In comment #16 Jeff noticed that I had backported a package to see it if fixed the issue we were seeing. It did not - but it did have the patches intended to fix this issue. So I think we're seeing an additional issue. I added some debugging code to figure out what was going on:

@@ -487,15 +489,18 @@ def uefi_find_duplicate_entries(grubcfg,
     to_remove = []
     if efi_output is None:
         efi_output = util.get_efibootmgr(target=target)
+    LOG.info("DANNF: %s", efi_output)
     entries = efi_output.get('entries', {})
     current_bootnum = efi_output.get('current', None)
     # adding BootCurrent to seen first allows us to remove any other duplicate
     # entry of BootCurrent.


With this, I see:
DANNF: {'current': '0003', 'timeout': '5 seconds', 'order': ['0000'], 'entries': {'0000': {'name': 'ubuntu', 'path': 'HD(1,GPT,e45478ae-8e68-4171-a165-5a8ac6654f30,0x800,0x100000)/File(\\EFI\\ubuntu\\shimx64.efi)'}}}

Notice we have no entry for current/0003. I have not inspected the code to determine whether or not this is an issue parsing efibootmgr output or the actual variable state.

I made a few hacks which allowed me to deploy:

Index: curtin-20.1-2-g42a9667f/curtin/commands/curthooks.py
===================================================================
--- curtin-20.1-2-g42a9667f.orig/curtin/commands/curthooks.py
+++ curtin-20.1-2-g42a9667f/curtin/commands/curthooks.py   
@@ -451,7 +451,9 @@ def uefi_reorder_loaders(grubcfg, target
         if currently_booted:
             if currently_booted in boot_order:
                 boot_order.remove(currently_booted)
-            boot_order = [currently_booted] + boot_order  
+            entries = efi_output.get('entries', {})
+            if currently_booted in entries.keys():
+                boot_order = [currently_booted] + boot_order
             new_boot_order = ','.join(boot_order)
             LOG.debug(
                 "Setting currently booted %s as the first "
@@ -487,15 +489,18 @@ def uefi_find_duplicate_entries(grubcfg,
     to_remove = []
     if efi_output is None:
         efi_output = util.get_efibootmgr(target=target)
+    LOG.info("DANNF: %s", efi_output)
     entries = efi_output.get('entries', {})
     current_bootnum = efi_output.get('current', None)
     # adding BootCurrent to seen first allows us to remove any other duplicate
     # entry of BootCurrent.
-    if current_bootnum:
+    if current_bootnum and current_bootnum in entries.keys():
         seen.add(tuple(entries[current_bootnum].items())) 
     for bootnum in sorted(entries):
         if bootnum == current_bootnum:
             continue
+        if bootnum not in entries.keys():
+            continue
         entry = entries[bootnum]
         t = tuple(entry.items())
         if t not in seen:


Post-deploy I checked to see if the no-entry-for-current issue persists, but it does not appear to:

$ sudo efibootmgr -v
BootCurrent: 0002
Timeout: 5 seconds
BootOrder: 0003,0004,0005,0002,0006,0001,0000
Boot0000  ubuntu	HD(1,GPT,e45478ae-8e68-4171-a165-5a8ac6654f30,0x800,0x100000)/File(\EFI\UBUNTU\SHIMX64.EFI)
Boot0002* UEFI: NIC1 IPv4 Quanta Dual Port 10G BASE-T Mezzanine	PciRoot(0x0)/Pci(0x1,0x0)/Pci(0x0,0x0)/MAC(2c600c6fbb15,1)/IPv4(0.0.0.00.0.0.0,0,0)..BO