From 0dcb3b065a429bf278e2bbcdf00c4b314a741b5b Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Tue, 30 Jun 2026 21:52:03 +0100
Subject: [PATCH 1/8] ignition: Assume /sysusr/usr is present in the second
 stage initrd

We mount it in the minimal initrd and it never gets unmounted, so it's
simpler to assume it's there.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/50flatcar-network/afterburn-network-kargs.service | 4 ----
 dracut/53ignition/flatcar-afterburn-network.service      | 3 ---
 dracut/53ignition/flatcar-metadata-hostname.service      | 3 ---
 dracut/53ignition/flatcar-openstack-hostname.service     | 3 ---
 dracut/53ignition/flatcar-static-network.service         | 3 ---
 dracut/53ignition/ignition-disks.service                 | 1 -
 dracut/53ignition/ignition-fetch-offline.service         | 2 +-
 dracut/53ignition/ignition-fetch.service                 | 2 +-
 dracut/53ignition/ignition-kargs.service                 | 2 +-
 dracut/53ignition/ignition-mount.service                 | 1 -
 dracut/53ignition/module-setup.sh                        | 4 ----
 dracut/53ignition/sysusr-usr-revdeps.conf                | 3 ---
 12 files changed, 3 insertions(+), 28 deletions(-)
 delete mode 100644 dracut/53ignition/sysusr-usr-revdeps.conf

diff --git a/dracut/50flatcar-network/afterburn-network-kargs.service b/dracut/50flatcar-network/afterburn-network-kargs.service
index a382e59..9bece87 100644
--- a/dracut/50flatcar-network/afterburn-network-kargs.service
+++ b/dracut/50flatcar-network/afterburn-network-kargs.service
@@ -13,10 +13,6 @@ ConditionKernelCommandLine=|flatcar.oem.id=vmware
 OnFailure=emergency.target
 OnFailureJobMode=replace-irreversibly
 
-# Flatcar: Load coreos-metadata binary
-Requires=sysusr-usr.mount
-After=sysusr-usr.mount
-
 [Service]
 ExecStart=/usr/bin/coreos-metadata exp rd-network-kargs --cmdline --default-value ''
 Type=oneshot
diff --git a/dracut/53ignition/flatcar-afterburn-network.service b/dracut/53ignition/flatcar-afterburn-network.service
index 76aa3df..9cdd8f3 100644
--- a/dracut/53ignition/flatcar-afterburn-network.service
+++ b/dracut/53ignition/flatcar-afterburn-network.service
@@ -4,9 +4,6 @@ DefaultDependencies=false
 Before=initrd.target
 After=systemd-networkd.service initrd-root-fs.target
 Wants=systemd-networkd.service initrd-root-fs.target
-# Flatcar: Load coreos-metadata binary
-Requires=sysusr-usr.mount
-After=sysusr-usr.mount
 
 [Service]
 Type=oneshot
diff --git a/dracut/53ignition/flatcar-metadata-hostname.service b/dracut/53ignition/flatcar-metadata-hostname.service
index 48e9910..68e7c50 100644
--- a/dracut/53ignition/flatcar-metadata-hostname.service
+++ b/dracut/53ignition/flatcar-metadata-hostname.service
@@ -4,9 +4,6 @@ DefaultDependencies=false
 Before=initrd.target
 After=systemd-networkd.service initrd-root-fs.target
 Wants=systemd-networkd.service initrd-root-fs.target
-# Flatcar: Load coreos-metadata binary
-Requires=sysusr-usr.mount
-After=sysusr-usr.mount
 
 # Ensure Ignition can overwrite /etc/hostname
 Before=ignition-files.service
diff --git a/dracut/53ignition/flatcar-openstack-hostname.service b/dracut/53ignition/flatcar-openstack-hostname.service
index 8920100..c464693 100644
--- a/dracut/53ignition/flatcar-openstack-hostname.service
+++ b/dracut/53ignition/flatcar-openstack-hostname.service
@@ -4,9 +4,6 @@ DefaultDependencies=false
 Before=initrd.target
 After=systemd-networkd.service initrd-root-fs.target
 Wants=systemd-networkd.service initrd-root-fs.target
-# Flatcar: Load coreos-metadata binary
-Requires=sysusr-usr.mount
-After=sysusr-usr.mount
 
 # Ensure Ignition can overwrite /etc/hostname
 Before=ignition-files.service
diff --git a/dracut/53ignition/flatcar-static-network.service b/dracut/53ignition/flatcar-static-network.service
index 950ee07..0d45866 100644
--- a/dracut/53ignition/flatcar-static-network.service
+++ b/dracut/53ignition/flatcar-static-network.service
@@ -4,9 +4,6 @@ DefaultDependencies=false
 Before=initrd.target
 After=systemd-networkd.service initrd-root-fs.target
 Wants=systemd-networkd.service initrd-root-fs.target
-# Flatcar: Load coreos-metadata binary
-Requires=sysusr-usr.mount
-After=sysusr-usr.mount
 
