You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "allthingssecurity (via GitHub)" <gi...@apache.org> on 2026/10/11 00:03:53 UTC

[PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

allthingssecurity opened a new pull request, #27669:
URL: https://github.com/apache/camel/pull/27669

   # Description
   
   [CAMEL-25518](https://issues.apache.org/jira/browse/CAMEL-25518)
   
   With `camel.vault.hashicorp.refreshEnabled=true`, the refresh task also tracks the secrets the `hashicorp:` properties function resolved (the documented behaviour when `camel.vault.hashicorp.secrets` is not set). Two problems:
   
   - The function recorded `hashicorp:kv:db#password` as `db`. The task reads a name without an engine from the `secret` engine, so it polled `secret/metadata/db`, got nothing, and an update of a secret in any other engine never triggered a reload.
   - The task's first run only records the version it sees. It runs one refresh period (60 s by default) after startup, so an update in that window became the baseline and the application kept the old value.
   
   This change records the secret in the format of `camel.vault.hashicorp.secrets`, which the task already parses: `engine:secret`, or only `secret` for the default `secret` engine (so the names of those secrets do not change). It also remembers the version the function resolved (from `data.metadata.version`, not when a specific `@version` was requested), and the task starts from that version for a secret it has not seen yet. The recorded set and the new version map are concurrent collections, as the task reads them from its own thread. New public method: `HashicorpVaultPropertiesFunction.getSecretVersion(String)`. The component docs (and their catalog copy) and the 4.23 upgrade guide describe the change, including the new names of secrets of other engines in `getSecrets()` and in the task's updates.
   
   Tests:
   - New `HashicorpVaultReloadTriggerTaskTest` with a small in-process fake of the Vault KV v2 HTTP API (JDK `HttpServer`, no container): an update in the `kv` engine, an update before the first check, the recorded names, a secret resolved at a specific version (`@1`) that must not be compared with that version, and an unchanged secret that must not trigger a reload (the last two pass without the change too; they guard against a reload caused by the remembered version).
   - Without the change: `the refresh task must read the metadata of the engine the secret was resolved from, but read [secret/metadata/db, secret/metadata/db]`, `the application resolved version 1 but version 2 was not detected, updates: {}`, and the recorded names are `db` and `api` instead of `kv:db` and `api`.
   - With the change, the camel-hashicorp-vault unit tests pass (7). The ITs need a Vault container; I did not run them.
   
   Found with a TLA+ model of startup resolution, secret updates and the refresh runs: "after a complete check run with no update since it started, the application uses the current version of every secret" is violated for a `kv` secret (12 steps) and for an update before the first check (8 steps). I then reproduced both with the real classes.
   
   Affected: 4.17.0 and later (the refresh was added by CAMEL-22676).
   
   # Target
   
   - [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch)
   
   # Tracking
   - [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it).
   
   # Apache Camel coding standards and style
   
   - [x] I checked that each commit in the pull request has a meaningful subject line and body.
   - [ ] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes.
     (I built and tested camel-hashicorp-vault, including the formatter and import-sort plugins, and updated the catalog copy of the component page. I did not run the full root build.)
   
   # AI-assisted contributions
   
   - [x] If this PR includes AI-generated code, commits have proper co-authorship attribution (e.g., `Co-authored-by` trailers) and the PR description identifies the AI tool used.
     This PR was prepared with Claude Code (Claude Opus 5.5). The commit carries a `Co-Authored-By` trailer.
   
   _Claude Code on behalf of allthingssecurity_
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4240437086


##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +267,26 @@ private String getSecretFromSource(String key, String subkey, String defaultValu
         return returnValue;
     }
 
+    /**
+     * The name of a secret as the refresh task tracks it: engine:secret, or only the secret for the default secret
+     * engine. A lookup without engine is tracked as a secret of the default secret engine, which is also how the
+     * refresh task reads a name without engine.
+     */
+    private static String trackedSecretName(String secretEngine, String key) {
+        return secretEngine == null || "secret".equals(secretEngine) ? key : secretEngine + ":" + key;
+    }
+
+    private void captureVersion(String secretName, VaultResponse rawSecret) {
+        if (rawSecret.getData().get("metadata") instanceof Map<?, ?> metadata && metadata.get("version") != null) {
+            try {
+                secretVersions.put(secretName, Integer.valueOf(metadata.get("version").toString()));

