From 8578545ce6105fec931dbd85037492183720485f Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Mon, 10 Aug 2026 15:16:15 +0530
Subject: [PATCH 01/10] add sscsi validation job

---
 .gitignore                                    |   1 +
 ...ecrets-store-csi-driver-operator-main.yaml |   8 +
 ...re-csi-driver-operator-main-periodics.yaml |  87 +++
 ...0x-csi-secrets-store-setup-fbc-commands.sh | 566 ++++++++++++++++++
 ...s390x-csi-secrets-store-setup-fbc-ref.yaml |  29 +
 ...x-csi-secrets-store-test-vault-commands.sh | 510 ++++++++++++++++
 ...390x-csi-secrets-store-test-vault-ref.yaml |  30 +
 ...390x-csi-secrets-store-vault-workflow.yaml |  31 +
 8 files changed, 1262 insertions(+)
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml

diff --git a/.gitignore b/.gitignore
index 167d8389022f3..e01a728d18640 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ clusters/app.ci/.actual_diff
 hack/gcp-secret-manager/gcp-secrets-venv
 hack/gcp-secret-manager/.secret-manager-gcloud
 CLAUDE.local.md
+.bob/
 ### macOS ###
 .DS_Store
 cluster-profile-set-details.json
diff --git a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
index b44638d2df26e..870bca873c442 100644
--- a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
+++ b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
@@ -293,6 +293,14 @@ tests:
     test:
     - ref: openshift-e2e-aws-csi-secrets-store-test
     workflow: openshift-e2e-aws-csi-secrets-store
+- as: operator-e2e-s390x-vault-weekly
+  cron: '@weekly'
+  steps:
+    cluster_profile: libvirt-s390x
+    env:
+      ARCH: s390x
+      BRANCH: "5.0"
+    workflow: openshift-e2e-libvirt-s390x-csi-secrets-store-vault
 - as: verify-deps
   steps:
     test:
diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
index e9df144af9bc1..faf84edc7761a 100644
--- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
+++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
@@ -86,3 +86,90 @@ periodics:
     - name: result-aggregator
       secret:
         secretName: result-aggregator
+- agent: kubernetes
+  cluster: build11
+  cron: '@weekly'
+  decorate: true
+  decoration_config:
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile.mustgather
+    - Dockerfile.openshift
+  extra_refs:
+  - base_ref: main
+    org: openshift
+    repo: secrets-store-csi-driver-operator
+    sparse_checkout_files:
+    - .ci-operator.yaml
+    - Dockerfile.mustgather
+    - Dockerfile.openshift
+  labels:
+    ci-operator.openshift.io/cloud: libvirt-s390x
+    ci-operator.openshift.io/cloud-cluster-profile: libvirt-s390x
+    ci.openshift.io/generator: prowgen
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-s390x-vault-weekly
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=operator-e2e-s390x-vault-weekly
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
new file mode 100644
index 0000000000000..a7c414308d6f0
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
@@ -0,0 +1,566 @@
+#!/bin/bash
+# ==============================================================================
+# Script to setup a custom FileBasedCatalog (FBC) CatalogSource on OpenShift
+# for testing the secrets-store-csi-driver operator on s390x.
+#
+# This is adapted for CI environment with vault credentials.
+# ==============================================================================
+
+set -euo pipefail
+
+# --- Configuration ---
+# Check if TEST_GA_BUILD is set to true (case-insensitive)
+TEST_GA_BUILD="${TEST_GA_BUILD:-false}"
+if [[ "${TEST_GA_BUILD,,}" == "true" ]]; then
+    USE_GA_BUILD=true
+    echo "INFO: TEST_GA_BUILD is set to true - will use default catalog sources"
+else
+    USE_GA_BUILD=false
+    echo "INFO: TEST_GA_BUILD is not set or false - will use custom FBC catalog"
+fi
+
+OPERATOR_NAME="ose-secrets-store-csi-driver-rhel9-operator"
+FBC_IMAGE_REPO="quay.io/redhat-user-workloads/ocp-art-tenant/art-fbc"
+FBC_CATALOG_NAME="art-fbc-catalog"
+MIRROR_REPO="quay.io/redhat-user-workloads/ocp-art-tenant/art-images-share"
+
+# Operator installation config
+OPERATOR_NAMESPACE="openshift-cluster-csi-drivers"
+OPERATORGROUP_NAME="secrets-store-csi-driver-og"
+SUBSCRIPTION_NAME="secrets-store-csi-driver-operator"
+SUBSCRIPTION_PACKAGE="secrets-store-csi-driver-operator"
+SUBSCRIPTION_CHANNEL="stable"
+CLUSTER_CSI_DRIVER_NAME="secrets-store.csi.k8s.io"
+CSV_READY_TIMEOUT=300   # seconds to wait for CSV to reach Succeeded
+
+# Pull secret from vault mount
+PULL_SECRET_FILE="/var/run/vault/secrets-store-csi/pull-secret.json"
+CLUSTER_PULL_SECRET_NAME="pull-secret"
+CLUSTER_PULL_SECRET_NAMESPACE="openshift-config"
+
+# Temp directory for oras pull output
+WORK_DIR=$(mktemp -d)
+trap 'rm -rf "${WORK_DIR}"' EXIT
+
+# --- Helper: print a section header ---
+section() {
+    echo
+    echo "======================================================================"
+    echo "  $*"
+    echo "======================================================================"
+}
+
+# ==============================================================================
+# STEP 0: Architecture + Dependency Check
+# ==============================================================================
+check_arch_and_deps() {
+    section "STEP 0: Architecture and Dependency Check"
+
+    ARCH=$(uname -m)
+    echo "Detected architecture: ${ARCH}"
+    if [ "${ARCH}" != "s390x" ]; then
+        echo "ERROR: This script is intended for s390x (IBM Z) architecture."
+        echo "       Detected: ${ARCH}. Exiting."
+        exit 1
+    fi
+    echo "Architecture check passed: s390x confirmed."
+
+    echo
+    echo "Checking required tools..."
+
+    # --- dnf-installable packages ---
+    for pkg in jq podman curl tar; do
+        if ! command -v "${pkg}" &>/dev/null; then
+            echo "Installing ${pkg} via dnf..."
+            sudo dnf install -y "${pkg}" || {
+                echo "ERROR: Failed to install ${pkg}."
+                exit 1
+            }
+        else
+            echo "  [OK] ${pkg}"
+        fi
+    done
+
+    # --- oras: download s390x binary from GitHub releases if not present ---
+    if ! command -v oras &>/dev/null; then
+        echo "Installing oras (s390x)..."
+        ORAS_VERSION="1.3.1"
+        ORAS_TMP=$(mktemp -d)
+        ORAS_TARBALL="oras_${ORAS_VERSION}_linux_s390x.tar.gz"
+        ORAS_URL="https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/${ORAS_TARBALL}"
+        echo "   Downloading: ${ORAS_URL}"
+        curl -fsSL "${ORAS_URL}" -o "${ORAS_TMP}/${ORAS_TARBALL}" || {
+            echo "ERROR: Failed to download oras from ${ORAS_URL}."
+            rm -rf "${ORAS_TMP}"
+            exit 1
+        }
+        tar -xzf "${ORAS_TMP}/${ORAS_TARBALL}" -C "${ORAS_TMP}"
+        sudo install -m 0755 "${ORAS_TMP}/oras" /usr/local/bin/oras
+        rm -rf "${ORAS_TMP}"
+        echo "  [OK] oras $(oras version | head -n1)"
+    else
+        echo "  [OK] oras ($(oras version | head -n1))"
+    fi
+
+    echo
+    echo "All dependency checks passed."
+}
+
+# ==============================================================================
+# STEP 1: Extract Cluster Version and Build FBC Image Tag
+# ==============================================================================
+extract_cluster_version() {
+    section "STEP 1: Extracting OpenShift Cluster Version"
+
+    OCP_FULL_VERSION=$(oc get clusterversion version \
+        -o=jsonpath='{.status.desired.version}' 2>/dev/null)
+
+    if [ -z "${OCP_FULL_VERSION}" ]; then
+        echo "ERROR: Could not retrieve cluster version."
+        exit 1
+    fi
+
+    # Extract 'X.Y' only (e.g. '4.21' from '4.21.3')
+    OCP_VERSION=$(echo "${OCP_FULL_VERSION}" | cut -d. -f1,2)
+
+    if [ -z "${OCP_VERSION}" ]; then
+        echo "ERROR: Could not parse major.minor from version '${OCP_FULL_VERSION}'."
+        exit 1
+    fi
+
+    # Build the final FBC image reference
+    FINAL_FBC_IMAGE="${FBC_IMAGE_REPO}:ocp__${OCP_VERSION}__${OPERATOR_NAME}"
+
+    echo "Cluster version  : ${OCP_FULL_VERSION}"
+    echo "OCP version used : ${OCP_VERSION}"
+    echo "FBC image        : ${FINAL_FBC_IMAGE}"
+}
+
+# ==============================================================================
+# STEP 2: Disable Default CatalogSources
+# ==============================================================================
+disable_default_catalogs() {
+    if [ "${USE_GA_BUILD}" = true ]; then
+        section "STEP 2: Skipping - Using Default CatalogSources (TEST_GA_BUILD=true)"
+        echo "Default CatalogSources will remain enabled for GA build testing."
+        return 0
+    fi
+
+    section "STEP 2: Disabling All Default CatalogSources via OperatorHub"
+
+    oc patch operatorhub cluster --type=json \
+        -p='[{"op":"add","path":"/spec/disableAllDefaultSources","value":true}]'
+
+    echo "Default CatalogSources disabled."
+}
+
+# ==============================================================================
+# STEP 3: Merge Pull Secret
+# ==============================================================================
+merge_pull_secret() {
+    section "STEP 3: Merging Pull Secret into Cluster Pull Secret"
+
+    if [ ! -f "${PULL_SECRET_FILE}" ]; then
+        echo "ERROR: Pull secret file not found at: ${PULL_SECRET_FILE}"
+        exit 1
+    fi
+
+    # Validate that the pull secret file is valid JSON
+    if ! jq empty "${PULL_SECRET_FILE}" 2>/dev/null; then
+        echo "ERROR: '${PULL_SECRET_FILE}' is not valid JSON."
+        exit 1
+    fi
+
+    echo "1. Fetching existing cluster pull secret..."
+    EXISTING_SECRET_B64=$(oc get secret "${CLUSTER_PULL_SECRET_NAME}" \
+        -n "${CLUSTER_PULL_SECRET_NAMESPACE}" \
+        -o=jsonpath='{.data.\.dockerconfigjson}' 2>/dev/null)
+
+    if [ -z "${EXISTING_SECRET_B64}" ]; then
+        echo "ERROR: Could not read cluster pull secret."
+        exit 1
+    fi
+
+    EXISTING_DOCKERCONFIG=$(echo "${EXISTING_SECRET_B64}" | base64 -d)
+
+    echo "2. Merging new credentials into existing pull secret..."
+    NEW_DOCKERCONFIG=$(cat "${PULL_SECRET_FILE}")
+
+    # Deep-merge: new values override existing keys
+    MERGED_DOCKERCONFIG=$(jq -s '.[0] * .[1]' \
+        <(echo "${EXISTING_DOCKERCONFIG}") \
+        <(echo "${NEW_DOCKERCONFIG}"))
+
+    echo "3. Patching cluster pull secret..."
+    MERGED_B64=$(echo "${MERGED_DOCKERCONFIG}" | base64 -w 0)
+
+    oc patch secret "${CLUSTER_PULL_SECRET_NAME}" \
+        -n "${CLUSTER_PULL_SECRET_NAMESPACE}" \
+        --type=json \
+        -p="[{\"op\":\"replace\",\"path\":\"/data/.dockerconfigjson\",\"value\":\"${MERGED_B64}\"}]"
+
+    echo "Pull secret merged successfully."
+}
+
+# ==============================================================================
+# STEP 4: Apply CatalogSource
+# ==============================================================================
+apply_catalog_source() {
+    if [ "${USE_GA_BUILD}" = true ]; then
+        section "STEP 4: Skipping - Not Creating Custom CatalogSource (TEST_GA_BUILD=true)"
+        return 0
+    fi
+
+    section "STEP 4: Creating CatalogSource '${FBC_CATALOG_NAME}'"
+
+    cat <<EOF | oc apply -f -
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: CatalogSource
+metadata:
