DGS-22404 Add AppRole auth for HC Vault

[rayokota]

What

Add AppRole auth for HC Vault. Tested manually with local HC Vault instance with AppRole auth enabled.

Checklist

• [Y] Contains customer facing changes? Including API/behavior changes
• [Y] Did you add sufficient unit test and/or integration test coverage for this PR?
  • Covered by existing tests plus new manual testing.

References

JIRA:

Test & Review

Open questions / Follow-ups

[confluent-cla-assistant]

🎉 All Contributor License Agreements have been signed. Ready to merge.
_{Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.}

[Copilot]

Pull Request Overview

This PR adds AppRole authentication support to the HashiCorp Vault KMS driver, allowing authentication using role ID and secret ID as an alternative to token-based authentication.

• Added support for AppRole authentication configuration through new constants and environment variables
• Extended the KMS client constructor to handle role ID and secret ID parameters
• Implemented AppRole login functionality in the client initialization

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
hcvault_driver.py	Added AppRole configuration constants and environment variable fallback logic
hcvault_client.py	Extended constructor to accept AppRole credentials and perform AppRole login

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[sonarqube-confluent]

Analysis Details

0 Issues

• 0 Bugs
• 0 Vulnerabilities
• 0 Code Smells

Coverage and Duplications

• 9.50% Coverage (66.90% Estimated after merge)
• No duplication information (4.90% Estimated after merge)

Project ID: confluent-kafka-python

View in SonarQube