 # Ensure Ignition can overwrite /etc/hostname
 Before=ignition-files.service
diff --git a/dracut/53ignition/ignition-disks.service b/dracut/53ignition/ignition-disks.service
index d3cea85..548ed21 100644
--- a/dracut/53ignition/ignition-disks.service
+++ b/dracut/53ignition/ignition-disks.service
@@ -33,7 +33,6 @@ Requires=local-fs-pre.target
 Before=local-fs-pre.target
 Requires=ignition-setup-pre.service
 After=ignition-setup-pre.service
-RequiresMountsFor=/sysusr/usr/
 
 [Service]
 Type=oneshot
diff --git a/dracut/53ignition/ignition-fetch-offline.service b/dracut/53ignition/ignition-fetch-offline.service
index 0c5beea..6d07bb8 100644
--- a/dracut/53ignition/ignition-fetch-offline.service
+++ b/dracut/53ignition/ignition-fetch-offline.service
@@ -24,7 +24,7 @@ Requires=local-fs-pre.target
 Before=local-fs-pre.target
 Requires=ignition-setup-pre.service
 After=ignition-setup-pre.service
-RequiresMountsFor=/sysusr/usr/ /oem/
+RequiresMountsFor=/oem/
 
 [Service]
 Type=oneshot
diff --git a/dracut/53ignition/ignition-fetch.service b/dracut/53ignition/ignition-fetch.service
index 72b8349..4ba2e8c 100644
--- a/dracut/53ignition/ignition-fetch.service
+++ b/dracut/53ignition/ignition-fetch.service
@@ -28,7 +28,7 @@ Requires=local-fs-pre.target
 Before=local-fs-pre.target
 Requires=ignition-setup-pre.service
 After=ignition-setup-pre.service
-RequiresMountsFor=/sysusr/usr/ /oem/
+RequiresMountsFor=/oem/
 
 [Service]
 Type=oneshot
diff --git a/dracut/53ignition/ignition-kargs.service b/dracut/53ignition/ignition-kargs.service
index ebedeb9..8cdf87c 100644
--- a/dracut/53ignition/ignition-kargs.service
+++ b/dracut/53ignition/ignition-kargs.service
@@ -17,7 +17,7 @@ Requires=local-fs-pre.target
 Before=local-fs-pre.target
 Requires=ignition-setup-pre.service
 After=ignition-setup-pre.service
-RequiresMountsFor=/sysusr/usr/ /oem/
+RequiresMountsFor=/oem/
 
 [Service]
 Type=oneshot
diff --git a/dracut/53ignition/ignition-mount.service b/dracut/53ignition/ignition-mount.service
index 86a3410..880e69d 100644
--- a/dracut/53ignition/ignition-mount.service
+++ b/dracut/53ignition/ignition-mount.service
@@ -36,7 +36,6 @@ Requires=initrd-setup-root.service
 After=initrd-setup-root.service
 Requires=ignition-setup-pre.service
 After=ignition-setup-pre.service
-RequiresMountsFor=/sysusr/usr/
 
 [Service]
 Type=oneshot
diff --git a/dracut/53ignition/module-setup.sh b/dracut/53ignition/module-setup.sh
index 10dab7f..425e7b9 100755
--- a/dracut/53ignition/module-setup.sh
+++ b/dracut/53ignition/module-setup.sh
@@ -162,10 +162,6 @@ EOF
         rm "${wrapper}"
     done
 
-    # Ensure /sysusr/usr is mounted before decrypting root.
-    inst_simple "$moddir/sysusr-usr-revdeps.conf" \
-        "$systemdsystemunitdir/systemd-cryptsetup@rootencrypted.service.d/sysusr-usr.conf"
-
     # Ignition reads user.ign and base.d/* in /usr/lib/ignition by default, but
     # our initrd is not writeable. Create symlinks pointing to /oem in advance.
     mkdir -m0755 -p "${initdir}"/usr/lib/ignition
diff --git a/dracut/53ignition/sysusr-usr-revdeps.conf b/dracut/53ignition/sysusr-usr-revdeps.conf
deleted file mode 100644
index 28d7fca..0000000
--- a/dracut/53ignition/sysusr-usr-revdeps.conf
+++ /dev/null
@@ -1,3 +0,0 @@
-[Unit]
-Requires=sysusr-usr.mount
-After=sysusr-usr.mount

From 8dbd0a9311fb863761e3bfa1424a0169052c3753 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Tue, 18 Aug 2026 10:37:25 +0100
Subject: [PATCH 2/8] ignition: flatcar-static-network.service is no longer
 used