+  name: ${FBC_CATALOG_NAME}
+  namespace: openshift-marketplace
+spec:
+  sourceType: grpc
+  image: ${FINAL_FBC_IMAGE}
+  displayName: "ART FBC for ${OPERATOR_NAME}"
+  publisher: "Red Hat ART"
+  updateStrategy:
+    registryPoll:
+      interval: 10m
+EOF
+
+    echo "CatalogSource applied."
+}
+
+# ==============================================================================
+# STEP 5: Discover Related Images and Apply ImageDigestMirrorSet (IDMS)
+# ==============================================================================
+generate_and_apply_idms() {
+    if [ "${USE_GA_BUILD}" = true ]; then
+        section "STEP 5: Skipping - Not Creating IDMS (TEST_GA_BUILD=true)"
+        return 0
+    fi
+
+    section "STEP 5: Generating and Applying ImageDigestMirrorSet (IDMS)"
+
+    echo "1. Discovering attached artifacts from FBC image..."
+    mapfile -t ARTIFACT_DIGESTS < <(
+        oras discover --format json "${FINAL_FBC_IMAGE}" | \
+        jq -r '.referrers[]
+               | select(.artifactType == "application/vnd.konflux-ci.attached-artifact")
+               | .digest'
+    )
+
+    if [ ${#ARTIFACT_DIGESTS[@]} -eq 0 ]; then
+        echo "ERROR: No attached artifacts found on image '${FINAL_FBC_IMAGE}'."
+        exit 1
+    fi
+    echo "   Found ${#ARTIFACT_DIGESTS[@]} attached artifact(s)"
+
+    echo
+    echo "2. Pulling all attached artifacts..."
+    for DIGEST in "${ARTIFACT_DIGESTS[@]}"; do
+        echo "   Pulling ${DIGEST}..."
+        (
+            cd "${WORK_DIR}"
+            oras pull "${FBC_IMAGE_REPO}@${DIGEST}"
+        )
+    done
+
+    RELATED_IMAGES_FILE="${WORK_DIR}/related-images.json"
+    if [ ! -f "${RELATED_IMAGES_FILE}" ]; then
+        echo "ERROR: 'related-images.json' was not found after pulling artifacts."
+        exit 1
+    fi
+
+    echo "   Found related-images.json"
+
+    echo
+    echo "3. Parsing image list from related-images.json..."
+    mapfile -t IMAGE_LIST < <(
+        jq -r '.[]' "${RELATED_IMAGES_FILE}" | sed 's/@sha256:[a-f0-9]*//'
+    )
+
+    if [ ${#IMAGE_LIST[@]} -eq 0 ]; then
+        echo "WARNING: No images found in related-images.json."
+    else
+        echo "   Found ${#IMAGE_LIST[@]} image(s) to mirror"
+    fi
+
+    echo
+    echo "4. Building and applying ImageDigestMirrorSet..."
+
+    MIRRORS_YAML=""
+    for SOURCE_IMAGE in "${IMAGE_LIST[@]}"; do
+        MIRRORS_YAML+="
+  - mirrors:
+    - ${MIRROR_REPO}
+    source: ${SOURCE_IMAGE}"
+    done
+
+    IDMS_YAML=$(cat <<EOF
+---
+apiVersion: config.openshift.io/v1
+kind: ImageDigestMirrorSet
+metadata:
+  name: ${OPERATOR_NAME}-images-mirror-set
+spec:
+  imageDigestMirrors:${MIRRORS_YAML}
+EOF
+)
+
+    echo "${IDMS_YAML}" | oc apply -f -
+    echo "IDMS applied."
+}
+
+# ==============================================================================
+# STEP 6: Wait for CatalogSource to become READY
+# ==============================================================================
+wait_for_catalog_source() {
+    if [ "${USE_GA_BUILD}" = true ]; then
+        section "STEP 6: Skipping - No Custom CatalogSource (TEST_GA_BUILD=true)"
+        return 0
+    fi
+
+    section "STEP 6: Waiting for CatalogSource '${FBC_CATALOG_NAME}' to become READY"
+
+    local timeout=120
+    local elapsed=0
+    local interval=10
+
+    echo "Polling every ${interval}s (timeout: ${timeout}s)..."
+    while [ ${elapsed} -lt ${timeout} ]; do
+        STATUS=$(oc get catalogsource "${FBC_CATALOG_NAME}" \
+            -n openshift-marketplace \
+            -o=jsonpath='{.status.connectionState.lastObservedState}' 2>/dev/null || true)
+
+        if [ "${STATUS}" = "READY" ]; then
+            echo "  CatalogSource is READY."
+            return 0
+        fi
+
+        echo "  Current state: '${STATUS}' — waiting..."
+        sleep ${interval}
+        elapsed=$(( elapsed + interval ))
+    done
+
+    echo "ERROR: CatalogSource did not reach READY state within ${timeout}s."
+    exit 1
+}
+
+# ==============================================================================
+# STEP 7: Wait for MachineConfigPool rollout triggered by IDMS
+# ==============================================================================
+wait_for_mcp_rollout() {
+    if [ "${USE_GA_BUILD}" = true ]; then
+        section "STEP 7: Skipping - No MCP Rollout Needed (TEST_GA_BUILD=true)"
+        return 0
+    fi
+
+    section "STEP 7: Waiting for MachineConfigPool Rollout (triggered by IDMS)"
+
+    echo "IDMS changes trigger a MachineConfig update which reboots nodes."
+    echo "Waiting for all MCPs to finish updating..."
+
+    local timeout=900   # 15 min
+    local elapsed=0
+    local interval=30
+
+    while [ ${elapsed} -lt ${timeout} ]; do
+        UPDATING=$(oc get mcp -o=jsonpath='{range .items[*]}{.metadata.name}{" updating="}{.status.conditions[?(@.type=="Updating")].status}{"\n"}{end}' 2>/dev/null \
+            | grep -c 'updating=True' || true)
+        DEGRADED=$(oc get mcp -o=jsonpath='{range .items[*]}{.status.conditions[?(@.type=="Degraded")].status}{"\n"}{end}' 2>/dev/null \
+            | grep -c 'True' || true)
+
+        if [ "${DEGRADED}" -gt 0 ]; then
+            echo "ERROR: One or more MachineConfigPools are Degraded."
+            oc get mcp
+            exit 1
+        fi
+
+        if [ "${UPDATING}" -eq 0 ]; then
+            echo "  All MachineConfigPools are up to date."
+            oc get mcp
+            return 0
+        fi
+
+        echo "  ${UPDATING} MCP(s) still updating — waiting ${interval}s..."
+        sleep ${interval}
+        elapsed=$(( elapsed + interval ))
+    done
+
+    echo "ERROR: MachineConfigPool rollout did not complete within ${timeout}s."
+    exit 1
+}
+
+# ==============================================================================
+# STEP 8: Create Namespace + OperatorGroup + Subscription
+# ==============================================================================
+install_operator() {
+    section "STEP 8: Installing Operator via Subscription"
+
+    if ! oc get namespace "${OPERATOR_NAMESPACE}" &>/dev/null; then
+        echo "Creating namespace '${OPERATOR_NAMESPACE}'..."
+        oc create namespace "${OPERATOR_NAMESPACE}"
+    else
+        echo "Namespace '${OPERATOR_NAMESPACE}' already exists."
+    fi
+
+    echo
+    echo "1. Applying OperatorGroup..."
+    oc apply -f - <<EOF
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: ${OPERATORGROUP_NAME}
+  namespace: ${OPERATOR_NAMESPACE}
+spec: {}
+EOF
+
+    echo
+    echo "2. Applying Subscription..."
+    
+    if [ "${USE_GA_BUILD}" = true ]; then
+        CATALOG_SOURCE="redhat-operators"
+    else
+        CATALOG_SOURCE="${FBC_CATALOG_NAME}"
+    fi
+    
+    oc apply -f - <<EOF
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: ${SUBSCRIPTION_NAME}
+  namespace: ${OPERATOR_NAMESPACE}
+spec:
+  channel: ${SUBSCRIPTION_CHANNEL}
+  installPlanApproval: Automatic
+  name: ${SUBSCRIPTION_PACKAGE}
+  source: ${CATALOG_SOURCE}
+  sourceNamespace: openshift-marketplace
+EOF
+
+    echo "Subscription created."
+}
+
+# ==============================================================================
+# STEP 9: Wait for CSV to reach Succeeded
+# ==============================================================================
+wait_for_csv() {
+    section "STEP 9: Waiting for CSV to reach 'Succeeded' Phase"
+
+    local elapsed=0
+    local interval=15
+
+    echo "Polling every ${interval}s (timeout: ${CSV_READY_TIMEOUT}s)..."
+
+    while [ ${elapsed} -lt ${CSV_READY_TIMEOUT} ]; do
+        CSV_NAME=$(oc get subscription "${SUBSCRIPTION_NAME}" \
+            -n "${OPERATOR_NAMESPACE}" \
+            -o=jsonpath='{.status.installedCSV}' 2>/dev/null || true)
+
+        if [ -n "${CSV_NAME}" ]; then
+            CSV_PHASE=$(oc get csv "${CSV_NAME}" \
+                -n "${OPERATOR_NAMESPACE}" \
+                -o=jsonpath='{.status.phase}' 2>/dev/null || true)
+
+            echo "  CSV: ${CSV_NAME}  Phase: ${CSV_PHASE}"
+
+            if [ "${CSV_PHASE}" = "Succeeded" ]; then
+                echo
+                echo "CSV reached Succeeded."
+                oc get csv "${CSV_NAME}" -n "${OPERATOR_NAMESPACE}"
+                return 0
+            fi
+
+            if [ "${CSV_PHASE}" = "Failed" ]; then
+                echo "ERROR: CSV '${CSV_NAME}' has Failed."
+                exit 1
+            fi
+        else
+            echo "  InstallPlan not yet created — waiting..."
+        fi
+
+        sleep ${interval}
+        elapsed=$(( elapsed + interval ))
+    done
+
+    echo "ERROR: CSV did not reach 'Succeeded' within ${CSV_READY_TIMEOUT}s."
+    exit 1
+}
+
+# ==============================================================================
+# STEP 10: Create ClusterCSIDriver
+# ==============================================================================
+create_cluster_csi_driver() {
+    section "STEP 10: Creating ClusterCSIDriver '${CLUSTER_CSI_DRIVER_NAME}'"
+
+    oc apply -f - <<EOF
+apiVersion: operator.openshift.io/v1
+kind: ClusterCSIDriver
+metadata:
+  name: ${CLUSTER_CSI_DRIVER_NAME}
+spec:
+  managementState: Managed
+EOF
+
+    echo "ClusterCSIDriver '${CLUSTER_CSI_DRIVER_NAME}' applied."
+}
+
+# ==============================================================================
+# STEP 11: Verify Operator and Operand Pods
+# ==============================================================================
+verify_pods() {
+    section "STEP 11: Verifying Operator and Operand Pods"
+
+    local timeout=300
+    local elapsed=0
+    local interval=15
+
+    echo "Waiting for secrets-store pods to be Running..."
+
+    while [ ${elapsed} -lt ${timeout} ]; do
+        NOT_RUNNING=$(oc get pods -n "${OPERATOR_NAMESPACE}" \
+            --no-headers 2>/dev/null \
+            | grep -i secrets \
+            | grep -cv 'Running' || true)
+
+        RUNNING=$(oc get pods -n "${OPERATOR_NAMESPACE}" \
+            --no-headers 2>/dev/null \
+            | grep -i secrets \
+            | grep -c 'Running' || true)
+
+        if [ "${RUNNING}" -gt 0 ] && [ "${NOT_RUNNING}" -eq 0 ]; then
+            echo "  All secrets-store pods are Running:"
+            oc get pods -n "${OPERATOR_NAMESPACE}" | grep -i secrets
+            return 0
+        fi
+
+        echo "  Running: ${RUNNING}  Not yet Running: ${NOT_RUNNING} — waiting..."
+        sleep ${interval}
+        elapsed=$(( elapsed + interval ))
+    done
+
+    echo "WARNING: Not all pods reached Running state within ${timeout}s."
+    oc get pods -n "${OPERATOR_NAMESPACE}" | grep -i secrets || true
+}
+
+# ==============================================================================
+# Main
+# ==============================================================================
+check_arch_and_deps
+extract_cluster_version
+disable_default_catalogs
+merge_pull_secret
+apply_catalog_source
+generate_and_apply_idms
+wait_for_mcp_rollout
+wait_for_catalog_source
+install_operator
+wait_for_csv
+create_cluster_csi_driver
+verify_pods
+
+section "Setup Complete"
+echo "Secrets Store CSI Driver operator is installed and ready for testing."
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
new file mode 100644
