HDDS-13148. [Docs] Update Transparent Data Encryption doc.

[jojochuang]

What changes were proposed in this pull request?

HDDS-13148. [Docs] Update Transparent Data Encryption doc.

Please describe your PR in detail:

• Generated-by: Google Gemini 2.5 Pro (Preview) with the following prompt:

I want to update the current Ozone's Transparent Data Encryption
page https://ozone.apache.org/docs/edge/security/securingtde.html with the following instructions:

The Ozone TDE doc is written with the assumption that user is familiar with HDFS TDE, which may not be the case.

We should update the doc such that

(1) It does not require prior knowledge in HDFS TDE.

(2) Ozone can work with Hadoop KMS and Ranger KMS. We should mention Ranger KMS in the doc.

(3) For Ranger KMS, encryption key can also be managed by Ranger KMS management console or its REST API.

(4) hadoop key create enckey command has additional parameters: -size: specifies key bit length. Ozone supports 128 and 256 bits; -cipher: only AES/CTR/NoPadding (default) is supported as of now.

(5) Add reference to Transparent Encryption in HDFS: https://hadoop.apache.org/docs/current/hadoop-project-dist/hadoop-hdfs/TransparentEncryption.html and Hadoop KMS doc: https://hadoop.apache.org/docs/r3.4.1/hadoop-kms/index.html

(6) For the section Using Transparent Data Encryption from S3G, we should mention Ozone does not support S3-SSE (Server-Side Encryption) or S3-CSE (Client-Side Encryption). That said, Ozone S3 buckets can be encrypted using Ranger/Hadoop KMS to provide the same guarantee as S3-SSE with client-supplied key (S3 SSE-C).

(7) For section KMS Authorization: provide examples.

Be succinct. Insert new text to the existing content, instead of rewriting everything.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-13148

How was this patch tested?

User doc only update.

[Copilot]

Pull Request Overview

This PR updates the Transparent Data Encryption documentation to improve clarity and expand support instructions to include both Hadoop KMS and Ranger KMS. Key changes include:

• Enhanced introduction and explanation of TDE and its configuration requirements
• Updated instructions for creating encryption keys and encrypted buckets, including new command parameters
• Revised S3 Gateway usage and Ranger KMS authorization examples

Comments suppressed due to low confidence (3)

hadoop-hdds/docs/content/security/SecuringTDE.md:156

• Unintended text 'Youtube' appears in the permission list. Please replace or remove it to reflect the correct permission.

* Policy for `om` user (or the user running the Ozone Manager):
  * Resource: `keyname=enckey`
  * Permissions: `DECRYPT_EEK` (Decrypt Encrypted Encryption Key), `Youtube`

hadoop-hdds/docs/content/security/SecuringTDE.md:159

• The permission list includes an unexpected 'Youtube' token. Please replace or remove it with the appropriate permission.

* Policy for S3 Gateway proxy user (e.g., `s3g_proxy`):
  * Resource: `keyname=enckey` (or specific keys for S3 buckets)
  * Permissions: `DECRYPT_EEK`, `Youtube`

hadoop-hdds/docs/content/security/SecuringTDE.md:162

• The inclusion of 'Youtube' in the permission list seems accidental. It should be replaced or removed to correctly indicate the intended permissions.

* Policy for administrative users (e.g., `hdfs` or a keyadmin group):
  * Resource: `keyname=*` (or specific keys)
  * Permissions: `CREATE_KEY`, `DELETE_KEY`, `GET_KEYS`, `Youtube`, `ROLL_NEW_VERSION`

[Copilot]

Pull Request Overview

This PR updates the Ozone Transparent Data Encryption (TDE) documentation to make it more accessible for users without prior HDFS TDE knowledge and to clarify support for both Hadoop KMS and Ranger KMS. Key changes include:

• Expanded explanation of TDE functionality and the configuration steps for a Key Management Server (KMS).
• Detailed instructions for creating encryption keys and encrypted buckets, including new command parameters.
• Revised guidance on using TDE with Ozone’s S3 Gateway and an updated section on KMS authorization with example policies.

Comments suppressed due to low confidence (1)

hadoop-hdds/docs/content/security/SecuringTDE.md:164

• [nitpick] Ensure that resource identifiers in the Ranger KMS policy examples are consistently formatted (using code formatting where applicable) throughout the document for enhanced readability.

For example, when using Ranger KMS for authorization, you might have policies in Ranger KMS like:

[jojochuang]

Updated per Gemini's suggestion jojochuang#567

[smengcl]

Thanks @jojochuang for the doc improvement effort!

[jojochuang]

Thanks @smengcl !