You use Apache CXF, eg the cxfEndpoint to publish the web service on the Karaf server. And when you do that Apache CXF uses the HTTP service of Apache Karaf, which is Jetty based. So in the bottom line, its Jetty that is used.
Apache Karaf has a etc/jetty.xml configuration file, where Jetty is configured.
You can find some details about the OSGi HTTP service and Jetty on the Karaf website, such as: http://karaf.apache.org/manual/latest-2.3.x/users-guide/http.html