oscerd opened a new pull request, #29708: URL: https://github.com/apache/camel/pull/29708
## Summary Third and last PR for [CAMEL-25675](https://issues.apache.org/jira/browse/CAMEL-25675), after #29235 (AppRole, Kubernetes, JWT, token renewal) and #29619 (TLS and the cert login). It adds the cloud logins to the `hashicorp-vault` endpoint, the `hashicorp:` properties function and the secret refresh task, and the follow-ups of the review of #29619. **Cloud logins** (`authentication=`), each with `role` and `authMountPath`: - `aws-iam`: Spring Vault's `AwsIamAuthentication`, with the credentials of the AWS SDK default chain (environment, system properties, web identity such as IRSA on EKS, profile, ECS container, EC2 instance profile). The AWS SDK is an optional dependency (`software.amazon.awssdk:auth`, `${aws-java-sdk2-version}`): the login is in a class of its own, loaded only for `aws-iam`, and the validation says which dependency to add when it is missing. New options: `awsRegion` (the signing region), `awsStsEndpoint` (default the global `https://sts.amazonaws.com/`, which takes requests signed for `us-east-1`) and `awsIamServerId` (the `X-Vault-AWS-IAM-Server-ID` header). The credentials provider is closed with the client. - `azure-msi`: Spring Vault's `AzureMsiAuthentication`, with the token of the managed identity for `azureResource`, which must be the resource of Vault's Azure login. The default is `https://management.azure.com/`, as in Vault's Azure login documentation, rather than Spring Vault's `https://vault.hashicorp.com`. `azureClientId` chooses a user-assigned identity. A pod of AKS with workload identity gets its identity as a token in a file rather than from the instance metadata service: the docs point it to the `jwt` login with `jwtFile`. - `gcp-gce`: Spring Vault's `GcpComputeAuthentication`, with the identity token of the default service account of the instance. - The Azure instance metadata service and the Compute Engine metadata server are called without a proxy, as both clouds require. `gcp-iam` is left out: it needs `google-cloud-iamcredentials` (gRPC, not managed in the parent POM) and only works with a service account key file. **Follow-ups of the review of #29619** - The `role`, `authMountPath` and `keyStore` option descriptions now cover `cert` and PKCS#1, and the cloud logins. - The TLS section says that the stores are read when the client is created, so a renewed client certificate is used after a restart. - A PKCS12 or JKS trust store that reads as empty fails with a hint about `trustStorePassword`: a keytool-made PKCS12 trust store read without its password does come back empty (tested). - A test with an EC key in PKCS#8, and the "Java 17" comment of `HashicorpVaultTls`. ## Tests - `HashicorpVaultCloudLoginTest`: the `aws-iam` login against the fake Vault, with credentials and region from the AWS SDK system properties. It checks the request URL, the body, the server ID header and the region of the signature, with and without `awsRegion`/`awsStsEndpoint`. The `azure-msi` and `gcp-gce` options (token URI with resource and client ID, role, mount path, service account), and creating and closing their clients without reaching the cloud. The role is required by the three logins. - `HashicorpVaultTlsTest`: the EC key and the empty trust store. `HashicorpVaultClientSettingsTest`: the cloud settings from the environment variables and the configuration. - All 76 unit tests pass, and all 38 integration tests of the module pass against `mirror.gcr.io/hashicorp/vault:2.2.1` (no new integration test: the cloud logins need a cloud identity). Full reactor build (`mvn clean install -DskipTests -DskipITs`) with the regenerated files committed. CAMEL-25675 was resolved when #29619 was merged; it is reopened for this last PR. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
