Enable ACL Template kola parity: variant-aware enforcement, ESP sizing, LUKS initramfs modules

[Lance Liu (liulanze)]

Summary

Three changes that let the ACL-T (ACL Template) build path share the existing kola test infrastructure with stock ACL. The first is test-infra only; the last two change the built image for both stock ACL and ACL-T (called out below).

1. acl/tests/kola_enforcing.yaml — add an optional imageVariants field to the enforcement schema and register the acl-t exceptions. Stock ACL matching is unchanged: a missing imageVariants matches any variant, and callers that don't pass a variant default to acl. The exceptions collapse to a small set of canonical reasons, all rooted in two deliberate acl-t design decisions:

   • No docker / no sysexts — the containerd and oem-azure sysexts are replaced by first-class RPMs (moby-containerd ships containerd/ctr only), so docker.*, sysext.*, bpf.*, etcd-member, flannel, and kubeadm tests have no viable target. Replacement containerd-native (ctr) tests are tracked as follow-up mantle work.
   • chrony is the time stack — the chrony RPM %post disables systemd-timesyncd, so linux.ntp (hardcodes timesyncd) and acl.internet/NTPDate (needs the ntpdate binary) are non-viable. Daemon liveness is covered by acl.basic/ServicesActive; a chrony-native sync test is tracked as a follow-up.

   linux.nfs.v3/v4 are intentionally not exempted — they are fixable on acl-t and stay enforced.

2. build_library/disk_layout_uki.json — grow EFI-SYSTEM from 128 MiB to 192 MiB (262144 → 393216 × 512-byte blocks). Not a steady-state size issue; the pressure is transient: Image Customizer's UKI re-customization extracts .linux (~14.5 MiB) and .initrd (~34 MiB) from the existing UKI on /boot while the original UKI (~50 MiB) is still in place, pushing peak ESP usage past 128 MiB — arm64 Run 2 failed with 0% free on /boot. At 192 MiB the final ACL-T image uses ~101 MiB, leaving ~89 MiB free. Applies to stock ACL images as well (shared layout); the sizing rationale is documented in a partition-level _comment.

3. build_library/rpm/additional_files/99-acl.conf — force dm_crypt and its cipher modules into the initramfs. Ignition formats LUKS volumes in the initramfs (cl.ignition.luks), and the arm64 kernel ships CONFIG_DM_CRYPT=m; the crypt dracut module (already in add_dracutmodules) brings the cryptsetup userspace but does not reliably pull the kernel module in, so the deps are listed explicitly. Also hardens stock ACL arm64.

Companion PRs: mantle #29 (test fixes this enforcement set relies on) and the acl-pipelines change that consumes imageVariants via evaluate_test_results.sh --image-variant and builds the acl-t artifact.

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

The disk layout change re-partitions the boot disk and the dracut change grows the initramfs slightly — both apply to stock ACL and ACL-T. kola_enforcing.yaml is test-infra only.

Test Methodology

• Validated on the acldevel testing pipeline across the full permutation matrix: {amd64, arm64} × UKI × {kola, smoke} × {azure, qemu}.
• cl.ignition.luks passes on both architectures with the initramfs module change; before the ESP change, arm64 IC Run 2 failed with 0% free on /boot.
• Stock-ACL regression signal: the same pipeline run on this branch produces the same enforced-test pass set as aclmain (missing imageVariants matches any variant, so stock enforcement is unchanged).
• linux.nfs.v3/v4 are expected red on acl-t kola-qemu until the pipeline-side NFS fix lands (tracked in the acl-pipelines PR); they are enforced deliberately rather than exempted.

Merge Checklist

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Copilot]

Pull request overview

This PR updates ACL/ACL-T build and test configuration to improve kola enforcement parity between stock ACL and the ACL Template variant, while also addressing UKI first-boot robustness and increasing ESP capacity for UKI assets.

Changes:

• Extend kola_enforcing.yaml with imageVariants-scoped exceptions to support ACL-T parity with existing enforced kola infrastructure.
• Adjust ignition-quench behavior (via bootengine patch) to tolerate missing first-boot inputs and remove the UKI firstboot addon when present.
• Increase the UKI disk layout ESP size to accommodate signed UKI + firstboot addon content.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
es-metadata.yml	Adds Inventory-as-Code metadata for routing/ownership.
build_library/disk_layout_uki.json	Enlarges the EFI-SYSTEM partition for UKI images.
acl/tests/kola_enforcing.yaml	Adds imageVariants field usage and ACL-T-specific enforcement exceptions.
acl/SPECS/bootengine/0002-delete-UKI-firstboot-addon-after-Ignition.patch	Makes ignition-quench tolerant of missing markers and removes UKI firstboot addon.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

acl/tests/kola_enforcing.yaml:36

• acl.basic/ServicesActive is now listed alongside the broader acl.basic prefix. Since the file describes prefix-based matching but doesn’t define what happens when multiple prefixes match the same test, it’s unclear (from this file alone) how this exception interacts with the broader acl.basic rule. Please document the precedence/merge behavior (e.g., most-specific match wins, or any matching exception wins) to avoid accidental enforcement changes.

tests:
  - name: acl.basic
  - name: acl.basic/ServicesActive
    exceptions:
      - imageVariants: [acl-t]
        reason: |

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

acl/tests/kola_enforcing.yaml:24

• The header comments refer to evaluate_test_results.sh, but that script name/path doesn’t exist anywhere in this repository. This makes the file harder to understand/maintain for contributors who only have this repo; consider rewording to a repo-local reference (e.g., “kola test-results evaluation step/script”) or linking to the actual location if it lives elsewhere.

# imageVariants notes:
#   - Callers that don't pass an --image-variant to evaluate_test_results.sh
#     get "acl" as the default (matches the stock acl build). acl-t stages
#     pass "acl-t" so the acl-t-only exceptions below apply.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.