index 0000000000000..7c95a3920d24f
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
@@ -0,0 +1,29 @@
+ref:
+  as: openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc
+  from: cli
+  cli: latest
+  commands: openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
+  credentials:
+  - mount_path: /var/run/vault/secrets-store-csi
+    name: secrets-store-csi-s390x-vault
+    namespace: test-credentials
+  resources:
+    requests:
+      cpu: 100m
+      memory: 200Mi
+  timeout: 30m
+  grace_period: 5m
+  documentation: |-
+    This step sets up the FileBasedCatalog (FBC) operator for the Secrets Store CSI Driver
+    on an s390x cluster. It performs the following:
+    - Validates s390x architecture
+    - Installs required dependencies (jq, podman, curl, tar, oras, kubectl)
+    - Extracts cluster version and builds FBC image tag
+    - Disables default CatalogSources (unless TEST_GA_BUILD=true)
+    - Merges pull secret from vault credentials
+    - Creates custom CatalogSource for the operator
+    - Generates and applies ImageDigestMirrorSet (IDMS)
+    - Waits for MachineConfigPool rollout
+    - Installs the operator via Subscription
+    - Creates ClusterCSIDriver resource
+    - Verifies operator and operand pods are running
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
new file mode 100644
index 0000000000000..cef4ae251601c
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
@@ -0,0 +1,510 @@
+#!/bin/bash
+# ==============================================================================
+# Script to test the Secrets Store CSI Driver operator with HashiCorp Vault
+# on OpenShift (s390x / IBM Z) in CI environment.
+#
+# Assumptions:
+#   - setup-fbc-operator step has already been run successfully
+#   - Vault credentials are mounted from vault at /var/run/vault/secrets-store-csi
+# ==============================================================================
+
+set -euo pipefail
+
+# --- Configuration ---
+VAULT_CREDS_DIR="/var/run/vault/secrets-store-csi"
+
+# Vault license
+VAULT_LICENSE_FILE="${VAULT_CREDS_DIR}/vault-license.yaml"
+VAULT_NAMESPACE="vault"
+
+# Repo
+REPO_URL="https://github.com/openshift/secrets-store-csi-driver"
+REPO_DIR="${SHARED_DIR}/secrets-store-csi-driver"
+
+# Image replacement — old image in test yamls → new s390x image
+OLD_BUSYBOX_IMAGE="registry.k8s.io/e2e-test-images/busybox:1.29-4"
+NEW_BUSYBOX_IMAGE="docker.io/s390x/busybox:latest"
+
+# Test yaml files (relative to repo root) that need the busybox image replaced
+BUSYBOX_YAML_FILES=(
+    "test/bats/tests/vault/pod-vault-rotation.yaml"
+    "test/bats/tests/vault/pod-vault-inline-volume-secretproviderclass.yaml"
+    "test/bats/tests/vault/deployment-synck8s.yaml"
+    "test/bats/tests/vault/deployment-two-synck8s.yaml"
+    "test/bats/tests/vault/pod-vault-inline-volume-multiple-spc.yaml"
+)
+
+# vault.bats patch
+BATS_FILE="test/bats/vault.bats"
+
+# Helm / Vault config
+VAULT_HELM_RELEASE="vault"
+VAULT_HELM_REPO="https://helm.releases.hashicorp.com"
+
+# Timeouts
+VAULT_READY_TIMEOUT=300   # seconds
+
+# --- Helper ---
+section() {
+    echo
+    echo "======================================================================"
+    echo "  $*"
+    echo "======================================================================"
+}
+
+# ==============================================================================
+# STEP 0: Architecture check + dependency install
+# ==============================================================================
+check_arch_and_deps() {
+    section "STEP 0: Architecture and Dependency Check"
+
+    ARCH=$(uname -m)
+    echo "Detected architecture: ${ARCH}"
+    if [ "${ARCH}" != "s390x" ]; then
+        echo "ERROR: This script is intended for s390x (IBM Z) architecture."
+        echo "       Detected: ${ARCH}. Exiting."
+        exit 1
+    fi
+    echo "Architecture check passed: s390x confirmed."
+
+    echo
+    echo "Checking and installing required tools..."
+
+    # --- dnf-installable ---
+    for pkg in git curl jq tar; do
+        if ! command -v "${pkg}" &>/dev/null; then
+            echo "Installing ${pkg} via dnf..."
+            sudo dnf install -y "${pkg}" || {
+                echo "ERROR: Failed to install ${pkg}."
+                exit 1
+            }
+        else
+            echo "  [OK] ${pkg}"
+        fi
+    done
+
+    # --- bats: install from source ---
+    if ! command -v bats &>/dev/null; then
+        echo "Installing bats (Bash Automated Testing System)..."
+        BATS_TMP=$(mktemp -d)
+        git clone https://github.com/bats-core/bats-core.git "${BATS_TMP}/bats-core"
+        sudo bash "${BATS_TMP}/bats-core/install.sh" /usr/local
+        rm -rf "${BATS_TMP}"
+        echo "  [OK] bats $(bats --version)"
+    else
+        echo "  [OK] bats ($(bats --version))"
+    fi
+
+    # --- helm: download s390x binary ---
+    if ! command -v helm &>/dev/null; then
+        echo "Installing helm (s390x)..."
+        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4
+        chmod 700 get_helm.sh
+        ./get_helm.sh
+        rm -rf ./get_helm.sh
+        echo "  [OK] helm ($(helm version --short))"
+    else
+        echo "  [OK] helm ($(helm version --short))"
+    fi
+
+    echo
+    echo "All dependency checks passed."
+}
+
+# ==============================================================================
+# STEP 1: Validate required files exist
+# ==============================================================================
+validate_files() {
+    section "STEP 1: Validating Required Files"
+
+    local missing=0
+
+    if [ ! -f "${VAULT_LICENSE_FILE}" ]; then
+        echo "ERROR: Required file not found: ${VAULT_LICENSE_FILE}"
+        missing=$(( missing + 1 ))
+    else
+        echo "  [OK] ${VAULT_LICENSE_FILE}"
+    fi
+
+    # Validate vault-license.yaml has namespace: vault configured
+    if [ -f "${VAULT_LICENSE_FILE}" ]; then
+        if ! grep -q "namespace:.*vault" "${VAULT_LICENSE_FILE}"; then
+            echo "ERROR: '${VAULT_LICENSE_FILE}' does not have 'namespace: vault' set."
+            missing=$(( missing + 1 ))
+        else
+            echo "  [OK] vault-license.yaml namespace check passed"
+        fi
+    fi
+
+    if [ "${missing}" -gt 0 ]; then
+        echo
+        echo "ERROR: ${missing} required file(s) missing or invalid. Exiting."
+        exit 1
+    fi
+
+    echo "All required files present and valid."
+}
+
+# ==============================================================================
+# STEP 3: Clone the secrets-store-csi-driver repo
+# ==============================================================================
+clone_repo() {
+    section "STEP 3: Cloning secrets-store-csi-driver Repository"
+
+    if [ -d "${REPO_DIR}" ]; then
+        echo "Repository already exists at '${REPO_DIR}'. Pulling latest changes..."
+        git -C "${REPO_DIR}" pull --ff-only || {
+            echo "WARNING: Could not fast-forward pull. Using existing checkout."
+        }
+    else
+        echo "Cloning from ${REPO_URL}..."
+        git clone "${REPO_URL}" "${REPO_DIR}"
+    fi
+
+    echo "Repository ready at: ${REPO_DIR}"
+}
+
+# ==============================================================================
+# STEP 4: Replace busybox image in test YAML files
+# ==============================================================================
+replace_busybox_images() {
+    section "STEP 4: Replacing Busybox Image in Test YAML Files"
+
+    echo "Replacing:"
+    echo "  FROM: ${OLD_BUSYBOX_IMAGE}"
+    echo "  TO  : ${NEW_BUSYBOX_IMAGE}"
+    echo
+
+    local replaced=0
+    local not_found=0
+
+    for rel_path in "${BUSYBOX_YAML_FILES[@]}"; do
+        full_path="${REPO_DIR}/${rel_path}"
+
+        if [ ! -f "${full_path}" ]; then
+            echo "  [MISSING] ${rel_path}"
+            not_found=$(( not_found + 1 ))
+            continue
+        fi
+
+        if grep -qF "${OLD_BUSYBOX_IMAGE}" "${full_path}"; then
+            sed -i "s|${OLD_BUSYBOX_IMAGE}|${NEW_BUSYBOX_IMAGE}|g" "${full_path}"
+            echo "  [REPLACED] ${rel_path}"
+            replaced=$(( replaced + 1 ))
+        elif grep -qF "${NEW_BUSYBOX_IMAGE}" "${full_path}"; then
+            echo "  [ALREADY SET] ${rel_path}"
+            replaced=$(( replaced + 1 ))
+        else
+            echo "  [WARNING] '${OLD_BUSYBOX_IMAGE}' not found in ${rel_path}"
+            not_found=$(( not_found + 1 ))
+        fi
+    done
+
+    echo
+    echo "Image replacement complete: ${replaced} file(s) updated, ${not_found} file(s) not matched."
+
+    if [ "${not_found}" -gt 0 ]; then
+        echo "WARNING: Some files were not patched. Continuing anyway."
+    fi
+}
+
+# ==============================================================================
+# STEP 5: Patch vault.bats — replace the helm install block
+# ==============================================================================
+patch_vault_bats() {
+    section "STEP 5: Patching ${BATS_FILE}"
+
+    BATS_FULL_PATH="${REPO_DIR}/${BATS_FILE}"
+
+    if [ ! -f "${BATS_FULL_PATH}" ]; then
+        echo "ERROR: ${BATS_FULL_PATH} not found."
+        exit 1
+    fi
+
+    # Check if the patch has already been applied
+    if grep -q "vault-enterprise" "${BATS_FULL_PATH}"; then
+        echo "vault.bats already contains 'vault-enterprise' — patch already applied, skipping."
+        return 0
+    fi
+
+    # Verify the old block exists
+    if ! grep -q "helm install vault hashicorp/vault --namespace=vault" "${BATS_FULL_PATH}"; then
+        echo "ERROR: Expected helm install block not found in ${BATS_FILE}."
+        exit 1
+    fi
+
+    echo "Applying vault license apply line and helm install block replacement..."
+
+    # Use Python for reliable multi-line replacement
+    python3 - "${BATS_FULL_PATH}" "${VAULT_CREDS_DIR}" << 'PYEOF'
+import sys, re
+
+path = sys.argv[1]
+creds_dir = sys.argv[2]
+with open(path, 'r') as f:
+    content = f.read()
+
+# Patch 1: Insert vault-license apply before "# install the vault provider"
+license_apply_line = f'  oc apply -f {creds_dir}/vault-license.yaml\n'
+vault_comment = '  # install the vault provider using the helm charts'
+
+if 'oc apply -f' not in content or 'vault-license.yaml' not in content:
+    content = content.replace(
+        vault_comment,
+        license_apply_line + vault_comment
+    )
+
+# Patch 2: Replace the old helm install block
+old_helm_pattern = re.compile(
+    r'  helm install vault hashicorp/vault --namespace=vault\s*\\\s*\n'
+    r'(        --set [^\n]+\s*\\\s*\n)*'
+    r'        --set "csi\.daemonSet\.providersDir=/var/run/secrets-store-csi-providers"',
+    re.MULTILINE
+)
+
+new_helm_block = (
+    '  helm install vault hashicorp/vault \\\n'
+    '     --namespace vault \\\n'
+    '     --create-namespace \\\n'
+    '     --set server.dev.enabled=true \\\n'
+    '     --set server.image.repository="docker.io/hashicorp/vault-enterprise" \\\n'
+    '     --set server.image.tag="1.20.9-ent" \\\n'
+    '     --set server.enterpriseLicense.secretName="vault-license" \\\n'
+    '     --set server.logLevel=debug \\\n'
+    '     --set server.serviceAccount.name="vault" \\\n'