Review Comment:
   Edge case: this keeps the version resolved *last*. If the same secret is resolved again lazily (e.g. a `toD` placeholder) after an update but before the task's first check, the newer version becomes the baseline and values resolved earlier stay stale with no reload. Keeping the oldest is safer (worst case one extra reload):
   ```suggestion
                   secretVersions.merge(secretName, Integer.valueOf(metadata.get("version").toString()), Math::min);
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "allthingssecurity (via GitHub)" <gi...@apache.org>.
allthingssecurity commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4239752055


##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -268,9 +297,20 @@ public CamelContext getCamelContext() {
     }
 
     /**
-     * Ids of the secrets in use
+     * Ids of the secrets in use, as engine:secret, or only the secret for the default secret engine
      */
     public Set<String> getSecrets() {
         return secrets;

Review Comment:
   Done in 1a9153a56ec5: `getSecrets()` now returns `Collections.unmodifiableSet(secrets)`. The refresh task only reads it (it copies the names into its own set), so nothing else changes; 8 unit tests pass.
   
   _Claude Code on behalf of allthingssecurity_



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "allthingssecurity (via GitHub)" <gi...@apache.org>.
allthingssecurity commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4239723672


##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +262,24 @@ private String getSecretFromSource(String key, String subkey, String defaultValu
         return returnValue;
     }
 
+    /**
+     * The name of a secret as the refresh task tracks it: engine:secret, or only the secret for the default secret
+     * engine
+     */
+    private static String trackedSecretName(String secretEngine, String key) {
+        return "secret".equals(secretEngine) ? key : secretEngine + ":" + key;

Review Comment:
   Good catch, fixed in 86a401aa58f2: a null engine (a plain `hashicorp:key` before any lookup set one) is now tracked as `key`, the same way the refresh task's `buildMetadataPath` reads a name without engine; I checked the method's `secretEngine` parameter, as the method is static. New test `secretWithoutEngineIsTrackedAsDefaultEngine` fails without it (`expected: <[api]> but was: <[null:api]>`).
   
   _Claude Code on behalf of allthingssecurity_



##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +262,24 @@ private String getSecretFromSource(String key, String subkey, String defaultValu
         return returnValue;
     }
 
+    /**
+     * The name of a secret as the refresh task tracks it: engine:secret, or only the secret for the default secret
+     * engine
+     */
+    private static String trackedSecretName(String secretEngine, String key) {
+        return "secret".equals(secretEngine) ? key : secretEngine + ":" + key;
+    }
+
+    private void captureVersion(String secretName, VaultResponse rawSecret) {
+        if (rawSecret.getData().get("metadata") instanceof Map<?, ?> metadata && metadata.get("version") != null) {
+            try {
+                secretVersions.put(secretName, Integer.valueOf(metadata.get("version").toString()));
+            } catch (NumberFormatException e) {
+                // ignore, the refresh task then uses the version it reads first
+            }

Review Comment:
   Done in 86a401aa58f2: the class had no logger yet, so I added one and log the secret name, the unparsable version and the exception at DEBUG.
   
   _Claude Code on behalf of allthingssecurity_



##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -268,9 +291,17 @@ public CamelContext getCamelContext() {
     }
 
     /**
-     * Ids of the secrets in use
+     * Ids of the secrets in use, as engine:secret, or only the secret for the default secret engine
      */
     public Set<String> getSecrets() {
         return secrets;
     }
+
+    /**
+     * The version of the secret (named as in {@link #getSecrets()}) that was last resolved, or null if not known (such
+     * as when a specific version was requested).
+     */
+    public Integer getSecretVersion(String secretName) {

Review Comment:
   Added `@param` and `@return` in 86a401aa58f2.
   
   _Claude Code on behalf of allthingssecurity_



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus merged PR #27669:
URL: https://github.com/apache/camel/pull/27669


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4239741828


