KeyVault JCA: lazy-load certificate material and add alias regex filtering

[rujche]

Description

This PR completes #39487 in azure-security-keyvault-jca and also finalizes the follow-up lazy-loading/thread-safety refinements requested during review.

What changed

• sdk/keyvault/azure-security-keyvault-jca/checkstyle-suppressions.xml updates are script-generated via eng/scripts/linting_suppression_generator.py (not manually edited).
• Added lazy loading in KeyVaultCertificates for certificate, key, and certificate chain by alias.
• Added alias regex filtering via system property:
  • azure.keyvault.jca.certificate-alias-filter-pattern configures a single filter.
  • Append a suffix to configure more than one filter, for example azure.keyvault.jca.certificate-alias-filter-pattern.1 or azure.keyvault.jca.certificate-alias-filter-pattern.prod.
  • Include patterns are plain regex entries.
  • Exclude patterns are prefixed with !.
  • Patterns use full-alias matching (Pattern.matcher(alias).matches()).
• Improved concurrent behavior and refresh flow in KeyVaultCertificates:
  • Reduced lock contention during lazy loads.
  • Alias listing is performed under the instance lock, so concurrent refreshes can no longer apply their results out of order, and only one listing request is issued per refresh.
  • Added retry semantics for transient/null load failures.
  • Preserved alias/cache consistency after refresh and client updates.
• Updated KeyVaultKeyStore lookup pathing and filter-pattern collection.
• Updated module docs and release notes (README.md, CHANGELOG.md).
• Added/updated unit tests in:
  • KeyVaultKeyStoreUnitTest
  • KeyVaultCertificatesTest

Why one property per filter

Each property value is a regex, so no delimiter is safe: a comma is valid regex syntax, and a bounded quantifier such as \d{1,5} would be split into \d{1 and 5} and fail to compile. Escaping does not help either, because \ is already the regex escape character, so \, cannot be distinguished from a legitimate regex escape. Giving each filter its own property removes the delimiter entirely, so a pattern may contain any character.

A suffix only keeps property names unique and does not affect evaluation, because include patterns are matched with anyMatch and exclude patterns with noneMatch. Property names are case-sensitive, so .prod and .PROD are two distinct filters.

-Dazure.keyvault.jca.certificate-alias-filter-pattern.1='^prod-.*'
-Dazure.keyvault.jca.certificate-alias-filter-pattern.2='^cert-\d{1,5}$'
-Dazure.keyvault.jca.certificate-alias-filter-pattern.exclude-old='!.*-old$'

Quote the value as required by your shell. On cmd.exe in particular, -D...='^prod-.*' arrives as 'prod-.*', because single quotes are not stripped and ^ is the escape character; the result still compiles as a regex but matches nothing. The README documents the correct quoting per shell.

Validation

• mvn -f sdk/keyvault/azure-security-keyvault-jca/pom.xml clean test: 115 tests pass.
• mvn -f sdk/keyvault/azure-security-keyvault-jca/pom.xml checkstyle:check spotbugs:check: 0 Checkstyle violations, 0 SpotBugs findings.

Notes

• The filter property is introduced by this PR and has never shipped, so renaming it from the earlier comma-separated azure.keyvault.jca.certificate-alias-filter-patterns to azure.keyvault.jca.certificate-alias-filter-pattern is not a breaking change, and the old name is removed rather than deprecated.
• main has been merged in after the 2.12.0 release, so the release notes now target 2.13.0-beta.1.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[Copilot]

Pull request overview

This PR enhances azure-security-keyvault-jca to reduce unnecessary Key Vault reads by (1) allowing users to configure a subset of certificate aliases to consider and (2) lazily loading certificate details only when a specific alias is requested—addressing the scenario described in #39487 (iterating/fetching all aliases when only one is configured).

Changes:

• Added azure.keyvault.jca.certificates system property support to filter Key Vault certificate aliases to a configured subset.
• Implemented lazy loading of Key Vault certificate key/certificate/chain data per alias (instead of eagerly loading all details on refresh).
• Updated tests and documentation (README + CHANGELOG) to cover and describe the new behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java	Wires configured alias filtering into keystore initialization and routes Key Vault lookups through lazy-loading accessors.
sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java	Implements configured-alias filtering and lazy loading of certificate details per alias.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/KeyVaultKeyStoreUnitTest.java	Adds unit coverage for parsing configured aliases and verifying they are passed into KeyVaultCertificates.
sdk/keyvault/azure-security-keyvault-jca/src/test/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificatesTest.java	Adds unit coverage ensuring alias listing is not eager and that only requested/configured aliases trigger Key Vault reads.
sdk/keyvault/azure-security-keyvault-jca/README.md	Documents the new azure.keyvault.jca.certificates configuration option.
sdk/keyvault/azure-security-keyvault-jca/CHANGELOG.md	Records the new filtering + lazy-loading features for the upcoming release.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/implementation/certificates/KeyVaultCertificates.java:300

• The inline comment says this outer check avoids acquiring the lock, but certificatesNeedRefresh() is synchronized and always acquires the instance monitor. This is misleading when reasoning about contention; either adjust the comment or change the locking strategy.

    private void refreshCertificatesIfNeeded() {
        if (certificatesNeedRefresh()) { // Avoid acquiring the lock as much as possible.
            synchronized (this) {
                if (certificatesNeedRefresh()) { // After obtaining the lock, avoid doing too many operations.
                    refreshCertificates();
                }

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (1)

sdk/keyvault/azure-security-keyvault-jca/src/main/java/com/azure/security/keyvault/jca/KeyVaultKeyStore.java:64

• The configured system property name for alias filtering is hard-coded here as azure.keyvault.jca.certificate-alias-filter-pattern, but the PR description/notes indicate the property was renamed to azure.keyvault.jca.certificate-alias-filter-patterns (plural). This inconsistency will confuse users and makes it unclear which property is actually supported. Please align the property name across code, README, CHANGELOG, and tests (or explicitly support both names for backward/forward compatibility).

    static final String CERTIFICATE_ALIAS_FILTER_PATTERN_PROPERTY
        = "azure.keyvault.jca.certificate-alias-filter-pattern";