gnodet commented on PR #26845:
URL: https://github.com/apache/camel/pull/26845#issuecomment-5828854363

   @Croway Good questions — let me clarify the design.
   
   **Credential update**: the credentials are updated _before_ 
`onSecretRotation()` is called. The reload sequence in 
`DefaultContextReloadStrategy.onReload()` is:
   
   1. `reloadProperties()` — reloads the vault / properties sources
   2. `reloadComponentProperties()` — re-resolves placeholders and re-applies 
them to components (e.g. `camel.component.sql.dataSource.password`), so by this 
point the `DataSource` bean already holds the new password
   3. `notifySecretRotation()` — calls `onSecretRotation()` on all 
`SecretRotationAware` components
   4. `reloadRoutes()` — restarts routes
   
   So `softEvictConnections()` runs _after_ the DataSource has been 
reconfigured with the rotated credential. It evicts stale pooled connections so 
the pool opens fresh ones using the already-updated password — it does not need 
to carry the credential itself.
   
   **Agroal**: fair point. This PR starts with HikariCP support (by far the 
most common pool in Camel deployments) and uses a graceful fallback for unknown 
pools — log and let connections expire naturally. Adding Agroal 
`flush(FlushMode.GRACEFUL)` is a natural follow-up but probably belongs in a 
separate JIRA so we can iterate without blocking the core mechanism. The 
`DataSourceHelper` design makes it straightforward to add new pool vendors 
later — each is a reflection block with a no-match fallthrough.
   
   **Integration test with real rotation**: that would be valuable, but it 
requires a database container (Testcontainers + PostgreSQL), which is a 
significant test-infra addition for what is fundamentally a connection-eviction 
callback. The unit tests verify the reflection chain works correctly. A full 
end-to-end rotation test could be added as a follow-up.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to