KIP-1288 — SSL Hot Reload for Kafka Clients

Discussion SecurityClient

Adds opt-in SSL hot reload to Kafka clients by monitoring keystore and truststore files for changes and automatically reconfiguring the SSL context without restarting the client. Currently, SSL credentials are loaded once at startup and never refreshed, so certificate rotation or expiry requires restarting every client—a significant operational burden in environments using short-lived certificates.

Details