Turn off kiosk by default

files/dracut/95dot1x-macsec/nvmf-connect.sh

@@ -29,11 +29,26 @@ _trsvcid=${_rest##*,}
 # nvme_tcp is usually auto-loaded; ensure it so /dev/nvme-fabrics exists.
 modprobe nvme_tcp 2>/dev/null
 
+# Keep-alive / reconnect tuning for the ROOT device. These persist across
+# switch-root (the in-kernel nvme-tcp controller and its opts survive).
+#   -k 30  keep-alive timeout (s). The 5s default means a KA every 2.5s; under
+#          kiosk CPU/memory pressure the nvme-tcp keep-alive work can be delayed
+#          past 5s, the target sees no KA and disconnects ("keep alive timeout").
+#          30s gives a 15s emit interval and far more slack.
+#   -l -1  ctrl-loss-tmo = retry reconnection forever. This is the rootfs: the
+#          600s default makes the host GIVE UP after a blip, after which root I/O
+#          fails permanently and the box wedges — strictly worse than retrying.
+#   -c 10  wait 10s between reconnect attempts.
+_kato=30
+_ctrl_loss_tmo=-1
+_reconnect_delay=10
+
 # Networking (ip=dhcp) is brought up in parallel, so poll-and-connect until a
 # fabrics namespace appears or we time out. connect-all is idempotent.
 _i=0
 while [ "$_i" -lt 60 ]; do
-    nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" 2>/dev/null
+    nvme connect-all -t "$_trtype" -a "$_traddr" -s "$_trsvcid" \
+        -k "$_kato" -l "$_ctrl_loss_tmo" -c "$_reconnect_delay" 2>/dev/null
     for _ns in /dev/nvme[0-9]*n[0-9]*; do
         if [ -b "$_ns" ]; then
             mkdir -p /run/dot1x