DGS-21595 Allow alternate KMS key IDs on a KEK

[rayokota]

What

Checklist

• Contains customer facing changes? Including API/behavior changes
• Did you add sufficient unit test and/or integration test coverage for this PR?
  • If not, please explain why it is not required

References

JIRA:

Test & Review

Open questions / Follow-ups

[Copilot]

Pull Request Overview

Implements support for alternate KMS key IDs on a KEK (Key Encryption Key) to provide fallback options for encryption/decryption operations.

• Adds configuration parsing for alternate KMS key IDs from both rule config and KEK properties
• Replaces direct AEAD calls with an AeadWrapper that tries multiple key IDs in sequence
• Adds test coverage for the alternate KEK functionality

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 6 comments.

File	Description
schemaregistry/serde/avrov2/avro_test.go	Adds test case to verify encryption with alternate KMS key IDs configuration
schemaregistry/rules/encryption/encrypt_executor.go	Implements AeadWrapper with fallback logic and alternate KMS key ID parsing

[sonarqube-confluent]

• 0.00% Coverage on New Code (is less than 80.00%)

Analysis Details

0 Issues

• 0 Bugs
• 0 Vulnerabilities
• 0 Code Smells

Coverage and Duplications

• 0.00% Coverage (55.10% Estimated after merge)
• No duplication information (0.00% Estimated after merge)

Project ID: confluent-kafka-go

View in SonarQube