It was only used by Equinix Metal (Packet), which has now gone.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/53ignition/flatcar-static-network.service | 13 -------------
 dracut/53ignition/module-setup.sh                |  4 +---
 2 files changed, 1 insertion(+), 16 deletions(-)
 delete mode 100644 dracut/53ignition/flatcar-static-network.service

diff --git a/dracut/53ignition/flatcar-static-network.service b/dracut/53ignition/flatcar-static-network.service
deleted file mode 100644
index 0d45866..0000000
--- a/dracut/53ignition/flatcar-static-network.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Flatcar Static Network Agent
-DefaultDependencies=false
-Before=initrd.target
-After=systemd-networkd.service initrd-root-fs.target
-Wants=systemd-networkd.service initrd-root-fs.target
-
-# Ensure Ignition can overwrite /etc/hostname
-Before=ignition-files.service
-
-[Service]
-Type=oneshot
-ExecStart=/usr/bin/coreos-metadata --cmdline --network-units=/sysroot/etc/systemd/network/
diff --git a/dracut/53ignition/module-setup.sh b/dracut/53ignition/module-setup.sh
index 425e7b9..ec0bc86 100755
--- a/dracut/53ignition/module-setup.sh
+++ b/dracut/53ignition/module-setup.sh
@@ -98,7 +98,7 @@ install() {
     done
 
     # Flatcar: add ignition-quench.service, boot.mount,
-    # flatcar-afterburn-network.service, flatcar-static-network.service,
+    # flatcar-afterburn-network.service,
     # flatcar-metadata-hostname.service, flatcar-openstack-hostname.service
     inst_simple "$moddir/ignition-quench.service" \
         "$systemdsystemunitdir/ignition-quench.service"
@@ -106,8 +106,6 @@ install() {
         "$systemdsystemunitdir/boot.mount"
     inst_simple "$moddir/flatcar-afterburn-network.service" \
         "$systemdsystemunitdir/flatcar-afterburn-network.service"
-    inst_simple "$moddir/flatcar-static-network.service" \
-        "$systemdsystemunitdir/flatcar-static-network.service"
     inst_simple "$moddir/flatcar-metadata-hostname.service" \
         "$systemdsystemunitdir/flatcar-metadata-hostname.service"
     inst_simple "$moddir/flatcar-openstack-hostname.service" \

From 7583328019c3917620e43a1f3ae422babeb1a6e0 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Fri, 3 Jul 2026 12:22:01 +0100
Subject: [PATCH 3/8] flatcar-network: Deduplicate .network files in common
 with coreos-init

The bootengine copies had gone out of sync, and we can just install
coreos-init's copies. We need to adjust KeepConfiguration for the initrd
environment though.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/50flatcar-network/module-setup.sh      | 20 +++++++++----------
 .../yy-azure-sriov-coreos.network             | 15 --------------
 .../50flatcar-network/yy-azure-sriov.network  | 15 --------------
 dracut/50flatcar-network/yy-pxe.network       | 12 -----------
 dracut/50flatcar-network/zz-default.network   | 14 -------------
 5 files changed, 10 insertions(+), 66 deletions(-)
 delete mode 100644 dracut/50flatcar-network/yy-azure-sriov-coreos.network
 delete mode 100644 dracut/50flatcar-network/yy-azure-sriov.network
 delete mode 100644 dracut/50flatcar-network/yy-pxe.network
 delete mode 100644 dracut/50flatcar-network/zz-default.network

diff --git a/dracut/50flatcar-network/module-setup.sh b/dracut/50flatcar-network/module-setup.sh
index 5125e4c..2b49fd0 100755
--- a/dracut/50flatcar-network/module-setup.sh
+++ b/dracut/50flatcar-network/module-setup.sh
@@ -16,7 +16,16 @@ install() {
         /etc/systemd/resolved.conf
 
     inst_multiple \
-        "$systemdnetwork"/{20-calico-tunl0,50-veth,98-{gce-coreos-virtio,gce-virtio,virtio}}.link
+        "$systemdnetwork"/{20-calico-tunl0,50-veth,98-{gce-coreos-virtio,gce-virtio,virtio}}.link \
+        "$systemdnetwork"/yy-{azure-sriov{,-coreos},pxe}.network \
+        "$systemdnetwork"/zz-default.network
+
+    # Don't keep the configuration, otherwise the IP address is not released.
+    # This can cause problems when a different DHCP client configuration is set
+    # on first boot. The DHCP server would not recognize the rootfs system and
+    # would therefore keep two addresses allocated.
+    sed -i -r 's:^(KeepConfiguration)=.*:\1=no:' \
+        "$initdir/$systemdnetwork"/{yy-pxe,zz-default}.network
 
     inst_simple "$moddir/network-cleanup.service" \
         "$systemdsystemunitdir/network-cleanup.service"
@@ -30,21 +39,12 @@ install() {
     inst_simple "$moddir/10-nodeps.conf" \
         "$systemdsystemunitdir/systemd-resolved.service.d/10-nodeps.conf"
 
-    inst_simple "$moddir/yy-azure-sriov.network" \
-        "$systemdnetwork/yy-azure-sriov.network"
-
     inst_simple "$moddir/yy-digitalocean.network" \
         "$systemdnetwork/yy-digitalocean.network"
 
     inst_simple "$moddir/yy-netroot.network" \
         "$systemdnetwork/yy-netroot.network"
 
