KeyVault JCA: lazy-load certificate material and add alias regex filtering by rujche · Pull Request #49774 · Azure/azure-sdk-for-java

rujche · 2026-07-10T01:43:23Z

Description

This PR completes #39487 in azure-security-keyvault-jca and also finalizes the follow-up lazy-loading/thread-safety refinements requested during review.

What changed

sdk/keyvault/azure-security-keyvault-jca/checkstyle-suppressions.xml updates are script-generated via eng/scripts/linting_suppression_generator.py (not manually edited).
Added lazy loading in KeyVaultCertificates for certificate, key, and certificate chain by alias.
Added alias regex filtering via system property:
- azure.keyvault.jca.certificate-alias-filter-patterns
- Include patterns are plain regex entries.
- Exclude patterns are prefixed with !.
Improved concurrent behavior and refresh flow in KeyVaultCertificates:
- Reduced lock contention during lazy loads.
- Added retry semantics for transient/null load failures.
- Preserved alias/cache consistency after refresh and client updates.
Updated KeyVaultKeyStore lookup pathing and filter-pattern parsing.
Updated module docs and release notes (README.md, CHANGELOG.md).
Added/updated unit tests in:
- KeyVaultKeyStoreUnitTest
- KeyVaultCertificatesTest

Validation

mvn -f sdk/keyvault/azure-security-keyvault-jca/pom.xml -Dtest=KeyVaultKeyStoreUnitTest,com.azure.security.keyvault.jca.implementation.certificates.KeyVaultCertificatesTest test

Notes

This PR updates the unreleased filter property naming to azure.keyvault.jca.certificate-alias-filter-patterns for clearer semantics.

All SDK Contribution checklist:

The pull request does not introduce [breaking changes]
CHANGELOG is updated for new features, bug fixes or other significant changes.
I have read the contribution guidelines.

General Guidelines and Best Practices

Title of the pull request is clear and informative.
There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

Pull request includes test coverage for the included changes.

Copilot

Pull request overview

This PR enhances azure-security-keyvault-jca to reduce unnecessary Key Vault reads by (1) allowing users to configure a subset of certificate aliases to consider and (2) lazily loading certificate details only when a specific alias is requested—addressing the scenario described in #39487 (iterating/fetching all aliases when only one is configured).

Changes:

Added azure.keyvault.jca.certificates system property support to filter Key Vault certificate aliases to a configured subset.
Implemented lazy loading of Key Vault certificate key/certificate/chain data per alias (instead of eagerly loading all details on refresh).
Updated tests and documentation (README + CHANGELOG) to cover and describe the new behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java	Wires configured alias filtering into keystore initialization and routes Key Vault lookups through lazy-loading accessors.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java	Implements configured-alias filtering and lazy loading of certificate details per alias.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/KeyVaultKeyStoreUnitTest.java	Adds unit coverage for parsing configured aliases and verifying they are passed into `KeyVaultCertificates`.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificatesTest.java	Adds unit coverage ensuring alias listing is not eager and that only requested/configured aliases trigger Key Vault reads.
sdk/keyvault/azure-security-keyvault-jca/README.md	Documents the new `azure.keyvault.jca.certificates` configuration option.
sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md	Records the new filtering + lazy-loading features for the upcoming release.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

…havior

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java:300

The inline comment says this outer check avoids acquiring the lock, but certificatesNeedRefresh() is synchronized and always acquires the instance monitor. This is misleading when reasoning about contention; either adjust the comment or change the locking strategy.

    private void refreshCertificatesIfNeeded() {
        if (certificatesNeedRefresh()) { // Avoid acquiring the lock as much as possible.
            synchronized (this) {
                if (certificatesNeedRefresh()) { // After obtaining the lock, avoid doing too many operations.
                    refreshCertificates();
                }

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

moarychan · 2026-07-14T08:40:09Z

+            }
+
+            // Discover aliases from Key Vault and apply include/exclude regex filters.
+            aliases = refreshedAliases;


Is it possible to move the logic for retrieving refreshedAliases here?

moarychan · 2026-07-14T08:56:24Z


+    Set<String> getKeyVaultCertificateAliasFilterPatterns() {
+        return Optional.ofNullable(System.getProperty(CERTIFICATE_ALIAS_FILTER_PATTERNS_PROPERTY))
+            .map(value -> Stream.of(value.split(","))


Just check the comma and semicolon can be used as the file name, I couldn't find a good delimiter.

