sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Network Manager refactor

Browse Source
This commit is contained in:
Audiobuzz
2026-06-17 13:40:28 +00:00
parent 4b0e0135b3
commit 55aa517976
10 changed files with 198 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
diskless.pkr.hcl
+20 -10
View File
@@ -211,22 +211,26 @@ build {
inline = [
"set -euxo pipefail",
# dhcp-client provides dhclient, which the dracut 'network-legacy' module
# (and therefore the 95dot1x-macsec hook's ifup step) requires. RHEL9
# deprecated dhclient in favour of NetworkManager, so the minimal ISO
# omits it; without it network-legacy fails dracut's check() and the
# diskless module 'cannot be installed'. (Strategic path: port the hook to
# the 'network-manager' dracut module — see CLAUDE.md bench-verify notes.)
# No dhcp-client: the initramfs now uses the 'network-manager' dracut
# module (90-diskless.conf), not 'network-legacy'/dhclient. NM renews the
# DHCP lease in the running system after switch-root, fixing the lease-
# expiry outage (legacy's one-shot lease was never renewed -> address
# dropped -> NVMe/TCP root died). NetworkManager is already pulled in by
# @^minimal-environment, so nothing extra is needed for it here.
# zstd: dracut compresses the initramfs with compress="zstd"
# (90-diskless.conf); the minimal ISO lacks the zstd binary, so without it
# dracut warns and silently falls back to gzip (a larger initramfs).
"dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network dhcp-client zstd openssl",
"dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
# Stage etc files into place
"install -D -m0644 /tmp/etc-stage/dot1x/radius-ca.pem /etc/dot1x/radius-ca.pem",
"install -D -m0644 /tmp/etc-stage/dot1x/wpa_supplicant-dot1x.conf /etc/dot1x/wpa_supplicant-dot1x.conf",
"install -D -m0644 /tmp/etc-stage/dracut.conf.d/90-diskless.conf /etc/dracut.conf.d/90-diskless.conf",
"install -D -m0644 /tmp/etc-stage/NetworkManager/99-dot1x-unmanaged.conf /etc/NetworkManager/conf.d/99-dot1x-unmanaged.conf",
# NB: the old static /etc/NetworkManager/conf.d/99-dot1x-unmanaged.conf is
# GONE. It can't be mode-aware (it wrongly unmanaged en* in test mode too,
# blocking renewal). The 95dot1x-macsec cmdline hook nm-unmanaged.sh now
# writes /run/NetworkManager/conf.d/10-dot1x-unmanaged.conf at boot, only in
# secure mode, reserving the physical NIC for wpa_supplicant.
"chmod 0755 /usr/lib/dracut/modules.d/95dot1x-macsec/*.sh",
# Inject the fleet NIC drivers into the dracut config
@@ -253,8 +257,14 @@ build {
# present (a false negative that wrongly failed the build for many runs).
"lsinitrd /boot/initramfs-generic.img > /tmp/lsinitrd.txt",
"grep -E 'macsec|wpa_supplicant|tpm2_nvread|nvme.tcp|erofs|veritysetup' /tmp/lsinitrd.txt",
# Assert the test-mode NVMe-oF connect unit made it in (systemd-driven
# initramfs → the connect is a systemd unit, not a dracut hook).
# Assert NetworkManager is in the initramfs — the network-manager dracut
# module is what renews the DHCP lease post-switch-root. A missing/renamed
# network module would silently regress to no-renewal, so fail loudly.
"grep -q 'NetworkManager' /tmp/lsinitrd.txt || { echo 'ERROR: NetworkManager missing from initramfs (network-manager dracut module not installed)' >&2; exit 1; }",
# Assert the secure-mode NM unmanaged hook + test-mode NVMe-oF connect unit
# made it in (systemd-driven initramfs → the connect is a systemd unit, not
# a dracut hook).
"grep -q 'nm-unmanaged.sh' /tmp/lsinitrd.txt || { echo 'ERROR: nm-unmanaged.sh hook missing from initramfs' >&2; exit 1; }",
"grep -q 'nvmf-connect.service' /tmp/lsinitrd.txt || { echo 'ERROR: nvmf-connect.service missing from initramfs' >&2; exit 1; }",
# ---- Build hygiene ---------------------------------------------------