tests: Run authenticated tests with experimental_force_guest_pull

As it should be supported.

Signed-off-by: Fabiano Fidêncio <ffidencio@nvidia.com>

.github/workflows/run-kata-coco-tests.yaml

@@ -158,6 +158,7 @@ jobs:
       AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
       AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
       SNAPSHOTTER: ${{ matrix.snapshotter }}
+      EXPERIMENTAL_FORCE_GUEST_PULL: ${{ matrix.pull-type == 'experimental-force-guest-pull' && matrix.vmm || '' }}
       # Caution: current ingress controller used to expose the KBS service
       # requires much vCPUs, lefting only a few for the tests. Depending on the
       # host type chose it will result on the creation of a cluster with
@@ -216,7 +217,6 @@ jobs:
         timeout-minutes: 20
         run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
         env:
-          EXPERIMENTAL_FORCE_GUEST_PULL: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && env.KATA_HYPERVISOR || '' }}
           USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: ${{ env.SNAPSHOTTER == 'nydus' }}
           AUTO_GENERATE_POLICY: ${{ env.PULL_TYPE == 'experimental-force-guest-pull' && 'no' || 'yes' }}
 
@@ -282,6 +282,7 @@ jobs:
       PULL_TYPE: ${{ matrix.pull-type }}
       SNAPSHOTTER: ${{ matrix.snapshotter }}
       USE_EXPERIMENTAL_SETUP_SNAPSHOTTER: "true"
+      EXPERIMENTAL_FORCE_GUEST_PULL: ""
       K8S_TEST_HOST_TYPE: "all"
       # We are skipping the auto generated policy tests for now,
       # but those should be enabled as soon as we work on that.

tests/integration/kubernetes/gha-run.sh

@@ -216,6 +216,7 @@ function deploy_kata() {
 	if [[ "${KATA_HYPERVISOR}" == "qemu-nvidia-gpu-"* ]]; then
 		EXPERIMENTAL_FORCE_GUEST_PULL="${KATA_HYPERVISOR}"
 	fi
+	export EXPERIMENTAL_FORCE_GUEST_PULL
 
 	export HELM_K8S_DISTRIBUTION="${KUBERNETES}"
 	export HELM_IMAGE_REFERENCE="${DOCKER_REGISTRY}/${DOCKER_REPO}"

tests/integration/kubernetes/k8s-guest-pull-image-authenticated.bats

@@ -14,7 +14,9 @@ setup() {
         skip "Test not supported for ${KATA_HYPERVISOR}."
     fi
 
-    [ "${SNAPSHOTTER:-}" = "nydus" ] || skip "None snapshotter was found but this test requires one"
+    if [ "${SNAPSHOTTER:-}" != "nydus" ] &&  [ -z "${EXPERIMENTAL_FORCE_GUEST_PULL}" ]; then
+        skip "No snapshotter or experimental_force_guest_pull was found but this test requires one"
+    fi
 
     setup_common || die "setup_common failed"
     AUTHENTICATED_IMAGE="${AUTHENTICATED_IMAGE:-quay.io/kata-containers/confidential-containers-auth:test}"
@@ -170,7 +172,9 @@ teardown() {
         skip "Test not supported for ${KATA_HYPERVISOR}."
     fi
 
-    [ "${SNAPSHOTTER:-}" = "nydus" ] || skip "None snapshotter was found but this test requires one"
+    if [ "${SNAPSHOTTER}" != "nydus" ] && [ -z "${EXPERIMENTAL_FORCE_GUEST_PULL}" ]; then
+        skip "No snapshotter or experimental_force_guest_pull was found but this test requires one"
+    fi
 
     confidential_teardown_common "${node}" "${node_start_time:-}"
     kubectl delete secret cococred --ignore-not-found