cmek split 4/8: encryption metadata cache and manager (#4570)

[ti-chi-bot]

This is an automated cherry-pick of #4570

What problem does this PR solve?

Issue Number: ref #3943

This is split PR 4/8 from #3955.

What is changed and how it works?

This PR adds the core encryption managers:

• Add encryption metadata manager with metadata/data-key cache and refresh logic.
• Add data encryption manager for encrypt/decrypt flow with header handling.
• Add degrade-on-error behavior controlled by config.
• Add keyspace-aware data key retrieval and decrypt path.
• Add mock TiKV client and unit tests for manager flows.

This PR provides the core CMEK encryption/decryption engine consumed by server wiring and storage modules.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Questions

Will it cause performance regression or break compatibility?

Potential small crypto overhead when enabled; behavior keeps plaintext compatibility via header detection/degrade path.

Do you need to update user documentation, design documentation or monitoring documentation?

No.

Release note

None

Summary by CodeRabbit

• New Features

  • Added per-keyspace data encryption and decryption capabilities with configurable degradation to plaintext on key retrieval failures.

• Tests

  • Comprehensive test coverage for encryption operations, key management, and backwards compatibility scenarios.

• Documentation

  • Updated error-handling guidelines to enforce standardized error objects from the predefined error package.

[ti-chi-bot]

This cherry pick PR is for a release branch and has not yet been approved by triage owners.
Adding the do-not-merge/cherry-pick-not-approved label.

To merge this cherry pick:

1. It must be LGTMed and approved by the reviewers firstly.
2. For pull requests to TiDB-x branches, it must have no failed tests.
3. AFTER it has lgtm and approved labels, please wait for the cherry-pick merging approval from triage owners.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 47dec02b-2455-4f7e-85dd-e0fae2ff5ae3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ti-chi-bot]

@ti-chi-bot: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-error-log-review	7bed0ce	link	true	/test pull-error-log-review

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tenfyzhong

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tenfyzhong]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment