everpure.flasharray.purefa_zte module – Perform Zero Touch Erasure (ZTE) on a FlashArray

Note

This module is part of the everpure.flasharray collection (version 1.46.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install everpure.flasharray. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: everpure.flasharray.purefa_zte.

New in everpure.flasharray 1.44.0

Synopsis

  • Securely reset a FlashArray to a factory-fresh state using Zero Touch Erasure (ZTE).

  • ZTE wipes all drives, generates a NIST SP800-88R1 sanitization certificate and optionally reinstalls the array image.

  • This is an extremely destructive and irreversible operation. All data on the array is permanently and unrecoverably erased.

  • Requires Purity//FA 6.6.8, or higher.

  • All customer data (pods, protection groups, volumes/snapshots, array connections, file systems, directory service, file local users and groups, and Active Directory service) must be deleted and eradicated before starting ZTE, otherwise the operation will fail immediately.

  • ZTE is a multi-phase process. Use state=start to begin the drive wipe, state=status to monitor progress and retrieve the sanitization certificate, and state=finalize to complete the reset. Use state=cancel to cancel a failed reset.

  • During the drive wipe the array REST API service is unavailable for a period of time (typically around 30 minutes). This is expected behaviour.

Requirements

The below requirements are needed on the host that executes this module.

  • python >= 3.3

  • purestorage >= 1.19

  • py-pure-client >= 1.88.0

  • netaddr

  • requests

  • pycountry

  • urllib3

Parameters

Parameter

Comments

api_token

string

FlashArray API token for admin privileged user.

client_id

string

added in everpure.flasharray 1.43.0

ID of the API Client that issues the identity token.

Used with private_key_file.

disable_warnings

boolean

added in everpure.flasharray 1.29.0

Disable insecure certificate warnings in debug logs

Choices:

  • false ← (default)

  • true

eradicate

boolean

A safety acknowledgement that must be set to true to perform any destructive ZTE phase (start or finalize).

Setting this to true confirms that you understand all data on the array will be permanently and unrecoverably erased.

Choices:

  • false ← (default)

  • true

fa_url

string

FlashArray management IPv4 address or Hostname.

id_token

string

added in everpure.flasharray 1.43.0

A pre-signed JWT to authenticate with, as an alternative to api_token.

The token is exchanged by the array for a short-lived access token.

Requires a matching API Client to be registered on the array (see everpure.flasharray.purefa_apiclient).

image_source

string

The source of the image used when reinstall_image=true.

For phoning-home arrays set this to auto.

For darksite arrays set this to the URL, or file path, of an image bundle that the array can access. The image bundle must be the same version as the Purity//FA version running on the array.

Only used when state=finalize and reinstall_image=true.

Default: "auto"

image_version

string

The Purity//FA version of the darksite image bundle referenced by image_source.

Only used when state=finalize and reinstall_image=true for a darksite array.

issuer

string

added in everpure.flasharray 1.43.0

The API Client’s trusted identity issuer registered on the array.

Used with private_key_file.

key_id

string

added in everpure.flasharray 1.43.0

Key ID of the API Client that issues the identity token.

Used with private_key_file.

preserve_config

boolean

Whether to preserve array configuration data during the drive wipe.

Note that the default preserves all configuration data. Set this to false to wipe configuration data as well, for a completely factory-fresh array.

Only used when state=start.

Choices:

  • false

  • true ← (default)

private_key_file

string

added in everpure.flasharray 1.43.0

Path to the PEM RSA private key used to sign an identity token, as an alternative to api_token.

Requires client_id, key_id, issuer and username.

private_key_password

string

added in everpure.flasharray 1.43.0

Password protecting private_key_file, if encrypted.

reinstall_image

boolean

Whether to reinstall the array image when finalizing ZTE.

When false (Option 1), existing system-generated data, management interface configuration and configuration data are retained.

When true (Option 2), the array image is reinstalled and existing system-generated data, management interface configuration and configuration data are removed.

