ignition: Mount OEM partition so that Ignition doesn't have to do it

dracut/50flatcar-network/afterburn-network-kargs.service

@@ -11,7 +11,7 @@ PartOf=systemd-networkd.service
 ConditionKernelCommandLine=|coreos.oem.id=vmware
 ConditionKernelCommandLine=|flatcar.oem.id=vmware
 OnFailure=emergency.target
-OnFailureJobMode=isolate
+OnFailureJobMode=replace-irreversibly
 
 # Flatcar: Load coreos-metadata binary
 Requires=sysusr-usr.mount

dracut/51diskless-generator/diskless-generator

@@ -29,8 +29,6 @@ add_requires() {
     ln -sf "../${name}" "${requires_dir}/${name}"
 }
 
-# set to 1 to enable copying /oem from the initrd
-copy_oem=0
 # check both the new mount.usr and our old usr kernel options
 usr=$(cmdline_arg mount.usr "$(cmdline_arg usr)")
 root=$(cmdline_arg root)
@@ -39,7 +37,6 @@ rootflags=$(cmdline_arg rootflags)
 
 # If usr= was not specified and a squashfs is bundled in the initrd use it.
 if [[ -z "${usr}" && -f /usr.squashfs ]]; then
-    copy_oem=1
     add_requires sysroot-usr.mount
     cat >"${UNIT_DIR}/sysroot-usr.mount" <<EOF
 # Automatically generated by diskless-generator
@@ -57,6 +54,26 @@ What=/usr.squashfs
 Where=/sysroot/usr
 Type=squashfs
 EOF
+else
+    # When /usr is provided by the initrd, then OEM is a tmpfs. This is already
+    # mounted by minimal-init, so we don't need a unit in that case.
+    cat >"${UNIT_DIR}/oem.mount" <<EOF
+# Automatically generated by diskless-generator
+
+[Unit]
+# The default dependencies will mount this after local-fs-pre.target, but we
+# need to mount it before.
+DefaultDependencies=no
+# Add these lines that are normally added by default.
+Before=umount.target
+Conflicts=umount.target
+
+[Mount]
+What=/dev/disk/by-label/OEM
+Where=/oem
+Type=btrfs,ext4
+Options=nodev
+EOF
 fi
 
 # When root= and rootfstype= are unspecified mount it as a tmpfs
@@ -108,34 +125,3 @@ RemainAfterExit=yes
 ExecStart=/usr/lib/systemd/diskless-btrfs
 EOF
 fi
-
-# When /usr is provided by the initrd then OEM may be also, but as tmpfs.
-# The contents of /oem are copied into place by 99setup-root
-if [[ "${copy_oem}" -eq 1 ]]; then
-    add_requires sysroot-oem.mount
-    cat >"${UNIT_DIR}/sysroot-oem.mount" <<EOF
-# Automatically generated by diskless-generator
-
-[Unit]
-# This runs early for initrd-setup-root to populate it.
-# Ignition can mount something else on /oem still
-# if the user wants so.
-Before=initrd-root-fs.target
-
-[Mount]
-What=tmpfs
-Where=/sysroot/oem
-Type=tmpfs
-Options=size=0,mode=755
-EOF
-else
-    cat >"${UNIT_DIR}/sysroot-oem.mount" <<EOF
-# Automatically generated by diskless-generator
-# (Ignition's OEM mounting can also (de)activate the unit)
-[Mount]
-What=/dev/disk/by-label/OEM
-Where=/sysroot/oem
-Type=auto
-Options=nodev
-EOF
-fi

dracut/51diskless-generator/module-setup.sh

@@ -12,4 +12,6 @@ install() {
     inst_simple "$moddir/diskless-btrfs" "$systemdutildir/diskless-btrfs"
     inst_simple "$moddir/diskless-generator" \
         "$systemdutildir/system-generators/diskless-generator"
+    inst_simple "$moddir/sysroot-oem.mount" \
+        "$systemdsystemunitdir/sysroot-oem.mount"
 }

dracut/51diskless-generator/sysroot-oem.mount

@@ -0,0 +1,8 @@
+[Unit]
+After=ignition-mount.service
+
+[Mount]
+What=/oem
+Where=/sysroot/oem
+Type=none
+Options=bind

dracut/53disk-uuid/disk-uuid.service

@@ -10,7 +10,7 @@ After=systemd-udevd.service dev-disk-by\x2dpartlabel-USR\x2dA.device
 