-    inst_simple "$moddir/yy-pxe.network" \
-        "$systemdnetwork/yy-pxe.network"
-
-    inst_simple "$moddir/zz-default.network" \
-        "$systemdnetwork/zz-default.network"
-
     # add a hook to generate networkd configuration from ip= arguments
     inst_hook cmdline 99 "$moddir/parse-ip-for-networkd.sh"
 
diff --git a/dracut/50flatcar-network/yy-azure-sriov-coreos.network b/dracut/50flatcar-network/yy-azure-sriov-coreos.network
deleted file mode 100644
index 688954d..0000000
--- a/dracut/50flatcar-network/yy-azure-sriov-coreos.network
+++ /dev/null
@@ -1,15 +0,0 @@
-# Ignore SR-IOV interface on Azure, since it'll be transparently bonded
-# to the synthetic interface
-
-[Match]
-KernelCommandLine=coreos.oem.id=azure
-# With NetworkManager, Azure uses a udev rule matching DRIVERS=="hv_pci".
-# This won't work with networkd because it only checks the driver of the
-# device itself, not its parents. All we can do instead is blacklist the
-# VF driver currently used in Azure. If other drivers come into use, the
-# symptom will be a VF interface in the output of "networkctl" which never
-# finishes configuring.
-Driver=mlx4_en mlx5_core mana
-
-[Link]
-Unmanaged=yes
diff --git a/dracut/50flatcar-network/yy-azure-sriov.network b/dracut/50flatcar-network/yy-azure-sriov.network
deleted file mode 100644
index 5189ae2..0000000
--- a/dracut/50flatcar-network/yy-azure-sriov.network
+++ /dev/null
@@ -1,15 +0,0 @@
-# Ignore SR-IOV interface on Azure, since it'll be transparently bonded
-# to the synthetic interface
-
-[Match]
-KernelCommandLine=flatcar.oem.id=azure
-# With NetworkManager, Azure uses a udev rule matching DRIVERS=="hv_pci".
-# This won't work with networkd because it only checks the driver of the
-# device itself, not its parents. All we can do instead is blacklist the
-# VF driver currently used in Azure. If other drivers come into use, the
-# symptom will be a VF interface in the output of "networkctl" which never
-# finishes configuring.
-Driver=mlx4_en mlx5_core mana
-
-[Link]
-Unmanaged=yes
diff --git a/dracut/50flatcar-network/yy-pxe.network b/dracut/50flatcar-network/yy-pxe.network
deleted file mode 100644
index aa61e61..0000000
--- a/dracut/50flatcar-network/yy-pxe.network
+++ /dev/null
@@ -1,12 +0,0 @@
-[Match]
-Name=*
-KernelCommandLine=!root
-
-[Network]
-DHCP=yes
-IPv6AcceptRA=true
-
-[DHCP]
-ClientIdentifier=mac
-UseMTU=true
-UseDomains=true
diff --git a/dracut/50flatcar-network/zz-default.network b/dracut/50flatcar-network/zz-default.network
deleted file mode 100644
index f51045b..0000000
--- a/dracut/50flatcar-network/zz-default.network
+++ /dev/null
@@ -1,14 +0,0 @@
-[Match]
-Name=*
-Type=!loopback
-
-[Network]
-DHCP=yes
-IPv6AcceptRA=true
-
-[DHCP]
-UseMTU=true
-UseDomains=true
-
-[DHCPv4]
-RoutesToDNS=false

From ec401853cd6300327533380cad5f1f4dd3316f54 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Fri, 3 Jul 2026 12:25:46 +0100
Subject: [PATCH 4/8] flatcar-network: Install yy-digitalocean-coreos.network

This was accidentally omitted.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/50flatcar-network/module-setup.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dracut/50flatcar-network/module-setup.sh b/dracut/50flatcar-network/module-setup.sh
index 2b49fd0..f9f1015 100755
--- a/dracut/50flatcar-network/module-setup.sh
+++ b/dracut/50flatcar-network/module-setup.sh
@@ -42,6 +42,9 @@ install() {
     inst_simple "$moddir/yy-digitalocean.network" \
         "$systemdnetwork/yy-digitalocean.network"
 
+    inst_simple "$moddir/yy-digitalocean-coreos.network" \
+        "$systemdnetwork/yy-digitalocean-coreos.network"
+
     inst_simple "$moddir/yy-netroot.network" \
         "$systemdnetwork/yy-netroot.network"
 

From 7941594eee7860ed2f9036210b3501d8cebaa589 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Fri, 3 Jul 2026 12:26:33 +0100
Subject: [PATCH 5/8] flatcar-network: Don't install Calico and veth .link
 files

