[
https://issues.apache.org/jira/browse/CAMEL-26561?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18137903#comment-18137903
]
Claus Ibsen commented on CAMEL-26561:
-------------------------------------
Merged via https://github.com/apache/camel/pull/29137 (commit
d76673581bbc94d2641aace39afa3d6f0f13a1fb).
_Claude Code on behalf of davsclaus_
> camel-opa/spiffe docs - fix the SPIFFE TLS example, add YAML for the SPIFFE
> beans
> ---------------------------------------------------------------------------------
>
> Key: CAMEL-26561
> URL: https://issues.apache.org/jira/browse/CAMEL-26561
> Project: Camel
> Issue Type: Bug
> Components: camel-spiffe, documentation
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.24.0
>
>
> Found while checking how well the camel-spiffe, camel-opa and camel-openfga
> configuration can be written in YAML.
> h4. The camel-opa example cannot start
> The "Connecting to the server" section of opa-component.adoc shows how to
> present a SPIFFE X.509-SVID to an OPA server that requires mutual TLS:
> {code:java}
> SpiffeSSLContextParameters spiffe = new SpiffeSSLContextParameters();
> spiffe.setCamelContext(context);
> context.getRegistry().bind("opaTls", spiffe);
> {code}
> It sets neither {{acceptedSpiffeIds}} nor {{acceptAnySpiffeId}}, and
> {{SpiffeSSLContextParameters.createSSLContext}} fails closed when neither is
> given ({{A SPIFFE-backed SSLContext requires either acceptAnySpiffeId=true or
> a non-empty acceptedSpiffeIds allow-list}}). A route using
> {{sslContextParameters=#opaTls}} therefore does not start. The example should
> pin the OPA server's SPIFFE ID, and show the YAML form next to the Java one
> like the rest of the page.
> h4. camel-spiffe has no YAML for its beans
> The "Mutual TLS with SPIFFE" and "Authorizing a route on the peer SPIFFE ID"
> sections of spiffe-component.adoc are Java only, while the camel-opa and
> camel-openfga pages give every example in Java and YAML. Both beans bind
> fully from a YAML {{beans:}} entry, including the inherited
> {{serverParameters.clientAuthentication: REQUIRE}} the server side needs, so
> the page can show it.
> h4. Proposed fix
> Documentation only:
> * opa-component.adoc: give the SPIFFE example an {{acceptedSpiffeIds}} (the
> OPA server's ID), drop the {{setCamelContext}} call it does not need, and add
> a YAML tab.
> * spiffe-component.adoc: add YAML tabs to the {{SpiffeSSLContextParameters}}
> and {{SpiffeSecurityPolicy}} examples.
> _Claude Code on behalf of oscerd_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
