Reduce vmlinuz size

[pothos]

Description

The boot partition has to fit both kernels on update. If both are > 60 MiB they won't fit. Therefore, we always have to ensure that the vmlinuz file is < 60 MiB. On arm64 we are closely approaching the limit (new Alpha has a ~57 MiB vmlinuz).

Impact

To avoid hitting the size limit we may have to block a security update.
And of course updates will break for users if we release with a too large vmlinuz file.

Environment and steps to reproduce

See end of the console output of the image-matrix job

Expected behavior

Have some MiBs wiggle room, on amd64 we have a ~54 MiB vmlinuz - while not perfect it's still double the margin

Additional information

Compression was adjusted last time, and we couldn't enable it more at that time. This time it's worth to check if we can throw binaries/kernel modules out of the initramfs (planned is torcx for example, but I don't think the impact on the initramfs will be that large?).

[pothos]

First small size reduction in flatcar-archive/coreos-overlay#1750

[pothos]

Current situation: 58 MiB (must be < 60 MiB or updates will break)

[pothos]

This may be a blocker for Clevis integration for LUKS setup from Ignition with TPM unlocking

[pothos]

When CONFIG_EFI_ZBOOT is available we will gain kernel compression for arm64. Not sure if we can/should also switch amd64 over to it.

[pothos]

By moving Ignition and afterburn/coreos-metadata out and use it from the /usr partition I was able to reduce the /boot size from 58 MiB to 52 MiB for arm64 (from 55 MiB to 49 MiB for amd64). Am still testing the changes but this will likely "solve" the growth issue for the next years and once we hit the limit again we can search for more binaries or even kernel modules to move out to the /usr partition.

[pothos]

PR in flatcar/bootengine#52

We can leave this open to use CONFIG_EFI_ZBOOT as final improvement for arm64.

[pothos]

Now with the 6.1 update the amd64 kernel is quite large, even larger than the arm64 kernel. Some configs got changed unexpectedly, this could have caused it, too.

[jepio]

• sys-kernel/coreos-modules: Enable EFI_ZBOOT for arm64 scripts#2507 enables CONFIG_EFI_ZBOOT for arm64.