oscerd opened a new pull request, #25621: URL: https://github.com/apache/camel/pull/25621
## What New **`camel-spiffe`** producer component (CAMEL-23305) integrating with the SPIFFE Workload API via `io.spiffe:java-spiffe-core` (Apache-2.0, on Maven Central) to provide cryptographic workload identity to Camel routes. ### Operations - `fetchX509Svid` — fetch the default X.509-SVID (mTLS cert chain + private key + SPIFFE ID). Body = `X509Svid`. - `fetchJwtSvid` — fetch a JWT-SVID for the configured / `CamelSpiffeAudience`-headered audience(s). Body = JWT token; `CamelSpiffeSpiffeId` / `CamelSpiffeExpiry` headers. - `validateJwtSvid` — validate a JWT-SVID (from the `CamelSpiffeToken` header or body) against an audience. Body = validated `JwtSvid`. The Workload API endpoint comes from the `spiffeSocketPath` option or the standard `SPIFFE_ENDPOINT_SOCKET` env var; an already-configured `WorkloadApiClient` can also be injected (`workloadApiClient` option) for advanced/testing use. ### Scope note This is the **first increment** of CAMEL-23305. The issue also proposes an `SSLContextParameters` implementation backed by the SPIFFE Workload API (with rotation) for zero-trust mTLS across TLS-capable components — left as a **follow-up**, as it's a deeper, design-heavy integration. ## Testing - `SpiffeProducerTest` (5 tests, Mockito + AssertJ, mocked `WorkloadApiClient`): all three operations, audience-from-header, and the missing-audience failure path. - Full-reactor `mvn clean install -DskipTests` passes; catalog / endpoint-DSL / component-DSL / BOM / docs all regenerated and committed. ## Dependency `io.spiffe:java-spiffe-core:0.8.17` — Apache-2.0, published to Maven Central, actively maintained. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
