[jira] [Resolved] (CAMEL-24341) camel-google-secret-manager: GCP vault refresh task reads the AWS vault configuration and reloads repeatedly

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24341?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino resolved CAMEL-24341.
--------------------------------------
    Resolution: Fixed

Fixed on main via PR https://github.com/apache/camel/pull/25326 — the GCP vault refresh task now reads the GCP vault configuration instead of the AWS one. Backports opened for camel-4.18.x (#25339) and camel-4.14.x (#25340).

_Claude Code on behalf of Andrea Cosentino (@oscerd)._

> camel-google-secret-manager: GCP vault refresh task reads the AWS vault configuration and reloads repeatedly
> ------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24341
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24341
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-google
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.14.9, 4.18.4, 4.22.0
>
>
> The GCP secret refresh task {{PubsubReloadTriggerTask}} has several defects:
> 1. It reads the *AWS* vault configuration instead of the GCP one:
> {code:java}
> // PubsubReloadTriggerTask.java:131
> secrets = camelContext.getVaultConfiguration().aws().getSecrets();
> {code}
> {{camel.vault.gcp.secrets}} is a documented option (GcpVaultConfiguration#getSecrets) but is never read. When only the GCP property is configured (without a properties function), doStart fails with "Secrets must be configured on GCP vault configuration".
> 2. {{triggerReloading}} is an instance field that is never reset:
> {code:java}
> // PubsubReloadTriggerTask.java:223,240
> private boolean triggerReloading;
> ...
> if (triggerReloading) { ... reload.onReload(this); }
> {code}
> Once one matching secret event is seen, every subsequent Pub/Sub message on that subscription triggers a CamelContext reload. The AWS equivalent uses a local variable (CloudTrailReloadTriggerTask:271).
> 3. {{run()}} starts the subscriber on every tick:
> {code:java}
> // PubsubReloadTriggerTask.java:190
> subscriber.startAsync().awaitRunning();
> {code}
> The task is scheduled with {{schedulePeriodTask(r, period)}} (camel.vault.gcp.refreshPeriod, default 30000ms), and startAsync() throws IllegalStateException once the service is no longer NEW, so every tick after the first fails. A start-once guard is needed.
> 4. {{receiveMessage}} dereferences message attributes without a null check ({{eventType.equalsIgnoreCase(...)}}, {{matchSecret(secretId)}} at :227-230), so any Pub/Sub message on the subscription without the {{eventType}}/{{secretId}} attributes throws and is redelivered indefinitely.
> Also: the javadoc of {{setReloadEnabled}} says "on AWS secret updated", and {{GoogleSecretManagerPropertiesFunction}} javadoc (:58-59) documents {{camel.vault.aws.serviceAccountKey}} / {{camel.vault.aws.projectId}} instead of the {{gcp}} equivalents; {{GoogleSecretManagerPropertiesFunction:210}} allocates a new ObjectMapper on every secret lookup.
> The class currently has no test coverage.
> Found during a source audit of the {{components/camel-google}} module family against main @ c3b01310be15.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)