[HDDS-2012] Support GDPR-Right to Erasure feature on Ozone

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Fix Version/s: 0.5.0
• Component/s: Ozone Client, Ozone Manager
• Labels: compliance
• Target Version/s: 0.5.0
• Release Note: GDPR Right to Erasure feature set with known limitations for backup/restore scenarios and existing buckets would need manual copying of keys.
• Assignee: Dinesh Chitlangia
• Reporter: Dinesh Chitlangia
• Created: 22/Aug/19 21:47
• Updated: 26/Jan/21 06:49
• Resolved: 05/Dec/19 08:38

Description

While several aspects of GDPR can be achieved by various ways in Ozone, the Right to Erasure support will need some work.
This is an umbrella jira to add support for this feature to Ozone.

Design doc is attached.

Issue Links

• is a parent of: HDDS-4394 Option to enable GDPR globally on ozone clusters

Sub-Tasks

• Add flag gdprEnabled for BucketInfo in OzoneManager proto: Resolved
• Create Symmetric Key for GDPR: Resolved
• Encrypt/decrypt key using symmetric key while writing/reading: Resolved
• Add option to enforce gdpr in Bucket Create command: Resolved
• Add option to confirm if a key has been deleted from DeletedKeys table in OM: Resolved
• Allow users to specify symmetric key algorithm & secret: Resolved
• Add robot test for GDPR feature: Resolved
• Create RepeatedKeyInfo structure to be saved in deletedTable: Resolved
• Delete GDPR Encryption Key from metadata when a Key is deleted: Resolved
• GDPR key generation could benefit from secureRandom: Resolved
• Delete FileEncryptionInfo from KeyInfo when a Key is deleted: Resolved
• Enable gdpr robot test in daily build: Resolved