ci: CC | Add a new job to pull image inside the guest

And let's hope for the buest. :-)

Signed-off-by: Fabiano Fidêncio <[email protected]>

.ci/ci_job_flags.sh

@@ -40,6 +40,9 @@ init_ci_flags() {
 	# Use the forked version of containerd for Confidential Containers
 	# Valyes: "yes|no"
 	export FORKED_CONTAINERD="no"
+	# Do the pull on the guest using the upstream containerd for Confidential Containers
+	# Values: "yes|no"
+	export IMAGE_OFFLOAD_TO_GUEST="no"
 	# Hypervisor to use
 	export KATA_HYPERVISOR=""
 	# Install k8s
@@ -131,6 +134,20 @@ case "${CI_JOB}" in
 			;;
 	esac
 	;;
+"CC_CRI_CONTAINERD_K8S_IMAGE_OFFLOAD_TO_GUEST")
+	# This job only tests containerd + k8s
+	init_ci_flags
+	export CRI_CONTAINERD="yes"
+	export CRI_RUNTIME="containerd"
+	export KATA_HYPERVISOR="qemu"
+	export KUBERNETES="yes"
+	# Export any CC specific environment variables
+	export KATA_BUILD_CC="yes"
+	export FORKED_CONTAINERD="no"
+	export IMAGE_OFFLOAD_TO_GUEST="yes"
+	export MEASURED_ROOTFS="yes"
+	export AA_KBC="offline_fs_kbc"
+	;;
 "CC_SEV_CRI_CONTAINERD_K8S"|"CC_SNP_CRI_CONTAINERD_K8S")
 	init_ci_flags
 	export CRI_CONTAINERD="yes"

.ci/run.sh

@@ -83,7 +83,7 @@ case "${CI_JOB}" in
 		info "Running Confidential Containers tests for AMD SEV-SNP"
 		sudo -E PATH="$PATH" CRI_RUNTIME="containerd" bash -c "make cc-snp-kubernetes"
 		;;
-	"CC_CRI_CONTAINERD_K8S"|"CC_CRI_CONTAINERD_K8S_TDX_QEMU"|"CC_CRI_CONTAINERD_K8S_SE_QEMU"|"CC_CRI_CONTAINERD_K8S_TDX_CLOUD_HYPERVISOR")
+	"CC_CRI_CONTAINERD_K8S"|"CC_CRI_CONTAINERD_K8S_TDX_QEMU"|"CC_CRI_CONTAINERD_K8S_SE_QEMU"|"CC_CRI_CONTAINERD_K8S_TDX_CLOUD_HYPERVISOR"|"CC_CRI_CONTAINERD_K8S_IMAGE_OFFLOAD_TO_GUEST")
 		info "Running Confidential Container tests"
 		sudo -E PATH="$PATH" CRI_RUNTIME="containerd" bash -c "make cc-kubernetes"
 		;;