gha: fix issue in containerd switching between different snapshotters…

… on CI

we are encountering the issue (kata-containers#8407)
with containerd on CI is likely due to the content digest being missing from the content store,
which can happen when switching between different snapshotters.
To help sort it out on CI, we now clean up related snapshots or images in k8s.io namespace.

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>

tests/integration/kubernetes/run_kubernetes_tests.sh

@@ -14,6 +14,7 @@ TARGET_ARCH="${TARGET_ARCH:-x86_64}"
 KATA_HYPERVISOR="${KATA_HYPERVISOR:-qemu}"
 K8S_TEST_DEBUG="${K8S_TEST_DEBUG:-false}"
 K8S_TEST_HOST_TYPE="${K8S_TEST_HOST_TYPE:-small}"
+PULL_TYPE="${PULL_TYPE:-default}"
 
 ALLOW_ALL_POLICY="${ALLOW_ALL_POLICY:-$(base64 -w 0 runtimeclass_workloads_work/allow-all.rego)}"
 
@@ -88,6 +89,10 @@ else
 	esac
 fi
 
+check_pull_type(){
+	[ "${PULL_TYPE}" == "guest-pull" ] || [ "${PULL_TYPE}" == "host-share-image-block" ]
+}
+
 policy_tests_enabled() {
 	# The Guest images for these platforms have been built using AGENT_POLICY=yes -
 	# see kata-deploy-binaries.sh.
@@ -166,6 +171,33 @@ if [ -f "${arch_config_file}" ]; then
 	mapfile -d " " -t K8S_TEST_UNION <<< "${arch_k8s_test_union}"
 fi
 
+if check_pull_type; then
+	# we are encountering the issue (https://github.com/kata-containers/kata-containers/issues/8407)
+	# with containerd on CI is likely due to the content digest being missing from the content store,
+	# which can happen when switching between different snapshotters.
+	# To help sort it out, we now clean up or fetch related images in k8s.io namespace.
+	ctr_args=""
+	if [ "${KUBERNETES}" = "k3s" ]; then
+		ctr_args="--address /run/k3s/containerd/containerd.sock "
+	fi
+	ctr_args+="--namespace k8s.io"
+	ctr_command="sudo -E ctr ${ctr_args}"
+	pause_images=$(${ctr_command} i ls | grep 'pause' | awk '{print $1}')
+	for image in $pause_images; do
+		${ctr_command} content fetch "$image"
+	done
+	# remove related images in k8s.io namespace
+	images_to_remove=(
+		"quay.io/sjenning/nginx:1.15-alpine"
+		"quay.io/prometheus/busybox:latest"
+		"quay.io/confidential-containers/test-images:largeimage"
+	)
+
+	for image in "${images_to_remove[@]}"; do
+    	${ctr_command} i remove "$image" || true
+	done
+fi
+
 if policy_tests_enabled; then
 	ensure_yq
 	run_policy_specific_tests