Hi Kafka developers, I'm looking for clarification on the intended contract of the public `SslEngineFactory` SPI, particularly in relation to dynamic SSL credential rotation.
I recently contributed SSL bundle hot-reload support for Kafka clients to Spring Boot (https://github.com/spring-projects/spring-boot/pull/52257). The Spring Boot team declined the proposal because it was unclear whether relying on Kafka to create new `SSLEngine` instances using dynamically updated key/trust material is an officially supported behavior. The implementation did not invoke `SslFactory.reconfigure()` or modify Kafka internals. Instead, it supplied a stable `SslBundle` reference that resolves the latest material whenever Kafka invokes `SslEngineFactory.createClientSslEngine()`. Could Kafka maintainers clarify whether the following is an intended and supported use of the SPI? - An `SslEngineFactory` dynamically resolves its key/trust material whenever a new `SSLEngine` is requested. - An existing producer/consumer continues running without recreation. - Existing TLS connections remain unaffected, while subsequent connections use renewed credentials. This is narrower than KIP-1288, since file watching and certificate rotation are already handled externally by Spring Boot. I also noticed that KIP-1288 and PR #21488 have seen limited progress since March. Is there a particular technical or design concern preventing this work from moving forward, or is it mainly awaiting maintainer review? Related: - https://github.com/spring-projects/spring-boot/pull/52257 - https://github.com/apache/kafka/pull/21488 - https://issues.apache.org/jira/browse/KAFKA-10731 - https://cwiki.apache.org/confluence/display/KAFKA/KIP-1288%3A+SSL+Hot+Reload+for+Kafka+Clients best regards, Henning Kvinnesland