I added these when Dracut stopped simply installing all of them, but on
reflection, Calico and veth are irrelevant in the initrd.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/50flatcar-network/module-setup.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dracut/50flatcar-network/module-setup.sh b/dracut/50flatcar-network/module-setup.sh
index f9f1015..02250e4 100755
--- a/dracut/50flatcar-network/module-setup.sh
+++ b/dracut/50flatcar-network/module-setup.sh
@@ -16,7 +16,7 @@ install() {
         /etc/systemd/resolved.conf
 
     inst_multiple \
-        "$systemdnetwork"/{20-calico-tunl0,50-veth,98-{gce-coreos-virtio,gce-virtio,virtio}}.link \
+        "$systemdnetwork"/98-{gce-coreos-virtio,gce-virtio,virtio}.link \
         "$systemdnetwork"/yy-{azure-sriov{,-coreos},pxe}.network \
         "$systemdnetwork"/zz-default.network
 

From 2dc224ffcb180b0ffc21cc5c3ff08e304aa89581 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Fri, 3 Jul 2026 12:32:16 +0100
Subject: [PATCH 6/8] flatcar-network: Ensure yy-netroot.network does not match
 virtual or lo

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/50flatcar-network/yy-netroot.network | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dracut/50flatcar-network/yy-netroot.network b/dracut/50flatcar-network/yy-netroot.network
index 250e3fd..7279c3a 100644
--- a/dracut/50flatcar-network/yy-netroot.network
+++ b/dracut/50flatcar-network/yy-netroot.network
@@ -1,4 +1,7 @@
 [Match]
+# Only virtual NICs have a Kind, and we want to exclude those.
+Kind=!?*
+Type=!loopback
 KernelCommandLine=netroot
 
 [Network]

From a7d36aa5dd6886b73b98515366c02ef4fd5a6dc9 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Fri, 3 Jul 2026 14:19:03 +0100
Subject: [PATCH 7/8] flatcar-network: Use upstream network and resolved Dracut
 modules

Our IP parser has some shortcomings and systemd-network-generator can
simply do this for us. Afterburn is being modified to emit an
environment file with SYSTEMD_PROC_CMDLINE because the generator won't
read the existing /etc/cmdline.d file that was consumed by Dracut.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/50flatcar-network/10-nodeps.conf       |   2 -
 .../afterburn-network-kargs.service           |   8 +-
 dracut/50flatcar-network/module-setup.sh      |  47 ++----
 .../parse-ip-for-networkd.service             |  18 ---
 .../parse-ip-for-networkd.sh                  | 138 ------------------
 .../systemd-network-generator-afterburn.conf  |   9 ++
 update-bootengine                             |   4 +-
 7 files changed, 28 insertions(+), 198 deletions(-)
 delete mode 100644 dracut/50flatcar-network/10-nodeps.conf
 delete mode 100644 dracut/50flatcar-network/parse-ip-for-networkd.service
 delete mode 100755 dracut/50flatcar-network/parse-ip-for-networkd.sh
 create mode 100644 dracut/50flatcar-network/systemd-network-generator-afterburn.conf

diff --git a/dracut/50flatcar-network/10-nodeps.conf b/dracut/50flatcar-network/10-nodeps.conf
deleted file mode 100644
index 911bbfa..0000000
--- a/dracut/50flatcar-network/10-nodeps.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-[Unit]
-DefaultDependencies=no
diff --git a/dracut/50flatcar-network/afterburn-network-kargs.service b/dracut/50flatcar-network/afterburn-network-kargs.service
index 9bece87..c8b3e16 100644
--- a/dracut/50flatcar-network/afterburn-network-kargs.service
+++ b/dracut/50flatcar-network/afterburn-network-kargs.service
@@ -2,11 +2,8 @@
 Description=Afterburn Initrd Setup Network Kernel Arguments
 Documentation=https://coreos.github.io/afterburn/usage/initrd-network-cmdline/
 
-# This service may produce additional kargs fragments,
-# which are then consumed by dracut-cmdline(8).
 DefaultDependencies=no
-Before=parse-ip-for-networkd.service systemd-networkd.service
-PartOf=systemd-networkd.service
+Before=dracut-cmdline.service
 # For extra safety
 ConditionKernelCommandLine=|coreos.oem.id=vmware
 ConditionKernelCommandLine=|flatcar.oem.id=vmware
@@ -17,6 +14,3 @@ OnFailureJobMode=replace-irreversibly
 ExecStart=/usr/bin/coreos-metadata exp rd-network-kargs --cmdline --default-value ''
 Type=oneshot
 RemainAfterExit=yes
-
-[Install]
-WantedBy=systemd-networkd.service
diff --git a/dracut/50flatcar-network/module-setup.sh b/dracut/50flatcar-network/module-setup.sh
index 02250e4..903bf50 100755
--- a/dracut/50flatcar-network/module-setup.sh
+++ b/dracut/50flatcar-network/module-setup.sh
@@ -5,16 +5,11 @@
 
 # called by dracut
 depends() {
-    echo net-lib systemd-networkd
+    echo net-lib systemd-networkd systemd-resolved
 }
 
