Ignition Kernel Argument Support

Overview

Ignition is planning to add kernel argument support (coreos/ignition#1168), the base CoreOS distribution implementation design discussion (coreos/fedora-coreos-tracker#752) will handle the general case however there are likely additional integration points with RHCOS & the MCO that would likely make sense.

FIPS

RHCOS Side

Ignition expects that the system is being rebooted once kernel arguments have been applied. This stage will likely run in between the fetch & disks Ignition stages and has some similarities with the FIPS script. At minimum we'll need to coordinate the two so that there is a maximum of one reboot in the initrd (if any of FIPS or Ignition kernel arguments are set).

It is probably worth looking into if there's an easy way to remove the current FIPS code and perform the same action via a generated Ignition config. If so then we could tie that in with the approach detailed in the MCS section.

MCS Side

When the fips flag is set inside of a MachineConfig the MCS could be updated to serve a modified Ignition config containing the desired kernel arguments, files, systemd units, etc. when the requesting caller is using a relevant version of Ignition (e.x. only for Ignition 3.3.0 callers). This would allow us to drop the encapsulated machine config on newer bootimages and just read the Ignition config.

Start by reading the RHCOS FIPS script at overlay.d/05rhcos/usr/lib/dracut/modules.d/40rhcos-fips/rhcos-fips.sh, then review the Ignition fetch and disks stages and the MachineConfig Server (MCS) path. The work is complete when the RHCOS and MCO integration supports Ignition kernel arguments, coordinates FIPS and argument reboots, and handles relevant Ignition versions.