Andrea Cosentino created CAMEL-24554:
----------------------------------------
Summary: camel-jolokia-starter - agent binds all interfaces by
default and the bundled restrictor gates on MBean domain only
Key: CAMEL-24554
URL: https://issues.apache.org/jira/browse/CAMEL-24554
Project: Camel
Issue Type: Improvement
Components: camel-spring-boot-starters
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
The Jolokia starter's shipped defaults are broader than the defaults of the
Jolokia agent it wraps, and the
bundled restrictor is narrower in name than in effect.
*Bind address and activation*
{code:java}
@ConditionalOnProperty(name = "camel.component.jolokia.enabled", havingValue =
"true", matchIfMissing = true)
...
setDefaultConfigValue("host", "0.0.0.0");
setDefaultConfigValue("autoStart", "true");
{code}
(JolokiaComponentAutoConfiguration:39, 87-88)
With {{matchIfMissing=true}}, adding the starter to the classpath is enough to
start the agent, and the starter
hard-defaults the bind address to all interfaces. The Jolokia JVM agent's own
upstream default is loopback. TLS
is configured only when the Kubernetes service-account CA file is present on
disk, so other deployment shapes
get plain HTTP, and {{discoveryEnabled}} is turned on off-Kubernetes.
*Restrictor capability gating*
{code:java}
public class CamelRestrictor extends AllowAllRestrictor {
@Override
public boolean isAttributeWriteAllowed(ObjectName pName, String pAttribute)
{
return objectNameEvaluator.apply(pName);
}
@Override
public boolean isOperationAllowed(ObjectName pName, String pOperation) {
return objectNameEvaluator.apply(pName);
}
{code}
(restrictor/CamelRestrictor:26)
{{CamelRestrictor}} extends {{AllowAllRestrictor}} and evaluates the MBean
*domain* only. Attribute writes and
operation invocations are therefore permitted for every MBean in the allowed
domains, and {{isOriginAllowed}} is
not overridden at all, so the permissive base-class behaviour applies. The
starter documentation describes the
restrictor as limiting access to Camel MBeans, which describes the namespace
but not the capability.
Note that {{camel-management-starter}} is a compile dependency of this starter
(pom.xml), so the management
MBeans are present whenever the starter is.
*Proposal*
- Default {{host}} to {{127.0.0.1}}, matching the wrapped agent's own default.
- Gate attribute write and operation invocation behind an explicit opt-in,
defaulting to read-only.
- Override {{isOriginAllowed}} with a configurable allowlist rather than
inheriting the permissive default.
- Update {{intro.adoc}} / {{usage.adoc}} to state the actual default posture.
Both items live in the same starter and share the same reachability, so they
are best changed together. Tests
should assert the default bind address and that write and exec are refused
unless explicitly enabled.
These are deliberate changes to shipped defaults and need an upgrade-guide
entry.
----
_This issue was drafted by Claude Code on behalf of Andrea Cosentino._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
