[jira] [Commented] (CAMEL-21812) camel-jbang - Provide an option in camel k8s to trust a given cert

["Thomas Diesler (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CAMEL-21812?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17934164#comment-17934164 ] 

Thomas Diesler commented on CAMEL-21812:
----------------------------------------

With this change, containers now generally use an enhanced version of run-java.sh (which we have had in jbang-core templates) as entrypoint.

The entrypoint now supports SSL_TRUSTSTORE_CERTIFICATES which is already supported by the Strimzi Kafka image.
When using `jbang camel kubernetes` you add certificates that you want the resulting java process to trust the set of input files and either use the SSL_TRUSTSTORE_CERTIFICATES envar directly or use `--property=ssl.truststore.certificates=...` which will then map to that envar.

For eaxmple like this

{code}
	jbang camel kubernetes export platform-http-files/* tls/* \
	--dep=org.apache.camel:camel-oauth:4.11.0-SNAPSHOT \
	--gav=examples:platform-http-oauth:1.0.0 \
	--property=camel.oauth.baseUri=https://keycloak.local/kc/realms/camel \
	--property=camel.oauth.redirectUri=http://127.0.0.1:8080/auth \
	--property=camel.oauth.logout.redirectUri=http://127.0.0.1:8080/ \
	--property=camel.oauth.clientId=camel-client \
	--property=camel.oauth.clientSecret=camel-client-secret \
	--property=ssl.truststore.certificates=tls/cluster.crt \
	--trait container.image-pull-policy=IfNotPresent \
	--ignore-loading-error=true \
	--image-builder=docker \
	--image-push=false \
	--runtime=camel-main
{code}

run-java.sh adds the given certificates to the truststore on startup

> camel-jbang - Provide an option in camel k8s to trust a given cert
> ------------------------------------------------------------------
>
>                 Key: CAMEL-21812
>                 URL: https://issues.apache.org/jira/browse/CAMEL-21812
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-jbang, camel-oauth
>            Reporter: Thomas Diesler
>            Assignee: Thomas Diesler
>            Priority: Major
>             Fix For: 4.11.0
>
>
> Communication with Keycloak should not happen over an insecure channel. Specifically, some OAuth/OIDC protocols require TLS before they are willing to send sensitive data across the wire.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)