[PR] [rust] Add shared TLS profiles for Gateway REST [fluss]

["hutiefang76 (via GitHub)" <gi...@apache.org>]

hutiefang76 opened a new pull request, #4472:
URL: https://github.com/apache/fluss/pull/4472

   <!-- Generated-by: Codex (GPT-6) following https://github.com/apache/fluss/blob/main/AGENTS.md -->
   
   ### Purpose
   
   Linked issue: close #4470
   
   The Rust Gateway REST listener currently accepts plaintext HTTP only. This adds a reusable, named TLS profile layer and lets the REST listener serve HTTPS using one selected profile. Other protocol listeners can select a profile and their own ALPN policy without duplicating certificate loading or handshake handling.
   
   ### Brief change log
   
   - Add named TLS profiles with certificate/key paths and a handshake timeout. Load and validate all configured identities before binding a listener, with field-specific configuration errors.
   - Wrap accepted REST sockets in TLS when configured, preserving the existing HTTP/1.1 request handling, header timeout, and shutdown behavior. Plaintext remains the default when no profile is selected.
   - Derive connection metadata, including peer address, negotiated ALPN, and any verified client certificates, from the accepted transport rather than request headers. Client-certificate authentication and identity mapping are not enabled by this change.
   - Document the profile configuration and HTTPS deployment path. Regenerate the Rust dependency and binary license inventories using the repository scripts.
   
   ### Tests
   
   - `cargo test --locked --quiet` in `fluss-gateway`: 181 unit tests passed, 1 ignored; 8 HTTP, 6 process, and 7 TLS integration tests passed.
   - `cargo clippy --all-targets --locked -- -D warnings`
   - `cargo fmt --check`
   - `cargo deny --locked check licenses bans`
   - Binary license generator `--check`
   
   The TLS integration tests use real sockets and cover HTTPS health, plaintext rejection, invalid certificates and mismatched keys, distinct profile trust, handshake timeout, and shutdown with an incomplete handshake. Cluster-dependent end-to-end tests were not run locally.
   
   ### API and Format
   
   Adds Gateway configuration keys under `gateway.tls.profile.*` and `gateway.server.rest.tls-profile`. No storage format change. Existing configurations continue to serve plaintext HTTP.
   
   ### Documentation
   
   Updated the Gateway and deployment documentation with TLS profile examples and certificate requirements.
   
   ### Generative AI disclosure
   
   - [x] Yes — Codex (GPT-6) assisted with implementation and tests; the changes were reviewed and validated locally.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org