##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -268,9 +297,20 @@ public CamelContext getCamelContext() {
     }
 
     /**
-     * Ids of the secrets in use
+     * Ids of the secrets in use, as engine:secret, or only the secret for the default secret engine
      */
     public Set<String> getSecrets() {
         return secrets;

Review Comment:
   💡 **Suggestion (low severity, pre-existing):** `getSecrets()` returns the backing `ConcurrentHashMap` key set directly, exposing a mutable view. Callers can add/remove entries from the live set unintentionally.
   
   Consider wrapping in `Collections.unmodifiableSet()` to make the contract explicit:
   
   ```suggestion
           return Collections.unmodifiableSet(secrets);
   ```
   
   (This was also true with the old `HashSet` — the change to `ConcurrentHashMap.newKeySet()` doesn't change the exposure.)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4239685071


##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +262,24 @@ private String getSecretFromSource(String key, String subkey, String defaultValu
         return returnValue;
     }
 
+    /**
+     * The name of a secret as the refresh task tracks it: engine:secret, or only the secret for the default secret
+     * engine
+     */
+    private static String trackedSecretName(String secretEngine, String key) {
+        return "secret".equals(secretEngine) ? key : secretEngine + ":" + key;

Review Comment:
   ⚠ī¸ **Bug: `trackedSecretName` produces `"null:key"` when `engine` is null**
   
   If the `engine` field is still `null` (it's initialized lazily and can remain null), `"secret".equals(null)` returns `false`, so the method falls through to `secretEngine + ":" + key` — which Java evaluates as `"null:key"`. That mangled key then propagates into `secrets` and `secretVersions`, and the refresh task will never match a real Vault secret.
   
   ```suggestion
           return engine == null || "secret".equals(secretEngine) ? key : secretEngine + ":" + key;
   ```



##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -268,9 +291,17 @@ public CamelContext getCamelContext() {
     }
 
     /**
-     * Ids of the secrets in use
+     * Ids of the secrets in use, as engine:secret, or only the secret for the default secret engine
      */
     public Set<String> getSecrets() {
         return secrets;
     }
+
+    /**
+     * The version of the secret (named as in {@link #getSecrets()}) that was last resolved, or null if not known (such
+     * as when a specific version was requested).
+     */
+    public Integer getSecretVersion(String secretName) {

Review Comment:
   ℹī¸ **Minor: `getSecretVersion` Javadoc is missing `@param` and `@return` tags**
   
   The description is clear, but the method's `@param secretName` and `@return` are absent. No action required — just flagging for completeness.



##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +262,24 @@ private String getSecretFromSource(String key, String subkey, String defaultValu
         return returnValue;
     }
 
+    /**
+     * The name of a secret as the refresh task tracks it: engine:secret, or only the secret for the default secret
+     * engine
+     */
+    private static String trackedSecretName(String secretEngine, String key) {
+        return "secret".equals(secretEngine) ? key : secretEngine + ":" + key;
+    }
+
+    private void captureVersion(String secretName, VaultResponse rawSecret) {
+        if (rawSecret.getData().get("metadata") instanceof Map<?, ?> metadata && metadata.get("version") != null) {
+            try {
+                secretVersions.put(secretName, Integer.valueOf(metadata.get("version").toString()));
+            } catch (NumberFormatException e) {
+                // ignore, the refresh task then uses the version it reads first
+            }

Review Comment:
   💡 **Suggestion: log at DEBUG instead of silently swallowing `NumberFormatException`**
   
   The inline comment explains the intent, but a `LOG.debug()` call here would make it observable in production — especially useful when debugging a "secret never triggers reload" scenario. The class already has a logger, so just add a debug line.
   
   ```suggestion
               } catch (NumberFormatException e) {
                   LOG.debug("Could not parse secret version for {}: {}", secretName, metadata.get("version"), e);
                   // refresh task will use the version it reads first
               }
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27669:
URL: https://github.com/apache/camel/pull/27669#issuecomment-6105966304

