Move Ignition-Dracut into Ignition

.cci.jenkinsfile

@@ -19,20 +19,16 @@ cosaPod(buildroot: true) {
             # https://bugs.archlinux.org/task/66526
             curl -L --remote-name-all https://kojipkgs.fedoraproject.org//packages/kernel/5.6.7/200.fc31/x86_64/kernel{,-core,-modules}-5.6.7-200.fc31.x86_64.rpm
         """)
-        shwrap("""
-            # and we want latest ignition-dracut until it is merged
-            # https://github.com/coreos/fedora-coreos-tracker/issues/511
-            git clone https://github.com/coreos/ignition-dracut
-        """)
-        fcosBuild(skipInit: true, make: true, makeDirs: ["ignition-dracut"], skipKola: true)
+        fcosBuild(skipInit: true, make: true, skipKola: true)
     }
 
     // we run the blackbox tests separately instead of as part of the main kola
     // run since it's a distinct kind of test and we want to draw more
     // attention to it in the Jenkins UI
     // XXX: need a e.g. `--tag !external`
 
-    fcosKola(extraArgs: "--denylist-test ext.*")
+    // XXX: skip rootfs.uuid to ratchet ignition-dracut merge
+    fcosKola(extraArgs: "--denylist-test ext.* --denylist-test rootfs.uuid")
 
     parallel blackbox: {
         shwrap("""

Makefile

@@ -12,11 +12,13 @@ endif
 all:
 	./build
 
-# This currently assumes you're using https://github.com/coreos/ignition-dracut/
-# If in the future any other initramfs integration appears, feel free to add a PR
-# to make this configurable.
 .PHONY: install
 install: all
+	for x in dracut/*; do \
+	  bn=$$(basename $$x); \
+	  install -D -t $(DESTDIR)/usr/lib/dracut/modules.d/$${bn} $$x/*; \
+	done
+	install -D -t $(DESTDIR)/usr/lib/systemd/system systemd/*
 	install -m 0755 -D -t $(DESTDIR)/usr/lib/dracut/modules.d/30ignition bin/$(GOARCH)/ignition
 	install -m 0755 -D -t $(DESTDIR)/usr/bin bin/$(GOARCH)/ignition-validate
 