 # Run before services that use device nodes, preventing them from racing
 # with udev activity generated by sgdisk
-Before=ignition-setup.service ignition-disks.service verity-setup.service
+Before=ignition-disks.service verity-setup.service
 
 [Service]
 Type=oneshot

dracut/53ignition/flatcar-metadata-hostname.service

@@ -40,7 +40,7 @@ ConditionKernelCommandLine=|flatcar.oem.id=proxmoxve
 ConditionKernelCommandLine=|flatcar.oem.id=scaleway
 
 OnFailure=emergency.target
-OnFailureJobMode=isolate
+OnFailureJobMode=replace-irreversibly
 
 [Service]
 Type=oneshot

dracut/53ignition/ignition-complete.target

@@ -9,10 +9,10 @@ Documentation=https://github.com/coreos/ignition
 ConditionPathExists=/etc/initrd-release
 Before=initrd.target
 
-# Run the generic rootfs setup helpers
-Requires=initrd-setup-root.service initrd-setup-root-after-ignition.service
-After=initrd-setup-root.service initrd-setup-root-after-ignition.service
-
 # Make sure we stop all the units before switching root
 Conflicts=initrd-switch-root.target umount.target
 Conflicts=dracut-emergency.service emergency.service emergency.target
+
+# Run the generic rootfs setup helpers
+Requires=initrd-setup-root.service initrd-setup-root-after-ignition.service
+After=initrd-setup-root.service initrd-setup-root-after-ignition.service

dracut/53ignition/ignition-disks.service

@@ -5,12 +5,6 @@ ConditionPathExists=/etc/initrd-release
 DefaultDependencies=false
 Before=ignition-complete.target
 
-# Flatcar:
-Requires=local-fs-pre.target
-Before=local-fs-pre.target
-Requires=ignition-setup.service
-After=ignition-setup.service
-
 # Stage order: fetch-offline [-> fetch] [-> kargs] -> disks -> mount -> files.
 After=ignition-fetch.service
 Before=ignition-mount.service
@@ -28,14 +22,23 @@ Before=initrd-root-device.target
 Before=sysroot.mount
 
 OnFailure=emergency.target
-OnFailureJobMode=isolate
+OnFailureJobMode=replace-irreversibly
 
 # This stage requires udevd to detect disk partitioning changes.
 Requires=systemd-udevd.service
 After=systemd-udevd.service
 
+# Flatcar:
+Requires=local-fs-pre.target
+Before=local-fs-pre.target
+Requires=ignition-setup-pre.service
+After=ignition-setup-pre.service
+RequiresMountsFor=/sysusr/usr/
+
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=/run/ignition.env
+# Flatcar: Unmount any disk-based OEM partition in case the Ignition config wants to wipe it.
+ExecStartPre=sh -c 'findmnt -t tmpfs /oem >/dev/null || systemctl stop oem.mount'
 ExecStart=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=disks

dracut/53ignition/ignition-fetch-offline.service

@@ -9,22 +9,22 @@ Documentation=https://github.com/coreos/ignition
 ConditionPathExists=/etc/initrd-release
 DefaultDependencies=false
 Before=ignition-complete.target
-# Flatcar:
-#After=basic.target
-Wants=sockets.target paths.target slices.target
-After=sockets.target paths.target slices.target
-
-# Flatcar:
-Requires=local-fs-pre.target
-Before=local-fs-pre.target
-Requires=ignition-setup.service
-After=ignition-setup.service
+#After=basic.target # Flatcar
 
