oscerd opened a new pull request, #1900:
URL: https://github.com/apache/camel-spring-boot/pull/1900
The early-resolution parsers used by the vault and secrets starters resolve
`{{prefix:...}}` placeholders
before Spring Boot auto-configuration runs. Each swallowed per-property
failures:
```java
} catch (Exception e) {
// Log and do nothing
LOG.debug("failed to parse property {}. This exception is ignored.",
key, e);
}
```
When the lookup failed — wrong region, missing permission, secret not found,
endpoint unreachable — nothing
was put into the override property source, so the property kept its literal
`{{aws:...}}` text. That literal
then became the effective value of whatever it configured: a password, a
token, a URL. At `DEBUG` the
operator saw nothing at the default log level, and the application started
as though configuration had
succeeded.
### Change
A placeholder that matched a vault prefix but failed to resolve now aborts
startup with a
`RuntimeCamelException` naming the property. Continuing is not safe: the
value is known to be wrong, and the
wrongness is invisible.
`camel.vault.ignore-resolution-failures=true` restores the previous
tolerance, now logged at `WARN` rather
than `DEBUG` so it is visible at the default log level.
Applied uniformly to all seven parsers:
| Starter | Parser |
|---|---|
| camel-aws-secrets-manager-starter |
`SpringBootAwsSecretsManagerPropertiesParser` |
| camel-azure-key-vault-starter | `SpringBootAzureKeyVaultPropertiesParser` |
| camel-cyberark-vault-starter | `SpringBootCyberArkVaultPropertiesParser` |
| camel-google-secret-manager-starter |
`SpringBootGoogleSecretManagerPropertiesParser` |
| camel-hashicorp-vault-starter | `SpringBootHashicorpVaultPropertiesParser`
|
| camel-ibm-secrets-manager-starter |
`IBMSecretsManagerVaultPropertiesParser` |
| camel-spring-cloud-config-starter |
`SpringBootCloudConfigPropertiesParser` |
`camel-openapi-java-starter` and `camel-springdoc-starter` carry the same
`catch` text but in an unrelated
context, and are deliberately left alone.
### Tests
`EarlyResolutionFailureTest` in camel-hashicorp-vault-starter — a direct
unit test on the listener, pointed
at a port with nothing listening, so it needs neither Docker nor a network
(unlike the existing
`EarlyResolvedPropertiesTest`, which uses testcontainers). Two cases: an
unresolvable secret aborts startup
and names both the property and the opt-back flag; with
`camel.vault.ignore-resolution-failures=true` it does
not throw.
Verified meaningful: the first case fails against the unpatched parser
("nothing was thrown"), the second
passes either way as a guard on the opt-back path.
### Behaviour change — needs an upgrade-guide entry
This is deliberate and breaking for anyone currently relying on the silent
fallback. The camel-spring-boot
upgrade notes live in `apache/camel`
(`docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc`,
which already carries `camel-spring-boot` sections), so it needs a companion
PR there — I have not opened one
yet, since it should land alongside whatever wording you prefer here.
---
_Filed by Claude Code on behalf of Andrea Cosentino._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
