Apache Karaf 4.4: provisioning and operations

Apache Karaf is a managed OSGi runtime distribution. Version 4.4.11 is the current stable release and its 4.4 line supports OSGi R8 and Java 11+.

What Karaf adds

local and SSH shell;
features repositories and application provisioning;
configuration in etc/;
logging, audit, JAAS-based security facilities;
hot deployment;
instance and wrapper tooling;
integration with Pax Web, Aries, CXF, Camel, Decanter, and Cellar.

Features

A feature is a named, versioned provisioning recipe listing bundles, configs, libraries, requirements, and dependent features.

<feature name="charging-api" version="1.4.0">
  <feature>scr</feature>
  <bundle>mvn:com.acme/charging-api/1.4.0</bundle>
  <bundle>mvn:com.acme/charging-core/1.4.0</bundle>
</feature>

Feature resolution selects a compatible closure. Pin repositories and feature versions. Test installation from an empty Karaf, not a developer cache.

KAR and deploy directory

A KAR packages a features repository and artifacts for offline deployment. The deploy/ directory is convenient but implicit watching can surprise production operations. Prefer an explicit, audited provisioning path.

Shell diagnostics

Start with:

bundle:list
bundle:diag <id>
headers <id>
services
scr:list
scr:info <component>
config:list
feature:list -i
log:tail

Upgrades

Treat Karaf, framework, Pax Web, logging, features, Java, and applications as one tested compatibility set. Use immutable base distributions and externalized state. Rehearse config migration, data compatibility, feature rollback, and clean-cache recovery.

Security

Restrict SSH and JMX, rotate credentials and host keys, audit commands, limit Web Console, protect etc/, verify artifacts and signatures, and isolate management from public application traffic.

Feynman check

Karaf is not a different module standard. It is an operator-friendly house built around an OSGi framework and selected service implementations.