 # called by dracut
 install() {
-    inst_multiple -o \
-        $systemdutildir/systemd-resolved \
-        $systemdsystemunitdir/systemd-resolved.service \
-        /etc/systemd/resolved.conf
-
     inst_multiple \
         "$systemdnetwork"/98-{gce-coreos-virtio,gce-virtio,virtio}.link \
         "$systemdnetwork"/yy-{azure-sriov{,-coreos},pxe}.network \
@@ -27,18 +22,6 @@ install() {
     sed -i -r 's:^(KeepConfiguration)=.*:\1=no:' \
         "$initdir/$systemdnetwork"/{yy-pxe,zz-default}.network
 
-    inst_simple "$moddir/network-cleanup.service" \
-        "$systemdsystemunitdir/network-cleanup.service"
-
-    inst_simple "$moddir/parse-ip-for-networkd.service" \
-        "$systemdsystemunitdir/parse-ip-for-networkd.service"
-
-    inst_simple "$moddir/afterburn-network-kargs.service" \
-        "$systemdsystemunitdir/afterburn-network-kargs.service"
-
-    inst_simple "$moddir/10-nodeps.conf" \
-        "$systemdsystemunitdir/systemd-resolved.service.d/10-nodeps.conf"
-
     inst_simple "$moddir/yy-digitalocean.network" \
         "$systemdnetwork/yy-digitalocean.network"
 
@@ -48,22 +31,24 @@ install() {
     inst_simple "$moddir/yy-netroot.network" \
         "$systemdnetwork/yy-netroot.network"
 
-    # add a hook to generate networkd configuration from ip= arguments
-    inst_hook cmdline 99 "$moddir/parse-ip-for-networkd.sh"
+    inst_simple "$moddir/network-cleanup.service" \
+        "$systemdsystemunitdir/network-cleanup.service"
+
+    inst_simple "$moddir/afterburn-network-kargs.service" \
+        "$systemdsystemunitdir/afterburn-network-kargs.service"
 
-    # user/group required for systemd-resolved
-    getent passwd systemd-resolve >> "$initdir/etc/passwd"
-    getent group systemd-resolve >> "$initdir/etc/group"
+    # Feed afterburn-injected kargs (in Dracut's cmdline.d) to
+    # systemd-network-generator, which only reads /proc/cmdline.
+    inst_simple "$moddir/systemd-network-generator-afterburn.conf" \
+        "$systemdsystemunitdir/systemd-network-generator.service.d/10-afterburn.conf"
 
-    # point /etc/resolv.conf @ systemd-resolved's resolv.conf
-    ln -s ../run/systemd/resolve/resolv.conf "$initdir/etc/resolv.conf"
+    # The systemd-networkd and systemd-resolved Dracut modules enable their
+    # services by default, but we only want them when pulled in on demand.
+    systemctl --root "$initdir" disable systemd-networkd.{service,socket} systemd-resolved.service
 
-    # the systemd-networkd dracut module enables networkd by default, but
-    # we only want it when pulled in
-    systemctl --root "$initdir" disable systemd-networkd.service
-    systemctl --root "$initdir" disable systemd-networkd.socket
+    # Disabling systemd-networkd also disables its generator because the former
+    # lists the latter in its [Install] Also=, so explicitly re-enable it.
+    systemctl --root "$initdir" enable systemd-network-generator.service
 
