Adds enable_ata_secure_erase option

Adds an option for the dependent patch which
just updates the the driver_internal_info to
trigger a behavior change in IPA.

Depends-On: https://review.openstack.org/#/c/575207
Change-Id: Ic4210711b64c47d253161e50e8a371f6365a7c39
Story: #2002546
Task: #22106

ironic/conf/deploy.py

@@ -26,6 +26,10 @@ opts = [
     cfg.StrOpt('http_root',
                default='/httpboot',
                help=_("ironic-conductor node's HTTP root path.")),
+    cfg.BoolOpt('enable_ata_secure_erase',
+                default=True,
+                help=_('Whether to support the use of ATA Secure Erase '
+                       'during the cleaning process. Defaults to True.')),
     cfg.IntOpt('erase_devices_priority',
                help=_('Priority to run in-band erase devices via the Ironic '
                       'Python Agent ramdisk. If unset, will use the priority '

ironic/drivers/modules/deploy_utils.py

@@ -681,6 +681,8 @@ def agent_add_clean_params(task):
     info['agent_erase_devices_zeroize'] = zeroize
     erase_fallback = CONF.deploy.continue_if_disk_secure_erase_fails
     info['agent_continue_if_ata_erase_failed'] = erase_fallback
+    secure_erase = CONF.deploy.enable_ata_secure_erase
+    info['agent_enable_ata_secure_erase'] = secure_erase
 
     task.node.driver_internal_info = info
     task.node.save()

ironic/tests/unit/drivers/modules/test_deploy_utils.py

@@ -1625,6 +1625,7 @@ class AgentMethodsTestCase(db_base.DbTestCase):
                               'deploy')
         cfg.CONF.set_override('continue_if_disk_secure_erase_fails', True,
                               'deploy')
+        cfg.CONF.set_override('enable_ata_secure_erase', False, 'deploy')
         with task_manager.acquire(
                 self.context, self.node.uuid, shared=False) as task:
             utils.agent_add_clean_params(task)
@@ -1634,6 +1635,8 @@ class AgentMethodsTestCase(db_base.DbTestCase):
                 'agent_erase_devices_zeroize'])
             self.assertIs(True, task.node.driver_internal_info[
                 'agent_continue_if_ata_erase_failed'])
+            self.assertIs(False, task.node.driver_internal_info[
+                'agent_enable_ata_secure_erase'])
 
     @mock.patch.object(pxe.PXEBoot, 'prepare_ramdisk', autospec=True)
     @mock.patch('ironic.conductor.utils.node_power_action', autospec=True)

releasenotes/notes/adds-secure-erase-switch-23f449c86b3648a4.yaml

@@ -0,0 +1,7 @@
+---
+features:
+  - |
+    Adds the ``[deploy]enable_ata_secure_erase`` option which allows an
+    operator to disable ATA Secure Erase for all nodes being managed by
+    the conductor. This setting defaults to ``True`` which aligns with
+    the prior behavior of the Bare Metal service.