README.md

@@ -32,24 +32,19 @@ Example:
 podman run --rm -i quay.io/coreos/ignition-validate - < myconfig.ign
 ```
 
-## Dracut
-
-For distributions that use dracut, there is an
-[ignition-dracut](https://github.com/coreos/ignition-dracut)
-repo which contains scripts and systemd units for boot-time
-execution. But it's very likely that distributions will have
-to do additional work in order to properly integrate with
-Ignition.
-
 ## Branches
 
 There are two branches:
-- `master` works with the `master` branch of ignition-dracut
-  and is currently used by Fedora CoreOS, which targets
-  Ignition v2 (spec 3).
-- `spec2x` works with the `spec2x` branch of ignition-dracut
-  and is currently used by CL and RHEL CoreOS, which (for
-  now) targets Ignition v0.x (spec 2).
+- `master`: the actively maintained version of Ignition, supporting config
+  spec 3.x.  Used by Fedora CoreOS, and by Red Hat CoreOS starting with
+  version 46.82.
+- `spec2x`: the legacy branch of Ignition, supporting config spec 1 and 2.x.
+  Used by RHEL CoreOS, alongside the `spec2x` branch of ignition-dracut,
+  and by Flatcar Container Linux.
+
+### Legacy ignition-dracut
+
+In Ignition 2.5.0, the old [ignition-dracut](https://github.com/coreos/ignition-dracut) repository, containing scripts and systemd units for boot-time execution, was merged into Ignition itself.  CoreOS-specific Dracut modules have moved to the [fedora-coreos-config](https://github.com/coreos/fedora-coreos-config) repository.
 
 [getting started]: doc/getting-started.md
 [issues]:  https://github.com/coreos/ignition/issues/new/choose

dracut/30ignition/99-xx-ignition-systemd-cryptsetup.rules

@@ -0,0 +1,8 @@
+SUBSYSTEM!="block", GOTO="systemd_cryptsetup_end"
+
+# This overrides systemd default behavior from 99-systemd.rules, which ignores unformatted crypto devices.
+# https://github.com/systemd/systemd/commit/90e6abaea0cfd25093aae1ad862c5c909ae55829
+# Ignition relies on unformatted crypto devices being discovered to trigger formatting
+SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="1"
+
+LABEL="systemd_cryptsetup_end"

dracut/30ignition/ignition-complete.target

@@ -0,0 +1,14 @@
+# This target is reached when Ignition finishes running. Note that it gets
+# activated *only* on first boot (or if ignition.firstboot=1 is provided).
+# Thus, it is also an API for units to use so that they are activated only on
+# first boot. Simply add a link under ignition-complete.target.requires in the
+# initrd.
+[Unit]
+Description=Ignition Complete
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+Before=initrd.target
+
+# Make sure we stop all the units before switching root
+Conflicts=initrd-switch-root.target umount.target
+Conflicts=dracut-emergency.service emergency.service emergency.target

dracut/30ignition/ignition-diskful-subsequent.target

@@ -0,0 +1,12 @@
+# This target is a combination of ignition-subsequent.target and
+# ignition-diskful.target - units here should only run when we have a
+# boot disk and *aren't* doing the first boot.
+[Unit]
+Description=Ignition Subsequent Boot Disk Setup
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+Before=ignition-subsequent.target
+
+# Make sure we stop all the units before switching root
+Conflicts=initrd-switch-root.target umount.target
+Conflicts=dracut-emergency.service emergency.service emergency.target

dracut/30ignition/ignition-diskful.target

@@ -0,0 +1,12 @@
+# This target contains Ignition units that should only run when we have a
+# boot disk, i.e. when we're not running diskless from a live image in RAM.
+# Like ignition-complete.target, it only runs on first boot.
+[Unit]
+Description=Ignition Boot Disk Setup
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+Before=ignition-complete.target
+
+# Make sure we stop all the units before switching root
+Conflicts=initrd-switch-root.target umount.target
+Conflicts=dracut-emergency.service emergency.service emergency.target

dracut/30ignition/ignition-disks.service

@@ -0,0 +1,35 @@
+[Unit]
+Description=Ignition (disks)
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+DefaultDependencies=false
+Before=ignition-complete.target
+
+# Stage order: setup -> fetch-offline [-> fetch] -> disks -> mount -> files.
+After=ignition-fetch.service
+Before=ignition-mount.service
+
+# This stage runs between `basic.target` and `initrd-root-device.target`,
+# see https://www.freedesktop.org/software/systemd/man/bootup.html
+# Make sure to run before the file system checks, as sgdisk will trigger
+# udev events, potentially resulting in race conditions due to disappearing
+# devices.
+
+# Note that CL runs this before `local-fs-pre.target` to allow for configs that
+# completely wipe the rootfs. Though we're not there yet. But we still run
+# before `sysroot.mount` on principle.
+Before=initrd-root-device.target
+Before=sysroot.mount
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+# This stage requires udevd to detect disk partitioning changes.
+Requires=systemd-udevd.service
+After=systemd-udevd.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/run/ignition.env
+ExecStart=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=disks

dracut/30ignition/ignition-fetch-offline.service

@@ -0,0 +1,28 @@
+# This unit creates /run/ignition/neednet if networking needs to be enabled.
+# The distro is responsible for sequencing a unit between
+# ignition-fetch-offline.service and ignition-fetch.service, detecting the
+# flag file with ConditionPathExists=, and enabling networking.
+
+[Unit]
+Description=Ignition (fetch-offline)
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+DefaultDependencies=false
+Before=ignition-complete.target
+After=basic.target
+
+# Stage order: setup -> fetch-offline [-> fetch] -> disks -> mount -> files.
+# We run after the setup stage has run because it may copy in new/different
+# ignition configs for us to consume.
+After=ignition-setup-base.service
+After=ignition-setup-user.service
+Before=ignition-fetch.service
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/run/ignition.env
+ExecStart=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=fetch-offline

dracut/30ignition/ignition-fetch.service

@@ -0,0 +1,26 @@
+[Unit]