     systemctl --root "$initdir" enable network-cleanup.service
-    systemctl --root "$initdir" enable parse-ip-for-networkd.service
-    systemctl --root "$initdir" enable afterburn-network-kargs.service
 }
diff --git a/dracut/50flatcar-network/parse-ip-for-networkd.service b/dracut/50flatcar-network/parse-ip-for-networkd.service
deleted file mode 100644
index 23fcbbd..0000000
--- a/dracut/50flatcar-network/parse-ip-for-networkd.service
+++ /dev/null
@@ -1,18 +0,0 @@
-[Unit]
-Description=Write systemd-networkd units from cmdline
-DefaultDependencies=false
-
-After=afterburn-network-kargs.service dracut-cmdline.service
-PartOf=systemd-networkd.service
-Before=systemd-networkd.service initrd-switch-root.target
-# Switching the root filesystem terminates all running services with binaries from the initramfs, we need to finish before that happens
-Conflicts=initrd-switch-root.target
-
-[Service]
-Type=oneshot
-RemainAfterExit=true
-Environment="APPLY=1"
-ExecStart=/var/lib/dracut/hooks/cmdline/99-parse-ip-for-networkd.sh
-
-[Install]
-WantedBy=systemd-networkd.service
diff --git a/dracut/50flatcar-network/parse-ip-for-networkd.sh b/dracut/50flatcar-network/parse-ip-for-networkd.sh
deleted file mode 100755
index 6bb015e..0000000
--- a/dracut/50flatcar-network/parse-ip-for-networkd.sh
+++ /dev/null
@@ -1,138 +0,0 @@
-#!/bin/bash
-#
-# This script was mostly stolen from 40network/parse-ip-opts.sh.  Its
-# actions are adapted to write .network files to /etc/systemd/network
-# in the initramfs instead of using separate DHCP commands, etc.  Note
-# the bashisms. It used to be run as a dracut hook, relying on afterburn to
-# process kargs for the dracut cmdline target. Now that we start afterburn
-# from /sysusr instead of ramdisk root, we need to mount /sysusr first. Mounting
-# happens later than the dracut hook we used. Thus we added a systemd unit for
-# this script. The unit runs shortly before systemd-networkd.
-# However, since the "netroot" variable is set up by another dracut
-# hook, this script here will still get executed once as dracut hook
-# to save the "netroot" variable to an env file and exit.
-# Could the script instead be a hook at a later stage? There doesn't
-# seem to be a suitable later stage and also then the env could be
-# different. As long as we want to rely on dracut-lib/net-lib for
-# parsing the env var topic is not easily avoided.
-#
-
-if [ "${APPLY-}" != "1" ]; then
-  # First run, called as dracut hook
-  {
-  # While the script only makes use of the env vars "NEEDBOOTDEV" and "netroot"
-  # we actually don't really know what env vars dracut-lib.sh and net-lib.sh
-  # will depend on in future versions and therefore, we try to preserve the
-  # environment as is.
-  for VARNAME in $(compgen -v); do
-    # Prevent leaking HEREEOF into VAL ($_ is the argument of the prev. command, and in this loop contains HEREOF)
-    [ "${VARNAME}" = "_" ] && continue
-    # Skip unnecessary variables
-    [[ "${VARNAME}" = "BASH"* ]] && continue
-    # Skip errors from read-only variables
-    (unset "${VARNAME}" 2> /dev/null) || continue
-    VAL="${!VARNAME}"
-    echo "${VARNAME}=\$(cat <<'HEREEOF'
-${VAL}
-HEREEOF
-)"
-  done
-  } > /saved-parse-ip.env
-  return;
-else
-  # Second run, expected to be called as systemd unit
-  # Make it a hard error if we forgot to exclude some problematic variables and thus the sourcing terminates without setting all variables
-  . /saved-parse-ip.env || { echo "Error: failed sourcing all variables"; exit 1 ; }
-fi
-
-# The getarg uses getcmdline which assembles the cmdline on-the-fly
-# from /proc/cmdline and the drop-in files under /etc/cmdline.d/
-# where afterburn could have written the kargs values
-command -v getarg >/dev/null          || . /lib/dracut-lib.sh
-command -v ip_to_var >/dev/null       || . /lib/net-lib.sh
-
-if [ -n "$netroot" ] && [ -z "$(getarg ip=)" ] && [ -z "$(getarg BOOTIF=)" ]; then
-    # No ip= argument(s) for netroot provided, defaulting to DHCP
-    exit 0
-fi
-
-function mask2cidr() {
-    local -i bits=0
-    for octet in ${1//./ }; do
-        for i in {0..8}; do
-            [ "$octet" -eq $(( 256 - (1 << i) )) ] && bits+=$((8-i)) && break
-        done
-        [ $i -eq 8 -a "$octet" -ne 0 ] && warn "Bad netmask $mask" && return
-        [ $i -gt 0 ] && break
-    done
-    echo $bits
-}
-
-# Check ip= lines
-# XXX Would be nice if we could errorcheck ip addresses here as well
-for p in $(getargs ip=); do
-    ip_to_var $p
-    # From here on the variables "ip", "mask" etc are set up (or are cleared)
-    # from 'unset ip srv gw mask hostname dev autoconf macaddr mtu dns1 dns2' in ip_to_var
-    # ("cidr" is defined below)
-
-    # Empty autoconf defaults to 'dhcp'
-    if [ -z "$autoconf" ] ; then
-        warn "Empty autoconf values default to dhcp"
-        autoconf="dhcp"
-    fi
-
-    # Convert the netmask to CIDR notation
-    if [[ "x$mask" =~ ^x[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
-        cidr=$(mask2cidr "$mask")
-    elif [ -n "$mask" -a "x${mask//[0-9]/}" = 'x' ]; then
