Adding spdk loader

diskless.pkr.hcl

@@ -343,6 +343,16 @@ build {
       "truncate -s 0 /etc/hostname",
       "install -D -m0644 /tmp/etc-stage/NetworkManager/conf.d/20-hostname.conf /etc/NetworkManager/conf.d/20-hostname.conf",
       "restorecon /etc/NetworkManager/conf.d/20-hostname.conf",
+      # Subscription-manager has no role on a booted, hostname-neutral, immutable
+      # appliance — entitlements only matter at BUILD time (dnf). Left running,
+      # rhsmcertd wakes periodically and tries to write Python __pycache__ into a
+      # bin_t dir on the read-only/overlay root: SELinux denies it (enforcing), so
+      # it's a benign but RECURRING AVC that floods the SIEM (fleet_audit rule
+      # 100120) and can never succeed (tmpfs overlay is wiped each boot). Mask the
+      # daemon + timer to kill the noise and trim attack surface. (Don't waive the
+      # AVC in Wazuh — that would also hide future rhsmcertd_t denials.)
+      "systemctl mask rhsmcertd.service 2>/dev/null || true",
+      "systemctl disable rhsmcertd.service 2>/dev/null || true",
       # Read-only erofs/verity root; runtime state on a tmpfs overlay provided
       # by systemd.volatile=overlay (set in the cmdline by extract-artifacts.sh).
       # RHEL/Rocky dracut has no 'overlayfs'/'rootovl' module.