+Description=Ignition (fetch)
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+DefaultDependencies=false
+Before=ignition-complete.target
+After=basic.target
+ConditionPathExists=/run/ignition/neednet
+
+# Stage order: setup -> fetch-offline [-> fetch] -> disks -> mount -> files.
+# We run after the setup stage has run because it may copy in new/different
+# ignition configs for us to consume.
+After=ignition-fetch-offline.service
+Before=ignition-disks.service
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+# If we run, we definitely need network, so make sure we run after.
+After=network.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/run/ignition.env
+ExecStart=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=fetch

dracut/30ignition/ignition-files.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Ignition (files)
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+DefaultDependencies=false
+Before=ignition-complete.target
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+# Stage order: setup -> fetch-offline [-> fetch] -> disks -> mount -> files.
+After=ignition-mount.service
+
+# Run before initrd-parse-etc so that we can drop files it then picks up.
+Before=initrd-parse-etc.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/run/ignition.env
+ExecStart=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=files --log-to-stdout

dracut/30ignition/ignition-generator

@@ -0,0 +1,71 @@
+#!/bin/bash
+# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+# ex: ts=8 sw=4 sts=4 et filetype=sh
+
+set -e
+
+# Generators don't have logging right now
+# https://github.com/systemd/systemd/issues/15638
+exec 1>/dev/kmsg; exec 2>&1
+
+UNIT_DIR="${1:-/tmp}"
+
+cmdline=( $(</proc/cmdline) )
+cmdline_arg() {
+    local name="$1" value="$2"
+    for arg in "${cmdline[@]}"; do
+        if [[ "${arg%%=*}" == "${name}" ]]; then
+            value="${arg#*=}"
+        fi
+    done
+    echo "${value}"
+}
+
+cmdline_bool() {
+    local value=$(cmdline_arg "$@")
+    case "$value" in
+        ""|0|no|off) return 1;;
+        *) return 0;;
+    esac
+}
+
+add_requires() {
+    local name="$1"; shift
+    local target="$1"; shift
+    local requires_dir="${UNIT_DIR}/${target}.requires"
+    mkdir -p "${requires_dir}"
+    ln -sf "../${name}" "${requires_dir}/${name}"
+}
+
+# This can't be done with ConditionKernelCommandLine because that always
+# starts the unit's dependencies. We want to start networking only on first
+# boot.
+if $(cmdline_bool 'ignition.firstboot' 0); then
+    add_requires ignition-complete.target initrd.target
+
+    # Invoke distro hook for detecting whether we're booted from a live image,
+    # and therefore won't have a root disk.
+    if ! command -v is-live-image >/dev/null || ! is-live-image; then
+        add_requires ignition-diskful.target ignition-complete.target
+
+        # ignition-setup-user.service should depend on the boot device node
+        # only on diskful boots
+        mkdir -p "${UNIT_DIR}/ignition-setup-user.service.d"
+        cat > "${UNIT_DIR}/ignition-setup-user.service.d/diskful.conf" <<EOF
+[Unit]
+Requires=dev-disk-by\x2dlabel-boot.device
+After=dev-disk-by\x2dlabel-boot.device
+EOF
+    fi
+else
+    # If we're doing a non-Ignition (subsequent) boot, then
+    # queue a different target.  This is necessary so that units
+    # like `ignition-ostree-mount-sysroot.service`
+    # can cleanly distinguish between the two.
+    add_requires ignition-subsequent.target initrd.target
+    if ! command -v is-live-image >/dev/null || ! is-live-image; then
+        add_requires ignition-diskful-subsequent.target ignition-subsequent.target
+    fi
+fi
+
+echo "PLATFORM_ID=$(cmdline_arg ignition.platform.id)" > /run/ignition.env

dracut/30ignition/ignition-luks.conf

@@ -0,0 +1,3 @@
+# We don't ship cracklib dicts in the initramfs, so don't check
+# generated clevis keys against them
+dictcheck = 0

dracut/30ignition/ignition-mount.service

@@ -0,0 +1,33 @@
+[Unit]
+Description=Ignition (mount)
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+DefaultDependencies=false
+Before=ignition-complete.target
+
+# Stage order: setup -> fetch-offline [-> fetch] -> disks -> mount -> files.
+# We need to make sure the partitions and filesystems are set up before
+# mounting. This is also guaranteed through After=initrd-root-fs.target but
+# just to be explicit.
+After=ignition-disks.service
+Before=ignition-files.service
+
+# Make sure ExecStop= runs before we switch root
+Before=initrd-switch-root.target
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+# Make sure the final /sysroot is ready first, since we're mounting under there
+Requires=initrd-root-fs.target
+After=initrd-root-fs.target
+
+# Make sure root filesystem is remounted read-write if needed
+After=ignition-remount-sysroot.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/run/ignition.env
+ExecStart=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=mount --log-to-stdout
+ExecStop=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=umount --log-to-stdout

dracut/30ignition/ignition-remount-sysroot.service

@@ -0,0 +1,20 @@
+[Unit]
+Description=Remount /sysroot read-write for Ignition
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+# Some Linux Distributions don't pass a rw option on the kernel
+# commandline and thus mount the root filesystem ro by default. In
+# this case, remount /sysroot to rw (issue #37)
+DefaultDependencies=no
+Before=ignition-diskful.target
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+After=sysroot.mount
+ConditionPathIsReadWrite=!/sysroot
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/bin/mount -o remount,rw /sysroot

dracut/30ignition/ignition-setup-base.service

@@ -0,0 +1,18 @@
+[Unit]
+Description=Ignition (setup base config)
+Documentation=https://github.com/coreos/ignition
+ConditionPathExists=/etc/initrd-release
+DefaultDependencies=false
+Before=ignition-complete.target
+
+OnFailure=emergency.target
+OnFailureJobMode=isolate
+
+# Stage order: setup -> fetch-offline [-> fetch] -> disks -> mount -> files.
+Before=ignition-fetch-offline.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+EnvironmentFile=/run/ignition.env
+ExecStart=/usr/sbin/ignition-setup-base