 # Stage order: fetch-offline [-> fetch] [-> kargs] -> disks -> mount -> files.
 Before=ignition-fetch.service
 
 OnFailure=emergency.target
-OnFailureJobMode=isolate
+OnFailureJobMode=replace-irreversibly
+
+# Flatcar:
+Wants=sockets.target paths.target slices.target
+After=sockets.target paths.target slices.target
+Requires=local-fs-pre.target
+Before=local-fs-pre.target
+Requires=ignition-setup-pre.service
+After=ignition-setup-pre.service
+RequiresMountsFor=/sysusr/usr/ /oem/
 
 [Service]
 Type=oneshot

dracut/53ignition/ignition-fetch.service

@@ -4,8 +4,7 @@ Documentation=https://github.com/coreos/ignition
 ConditionPathExists=/etc/initrd-release
 DefaultDependencies=false
 Before=ignition-complete.target
-# Flatcar:
-#After=basic.target
+#After=basic.target # Flatcar
 ConditionPathExists=/run/ignition/neednet
 # Don't run if the `fetch-offline` stage successfully fetched a config
 ConditionPathExists=!/run/ignition.json
@@ -17,19 +16,19 @@ After=ignition-fetch-offline.service
 Before=ignition-disks.service
 
 OnFailure=emergency.target
-OnFailureJobMode=isolate
+OnFailureJobMode=replace-irreversibly
 
 # If we run, we definitely need network, so make sure we run after.
 After=network.target
+
 # Flatcar:
-Wants=systemd-networkd.service
-After=systemd-networkd.service
-Wants=systemd-resolved.service
-After=systemd-resolved.service
+Wants=systemd-networkd.service systemd-resolved.service
+After=systemd-networkd.service systemd-resolved.service
 Requires=local-fs-pre.target
 Before=local-fs-pre.target
-Requires=ignition-setup.service
-After=ignition-setup.service
+Requires=ignition-setup-pre.service
+After=ignition-setup-pre.service
+RequiresMountsFor=/sysusr/usr/ /oem/
 
 [Service]
 Type=oneshot

dracut/53ignition/ignition-files.service

@@ -5,31 +5,29 @@ ConditionPathExists=/etc/initrd-release
 DefaultDependencies=false
 Before=ignition-complete.target
 
-# Flatcar:
-Requires=initrd-root-fs.target
-After=initrd-root-fs.target
-Requires=ignition-setup.service ignition-disks.service
-After=ignition-setup.service ignition-disks.service
-# setup the root filesystem before we try do things like create users on it.
-Requires=initrd-setup-root.service
-After=initrd-setup-root.service
-# Already mount the OEM partition here so that it works to write files
-# without having to declare it as initrd mount in Ignition
-RequiresMountsFor=/sysroot/usr/ /sysroot/oem/
-
 OnFailure=emergency.target
-OnFailureJobMode=isolate
+OnFailureJobMode=replace-irreversibly
 
 # Stage order: fetch-offline [-> fetch] [-> kargs] -> disks -> mount -> files.
 After=ignition-mount.service
 
 # Run before initrd-parse-etc so that we can drop files it then picks up.
 Before=initrd-parse-etc.service
 
+# Flatcar:
+# setup the root filesystem before we try do things like create users on it.
+Requires=initrd-setup-root.service
+After=initrd-setup-root.service
+# Already mount the OEM partition here so that it works to write files
+# without having to declare it as initrd mount in Ignition
+RequiresMountsFor=/sysroot/usr/
+
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 EnvironmentFile=/run/ignition.env
-# Flatcar: Make sure that the OEM mount point is there even if it shortly was away
+# Flatcar: Start the /sysroot/oem bind mount and its underlying /oem mount.
+# Don't use RequiresMountsFor for this because /oem may get unmounted earlier in
+# the same systemd transaction, preventing this unit from starting.
 ExecStartPre=-systemctl start sysroot-oem.mount
 ExecStart=/usr/bin/ignition --root=/sysroot --platform=${PLATFORM_ID} --stage=files --log-to-stdout

dracut/53ignition/ignition-generator

@@ -82,22 +82,16 @@ else
     add_requires ignition-subsequent.target initrd.target
 fi
 
