CAMEL-21142 - Kubernetes Secrets/Configmap: Trigger context reloading…

catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/main/camel-main-configuration-metadata.json

@@ -12,6 +12,7 @@
     { "name": "camel.vault.aws", "description": "Camel AWS Vault configurations", "sourceType": "org.apache.camel.vault.AwsVaultConfiguration" },
     { "name": "camel.vault.gcp", "description": "Camel GCP Vault configurations", "sourceType": "org.apache.camel.vault.GcpVaultConfiguration" },
     { "name": "camel.vault.azure", "description": "Camel Azure Key Vault configurations", "sourceType": "org.apache.camel.vault.AzureVaultConfiguration" },
+    { "name": "camel.vault.kubernetes", "description": "Camel Kubernetes Vault configurations", "sourceType": "org.apache.camel.vault.KubernetesVaultConfiguration" },
     { "name": "camel.opentelemetry", "description": "Camel OpenTelemetry configurations", "sourceType": "org.apache.camel.main.OtelConfigurationProperties" },
     { "name": "camel.metrics", "description": "Camel Micrometer Metrics configurations", "sourceType": "org.apache.camel.main.MetricsConfigurationProperties" },
     { "name": "camel.faulttolerance", "description": "Fault Tolerance EIP Circuit Breaker configurations", "sourceType": "org.apache.camel.main.FaultToleranceConfigurationProperties" },
@@ -349,6 +350,8 @@
     { "name": "camel.vault.gcp.secrets", "description": "Specify the secret names (or pattern) to check for updates. Multiple secrets can be separated by comma.", "sourceType": "org.apache.camel.vault.GcpVaultConfiguration", "type": "string", "javaType": "java.lang.String" },
     { "name": "camel.vault.gcp.serviceAccountKey", "description": "The Service Account Key location", "sourceType": "org.apache.camel.vault.GcpVaultConfiguration", "type": "string", "javaType": "java.lang.String" },
     { "name": "camel.vault.gcp.subscriptionName", "description": "Define the Google Pubsub subscription Name to be used when checking for updates", "sourceType": "org.apache.camel.vault.GcpVaultConfiguration", "type": "string", "javaType": "java.lang.String" },
-    { "name": "camel.vault.gcp.useDefaultInstance", "description": "Define if we want to use the GCP Client Default Instance or not", "sourceType": "org.apache.camel.vault.GcpVaultConfiguration", "type": "boolean", "javaType": "boolean", "defaultValue": "false" }
+    { "name": "camel.vault.gcp.useDefaultInstance", "description": "Define if we want to use the GCP Client Default Instance or not", "sourceType": "org.apache.camel.vault.GcpVaultConfiguration", "type": "boolean", "javaType": "boolean", "defaultValue": "false" },
+    { "name": "camel.vault.kubernetes.refreshEnabled", "description": "Whether to automatically reload Camel upon secrets being updated in Kubernetes Cluster.", "sourceType": "org.apache.camel.vault.KubernetesVaultConfiguration", "type": "boolean", "javaType": "boolean", "defaultValue": true },
+    { "name": "camel.vault.kubernetes.secrets", "description": "Specify the secret names (or pattern) to check for updates. Multiple secrets can be separated by comma.", "sourceType": "org.apache.camel.vault.KubernetesVaultConfiguration", "type": "string", "javaType": "java.lang.String" }
   ]
 }

components/camel-kubernetes/src/generated/resources/META-INF/services/org/apache/camel/periodic-task/kubernetes-secret-refresh

@@ -0,0 +1,2 @@
+# Generated by camel build tools - do NOT edit this file!
+class=org.apache.camel.component.kubernetes.secrets.vault.SecretsReloadTriggerTask

components/camel-kubernetes/src/main/java/org/apache/camel/component/kubernetes/secrets/vault/SecretsReloadTriggerTask.java

