Add optional s390x e2e CI for ClusterResourceOverride operator

ci-operator/config/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main__s390x.yaml

@@ -0,0 +1,65 @@
+base_images:
+  cli:
+    name: "5.0"
+    namespace: ocp
+    tag: cli
+  libvirt-installer:
+    name: "5.0"
+    namespace: ocp
+    tag: libvirt-installer
+  upi-installer:
+    name: "5.0"
+    namespace: ocp
+    tag: upi-installer
+build_root:
+  image_stream_tag:
+    name: release
+    namespace: openshift
+    tag: rhel-9-release-golang-1.26-openshift-5.0
+releases:
+  latest:
+    candidate:
+      architecture: multi
+      product: ocp
+      stream: nightly
+      version: "5.0"
+  s390x-latest:
+    candidate:
+      architecture: s390x
+      product: ocp
+      stream: nightly
+      version: "5.0"
+resources:
+  '*':
+    limits:
+      memory: 8Gi
+    requests:
+      cpu: "2"
+      memory: 2Gi
+tests:
+- always_run: false
+  as: e2e
+  capabilities:
+  - intranet
+  optional: true
+  steps:
+    cluster_profile: libvirt-s390x-vpn-oz
+    dependencies:
+      OPENSHIFT_INSTALL_TARGET: release:s390x-latest
+    env:
+      ARCH: s390x
+      BRANCH: "5.0"
+      COMPUTE_COUNT: "2"
+      CONTROL_COUNT: "3"
+      CRO_ART_IMAGE_SHARE: quay.io/redhat-user-workloads/ocp-art-tenant/art-images-share
+      CRO_CATALOG_IMAGE: quay.io/redhat-user-workloads/ocp-art-tenant/art-fbc:ocp__5.0__ose-clusterresourceoverride-rhel9-operator
+      CRO_CATALOG_SOURCE: cro-art-fbc
+      ETCD_DISK_SPEED: slow
+      NODE_TUNING: "true"
+      USE_EXTERNAL_DNS: "true"
+    workflow: cluster-resource-override-s390x
+zz_generated_metadata:
+  branch: main
+  org: openshift
+  repo: cluster-resource-override-admission-operator
+  variant: s390x

ci-operator/jobs/openshift/cluster-resource-override-admission-operator/openshift-cluster-resource-override-admission-operator-main-presubmits.yaml

@@ -376,6 +376,93 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )images,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build12
+    context: ci/prow/s390x-e2e
+    decorate: true
+    decoration_config:
+      skip_cloning: true
+    labels:
+      capability/intranet: intranet
+      ci-operator.openshift.io/cloud: libvirt-s390x-vpn-oz
+      ci-operator.openshift.io/cloud-cluster-profile: libvirt-s390x-vpn-oz
+      ci-operator.openshift.io/variant: s390x
+      ci.openshift.io/generator: prowgen
+      job-release: "5.0"
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-cluster-resource-override-admission-operator-main-s390x-e2e
+    optional: true
+    rerun_command: /test s390x-e2e
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e
+        - --variant=s390x
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )s390x-e2e,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:

ci-operator/step-registry/cluster-resource-override/OWNERS

@@ -0,0 +1,4 @@
+approvers:
+- multiarch-approvers
+reviewers:
+- multiarch-reviewers

ci-operator/step-registry/cluster-resource-override/s390x/OWNERS

@@ -0,0 +1,4 @@
+approvers:
+- multiarch-approvers
+reviewers:
+- multiarch-reviewers

ci-operator/step-registry/cluster-resource-override/s390x/cleanup/OWNERS

@@ -0,0 +1,4 @@
+approvers:
+- multiarch-approvers
+reviewers:
+- multiarch-reviewers

ci-operator/step-registry/cluster-resource-override/s390x/cleanup/cluster-resource-override-s390x-cleanup-commands.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -euo pipefail
+
+echo "=== Cleaning up ClusterResourceOverride s390x test components (best effort) ==="
+
+oc delete clusterresourceoverride cluster -n "${CRO_NAMESPACE}" --ignore-not-found --timeout=60s || true
+oc delete subscription "${CRO_SUBSCRIPTION_NAME}" -n "${CRO_NAMESPACE}" --ignore-not-found --timeout=60s || true
+oc delete csv --all -n "${CRO_NAMESPACE}" --ignore-not-found --timeout=60s || true
+oc delete operatorgroup --all -n "${CRO_NAMESPACE}" --ignore-not-found --timeout=60s || true
+oc delete imagedigestmirrorset "${CRO_IDMS_NAME}" --ignore-not-found || true
+# Only delete custom catalogs we created; never remove stock redhat-operators.
+if [[ -n "${CRO_CATALOG_SOURCE:-}" && "${CRO_CATALOG_SOURCE}" != "redhat-operators" && "${CRO_CATALOG_SOURCE}" != "certified-operators" && "${CRO_CATALOG_SOURCE}" != "community-operators" && "${CRO_CATALOG_SOURCE}" != "redhat-marketplace" ]]; then
+  oc delete catalogsource "${CRO_CATALOG_SOURCE}" -n "${CRO_CATALOG_SOURCE_NAMESPACE:-openshift-marketplace}" --ignore-not-found || true
+fi
+oc delete ns "${CRO_NAMESPACE}" --ignore-not-found --timeout=180s || true
+
+echo "=== Component cleanup complete ==="

