[feat][zk] Enable certificate refresh for Quorum and Netty Servers

[michaeljmarshall]

Fixes apache/pulsar-helm-chart#285

Motivation

The current Pulsar SSL Server Contexts always reload certificates from the file system. Zookeeper supports such options, but we do not enable them by default. I propose we do that.

Apache Zookeeper documentation:

sslQuorumReloadCertFiles : (No Java system property) New in 3.5.5, 3.6.0: Allows Quorum SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false

client.certReload : (Java system property: zookeeper.client.certReload) New in 3.7.2, 3.8.1, 3.9.0: Allows client SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false

Modifications

• Enable the Quorum server to update its context (already available)
• Enable the Netty Server to update its context (not available until ZK 3.8.1 or 3.9.0 https://issues.apache.org/jira/browse/ZOOKEEPER-3806, but won't hurt anything to get for free when we upgrade)

Verifying this change

This is a trivial configuration change.

Does this pull request potentially affect one of the following parts:

• The default values of configurations

I do not believe this needs a PIP because our standard default is already to refresh certificates in the broker, function worker, the proxy, and the websocket proxy.

Documentation

• doc-not-needed

Matching PR in forked repository

PR in forked repository: michaeljmarshall#5

[nodece]

LGTM

[nodece]

From ZK documentation:

sslQuorumReloadCertFiles : (No Java system property) New in 3.5.5, 3.6.0: Allows Quorum SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false

client.certReload : (Java system property: zookeeper.client.certReload) New in 3.7.2, 3.8.1, 3.9.0: Allows client SSL keyStore and trustStore reloading when the certificates on the filesystem change without having to restart the ZK process. Default: false

[michaeljmarshall]

Good idea to reference the ZK documentation @nodece. I updated my PR's description with it. Thanks!

[codecov-commenter]

Codecov Report

❗ No coverage uploaded for pull request base (master@69deb1f). Click here to learn what that means.
The diff coverage is n/a.

@@            Coverage Diff            @@
##             master   #18097   +/-   ##
=========================================
  Coverage          ?   46.93%           
  Complexity        ?    17937           
=========================================
  Files             ?     1574           
  Lines             ?   128342           
  Branches          ?    14121           
=========================================
  Hits              ?    60239           
  Misses            ?    61908           
  Partials          ?     6195           

Flag	Coverage Δ
unittests	46.93% <0.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.