You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "apupier (via GitHub)" <gi...@apache.org> on 2026/10/07 15:17:46 UTC
[PR] camel-test-infra-spiffe: fix IT failures on rootless Pcontainer [camel]
apupier opened a new pull request, #27509:
URL: https://github.com/apache/camel/pull/27509
Two bugs caused all SpiffeWorkloadApiIT and SpiffeMutualTlsIT tests to fail with PERMISSION_DENIED: no identity issued on rootless container (by default for podman and by default on Jenkins CI)
**Wrong workload UID under rootless Podman**
createWorkloadEntry() registered the SPIRE unix:uid selector using UnixSystem.getUid(), which returns the host UID of the test process (e.g. 1000). Under rootless Podman every container runs in a Linux user namespace where the owner's host UID is mapped to UID 0 inside the container. The agent uses that user namespace when reading /proc/<pid>/status to attest workloads, so it sees the test process as UID 0 - not 1000. The mismatch meant no workload entry ever matched, producing PERMISSION_DENIED for every SVID request.
Fix: add resolveWorkloadUid() which calls DockerClientFactory's info API and checks the "Rootless" key in the raw JSON response (Podman sets it to true; the docker-java Info model has no typed field for it, so it lands in rawValues). When rootless, return 0; otherwise fall back to the real host UID from UnixSystem.
**No agent readiness gate after socket creation**
waitForSocket() only checked that the socket file existed, returning the moment the file appeared. At that point the agent had just created the socket but had not finished its initial sync with the SPIRE server and was not yet ready to serve workload requests.
Fix: add waitForAgentHealthy() which polls "spire-agent healthcheck -socketPath ..." inside the running agent container, mirroring the existing waitForServerHealthy() pattern for the server. initialize() now calls waitForSocket() followed by waitForAgentHealthy() before handing the service to the tests.
Co-authored-by: IBM Bob 2.2.1
# Description
<!--
- Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
-->
# Target
- [ ] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch)
# Tracking
- [ ] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it).
<!--
# *Note*: trivial changes like, typos, minor documentation fixes and other small items do not require a JIRA issue. In this case your pull request should address just this issue, without pulling in other changes.
-->
# Apache Camel coding standards and style
- [ ] I checked that each commit in the pull request has a meaningful subject line and body.
<!--
If you're unsure, you can format the pull request title like `[CAMEL-XXX] Fixes bug in camel-file component`, where you replace `CAMEL-XXX` with the appropriate JIRA issue.
-->
- [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes.
<!--
You can run the aforementioned command in your module so that the build auto-formats your code. This will also be verified as part of the checks and your PR may be rejected if if there are uncommited changes after running `mvn clean install -DskipTests`.
You can learn more about the contribution guidelines at https://github.com/apache/camel/blob/main/CONTRIBUTING.md
-->
# AI-assisted contributions
- [ ] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] camel-test-infra-spiffe: fix IT failures on rootless container [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #27509:
URL: https://github.com/apache/camel/pull/27509#discussion_r4210387100
##########
test-infra/camel-test-infra-spiffe/src/main/java/org/apache/camel/test/infra/spiffe/services/SpiffeLocalContainerInfraService.java:
##########
@@ -192,11 +196,36 @@ private String generateJoinToken() {
}
private void createWorkloadEntry() {
- long uid = new UnixSystem().getUid();
+ long uid = resolveWorkloadUid();
+ LOG.info("Registering workload entry for unix:uid:{}", uid);
exec(server, SERVER_BIN, "entry", "create", "-parentID", AGENT_SPIFFE_ID, "-spiffeID", WORKLOAD_SPIFFE_ID,
"-selector", "unix:uid:" + uid);
}
+ /**
+ * Returns the UID of this JVM process as it will appear to the SPIRE unix workload attestor.
+ * <p>
+ * Under rootless Podman the container's user namespace maps the host owner uid to container uid 0, so the agent
+ * sees the test process as uid 0 when reading {@code /proc/<pid>/status} through the host PID namespace. On a
+ * standard (root-owned) Docker daemon no such remapping occurs and the real host uid is used.
