DGS-24022 SPIRE Trust Manager Only

[Dhiraj Suri (DhirajSuri27)]

Create a mode to run the server with SPIRE TrustManager-only and default KeyManager.

Confirmed that client TLS REQUESTED (instead of REQUIRED) works as expected,

Port 8085 is HTTPS,

dhirajsuri@FYL4F3V7V5 confluent-cloud-plugins % curl -u tenant1-key:nohash \
  -H "Content-Type: application/json" \
  https://localhost:8085/subjects -k
[]%

Existing port 8081 is HTTP,
dhirajsuri@FYL4F3V7V5 confluent-cloud-plugins % curl -u tenant1-key:nohash \
  -H "Content-Type: application/json" \
  http://localhost:8081/subjects
[]%


Port 8085 rejects stale TLS client cert,

dhirajsuri@FYL4F3V7V5 ~ %   curl -H "Authorization: Bearer token" \
       -H "target-sr-cluster: lsrc-dummy" \
       -H "Host: localhost" \
       --cert $CERT_PATH/svid.0.pem \
       --key $CERT_PATH/svid.0.key \
       --cacert /Users/dhirajsuri/rest-utils/core/src/test/resources/certs/cert1.pem \
       --resolve localhost:8085:127.0.0.1 \
       https://localhost:8085/config
curl: (56) LibreSSL SSL_read: LibreSSL/3.3.6: error:1404C416:SSL routines:ST_OK:sslv3 alert certificate unknown, errno 0

Port 8085 accepts correct TLS client cert and client is able to validate non-SPIRE server cert with a local CA file,

dhirajsuri@FYL4F3V7V5 ~ %   curl -H "Authorization: Bearer token" \
       -H "target-sr-cluster: lsrc-dummy" \
       -H "Host: localhost" \
       --cert $CERT_PATH/svid.0.pem \
       --key $CERT_PATH/svid.0.key \
       --cacert /Users/dhirajsuri/rest-utils/core/src/test/resources/certs/cert1.pem \
       --resolve localhost:8085:127.0.0.1 \
       https://localhost:8085/config
{"compatibilityLevel":"BACKWARD"}%

[Copilot]

Pull request overview

Adds a new SPIRE “trust-manager-only” SSL mode so the server can continue using the configured keystore for its KeyManager while sourcing peer verification (TrustManager) from SPIRE.

Changes:

• Introduces ssl.spire.trust.only.enabled config and exposes it via SslConfig.
• Refactors SslFactory to select between: non-SPIRE, SPIRE full mode, and SPIRE trust-only mode (TrustManager override).
• Adds unit tests covering SPIRE trust-only behavior and the “ignored when SPIRE disabled” case.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
core/src/main/java/io/confluent/rest/SslFactory.java	Adds server-factory selection logic and a trust-only SPIRE path that overrides TrustManagers.
core/src/main/java/io/confluent/rest/SslConfig.java	Exposes the new SPIRE trust-only config toggle.
core/src/main/java/io/confluent/rest/RestConfig.java	Defines and documents the new ssl.spire.trust.only.enabled setting in the config definition.
core/src/test/java/io/confluent/rest/SslFactoryTest.java	Adds tests for trust-only mode and SPIRE-disabled behavior; introduces new imports.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.