[WIP]: multiarch: migrate 4.14 s390x libvirt jobs to libvirt-s390x-vpn

[ibm-adarsh]

Summary

Follow-up to #82603: migrate remaining IBM Z homogeneous 4.14 and related upgrade jobs to libvirt-s390x-vpn using the existing VPN workflows (same pattern as 4.15–5.0).

Jobs migrated

Config	Job	Profile	Workflow
nightly-4.14	ocp-e2e-ovn-remote-libvirt-s390x	libvirt-s390x-vpn	openshift-e2e-libvirt-vpn
nightly-4.14	ocp-image-ecosystem-ovn-remote-libvirt-s390x	libvirt-s390x-vpn	openshift-e2e-libvirt-vpn
nightly-4.14	ocp-e2e-serial-ovn-remote-libvirt-s390x	libvirt-s390x-vpn	openshift-e2e-libvirt-vpn
nightly-4.14	ocp-fips-ovn-remote-libvirt-s390x	libvirt-s390x-vpn	openshift-e2e-libvirt-vpn-fips
nightly-4.15-upgrade-from-nightly-4.14	ocp-ovn-remote-libvirt-s390x	libvirt-s390x-vpn	openshift-e2e-libvirt-vpn

Migrated jobs are pinned to build12 in generated periodics only. Relies on the ≤4.15 s390x install fallbacks already merged in #82603.

Not migrated: nightly-4.14-upgrade-from-nightly-4.13, heterogeneous jobs.

Test plan

• /pj-rehearse all migrated jobs
• Confirm 4.14 s390x logs use virsh when virt-install is absent
• Confirm upgrade job installs 4.14 via VPN path then upgrades to 4.15

Summary by CodeRabbit

Migrates the remaining homogeneous IBM Z s390x 4.14 nightly jobs and the 4.15-from-4.14 upgrade job to the libvirt-s390x-vpn profile.

The jobs now use intranet access, VPN workflows, external DNS, and OPENSHIFT_INSTALL_TARGET dependencies. Generated periodics are pinned to build12. The image ecosystem job now targets s390x-latest, while the FIPS job keeps its dedicated workflow.

[openshift-ci]

Hi @ibm-adarsh. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Walkthrough

The pull request updates s390x remote libvirt jobs to use VPN-based configurations. It changes capabilities, profiles, release dependencies, workflows, external DNS settings, and the image ecosystem release target.

Changes

s390x libvirt VPN migration

Layer / File(s)	Summary
Update s390x libvirt job wiring ci-operator/config/openshift/multiarch/openshift-multiarch-main__nightly-4.14.yaml, ci-operator/config/openshift/multiarch/openshift-multiarch-main__nightly-4.15-upgrade-from-nightly-4.14.yaml	The nightly and upgrade jobs now use the intranet capability, libvirt-s390x-vpn profile, VPN workflows, OPENSHIFT_INSTALL_TARGET, and external DNS. The nightly image ecosystem job targets release:s390x-latest.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#82603: Applies the same s390x libvirt-to-VPN migration pattern to 4.15 nightly jobs.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only YAML CI job configuration and generated periodic metadata; no Ginkgo It, Describe, Context, or When test titles are added or changed.
Test Structure And Quality	✅ Passed	The PR changes only three generated YAML configuration files; it adds or modifies no Ginkgo test code, so these test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The patch changes only three YAML CI configuration/generated-periodic files and adds no Ginkgo test declarations or test source files.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only YAML CI configuration and generated periodics; it adds no Ginkgo It, Describe, Context, or When tests, so SNO compatibility review is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes only CI-operator job/config YAML: capabilities, libvirt profiles, workflows, dependencies, and Prow cluster labels. It adds no deployment scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The patch changes only three YAML CI configuration files and adds no process-level OTE code or stdout/logging writes; this check is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff changes only YAML job configuration and generated periodics; it adds no Ginkgo declarations or e2e test code with IPv4 or external-connectivity assumptions.
No-Weak-Crypto	✅ Passed	All three modified files are YAML job configuration; added lines only change VPN profiles, capabilities, workflows, dependencies, DNS, and build12 labels, with no weak-crypto or custom crypto usage.
Container-Privileges	✅ Passed	Changed config and generated periodic files add no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation fields; intranet is a Prow scheduling label.
No-Sensitive-Data-In-Logs	✅ Passed	The commit adds only CI routing and environment values; scans found no logging commands, credentials, tokens, PII, URLs, or internal hostnames in added content.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the migration of 4.14 s390x libvirt jobs to the libvirt-s390x-vpn profile, which matches the main pull request objective.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ibm-adarsh
Once this PR has been reviewed and has the lgtm label, please assign deepsm007 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• ci-operator/config/openshift/multiarch/OWNERS
• ci-operator/jobs/openshift/multiarch/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@ibm-adarsh: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-e2e-serial-ovn-remote-libvirt-s390x	N/A	periodic	Periodic changed
periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-fips-ovn-remote-libvirt-s390x	N/A	periodic	Periodic changed
periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-image-ecosystem-ovn-remote-libvirt-s390x	N/A	periodic	Periodic changed
periodic-ci-openshift-multiarch-main-nightly-4.15-upgrade-from-nightly-4.14-ocp-ovn-remote-libvirt-s390x	N/A	periodic	Periodic changed
periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-e2e-ovn-remote-libvirt-s390x	N/A	periodic	Periodic changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[ibm-adarsh]

/pj-rehearse periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-e2e-ovn-remote-libvirt-s390x periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-image-ecosystem-ovn-remote-libvirt-s390x periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-e2e-serial-ovn-remote-libvirt-s390x periodic-ci-openshift-multiarch-main-nightly-4.14-ocp-fips-ovn-remote-libvirt-s390x periodic-ci-openshift-multiarch-main-nightly-4.15-upgrade-from-nightly-4.14-ocp-ovn-remote-libvirt-s390x

[openshift-merge-bot]

@ibm-adarsh: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-merge-bot]

@ibm-adarsh: needs-ok-to-test label found, no rehearsals will be run