mirror of
https://github.com/coreos/fedora-coreos-config.git
synced 2026-11-03 22:59:47 -09:00
7bed92f728
- coreos-installer now embeds network config in the initramfs
instead of writing to /boot/coreos-firstboot-network. When a
system is provisioned with an older coreos-installer but boots
a newer image, the network config is stranded in /boot and
never applied — breaking network-dependent boot paths like iSCSI.
- Add a three-layer backward compatibility mechanism:
1. Initramfs rescue service (coreos-rescue-misplaced-network):
if no config exists in /etc/coreos-firstboot-network, mount
/boot and copy any legacy config found there so that the
existing coreos-copy-firstboot-network.service can apply it.
This is the active fix — it recovers the stranded config and
allows boot to succeed.
2. Dracut emergency hook (coreos-warn-misplaced-network.sh):
on iSCSI systems, /boot lives on a network device — but the
network config needed to reach it is stranded inside /boot
itself, so the rescue service cannot help. When this
chicken-and-egg problem causes the system to drop to an
emergency shell, this hook explains the situation and advises
re-installing with a newer coreos-installer.
3. Real-root warning service (coreos-warn-misplaced-network):
runs after boot has already succeeded (thanks to the rescue
service above). It does not fix anything — it warns
that legacy config was found in /boot, prompting
the user to re-install with a newer coreos-installer so
future boots do not depend on the rescue path. If /boot is
not mounted at all, it warns that this may itself be a
symptom of missing network config.
- We may drop it in the feature, since there is a
cost of keeping checking it
- See https://github.com/coreos/coreos-installer/issues/1758
Signed-off-by: Renata Ravanelli <rravanel@redhat.com>
40 lines
1.6 KiB
YAML
40 lines
1.6 KiB
YAML
# Shared with EL 10 (CentOS Stream 10 and RHCOS 10) only
|
|
|
|
# Backward compatibility: rescue/warn firstboot network config
|
|
# coreos-installer placed in /boot. This will drop out in EL11+.
|
|
conditional-include:
|
|
- if: id != "fedora"
|
|
include:
|
|
ostree-layers:
|
|
- fedora-coreos-config/overlay.d/11legacy-copy-network
|
|
|
|
packages:
|
|
# GPU Firmware files (not broken out into subpackage of linux-firmware in RHEL yet)
|
|
- amd-gpu-firmware intel-gpu-firmware nvidia-gpu-firmware
|
|
|
|
# Recent changes in the SELinux policy have broken a lot of our code.
|
|
# Revert the affected domains back to permissive mode so we can
|
|
# continue to build and test `releasever >= 41` until
|
|
# https://github.com/fedora-selinux/selinux-policy/pull/2257 merges
|
|
# and the domains are reverted upstream or until the issue is resolved
|
|
# altogether
|
|
postprocess:
|
|
- |
|
|
#!/usr/bin/bash
|
|
set -eux -o pipefail
|
|
cat > /tmp/fcos-workarounds.cil << EOF
|
|
; https://bugzilla.redhat.com/show_bug.cgi?id=2300306
|
|
(typeattributeset cil_gen_require bootupd_t)
|
|
(typepermissive bootupd_t)
|
|
; https://bugzilla.redhat.com/show_bug.cgi?id=2305385
|
|
(typeattributeset cil_gen_require coreos_installer_t)
|
|
(typepermissive coreos_installer_t)
|
|
; https://bugzilla.redhat.com/show_bug.cgi?id=2306352
|
|
(typeattributeset cil_gen_require afterburn_t)
|
|
(typepermissive afterburn_t)
|
|
EOF
|
|
/usr/sbin/semodule -i /tmp/fcos-workarounds.cil
|
|
rm /tmp/fcos-workarounds.cil
|
|
# Also remove created LOCK files as we don't want those
|
|
# to end up in /usr/etc
|
|
rm -f /etc/selinux/targeted/semanage.*.LOCK
|