Camel Spring Boot

SPIFFE

Fetch and validate SPIFFE workload identity (X.509-SVID and JWT-SVID) from the SPIFFE Workload API.

What’s inside

SPIFFE component, URI syntax: spiffe:label

Please refer to the above links for usage and configuration details.

Maven coordinates

<dependency>
    <groupId>org.apache.camel.springboot</groupId>
    <artifactId>camel-spiffe-starter</artifactId>
</dependency>

Spring Boot Auto-Configuration

The starter supports 9 options, which are listed below.

Name	Description	Default	Type
camel.component.spiffe.allow-operation-header	Whether the CamelSpiffeOperation header may override the configured operation. Disabled by default: the operation decides whether this endpoint validates a token or mints one, so a message that can set it can turn a validator into an endpoint that hands out this workload’s own JWT-SVID. Enable it only on routes whose input is trusted.	false	Boolean
camel.component.spiffe.audience	The comma-separated audience(s) to request for a JWT-SVID (fetchJwtSvid) or to validate against (validateJwtSvid). Can be overridden per-message with the CamelSpiffeAudience header. Note that validateJwtSvid validates against a single audience, so when several comma-separated audiences are given only the first one is used for validation; fetchJwtSvid requests all of them.		String
camel.component.spiffe.autowired-enabled	Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.	true	Boolean
camel.component.spiffe.configuration	The component configuration. The option is a org.apache.camel.component.spiffe.SpiffeConfiguration type.		SpiffeConfiguration
camel.component.spiffe.enabled	Whether to enable auto configuration of the spiffe component. This is enabled by default.		Boolean
camel.component.spiffe.lazy-start-producer	Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.	false	Boolean
camel.component.spiffe.operation	The operation to perform on the SPIFFE Workload API.	fetchx509svid	SpiffeOperation
camel.component.spiffe.spiffe-socket-path	The address of the SPIFFE Workload API endpoint (for example \{code unix:///tmp/agent.sock} or \{code tcp://127.0.0.1:8082}). When not set, the SPIFFE_ENDPOINT_SOCKET environment variable is used.		String
camel.component.spiffe.workload-api-client	An existing WorkloadApiClient to use. When set, the component does not create or close its own client and spiffeSocketPath is ignored. The option is a io.spiffe.workloadapi.WorkloadApiClient type.		WorkloadApiClient

Name

Description

Default

Type

camel.component.spiffe.allow-operation-header

Whether the CamelSpiffeOperation header may override the configured operation. Disabled by default: the operation decides whether this endpoint validates a token or mints one, so a message that can set it can turn a validator into an endpoint that hands out this workload’s own JWT-SVID. Enable it only on routes whose input is trusted.

false

Boolean

camel.component.spiffe.audience

The comma-separated audience(s) to request for a JWT-SVID (fetchJwtSvid) or to validate against (validateJwtSvid). Can be overridden per-message with the CamelSpiffeAudience header. Note that validateJwtSvid validates against a single audience, so when several comma-separated audiences are given only the first one is used for validation; fetchJwtSvid requests all of them.

String

camel.component.spiffe.autowired-enabled

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

Boolean

camel.component.spiffe.configuration

The component configuration. The option is a org.apache.camel.component.spiffe.SpiffeConfiguration type.

SpiffeConfiguration

camel.component.spiffe.enabled

Whether to enable auto configuration of the spiffe component. This is enabled by default.

Boolean

camel.component.spiffe.lazy-start-producer

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

Boolean

camel.component.spiffe.operation

The operation to perform on the SPIFFE Workload API.

fetchx509svid

SpiffeOperation

camel.component.spiffe.spiffe-socket-path

The address of the SPIFFE Workload API endpoint (for example \{code unix:///tmp/agent.sock} or \{code tcp://127.0.0.1:8082}). When not set, the SPIFFE_ENDPOINT_SOCKET environment variable is used.

String

camel.component.spiffe.workload-api-client

An existing WorkloadApiClient to use. When set, the component does not create or close its own client and spiffeSocketPath is ignored. The option is a io.spiffe.workloadapi.WorkloadApiClient type.

WorkloadApiClient