[
https://issues.apache.org/jira/browse/CAMEL-24638?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18118799#comment-18118799
]
Guillaume Nodet commented on CAMEL-24638:
-----------------------------------------
This issue is being investigated by a coding agent (on behalf of gnodet).
The gap is confirmed: neither JdbcComponent nor SqlComponent implements
SecretRotationAware. The SPI Javadoc (added by CAMEL-24636) explicitly names a
JDBC connection pool as the motivating example. After a vault-triggered context
reload, the DataSource pool (HikariCP, DBCP2, etc.) keeps using the old
credentials until the JVM restarts.
The implementation approach:
- JdbcComponent implements SecretRotationAware: onSecretRotation() evicts stale
pool connections. Where the pool exposes a credential-update API (e.g. HikariCP
HikariConfigMXBean.softEvictConnections()), that is preferred over replacing
the DataSource reference.
- SqlComponent implements SecretRotationAware: same pattern.
- Both fit in a single PR with a shared test using an embedded DB.
This is consistent with the project direction: the parent CAMEL-24636 is
resolved, and CAMEL-24637 (camel-jms) follows the same pattern.
_Note: This comment was generated by an AI coding agent and requires manual
verification._
> camel-jdbc/camel-sql: implement SecretRotationAware to rebuild the pool on
> rotation
> -----------------------------------------------------------------------------------
>
> Key: CAMEL-24638
> URL: https://issues.apache.org/jira/browse/CAMEL-24638
> Project: Camel
> Issue Type: Sub-task
> Components: camel-jdbc, camel-sql
> Reporter: Andrea Cosentino
> Assignee: Guillaume Nodet
> Priority: Major
>
> Sub-task of CAMEL-24636.
> Adopt the {{SecretRotationAware}} SPI in camel-jdbc and camel-sql.
> Both components resolve a {{DataSource}} bean from the registry
> ({{JdbcComponent}} looks it up by name or by type, {{SqlComponent}} holds one
> directly). The {{DataSource}} is created once by Spring Boot, Quarkus or
> Camel Main with the credentials valid at startup, and clearing the endpoint
> registry during a context reload does not recreate it.
> The result is that a connection pool such as HikariCP goes on handing out
> connections authenticated with a revoked password, and new connections opened
> by the pool fail once the old credential is retired.
> On {{onSecretRotation}} the components should refresh the credentials the
> pool uses and evict the existing connections so that the pool
> re-authenticates. Where the underlying pool exposes a credential-update API
> this should be preferred over recreating the {{DataSource}}, since the bean
> may be shared with non-Camel code.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
