Allow kernel command update in case of immutable os (#209)

niket-intc · web-flow · commit 1080e74deaf6 · 2025-10-31T17:11:40.000+05:30
diff --git a/.github/workflows/pre-merge.yml b/.github/workflows/pre-merge.yml
@@ -103,6 +103,7 @@ jobs:
       prefix_tag_separator: "/"
       project_folder: ${{ matrix.project_folder }}
       trivy_image_skip: "postgres:16.4"
+      trivy_config_path: '${{ matrix.project_folder }}/trivy.yaml'
     secrets:
       NO_AUTH_ECR_PUSH_USERNAME: ${{ secrets.NO_AUTH_ECR_PUSH_USERNAME }}
       NO_AUTH_ECR_PUSH_PASSWD: ${{ secrets.NO_AUTH_ECR_PUSH_PASSWD }}
diff --git a/host/.trivyignore b/host/.trivyignore
@@ -92,3 +92,14 @@ CVE-2023-5981
 CVE-2024-2236
 CVE-2023-4039
 CVE-2023-4039
+
+CVE-2025-47912
+CVE-2025-58183
+CVE-2025-58185
+CVE-2025-58186
+CVE-2025-58187
+CVE-2025-58188
+CVE-2025-58189
+CVE-2025-61723
+CVE-2025-61724
+CVE-2025-61725
diff --git a/host/trivy.yaml b/host/trivy.yaml
@@ -0,0 +1,5 @@
+---
+# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+
+ignorefile: host/.trivyignore
diff --git a/maintenance/.trivyignore b/maintenance/.trivyignore
@@ -49,3 +49,14 @@ CVE-2024-2236
 CVE-2024-33600
 CVE-2024-33601
 CVE-2024-33602
+
+CVE-2025-47912
+CVE-2025-58183
+CVE-2025-58185
+CVE-2025-58186
+CVE-2025-58187
+CVE-2025-58188
+CVE-2025-58189
+CVE-2025-61723
+CVE-2025-61724
+CVE-2025-61725
diff --git a/maintenance/VERSION b/maintenance/VERSION
@@ -1 +1 @@
-1.23.6-dev
+1.23.6
diff --git a/maintenance/pkg/maintmgr/grpc_server.go b/maintenance/pkg/maintmgr/grpc_server.go
@@ -182,6 +182,15 @@ func populateImmutableUpdateDetails(
 	policy *computev1.OSUpdatePolicyResource,
 	tenantID, profileName, guid string,
 ) error {
+	resp.UpdateSource.KernelCommand = policy.GetUpdateKernelCommand()
+
+	// If KernelCommand is set in the OSUpdatePolicy, skip fetching the OS resource
+	// as we will not update the OS in this case.
+	if resp.UpdateSource.KernelCommand != "" {
+		zlog.Debug().Msgf("Skipping OS resource fetch as KernelCommand is set in OSUpdatePolicy: tenantID=%s", tenantID)
+		return nil
+	}
+
 	osRes, err := getUpdateOS(ctx, invMgrCli.InvClient, tenantID, profileName, policy)
 	if err != nil {
 		zlog.InfraSec().InfraErr(err).Msgf("PlatformUpdateStatus: tenantID=%s, UUID=%s", tenantID, guid)
diff --git a/maintenance/trivy.yaml b/maintenance/trivy.yaml
@@ -0,0 +1,5 @@
+---
+# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+
+ignorefile: maintenance/.trivyignore
diff --git a/networking/.trivyignore b/networking/.trivyignore
@@ -48,4 +48,15 @@ CVE-2023-5981
 CVE-2024-2236
 CVE-2024-33600
 CVE-2024-33601
-CVE-2024-33602
+CVE-2024-33602
+
+CVE-2025-47912
+CVE-2025-58183
+CVE-2025-58185
+CVE-2025-58186
+CVE-2025-58187
+CVE-2025-58188
+CVE-2025-58189
+CVE-2025-61723
+CVE-2025-61724
+CVE-2025-61725
diff --git a/networking/VERSION b/networking/VERSION
@@ -1 +1 @@
-1.19.1-dev
+1.19.1
diff --git a/networking/trivy.yaml b/networking/trivy.yaml
@@ -0,0 +1,5 @@
+---
+# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+
+ignorefile: networking/.trivyignore
diff --git a/os-resource/.trivyignore b/os-resource/.trivyignore
@@ -9,3 +9,15 @@ CVE-2023-6780
 
 # we have OAM HealthCheck
 DS026
+
+CVE-2025-47912
+CVE-2025-58183
+CVE-2025-58185
+CVE-2025-58186
+CVE-2025-58187
+CVE-2025-58188
+CVE-2025-58189
+CVE-2025-61723
+CVE-2025-61724
+CVE-2025-61725
+
diff --git a/os-resource/VERSION b/os-resource/VERSION
@@ -1 +1 @@
-0.19.4
+0.19.5-dev
diff --git a/os-resource/trivy.yaml b/os-resource/trivy.yaml
@@ -0,0 +1,5 @@
+---
+# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+
+ignorefile: os-resource/.trivyignore
diff --git a/telemetry/.trivyignore b/telemetry/.trivyignore
@@ -92,3 +92,14 @@ CVE-2023-5981
 CVE-2024-2236
 CVE-2023-4039
 CVE-2023-4039
+
+CVE-2025-47912
+CVE-2025-58183
+CVE-2025-58185
+CVE-2025-58186
+CVE-2025-58187
+CVE-2025-58188
+CVE-2025-58189
+CVE-2025-61723
+CVE-2025-61724
+CVE-2025-61725
diff --git a/telemetry/VERSION b/telemetry/VERSION
@@ -1 +1 @@
-1.23.1-dev
+1.23.1
diff --git a/telemetry/trivy.yaml b/telemetry/trivy.yaml
@@ -0,0 +1,5 @@
+---
+# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
+# SPDX-License-Identifier: Apache-2.0
+
+ignorefile: telemetry/.trivyignore