@@ -0,0 +1,164 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.kubernetes.secrets.vault;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+import java.util.concurrent.CountDownLatch;
+
+import io.fabric8.kubernetes.api.model.Secret;
+import io.fabric8.kubernetes.client.*;
+import org.apache.camel.CamelContext;
+import org.apache.camel.CamelContextAware;
+import org.apache.camel.component.kubernetes.properties.SecretPropertiesFunction;
+import org.apache.camel.spi.ContextReloadStrategy;
+import org.apache.camel.spi.Metadata;
+import org.apache.camel.spi.PropertiesComponent;
+import org.apache.camel.spi.PropertiesFunction;
+import org.apache.camel.spi.annotations.PeriodicTask;
+import org.apache.camel.support.PatternHelper;
+import org.apache.camel.support.service.ServiceSupport;
+import org.apache.camel.util.ObjectHelper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+@PeriodicTask("kubernetes-secret-refresh")
+public class SecretsReloadTriggerTask extends ServiceSupport implements CamelContextAware, Runnable {
+
+    private CamelContext camelContext;
+    @Metadata(defaultValue = "true")
+    private boolean reloadEnabled = true;
+    private String secrets;
+    private KubernetesClient kubernetesClient;
+    private SecretPropertiesFunction propertiesFunction;
+
+    private static final Logger LOG = LoggerFactory.getLogger(SecretsReloadTriggerTask.class);
+
+    @Override
+    public CamelContext getCamelContext() {
+        return camelContext;
+    }
+
+    @Override
+    public void setCamelContext(CamelContext camelContext) {
+        this.camelContext = camelContext;
+    }
+
+    public boolean isReloadEnabled() {
+        return reloadEnabled;
+    }
+
+    /**
+     * Whether Camel should be reloaded on Secrets updated
+     */
+    public void setReloadEnabled(boolean reloadEnabled) {
+        this.reloadEnabled = reloadEnabled;
+    }
+
+    @Override
+    protected void doStart() throws Exception {
+        super.doStart();
+
+        // auto-detect secrets in-use
+        PropertiesComponent pc = camelContext.getPropertiesComponent();
+        PropertiesFunction pf = pc.getPropertiesFunction("secret");
+        if (pf instanceof SecretPropertiesFunction) {
+            propertiesFunction = (SecretPropertiesFunction) pf;
+            LOG.debug("Auto-detecting secrets from properties-function: {}", pf.getName());
+        }
+        // specific secrets
+        secrets = camelContext.getVaultConfiguration().kubernetes().getSecrets();
+        if (ObjectHelper.isEmpty(secrets) && propertiesFunction == null) {
+            throw new IllegalArgumentException("Secrets must be configured on Kubernetes vault configuration");
+        }
+
+        kubernetesClient = propertiesFunction.getClient();
+    }
+
+    @Override
+    protected void doShutdown() throws Exception {
+        super.doShutdown();
+
+        if (kubernetesClient != null) {
+            try {
+                kubernetesClient.close();
+            } catch (Exception e) {
+                // ignore
+            }
+            kubernetesClient = null;
+        }
+    }
+
+    @Override
+    public void run() {
+        final CountDownLatch isWatchClosed = new CountDownLatch(1);
+        Watch watch = kubernetesClient.secrets().inNamespace(kubernetesClient.getNamespace()).watch(new Watcher<>() {
+            @Override
+            public void eventReceived(Action action, Secret secret) {
+                switch (action.name()) {
+                    case "MODIFIED":
+                        if (isReloadEnabled()) {
+                            if (matchSecret(secret.getMetadata().getName())) {
+                                LOG.info("Update for Kubernetes Secret: {} detected, triggering CamelContext reload",
+                                        secret.getMetadata().getName());
+                                ContextReloadStrategy reload = camelContext.hasService(ContextReloadStrategy.class);
+                                if (reload != null) {
+                                    // trigger reload
+                                    reload.onReload(this);
+                                }
+                            }
+                        }
+                        break;
+                    default:
+                        LOG.debug("Not watched event {}", action.name());
+                }
+            }
+
+            @Override
+            public void onClose(WatcherException e) {
+                isWatchClosed.countDown();
+            }
+        });
+
+        // Wait till watch gets closed
+        try {
+            isWatchClosed.await();
+        } catch (InterruptedException e) {
+            LOG.debug("Interrupted while waiting for the watch to close: {}", e.getMessage());
+            Thread.currentThread().interrupt();
+        }
+        watch.close();
+    }
+
+    protected boolean matchSecret(String name) {
+        Set<String> set = new HashSet<>();
+        if (secrets != null) {
+            Collections.addAll(set, secrets.split(","));
+        }
+
+        for (String part : set) {
+            boolean result = name.contains(part) || PatternHelper.matchPattern(name, part);
+            LOG.trace("Matching secret id: {}={} -> {}", name, part, result);
+            if (result) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

core/camel-api/src/main/java/org/apache/camel/vault/KubernetesVaultConfiguration.java

