This is an automated email from the ASF dual-hosted git repository. squakez pushed a commit to branch release-2.10.x in repository https://gitbox.apache.org/repos/asf/camel-k.git
commit 42b4573a779c4202a205a088e42c781cea3e4ed4 Author: Pasquale Congiusti <[email protected]> AuthorDate: Thu Aug 27 08:32:59 2026 +0200 feat(platform): provide maven repo allow list --- e2e/common/misc/maven_repository_test.go | 7 ++++++- pkg/platform/platform.go | 21 +++++++++++++++++++++ pkg/trait/builder.go | 7 +++++++ pkg/trait/camel.go | 8 ++++++++ 4 files changed, 42 insertions(+), 1 deletion(-) diff --git a/e2e/common/misc/maven_repository_test.go b/e2e/common/misc/maven_repository_test.go index cffb9a162..d4f3e78fc 100644 --- a/e2e/common/misc/maven_repository_test.go +++ b/e2e/common/misc/maven_repository_test.go @@ -38,7 +38,12 @@ func TestRunExtraRepository(t *testing.T) { t.Parallel() WithNewTestNamespace(t, func(ctx context.Context, g *WithT, ns string) { name := RandomizedSuffixName("java") - g.Expect(KamelRun(t, ctx, ns, "files/Java.java", "--maven-repository", "https://maven.repository.redhat.com/ga@id=redhat";, "--dependency", "mvn:org.jolokia:jolokia-core:1.7.1.redhat-00001", "--name", name).Execute()).To(Succeed()) + // NOTE: the repo was allow listed during operator installation procedure + g.Expect(KamelRun(t, ctx, ns, "files/Java.java", + "--maven-repository", "https://maven.repository.redhat.com/ga@id=redhat";, + "--dependency", "mvn:org.jolokia:jolokia-core:1.7.1.redhat-00001", + "--name", name, + ).Execute()).To(Succeed()) g.Eventually(IntegrationPodPhase(t, ctx, ns, name), TestTimeoutLong).Should(Equal(corev1.PodRunning)) g.Eventually(IntegrationConditionStatus(t, ctx, ns, name, v1.IntegrationConditionReady), TestTimeoutShort).Should(Equal(corev1.ConditionTrue)) diff --git a/pkg/platform/platform.go b/pkg/platform/platform.go index 4db7128e5..5065fc5b2 100644 --- a/pkg/platform/platform.go +++ b/pkg/platform/platform.go @@ -19,11 +19,15 @@ package platform import ( "context" + "os" + "slices" + "strings" v1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1" "github.com/apache/camel-k/v2/pkg/util/defaults" "github.com/apache/camel-k/v2/pkg/util/kubernetes" "github.com/apache/camel-k/v2/pkg/util/log" + "github.com/apache/camel-k/v2/pkg/util/maven" k8serrors "k8s.io/apimachinery/pkg/api/errors" k8sclient "sigs.k8s.io/controller-runtime/pkg/client" ) @@ -211,3 +215,20 @@ func GetTraitProfile(p *v1.IntegrationPlatform) v1.TraitProfile { return "" } + +// IsMavenRepoAllowed is used to verify if a given maven repository can be used or not. +func IsMavenRepoAllowed(mavenRepo string) bool { + csvRepos := getEnvOrDefault("MAVEN_REPOSITORIES_ALLOWED", maven.DefaultMavenRepositories) + allowedRepos := strings.Split(csvRepos, ",") + + return slices.Contains(allowedRepos, mavenRepo) +} + +func getEnvOrDefault(key string, deflt string) string { + env, exists := os.LookupEnv(key) + if exists { + return env + } else { + return deflt + } +} diff --git a/pkg/trait/builder.go b/pkg/trait/builder.go index bda791655..07193fa7f 100644 --- a/pkg/trait/builder.go +++ b/pkg/trait/builder.go @@ -26,6 +26,7 @@ import ( "strconv" "strings" + "github.com/apache/camel-k/v2/pkg/platform" "github.com/apache/camel-k/v2/pkg/util/boolean" corev1 "k8s.io/api/core/v1" @@ -353,11 +354,17 @@ func (t *builderTrait) builderTask(e *Environment, taskConf *v1.BuildConfigurati // Add Maven repositories defined in the IntegrationKit or Integration if e.IntegrationKit != nil { for _, repo := range e.IntegrationKit.Spec.Repositories { + if !platform.IsMavenRepoAllowed(repo) { + return nil, fmt.Errorf("maven repository %s is not allowed by the operator", repo) + } maven.Repositories = append(maven.Repositories, mvn.NewRepository(repo)) } } if e.Integration != nil { for _, repo := range e.Integration.Spec.Repositories { + if !platform.IsMavenRepoAllowed(repo) { + return nil, fmt.Errorf("maven repository %s is not allowed by the operator", repo) + } maven.Repositories = append(maven.Repositories, mvn.NewRepository(repo)) } } diff --git a/pkg/trait/camel.go b/pkg/trait/camel.go index 7e07d9109..bb526d2ee 100644 --- a/pkg/trait/camel.go +++ b/pkg/trait/camel.go @@ -29,6 +29,7 @@ import ( v1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1" traitv1 "github.com/apache/camel-k/v2/pkg/apis/camel/v1/trait" + "github.com/apache/camel-k/v2/pkg/platform" "github.com/apache/camel-k/v2/pkg/util/camel" "github.com/apache/camel-k/v2/pkg/util/defaults" "github.com/apache/camel-k/v2/pkg/util/kubernetes" @@ -187,6 +188,13 @@ func (t *camelTrait) loadOrCreateCatalog(e *Environment) error { if e.IntegrationKit != nil && e.IntegrationKit.Spec.Repositories != nil { extraRepositories = append(extraRepositories, e.IntegrationKit.Spec.Repositories...) } + // verify extra repos are allowed + for _, repo := range extraRepositories { + if !platform.IsMavenRepoAllowed(repo) { + return fmt.Errorf("maven repository %s is not allowed by the operator", repo) + } + } + catalog, err = camel.CreateCatalog(e.Ctx, e.Client, catalogNamespace, mavenSpec, e.Platform.Status.Build.GetTimeout().Duration, runtime, extraRepositories) if err != nil {
