oscerd opened a new pull request, #24455:
URL: https://github.com/apache/camel/pull/24455
# CAMEL-23849: Camel-PQC — add automated key rotation scheduling
## Motivation
`KeyLifecycleManager` already exposes `needsRotation(keyId, maxAge,
maxUsage)` and
`rotateKey(oldId, newId, algorithm)`, but rotation had to be triggered
manually by the route
author — there was no built-in scheduler. This adds an opt-in background
scheduler around the
existing API.
## What this does
Adds `org.apache.camel.component.pqc.lifecycle.KeyRotationScheduler`, an
opt-in background service
that wraps a `KeyLifecycleManager` and, on a configurable interval,
evaluates every managed key and
rotates the ones that need rotation.
- **Opt-in**: nothing runs until `start()` is called.
- **Camel `Service`** (extends `ServiceSupport`): can be added to the
`CamelContext`
(`context.addService(scheduler)`) so it is started/stopped with the
context, or driven standalone.
- **Configurable policy**: `checkInterval` (default 1h), `maxKeyAge`,
`maxKeyUsage`, a
`keyFilter` (default: only `ACTIVE` keys), and a `keyIdStrategy` for
naming the replacement key.
- **Rotation** reuses `KeyLifecycleManager.rotateKey(...)`: a fresh key is
generated and the
previous key is deprecated.
- **Observability**: optional `KeyRotationListener` (`onRotated` /
`onError`) plus counters
(`getChecksPerformed()`, `getRotationsPerformed()`,
`getRotationFailures()`, `getLastCheckAt()`).
- **Robustness**: a single failing key is counted, logged and reported, then
the pass continues;
the recurring schedule is never cancelled by a failing pass.
`checkAndRotate()` is thread-safe.
No endpoint/`@UriParam` options were added, so there is no
catalog/endpoint-DSL change — this is a
purely additive helper class in the existing `lifecycle` package.
## Documentation
`pqc-key-lifecycle.adoc` gains an *Automated Rotation Scheduling* subsection
under *Key Rotation*
with Java examples (standalone and `CamelContext`-managed).
## Testing
New `KeyRotationSchedulerTest` (7 tests, all green) using a real
`FileBasedKeyLifecycleManager`
(`@TempDir`) and real BouncyCastle Dilithium key generation:
- rotates a key that breaches the usage policy (old → DEPRECATED, one fresh
ACTIVE replacement);
- does not rotate when the policy is not breached;
- the key filter excludes non-`ACTIVE` keys;
- custom `keyIdStrategy` is honoured;
- the listener receives the correct old/new ids and the new key pair;
- **scheduled** rotation fires on the background thread (deterministic via a
`CountDownLatch`, no
`Thread.sleep`) and the scheduler stops cleanly;
- `start()` rejects a non-positive interval.
## Backport
None. This is a new feature and follows the Camel policy of shipping new
features on `main` only
(target 4.21.0). The two *bugs* in the same camel-pqc batch (CAMEL-23843,
CAMEL-23844) are handled
separately and are the backport candidates.
---
_Claude Code on behalf of Andrea Cosentino._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