@@ -0,0 +1,52 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.vault;
+
+import org.apache.camel.spi.Metadata;
+
+/**
+ * Configuration for access to Kubernetes Secrets
+ */
+public class KubernetesVaultConfiguration extends VaultConfiguration {
+
+    @Metadata(defaultValue = "true")
+    private boolean refreshEnabled = true;
+    @Metadata
+    private String secrets;
+
+    public boolean isRefreshEnabled() {
+        return refreshEnabled;
+    }
+
+    /**
+     * Whether to automatically reload Camel upon secrets being updated in Kubernetes Cluster.
+     */
+    public void setRefreshEnabled(boolean refreshEnabled) {
+        this.refreshEnabled = refreshEnabled;
+    }
+
+    public String getSecrets() {
+        return secrets;
+    }
+
+    /**
+     * Specify the secret names (or pattern) to check for updates. Multiple secrets can be separated by comma.
+     */
+    public void setSecrets(String secrets) {
+        this.secrets = secrets;
+    }
+}

core/camel-api/src/main/java/org/apache/camel/vault/VaultConfiguration.java

@@ -25,6 +25,7 @@ public class VaultConfiguration {
     private GcpVaultConfiguration gcp;
     private AzureVaultConfiguration azure;
     private HashicorpVaultConfiguration hashicorp;
+    private KubernetesVaultConfiguration kubernetes;
 
     /**
      * AWS Vault Configuration
@@ -66,6 +67,16 @@ public HashicorpVaultConfiguration hashicorp() {
         return hashicorp;
     }
 
+    /**
+     * Kubernetes Vault Configuration
+     */
+    public KubernetesVaultConfiguration kubernetes() {
+        if (kubernetes == null) {
+            kubernetes = new KubernetesVaultConfiguration();
+        }
+        return kubernetes;
+    }
+
     public AwsVaultConfiguration getAwsVaultConfiguration() {
         return aws;
     }
@@ -97,4 +108,12 @@ public HashicorpVaultConfiguration getHashicorpVaultConfiguration() {
     public void setHashicorpVaultConfiguration(HashicorpVaultConfiguration hashicorp) {
         this.hashicorp = hashicorp;
     }
+
+    public KubernetesVaultConfiguration getKubernetesVaultConfiguration() {
+        return kubernetes;
+    }
+
+    public void setKubernetesVaultConfiguration(KubernetesVaultConfiguration kubernetes) {
+        this.kubernetes = kubernetes;
+    }
 }

core/camel-main/src/generated/java/org/apache/camel/main/AwsVaultConfigurationConfigurer.java

@@ -35,6 +35,8 @@ public boolean configure(CamelContext camelContext, Object obj, String name, Obj
         case "gcpVaultConfiguration": target.setGcpVaultConfiguration(property(camelContext, org.apache.camel.vault.GcpVaultConfiguration.class, value)); return true;
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": target.setHashicorpVaultConfiguration(property(camelContext, org.apache.camel.vault.HashicorpVaultConfiguration.class, value)); return true;
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": target.setKubernetesVaultConfiguration(property(camelContext, org.apache.camel.vault.KubernetesVaultConfiguration.class, value)); return true;
         case "profilecredentialsprovider":
         case "profileCredentialsProvider": target.setProfileCredentialsProvider(property(camelContext, boolean.class, value)); return true;
         case "profilename":
@@ -70,6 +72,8 @@ public Class<?> getOptionType(String name, boolean ignoreCase) {
         case "gcpVaultConfiguration": return org.apache.camel.vault.GcpVaultConfiguration.class;
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": return org.apache.camel.vault.HashicorpVaultConfiguration.class;
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": return org.apache.camel.vault.KubernetesVaultConfiguration.class;
         case "profilecredentialsprovider":
         case "profileCredentialsProvider": return boolean.class;
         case "profilename":
@@ -106,6 +110,8 @@ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         case "gcpVaultConfiguration": return target.getGcpVaultConfiguration();
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": return target.getHashicorpVaultConfiguration();
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": return target.getKubernetesVaultConfiguration();
         case "profilecredentialsprovider":
         case "profileCredentialsProvider": return target.isProfileCredentialsProvider();
         case "profilename":

