Audiobuzz
853ae20e68
First trim build confirmed firmware 678 MB -> 147 MB, but the initramfs came out 97 MB and is now kernel-MODULE-bound, not firmware: --no-hostonly + plymouth's drm dep instmods every GPU driver (amdgpu.ko etc.) though the fleet is i915-only. - omit_drivers += amdgpu radeon nouveau (90-diskless.conf): drop the discrete-GPU kmods (amdgpu.ko is the biggest single module in the initramfs); keep i915 + virtio-gpu/bochs for the splash. Shrinks the initramfs/UKI pulled over PXE on every boot. - Firmware keep-list tightened: drop mellanox/ (mlxsw_spectrum SWITCH-ASIC blobs, not NIC fw — mlx5 NIC fw is on-card) and narrow intel/ to just ice (drop ish/sof/ibt sensor-hub/audio/bluetooth, none loaded at boot per the audit). - Add an 'initramfs largest files' diagnostic (sort lsinitrd.txt by size) so the next build shows what dominates the .img. BENCH-VERIFY: kiosk still renders on the 820 (i915 kept); watch the new initramfs largest-files log line for the post-omit size.
38 lines
2.5 KiB
Plaintext
38 lines
2.5 KiB
Plaintext
# Fleet-generic initramfs for diskless 802.1X/MACsec hosts.
|
|
# Root = erofs image on a shared read-only NVMe/TCP namespace,
|
|
# integrity-verified by dm-verity, tmpfs overlay for runtime state.
|
|
# Built with --no-hostonly; assert everything the real hardware needs,
|
|
# because the build VM only has virtio devices.
|
|
hostonly="no"
|
|
# Module NAMES here omit the NN dir-prefix: the directory is 95dot1x-macsec but
|
|
# the module is 'dot1x-macsec' (cf. nvmf). The writable root overlay is provided
|
|
# by systemd.volatile=overlay on the kernel cmdline (RHEL/Rocky dracut has no
|
|
# 'overlayfs'/'rootovl' module — that's a Debian/third-party feature); we only
|
|
# need the overlay kernel filesystem, included via 'filesystems' below.
|
|
# network-manager (NOT network-legacy): NM in the initramfs hands its
|
|
# connections off to the real-root NetworkManager via /run/NetworkManager state,
|
|
# so the DHCP lease is RENEWED in the running system. network-legacy's one-shot
|
|
# lease was never renewed post-switch-root -> the address was dropped at lease
|
|
# expiry -> NVMe/TCP root died ("keep alive timeout" / "no route to host").
|
|
add_dracutmodules+=" dot1x-macsec network-manager nvmf systemd-veritysetup "
|
|
# plymouth: graphical boot splash, shown from early initramfs through the long
|
|
# network-auth + NVMe/TCP + verity phase until the kiosk/login takes over. The
|
|
# plymouth dracut module depends on 'drm', which in --no-hostonly mode pulls a
|
|
# broad set of DRM/KMS drivers (incl. the VM's bochs/virtio-gpu); if a specific
|
|
# fleet GPU's splash doesn't render, add its drm kmod to add_drivers like the
|
|
# NICs. Whether the splash actually displays is gated by the cmdline (rhgb quiet
|
|
# vs plymouth.enable=0), set from the boot_splash var in extract-artifacts.sh.
|
|
add_dracutmodules+=" plymouth "
|
|
filesystems+=" erofs overlay "
|
|
add_drivers+=" macsec nvme-tcp nvme-fabrics dm-verity @NIC_DRIVERS@ "
|
|
# Omit the discrete-GPU DRM drivers plymouth's `drm` dep would otherwise instmod
|
|
# in --no-hostonly mode. This fleet is Intel i915 ONLY (the build VM uses
|
|
# virtio-gpu/bochs), so amdgpu/radeon/nouveau are dead weight — amdgpu.ko alone is
|
|
# the single biggest module in the initramfs. i915 + virtio-gpu/bochs stay for the
|
|
# splash. (Their FIRMWARE is already stripped pre-dracut in diskless.pkr.hcl; this
|
|
# drops the MODULES too.) If a future host has a non-Intel GPU, remove it here.
|
|
# See docs/TODO #18.
|
|
omit_drivers+=" amdgpu radeon nouveau "
|
|
install_items+=" /etc/dot1x/radius-ca.pem /etc/dot1x/wpa_supplicant-dot1x.conf "
|
|
compress="zstd"
|