Support disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu (#11296)

Signed-off-by: tu1h <lihai.tu@daocloud.io>

roles/bootstrap-os/defaults/main.yml

@@ -11,6 +11,10 @@ coreos_locksmithd_disable: false
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true
 
+## Ubuntu specific variables
+# Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
+ubuntu_kernel_unattended_upgrades_disabled: false
+
 fedora_coreos_packages:
   - python
   - python3-libselinux

roles/bootstrap-os/tasks/debian.yml

@@ -62,3 +62,14 @@
     - '"changed its" in bootstrap_update_apt_result.stdout'
     - '"value from" in bootstrap_update_apt_result.stdout'
   ignore_errors: true
+
+- name: Disable kernel unattended-upgrades
+  lineinfile:
+    path: /etc/apt/apt.conf.d/50unattended-upgrades
+    insertafter: "Unattended-Upgrade::Package-Blacklist"
+    line: '"linux-";'
+    state: present
+  become: true
+  when:
+    - os_release_dict['ID'] == 'ubuntu'
+    - ubuntu_kernel_unattended_upgrades_disabled