core/camel-main/src/generated/java/org/apache/camel/main/AwsVaultConfigurationPropertiesConfigurer.java

@@ -35,6 +35,8 @@ public boolean configure(CamelContext camelContext, Object obj, String name, Obj
         case "gcpVaultConfiguration": target.setGcpVaultConfiguration(property(camelContext, org.apache.camel.vault.GcpVaultConfiguration.class, value)); return true;
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": target.setHashicorpVaultConfiguration(property(camelContext, org.apache.camel.vault.HashicorpVaultConfiguration.class, value)); return true;
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": target.setKubernetesVaultConfiguration(property(camelContext, org.apache.camel.vault.KubernetesVaultConfiguration.class, value)); return true;
         case "profilecredentialsprovider":
         case "profileCredentialsProvider": target.setProfileCredentialsProvider(property(camelContext, boolean.class, value)); return true;
         case "profilename":
@@ -70,6 +72,8 @@ public Class<?> getOptionType(String name, boolean ignoreCase) {
         case "gcpVaultConfiguration": return org.apache.camel.vault.GcpVaultConfiguration.class;
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": return org.apache.camel.vault.HashicorpVaultConfiguration.class;
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": return org.apache.camel.vault.KubernetesVaultConfiguration.class;
         case "profilecredentialsprovider":
         case "profileCredentialsProvider": return boolean.class;
         case "profilename":
@@ -106,6 +110,8 @@ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         case "gcpVaultConfiguration": return target.getGcpVaultConfiguration();
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": return target.getHashicorpVaultConfiguration();
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": return target.getKubernetesVaultConfiguration();
         case "profilecredentialsprovider":
         case "profileCredentialsProvider": return target.isProfileCredentialsProvider();
         case "profilename":

core/camel-main/src/generated/java/org/apache/camel/main/AzureVaultConfigurationConfigurer.java

@@ -45,6 +45,8 @@ public boolean configure(CamelContext camelContext, Object obj, String name, Obj
         case "gcpVaultConfiguration": target.setGcpVaultConfiguration(property(camelContext, org.apache.camel.vault.GcpVaultConfiguration.class, value)); return true;
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": target.setHashicorpVaultConfiguration(property(camelContext, org.apache.camel.vault.HashicorpVaultConfiguration.class, value)); return true;
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": target.setKubernetesVaultConfiguration(property(camelContext, org.apache.camel.vault.KubernetesVaultConfiguration.class, value)); return true;
         case "refreshenabled":
         case "refreshEnabled": target.setRefreshEnabled(property(camelContext, boolean.class, value)); return true;
         case "refreshperiod":
@@ -83,6 +85,8 @@ public Class<?> getOptionType(String name, boolean ignoreCase) {
         case "gcpVaultConfiguration": return org.apache.camel.vault.GcpVaultConfiguration.class;
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": return org.apache.camel.vault.HashicorpVaultConfiguration.class;
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": return org.apache.camel.vault.KubernetesVaultConfiguration.class;
         case "refreshenabled":
         case "refreshEnabled": return boolean.class;
         case "refreshperiod":
@@ -122,6 +126,8 @@ public Object getOptionValue(Object obj, String name, boolean ignoreCase) {
         case "gcpVaultConfiguration": return target.getGcpVaultConfiguration();
         case "hashicorpvaultconfiguration":
         case "hashicorpVaultConfiguration": return target.getHashicorpVaultConfiguration();
+        case "kubernetesvaultconfiguration":
+        case "kubernetesVaultConfiguration": return target.getKubernetesVaultConfiguration();
         case "refreshenabled":
         case "refreshEnabled": return target.isRefreshEnabled();
         case "refreshperiod":