From 71a3bf0e3e42117e7283b41116419d7d2f28d82c Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Mon, 13 Nov 2023 16:28:24 +0400 Subject: [PATCH] fix: allow extra kernel args for secureboot installer With SecureBoot, kernel args are part of the UKI (and signed), so we need to allow kernel args when building an installer, as this is the only way to allow updating kernel args in SecureBoot mode. Signed-off-by: Andrey Smirnov --- pkg/imager/profile/profile.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/imager/profile/profile.go b/pkg/imager/profile/profile.go index 1fa2194b11..b4c483b148 100644 --- a/pkg/imager/profile/profile.go +++ b/pkg/imager/profile/profile.go @@ -84,8 +84,8 @@ func (p *Profile) Validate() error { return fmt.Errorf("disk size is required for image output") } case OutKindInstaller: - if len(p.Customization.ExtraKernelArgs) > 0 { - return fmt.Errorf("customization of kernel args is not supported for %s output", p.Output.Kind) + if !p.SecureBootEnabled() && len(p.Customization.ExtraKernelArgs) > 0 { + return fmt.Errorf("customization of kernel args is not supported for %s output in !secureboot mode", p.Output.Kind) } if len(p.Customization.MetaContents) > 0 {