image: add IMDS support in initrd

This makes built images work in cloud environments for passing
credentials/configuration via IMDS, and keeps initrds consistent between
all output formats.

systemd's IMDS generator enables the imds and networkd units only on a
hwdb-matched cloud, so there is no runtime impact in other environments.
It still grows the disk footprint by a bit, measurements for the
uncompressed boot-demo initrd:

  Fedora: 93.5 MB → 101.4 MB (+8.5%)
  Debian: 103.2 MB → 111.7 MB (+8.2%)
  Arch:   unchanged, its systemd already ships both

Signed-off-by: Martin Pitt <martin@amutable.com>

Author: martinpitt

distribution/arch.bzl

@@ -48,7 +48,7 @@ _ARCH_PACKAGE_SETS = {
     ],
     # `base-devel` is a metapackage, so makepkg's assumed build environment is one name.
     "buildroot": ["base-devel"],
-    # Arch ships udev inside systemd and veritysetup inside cryptsetup.
+    # Arch ships udev, networkd and IMDS support inside systemd, and veritysetup inside cryptsetup.
     "initrd": ["bash", "cryptsetup", "kmod", "systemd"],
 }
 

distribution/debian.bzl

@@ -75,6 +75,7 @@ _DEBIAN_PACKAGE_SETS = {
         "mount",
         "systemd",
         "systemd-cryptsetup",
+        "systemd-imds",
         "udev",
         "util-linux",
     ],

distribution/fedora.bzl

@@ -42,7 +42,17 @@ _FEDORA_PACKAGE_SETS = {
         "util-linux",
     ],
     "buildroot": ["@buildsys-build"],
-    "initrd": ["bash", "kmod", "systemd", "systemd-udev", "veritysetup"],
+    "initrd": [
+        "bash",
+        "kmod",
+        # avoid full libcurl, not necessary for imds
+        "libcurl-minimal",
+        "systemd",
+        "systemd-imds",
+        "systemd-networkd",
+        "systemd-udev",
+        "veritysetup",
+    ],
 }
 
 def _merge_package_sets(

docs/user/images.md

@@ -242,6 +242,11 @@ initrd never reads) apply either way. `compression` picks how the cpio the UKI c
 it from the tree. `install_docs` and `install_langs` default the other way round from an OS image, since
 documentation and translations only cost an initrd boot memory.
 
+Every initrd can import system credentials, such as an SSH key, from a cloud's instance metadata service
+(IMDS). systemd's IMDS generator enables that (together with networkd to reach the service) on a cloud
+instance which it recognizes from the hardware database; `systemd.imds=` on the kernel command line
+overrides it.
+
 The target is an ordinary image: it builds on its own, publishes `[pkgdb]` and `[sbom]`, and one initrd can
 be shared by several disk images.
 

examples/image/BUCK

@@ -262,6 +262,8 @@ tests.vm_smoke(
         "test -s /usr/lib/udev/hwdb.bin",
         # The runner's cmdline_extra reached the kernel the UKI booted.
         "grep -q tine.smoke=1 /proc/cmdline",
+        # The initrd carries networkd for IMDS, which is inert on a non-cloud VM.
+        '[ -z "$(journalctl -b -q _RUNTIME_SCOPE=initrd _SYSTEMD_UNIT=systemd-networkd.service)" ]',
     ],
 )
 

examples/image/expected.json

@@ -36,22 +36,22 @@
   },
   "x86_64": {
     "boot-demo.fedora": {
-      "sha256": "6a7b4796d2216d9bf9d0db587d08e9c8d44fdc1ebc817c2c4ba3f428aa6f3195"
+      "sha256": "e8559e1abcfc7c831acd49abca86c64724e2622ce267cec8eea82a87546d95e5"
     },
     "boot-demo.fedora[boot][initrd]": {
-      "sha256": "d0081aa88c2729fb5363d30eb815e3cdc563eb9c61a5c19e93413ca80a3a0933"
+      "sha256": "90cbd50c4bb7041e8af9031cfbf4bcaab81b7de5d1795200a8a8af739660d212"
     },
     "boot-demo.fedora[boot][kernel]": {
       "sha256": "50896468d533671538dea76a150529455c2712075a927665339ed755065913c6"
     },
     "boot-demo.fedora[boot][uki]": {
-      "sha256": "445a85f5425a11d8af6094491c44854b746c6ee6fb0c029134348c148a2adc28"
+      "sha256": "43df3056444a89663d57b97c96a597b357811b1b384a97ea7a761ac67f7a1173"
     },
     "boot-demo.fedora[disk-manifest]": {
-      "sha256": "ece373a06978f121266654bb894cff92fd038e2f5dc5b4bd2db04edfcb250e29"
+      "sha256": "e959738f81352350e37f16535cafb2aae2759da49ea23c27df0b0c5924e6d7a4"
     },
     "boot-demo.fedora[manifests][esp]": {
-      "sha256": "370ca1974ee8a13d3f0e0fa4bd18df38b936d82ae5c101dc6261dd7f983b07b9"
+      "sha256": "707c4c10d26529a8e5c3577e635bd69522f3747c1cd5bf282c023f0efa285a8c"
     },
     "boot-demo.fedora[manifests][usr]": {
       "sha256": "5ba6f1c6690e971d62b97e17d2131cc28186c4992d1cfa27a1ccca6343590654"

image/compose.bzl

@@ -55,6 +55,7 @@ load(
     "remove",
     "sign_systemd_boot",
     "symlink",
+    "write_file",
 )
 load(":publish.bzl", "PublishedInfo", "published_metadata_subtargets")
 load(
@@ -80,6 +81,14 @@ InitrdInfo = provider(
     },
 )
 
+# As of systemd 262, systemd-imds-early-network.service only writes a .network file, but doesn't start
+# networkd. The IMDS generator pulls the unit in only on a cloud it detects in the hardware database, so
+# networkd runs nowhere else, and `systemd.imds.network=off` opts out. mkosi does that via a preset call.
+_IMDS_NETWORKD = write_file(
+    "/usr/lib/systemd/system/systemd-imds-early-network.service.d/tine-networkd.conf",
+    "[Unit]\nWants=systemd-networkd.service\n",
+)
+
 def _initrd_image_impl(ctx: AnalysisContext) -> list[Provider]:
     tools = ctx.attrs._tools[ImageToolsInfo]
     image = declare_image(
@@ -91,6 +100,7 @@ def _initrd_image_impl(ctx: AnalysisContext) -> list[Provider]:
             [
                 symlink("/usr/lib/systemd/systemd", "/init"),
                 symlink("/etc/os-release", "/etc/initrd-release"),
+                _IMDS_NETWORKD,
             ]
             + ctx.attrs.ops,
             ["initrd"],