On updates, Flatcar should download the wanted extension images when the Nebraska response returns them as additional packages. There are two types of extension images, the OEM extensions and the optional Flatcar extensions (e.g., K8s). Only one OEM is downloaded, as specified through the ID= field from /oem/oem-release. The optional extensions are specified in /etc/flatcar/enabled-sysext.conf (contains the names per line and supports # comments).
The ticket for this is #768
As subtask, we want to use a special ue-rs binary in the post-install action to download the extension images. This means less changes to update-engine but still some are needed.

From update-engine we should pass the XML response to the special binary when invoking it from the start of the post-install action. Note that this binary is to be loaded from the new partition and its temporary mount point. When no XML response is available in the post install action because the update-engine calling it is too old, we have to fall back to a hardcoded URL scheme to download the extension update payloads. What parts are done in bash vs what parts are done in the special ue-rs binary is a tradeoff. During development it will help if the ue-rs binary can be started manually with arguments that overwrite the defaults so that it's suitable for local development.
#768 describes two paths where the extracted OEM extension images will be stored after protobuf parsing and signature verification; the OEM path is preferred, the rootfs path is a fallback when the OEM partition is too small. The post-install action will also check if both the old and new OS versions have a sysext available and then create the active-oem-OEMID flag file for the sysext to be used on next boot.