oscerd opened a new pull request, #26191: URL: https://github.com/apache/camel/pull/26191
## What Registers a producer readiness health check for the OPA server behind a `camel-opa` endpoint. ## Why `camel-opa` fails closed by design: when the policy cannot be evaluated at all — OPA unreachable, timed out, or answering with an error — the producer throws `OpaPolicyEvaluationException` and `OpaSecurityPolicy` throws `CamelAuthorizationException`. That is right for an authorization component, but it means an OPA server that is down fails *every* exchange through the route, and the only signal was the failures themselves. ## What changed `OpaProducerHealthCheck extends AbstractHealthCheck` probes the server's `/health` endpoint, following the shape of `KafkaProducerHealthCheck` and `RemoteFileProducerHealthCheck`. `OpaProducer` registers it in the `producers` repository on start and removes it on stop. `OpaComponent` now extends `HealthCheckComponent` rather than `DefaultComponent` — that is what supplies the standard `healthCheckProducerEnabled` / `healthCheckConsumerEnabled` options — which needed a typed `getComponent()` override on the endpoint, the same one `KafkaEndpoint` carries. Two things worth a look: - **The check is skipped when an `opaClient` was injected.** An injected client can point anywhere, and the endpoint has no way to ask it where it connects. Probing the configured `serverUrl` in that case would report on a server the producer may never talk to — a health check that lies is worse than no health check, so none is registered. - **Unreachable and unhealthy are reported differently.** A connection failure and a `/health` answering with an error code produce distinct messages and details, so an outage is never confused with a policy that denied. That distinction is the same one the component already draws between an evaluation failure and a deny. `/health` is a good probe target here because it is what `camel-test-infra-opa` already uses as its Testcontainers wait strategy, so it is known to behave. Note that Camel disables producer health checks globally by default; they are enabled with `camel.health.producersEnabled=true`, or per component with `healthCheckProducerEnabled`. ## Testing 28 unit tests (was 25). The three new ones drive the check against a real `HttpServer` covering healthy (200), unhealthy (500 — asserting the status code reaches the details) and unreachable. Full reactor build green. `main` only — additive. _Claude Code on behalf of @oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
