DGS-21595 Allow alternate KMS key IDs on a KEK

[rayokota]

What

Checklist

• Contains customer facing changes? Including API/behavior changes
• Did you add sufficient unit test and/or integration test coverage for this PR?
  • If not, please explain why it is not required

References

JIRA:

Test & Review

Open questions / Follow-ups

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[Copilot]

Pull Request Overview

This PR adds support for alternate KMS key IDs on Key Encryption Keys (KEK) to provide fallback encryption/decryption capabilities. The implementation allows specifying multiple KMS key IDs that will be tried in sequence during encryption and decryption operations.

• Introduces a new AeadWrapper class that handles multiple KMS key IDs with fallback logic
• Adds configuration support for alternate KMS key IDs via encrypt.alternate.kms.key.ids
• Implements retry logic that attempts encryption/decryption with each available key ID

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/confluent_kafka/schema_registry/rules/encryption/encrypt_executor.py	Implements the core functionality with AeadWrapper class and alternate KMS key ID support
tests/schema_registry/_sync/test_avro_serdes.py	Adds synchronous test case for alternate KEK functionality
tests/schema_registry/_async/test_avro_serdes.py	Adds asynchronous test case for alternate KEK functionality

[sonarqube-confluent]

• 65.50% Coverage on New Code (is less than 80.00%)

Analysis Details

14 Issues

• 0 Bugs
• 0 Vulnerabilities
• 14 Code Smells

Coverage and Duplications

• 65.50% Coverage (66.10% Estimated after merge)
• No duplication information (5.40% Estimated after merge)

Project ID: confluent-kafka-python

View in SonarQube