You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "Valeriy Ak (Jira)" <ji...@apache.org> on 2025/03/11 07:14:00 UTC
[jira] [Updated] (ARTEMIS-5347) Add support env variable in bootstrap.xml config
[ https://issues.apache.org/jira/browse/ARTEMIS-5347?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Valeriy Ak updated ARTEMIS-5347:
--------------------------------
Description:
Bootstrap.xml supports tls connections, for this option you should set keystore path and keystore password, like:
{code:java}
//Bootstrap.xml
<binding uri="https://0.0.0.0:8161"
keyStorePath="keystore.jks"
keyStorePassword="ENC("@#$%UIO")" passwordCodec="org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec"
> {code}
In this config you must set the encrypted password directly and placeholders are not supported. Below code for reading password:
{code:java}
//BindingDTO
private String getPassword(String password) throws Exception {
return PasswordMaskingUtil.resolveMask(password, this.passwordCodec);
}
//PasswordMaskingUtil
public static String resolveMask(String password, String codecClass) throws Exception {
return resolveMask(null, password, codecClass);
}
public static String resolveMask(Boolean maskPassword, String password, String codecClass) throws Exception {
String plainText = password;
if (maskPassword == null) {
if (isEncMasked(password)) {
//masked
String bareMaskedPassword = unwrap(password);
plainText = getCodec(codecClass).decode(bareMaskedPassword);
}
} else if (maskPassword) {
plainText = getCodec(codecClass).decode(password);
}
return plainText;
}{code}
There is no way to get values from placeholders/envs, like it is done in broker.xml.
In a cloud environment where credentials are passed by the pod environment this is a problem. It's annoying that only this config does not support values from env and requires additional actions to make it work.
So can you realse this support? I see two way for this:
# Add new sensitiveDataCode that will get vaule from env
# Read this config by XMLUtil as others, this reader support both props and envs plaseholders
was:
Bootstrap.xml supports tls connections, for this option you should set keystore path and keystore password, like:
{code:java}
<binding uri="https://0.0.0.0:8161"
keyStorePath="keystore.jks"
keyStorePassword="ENC("@#$%UIO")" passwordCodec="org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec"
> {code}
In this config you must set the encrypted password directly and placeholders are not supported. Below code for reading password:
{code:java}
//BindingDTO
private String getPassword(String password) throws Exception {
return PasswordMaskingUtil.resolveMask(password, this.passwordCodec);
}
//PasswordMaskingUtil
public static String resolveMask(String password, String codecClass) throws Exception {
return resolveMask(null, password, codecClass);
}
public static String resolveMask(Boolean maskPassword, String password, String codecClass) throws Exception {
String plainText = password;
if (maskPassword == null) {
if (isEncMasked(password)) {
//masked
String bareMaskedPassword = unwrap(password);
plainText = getCodec(codecClass).decode(bareMaskedPassword);
}
} else if (maskPassword) {
plainText = getCodec(codecClass).decode(password);
}
return plainText;
}{code}
There is no way to get values from placeholders/envs, like it is done in broker.xml.
In a cloud environment where credentials are passed by the pod environment this is a problem. It's annoying that only this config does not support values from env and requires additional actions to make it work.
So can you realse this support? I see two way for this:
# Add new sensitiveDataCode that will get vaule from env
# Read this config by XMLUtil as others, this reader support both props and envs plaseholders
> Add support env variable in bootstrap.xml config
> -------------------------------------------------
>
> Key: ARTEMIS-5347
> URL: https://issues.apache.org/jira/browse/ARTEMIS-5347
> Project: ActiveMQ Artemis
> Issue Type: New Feature
> Components: Configuration
> Affects Versions: 2.38.0
> Reporter: Valeriy Ak
> Priority: Major
> Labels: bootstrap, console
>
> Bootstrap.xml supports tls connections, for this option you should set keystore path and keystore password, like:
> {code:java}
> //Bootstrap.xml
> <binding uri="https://0.0.0.0:8161"
> keyStorePath="keystore.jks"
> keyStorePassword="ENC("@#$%UIO")" passwordCodec="org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec"
> > {code}
>
> In this config you must set the encrypted password directly and placeholders are not supported. Below code for reading password:
> {code:java}
> //BindingDTO
> private String getPassword(String password) throws Exception {
> return PasswordMaskingUtil.resolveMask(password, this.passwordCodec);
> }
> //PasswordMaskingUtil
> public static String resolveMask(String password, String codecClass) throws Exception {
> return resolveMask(null, password, codecClass);
> }
> public static String resolveMask(Boolean maskPassword, String password, String codecClass) throws Exception {
> String plainText = password;
> if (maskPassword == null) {
> if (isEncMasked(password)) {
> //masked
> String bareMaskedPassword = unwrap(password);
> plainText = getCodec(codecClass).decode(bareMaskedPassword);
> }
> } else if (maskPassword) {
> plainText = getCodec(codecClass).decode(password);
> }
> return plainText;
> }{code}
>
> There is no way to get values from placeholders/envs, like it is done in broker.xml.
> In a cloud environment where credentials are passed by the pod environment this is a problem. It's annoying that only this config does not support values from env and requires additional actions to make it work.
>
> So can you realse this support? I see two way for this:
> # Add new sensitiveDataCode that will get vaule from env
> # Read this config by XMLUtil as others, this reader support both props and envs plaseholders
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@activemq.apache.org
For additional commands, e-mail: issues-help@activemq.apache.org
For further information, visit: https://activemq.apache.org/contact