ci-operator/step-registry/cluster-resource-override/s390x/cleanup/cluster-resource-override-s390x-cleanup-ref.metadata.json

@@ -0,0 +1,11 @@
+{
+	"path": "cluster-resource-override/s390x/cleanup/cluster-resource-override-s390x-cleanup-ref.yaml",
+	"owners": {
+		"approvers": [
+			"multiarch-approvers"
+		],
+		"reviewers": [
+			"multiarch-reviewers"
+		]
+	}
+}

ci-operator/step-registry/cluster-resource-override/s390x/cleanup/cluster-resource-override-s390x-cleanup-ref.yaml

@@ -0,0 +1,39 @@
+ref:
+  as: cluster-resource-override-s390x-cleanup
+  from_image:
+    namespace: ocp
+    name: cli-jq
+    tag: latest
+  commands: cluster-resource-override-s390x-cleanup-commands.sh
+  grace_period: 1m0s
+  resources:
+    requests:
+      cpu: 100m
+      memory: 200Mi
+  timeout: 15m0s
+  env:
+  - name: CRO_NAMESPACE
+    default: "openshift-cluster-resource-override"
+    documentation: |-
+      Namespace where the ClusterResourceOverride operator was installed.
+  - name: CRO_SUBSCRIPTION_NAME
+    default: "clusterresourceoverride"
+    documentation: |-
+      Subscription name to delete during cleanup.
+  - name: CRO_IDMS_NAME
+    default: "cluster-resource-override-idms"
+    documentation: |-
+      ImageDigestMirrorSet name to delete during cleanup.
+  - name: CRO_CATALOG_SOURCE
+    default: "redhat-operators"
+    documentation: |-
+      CatalogSource name. Custom sources (not stock marketplace catalogs) are
+      deleted during cleanup.
+  - name: CRO_CATALOG_SOURCE_NAMESPACE
+    default: "openshift-marketplace"
+    documentation: |-
+      Namespace of CRO_CATALOG_SOURCE.
+  documentation: |-
+    Best-effort cleanup of ClusterResourceOverride operator resources created by
+    the s390x install step (CR, Subscription, CSVs, namespace, IDMS, custom
+    CatalogSource).

ci-operator/step-registry/cluster-resource-override/s390x/cluster-resource-override-s390x-workflow.metadata.json

@@ -0,0 +1,11 @@
+{
+	"path": "cluster-resource-override/s390x/cluster-resource-override-s390x-workflow.yaml",
+	"owners": {
+		"approvers": [
+			"multiarch-approvers"
+		],
+		"reviewers": [
+			"multiarch-reviewers"
+		]
+	}
+}

ci-operator/step-registry/cluster-resource-override/s390x/cluster-resource-override-s390x-workflow.yaml

@@ -0,0 +1,25 @@
+workflow:
+  as: cluster-resource-override-s390x
+  steps:
+    allow_best_effort_post_steps: true
+    pre:
+    - ref: upi-libvirt-cleanup-pre
+    - chain: upi-conf-libvirt
+    - ref: ipi-debug-missing-static-pod-controller-degraded
+    - ref: ipi-conf-etcd-on-ramfs
+    - chain: upi-install-libvirt
+    test:
+    - chain: cluster-resource-override-s390x-test
+    post:
+    - ref: cluster-resource-override-s390x-cleanup
+    - ref: ipi-conf-debug-kdump-gather-logs
+    - chain: gather
+    - ref: upi-libvirt-cleanup-post
+  documentation: |-
+    End-to-end workflow for the ClusterResourceOverride operator on s390x (IBM Z).
+    Provisions an OCP cluster on the VPN'd IBM Z CI environment using the same
+    UPI/libvirt pre and post steps as openshift-e2e-libvirt-vpn, installs the
+    ClusterResourceOverride operator via OLM (with optional ImageDigestMirrorSet
+    image source changes), creates the ClusterResourceOverride CR, then runs the
+    test step. Component cleanup runs first in post, followed by gather and
+    cluster deprovisioning.

ci-operator/step-registry/cluster-resource-override/s390x/install-operator/OWNERS

@@ -0,0 +1,4 @@
+approvers:
+- multiarch-approvers
+reviewers:
+- multiarch-reviewers