oscerd opened a new pull request, #1866:
URL: https://github.com/apache/camel-kafka-connector/pull/1866
Fixes #1497. This also covers #1682, which was closed as a duplicate.
### Problem
With `camel.idempotency.repository.type=kafka`, `CamelKafkaConnectMain`
built the repository with `new KafkaIdempotentRepository(topic,
bootstrapServers, maxCacheSize, pollDuration)`. There was no way to pass
`security.protocol`, SASL or SSL settings, so the repository could not reach a
secured cluster.
### Change
- **New prefix.** `camel.idempotency.kafka.client.<property>` takes any
Kafka client property. The prefix is removed, and the properties are applied to
both the consumer and the producer of the repository, on top of
`camel.idempotency.kafka.bootstrap.servers`.
- The tasks collect them with `originalsWithPrefix`. They reach the
repository through a new
`CamelKafkaConnectMain.Builder#withIdempotentRepositoryKafkaClientProperties`.
- The repository uses the camel-kafka 4.22 constructor that takes consumer
and producer `Properties`. It still forces its String (de)serializers and
`enable.auto.commit=false`.
- Without client properties, the repository is built exactly as before.
- A prefixed `bootstrap.servers` takes precedence, as camel-kafka's
`additionalProperties` does.
- **Masking.** Every value under the prefix is masked in the "Setting
initial properties" startup log. `SensitiveUtils` only looks at the last
segment of a key, so it would have printed `sasl.jaas.config` (with its
password) and `ssl.keystore.key` in clear. I reproduced that on the unmodified
code. Kafka's own client config log still shows the non-secret settings, with
passwords hidden.
- **Docs.** `idempotency.adoc` gets a section "Using a secured Kafka cluster
for the Kafka idempotent repository", with an SSL example (with client
authentication) and a SASL_SSL/SCRAM example. Both read their secrets through a
`FileConfigProvider`. The prefix is also added to the basic configuration
tables.
### Tests
- `IdempotentRepositoryKafkaClientPropertiesTest`:
- checks the consumer and producer configuration of the bound repository,
as separate instances;
- checks that the old path is used without client properties;
- checks the precedence of a prefixed `bootstrap.servers`.
- `StartupPropertiesLoggingTest`:
- checks that the startup line masks `sasl.jaas.config`,
`ssl.truststore.password`, an `ssl.keystore.key` PEM and a custom option, while
the key names stay visible;
- starts a source task with SASL_SSL client properties and checks that no
secret reaches any INFO+ log line.
- `CamelSourceTaskTest` / `CamelSinkTaskTest`: a task started with
`security.protocol=SSL` and a missing truststore fails inside the repository's
real Kafka consumer. That proves the wiring without a broker.
- `./mvnw -pl core -Psourcecheck install`: 134 tests, 0 failures. Full
reactor build `./mvnw clean verify -DskipTests`: success. Not run: a test
against a real SSL/SASL broker, since the itest harness has no secured Kafka.
_Claude Code on behalf of Andrea Cosentino_
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
