From 2c8358454dd6ab7ef8b2c0ce63d76153e8b042fe Mon Sep 17 00:00:00 2001 From: Alex Lyn Date: Tue, 16 Jun 2026 15:19:37 +0800 Subject: [PATCH] kata-deploy: Configure containerd erofs for dm-verity integrity mode The deploy will read EROFS_SNAPSHOTTER_MODE from the environment and, when set to "integrity", disable fsverity/immutable and enable dmverity_mode and enable_dmverity in the containerd erofs snapshotter/differ config. Add validation for the mode value and use an explicit 300s timeout for node-readiness checks during kata-deply in github CI. Signed-off-by: Alex Lyn --- .../binary/src/artifacts/snapshotters.rs | 23 +++++++++++++++++-- .../kata-deploy/binary/src/config.rs | 23 +++++++++++++++++++ .../packaging/kata-deploy/binary/src/main.rs | 2 +- .../binary/src/runtime/lifecycle.rs | 3 ++- 4 files changed, 47 insertions(+), 4 deletions(-) diff --git a/tools/packaging/kata-deploy/binary/src/artifacts/snapshotters.rs b/tools/packaging/kata-deploy/binary/src/artifacts/snapshotters.rs index a2b7599d3e..8a6a9c4a08 100644 --- a/tools/packaging/kata-deploy/binary/src/artifacts/snapshotters.rs +++ b/tools/packaging/kata-deploy/binary/src/artifacts/snapshotters.rs @@ -74,17 +74,28 @@ pub async fn configure_erofs_snapshotter(config: &Config, configuration_file: &P "[\"erofs\",\"walking\"]", )?; + // In integrity mode, fsverity and immutable are disabled in favor of dm-verity. + let is_integrity = config.erofs_snapshotter_mode.as_deref() == Some("integrity"); + toml_utils::set_toml_value( configuration_file, ".plugins.\"io.containerd.snapshotter.v1.erofs\".enable_fsverity", - "true", + if is_integrity { "false" } else { "true" }, )?; toml_utils::set_toml_value( configuration_file, ".plugins.\"io.containerd.snapshotter.v1.erofs\".set_immutable", - "true", + if is_integrity { "false" } else { "true" }, )?; + if is_integrity { + toml_utils::set_toml_value( + configuration_file, + ".plugins.\"io.containerd.snapshotter.v1.erofs\".dmverity_mode", + "\"auto\"", + )?; + } + // Erofs differ plugin options (requires erofs-utils >= 1.8.2 on the host). toml_utils::set_toml_value( configuration_file, @@ -97,6 +108,14 @@ pub async fn configure_erofs_snapshotter(config: &Config, configuration_file: &P "false", )?; + if is_integrity { + toml_utils::set_toml_value( + configuration_file, + ".plugins.\"io.containerd.differ.v1.erofs\".enable_dmverity", + "true", + )?; + } + toml_utils::set_toml_value( configuration_file, ".plugins.\"io.containerd.snapshotter.v1.erofs\".default_size", diff --git a/tools/packaging/kata-deploy/binary/src/config.rs b/tools/packaging/kata-deploy/binary/src/config.rs index 4700940740..8fd5c625a6 100644 --- a/tools/packaging/kata-deploy/binary/src/config.rs +++ b/tools/packaging/kata-deploy/binary/src/config.rs @@ -199,6 +199,9 @@ pub struct Config { pub daemonset_name: String, pub custom_runtimes_enabled: bool, pub custom_runtimes: Vec, + /// EROFS snapshotter mode (e.g., "integrity"). + /// When set to "integrity", dm-verity is enabled and fsverity/immutable are disabled. + pub erofs_snapshotter_mode: Option, } impl Config { @@ -337,6 +340,12 @@ impl Config { Vec::new() }; + // EROFS snapshotter mode (e.g. "integrity" for dm-verity support) + let erofs_snapshotter_mode = env::var("EROFS_SNAPSHOTTER_MODE") + .ok() + .map(|s| s.trim().to_string()) + .filter(|s| !s.is_empty()); + let config = Config { node_name, debug, @@ -365,6 +374,7 @@ impl Config { daemonset_name, custom_runtimes_enabled, custom_runtimes, + erofs_snapshotter_mode, }; // Validate the configuration @@ -546,6 +556,19 @@ impl Config { } } + // Validate EROFS_SNAPSHOTTER_MODE + if let Some(mode) = self.erofs_snapshotter_mode.as_ref() { + match mode.as_str() { + "disk" | "memory" | "integrity" => {} + _ => { + return Err(anyhow::anyhow!( + "Unsupported EROFS_SNAPSHOTTER_MODE: '{}'. Supported values: disk, memory, integrity", + mode + )); + } + } + } + Ok(()) } diff --git a/tools/packaging/kata-deploy/binary/src/main.rs b/tools/packaging/kata-deploy/binary/src/main.rs index d015fa05e1..d3cdde3d20 100644 --- a/tools/packaging/kata-deploy/binary/src/main.rs +++ b/tools/packaging/kata-deploy/binary/src/main.rs @@ -809,7 +809,7 @@ async fn reset(config: &config::Config, runtime: &str) -> Result<()> { if matches!(runtime, "crio" | "containerd") { utils::host_systemctl(&["restart", "kubelet"])?; } - runtime::lifecycle::wait_till_node_is_ready(config).await?; + runtime::lifecycle::wait_till_node_is_ready_timeout(config, Some(300)).await?; info!("Kata Containers reset completed successfully"); Ok(()) diff --git a/tools/packaging/kata-deploy/binary/src/runtime/lifecycle.rs b/tools/packaging/kata-deploy/binary/src/runtime/lifecycle.rs index 09c161cd1a..50caca3a7f 100644 --- a/tools/packaging/kata-deploy/binary/src/runtime/lifecycle.rs +++ b/tools/packaging/kata-deploy/binary/src/runtime/lifecycle.rs @@ -11,6 +11,7 @@ use log::info; use std::time::Duration; use tokio::time::sleep; +#[allow(dead_code)] pub async fn wait_till_node_is_ready(config: &Config) -> Result<()> { wait_till_node_is_ready_timeout(config, None).await } @@ -83,7 +84,7 @@ pub async fn restart_runtime(config: &Config, runtime: &str) -> Result<()> { } info!("restart_runtime: Waiting for node to become ready"); - wait_till_node_is_ready(config).await?; + wait_till_node_is_ready_timeout(config, Some(300)).await?; info!("restart_runtime: Node is ready"); Ok(()) }