Only used when state=finalize.

Choices:

  • false ← (default)

  • true

skip_phonehome_check

boolean

Skip the phonehome connectivity check when starting ZTE.

Must be set to true for darksite arrays that do not have connectivity to Everpure cloud servers, otherwise the reset will fail the phonehome connectivity check.

Only used when state=start.

Choices:

  • false ← (default)

  • true

state

string

The ZTE phase to perform.

start begins Phase 1, securely wiping the drives and generating the sanitization certificate. If a reset is already running this is a no-op.

status returns the current ZTE process status and, when available, the sanitization certificate. This is non-destructive.

finalize performs Phase 3, finalizing the reset. This permanently deletes the sanitization certificate, so ensure it has been saved first. A finalized array no longer reports a reset process, so re-running finalize reports no change rather than failing.

cancel cancels a ZTE process that is in a failed state. If no reset is present, or the reset has not failed, this is a no-op.

Choices:

  • "start"

  • "status" ← (default)

  • "finalize"

  • "cancel"

username

string

added in everpure.flasharray 1.43.0

Username the issued token should be granted to.

Must be a valid user on the array. Used with private_key_file.

Notes

Note

  • This module requires the py-pure-client Python library.

  • Additional Python libraries may be required for specific modules.

  • You must set PUREFA_URL and PUREFA_API environment variables if fa_url and api_token arguments are not passed to the module directly.

  • Token-based authentication (id_token, or private_key_file with client_id, key_id, issuer and username) may be used as an alternative to api_token, and requires a matching API Client registered on the array via everpure.flasharray.purefa_apiclient.

Examples

- name: Check current ZTE status and retrieve sanitization certificate
  everpure.flasharray.purefa_zte:
    state: status
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592
  register: zte

- name: Save the sanitization certificate before finalizing
  ansible.builtin.copy:
    content: "{{ zte.zte.sanitization_certificate }}"
    dest: ./sanitization_certificate.txt
  when: zte.zte.sanitization_certificate | length > 0

- name: Start ZTE (Phase 1 - wipe drives)
  everpure.flasharray.purefa_zte:
    state: start
    eradicate: true
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Start ZTE on a darksite array
  everpure.flasharray.purefa_zte:
    state: start
    eradicate: true
    skip_phonehome_check: true
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Finalize ZTE without reinstalling the image (Option 1)
  everpure.flasharray.purefa_zte:
    state: finalize
    eradicate: true
    reinstall_image: false
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Finalize ZTE and reinstall image on a phoning-home array (Option 2)
  everpure.flasharray.purefa_zte:
    state: finalize
    eradicate: true
    reinstall_image: true
    image_source: auto
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Finalize ZTE and reinstall image on a darksite array (Option 2)
  everpure.flasharray.purefa_zte:
    state: finalize
    eradicate: true
    reinstall_image: true
    image_source: "https://server.example.com/purity_iso.sh"
    image_version: "6.6.8"
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

- name: Cancel a failed ZTE process
  everpure.flasharray.purefa_zte:
    state: cancel
    fa_url: 10.10.10.2
    api_token: e31060a7-21fc-e277-6240-25983c6c4592

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

zte

dictionary

The current state of the ZTE process.

Returned: always

details

string

Failure information when the ZTE process has failed.

Returned: always

image_download_progress

float

The image download progress, in decimal format, when reinstalling the image.

Null when no image download is in progress.

Returned: always

sanitization_certificate

string

The NIST SP800-88R1 sanitization certificate generated during the drive wipe.

This is only available between Phase 1 completing and ZTE being finalized. It cannot be retrieved once ZTE is finalized.

Returned: always

status

string

The status of the ZTE process. One of resetting, waiting_for_finalize, downloading, downloaded, reset_failed, download_failed or reimage_failed.

An empty string indicates that no ZTE process is in progress. This is both the pre-start and the post-finalize state.

Returned: always

Authors

  • Everpure Ansible Team (@sdodsley)