You are viewing a plain text version of this content. The canonical link for it is here.
Posted to jira@kafka.apache.org by "kwondh5217 (via GitHub)" <gi...@apache.org> on 2026/04/14 12:04:01 UTC

[PR] KAFKA-20437: Fix ssl.enabled.protocols dynamic reconfiguration not being applied [kafka]

kwondh5217 opened a new pull request, #22051:
URL: https://github.com/apache/kafka/pull/22051

   `ssl.enabled.protocols` is documented as a per-broker dynamically reconfigurable config, but it was classified in `SslConfigs.NON_RECONFIGURABLE_CONFIGS`. Because `SslFactory.createNewSslEngineFactory()` only   
     copies keys present in `RECONFIGURABLE_CONFIGS` into `nextConfigs`, the new value is silently dropped. `DefaultSslEngineFactory.shouldBeRebuilt()` then sees no diff and skips rebuilding the engine, leaving the  
     old protocol set active. As a result, operators who restrict `ssl.enabled.protocols` to TLSv1.3 via kafka-configs.sh see the change reflected in broker logs but TLSv1.2 connections continue to succeed.    
                                                                                                                                                                                                                  
     This PR moves `ssl.enabled.protocols` from `NON_RECONFIGURABLE_CONFIGS` to `RECONFIGURABLE_CONFIGS`. With this change, `createNewSslEngineFactory()` copies the updated value into `nextConfigs`, `shouldBeRebuilt()`
     detects the diff, and a new `SslEngineFactory` is instantiated with the restricted protocol set. A regression test is added to `SslFactoryTest` that configures both TLSv1.2 and TLSv1.3, reconfigures to TLSv1.3
      only, and asserts that a newly created `SSLEngine` no longer advertises TLSv1.2.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20437: Fix ssl.enabled.protocols dynamic reconfiguration not being applied [kafka]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22051:
URL: https://github.com/apache/kafka/pull/22051#issuecomment-6379227394

   A label of 'needs-attention' was automatically added to this PR in order to raise the
   attention of the committers. Once this issue has been triaged, the `triage` label
   should be removed to prevent this automation from happening again.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20437: Fix ssl.enabled.protocols dynamic reconfiguration not being applied [kafka]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22051:
URL: https://github.com/apache/kafka/pull/22051#issuecomment-5054226255

   A label of 'needs-attention' was automatically added to this PR in order to raise the
   attention of the committers. Once this issue has been triaged, the `triage` label
   should be removed to prevent this automation from happening again.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20437: Fix ssl.enabled.protocols dynamic reconfiguration not being applied [kafka]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22051:
URL: https://github.com/apache/kafka/pull/22051#issuecomment-5030201463

   This PR is being marked as stale since it has not had any activity in 90 days. If you
   would like to keep this PR alive, please leave a comment asking for a review. If the PR has 
   merge conflicts, update it with the latest from the base branch.
   <p>
   If you are having difficulty finding a reviewer, please reach out on the 
   [mailing list](https://kafka.apache.org/contact).
   <p>
   If this PR is no longer valid or desired, please feel free to close it. If no activity
   occurs in the next 30 days, it will be automatically closed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20437: Fix ssl.enabled.protocols dynamic reconfiguration not being applied [kafka]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22051:
URL: https://github.com/apache/kafka/pull/22051#issuecomment-4293428206

   A label of 'needs-attention' was automatically added to this PR in order to raise the
   attention of the committers. Once this issue has been triaged, the `triage` label
   should be removed to prevent this automation from happening again.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] KAFKA-20437: Fix ssl.enabled.protocols dynamic reconfiguration not being applied [kafka]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22051:
URL: https://github.com/apache/kafka/pull/22051#issuecomment-6332157677

   This PR is being marked as stale since it has not had any activity in 90 days. If you
   would like to keep this PR alive, please leave a comment asking for a review. If the PR has 
   merge conflicts, update it with the latest from the base branch.
   <p>
   If you are having difficulty finding a reviewer, please reach out on the 
   [mailing list](https://kafka.apache.org/contact).
   <p>
   If this PR is no longer valid or desired, please feel free to close it. If no activity
   occurs in the next 30 days, it will be automatically closed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: jira-unsubscribe@kafka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org