jamesnetherton opened a new pull request, #554:
URL: https://github.com/apache/camel-quarkus-examples/pull/554
The `cyberark-vault` example logged retrieved secret values at INFO level,
which undercuts the point of a vault integration example — anyone copying this
pattern writes their vault secrets to the application log. The log statements
now report the secret id and the fact that it resolved, not what it resolved to.
Credentials were also interpolated into the endpoint URIs from
`@ConfigProperty` fields via `String.format`. They are now referenced with
property placeholders wrapped in `RAW()`, leaving the secret id as the only
interpolated value.
`RAW()` is not cosmetic here. Camel URI decodes query parameter values, so a
credential containing `+` is silently turned into a space before it reaches the
component. Conjur API keys are base64 encoded and routinely contain `+`, so the
example as written would fail for a meaningful fraction of real API keys:
```
URISupport.parseQuery("apiKey=3ah+x8/dy3==") -> {apiKey=3ah x8/dy3==}
```
Verified end to end by pointing the packaged application at a stub Conjur
endpoint with the API key `ab+cd/ef==` and capturing the outbound
authentication request — the body arrives as `ab+cd/ef==` intact.
Dropping the `@ConfigProperty` fields in favour of placeholders also removes
six fields and matches the convention used across the other examples. Note that
`application.properties` resolves these from the environment via `{{env:...}}`,
so Camel now resolves them two levels deep; this is supported
(`nestedPlaceholder` defaults to `true`) and was confirmed by running the
packaged application with the environment variables set.
The README stated that the dev mode log output would show the resolved
secret value, which is no longer true, so it has been updated.
Finally, the test resource receives the Conjur credentials from the
container at runtime and can only pass them as plain text. Camel's startup
security check warns about this, which is correct but expected under the test
profile — a comment now records why, so the warning does not read as an
oversight in an example about secret handling.
Verified with `mvn clean install` and `mvn license:check formatter:validate
impsort:check`. The native build was not run locally and is left to CI.
_Claude Code on behalf of James Netherton_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
