oscerd opened a new pull request, #24953: URL: https://github.com/apache/camel/pull/24953
### Motivation [CAMEL-22538](https://issues.apache.org/jira/browse/CAMEL-22538) (sub-task of CAMEL-22512): camel-pqc has key lifecycle managers for in-memory, file, HashiCorp Vault and AWS Secrets Manager backends — this adds the missing Azure Key Vault implementation. ### Changes - New `AzureKeyVaultKeyLifecycleManager`, mirroring the AWS Secrets Manager implementation: private key (PKCS#8), public key (X.509/SubjectPublicKeyInfo) and metadata are stored as **three distinct Key Vault secrets**, enabling different access policies / Azure RBAC for private vs public material. PQC keys are stored as Key Vault *secrets* because Key Vault key objects do not support post-quantum key material. - Metadata is stored as **JSON via `KeyMetadataCodec`** — no Java serialization anywhere (consistent with the CAMEL-23726 hardening; no legacy-deserialization path since this is a new store). - Azure secret names only allow `[0-9a-zA-Z-]`, so secrets are named `{keyPrefix}-{keyId}-{type}` (default prefix `pqc-keys`), with explicit validation of key ids/prefix (fail fast instead of silent mangling). - Crypto helpers reuse the shared `KeyAlgorithmSupport`/`KeyFormatConverter` instead of duplicating them. - Three constructors: injected `SecretClient` (recommended), client-secret credential, and Default Azure Credential chain (managed identity). - pom: `azure-sdk-bom` import + `azure-security-keyvault-secrets`/`azure-identity` as **optional** deps (same pattern as the optional AWS/spring-vault deps); `mockito-core` (test). - Docs: full section in `pqc-key-lifecycle.adoc` (security notes, naming, soft-delete behavior, three usage examples) + updated comparison table and component-page mention. ### Testing - 9 new unit tests against a mocked `SecretClient` simulating the vault store (store/round-trip through a fresh manager instance, listing, deletion, rotation/deprecation, expire/revoke, missing-key handling, invalid-name rejection) — all pass. Note: the AWS/Hashicorp managers currently have no unit tests, so this also raises the bar slightly. - `mvn clean install` in `components/camel-pqc`: BUILD SUCCESS. - Full reactor `mvn clean install -DskipTests` from root: success, no stale generated files. No backport: new feature, main/4.22.0 only. _Claude Code on behalf of Andrea Cosentino (@oscerd)._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