   :star2: Thank you for your contribution to the Apache Camel project! :star2:
     :robot: CI automation will test this PR automatically.
   
     :camel: Apache Camel Committers, please review the following items:
   
     * First-time contributors **require MANUAL approval** for the GitHub Actions to run
     * You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
     * You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
     * Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
     
     :warning: Be careful when sharing logs. Review their contents before sharing them publicly.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #27669:
URL: https://github.com/apache/camel/pull/27669#issuecomment-6106156503

   <!-- ci-tested-modules -->
   :test_tube: **CI tested the following changed modules:**
   
   - `catalog/camel-catalog`
   - `components/camel-hashicorp-vault`
   - `docs`
   
   ---
   
   <details><summary>:microscope: Scalpel shadow comparison — Scalpel: 9 of 704 tested, 25 compile-only — current: 9 all tested</summary>
   
   [Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **9 affected modules** (current approach: 9).
   
   **Skip-tests mode would test 9 modules** (3 direct + 8 downstream), **skip tests for 25** (generated code, meta-modules)
   
   <details><summary>Modules Scalpel would test (9)</summary>
   
   - `camel-hashicorp-vault` ← components/camel-hashicorp-vault/src/main/docs/hashicorp-vault-component.adoc, components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java, components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/vault/HashicorpVaultReloadTriggerTask.java, components/camel-hashicorp-vault/src/test/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultReloadTriggerTaskTest.java
   - `camel-jbang-mcp` ← downstream of org.apache.camel:camel-catalog
   - `camel-jbang-plugin-mcp` ← downstream of org.apache.camel:camel-jbang-core
   - `camel-jbang-plugin-route-parser` ← downstream of org.apache.camel:camel-route-parser
   - `camel-jbang-plugin-tui` ← downstream of org.apache.camel:camel-catalog
   - `camel-jbang-plugin-validate` ← downstream of org.apache.camel:camel-yaml-dsl-validator
   - `camel-launcher-container` ← downstream of org.apache.camel:camel-launcher
   - `camel-yaml-dsl-validator` ← downstream of org.apache.camel:camel-catalog
   - `camel-yaml-dsl-validator-maven-plugin` ← downstream of org.apache.camel:camel-yaml-dsl-validator
   
   </details>
   
   <details><summary>Modules with tests skipped (25)</summary>
   
   - `apache-camel`
   - `camel-allcomponents`
   - `camel-catalog-console`
   - `camel-catalog-maven`
   - `camel-catalog-suggest`
   - `camel-componentdsl`
   - `camel-endpointdsl`
   - `camel-endpointdsl-support`
   - `camel-itest`
   - `camel-jbang-core`
   - `camel-jbang-it`
   - `camel-jbang-main`
   - `camel-jbang-plugin-edit`
   - `camel-jbang-plugin-generate`
   - `camel-jbang-plugin-kubernetes`
   - `camel-jbang-plugin-test`
   - `camel-kamelet-main`
   - `camel-launcher`
   - `camel-report-maven-plugin`
   - `camel-route-parser`
   - `camel-yaml-dsl`
   - `camel-yaml-dsl-deserializers`
   - `camel-yaml-dsl-maven-plugin`
   - `coverage`
   - `dummy-component`
   
   </details>
   
   > :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
   
   </details>
   
   <details><summary>All tested modules (36 modules, 4m 17s total)</summary>
   
   **Total reactor time:** 4m 17s
   
   | Module | Duration | Status |
   | --- | --- | --- |
   | Camel :: JBang :: Plugin :: TUI | 52.1s | SUCCESS |
   | Camel :: Launcher | 24.9s | SUCCESS |
   | Camel :: JBang :: MCP | 19.8s | SUCCESS |
   | Camel :: HashiCorp :: Key Vault | 17.7s | SUCCESS |
   | Camel :: Catalog :: Camel Catalog | 14.5s | SUCCESS |
   | Camel :: YAML DSL :: Validator | 13.6s | SUCCESS |
   | Camel :: JBang :: Plugin :: Validate | 13.5s | SUCCESS |
   | Camel :: YAML DSL | 12.8s | SUCCESS |
   | Camel :: Component DSL | 12.6s | SUCCESS |
   | Camel :: JBang :: Plugin :: Testing | 11.0s | SUCCESS |
   | Camel :: Docs | 10.3s | SUCCESS |
   | Camel :: JBang :: Plugin :: Kubernetes | 10.1s | SUCCESS |
   | Camel :: Kamelet Main | 7.8s | SUCCESS |
   | Camel :: Catalog :: Camel Route Parser | 5.1s | SUCCESS |
   | Camel :: YAML DSL :: Deserializers | 4.9s | SUCCESS |
   | Camel :: Catalog :: Camel Report Maven Plugin | 4.5s | SUCCESS |
   | Camel :: YAML DSL :: Validator Maven Plugin | 4.1s | SUCCESS |
   | Camel :: All Components Sync point | 3.2s | SUCCESS |
   | Camel :: YAML DSL :: Maven Plugins | 2.1s | SUCCESS |
   | Camel :: Catalog :: Maven | 2.1s | SUCCESS |
   | Camel :: Catalog :: Suggest (deprecated) | 1.9s | SUCCESS |
   | Camel :: JBang :: Plugin :: Edit | 1.1s | SUCCESS |
   | Camel :: Catalog :: Dummy Component | 1.0s | SUCCESS |
   | Camel :: JBang :: Plugin :: Generate | 0.9s | SUCCESS |
   | Camel :: Coverage | 0.8s | SUCCESS |
   | Camel :: Assembly | 0.7s | SUCCESS |
   | Camel :: JBang :: Integration tests | 0.7s | SUCCESS |
   | Camel :: JBang :: Main | 0.6s | SUCCESS |
   | Camel :: Catalog :: Console | 0.6s | SUCCESS |
   | Camel :: Endpoint DSL :: Support | 0.6s | SUCCESS |
   | Camel :: JBang :: Plugin :: Route Parser | 0.5s | SUCCESS |
   | Camel :: Launcher :: Container | 0.5s | SUCCESS |
   | Camel :: JBang :: Plugin :: MCP | 0.5s | SUCCESS |
   | Camel :: Endpoint DSL | n/a |  |
   | Camel :: Integration Tests | n/a |  |
   | Camel :: JBang :: Core | n/a |  |
   