+ * <p>
+ * Rootless mode is detected via the Docker info API: Podman returns {@code "Rootless": true} in the JSON response
+ * (captured in {@code rawValues} since the docker-java model does not have a typed field for it).
+ */
+ private long resolveWorkloadUid() {
+ Info info = DockerClientFactory.instance().client().infoCmd().exec();
+ Object rootless = info.getRawValues().get("Rootless");
Review Comment:
This covers rootless Podman. Rootless Docker also remaps the owner uid to 0, but I believe it advertises it via `SecurityOptions` (`name=rootless`) rather than a `Rootless` key. Would it be worth checking that too, e.g. `info.getSecurityOptions() != null && info.getSecurityOptions().stream().anyMatch(o -> o.contains("rootless"))`?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] camel-test-infra-spiffe: fix IT failures on rootless container [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27509:
URL: https://github.com/apache/camel/pull/27509#issuecomment-6041489324
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `test-infra/camel-test-infra-spiffe`
:repeat: **1 test passed only after a retry on JDK 25** (1 retried attempt)
<details><summary>Recovered flaky tests on JDK 25 (1)</summary>
| Module | Test | Failed attempts | First failure |
| --- | --- | --- | --- |
| `dsl/camel-jbang/camel-jbang-plugin-tui` | `AiPanelAcpTest.usageUpdateFeedsTheTokenCounter` | 1 | array contents differ at index [0], expected: <900> but was: <0> |
> :information_source: These tests did **not** fail the build. Surefire retried them and they passed.
> Retries are enabled project-wide by `surefire.rerunFailingTestsCount` in `parent/pom.xml`.
</details>
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 11 of 700 tested, 27 compile-only — current: 11 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **11 affected modules** (current approach: 11).
**Skip-tests mode would test 11 modules** (1 direct + 10 downstream), **skip tests for 27** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (11)</summary>
- `camel-jbang-mcp` ← downstream of org.apache.camel:camel-catalog
- `camel-jbang-plugin-mcp` ← downstream of org.apache.camel:camel-jbang-core
- `camel-jbang-plugin-route-parser` ← downstream of org.apache.camel:camel-route-parser
- `camel-jbang-plugin-tui` ← downstream of org.apache.camel:camel-catalog
- `camel-jbang-plugin-validate` ← downstream of org.apache.camel:camel-yaml-dsl-validator
- `camel-launcher-container` ← downstream of org.apache.camel:camel-launcher
- `camel-spiffe` ← downstream of org.apache.camel:camel-test-infra-spiffe
- `camel-test-infra-all` ← downstream of org.apache.camel:camel-test-infra-spiffe
- `camel-test-infra-spiffe` ← test-infra/camel-test-infra-spiffe/src/main/java/org/apache/camel/test/infra/spiffe/services/SpiffeLocalContainerInfraService.java
- `camel-yaml-dsl-validator` ← downstream of org.apache.camel:camel-catalog
- `camel-yaml-dsl-validator-maven-plugin` ← downstream of org.apache.camel:camel-yaml-dsl-validator
</details>
<details><summary>Modules with tests skipped (27)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>All tested modules (38 modules, 6m 28s total)</summary>
**Total reactor time:** 6m 28s
| Module | Duration | Status |
| --- | --- | --- |
| Camel :: Launcher | 52.5s | SUCCESS |
| Camel :: JBang :: Plugin :: TUI | 46.3s | SUCCESS |