+    '     --set "injector.enabled=false" \\\n'
+    '     --set global.openshift=true \\\n'
+    '     --set csi.enabled=true \\\n'
+    '     --set "csi.daemonSet.providersDir=/var/run/secrets-store-csi-providers" \\\n'
+    '     --set csi.image.repository="registry.connect.redhat.com/hashicorp/vault-csi-provider" \\\n'
+    '     --set csi.image.tag="1.7.1-ubi" \\\n'
+    '     --set csi.agent.enabled=false'
+)
+
+new_content, n = old_helm_pattern.subn(new_helm_block, content)
+if n == 0:
+    print("ERROR: helm install pattern not matched.")
+    sys.exit(1)
+
+with open(path, 'w') as f:
+    f.write(new_content)
+
+print("vault.bats patched successfully.")
+PYEOF
+
+    echo "Patch complete."
+
+    echo
+    echo "Increasing all timeout values to 300s..."
+    sed -i 's/--timeout=[0-9]\+[sm]/--timeout=300s/g' "${BATS_FULL_PATH}"
+    echo "Timeout values updated."
+}
+
+# ==============================================================================
+# Logging setup
+# ==============================================================================
+LOG_FILE="${ARTIFACT_DIR}/vault-test-$(date '+%Y%m%d-%H%M%S').log"
+exec > >(tee -a "${LOG_FILE}") 2>&1
+
+echo "Log file: ${LOG_FILE}"
+
+# ==============================================================================
+# collect_versions — record cluster + image versions
+# ==============================================================================
+collect_versions() {
+    section "Version and Image Information"
+
+    echo "--- Timestamp ---"
+    date
+
+    echo
+    echo "--- OpenShift Cluster Version ---"
+    oc get clusterversion version -o=jsonpath='{.status.desired.version}' 2>/dev/null || echo "(unavailable)"
+
+    echo
+    echo "--- Node Architecture ---"
+    oc get nodes -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.nodeInfo.architecture}{"\t"}{.status.nodeInfo.osImage}{"\n"}{end}' 2>/dev/null || echo "(unavailable)"
+
+    echo
+    echo "--- Secrets Store CSI Driver CSV ---"
+    oc get csv -n openshift-cluster-csi-drivers --no-headers 2>/dev/null | grep secrets-store || echo "(no CSV found)"
+
+    echo
+    echo "--- Vault Helm Release ---"
+    helm list -n "${VAULT_NAMESPACE}" 2>/dev/null || echo "(helm list failed)"
+
+    echo
+    echo "--- Vault Pod Images ---"
+    oc get pods -n "${VAULT_NAMESPACE}" -o=jsonpath='{range .items[*]}{.metadata.name}{"\n"}{range .spec.containers[*]}  image: {.image}{"\n"}{end}{end}' 2>/dev/null || echo "(no vault pods)"
+
+    echo
+    echo "--- Busybox Image Used ---"
+    echo "  ${NEW_BUSYBOX_IMAGE}"
+
+    echo
+    echo "--- Tool Versions ---"
+    echo "  oc      : $(oc version --client 2>/dev/null | head -1)"
+    echo "  helm    : $(helm version --short 2>/dev/null)"
+    echo "  bats    : $(bats --version 2>/dev/null)"
+}
+
+# ==============================================================================
+# collect_failure_logs — gather pod logs for diagnostics
+# ==============================================================================
+collect_failure_logs() {
+    section "FAILURE DIAGNOSTICS — Collecting Pod Logs"
+
+    echo "--- Timestamp of failure ---"
+    date
+
+    for ns in default "${VAULT_NAMESPACE}"; do
+        echo
+        echo "=== Namespace: ${ns} ==="
+
+        echo
+        echo "-- All pods --"
+        oc get pods -n "${ns}" 2>/dev/null || echo "(could not list pods)"
+
+        echo
+        echo "-- Events (last 30) --"
+        oc get events -n "${ns}" --sort-by='.lastTimestamp' 2>/dev/null | tail -30 || echo "(could not retrieve events)"
+
+        PROBLEM_PODS=$(oc get pods -n "${ns}" --no-headers 2>/dev/null \
+            | grep -vE '\s(Running|Completed)\s' \
+            | awk '{print $1}' || true)
+
+        if [ -n "${PROBLEM_PODS}" ]; then
+            echo
+            echo "-- Logs for non-Running/non-Completed pods --"
+            for pod in ${PROBLEM_PODS}; do
+                echo
+                echo "  >>> Pod: ${pod} <<<"
+                echo "  -- describe --"
+                oc describe pod "${pod}" -n "${ns}" 2>/dev/null || true
+                echo
+                echo "  -- logs (all containers, last 100 lines) --"
+                CONTAINERS=$(oc get pod "${pod}" -n "${ns}" \
+                    -o=jsonpath='{range .spec.initContainers[*]}{.name}{"\n"}{end}{range .spec.containers[*]}{.name}{"\n"}{end}' \
+                    2>/dev/null || true)
+                for container in ${CONTAINERS}; do
+                    echo "    [container: ${container}]"
+                    oc logs "${pod}" -n "${ns}" -c "${container}" --tail=100 2>/dev/null || echo "    (logs unavailable)"
+                done
+            done
+        else
+            echo
+            echo "  No problem pods found."
+        fi
+    done
+}
+
+# ==============================================================================
+# cleanup_default_namespace — remove test resources
+# ==============================================================================
+cleanup_default_namespace() {
+    section "Cleanup: Removing Test Resources from 'default' Namespace"
+
+    echo "Deleting pods created by vault.bats..."
+
+    for resource in pods deployments secretproviderclasses; do
+        echo
+        echo "-- ${resource} --"
+        ITEMS=$(oc get "${resource}" -n default --no-headers 2>/dev/null \
+            | grep -iE 'vault|secrets-store|busybox|synck8s|rotation|inline' \
+            | awk '{print $1}' || true)
+        if [ -n "${ITEMS}" ]; then
+            for item in ${ITEMS}; do
+                echo "  Deleting ${resource}/${item}..."
+                oc delete "${resource}" "${item}" -n default --ignore-not-found 2>/dev/null || true
+            done
+        else
+            echo "  Nothing to clean up."
+        fi
+    done
+
+    echo
+    echo "Cleanup complete."
+}
+
+# ==============================================================================
+# on_exit — trap handler
+# ==============================================================================
+BATS_EXIT_CODE=0
+
+on_exit() {
+    local exit_code=$?
+
+    [ "${BATS_EXIT_CODE}" -ne 0 ] && exit_code="${BATS_EXIT_CODE}"
+
+    echo
+    echo "======================================================================"
+    if [ "${exit_code}" -eq 0 ]; then
+        echo "  EXIT: SUCCESS"
+    else
+        echo "  EXIT: FAILURE (exit code: ${exit_code})"
+    fi
+    echo "======================================================================"
+
+    if [ "${exit_code}" -eq 0 ]; then
+        cleanup_default_namespace
+        section "All Tests Passed"
+        echo "Log file: ${LOG_FILE}"
+    else
+        collect_failure_logs
+        section "Tests FAILED — Resources left for investigation"
+        echo "Full log: ${LOG_FILE}"
+    fi
+}
+
+trap on_exit EXIT
+
+# ==============================================================================
+# STEP 6: Run vault.bats tests
+# ==============================================================================
+run_bats_tests() {
+    section "STEP 6: Running vault.bats Tests"
+
+    local bats_full="${REPO_DIR}/${BATS_FILE}"
+
+    if [ ! -f "${bats_full}" ]; then
+        echo "ERROR: ${bats_full} not found."
+        exit 1
+    fi
+
+    echo "Switching to 'default' namespace..."
+    oc project default
+
+    echo "Working directory: ${REPO_DIR}"
+    echo "Running: bats --trace --verbose-run --show-output-of-passing-tests ${BATS_FILE}"
+    echo
+
+    cd "${REPO_DIR}"
+
+    set +e
+    bats --trace --verbose-run --show-output-of-passing-tests ${BATS_FILE}
+    BATS_EXIT_CODE=$?
+    set -e
+
+    if [ "${BATS_EXIT_CODE}" -eq 0 ]; then
+        echo
+        echo "All vault.bats tests passed."
+    else
+        echo
+        echo "ERROR: vault.bats exited with code ${BATS_EXIT_CODE}"
+    fi
+
+    cd -
+}
+
+# ==============================================================================
+# Main
+# ==============================================================================
+collect_versions
+check_arch_and_deps
+validate_files
+clone_repo
+replace_busybox_images
+patch_vault_bats
+run_bats_tests
+
+exit "${BATS_EXIT_CODE}"
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml
new file mode 100644
index 0000000000000..844b7e200d1d4
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml
@@ -0,0 +1,30 @@
+ref:
+  as: openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault
+  from: secrets-store-csi-driver-test
+  cli: latest
+  commands: openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
+  credentials:
+  - mount_path: /var/run/vault/secrets-store-csi
+    name: secrets-store-csi-s390x-vault
+    namespace: test-credentials
+  resources:
+    requests:
+      cpu: 100m
+      memory: 200Mi
+  timeout: 2h
+  grace_period: 10m
+  documentation: |-
+    This step runs the Vault end-to-end tests for the Secrets Store CSI Driver
+    on an s390x cluster. It performs the following:
+    - Validates s390x architecture
+    - Installs required dependencies (git, curl, jq, tar, helm, bats)
+    - Clones the secrets-store-csi-driver repository
+    - Replaces busybox images with s390x-compatible versions (uses docker.io/s390x/busybox)
+    - Patches vault.bats to use Vault Enterprise with proper configuration
+    - Applies vault license from vault credentials
+    - Runs the vault.bats test suite
+    - Collects logs and diagnostics on failure
+    - Cleans up test resources on success
+    
+    Note: Docker Hub images are accessible via the cluster's pre-configured pull secret.
+    No additional docker-secret.json is required.
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
new file mode 100644
index 0000000000000..32c5343b1dd8e
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
@@ -0,0 +1,31 @@
+workflow:
+  as: openshift-e2e-libvirt-s390x-csi-secrets-store-vault
+  steps:
+    allow_best_effort_post_steps: true
+    cluster_profile: libvirt-s390x
+    pre:
+    - chain: ipi-libvirt-pre
+    - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc
+    test:
+    - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault
+    post:
+    - chain: ipi-libvirt-post
+  documentation: |-
+    The OpenShift E2E Secrets Store CSI Driver workflow for s390x (IBM Z) architecture
+    installs the Secrets Store CSI Driver Operator using a custom FileBasedCatalog (FBC)
+    and executes the vault end-to-end tests from the operator repository.
+    
+    This workflow:
+    1. Provisions an s390x cluster using libvirt
+    2. Sets up the FBC operator with custom catalog sources and IDMS
+    3. Installs the Secrets Store CSI Driver operator
+    4. Runs comprehensive Vault integration tests using bats
+    5. Collects logs and diagnostics on failure
+    6. Cleans up resources on success
+    
+    Required vault secrets (namespace: test-credentials, secret: secrets-store-csi-s390x-vault):
+    - pull-secret.json: Container registry credentials for FBC and operator images
+    - vault-license.yaml: HashiCorp Vault Enterprise license
+    
+    Note: Docker Hub images (docker.io/s390x/busybox) are accessible via the cluster's
+    pre-configured pull secret. No additional docker-secret.json is required.

