gha: fix issue in containerd switching between different snapshotters…

… on CI

we are encountering the issue (kata-containers#8407)
with containerd on CI is likely due to the content digest being missing from the content store,
which can happen when switching between different snapshotters.
To help sort it out on CI, we now clean up related snapshots or images in k8s.io namespace.

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>

tests/integration/kubernetes/confidential_common.sh

@@ -59,5 +59,5 @@ function confidential_setup() {
         return 1
     elif [[ " ${SUPPORTED_NON_TEE_HYPERVISORS[*]} " =~ " ${KATA_HYPERVISOR} " ]]; then
         info "Need to apply image annotations"
-    fi
+    fi	
 }

tests/integration/kubernetes/gha-run.sh

@@ -541,7 +541,6 @@ function cleanup_nydus_snapshotter() {
 	kubectl delete -f "misc/snapshotter/nydus-snapshotter-rbac.yaml"
 	kubectl get namespace nydus-system -o json | jq 'del(.spec.finalizers)' | kubectl replace --raw "/api/v1/namespaces/nydus-system/finalize" -f - || true
 	popd
-	sudo rm -rf /var/lib/containerd-nydus
 	sleep 30s
 	echo "::endgroup::"
 }

tests/integration/kubernetes/run_kubernetes_tests.sh

@@ -167,6 +167,24 @@ if [ -f "${arch_config_file}" ]; then
 fi
 
 if policy_tests_enabled; then
+	# we are encountering the issue (https://github.com/kata-containers/kata-containers/issues/8407)
+	# with containerd on CI is likely due to the content digest being missing from the content store,
+	# which can happen when switching between different snapshotters.
+	# To help sort it out, we now clean up or fetch related images in k8s.io namespace.
+	ctr_args=""
+	if [ "${KUBERNETES}" = "k3s" ]; then
+		ctr_args="--address /run/k3s/containerd/containerd.sock "
+	fi
+	ctr_args+="--namespace k8s.io"
+	ctr_command="sudo ctr ${ctr_args}"
+	pause_images=$(${ctr_command} i ls | grep 'pause' | awk '{print $1}')
+	for image in $pause_images; do
+        ${ctr_command} content fetch "$image"
+    done
+	# remove related images in k8s.io namespace
+	${ctr_command} i rm quay.io/sjenning/nginx:1.15-alpine || true
+	${ctr_command} i rm quay.io/prometheus/busybox:latest || true
+	${ctr_command} i rm quay.io/confidential-containers/test-images:largeimage || true
 	ensure_yq
 	run_policy_specific_tests
 	add_policy_to_successful_tests