[
https://issues.apache.org/jira/browse/CAMEL-24341?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18102311#comment-18102311
]
Andrea Cosentino commented on CAMEL-24341:
------------------------------------------
Fixed on main in https://github.com/apache/camel/pull/25326, backported to
camel-4.18.x in https://github.com/apache/camel/pull/25339 and to camel-4.14.x
in https://github.com/apache/camel/pull/25340.
> camel-google-secret-manager: GCP vault refresh task reads the AWS vault
> configuration and reloads repeatedly
> ------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24341
> URL: https://issues.apache.org/jira/browse/CAMEL-24341
> Project: Camel
> Issue Type: Bug
> Components: camel-google
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.14.9, 4.18.4, 4.22.0
>
>
> The GCP secret refresh task {{PubsubReloadTriggerTask}} has several defects:
> 1. It reads the *AWS* vault configuration instead of the GCP one:
> {code:java}
> // PubsubReloadTriggerTask.java:131
> secrets = camelContext.getVaultConfiguration().aws().getSecrets();
> {code}
> {{camel.vault.gcp.secrets}} is a documented option
> (GcpVaultConfiguration#getSecrets) but is never read. When only the GCP
> property is configured (without a properties function), doStart fails with
> "Secrets must be configured on GCP vault configuration".
> 2. {{triggerReloading}} is an instance field that is never reset:
> {code:java}
> // PubsubReloadTriggerTask.java:223,240
> private boolean triggerReloading;
> ...
> if (triggerReloading) { ... reload.onReload(this); }
> {code}
> Once one matching secret event is seen, every subsequent Pub/Sub message on
> that subscription triggers a CamelContext reload. The AWS equivalent uses a
> local variable (CloudTrailReloadTriggerTask:271).
> 3. {{run()}} starts the subscriber on every tick:
> {code:java}
> // PubsubReloadTriggerTask.java:190
> subscriber.startAsync().awaitRunning();
> {code}
> The task is scheduled with {{schedulePeriodTask(r, period)}}
> (camel.vault.gcp.refreshPeriod, default 30000ms), and startAsync() throws
> IllegalStateException once the service is no longer NEW, so every tick after
> the first fails. A start-once guard is needed.
> 4. {{receiveMessage}} dereferences message attributes without a null check
> ({{eventType.equalsIgnoreCase(...)}}, {{matchSecret(secretId)}} at :227-230),
> so any Pub/Sub message on the subscription without the
> {{eventType}}/{{secretId}} attributes throws and is redelivered indefinitely.
> Also: the javadoc of {{setReloadEnabled}} says "on AWS secret updated", and
> {{GoogleSecretManagerPropertiesFunction}} javadoc (:58-59) documents
> {{camel.vault.aws.serviceAccountKey}} / {{camel.vault.aws.projectId}} instead
> of the {{gcp}} equivalents; {{GoogleSecretManagerPropertiesFunction:210}}
> allocates a new ObjectMapper on every secret lookup.
> The class currently has no test coverage.
> Found during a source audit of the {{components/camel-google}} module family
> against main @ c3b01310be15.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