-        # The mask is already a prefix length (uint), so validate it
-        [[ "x$ip" == x*:*:* && "$mask" -le 128 || "$mask" -le 32 ]] && cidr=$mask
-    fi
-
-    # Error checking for autoconf in combination with other values
-    for autoopt in $(str_replace "$autoconf" "," " "); do
-        case $autoopt in
-            error) die "Error parsing option 'ip=$p'";;
-            auto6|ibft|bootp|rarp|both) die "Sorry, ip=$autoopt is currenty unsupported";;
-            none|off)
-                [ -z "$ip" ] && \
-                    die "For argument 'ip=$p'\nValue '$autoopt' without static configuration does not make sense"
-                [ -z "$mask" ] && \
-                    die "Sorry, automatic calculation of netmask is not yet supported"
-                [ -z "$cidr" ] && \
-                    die "For argument 'ip=$p'\nSorry, failed to convert netmask '$mask' to CIDR"
-                ;;
-            dhcp|dhcp6|on|any) \
-                [ -n "$NEEDBOOTDEV" ] && [ -z "$dev" ] && \
-                    die "Sorry, 'ip=$p' does not make sense for multiple interface configurations"
-                [ -n "$ip" ] && \
-                    die "For argument 'ip=$p'\nSorry, setting client-ip does not make sense for '$autoopt'"
-                ;;
-            *) die "For argument 'ip=$p'\nSorry, unknown value '$autoopt'";;
-        esac
-    done
-
-    # Enough validation, write the network file
-    # Count down so that early ip= arguments are overridden by later ones
-    _net_file=/etc/systemd/network/10-dracut-cmdline-$(( 99 - _net_count++ )).network
-    mkdir -p /etc/systemd/network
-    echo '[Match]' > $_net_file
-    _dev=${dev:-"*"}; echo "Name=$_dev" >> $_net_file
-    echo '[Link]' >> $_net_file
-    [ -n "$macaddr" ] && echo "MACAddress=$macaddr" >> $_net_file
-    [ -n "$mtu" ] && echo "MTUBytes=$mtu" >> $_net_file
-    echo '[Network]' >> $_net_file
-    [ "x$autoconf" = xoff -o "x$autoconf" = xnone ] &&
-        echo DHCP=no >> $_net_file || echo -e "DHCP=yes\nIPv6AcceptRA=true" >> $_net_file
-    [ -n "$gw" ] && echo "Gateway=$gw" >> $_net_file
-    [ -n "$dns1" ] && echo "DNS=$dns1" >> $_net_file
-    [ -n "$dns2" ] && echo "DNS=$dns2" >> $_net_file
-    echo '[Address]' >> $_net_file
-    [ -n "$ip" ] && echo "Address=$ip/${cidr:-24}" >> $_net_file
-    [ -n "$srv" ] && echo "Peer=$srv" >> $_net_file
-    echo '[DHCP]' >> $_net_file
-    [ -n "$hostname" ] && echo "Hostname=$hostname" >> $_net_file
-done
-# Have a clear exit code instead of propagating the one from [ -n "$hostname" ]
-exit 0
diff --git a/dracut/50flatcar-network/systemd-network-generator-afterburn.conf b/dracut/50flatcar-network/systemd-network-generator-afterburn.conf
new file mode 100644
index 0000000..4c03323
--- /dev/null
+++ b/dracut/50flatcar-network/systemd-network-generator-afterburn.conf
@@ -0,0 +1,9 @@
+[Unit]
+# Augment command line with Afterburn before running systemd-network-generator.
+Wants=afterburn-network-kargs.service
+After=afterburn-network-kargs.service
+
+[Service]
+# systemd-network-generator only parses /proc/cmdline or SYSTEMD_PROC_CMDLINE.
+# Afterburn writes SYSTEMD_PROC_CMDLINE here; ignore it when absent.
+EnvironmentFile=-/run/afterburn/network-generator.env
diff --git a/update-bootengine b/update-bootengine
index b2ddf8b..a4897b5 100755
--- a/update-bootengine
+++ b/update-bootengine
@@ -20,8 +20,8 @@ DRACUT_ARGS=(
     --force
     --no-hostonly
     --no-compress
-    --omit "bluetooth cifs fido2 lvm multipath network nfs nvmf pkcs11 tpm2-tss zfs"
-    --add "i18n iscsi systemd-coredump"
+    --omit "bluetooth cifs fido2 lvm multipath nfs nvmf pkcs11 tpm2-tss zfs"
+    --add "flatcar-network i18n iscsi systemd-coredump"
     --add-drivers "loop brd drbd nbd rbd mmc_block xen-blkfront zram libarc4 lru_cache zsmalloc vboxguest"
     --kernel-cmdline "SYSTEMD_SULOGIN_FORCE=1"
     )

From aa913a4b2d288ba90392a5b363b6b22247584249 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Fri, 21 Aug 2026 12:20:44 +0100
Subject: [PATCH 8/8] afterburn: Allow ProxmoxVE to configure the network using
 kernel args

Upstream have also added KubeVirt support here, but that hasn't been
released yet.

Bug: https://github.com/flatcar/bootengine/pull/117
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 dracut/50flatcar-network/afterburn-network-kargs.service | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dracut/50flatcar-network/afterburn-network-kargs.service b/dracut/50flatcar-network/afterburn-network-kargs.service
index c8b3e16..ef53f57 100644
--- a/dracut/50flatcar-network/afterburn-network-kargs.service
+++ b/dracut/50flatcar-network/afterburn-network-kargs.service
@@ -7,6 +7,9 @@ Before=dracut-cmdline.service
 # For extra safety
 ConditionKernelCommandLine=|coreos.oem.id=vmware
 ConditionKernelCommandLine=|flatcar.oem.id=vmware
+ConditionKernelCommandLine=|coreos.oem.id=proxmoxve
+ConditionKernelCommandLine=|flatcar.oem.id=proxmoxve
+
 OnFailure=emergency.target
 OnFailureJobMode=replace-irreversibly