| Camel :: JBang :: MCP | 40.9s | SUCCESS |
| Camel :: SPIFFE | 27.7s | SUCCESS |
| Camel :: Catalog :: Camel Catalog | 22.6s | SUCCESS |
| Camel :: YAML DSL | 18.8s | SUCCESS |
| Camel :: YAML DSL :: Validator | 18.7s | SUCCESS |
| Camel :: Component DSL | 17.9s | SUCCESS |
| Camel :: JBang :: Plugin :: Validate | 15.8s | SUCCESS |
| Camel :: Test Infra :: All test services | 15.5s | SUCCESS |
| Camel :: Docs | 14.8s | SUCCESS |
| Camel :: JBang :: Plugin :: Testing | 13.5s | SUCCESS |
| Camel :: JBang :: Plugin :: Kubernetes | 11.7s | SUCCESS |
| Camel :: Kamelet Main | 10.8s | SUCCESS |
| Camel :: YAML DSL :: Deserializers | 8.0s | SUCCESS |
| Camel :: YAML DSL :: Validator Maven Plugin | 7.9s | SUCCESS |
| Camel :: Catalog :: Camel Route Parser | 7.3s | SUCCESS |
| Camel :: Catalog :: Camel Report Maven Plugin | 6.6s | SUCCESS |
| Camel :: All Components Sync point | 4.7s | SUCCESS |
| Camel :: Test Infra :: SPIFFE | 4.3s | SUCCESS |
| Camel :: YAML DSL :: Maven Plugins | 3.2s | SUCCESS |
| Camel :: Catalog :: Maven | 2.5s | SUCCESS |
| Camel :: Catalog :: Suggest (deprecated) | 2.4s | SUCCESS |
| Camel :: Assembly | 1.7s | SUCCESS |
| Camel :: JBang :: Plugin :: Edit | 1.6s | SUCCESS |
| Camel :: JBang :: Main | 1.6s | SUCCESS |
| Camel :: Coverage | 1.3s | SUCCESS |
| Camel :: JBang :: Integration tests | 1.3s | SUCCESS |
| Camel :: JBang :: Plugin :: MCP | 1.1s | SUCCESS |
| Camel :: Catalog :: Dummy Component | 1.0s | SUCCESS |
| Camel :: JBang :: Plugin :: Generate | 1.0s | SUCCESS |
| Camel :: Catalog :: Console | 0.9s | SUCCESS |
| Camel :: Endpoint DSL :: Support | 0.8s | SUCCESS |
| Camel :: Launcher :: Container | 0.7s | SUCCESS |
| Camel :: JBang :: Plugin :: Route Parser | 0.5s | SUCCESS |
| Camel :: Endpoint DSL | n/a | |
| Camel :: Integration Tests | n/a | |
| Camel :: JBang :: Core | n/a | |
**Top 20 slowest modules:**
- `Camel :: Launcher` (52.5s)
- `Camel :: JBang :: Plugin :: TUI` (46.3s)
- `Camel :: JBang :: MCP` (40.9s)
- `Camel :: SPIFFE` (27.7s)
- `Camel :: Catalog :: Camel Catalog` (22.6s)
- `Camel :: YAML DSL` (18.8s)
- `Camel :: YAML DSL :: Validator` (18.7s)
- `Camel :: Component DSL` (17.9s)
- `Camel :: JBang :: Plugin :: Validate` (15.8s)
- `Camel :: Test Infra :: All test services` (15.5s)
- `Camel :: Docs` (14.8s)
- `Camel :: JBang :: Plugin :: Testing` (13.5s)
- `Camel :: JBang :: Plugin :: Kubernetes` (11.7s)
- `Camel :: Kamelet Main` (10.8s)
- `Camel :: YAML DSL :: Deserializers` (8.0s)
- `Camel :: YAML DSL :: Validator Maven Plugin` (7.9s)
- `Camel :: Catalog :: Camel Route Parser` (7.3s)
- `Camel :: Catalog :: Camel Report Maven Plugin` (6.6s)
- `Camel :: All Components Sync point` (4.7s)
- `Camel :: Test Infra :: SPIFFE` (4.3s)
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/37642661554)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-25436 -: fix IT failures on rootless container [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus merged PR #27509:
URL: https://github.com/apache/camel/pull/27509
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] camel-test-infra-spiffe: fix IT failures on rootless container [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27509:
URL: https://github.com/apache/camel/pull/27509#issuecomment-6054118533
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org