CAMEL-24571: camel-spiffe - add SpiffeSSLContextParameters for Workload-API-backed mTLS

[oscerd]

Second increment of the camel-spiffe component (CAMEL-23305, shipped in 4.23.0). Adds
SpiffeSSLContextParameters, an SSLContextParameters whose SSLContext is backed by the SPIFFE
Workload API (via io.spiffe:java-spiffe-provider) with automatic X.509-SVID rotation, so any Camel
component that accepts an sslContextParameters reference (camel-http, camel-netty-http, camel-jetty,
camel-vertx-http, ...) can obtain zero-trust mutual TLS.

Highlights

• Honours the inherited SSLContextParameters configuration. The SPIFFE SSLContext is wrapped with
  the same decorator the parent uses, so serverParameters.clientAuthentication, cipherSuites and
  secureSocketProtocols still apply — a server correctly requests and validates the peer SVID rather
  than silently accepting unauthenticated peers.
• Fail-closed peer authentication: either an acceptedSpiffeIds allow-list or acceptAnySpiffeId
  (the two are mutually exclusive); configuring neither is rejected.
• Lifecycle-safe: the X509Source is created lazily (bounded by initTimeout, default 30s), closed
  on CamelContext shutdown, and the cached context is invalidated at the same time so a restarted
  context rebuilds a fresh source.
• Property-placeholder resolution on all options; base handshake protocol from secureSocketProtocol
  (default TLSv1.3).

Testing

• 5 unit tests: fail-closed validation, SPIFFE-ID parsing, accept-any/allow-list mutual exclusion,
  blank-only allow-list rejection, and fast-fail on an unreachable Workload API.
• A full mTLS handshake requires a running SPIFFE Workload API (e.g. a SPIRE agent), so it is left as a
  manual/integration verification rather than a CI test.
• Full-reactor build is green.

Docs

Adds a "Mutual TLS with SPIFFE (SSLContextParameters)" section to the component page with a wiring example.

🤖 Generated with Claude Code

https://claude.ai/code/session_017EbUBfDPznQECWRbY5cr2n

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• catalog/camel-catalog
• components/camel-spiffe

---

🔬 Scalpel shadow comparison — Scalpel: 10 tested, 26 compile-only — current: 9 all tested

Maveniverse Scalpel detected 36 affected modules (current approach: 9).

⚠️ Modules only in Scalpel (27)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

Skip-tests mode would test 10 modules (2 direct + 8 downstream), skip tests for 26 (generated code, meta-modules)

Modules Scalpel would test (10)

• camel-catalog
• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-launcher-container
• camel-spiffe
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin

Modules with tests skipped (26)

• apache-camel
• camel-allcomponents
• camel-catalog-console
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (36 modules)

• Camel :: All Components Sync point
• Camel :: Assembly
• Camel :: Catalog :: Camel Catalog
• Camel :: Catalog :: Camel Report Maven Plugin
• Camel :: Catalog :: Camel Route Parser
• Camel :: Catalog :: Console
• Camel :: Catalog :: Dummy Component
• Camel :: Catalog :: Maven
• Camel :: Catalog :: Suggest
• Camel :: Component DSL
• Camel :: Coverage
• Camel :: Docs
• Camel :: Endpoint DSL
• Camel :: Endpoint DSL :: Support
• Camel :: Integration Tests
• Camel :: JBang :: Core
• Camel :: JBang :: Integration tests
• Camel :: JBang :: MCP
• Camel :: JBang :: Main
• Camel :: JBang :: Plugin :: Edit
• Camel :: JBang :: Plugin :: Generate
• Camel :: JBang :: Plugin :: Kubernetes
• Camel :: JBang :: Plugin :: MCP
• Camel :: JBang :: Plugin :: Route Parser
• Camel :: JBang :: Plugin :: TUI
• Camel :: JBang :: Plugin :: Testing
• Camel :: JBang :: Plugin :: Validate
• Camel :: Kamelet Main
• Camel :: Launcher
• Camel :: Launcher :: Container
• Camel :: SPIFFE
• Camel :: YAML DSL
• Camel :: YAML DSL :: Deserializers
• Camel :: YAML DSL :: Maven Plugins
• Camel :: YAML DSL :: Validator
• Camel :: YAML DSL :: Validator Maven Plugin

---

⚙️ View full build and test results

[gnodet]

Solid implementation. The double-checked locking on sslContext is correct (volatile field + synchronized block), fail-closed validation rejects missing trust configuration, and the X509Source lifecycle is properly tied to CamelContext shutdown.

Static analysis (ast-grep) flagged the synchronized block in X509SourceService.stop() and the broad catch (Exception) blocks -- both are non-issues: sslContext is already declared volatile, and the catch blocks preserve the cause chain via RuntimeCamelException(e), which is standard Camel idiom.

No findings.

This review was generated by an AI agent, Hermes on behalf of @gnodet.