About
Andrea Cosentino
Senior Principal Software Engineer at IBM
I’m an open source enthusiast and Senior Principal Software Engineer at IBM, working on integration technologies. I co-lead the Apache Camel project together with Claus Ibsen, focusing on enterprise integration.
Most of what I do sits in the open: components, releases, security fixes, the boring maintenance work that keeps a project the size of Camel usable. This blog is where I write the parts that don’t fit in a commit message.
Open Source Leadership
How I got here
I didn’t plan any of this as a career path. I picked up a component that needed fixing, then another one, and the rest followed. Looking back at what I was writing about, the arc is reasonably clear.
- Since July 2025 Senior Principal Software Engineer, IBM Integration technologies. On the Apache side I chair the Camel PMC and co-lead the project with Claus Ibsen, which in practice means releases, reviews, security triage and a lot of mailing list.
- 2026 Security became the main thread Running a weekly Java vulnerabilities digest, getting Camel ready for post-quantum cryptography, and arguing that we need a better culture around CVEs instead of treating every advisory as an accusation.
- 2020 – 2025 Camel 3, the cloud and secrets management The AWS2 component family, Camel Kafka Connector, and the Vault and Secrets property function with automatic context reload, so a running route can pick up a rotated secret without a restart. More recently document processing with LangChain4j and Camel on ECS Fargate.
- 2016 – 2018 Components, containers and the OSGi years Writing and maintaining components: camel-kubernetes, camel-nats, camel-cassandraql on Kubernetes, the Camel 2.x releases, and helping other people land their own components. This is also the ServiceMix and Karaf period, which is where I learned how much of integration is really classloading.
- 2016 – 2025 Red Hat Nearly ten years, and almost everything above happened there: the middleware and integration work, the components, the releases, and most of the patents further down this page. A decade in one place sounds static, but the stack underneath moved from OSGi containers to Spring Boot and Quarkus and then to whatever we are calling cloud native this year, so in practice very little of it stayed still.
Current Focus
I’m currently working on expanding the Camel ecosystem through subprojects like:
- Camel Spring Boot - Spring Boot integration for Apache Camel
- Camel Quarkus - Supersonic, subatomic Java integrations
- Kamelets - Reusable route snippets for easy integrations
Outside of Camel itself I contribute to Hawtio and to a number of smaller projects around the same ecosystem, usually because something broke and I happened to be the person looking at it.
A lot of the work is not feature work at all. Keeping a project the size of Camel healthy means release management, reviewing other people’s patches, triaging security reports, chasing dependency updates that nobody enjoys, and making sure the same route behaves the same way on Spring Boot, on Quarkus and on plain Java. None of that shows up in a changelog in a way anyone notices, but its the part that decides whether the project is still usable in five years.
The rest of my time goes on the boundary between the project and the people using it: answering questions on the mailing lists, writing up what changed and why, and trying to make the upgrade path from one major version to the next less painful then it needs to be.
Patents
Alongside the open source work I have spent a lot of time on patents: 41 inventions so far, 22 of them granted. Most were filed during the Red Hat years and a few more since moving to IBM. Almost none of it is solo work, it is mostly with Paolo Antinori and Leigh Griffin, and the full record is on my Google Scholar profile.
They fall into a few groups. A lot of messaging and event streaming: serializers, schemas, the claim check pattern, message sizing on mesh networks, compression for idempotent stores. Then secrets and key management, which is the same problem I ended up solving in the open with the Camel Vault property function. Then a long run of connected vehicle work: over the air updates, keyless entry, vehicle control on serverless functions. Lately it has been supply chain and AI: SBOM compliance, working out the minimal dependency update that clears a CVE, data provenance for foundational model training, and mediating access to quantum services.
The part that takes the time is not the writing. It is prior art search: reading through everything already published in an area before you can argue that the thing in front of you is actually new. I have done a lot of that, on my own submissions and reviewing other people’s, and it turns out to be a habit worth having well outside the patent process. It is the same instinct that tells you a brand new CVE is really the same bug shape you already saw two years ago.
Granted (22)
- Message format indicator for resource-constrained devices with Paolo Antinori
- Secrets management topology migrator with Paolo Antinori and Leigh Griffin
- Idling and waking a sender node for event message delivery with Paolo Antinori
- Cloud to on-premises storage migration with Leigh Griffin and Paolo Antinori
- Vehicle control using serverless functions with Paolo Antinori
- Adaptive asymmetric-key compression for idempotent data stores with Paolo Antinori
- Intra-vehicle over-the-air updates with Paolo Antinori
- Adaptive compression for idempotent data stores in computer messaging with Paolo Antinori
- Adjusting the size of a resource pool with Paolo Antinori
- Managing message sizes in a mesh network with Leigh Griffin and Paolo Antinori
- Cross-domain data access with Leigh Griffin and Paolo Antinori
- Sizing service for cloud migration away from only cloud storage with Leigh Griffin and Paolo Antinori
- Application profiling to resize and reconfigure compute instances with Paolo Antinori
- Proactive integrity checks with Paolo Antinori
- Object creation from schema for event streaming platform with Paolo Antinori
- Creation of message serializer for event streaming platform with Paolo Antinori
- Secrets rotation for vehicles with Paolo Antinori
- Multi-strategy compression scheme with Paolo Antinori
- Cloud-based keyless entry system with Paolo Antinori
- Dynamic runtime application integration with Paolo Antinori
- Managing event delivery in a serverless computing environment with Nicola Ferraro
- Providing system updates in automotive contexts with Paolo Antinori
Filed and pending (19)
- Auditable data provenance for training dataset prediction in large foundational models with Leigh Griffin
- Deployment of configuration files generated from serverless functions with Leigh Griffin
- Identifying minimal dependency updates to mitigate known CVEs with Leigh Griffin and Paolo Antinori
- Dynamic mediation of access to quantum services with Leigh Griffin and Paolo Antinori
- Mitigating vulnerabilities in a software program based on its usage with Luca Burgazzoli
- Event sourcing for quantum debugging and failover mechanisms with Leigh Griffin and Paolo Antinori
- Migrating ransomware activity of an operating system with Paolo Antinori
- Sizing service for cloud migration to physical machine with Leigh Griffin and Paolo Antinori
- Claim check mechanism for a message payload with Paolo Antinori
- Matching commands to attack patterns with Paolo Antinori
- Migrating secrets from a cloud environment to a local system with Leigh Griffin and Paolo Antinori
- Key rotation based on traffic state with Paolo Antinori
- User-customized vehicle control using serverless functions with Paolo Antinori
- Authenticating electronic key devices with Paolo Antinori
- Simplifying creation and publishing of schemas with Paolo Antinori
- Techniques for validating safety agreement compliance using SBOMs with Leigh Griffin and Paolo Antinori
- Mitigating ransomware activity of a host system using a kernel monitor with Paolo Antinori
- Intra-vehicle over-the-air updates based on install timestamp with Paolo Antinori
- Intra-vehicle over-the-air updates incorporating update compatibility with Paolo Antinori
Interests
Beyond integration, I’m passionate about:
- Security and cryptography
- Cloud-native technologies
- Developer experience and tooling
This Blog
This is my personal space where I write about open source, Apache Camel, programming, and technology in general. Lately it leans heavily towards security: what actually broke, and why, rather then the score somebody assigned to it.
Elsewhere
Best place to reach me is GitHub or LinkedIn. I read everything, I don’t always reply quickly.