From 82f95e532d72b1d5deeb7ff56c6d3e6360730dea Mon Sep 17 00:00:00 2001
From: Deepak Bhagat <deepak988088@gmail.com>
Date: Tue, 18 Aug 2026 15:37:03 +0530
Subject: [PATCH] butane: report CEX kernel arg error once when both sources
 set

When both boot_device.luks.cex.enabled and a storage.luks root entry
with cex.enabled are set, the missing 'rd.luks.key=/etc/luks/cex.key'
kernel argument was reported twice at $.openshift.kernel_arguments.

Consolidate the two independent checks into a single CEX-enabled flag
and emit the error exactly once. Behavior and error path are unchanged.

Fixes #2285

Signed-off-by: Deepak Bhagat <deepak988088@gmail.com>
---
 butane/config/openshift/v4_23_exp/validate.go |  6 +--
 .../openshift/v4_23_exp/validate_test.go      | 37 +++++++++++++++++++
 docs/release-notes.md                         |  2 +
 3 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/butane/config/openshift/v4_23_exp/validate.go b/butane/config/openshift/v4_23_exp/validate.go
index a0e01958c..d07415cd2 100644
--- a/butane/config/openshift/v4_23_exp/validate.go
+++ b/butane/config/openshift/v4_23_exp/validate.go
@@ -51,10 +51,10 @@ func (os OpenShift) Validate(c path.ContextPath) (r report.Report) {
 // See: https://github.com/coreos/butane/issues/611
 // See: https://github.com/coreos/butane/issues/613
 func (conf Config) Validate(c path.ContextPath) (r report.Report) {
-	if util.IsTrue(conf.BootDevice.Luks.Cex.Enabled) && !slices.Contains(conf.OpenShift.KernelArguments, "rd.luks.key=/etc/luks/cex.key") {
-		r.AddOnError(c.Append("openshift", "kernel_arguments"), common.ErrMissingKernelArgumentCex)
-	}
 	cex := false
+	if util.IsTrue(conf.BootDevice.Luks.Cex.Enabled) {
+		cex = true
+	}
 	for _, l := range conf.Storage.Luks {
 		if util.IsTrue(l.Cex.Enabled) && l.Name == "root" {
 			cex = true
diff --git a/butane/config/openshift/v4_23_exp/validate_test.go b/butane/config/openshift/v4_23_exp/validate_test.go
index a51e351b9..bae3e923e 100644
--- a/butane/config/openshift/v4_23_exp/validate_test.go
+++ b/butane/config/openshift/v4_23_exp/validate_test.go
@@ -230,6 +230,43 @@ func TestValidateConfig(t *testing.T) {
 			common.ErrMissingKernelArgumentCex,
 			path.New("yaml", "openshift", "kernel_arguments"),
 		},
+		{
+			// both boot_device CEX and a root storage.luks CEX entry set;
+			// the missing kernel argument must be reported exactly once
+			Config{
+				Config: fcos.Config{
+					BootDevice: fcos.BootDevice{
+						Layout: util.StrToPtr("s390x-eckd"),
+						Luks: fcos.BootDeviceLuks{
+							Device: util.StrToPtr("/dev/dasda"),
+							Cex: base.Cex{
+								Enabled: util.BoolToPtr(true),
+							},
+						},
+					},
+					Config: base.Config{
+						Storage: base.Storage{
+							Luks: []base.Luks{
+								{
+									Name:   "root",
+									Label:  util.StrToPtr("luks-root"),
+									Device: util.StrToPtr("/dev/disk/by-label/root"),
+									Cex: base.Cex{
+										Enabled: util.BoolToPtr(true),
+									},
+								},
+							},
+						},
+					},
+				},
+				OpenShift: OpenShift{
+					// explicitly empty kernel argument list
+					KernelArguments: []string{},
+				},
+			},
+			common.ErrMissingKernelArgumentCex,
+			path.New("yaml", "openshift", "kernel_arguments"),
+		},
 	}
 
 	for i, test := range tests {
diff --git a/docs/release-notes.md b/docs/release-notes.md
index b9020a1e8..ffba58606 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -19,6 +19,8 @@ nav_order: 9
 
 ### Bug fixes
 
+- butane: report the CEX kernel-argument validation error only once when both `boot_device.luks.cex` and a root `storage.luks` CEX entry are enabled ([#2285](https://github.com/coreos/ignition/pull/2285))
+
 
 ## Upcoming Ignition 2.27.0 (unreleased)