DROPBEAR_IFDOWN=* takes interface down but leaves netplan config

Status changed to 'Confirmed' because the bug affects multiple users.

I agree. I confirm this is still happening on Ubuntu 20.04.

This also applies when set up with static IP's in /etc/initramfs-tools/initramfs.conf. That case is most prominently noticed as lacking nameservers after boot.

Investigating further reveals that the package is not adapted for netplan in the first place. The maintainer is not on launchpad and the package was imported from Debian Sid.

Digging even further back, it turns out that IFDOWN is in itself a workaround for an equal issue dating back to ~2012. As such, the core of the issue lies with how initramfs network setup overrides netplan. Adding that package.

Given the very limited setup /etc/initramfs-tools/initramfs.conf allows (including the DHCP default mentioned in the description), there is a case to be made for allowing admins to rely on the full config rather than initramfs for their network setup.

It seems the workaround above does not work on Ubuntu 20.04.

Status changed to 'Confirmed' because the bug affects multiple users.

The easiest way to fix this on linux mint for me was to edit:

/usr/share/initramfs-tools/scripts/init-bottom/dropbear

add these two lines to the end of file:

rm /run/net-*.conf
rm /run/netplan/*.yaml

save and run:

update-initramfs -u

Which version of Mint (or which upstream Ubuntu it is based on?) I wonder if there is a way to get those rows into the configs rather than editing packaged files?

I can confirm the workaround by boxeus works on Ubuntu 20.04 LTS. To improve on that, the lines can be added to the /etc/dropbear-initramfs/config config file instead to avoid upgrade issues. It is loaded towards the end of /usr/share/initramfs-tools/scripts/init-bottom/dropbear anyway.

Automation two-liner:
echo -e "rm /run/net-*.conf\nrm /run/netplan/*.yaml" >> /etc/dropbear-initramfs/config
update-initramfs -u

After that, netplan actually works again.

The same problem occurs when the hdd is automatically decrypted with clevis and a tang server. The script /usr/share/initramfs-tools/scripts/local-bottom/clevis tries to deactivate the network interface again after it got the secret to decrypt the disk from the tang server:

...
for iface in /sys/class/net/*; do
    if [ -e "$iface" ]; then
        iface=$(basename "$iface")
        ip link set dev "$iface" down
        ip addr flush dev "$iface"
        ip route flush dev "$iface"
    fi
done

The presence of /run/net-*.conf and /run/netplan/*.yaml leads to the interface beeing managed by systemd-networkd instad of NetworkManager here, too.

Instead of implementing removal of the files in dropbear an clevis, maybe there is a single place to serve both, dropbear and clevis?

Status changed to 'Confirmed' because the bug affects multiple users.

Confirming the clevis issue.
Patch for reference:
------------
--- /usr/share/initramfs-tools/scripts/local-bottom/clevis.orig 2022-07-11 10:52:16.938228467 -0500
+++ /usr/share/initramfs-tools/scripts/local-bottom/clevis 2022-07-11 10:30:08.040636353 -0500
@@ -46,5 +46,9 @@ for iface in /sys/class/net/*; do
         ip link set dev "$iface" down
         ip addr flush dev "$iface"
         ip route flush dev "$iface"
+
+ if [ -f "/run/netplan/${iface}.yaml" ]; then
+ rm "/run/netplan/${iface}.yaml"
+ fi
     fi
 done
------------

Followed by: update-initramfs -u -k 'all'

Patch for /usr/share/initramfs-tools/scripts/init-bottom/dropbear on Ubuntu 22.04-LTS

This feels like the better place for a fix, as it respects Dropbear's original semantic for IFDOWN on systems which run Netplan, which I am certain has good reasons for choosing to preserve the network interfaces configured directly by the kernel.

Needs to be followed by update-initramfs -u -k 'all'

--- /root/dropbear-orig 2022-12-27 10:50:51.619568832 +0000
+++ /usr/share/initramfs-tools/scripts/init-bottom/dropbear 2022-12-27 11:00:26.055331525 +0000
@@ -79,6 +79,9 @@
 ip link set dev "$IFACE" down
 ip address flush dev "$IFACE"
 ip route flush dev "$IFACE"
+ if [ -f "/run/netplan/${IFACE}.yaml" ]; then
+ rm -f "/run/netplan/${IFACE}.yaml"
+ fi
 log_end_msg
 done
 fi