-# Write ignition-setup.service customized for PXE/ISO or regular boot
-pxe=
-nopxe=
-usr=$(cmdline_arg mount.usr "$(cmdline_arg usr)")
-if [[ -z "${usr}" && -f /usr.squashfs ]]; then
-    # PXE-booted system, with or without persistent root
-    # (see 10diskless-generator)
-    pxe=1
-else
-    nopxe=1
+# Do disk-based steps for non-PXE/ISO boot.
+if is-live-image; then
+    add_requires disk-uuid.service initrd.target
     if $(cmdline_bool flatcar.first_boot 0) || $(cmdline_bool coreos.first_boot 0); then
         add_requires ignition-diskful.target ignition-complete.target
     else
         add_requires ignition-diskful-subsequent.target ignition-subsequent.target
     fi
 fi
+
 cat > ${UNIT_DIR}/ignition-setup-pre.service <<EOF
 [Unit]
 Description=Ignition env setup
@@ -107,46 +101,14 @@ Requires=local-fs-pre.target
 Before=local-fs-pre.target
 
 OnFailure=emergency.target
-OnFailureJobMode=isolate
+OnFailureJobMode=replace-irreversibly
 
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 ExecStart=/usr/sbin/ignition-setup-pre
 EOF
 
-cat > ${UNIT_DIR}/ignition-setup.service <<EOF
-[Unit]
-Description=Ignition (setup)
-DefaultDependencies=false
-
-# Flatcar: Load Ignition binary
-Requires=sysusr-usr.mount ignition-setup-pre.service
-After=sysusr-usr.mount ignition-setup-pre.service
-
-Requires=local-fs-pre.target
-Before=local-fs-pre.target
-
-# pull in OEM device if it should exist
-${nopxe:+Requires=dev-disk-by\x2dlabel-OEM.device
-After=dev-disk-by\x2dlabel-OEM.device}
-
-OnFailure=emergency.target
-OnFailureJobMode=isolate
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-MountFlags=slave
-ExecStart=/usr/sbin/ignition-setup ${nopxe:+normal} ${pxe:+pxe}
-EOF
-
-# Call the disk UUID randomizer whenever we're not PXE booting
-# The unit will check if it needs to act or not.
-if [ "${nopxe}" = 1 ]; then
-    add_requires "disk-uuid.service" initrd.target
-fi
-
 if [[ $(cmdline_arg flatcar.oem.id) == "digitalocean" ]] || [[ $(cmdline_arg coreos.oem.id) == "digitalocean" ]] || [[ $(cmdline_arg flatcar.oem.id) == "proxmoxve" ]]; then
     add_requires flatcar-afterburn-network.service initrd.target
 fi

dracut/53ignition/ignition-kargs-helper

@@ -4,19 +4,14 @@
 
 set -euxo pipefail
 
-# Handle PXE boots gracefully by not mounting any disk and instead error out early
-if [ "${OEM_ID}" = "pxe" ]; then
+# Bail out early when PXE booting. OEM is a tmpfs in this case, so a new
+# grub.cfg would be lost on reboot.
+if [[ ${OEM_ID} == pxe ]]; then
   echo "error: can't set kargs for PXE boots" >&2
   exit 1
 fi
 
-# Mount the OEM partition. Note that we mount but we don't unmount it because we
-# are run in a systemd unit with MountFlags=slave so it is unmounted for us.
-oemmnt=/mnt/oem_partition
-mkdir -p ${oemmnt}
-oemdev=/dev/disk/by-label/OEM
-mount -o rw ${oemdev} ${oemmnt}
-grubcfg="${oemmnt}/grub.cfg"
+grubcfg="/oem/grub.cfg"
 
 # Ensure that it exists before we read from it (needed for the generic Flatcar image), "touch" does not exist in initramfs
 true >> $grubcfg