From 8a7be7af699ab521cb168ab52d0cff53bcb46276 Mon Sep 17 00:00:00 2001
From: Alex Lyn <alex.lyn@antgroup.com>
Date: Tue, 16 Jun 2026 15:41:33 +0800
Subject: [PATCH] kata-deploy: Add erofsSnapshotterMode helm value and
 integrity mode

Expose erofsSnapshotterMode in the helm chart values and render it as
the EROFS_SNAPSHOTTER_MODE environment variable in the kata-deploy pod.

Update gha-run-k8s-common.sh to load dm-mod/dm-verity kernel modules
and configure the erofs default size when the mode is "integrity".

Signed-off-by: Alex Lyn <alex.lyn@antgroup.com>
---
 tests/gha-run-k8s-common.sh                   | 20 +++++++++++++++++++
 .../kata-deploy/templates/_helpers.tpl        |  4 ++++
 .../helm-chart/kata-deploy/values.yaml        |  4 ++++
 3 files changed, 28 insertions(+)

diff --git a/tests/gha-run-k8s-common.sh b/tests/gha-run-k8s-common.sh
index f8850e810d..0526e6219a 100644
--- a/tests/gha-run-k8s-common.sh
+++ b/tests/gha-run-k8s-common.sh
@@ -615,6 +615,19 @@ function deploy_k8s() {
 				# Load the erofs module
 				sudo modprobe erofs
 
+				# Load device-mapper and dm-verity kernel modules.
+				if [[ "${EROFS_SNAPSHOTTER_MODE:-}" == "integrity" ]]; then
+					sudo modprobe dm-mod
+					sudo modprobe dm-verity
+
+					# Verify modules loaded successfully
+					if [[ ! -d /sys/module/dm_verity ]]; then
+						>&2 echo "ERROR: dm_verity kernel module not available after modprobe"
+						>&2 echo "dm-verity support requires dm-mod and dm-verity kernel modules"
+						exit 1
+					fi
+				fi
+
 				# Ensure fsverity is enabled on the disk, otherwise
 				# fsverity won't work on the erofs-snapshotter side.
 				#
@@ -853,6 +866,9 @@ function helm_helper() {
 				memory)
 					erofs_default_size="0"
 					;;
+				integrity)
+					erofs_default_size="10G"
+					;;
 				*)
 					die "Unsupported EROFS_SNAPSHOTTER_MODE: ${EROFS_SNAPSHOTTER_MODE}"
 					;;
@@ -863,6 +879,10 @@ function helm_helper() {
 
 			HELM_CONTAINERD_USER_DROP_IN="${HELM_CONTAINERD_USER_DROP_IN}" \
 				yq -i '.containerd.userDropIn = strenv(HELM_CONTAINERD_USER_DROP_IN)' "${values_yaml}"
+
+			# Pass the mode to kata-deploy so the Rust binary can configure
+			# containerd erofs plugin options (fsverity, dmverity, etc.) natively.
+			yq -i ".snapshotter.erofsSnapshotterMode = \"${EROFS_SNAPSHOTTER_MODE}\"" "${values_yaml}"
 		fi
 
 		# EROFS merge mode ("merged" default, or "unmerged"). This is orthogonal
diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl
index 24f309ae3c..08269b4fdd 100644
--- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl
+++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/templates/_helpers.tpl
@@ -581,6 +581,10 @@ e.g. `{{- include "kata-deploy.commonEnv" . | nindent 8 }}`.
 - name: EROFS_MERGE_MODE
   value: {{ $erofsMergeMode | quote }}
 {{- end }}
+{{- if .Values.snapshotter.erofsSnapshotterMode | trim }}
+- name: EROFS_SNAPSHOTTER_MODE
+  value: {{ .Values.snapshotter.erofsSnapshotterMode | trim | quote }}
+{{- end }}
 {{- $forceGuestPullAmd64 := include "kata-deploy.getForceGuestPullForArch" (dict "root" . "arch" "amd64") | trim -}}
 {{- if $forceGuestPullAmd64 }}
 - name: EXPERIMENTAL_FORCE_GUEST_PULL_X86_64
diff --git a/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml b/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml
index 7832ddb995..e786bbfffc 100644
--- a/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml
+++ b/tools/packaging/kata-deploy/helm-chart/kata-deploy/values.yaml
@@ -283,6 +283,10 @@ snapshotter:
   # erofs snapshotter. When empty, kata-deploy uses its built-in default
   # (merged).
   erofsMergeMode: ""
+  # EROFS snapshotter mode. When set to "integrity", dm-verity is enabled
+  # and fsverity/immutable are disabled for erofs layers.
+  # Valid values: "" (default) or "integrity".
+  erofsSnapshotterMode: ""
 
 # Shim configuration
 # By default (disableAll: false), all shims with enabled: ~ (null) are enabled.