If sill using the comma in this property, please add a note in doc to tell users not using a alila including a comma.

another way: Use the number keys: azure.keyvault.jca.certificate-alias-filter-pattern for a single item, azure.keyvault.jca.certificate-alias-filter-pattern.xxx for multiple items, like bellow:

-Dazure.keyvault.jca.certificate-alias-filter-pattern.1=abc.* -Dazure.keyvault.jca.certificate-alias-filter-pattern.2=test.* -Dazure.keyvault.jca.certificate-alias-filter-pattern.3=\d{1,5}

Properties props = System.getProperties(); List<String> patterns = props.stringPropertyNames() .stream() .filter(k -> k.startsWith("azure.keyvault.jca.certificate-alias-filter-patterns.")) .sorted() .map(props::getProperty) .toList();

[ "abc.*", "test.*", "\\d{1,5}" ]

Add configured certificate filtering and lazy loading in KeyVault JCA

6c8ec90

Copilot AI review requested due to automatic review settings July 10, 2026 01:43

rujche requested review from a team as code owners July 10, 2026 01:43

rujche self-assigned this Jul 10, 2026

rujche added azure-spring All azure-spring related issues azure-spring-jca labels Jul 10, 2026

rujche added this to Spring Cloud Azure Jul 10, 2026

github-actions Bot added the KeyVault label Jul 10, 2026

github-project-automation Bot added this to Azure SDK for Key Vault Jul 10, 2026

rujche moved this to In Progress in Spring Cloud Azure Jul 10, 2026

github-project-automation Bot moved this to Untriaged in Azure SDK for Key Vault Jul 10, 2026

rujche added this to the 2026-08 milestone Jul 10, 2026

Copilot started reviewing on behalf of rujche July 10, 2026 01:44 View session

Add PR link to keyvault-jca changelog entry

86621f2

rujche requested a review from moarychan July 10, 2026 01:46

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Address PR review comments for alias refresh and thread safety

f4371a4

rujche requested a review from Copilot July 10, 2026 01:53

Copilot started reviewing on behalf of rujche July 10, 2026 01:53 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Address additional PR review feedback on thread safety and refresh be…

5507d46

…havior

rujche requested a review from Copilot July 10, 2026 02:02

Copilot started reviewing on behalf of rujche July 10, 2026 02:03 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java

Make alias lookup use snapshots for thread-safe iteration

cc494aa

rujche requested a review from Copilot July 10, 2026 02:13

Copilot started reviewing on behalf of rujche July 10, 2026 02:13 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java Outdated

Ensure refreshed aliases list remains mutable

b3cd9d5

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread ...re-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java Outdated

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java

rujche added 2 commits July 13, 2026 14:31

Regenerate linting suppressions for keyvault-jca

d75b0e2

Address review feedback on alias logging and filter parsing

b3120a8

rujche requested a review from Copilot July 13, 2026 06:54

Copilot started reviewing on behalf of rujche July 13, 2026 06:55 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Address review feedback on filter pattern normalization

91a495c

rujche requested a review from Copilot July 13, 2026 07:21

Copilot started reviewing on behalf of rujche July 13, 2026 07:21 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java Outdated

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java

Refine alias filter error message and state usage

a407a55

rujche requested a review from Copilot July 13, 2026 07:30

Copilot started reviewing on behalf of rujche July 13, 2026 07:31 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java Outdated

Comment thread ...re-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java

Harden certificate lookup null safety and key map exposure

31c94e2

rujche requested a review from Copilot July 13, 2026 08:04

Copilot started reviewing on behalf of rujche July 13, 2026 08:04 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Defensively copy exposed certificate collections

fb84762

rujche requested a review from Copilot July 13, 2026 08:19

Copilot started reviewing on behalf of rujche July 13, 2026 08:19 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java Outdated

Comment thread ...n/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java

Refine KeyVault certificate refresh locking

e450841

rujche requested a review from Copilot July 13, 2026 08:30

Copilot started reviewing on behalf of rujche July 13, 2026 08:31 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread ...re-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java

Comment thread sdk/keyvault/azure-security-keyvault-jca/checkstyle-suppressions.xml

Avoid duplicate certificate chain cloning

7c23284

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Comment thread sdk/keyvault/azure-security-keyvault-jca/checkstyle-suppressions.xml

Comment thread sdk/keyvault/azure-security-keyvault-jca/checkstyle-suppressions.xml

Copilot AI reviewed Jul 13, 2026

View reviewed changes

moarychan reviewed Jul 14, 2026

View reviewed changes

Uh oh!

Conversation

rujche commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What changed

Validation

Notes

All SDK Contribution checklist:

General Guidelines and Best Practices

Testing Guidelines

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

rujche commented Jul 10, 2026 •

edited

Loading