From d23264bc7a3467b142fe0e059815d6f5b3d23221 Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Thu, 13 Aug 2026 11:48:59 +0530
Subject: [PATCH 02/10] use existing creds for art images

---
 ...libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh | 4 ++--
 ...2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml | 9 ++++++++-
 ...e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml | 6 +++---
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
index a7c414308d6f0..20adfabb572d7 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
@@ -33,8 +33,8 @@ SUBSCRIPTION_CHANNEL="stable"
 CLUSTER_CSI_DRIVER_NAME="secrets-store.csi.k8s.io"
 CSV_READY_TIMEOUT=300   # seconds to wait for CSV to reach Succeeded
 
-# Pull secret from vault mount
-PULL_SECRET_FILE="/var/run/vault/secrets-store-csi/pull-secret.json"
+# Pull secret from deploy-konflux credential (same as AWS weekly test)
+PULL_SECRET_FILE="/var/run/secrets/pull-secret/.dockerconfigjson"
 CLUSTER_PULL_SECRET_NAME="pull-secret"
 CLUSTER_PULL_SECRET_NAMESPACE="openshift-config"
 
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
index 7c95a3920d24f..c6eecff002d9b 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
@@ -4,6 +4,9 @@ ref:
   cli: latest
   commands: openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
   credentials:
+  - mount_path: /var/run/secrets/pull-secret
+    name: deploy-konflux-operator-art-image-share
+    namespace: test-credentials
   - mount_path: /var/run/vault/secrets-store-csi
     name: secrets-store-csi-s390x-vault
     namespace: test-credentials
@@ -20,10 +23,14 @@ ref:
     - Installs required dependencies (jq, podman, curl, tar, oras, kubectl)
     - Extracts cluster version and builds FBC image tag
     - Disables default CatalogSources (unless TEST_GA_BUILD=true)
-    - Merges pull secret from vault credentials
+    - Merges pull secret from deploy-konflux-operator-art-image-share credential
     - Creates custom CatalogSource for the operator
     - Generates and applies ImageDigestMirrorSet (IDMS)
     - Waits for MachineConfigPool rollout
     - Installs the operator via Subscription
     - Creates ClusterCSIDriver resource
     - Verifies operator and operand pods are running
+    
+    Credentials used:
+    - deploy-konflux-operator-art-image-share: FBC and operator image registry access
+    - secrets-store-csi-s390x-vault: Vault Enterprise license (used by test-vault step)
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
index 32c5343b1dd8e..7beef192aa21d 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
@@ -24,8 +24,8 @@ workflow:
     6. Cleans up resources on success
     
     Required vault secrets (namespace: test-credentials, secret: secrets-store-csi-s390x-vault):
-    - pull-secret.json: Container registry credentials for FBC and operator images
     - vault-license.yaml: HashiCorp Vault Enterprise license
     
-    Note: Docker Hub images (docker.io/s390x/busybox) are accessible via the cluster's
-    pre-configured pull secret. No additional docker-secret.json is required.
+    Container registry credentials:
+    - FBC and operator images: Provided by deploy-konflux-operator-art-image-share credential
+    - Docker Hub images (docker.io/s390x/busybox): Accessible via cluster's pre-configured pull secret

From 0bc0d06c7f3d34966fd7b9b2c9712e8e9ff5ac2f Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Thu, 13 Aug 2026 12:23:28 +0530
Subject: [PATCH 03/10] use existing vault-license in hypershift namespace

---
 ...x-csi-secrets-store-test-vault-commands.sh | 37 ++++++++++---------
 ...390x-csi-secrets-store-test-vault-ref.yaml |  4 +-
 ...390x-csi-secrets-store-vault-workflow.yaml | 11 +++---
 3 files changed, 28 insertions(+), 24 deletions(-)

diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
index cef4ae251601c..3355c41f364df 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
@@ -11,10 +11,10 @@
 set -euo pipefail
 
 # --- Configuration ---
-VAULT_CREDS_DIR="/var/run/vault/secrets-store-csi"
+VAULT_CREDS_DIR="/etc/hypershift-agent-ibmz-credentials"
 
-# Vault license
-VAULT_LICENSE_FILE="${VAULT_CREDS_DIR}/vault-license.yaml"
+# Vault license (just the license string, not a full YAML)
+VAULT_LICENSE_STRING_FILE="${VAULT_CREDS_DIR}/vault-license"
 VAULT_NAMESPACE="vault"
 
