oscerd opened a new issue, #9057:
URL: https://github.com/apache/camel-quarkus/issues/9057
`extensions-jvm/console/deployment/.../ConsoleProcessor.java:108-112`
```java
private static boolean canExposeManagementEndpoint(CamelConsoleConfig
config) {
return (LaunchMode.current().isDevOrTest()
&& config.exposureMode() ==
CamelConsoleConfig.ExposureMode.DEV_TEST)
||
config.exposureMode().equals(CamelConsoleConfig.ExposureMode.ALL);
}
```
The second clause has no launch-mode condition, so `exposure-mode=ALL`
registers `{quarkus root}/camel/dev-console` and `/camel/dev-console/:id` in
production too.
This is an explicit operator opt-in, so the default is fine. The sharp edge
is where it lands: with `quarkus.management.enabled=false` (the Quarkus
default) non-application routes are mounted on the **main HTTP port** under
`/q/` — the same socket serving application traffic — rather than on a separate
management port.
**Suggested fix**
Document clearly that `exposure-mode=ALL` in production requires the
endpoint to be protected, and consider requiring an explicit acknowledgement
property so the combination cannot be reached by accident.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
