Ignition silently fails to enable a nonexistent unit

[coreosbot]

Issue by @bgilbert

---

Issue Report

Bug

Container Linux Version

$ cat /etc/os-release
NAME="Container Linux by CoreOS"
ID=coreos
VERSION=1590.0.0
VERSION_ID=1590.0.0
BUILD_ID=2017-11-08-0831
PRETTY_NAME="Container Linux by CoreOS 1590.0.0 (Ladybug)"
ANSI_COLOR="38;5;75"
HOME_URL="https://coreos.com/"
BUG_REPORT_URL="https://issues.coreos.com"
COREOS_BOARD="amd64-usr"

Environment

Any

Expected Behavior

If Ignition is asked to enable a nonexistent unit, it fails the boot.

Actual Behavior

Ignition claims to have enabled the unit, but nothing happens.

Reproduction Steps

1. Boot the following CLC:

systemd:
  units:
    - name: blargh.service
      enabled: true

2. Check journalctl -t ignition and systemctl status.

Other Information

This happens because Ignition configures systemd units via presets, and presets are allowed to reference nonexistent units.

journalctl says:

Nov 10 01:19:32 localhost ignition[439]: files: op(8): [started]  processing unit "blargh.service"
Nov 10 01:19:32 localhost ignition[439]: files: op(8): [finished] processing unit "blargh.service"
Nov 10 01:19:32 localhost ignition[439]: files: op(9): [started]  enabling unit "blargh.service"
Nov 10 01:19:32 localhost ignition[439]: files: op(9): [finished] enabling unit "blargh.service"

[ajeddeloh]

Wild idea: The root of the problem here (as described in #588) is that we can't know what units are generated by systemd generators and thus can't know what units exist in the real root. One thought is to run the generators in the initramfs, chrooted into the real root, but with a throwaway overlayfs to "absorb" any writes to the filesystem, then inspect the real root with overlay and see if we'd fail to enable anything. It's still not perfect since it's not checking that enabling actually succeeded, just that it should succeed. Also seems somewhat brittle.

If generators are well behaved (see https://www.freedesktop.org/software/systemd/man/systemd.generator.html#Notes%20about%20writing%20generators) then we might even get away with running them with root RO and with the early/normal/late dirs bind-mounted in. But users can add their own generators which may not be well behaved.

[jamescassell]

seems like a failure of the "first boot fails if the ignition couldn't be applied" principle