Starting from systemd v256, systemd units in the initramfs run with ProtectSystem= by default. This means that /usr is now mounted read-only there:

https://github.com/systemd/systemd/blob/07748c53df5a72111d8b3eef49d275210d6018cd/NEWS#L168-L175

This breaks coreos-ignition-setup-user.sh which is used in various flows to copy the Ignition config to /usr/lib/ignition/.

Let's have Ignition also support sourcing from /run and /etc, which is standard nowadays for a lot of services. I think coreos-ignition-setup-user would probably want to use /etc since it's lifecycled with the initramfs, so we don't have to worry about cleaning it up.