HDDS-7254. Document that moving SCM from non-HA to HA is currently unsupported.

[szetszwo]

What changes were proposed in this pull request?

Currently SCM HA is supported only for fresh installations. SCM HA must be enabled when starting the Ozone service in the beginning. After a SCM is started in non-HA mode, it cannot be easily changed to HA mode. We should document this clearly.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-7254

How was this patch tested?

NA

[ChenSammi]

Hi @szetszwo , currently SCM ratis is by default enabled in master. So we still cannot support moving SCM from one instance to three instances with ratis enabled?

[szetszwo]

@ChenSammi , you are right. The problem is the CA and certificates, but not the Ratis server.

[errose28]

I see some previous discussion here but I just want to clarify before I +1. This is saying we cannot go from Ratis 1 to Ratis 3 SCM due to current limitations with certificates? Is this something that is planning to be resolved in the future cert rotation/management changes that @fapifta is working on?

[szetszwo]

@errose28 , when configuring with HA, the CA structure has two levels -- root CA and sub CA. Without HA, there is only one level of CA. Therefore, the old certificates will not work when changing from non-HA to HA. I am not sure if there is a plan for fixing it.

Note that the problem has nothing to do with Ratis.

[szetszwo]

... SCM-HA.zh.md needs to be updated also (perhaps in another PR).

@kaijchen , yes, are you interested in updating it?

[szetszwo]

@ChenSammi , @nandakumar131, @kaijchen, @kerneltime , @errose28 , thanks everyone for reviewing this!

[kaijchen]

yes, are you interested in updating it?

I have created #3861 to update it.