 # Repo
@@ -119,20 +119,17 @@ validate_files() {
 
     local missing=0
 
-    if [ ! -f "${VAULT_LICENSE_FILE}" ]; then
-        echo "ERROR: Required file not found: ${VAULT_LICENSE_FILE}"
+    if [ ! -f "${VAULT_LICENSE_STRING_FILE}" ]; then
+        echo "ERROR: Required file not found: ${VAULT_LICENSE_STRING_FILE}"
         missing=$(( missing + 1 ))
     else
-        echo "  [OK] ${VAULT_LICENSE_FILE}"
-    fi
-
-    # Validate vault-license.yaml has namespace: vault configured
-    if [ -f "${VAULT_LICENSE_FILE}" ]; then
-        if ! grep -q "namespace:.*vault" "${VAULT_LICENSE_FILE}"; then
-            echo "ERROR: '${VAULT_LICENSE_FILE}' does not have 'namespace: vault' set."
+        echo "  [OK] ${VAULT_LICENSE_STRING_FILE}"
+        # Validate it's not empty
+        if [ ! -s "${VAULT_LICENSE_STRING_FILE}" ]; then
+            echo "ERROR: '${VAULT_LICENSE_STRING_FILE}' is empty."
             missing=$(( missing + 1 ))
         else
-            echo "  [OK] vault-license.yaml namespace check passed"
+            echo "  [OK] vault-license file is not empty"
         fi
     fi
 
@@ -244,14 +241,20 @@ creds_dir = sys.argv[2]
 with open(path, 'r') as f:
     content = f.read()
 
-# Patch 1: Insert vault-license apply before "# install the vault provider"
-license_apply_line = f'  oc apply -f {creds_dir}/vault-license.yaml\n'
+# Patch 1: Insert vault-license secret creation before "# install the vault provider"
+license_secret_creation = f'''  # Create vault-license secret from license string
+  oc create namespace vault || true
+  oc create secret generic vault-license \\
+    --from-file=license={creds_dir}/vault-license \\
+    -n vault --dry-run=client -o yaml | oc apply -f -
+  
+'''
 vault_comment = '  # install the vault provider using the helm charts'
 
-if 'oc apply -f' not in content or 'vault-license.yaml' not in content:
+if 'vault-license' not in content or 'oc create secret' not in content:
     content = content.replace(
         vault_comment,
-        license_apply_line + vault_comment
+        license_secret_creation + vault_comment
     )
 
 # Patch 2: Replace the old helm install block
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml
index 844b7e200d1d4..e86c8857dc375 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml
@@ -4,8 +4,8 @@ ref:
   cli: latest
   commands: openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
   credentials:
-  - mount_path: /var/run/vault/secrets-store-csi
-    name: secrets-store-csi-s390x-vault
+  - mount_path: /etc/hypershift-agent-ibmz-credentials
+    name: hypershift-agent-ibmz-credentials
     namespace: test-credentials
   resources:
     requests:
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
index 7beef192aa21d..afd8821e763dd 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
@@ -23,9 +23,10 @@ workflow:
     5. Collects logs and diagnostics on failure
     6. Cleans up resources on success
     
-    Required vault secrets (namespace: test-credentials, secret: secrets-store-csi-s390x-vault):
-    - vault-license.yaml: HashiCorp Vault Enterprise license
+    Required credentials:
+    - hypershift-agent-ibmz-credentials (namespace: test-credentials)
+      Contains vault-license file (license string only, not full YAML)
+    - deploy-konflux-operator-art-image-share (namespace: test-credentials)
+      Provides FBC and operator image registry access
     
-    Container registry credentials:
-    - FBC and operator images: Provided by deploy-konflux-operator-art-image-share credential
-    - Docker Hub images (docker.io/s390x/busybox): Accessible via cluster's pre-configured pull secret
+    Note: Docker Hub images (docker.io/s390x/busybox) are accessible via cluster's pre-configured pull secret.

From 1b7d1f8455f6ce21293d24dc0e82fcec66fa559b Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Thu, 13 Aug 2026 12:55:30 +0530
Subject: [PATCH 04/10] add OWNERS

---
 .../step-registry/openshift/e2e/libvirt-s390x/OWNERS  |  9 +++++++++
 .../openshift/e2e/libvirt-s390x/csi/OWNERS            |  7 +++++++
 .../e2e/libvirt-s390x/csi/secrets-store/OWNERS        | 11 +++++++++++
 .../libvirt-s390x/csi/secrets-store/setup-fbc/OWNERS  | 11 +++++++++++
 .../libvirt-s390x/csi/secrets-store/test-vault/OWNERS | 11 +++++++++++
 .../e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS  | 11 +++++++++++
 6 files changed, 60 insertions(+)
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS

diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
new file mode 100644
index 0000000000000..cd370fef71322
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
@@ -0,0 +1,9 @@
+approvers:
+  - sandisamp
+  - v78singh
+  - ibm-adarsh
+
+reviewers:
+  - sandisamp
+  - v78singh
+  - ibm-adarsh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
new file mode 100644
index 0000000000000..2cbe611408472
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
@@ -0,0 +1,7 @@
+approvers:
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - sandisamp
+  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
new file mode 100644
index 0000000000000..8bacff29c16f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/OWNERS
new file mode 100644
index 0000000000000..8bacff29c16f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/OWNERS
new file mode 100644
index 0000000000000..8bacff29c16f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS
new file mode 100644
index 0000000000000..8bacff29c16f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh

From 00955082b009f1e0299a97d9b2140107deee8e4b Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Fri, 14 Aug 2026 13:31:31 +0530
Subject: [PATCH 05/10] change workflow to use upi

---
 ...shift-secrets-store-csi-driver-operator-main.yaml |  2 +-
 ...ets-store-csi-driver-operator-main-periodics.yaml |  4 ++--
 ...irt-s390x-csi-secrets-store-setup-fbc-commands.sh | 12 ++++++------
 ...ibvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml |  4 ----
 ...rt-s390x-csi-secrets-store-test-vault-commands.sh | 12 ++++++------
 ...bvirt-s390x-csi-secrets-store-vault-workflow.yaml | 12 +++++++++---
 6 files changed, 24 insertions(+), 22 deletions(-)

diff --git a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
index 870bca873c442..5e411f8512e48 100644
--- a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
+++ b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
@@ -296,7 +296,7 @@ tests:
 - as: operator-e2e-s390x-vault-weekly
   cron: '@weekly'
   steps:
-    cluster_profile: libvirt-s390x
+    cluster_profile: libvirt-s390x-vpn
     env:
       ARCH: s390x
       BRANCH: "5.0"
diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
index faf84edc7761a..b6bd07a56ba43 100644
--- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
+++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
@@ -104,8 +104,8 @@ periodics:
     - Dockerfile.mustgather
     - Dockerfile.openshift
   labels:
-    ci-operator.openshift.io/cloud: libvirt-s390x
-    ci-operator.openshift.io/cloud-cluster-profile: libvirt-s390x
+    ci-operator.openshift.io/cloud: libvirt-s390x-vpn
+    ci-operator.openshift.io/cloud-cluster-profile: libvirt-s390x-vpn
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
   name: periodic-ci-openshift-secrets-store-csi-driver-operator-main-operator-e2e-s390x-vault-weekly
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
index 20adfabb572d7..674b76054b36d 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
@@ -56,14 +56,14 @@ section() {
 check_arch_and_deps() {
     section "STEP 0: Architecture and Dependency Check"
 
-    ARCH=$(uname -m)
-    echo "Detected architecture: ${ARCH}"
-    if [ "${ARCH}" != "s390x" ]; then
-        echo "ERROR: This script is intended for s390x (IBM Z) architecture."
-        echo "       Detected: ${ARCH}. Exiting."
+    CLUSTER_ARCH=$(oc get nodes -o jsonpath='{.items[0].status.nodeInfo.architecture}' 2>/dev/null || echo "unknown")
+    echo "Detected cluster architecture: ${CLUSTER_ARCH}"
+    if [ "${CLUSTER_ARCH}" != "s390x" ]; then
+        echo "ERROR: This script is intended for s390x (IBM Z) clusters."
+        echo "       Detected cluster architecture: ${CLUSTER_ARCH}. Exiting."
         exit 1
     fi
-    echo "Architecture check passed: s390x confirmed."
+    echo "Architecture check passed: s390x cluster confirmed."
 
     echo
     echo "Checking required tools..."
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
index c6eecff002d9b..ea4c14cbf5cd1 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
@@ -7,9 +7,6 @@ ref:
   - mount_path: /var/run/secrets/pull-secret
     name: deploy-konflux-operator-art-image-share
     namespace: test-credentials
-  - mount_path: /var/run/vault/secrets-store-csi
-    name: secrets-store-csi-s390x-vault
-    namespace: test-credentials
   resources:
     requests:
       cpu: 100m
@@ -33,4 +30,3 @@ ref:
     
     Credentials used:
     - deploy-konflux-operator-art-image-share: FBC and operator image registry access
-    - secrets-store-csi-s390x-vault: Vault Enterprise license (used by test-vault step)
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
index 3355c41f364df..f8e09add6d2d4 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
@@ -58,14 +58,14 @@ section() {
 check_arch_and_deps() {
     section "STEP 0: Architecture and Dependency Check"
 
-    ARCH=$(uname -m)
-    echo "Detected architecture: ${ARCH}"
-    if [ "${ARCH}" != "s390x" ]; then
-        echo "ERROR: This script is intended for s390x (IBM Z) architecture."
-        echo "       Detected: ${ARCH}. Exiting."
+    CLUSTER_ARCH=$(oc get nodes -o jsonpath='{.items[0].status.nodeInfo.architecture}' 2>/dev/null || echo "unknown")
+    echo "Detected cluster architecture: ${CLUSTER_ARCH}"
+    if [ "${CLUSTER_ARCH}" != "s390x" ]; then
+        echo "ERROR: This script is intended for s390x (IBM Z) clusters."
+        echo "       Detected cluster architecture: ${CLUSTER_ARCH}. Exiting."
         exit 1
     fi
-    echo "Architecture check passed: s390x confirmed."
+    echo "Architecture check passed: s390x cluster confirmed."
 
     echo
     echo "Checking and installing required tools..."
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
index afd8821e763dd..aab73a7fd2f96 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
@@ -2,14 +2,20 @@ workflow:
   as: openshift-e2e-libvirt-s390x-csi-secrets-store-vault
   steps:
     allow_best_effort_post_steps: true
-    cluster_profile: libvirt-s390x
+    cluster_profile: libvirt-s390x-vpn
     pre:
-    - chain: ipi-libvirt-pre
+    - ref: upi-libvirt-cleanup-pre
+    - ref: upi-conf-libvirt
+    - ref: ipi-debug-missing-static-pod-controller-degraded
+    - ref: ipi-conf-etcd-on-ramfs
+    - ref: upi-install-libvirt
     - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc
     test:
     - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault
     post:
-    - chain: ipi-libvirt-post
+    - ref: ipi-conf-debug-kdump-gather-logs
+    - chain: gather
+    - ref: upi-libvirt-cleanup-post
   documentation: |-
     The OpenShift E2E Secrets Store CSI Driver workflow for s390x (IBM Z) architecture
     installs the Secrets Store CSI Driver Operator using a custom FileBasedCatalog (FBC)

