Disk erasure pertains to the erasing of data on each of a machine’s disks when the machine has been released (see Release action) back into the pool of available machines. The user can choose from among three erasure types before confirming the Release action. A default erasure configuration can also be set.
The three disk erasure types are:
- Standard erasure
- Secure erasure
- Quick erasure
Each of these are explained below.
Overwrites all data with zeros.
Although effectively equivalent to Standard erase, Secure erase is much faster because the disk’s firmware performs the operation. Because of this, however, some disks may not be able to perform this erasure type (SCSI, SAS, and FC disks in particular).
Same as Standard erase but only targets the first 1 MB and the last 1 MB of each disk. This removes the partition tables and/or superblock from the disk, making data recovery difficult but not impossible.
If all three options are checked when the machine is released the following order of preference is applied:
- Use ‘secure erase’ if the disk supports it
- If it does not then use ‘quick erase’
When using the MAAS CLI, you can erase a disk when releasing an individual machine. Note that this option is not available when releasing multiple machines, so you’ll want to make sure you’re using:
maas $PROFILE machine release...
maas $PROFILE machines release...
Note the difference in singular and plural “machine/machines” in the commands. Releasing a machine requires that you have the
system_id of the machine to be released, which you can obtain with a command like this one:
maas admin machines read | jq -r '(["HOSTNAME","SYSID","POWER","STATUS", "OWNER", "TAGS", "POOL", "VLAN","FABRIC","SUBNET"] | (., map(length*"-"))), (. | [.hostname, .system_id, .power_state, .status_name, .owner // "-", .tag_names // "-", .pool.name, .boot_interface.vlan.name, .boot_interface.vlan.fabric, .boot_interface.links.subnet.name]) | @tsv' | column -t
The basic form of the release command, when erasing disks on releasing, is:
maas $PROFILE machine release $SYSTEM_ID comment="some comment" erase=true [secure_erase=true ||/&& quick_erase=true]
quick_erase are both optional, although if you don’t specify either of them, the entire disk will be overwritten with null bytes. Note that this overwrite process is very slow.
Secure erasure uses the drive’s secure erase feature, if it has one. In some cases, this can be much faster than overwriting the entire drive. Be aware, though, that some drives implement secure erasure as a complete drive overwrite, so this method may still be very slow. Additionally, if you specify secure erasure and the drive doesn’t have this feature, you’ll get a complete overwrite anyway – again, possibly very slow.
Quick erasure wipes 2MB at the start and end of the drive to make recovery both inconvenient and unlikely to happen by accident. Note, though, that quick erasure is not secure.
If you specify both erasure types, like this:
maas $PROFILE machine release $SYSTEM_ID comment="some comment" erase=true secure_erase=true quick_erase=true
then MAAS will perform a secure erasure if the drive has that feature; if not, it will perform a quick erasure. Of course, if you’re concerned about completely erasing the drive, and you’re not sure whether the disk has secure erase features, the best way to handle that is to specify nothing, and allow the full disk to be overwritten by null bytes:
maas $PROFILE machine release $SYSTEM_ID comment="some comment" erase=true