components: camel-jbang, camel-spiffe
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.24.0
Found while checking how well the camel-spiffe, camel-opa and camel-openfga
configuration can be written in YAML.
h4. What happens
A YAML route that declares one of these classes under {{beans:}} fails under
{{camel run}} unless the component is added with {{--dep}}:
{code:yaml}
- beans:
- name: opaPolicy
type: org.apache.camel.component.opa.security.OpaSecurityPolicy
properties:
serverUrl: http://localhost:8181
policyPath: authz/allow
- route:
from:
uri: timer:tick?repeatCount=1
steps:
- policy:
ref: opaPolicy
steps:
- log: "allowed"
{code}
{noformat}
$ camel run policy.yaml --camel-version=4.23.0
Error creating bean: opaPolicy of type:
#class:org.apache.camel.component.opa.security.OpaSecurityPolicy: class
org.apache.camel.component.opa.security.OpaSecurityPolicy was not found (check
the package name; a class from another library needs its dependency added)
Caused by: java.lang.ClassNotFoundException:
org.apache.camel.component.opa.security.OpaSecurityPolicy
{noformat}
It still fails when the same file also has an {{opa:}} endpoint: YAML beans are
created while the file is pre-parsed, before any endpoint downloads its
component. {{OpenFgaSecurityPolicy}}, {{SpiffeSecurityPolicy}} and
{{SpiffeSSLContextParameters}} behave the same. With {{--dep=camel:opa}} (or
{{camel:openfga}}, {{camel:spiffe}}) every option binds and the routes start.
h4. Why
When a class is missing, {{DependencyDownloaderClassResolver}}
(camel-kamelet-main) finds its jar through the known dependencies, which list
each component by its component class only, or through the pojo-bean metadata
in the catalog ({{CamelCatalog.pojoBeanModel}}). None of the four classes has a
bean entry, so nothing tells {{camel run}} which jar to download.
h4. Proposed fix
Mark the four classes as catalog beans, the way
{{ThrottlingExceptionRoutePolicy}} and the aggregation and idempotent
repositories are: {{@Metadata(label = "bean", ...)}} on the class and
{{@Metadata}} on each option, so they appear under the catalog's {{beans}} with
their Maven coordinates and their options. That also documents the options for
{{camel doc}}, the catalog MCP tools and other tooling that reads the catalog.
{{OpenFgaSecurityPolicy}} keeps its options in an {{OpenFgaConfiguration}}, and
the bean generator reads annotated fields only, so the policy needs fields of
its own, as {{OpaSecurityPolicy}} has.
No other security policy ({{KeycloakSecurityPolicy}}, {{ShiroSecurityPolicy}},
...) is in the bean catalog either. That is left out of this issue.
_Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