From 514803962580056d1b7c2078f1ad95e73c319322 Mon Sep 17 00:00:00 2001
From: Sanidhya <ssanidhy@redhat.com>
Date: Fri, 14 Aug 2026 16:07:26 +0530
Subject: [PATCH 06/10] update from build11 to build12

---
 ...nshift-secrets-store-csi-driver-operator-main-periodics.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
index b6bd07a56ba43..66e6cc3a1368b 100644
--- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
+++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
@@ -1,6 +1,6 @@
 periodics:
 - agent: kubernetes
-  cluster: build11
+  cluster: build12
   cron: '@weekly'
   decorate: true
   decoration_config:

From a0de7c44fb7c97877ff9e9f51ab52a8d44cb47a3 Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Fri, 14 Aug 2026 16:13:20 +0530
Subject: [PATCH 07/10] update build machine for vpn connectivity

---
 ...nshift-secrets-store-csi-driver-operator-main-periodics.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
index 66e6cc3a1368b..43d6a0d94d56c 100644
--- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
+++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
@@ -87,7 +87,7 @@ periodics:
       secret:
         secretName: result-aggregator
 - agent: kubernetes
-  cluster: build11
+  cluster: build12
   cron: '@weekly'
   decorate: true
   decoration_config:

From ebc14f1a13d775938961ece6f0e6b50154347b12 Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Fri, 14 Aug 2026 18:18:17 +0530
Subject: [PATCH 08/10] update to use existing e2e-libvirt workflow

---
 ...ecrets-store-csi-driver-operator-main.yaml | 10 ++++-
 ...re-csi-driver-operator-main-periodics.yaml |  1 +
 .../csi/secrets-store/vault/OWNERS            | 11 ------
 ...390x-csi-secrets-store-vault-workflow.yaml | 38 -------------------
 4 files changed, 10 insertions(+), 50 deletions(-)
 delete mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS
 delete mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml

diff --git a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
index 5e411f8512e48..f53be970ea5ba 100644
--- a/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
+++ b/ci-operator/config/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main.yaml
@@ -294,13 +294,21 @@ tests:
     - ref: openshift-e2e-aws-csi-secrets-store-test
     workflow: openshift-e2e-aws-csi-secrets-store
 - as: operator-e2e-s390x-vault-weekly
+  capabilities:
+  - intranet
   cron: '@weekly'
   steps:
+    allow_best_effort_post_steps: true
     cluster_profile: libvirt-s390x-vpn
     env:
       ARCH: s390x
       BRANCH: "5.0"
-    workflow: openshift-e2e-libvirt-s390x-csi-secrets-store-vault
+      ETCD_DISK_SPEED: slow
+      USE_EXTERNAL_DNS: "true"
+    test:
+    - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc
+    - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault
+    workflow: openshift-e2e-libvirt-vpn
 - as: verify-deps
   steps:
     test:
diff --git a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
index 43d6a0d94d56c..66fc7d4d4226b 100644
--- a/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
+++ b/ci-operator/jobs/openshift/secrets-store-csi-driver-operator/openshift-secrets-store-csi-driver-operator-main-periodics.yaml
@@ -104,6 +104,7 @@ periodics:
     - Dockerfile.mustgather
     - Dockerfile.openshift
   labels:
+    capability/intranet: intranet
     ci-operator.openshift.io/cloud: libvirt-s390x-vpn
     ci-operator.openshift.io/cloud-cluster-profile: libvirt-s390x-vpn
     ci.openshift.io/generator: prowgen
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS
deleted file mode 100644
index 8bacff29c16f8..0000000000000
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/OWNERS
+++ /dev/null
@@ -1,11 +0,0 @@
-approvers:
-  - chiragkyal
-  - mytreya-rh
-  - sandisamp
-  - v78singh
-
-reviewers:
-  - chiragkyal
-  - mytreya-rh
-  - sandisamp
-  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
deleted file mode 100644
index aab73a7fd2f96..0000000000000
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/vault/openshift-e2e-libvirt-s390x-csi-secrets-store-vault-workflow.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-workflow:
-  as: openshift-e2e-libvirt-s390x-csi-secrets-store-vault
-  steps:
-    allow_best_effort_post_steps: true
-    cluster_profile: libvirt-s390x-vpn
-    pre:
-    - ref: upi-libvirt-cleanup-pre
-    - ref: upi-conf-libvirt
-    - ref: ipi-debug-missing-static-pod-controller-degraded
-    - ref: ipi-conf-etcd-on-ramfs
-    - ref: upi-install-libvirt
-    - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc
-    test:
-    - ref: openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault
-    post:
-    - ref: ipi-conf-debug-kdump-gather-logs
-    - chain: gather
-    - ref: upi-libvirt-cleanup-post
-  documentation: |-
-    The OpenShift E2E Secrets Store CSI Driver workflow for s390x (IBM Z) architecture
-    installs the Secrets Store CSI Driver Operator using a custom FileBasedCatalog (FBC)
-    and executes the vault end-to-end tests from the operator repository.
-    
-    This workflow:
-    1. Provisions an s390x cluster using libvirt
-    2. Sets up the FBC operator with custom catalog sources and IDMS
-    3. Installs the Secrets Store CSI Driver operator
-    4. Runs comprehensive Vault integration tests using bats
-    5. Collects logs and diagnostics on failure
-    6. Cleans up resources on success
-    
-    Required credentials:
-    - hypershift-agent-ibmz-credentials (namespace: test-credentials)
-      Contains vault-license file (license string only, not full YAML)
-    - deploy-konflux-operator-art-image-share (namespace: test-credentials)
-      Provides FBC and operator image registry access
-    
-    Note: Docker Hub images (docker.io/s390x/busybox) are accessible via cluster's pre-configured pull secret.

From 38c146e7e74c6b84e2f01be09b62fecc3d649c59 Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Fri, 14 Aug 2026 18:25:49 +0530
Subject: [PATCH 09/10] update owners file not needed

---
 .../step-registry/openshift/e2e/libvirt-s390x/OWNERS  |  9 ---------
 .../openshift/e2e/libvirt-s390x/csi/OWNERS            |  7 -------
 .../e2e/libvirt-s390x/csi/secrets-store/OWNERS        | 11 -----------
 3 files changed, 27 deletions(-)
 delete mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
 delete mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
 delete mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS

diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
deleted file mode 100644
index cd370fef71322..0000000000000
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
+++ /dev/null
@@ -1,9 +0,0 @@
-approvers:
-  - sandisamp
-  - v78singh
-  - ibm-adarsh
-
-reviewers:
-  - sandisamp
-  - v78singh
-  - ibm-adarsh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
deleted file mode 100644
index 2cbe611408472..0000000000000
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
+++ /dev/null
@@ -1,7 +0,0 @@
-approvers:
-  - sandisamp
-  - v78singh
-
-reviewers:
-  - sandisamp
-  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
deleted file mode 100644
index 8bacff29c16f8..0000000000000
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
+++ /dev/null
@@ -1,11 +0,0 @@
-approvers:
-  - chiragkyal
-  - mytreya-rh
-  - sandisamp
-  - v78singh
-
-reviewers:
-  - chiragkyal
-  - mytreya-rh
-  - sandisamp
-  - v78singh

From 451510b7ca69557bde45c50df65b36176350e2f8 Mon Sep 17 00:00:00 2001
From: Sanidhya <sandisamp@gmail.com>
Date: Thu, 20 Aug 2026 12:57:13 +0530
Subject: [PATCH 10/10] address comments

---
 .../openshift/e2e/libvirt-s390x/OWNERS        |  11 ++
 .../openshift/e2e/libvirt-s390x/csi/OWNERS    |  11 ++
 .../libvirt-s390x/csi/secrets-store/OWNERS    |  11 ++
 ...0x-csi-secrets-store-setup-fbc-commands.sh | 113 ++++++++++--------
 ...-secrets-store-setup-fbc-ref.metadata.json |  17 +++
 ...s390x-csi-secrets-store-setup-fbc-ref.yaml |   2 +-
 ...x-csi-secrets-store-test-vault-commands.sh |  89 +++++++++-----
 ...secrets-store-test-vault-ref.metadata.json |  17 +++
 8 files changed, 186 insertions(+), 85 deletions(-)
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.metadata.json
 create mode 100644 ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.metadata.json

diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
new file mode 100644
index 0000000000000..8bacff29c16f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
new file mode 100644
index 0000000000000..8bacff29c16f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
new file mode 100644
index 0000000000000..8bacff29c16f8
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/OWNERS
@@ -0,0 +1,11 @@
+approvers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
+
+reviewers:
+  - chiragkyal
+  - mytreya-rh
+  - sandisamp
+  - v78singh
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
index 674b76054b36d..e54fa3e78f78a 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-commands.sh
@@ -8,6 +8,10 @@
 
 set -euo pipefail
 
+# Setup unprivileged tool installation path
+export PATH="/tmp/bin:${PATH}"
+mkdir -p /tmp/bin
+
 # --- Configuration ---
 # Check if TEST_GA_BUILD is set to true (case-insensitive)
 TEST_GA_BUILD="${TEST_GA_BUILD:-false}"
@@ -68,38 +72,47 @@ check_arch_and_deps() {
     echo
     echo "Checking required tools..."
 
