Backport #33 to release/3.0: ACL-T kola parity (variant-aware enforcement, 192 MiB ESP, LUKS initramfs modules)

[Lanze Liu (liulanze)]

Summary

Cherry-pick of #33 (aclmain, 2026-08-13) onto release/3.0.

Production builds of the ACL-T variant use release/3.0 and hit the two gaps #33 closed on aclmain: the arm64 UKI rebuild runs out of ESP space (Low free disk space 0% on /boot, prod nightly 1207248, same as 1193186 on 08-28), and the ACL-T kola runs count the variant-exempt tests as enforced failures (140 QEMU / 125 Azure on 1207247; the same test set passes as exempt on aclmain, e.g. 1206112).

Change Log

• build_library/disk_layout_uki.json: ESP 128 MiB -> 192 MiB (all UKI images).
• build_library/rpm/additional_files/99-acl.conf: initramfs adds dm_crypt and its ciphers (arm64 ships CONFIG_DM_CRYPT=m; needed by kola cl.ignition.luks).
• acl/tests/kola_enforcing.yaml: rules gain imageVariants; rules for acl are unchanged, the additions apply to acl-t only.
• One hunk of Enable ACL Template kola parity: variant-aware enforcement, ESP sizing, LUKS initramfs modules #33 dropped: the acl-t exceptions it added to acl.flannel.udp / acl.flannel.vxlan, entries that Backport PR #74 Flannel enforcement cleanup to release/3.0 #78 (backport of test(flannel): disable enforcement of legacy flannel wrapper tests #74) has since removed. The result matches aclmain, which carries both changes.

Type of Change

• New kola test
• Kola test fix/update
• Platform integration change (Azure, QEMU, etc.)
• CLI/command change
• CI/automation change
• Bug fix
• Documentation update

Does this affect the image build?

• Yes
• No

ESP size of every UKI image and the initramfs module list; aclmain has shipped both in every nightly since 08-13.

Associated Issues

• Backport of ACL PR #33.
• Unblocks the ACL-T publish to MCR (acl-pipelines PR 29363).

Test Methodology

• aclmain nightlies (5304) carry Enable ACL Template kola parity: variant-aware enforcement, ESP sizing, LUKS initramfs modules #33 since 08-13: e.g. 1206112 (ACL-T kola: 28/35 exemptions applied, all enforced tests passed) and 1207313 (09-22, ACL-T build green on both architectures).
• Production nightly pipelines (amd64 and arm64) runs 1207566 / 1207567 built from this branch (aclScriptsRef=user/lanzeliu/backport-33-release-3.0, 9aab1f2): both succeeded; stock kola all enforced tests passed on both architectures; the arm64 ACL-T build succeeds with the 192 MiB ESP; ACL-T kola applies the imageVariant=acl-t exemptions and passes on both architectures (details in the PR comment).
• Required CI checks (github-acl-pr-validation: stock build, kola and smoke on both architectures).

Merge Checklist

All applicable boxes should be checked before merging

• Required CI checks pass
• Ready to merge

[Lanze Liu (liulanze)]

Production evidence for this branch (9aab1f2): the production nightly pipelines for amd64 and arm64 were queued with aclScriptsRef=user/lanzeliu/backport-33-release-3.0, buildAclTemplate=true, icSourceRef=839a4e8ff (runs 1207566 and 1207567, 2026-09-22).

Run	Result	Stock kola (Evaluate Test Results)	ACL-T
1207566 amd64	succeeded	Azure 59 enforced / 28 exempt, QEMU 85 enforced / 2 exempt: all enforced tests passed	build, QEMU + Azure smoke, QEMU kola (59 enforced / 28 exempt) and Azure kola (37 enforced / 50 exempt) all green
1207567 arm64	succeeded	Azure 59 / 28, QEMU 66 / 21: all enforced tests passed	build with the 192 MiB ESP (the UKI rebuild that failed on 1207248), smoke and kola all green: QEMU 52 enforced / 35 exempt, Azure 37 / 50

Same commit as this PR; the two gaps in the description are closed on release/3.0 (arm64 ACL-T build succeeds, ACL-T kola applies the imageVariant=acl-t exemptions and passes). The stock bundles of these two runs were not released: the release analysis they triggered judged them ineligible and queued no publish.