Manuel Huber 9b5897bc55 kata-deploy: shift erofs dm-verity mode to on ...

dmverity_mode=auto can preserve existing EROFS layers without
dm-verity metadata, which lets mixed-mode nodes keep running with
partially unprotected image layers.

Use dmverity_mode=on when kata-deploy enables EROFS dm-verity so
missing metadata is reported instead of silently accepted.

Also tighten the Kubernetes probe. Instead of checking for at least one
dm-verity line and one EROFS dm mount in dmesg, derive the expected
workload layer count from the root overlay lowerdirs and require matching
kata-verity devices and dm-backed EROFS mounts.

Signed-off-by: Manuel Huber <manuelh@nvidia.com>
Assisted-by: OpenAI Codex <codex@openai.com>

2026-07-14 18:07:32 +00:00

..

confidential

…

cryptsetup

…

numa

tests: Add NUMA topology / GPU placement tests to the NV CIs

2026-05-24 22:00:46 +02:00

openvpn

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

stress

…

busybox-pod.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

busybox-template.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

configmap.yaml

…

cron-job.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

custom-node-debugger.yaml

…

default-initdata.toml

…

footloose-configmap.yaml

…

initContainer-shared-volume.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

initcontainer-shareprocesspid.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

inject_secret.yaml

…

inotify-configmap-pod.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

inotify-configmap.yaml

…

inotify-updated-configmap.yaml

…

job-template.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

job.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

k8s-layered-sc-deployment.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

k8s-pod-sc-deployment.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

k8s-pod-sc-nobodyupdate-deployment.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

k8s-pod-sc-supplementalgroups-deployment.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

k8s-policy-configmap.yaml

…

k8s-policy-deployment.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

k8s-policy-hard-coded.yaml

…

k8s-policy-job.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

k8s-policy-pod-pvc.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

k8s-policy-pod.yaml

genpolicy: support pod-level resources

2026-06-16 15:30:22 +02:00

k8s-policy-pvc.yaml

…

k8s-policy-rc.yaml

genpolicy: ignore preemptionPolicy

2026-05-06 00:35:27 +00:00

k8s-policy-set-keys.rego

…

k8s-policy-set-keys.yaml

…

k8s-priority-class.yaml

…

kata-runtimeclass.yaml

…

lifecycle-events.yaml

…

limit-range.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

nginx-deployment.yaml

…

no-layer-image.yaml

…

numa-topology-gpu-test.yaml.in

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

numa-topology-test.yaml.in

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

nvidia-cuda-vectoradd.yaml.in

…

nvidia-nim-llama-3-1-8b-instruct-tee.yaml.in

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

nvidia-nim-llama-3-1-8b-instruct.yaml.in

…

nvidia-nim-llama-3-2-1b-instruct-service-tee.yaml.in

tests: nvidia: onboard NIM service test

2026-04-02 16:58:54 +02:00

nvidia-nim-llama-3-2-1b-instruct-service.yaml.in

tests: nvidia: onboard NIM service test

2026-04-02 16:58:54 +02:00

nvidia-nim-llama-3-2-nv-embedqa-1b-v2-tee.yaml.in

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

nvidia-nim-llama-3-2-nv-embedqa-1b-v2.yaml.in

…

pod-attestable-gpu.yaml.in

…

pod-attestable.yaml.in

…

pod-besteffort.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-block-pv.yaml

…

pod-burstable.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-caps.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-confidential-unencrypted.yaml

…

pod-config.yaml.in

…

pod-configmap-volume.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-configmap.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-cpu-defaults.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-cpu.yaml

tests: harden sandbox sizing manifests for k8s cpu workloads

2026-06-25 13:56:11 +02:00

pod-custom-dns.yaml

…

pod-empty-dir-fsgroup.yaml.in

…

pod-empty-dir.yaml

tests: test emptyDir sizeLimit eviction with virtio-fs

2026-06-30 09:10:00 -05:00

pod-env.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-erofs-dmverity-probe.yaml

kata-deploy: shift erofs dm-verity mode to on

2026-07-14 18:07:32 +00:00

pod-file-volume.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-footloose.yaml

…

pod-graceful-termination.yaml

agent: send SIGTERM only to root container process on container deletion

2026-07-13 22:39:42 +02:00

pod-guaranteed.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-guest-pull-in-trusted-storage.yaml.in

runtime-rs: size static sandboxes with overhead values

2026-06-25 13:56:11 +02:00

pod-hostname.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-hostpath-kmsg.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-http-liveness.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-hugepage.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

pod-istio.yaml

…

pod-liveness.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-memory-limit.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

pod-nested-configmap-secret.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-number-cpu.yaml

tests: add supplementalGroups to pod-number-cpu for guest-pull

2026-06-30 15:50:15 +02:00

pod-oom.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

pod-optional-empty-configmap.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-optional-empty-secret.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-plain-ephemeral-data-storage.yaml.in

tests: cover block-plain emptyDir storage

2026-06-26 21:05:51 +00:00

pod-privileged.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-projected-volume.yaml

…

pod-quota-deployment.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-readonly-volume.yaml

…

pod-sandbox-cgroup.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-sandbox-vcpus-allocation.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-sealed-secret-as-file.yaml

…

pod-sealed-secret.yaml

…

pod-seccomp.yaml

…

pod-secret-env.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-secret.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-security-context.yaml

…

pod-shared-volume.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-smb-volume.yaml

ci: Introduce smb server test

2026-04-23 21:04:46 -05:00

pod-sysctl.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-tcp-liveness.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-termination-log-fail.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-termination-log-success.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pod-trusted-ephemeral-data-storage.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pv-pod.yaml

tests: pin identity in policy workloads

2026-06-25 23:40:36 +00:00

pv-volume.yaml

…

redis-master-deployment.yaml

tests: use limits for Kata workload manifests

2026-06-19 09:38:15 -07:00

redis-master-service.yaml

…

replication-controller.yaml

…

resource-quota.yaml

…

smb-server.yaml

ci: Introduce smb server test

2026-04-23 21:04:46 -05:00

tests-namespace.yaml

…

volume-claim.yaml

…