Kairos installation doesn't seem to create a UEFI boot entry

[alihamzam]

Hi all,

Thanks for the great project, we're really excited to start using it! We're trying to get our heads around one thing, when we try to install Kairos on a bare-metal machine, it doesn't seem to create a UEFI boot entry.

We can create one ourselves using efibootmgr and that seems to work, but ideally we are working towards a fully-automated install, for edge machines.

Is this something we are overlooking or could this be a design decision or something similar please?

Thanks in advance!
Ali

[alihamzam]

We seem to have got around this for now by adding the following to the cloud-init config file:

kairos-install.after:
    - commands:
        - apt update
        - apt install efibootmgr -y
        - efibootmgr -c -L Kairos -l '\EFI\BOOT\shimx64.efi.dualsigned' -d /dev/disk/by-path/pci-0000:00:17.0-ata-3

And we think we could get around air-gapped installations by including the efibootmgr binary in an install-time bundle, with a shell script that runs the create command.

We also had a look at the code for kairos-agent, where Grub is installed, and a comment mentions that kairos-agent no longer uses grub-install, which I think would have created the boot entry through efibootmgr: https://github.com/kairos-io/kairos-agent/blob/4e4494293abbe94080a40ce2ae31f9487e4ac980/pkg/utils/grub.go#L163

Is there now another way to invoke the UEFI boot entry registration, or is it a case of adding this into the kairos-agent code?

[Itxaka]

Hi there,

we dont create any EFI entries as it was such a hassle to deal with during upgrades, reinstalls and resets that we decided not to do it.

In any case, what we do is we setup the grub or systemd-boot managers in teh proper places where the EFI standard will use them by default as fallback so if no entries are in the efi firmware it should automatically boot from those \EFI\BOOT\BOOTx64.EFI for amd64 machines for example.

This has been working in the wild for a long time now, in qemu, aws, azure, baremetal and more so its a working process.

So maybe what you are reporting is a different issue? Can you be more specific on whats the problem with this approach?

If you already have entries in the machine, then yes, this may be an issue, although witht he fallback mechanism that EFI firmwares have they will try all the entries then fallback to the default EFI firmware entries, like ipxe, fallback mechanism and so on.