kata-deploy: Configure containerd erofs for dm-verity integrity mode

The deploy will read EROFS_SNAPSHOTTER_MODE from the environment and,
when set to "integrity", disable fsverity/immutable and enable
dmverity_mode and enable_dmverity in the containerd erofs
snapshotter/differ config.

Add validation for the mode value and use an explicit 300s timeout
for node-readiness checks during kata-deply in github CI.

Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>

tools/packaging/kata-deploy/binary/src/artifacts/snapshotters.rs

@@ -74,17 +74,28 @@ pub async fn configure_erofs_snapshotter(config: &Config, configuration_file: &P
         "[\"erofs\",\"walking\"]",
     )?;
 
+    // In integrity mode, fsverity and immutable are disabled in favor of dm-verity.
+    let is_integrity = config.erofs_snapshotter_mode.as_deref() == Some("integrity");
+
     toml_utils::set_toml_value(
         configuration_file,
         ".plugins.\"io.containerd.snapshotter.v1.erofs\".enable_fsverity",
-        "true",
+        if is_integrity { "false" } else { "true" },
     )?;
     toml_utils::set_toml_value(
         configuration_file,
         ".plugins.\"io.containerd.snapshotter.v1.erofs\".set_immutable",
-        "true",
+        if is_integrity { "false" } else { "true" },
     )?;
 
+    if is_integrity {
+        toml_utils::set_toml_value(
+            configuration_file,
+            ".plugins.\"io.containerd.snapshotter.v1.erofs\".dmverity_mode",
+            "\"auto\"",
+        )?;
+    }
+
     // Erofs differ plugin options (requires erofs-utils >= 1.8.2 on the host).
     toml_utils::set_toml_value(
         configuration_file,
@@ -97,6 +108,14 @@ pub async fn configure_erofs_snapshotter(config: &Config, configuration_file: &P
         "false",
     )?;
 
+    if is_integrity {
+        toml_utils::set_toml_value(
+            configuration_file,
+            ".plugins.\"io.containerd.differ.v1.erofs\".enable_dmverity",
+            "true",
+        )?;
+    }
+
     toml_utils::set_toml_value(
         configuration_file,
         ".plugins.\"io.containerd.snapshotter.v1.erofs\".default_size",

tools/packaging/kata-deploy/binary/src/config.rs

@@ -199,6 +199,9 @@ pub struct Config {
     pub daemonset_name: String,
     pub custom_runtimes_enabled: bool,
     pub custom_runtimes: Vec<CustomRuntime>,
+    /// EROFS snapshotter mode (e.g., "integrity").
+    /// When set to "integrity", dm-verity is enabled and fsverity/immutable are disabled.
+    pub erofs_snapshotter_mode: Option<String>,
 }
 
 impl Config {
@@ -337,6 +340,12 @@ impl Config {
             Vec::new()
         };
 
+        // EROFS snapshotter mode (e.g. "integrity" for dm-verity support)
+        let erofs_snapshotter_mode = env::var("EROFS_SNAPSHOTTER_MODE")
+            .ok()
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty());
+
         let config = Config {
             node_name,
             debug,
@@ -365,6 +374,7 @@ impl Config {
             daemonset_name,
             custom_runtimes_enabled,
             custom_runtimes,
+            erofs_snapshotter_mode,
         };
 
         // Validate the configuration
@@ -546,6 +556,19 @@ impl Config {
             }
         }
 
+        // Validate EROFS_SNAPSHOTTER_MODE
+        if let Some(mode) = self.erofs_snapshotter_mode.as_ref() {
+            match mode.as_str() {
+                "disk" | "memory" | "integrity" => {}
+                _ => {
+                    return Err(anyhow::anyhow!(
+                        "Unsupported EROFS_SNAPSHOTTER_MODE: '{}'. Supported values: disk, memory, integrity",
+                        mode
+                    ));
+                }
+            }
+        }
+
         Ok(())
     }
 

tools/packaging/kata-deploy/binary/src/main.rs

@@ -809,7 +809,7 @@ async fn reset(config: &config::Config, runtime: &str) -> Result<()> {
     if matches!(runtime, "crio" | "containerd") {
         utils::host_systemctl(&["restart", "kubelet"])?;
     }
-    runtime::lifecycle::wait_till_node_is_ready(config).await?;
+    runtime::lifecycle::wait_till_node_is_ready_timeout(config, Some(300)).await?;
 
     info!("Kata Containers reset completed successfully");
     Ok(())

tools/packaging/kata-deploy/binary/src/runtime/lifecycle.rs

@@ -11,6 +11,7 @@ use log::info;
 use std::time::Duration;
 use tokio::time::sleep;
 
+#[allow(dead_code)]
 pub async fn wait_till_node_is_ready(config: &Config) -> Result<()> {
     wait_till_node_is_ready_timeout(config, None).await
 }
@@ -83,7 +84,7 @@ pub async fn restart_runtime(config: &Config, runtime: &str) -> Result<()> {
     }
 
     info!("restart_runtime: Waiting for node to become ready");
-    wait_till_node_is_ready(config).await?;
+    wait_till_node_is_ready_timeout(config, Some(300)).await?;
     info!("restart_runtime: Node is ready");
     Ok(())
 }