oscerd commented on code in PR #25621:
URL: https://github.com/apache/camel/pull/25621#discussion_r3849747001
##########
components/camel-spiffe/src/main/docs/spiffe-component.adoc:
##########
@@ -0,0 +1,80 @@
+= SPIFFE Component
+:doctitle: SPIFFE
+:shortname: spiffe
+:artifactid: camel-spiffe
+:description: Fetch and validate SPIFFE workload identity (X.509-SVID and
JWT-SVID) from the SPIFFE Workload API.
+:since: 4.23
+:supportlevel: Preview
+:tabs-sync-option:
+:component-header: Only producer is supported
+
+*Since Camel {since}*
+
+*{component-header}*
+
+The SPIFFE component integrates with the https://spiffe.io/[SPIFFE] (Secure
Production Identity Framework
+For Everyone) Workload API to provide cryptographic workload identity to Camel
routes. It talks to a local
+SPIFFE Workload API endpoint — for example the one exposed by a
https://spiffe.io/docs/latest/spire-about/[SPIRE]
+agent — to fetch and validate SVIDs (SPIFFE Verifiable Identity Documents):
+
+* *X.509-SVID*: an X.509 certificate whose SPIFFE ID is encoded as a URI SAN,
used for mutual TLS.
+* *JWT-SVID*: a JWT whose subject is the SPIFFE ID, used as a bearer token for
workload-to-workload authentication.
+
+Maven users will need to add the following dependency to their `pom.xml`.
+
+[source,xml]
+------------------------------------------------------------
+<dependency>
+ <groupId>org.apache.camel</groupId>
+ <artifactId>camel-spiffe</artifactId>
+ <version>x.x.x</version>
+ <!-- use the same version as your Camel core version -->
+</dependency>
+------------------------------------------------------------
+
+== URI Format
+
+------------------------------------------------------------
+spiffe:label[?options]
+------------------------------------------------------------
+
+Where `label` is a logical name for the endpoint.
+
+// component options: START
+include::partial$component-configure-options.adoc[]
+include::partial$component-endpoint-options.adoc[]
+include::partial$component-endpoint-headers.adoc[]
+// component options: END
+
+== Workload API endpoint
+
+The address of the SPIFFE Workload API is taken from the `spiffeSocketPath`
option, or, when that is not set, from
+the standard `SPIFFE_ENDPOINT_SOCKET` environment variable — for example
`unix:///tmp/spire-agent/public/api.sock`.
+For advanced scenarios an already-configured
`io.spiffe.workloadapi.WorkloadApiClient` can be supplied through the
+`workloadApiClient` option; in that case the component neither creates nor
closes the client.
+
+== Operations
+
+The component supports the following producer operations:
+
+* `fetchX509Svid` — fetches the default X.509-SVID from the Workload API. The
message body is set to the
+`io.spiffe.svid.x509svid.X509Svid` (certificate chain, private key and SPIFFE
ID) and the `CamelSpiffeSpiffeId`
+header to its SPIFFE ID.
+* `fetchJwtSvid` — fetches a JWT-SVID for the configured `audience` (or the
`CamelSpiffeAudience` header). The
Review Comment:
Good call — added in 2b55ef7. There is now a NOTE in the Operations section
warning that `fetchX509Svid` (private key in the `X509Svid`) and `fetchJwtSvid`
(bearer token) place sensitive material on the message body, and advising
against logging/tracing it via the `log`/`trace` components or message-history
EIPs. Leaving the thread for you to resolve.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
