feat(spring): support Key Vault certificate alias filters

[Arnab Nandy (arnabnandy7)]

Description

Adds Spring configuration support for filtering the certificate aliases loaded by the Azure Key Vault JCA provider.

Applications can now configure alias filter patterns independently for an SSL bundle's keystore and truststore:

• spring.ssl.bundle.keyvault.<bundle-name>.keystore.certificate-alias-filter-patterns
• spring.ssl.bundle.keyvault.<bundle-name>.truststore.certificate-alias-filter-patterns

The configured list is passed to the JCA provider through the azure.keyvault.jca.certificate-alias-filter-patterns system property. Include patterns are regular expressions, while exclusion patterns use the ! prefix. When the list is empty, all certificate aliases continue to be loaded, preserving the existing behavior.

The JCA system property is cleared between keystore and truststore initialization to prevent filter settings from leaking between SSL bundles or stores.

This change also:

• Adds Spring configuration binding coverage for the new properties.
• Adds unit coverage for propagation to the JCA system property.
• Updates the Spring Cloud Azure and autoconfigure changelogs.

Resolves #50013.

Depends on #49774, which adds the corresponding certificate alias filtering support to azure-security-keyvault-jca.

The focused tests are:

mvn -f sdk/spring/pom.xml -pl spring-cloud-azure-autoconfigure -am \
  -Dtest=AzureKeyVaultJcaAutoConfigurationTests,AzureKeyVaultSslBundleRegistrarTests \
  -Dsurefire.failIfNoSpecifiedTests=false test

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[github-actions]

Thank you for your contribution Arnab Nandy (@arnabnandy7)! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
31 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds Spring SSL bundle configuration support to control which Azure Key Vault JCA certificate aliases are loaded by propagating include/exclude regex patterns into the JCA provider’s system property.

Changes:

• Added new SSL bundle properties for keystore and truststore certificate alias filter patterns and bound them via Spring configuration.
• Propagated configured patterns to the Key Vault JCA provider using azure.keyvault.jca.certificate-alias-filter-patterns.
• Added/updated unit tests and changelog entries documenting the new configuration.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/keyvault/jca/AzureKeyVaultSslBundleRegistrar.java	Sets the new alias-filter system property when patterns are configured and includes it in the cleared-property set.
sdk/spring/spring-cloud-azure-autoconfigure/src/main/java/com/azure/spring/cloud/autoconfigure/implementation/keyvault/jca/properties/AzureKeyVaultSslBundleProperties.java	Adds certificateAliasFilterPatterns list to keystore/truststore property model for configuration binding.
sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/keyvault/jca/AzureKeyVaultSslBundleRegistrarTests.java	Adds a test for propagating configured patterns to the JCA system property.
sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/keyvault/jca/AzureKeyVaultJcaAutoConfigurationTests.java	Extends configuration binding assertions for the new truststore alias-filter property.
sdk/spring/spring-cloud-azure-autoconfigure/CHANGELOG.md	Documents the new SSL bundle alias-filter configuration support.
sdk/spring/CHANGELOG.md	Adds the feature entry to the aggregated Spring release notes.

Suppressed comments (1)

sdk/spring/spring-cloud-azure-autoconfigure/src/test/java/com/azure/spring/cloud/autoconfigure/implementation/keyvault/jca/AzureKeyVaultJcaAutoConfigurationTests.java:79

• After adding keystore alias-filter property values, the test should also assert that the keystore patterns were bound (similar to the truststore assertion above) to ensure the new keystore configuration is actually exercised.

                assertThat(sslBundlesProperties.getKeyvault().get("testBundle3").getTruststore().getKeyvaultRef()).isEqualTo("kv1");
                assertThat(sslBundlesProperties.getKeyvault().get("testBundle3").getKeystore().getKeyvaultRef()).isEqualTo("kv2");

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[Arnab Nandy (arnabnandy7)]

Moary Chen (@moarychan) please review

[Moary Chen (moarychan)]

PR #49774 is not merged yet, please note that port this feature to 6.x branch.

[Arnab Nandy (arnabnandy7)]

PR #49774 is not merged yet, please note that port this feature to 6.x branch.

Moary Chen (@moarychan) thanks for the reminder. This PR depends on #49774. Once the required JCA changes are available, I will port the Spring configuration support to the feature/spring-cloud-azure-6.x branch in a separate PR.