You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "ephemeris-lappis (via GitHub)" <gi...@apache.org> on 2025/12/26 07:56:01 UTC
[I] Trait jvm should accept more than one certificate in caCert [camel-k]
ephemeris-lappis opened a new issue, #6432:
URL: https://github.com/apache/camel-k/issues/6432
### Requirement
Release 2.9.0 includes a new feature to set certificates into a custom JVM's trust store.
First, the documentation mentions mounted resources (secrets) but the implementation indeed needs mounted paths.
Next, real use cases involve setting more than one custom certificate. As well, the original JVM's cacerts should be optionally integrated into the new trust store. And, at last, to make things shorter, default passwords ("changeit" I think) may be used.
Here an example of a complete configuration in an integration with a proposed syntax (entries names and structure may be obviously adapted to follow camel-k usual ones).
```
traits:
mount:
resources:
- secret:ca1-secret@/ca/enterprise
- sectet:ca2-secret@/ca/partners
- secret:ca-passwords-secret@/ca/passwords
jvm:
cacerts:
certicates:
# perhaps the alias my be optional and a computed value my be used
- alias: corporate-ca
filePath: /ca/enterprise/company.crt
- alias: abc-ca
filePath: /ca/enterprise/application-abc.crt
- alias: xyz-ca
filePath: /ca/partners/partner-xyz.crt
# default value may be "changeit"
password: /ca/passwords/new.password
jdkCacertsCopy: true
# it seems to be possible to find it, but can be explicit
jdkCacertsPath: /opt/java/openjdk/lib/security/cacerts
# same default value
jdkCacertsPassword: /ca/passwords/jdk.password
```
Do you confirm that the trait is available the same way in integration platforms to be applied to all dependent integrations ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Trait jvm should accept more than one certificate in caCert [camel-k]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez closed issue #6432: Trait jvm should accept more than one certificate in caCert
URL: https://github.com/apache/camel-k/issues/6432
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Trait jvm should accept more than one certificate in caCert [camel-k]
Posted by "pkalsi97 (via GitHub)" <gi...@apache.org>.
pkalsi97 commented on issue #6432:
URL: https://github.com/apache/camel-k/issues/6432#issuecomment-3692423879
@ephemeris-lappis thanks for creating the issue. I'll work on this on the weekend. :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Trait jvm should accept more than one certificate in caCert [camel-k]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez commented on issue #6432:
URL: https://github.com/apache/camel-k/issues/6432#issuecomment-3719207966
Yes. We should have implemented to be an array of values. Beside that, we need to implement an additional option to allow users to merge the existing cacert instead of creating a new one. @pkalsi97 if you're working on this, feel free to tackle the two issues separately in order to simplify the development.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Trait jvm should accept more than one certificate in caCert [camel-k]
Posted by "pkalsi97 (via GitHub)" <gi...@apache.org>.
pkalsi97 commented on issue #6432:
URL: https://github.com/apache/camel-k/issues/6432#issuecomment-3719217104
@squakez thanks for the input, I am yet to look into this properly. I'll follow your suggestion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Trait jvm should accept more than one certificate in caCert [camel-k]
Posted by "ephemeris-lappis (via GitHub)" <gi...@apache.org>.
ephemeris-lappis commented on issue #6432:
URL: https://github.com/apache/camel-k/issues/6432#issuecomment-3719481155
If I'm not wrong, you didn't answer about the availability of this feature on both integration and integration platform : it's important I think to be able to set this kind of common configuration at the platform level for all or almost all the applications in a given namespace.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Trait jvm should accept more than one certificate in caCert [camel-k]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez commented on issue #6432:
URL: https://github.com/apache/camel-k/issues/6432#issuecomment-3719512638
I overlooked that. If it's available in the trait, then, it can be configured either in the `IntegrationPlatform` or `IntegrationProfile`. Prefer the second option, as we aim to remove in the future the concept of IntegrationPlatform.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org