[HDDS-6030] Support for External Root CA

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.2.0
• Component/s: OM, Ozone Datanode, SCM, Security
• Labels: pull-request-available
• Target Version/s: 1.3.0
• Assignee: Vivek Ratnavel Subramanian
• Reporter: Vivek Ratnavel Subramanian
• Created: 23/Nov/21 00:33
• Updated: 15/Oct/22 11:34
• Resolved: 15/Oct/22 11:34

Description

Currently, Ozone brings its own CA and intermediate CAs through SCM instances when security is enabled and doesn't support deployments with an existing Root CA. Oftentimes enterprise customers have their own root CA and intermediate CAs set up and configured to sign the certificates within their organization.

This jira can be used to track this feature of supporting external Root CA in Ozone. This feature might require changes or updates to the security bootstrap flow of all the components. And, hence the feature can be tracked in a separate branch.

More details are added to the design doc attached.
External root CA support - Design Doc v1.pdf

Issue Links

• relates to: HDDS-7331 Ozone PKI improvements
• supercedes: HDDS-2731 Certificate Revocation Support for Ozone CA
• links to: GitHub Pull Request #2962

Sub-Tasks

• Add configs to support externalization of root CA: Resolved
• Load CA cert from truststore: Resolved
• All the components should send their signed certificates to SCM for persistence: Resolved
• Create a new docker compose env for External Root CA: Resolved
• Add acceptance tests for external Root CA: Resolved
• Introduce different configs for each component for keystore and truststore files: Resolved
• Document the steps and configs needed to enable external root CA: Resolved