Andrea Cosentino created CAMEL-24341:
----------------------------------------
Summary: camel-google-secret-manager: GCP vault refresh task reads
the AWS vault configuration and reloads repeatedly
Key: CAMEL-24341
URL: https://issues.apache.org/jira/browse/CAMEL-24341
Project: Camel
Issue Type: Bug
Components: camel-google
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
The GCP secret refresh task {{PubsubReloadTriggerTask}} has several defects:
1. It reads the *AWS* vault configuration instead of the GCP one:
{code:java}
// PubsubReloadTriggerTask.java:131
secrets = camelContext.getVaultConfiguration().aws().getSecrets();
{code}
{{camel.vault.gcp.secrets}} is a documented option
(GcpVaultConfiguration#getSecrets) but is never read. When only the GCP
property is configured (without a properties function), doStart fails with
"Secrets must be configured on GCP vault configuration".
2. {{triggerReloading}} is an instance field that is never reset:
{code:java}
// PubsubReloadTriggerTask.java:223,240
private boolean triggerReloading;
...
if (triggerReloading) { ... reload.onReload(this); }
{code}
Once one matching secret event is seen, every subsequent Pub/Sub message on
that subscription triggers a CamelContext reload. The AWS equivalent uses a
local variable (CloudTrailReloadTriggerTask:271).
3. {{run()}} starts the subscriber on every tick:
{code:java}
// PubsubReloadTriggerTask.java:190
subscriber.startAsync().awaitRunning();
{code}
The task is scheduled with {{schedulePeriodTask(r, period)}}
(camel.vault.gcp.refreshPeriod, default 30000ms), and startAsync() throws
IllegalStateException once the service is no longer NEW, so every tick after
the first fails. A start-once guard is needed.
4. {{receiveMessage}} dereferences message attributes without a null check
({{eventType.equalsIgnoreCase(...)}}, {{matchSecret(secretId)}} at :227-230),
so any Pub/Sub message on the subscription without the
{{eventType}}/{{secretId}} attributes throws and is redelivered indefinitely.
Also: the javadoc of {{setReloadEnabled}} says "on AWS secret updated", and
{{GoogleSecretManagerPropertiesFunction}} javadoc (:58-59) documents
{{camel.vault.aws.serviceAccountKey}} / {{camel.vault.aws.projectId}} instead
of the {{gcp}} equivalents; {{GoogleSecretManagerPropertiesFunction:210}}
allocates a new ObjectMapper on every secret lookup.
The class currently has no test coverage.
Found during a source audit of the {{components/camel-google}} module family
against main @ c3b01310be15.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
