kata-deploy: Add erofsSnapshotterMode helm value and integrity mode

Expose erofsSnapshotterMode in the helm chart values and render it as
the EROFS_SNAPSHOTTER_MODE environment variable in the kata-deploy pod.

Update gha-run-k8s-common.sh to load dm-mod/dm-verity kernel modules
and configure the erofs default size when the mode is "integrity".

Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>

tests/gha-run-k8s-common.sh

@@ -615,6 +615,19 @@ function deploy_k8s() {
 				# Load the erofs module
 				sudo modprobe erofs
 
+				# Load device-mapper and dm-verity kernel modules.
+				if [[ "${EROFS_SNAPSHOTTER_MODE:-}" == "integrity" ]]; then
+					sudo modprobe dm-mod
+					sudo modprobe dm-verity
+
+					# Verify modules loaded successfully
+					if [[ ! -d /sys/module/dm_verity ]]; then
+						>&2 echo "ERROR: dm_verity kernel module not available after modprobe"
+						>&2 echo "dm-verity support requires dm-mod and dm-verity kernel modules"
+						exit 1
+					fi
+				fi
+
 				# Ensure fsverity is enabled on the disk, otherwise
 				# fsverity won't work on the erofs-snapshotter side.
 				#
@@ -853,6 +866,9 @@ function helm_helper() {
 				memory)
 					erofs_default_size="0"
 					;;
+				integrity)
+					erofs_default_size="10G"
+					;;
 				*)
 					die "Unsupported EROFS_SNAPSHOTTER_MODE: ${EROFS_SNAPSHOTTER_MODE}"
 					;;
@@ -863,6 +879,10 @@ function helm_helper() {
 
 			HELM_CONTAINERD_USER_DROP_IN="${HELM_CONTAINERD_USER_DROP_IN}" \
 				yq -i '.containerd.userDropIn = strenv(HELM_CONTAINERD_USER_DROP_IN)' "${values_yaml}"
+
+			# Pass the mode to kata-deploy so the Rust binary can configure
+			# containerd erofs plugin options (fsverity, dmverity, etc.) natively.
+			yq -i ".snapshotter.erofsSnapshotterMode = \"${EROFS_SNAPSHOTTER_MODE}\"" "${values_yaml}"
 		fi
 
 		# EROFS merge mode ("merged" default, or "unmerged"). This is orthogonal

tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl

@@ -581,6 +581,10 @@ e.g. `{{- include "kata-deploy.commonEnv" . | nindent 8 }}`.
 - name: EROFS_MERGE_MODE
   value: {{ $erofsMergeMode | quote }}
 {{- end }}
+{{- if .Values.snapshotter.erofsSnapshotterMode | trim }}
+- name: EROFS_SNAPSHOTTER_MODE
+  value: {{ .Values.snapshotter.erofsSnapshotterMode | trim | quote }}
+{{- end }}
 {{- $forceGuestPullAmd64 := include "kata-deploy.getForceGuestPullForArch" (dict "root" . "arch" "amd64") | trim -}}
 {{- if $forceGuestPullAmd64 }}
 - name: EXPERIMENTAL_FORCE_GUEST_PULL_X86_64

tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml

@@ -283,6 +283,10 @@ snapshotter:
   # erofs snapshotter. When empty, kata-deploy uses its built-in default
   # (merged).
   erofsMergeMode: ""
+  # EROFS snapshotter mode. When set to "integrity", dm-verity is enabled
+  # and fsverity/immutable are disabled for erofs layers.
+  # Valid values: "" (default) or "integrity".
+  erofsSnapshotterMode: ""
 
 # Shim configuration
 # By default (disableAll: false), all shims with enabled: ~ (null) are enabled.