   **Top 20 slowest modules:**
   - `Camel :: JBang :: Plugin :: TUI` (52.1s)
   - `Camel :: Launcher` (24.9s)
   - `Camel :: JBang :: MCP` (19.8s)
   - `Camel :: HashiCorp :: Key Vault` (17.7s)
   - `Camel :: Catalog :: Camel Catalog` (14.5s)
   - `Camel :: YAML DSL :: Validator` (13.6s)
   - `Camel :: JBang :: Plugin :: Validate` (13.5s)
   - `Camel :: YAML DSL` (12.8s)
   - `Camel :: Component DSL` (12.6s)
   - `Camel :: JBang :: Plugin :: Testing` (11.0s)
   - `Camel :: Docs` (10.3s)
   - `Camel :: JBang :: Plugin :: Kubernetes` (10.1s)
   - `Camel :: Kamelet Main` (7.8s)
   - `Camel :: Catalog :: Camel Route Parser` (5.1s)
   - `Camel :: YAML DSL :: Deserializers` (4.9s)
   - `Camel :: Catalog :: Camel Report Maven Plugin` (4.5s)
   - `Camel :: YAML DSL :: Validator Maven Plugin` (4.1s)
   - `Camel :: All Components Sync point` (3.2s)
   - `Camel :: YAML DSL :: Maven Plugins` (2.1s)
   - `Camel :: Catalog :: Maven` (2.1s)
   
   </details>
   
   ---
   :gear: [View full build and test results](https://github.com/apache/camel/actions/runs/38099400314)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] CAMEL-25518: camel-hashicorp-vault - Secret refresh detects updates in any engine and before the first check [camel]

Posted by "allthingssecurity (via GitHub)" <gi...@apache.org>.
allthingssecurity commented on code in PR #27669:
URL: https://github.com/apache/camel/pull/27669#discussion_r4240516054


##########
components/camel-hashicorp-vault/src/main/java/org/apache/camel/component/hashicorp/vault/HashicorpVaultPropertiesFunction.java:
##########
@@ -257,6 +267,26 @@ private String getSecretFromSource(String key, String subkey, String defaultValu
         return returnValue;
     }
 
+    /**
+     * The name of a secret as the refresh task tracks it: engine:secret, or only the secret for the default secret
+     * engine. A lookup without engine is tracked as a secret of the default secret engine, which is also how the
+     * refresh task reads a name without engine.
+     */
+    private static String trackedSecretName(String secretEngine, String key) {
+        return secretEngine == null || "secret".equals(secretEngine) ? key : secretEngine + ":" + key;
+    }
+
+    private void captureVersion(String secretName, VaultResponse rawSecret) {
+        if (rawSecret.getData().get("metadata") instanceof Map<?, ?> metadata && metadata.get("version") != null) {
+            try {
+                secretVersions.put(secretName, Integer.valueOf(metadata.get("version").toString()));

Review Comment:
   Confirmed with a test: resolve the secret at version 1, update it to version 2, resolve it again, then run the first
   check. With `put` the function reported version 2 and the task saw no update
   (`rotationBetweenTwoLookupsBeforeFirstCheckIsDetected` failed with "expected: <1> but was: <2>"). Applied in 67fb08297966: `secretVersions.merge(..., Math::min)`, and the
   javadoc of `getSecretVersion` now says "oldest version resolved". camel-hashicorp-vault suite: 9 tests, 0 failures
   (the 32 integration tests are skipped without a Vault container).
   
   _Claude Code on behalf of allthingssecurity_



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org