Network Manager refactor

files/dracut/95dot1x-macsec/dot1x-macsec-up.sh

@@ -107,8 +107,26 @@ info "dot1x-macsec: port authorized, macsec0 up after ${i}s"
 
 # --- 4. address the secure interface; netroot rides on macsec0 --------------
 ip link set macsec0 up
-# Hand macsec0 to dracut's network stack for DHCP + netroot resolution
-ifup macsec0
+# DHCP on macsec0 via NetworkManager (NOT the old network-legacy `ifup`): NM owns
+# macsec0, so it RENEWS the lease in the running system after switch-root — the
+# whole point of the network-manager port. macsec0 was created externally by
+# wpa_supplicant; ask NM to manage+activate it with a default DHCP profile. The
+# physical NIC stays unmanaged (nm-unmanaged.sh cmdline drop-in), so
+# wpa_supplicant keeps EAPOL/MKA on it. -w 0 returns immediately; we poll below.
+nmcli device set macsec0 managed yes 2>/dev/null || true
+nmcli -w 0 device connect macsec0 2>/dev/null || true
+
+# Wait for the DHCP lease (IPv4 on macsec0) before netroot/NVMe connect.
+i=0
+while [ "$i" -lt "$TIMEOUT" ]; do
+    ip -4 addr show macsec0 2>/dev/null | grep -q 'inet ' && break
+    sleep 1; i=$((i + 1))
+done
+if [ "$i" -ge "$TIMEOUT" ]; then
+    warn "dot1x-macsec: no DHCP lease on macsec0 after ${TIMEOUT}s"
+    exit 1
+fi
+info "dot1x-macsec: macsec0 addressed via NetworkManager (DHCP)"
 
 # --- 5. derive per-host NVMe identity from the TPM certificate --------------
 # Keeps the image fleet-generic: the host NQN is a function of the machine