-    # --- dnf-installable packages ---
-    for pkg in jq podman curl tar; do
-        if ! command -v "${pkg}" &>/dev/null; then
-            echo "Installing ${pkg} via dnf..."
-            sudo dnf install -y "${pkg}" || {
-                echo "ERROR: Failed to install ${pkg}."
-                exit 1
-            }
-        else
-            echo "  [OK] ${pkg}"
+    # Verify tools already present in cli image
+    for tool in oc podman curl tar; do
+        if ! command -v "${tool}" &>/dev/null; then
+            echo "ERROR: Required tool '${tool}' not found in PATH."
+            exit 1
         fi
+        echo "  [OK] ${tool}"
     done
 
-    # --- oras: download s390x binary from GitHub releases if not present ---
+    # Install jq to /tmp/bin if not present
+    if ! command -v jq &>/dev/null; then
+        echo "Installing jq (amd64 for build farm pod)..."
+        JQ_VERSION="1.7.1"
+        JQ_URL="https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-amd64"
+        curl -fsSL "${JQ_URL}" -o /tmp/bin/jq || {
+            echo "ERROR: Failed to download jq from ${JQ_URL}."
+            exit 1
+        }
+        chmod +x /tmp/bin/jq
+        echo "  [OK] jq $(jq --version)"
+    else
+        echo "  [OK] jq $(jq --version)"
+    fi
+
+    # Install oras to /tmp/bin if not present
     if ! command -v oras &>/dev/null; then
-        echo "Installing oras (s390x)..."
+        echo "Installing oras (amd64 for build farm pod)..."
         ORAS_VERSION="1.3.1"
-        ORAS_TMP=$(mktemp -d)
-        ORAS_TARBALL="oras_${ORAS_VERSION}_linux_s390x.tar.gz"
+        ORAS_TARBALL="oras_${ORAS_VERSION}_linux_amd64.tar.gz"
         ORAS_URL="https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/${ORAS_TARBALL}"
         echo "   Downloading: ${ORAS_URL}"
-        curl -fsSL "${ORAS_URL}" -o "${ORAS_TMP}/${ORAS_TARBALL}" || {
+        curl -fsSL "${ORAS_URL}" -o /tmp/oras.tar.gz || {
             echo "ERROR: Failed to download oras from ${ORAS_URL}."
-            rm -rf "${ORAS_TMP}"
             exit 1
         }
-        tar -xzf "${ORAS_TMP}/${ORAS_TARBALL}" -C "${ORAS_TMP}"
-        sudo install -m 0755 "${ORAS_TMP}/oras" /usr/local/bin/oras
-        rm -rf "${ORAS_TMP}"
-        echo "  [OK] oras $(oras version | head -n1)"
+        tar -xzf /tmp/oras.tar.gz -C /tmp/bin oras
+        chmod +x /tmp/bin/oras
+        rm -f /tmp/oras.tar.gz
+        echo "  [OK] oras version: $(oras version 2>/dev/null || echo 'unknown')"
     else
-        echo "  [OK] oras ($(oras version | head -n1))"
+        echo "  [OK] oras version: $(oras version 2>/dev/null || echo 'unknown')"
     fi
 
     echo
@@ -282,6 +295,12 @@ generate_and_apply_idms() {
         jq -r '.[]' "${RELATED_IMAGES_FILE}" | sed 's/@sha256:[a-f0-9]*//'
     )
 
+    if [ -z "${IMAGE_LIST[*]}" ]; then
+        echo "ERROR: No related images found via oras discover."
+        echo "       Cannot generate IDMS. Exiting."
+        exit 1
+    fi
+
     if [ ${#IMAGE_LIST[@]} -eq 0 ]; then
         echo "WARNING: No images found in related-images.json."
     else
@@ -323,9 +342,9 @@ wait_for_catalog_source() {
         return 0
     fi
 
-    section "STEP 6: Waiting for CatalogSource '${FBC_CATALOG_NAME}' to become READY"
+section "STEP 6: Waiting for CatalogSource '${FBC_CATALOG_NAME}' to become READY"
 
-    local timeout=120
+    local timeout=600
     local elapsed=0
     local interval=10
 
@@ -361,6 +380,18 @@ wait_for_mcp_rollout() {
     section "STEP 7: Waiting for MachineConfigPool Rollout (triggered by IDMS)"
 
     echo "IDMS changes trigger a MachineConfig update which reboots nodes."
+    
+    echo "Waiting for MCP rollout to begin..."
+    for i in $(seq 1 60); do
+        MC=$(oc get mcp worker -o jsonpath='{.status.machineCount}' 2>/dev/null || echo "0")
+        UMC=$(oc get mcp worker -o jsonpath='{.status.updatedMachineCount}' 2>/dev/null || echo "0")
+        if [ "${MC}" != "${UMC}" ]; then
+            echo "MCP rollout started (${UMC}/${MC} updated)"
+            break
+        fi
+        sleep 10
+    done
+
     echo "Waiting for all MCPs to finish updating..."
 
     local timeout=900   # 15 min
@@ -514,36 +545,16 @@ EOF
 verify_pods() {
     section "STEP 11: Verifying Operator and Operand Pods"
 
-    local timeout=300
-    local elapsed=0
-    local interval=15
-
-    echo "Waiting for secrets-store pods to be Running..."
+    echo "Waiting for secrets-store-csi-driver-operator Deployment..."
+    oc rollout status deployment/secrets-store-csi-driver-operator \
+        -n "${OPERATOR_NAMESPACE}" --timeout=300s
 
-    while [ ${elapsed} -lt ${timeout} ]; do
-        NOT_RUNNING=$(oc get pods -n "${OPERATOR_NAMESPACE}" \
-            --no-headers 2>/dev/null \
-            | grep -i secrets \
-            | grep -cv 'Running' || true)
-
-        RUNNING=$(oc get pods -n "${OPERATOR_NAMESPACE}" \
-            --no-headers 2>/dev/null \
-            | grep -i secrets \
-            | grep -c 'Running' || true)
-
-        if [ "${RUNNING}" -gt 0 ] && [ "${NOT_RUNNING}" -eq 0 ]; then
-            echo "  All secrets-store pods are Running:"
-            oc get pods -n "${OPERATOR_NAMESPACE}" | grep -i secrets
-            return 0
-        fi
-
-        echo "  Running: ${RUNNING}  Not yet Running: ${NOT_RUNNING} — waiting..."
-        sleep ${interval}
-        elapsed=$(( elapsed + interval ))
-    done
+    echo "Waiting for secrets-store-csi-driver DaemonSet rollout..."
+    oc rollout status daemonset/secrets-store-csi-driver \
+        -n "${OPERATOR_NAMESPACE}" --timeout=300s
 
-    echo "WARNING: Not all pods reached Running state within ${timeout}s."
-    oc get pods -n "${OPERATOR_NAMESPACE}" | grep -i secrets || true
+    echo "All secrets-store pods are ready:"
+    oc get pods -n "${OPERATOR_NAMESPACE}" | grep -i secrets
 }
 
 # ==============================================================================
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.metadata.json b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.metadata.json
new file mode 100644
index 0000000000000..63cc794771916
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.metadata.json
@@ -0,0 +1,17 @@
+{
+	"path": "openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml",
+	"owners": {
+		"approvers": [
+			"chiragkyal",
+			"mytreya-rh",
+			"sandisamp",
+			"v78singh"
+		],
+		"reviewers": [
+			"chiragkyal",
+			"mytreya-rh",
+			"sandisamp",
+			"v78singh"
+		]
+	}
+}
\ No newline at end of file
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
index ea4c14cbf5cd1..640bfe99ca21a 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/setup-fbc/openshift-e2e-libvirt-s390x-csi-secrets-store-setup-fbc-ref.yaml
@@ -17,7 +17,7 @@ ref:
     This step sets up the FileBasedCatalog (FBC) operator for the Secrets Store CSI Driver
     on an s390x cluster. It performs the following:
     - Validates s390x architecture
-    - Installs required dependencies (jq, podman, curl, tar, oras, kubectl)
+    - Installs required dependencies (jq, oras)
     - Extracts cluster version and builds FBC image tag
     - Disables default CatalogSources (unless TEST_GA_BUILD=true)
     - Merges pull secret from deploy-konflux-operator-art-image-share credential
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
index f8e09add6d2d4..73d7e69e01395 100644
--- a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-commands.sh
@@ -5,11 +5,15 @@
 #
 # Assumptions:
 #   - setup-fbc-operator step has already been run successfully
-#   - Vault credentials are mounted from vault at /var/run/vault/secrets-store-csi
+#   - Vault credentials are mounted at /etc/hypershift-agent-ibmz-credentials
 # ==============================================================================
 
 set -euo pipefail
 
+# Setup unprivileged tool installation path
+export PATH="/tmp/bin:${PATH}"
+mkdir -p /tmp/bin
+
 # --- Configuration ---
 VAULT_CREDS_DIR="/etc/hypershift-agent-ibmz-credentials"
 
@@ -19,7 +23,7 @@ VAULT_NAMESPACE="vault"
 
 # Repo
 REPO_URL="https://github.com/openshift/secrets-store-csi-driver"
-REPO_DIR="${SHARED_DIR}/secrets-store-csi-driver"
+REPO_DIR="/tmp/secrets-store-csi-driver"
 
 # Image replacement — old image in test yamls → new s390x image
 OLD_BUSYBOX_IMAGE="registry.k8s.io/e2e-test-images/busybox:1.29-4"
@@ -37,13 +41,6 @@ BUSYBOX_YAML_FILES=(
 # vault.bats patch
 BATS_FILE="test/bats/vault.bats"
 
-# Helm / Vault config
-VAULT_HELM_RELEASE="vault"
-VAULT_HELM_REPO="https://helm.releases.hashicorp.com"
-
-# Timeouts
-VAULT_READY_TIMEOUT=300   # seconds
-
 # --- Helper ---
 section() {
     echo
@@ -70,41 +67,64 @@ check_arch_and_deps() {
     echo
     echo "Checking and installing required tools..."
 
-    # --- dnf-installable ---
-    for pkg in git curl jq tar; do
-        if ! command -v "${pkg}" &>/dev/null; then
-            echo "Installing ${pkg} via dnf..."
-            sudo dnf install -y "${pkg}" || {
-                echo "ERROR: Failed to install ${pkg}."
-                exit 1
-            }
-        else
-            echo "  [OK] ${pkg}"
+    # Verify tools already present in cli image
+    for tool in oc curl tar git; do
+        if ! command -v "${tool}" &>/dev/null; then
+            echo "ERROR: Required tool '${tool}' not found in PATH."
+            exit 1
         fi
+        echo "  [OK] ${tool}"
     done
 
-    # --- bats: install from source ---
+    # Install jq to /tmp/bin if not present
+    if ! command -v jq &>/dev/null; then
+        echo "Installing jq (amd64 for build farm pod)..."
+        JQ_VERSION="1.7.1"
+        JQ_URL="https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-amd64"
+        curl -fsSL "${JQ_URL}" -o /tmp/bin/jq || {
+            echo "ERROR: Failed to download jq from ${JQ_URL}."
+            exit 1
+        }
+        chmod +x /tmp/bin/jq
+        echo "  [OK] jq $(jq --version)"
+    else
+        echo "  [OK] jq $(jq --version)"
+    fi
+
+    # Install bats to /tmp/bin if not present
     if ! command -v bats &>/dev/null; then
         echo "Installing bats (Bash Automated Testing System)..."
-        BATS_TMP=$(mktemp -d)
-        git clone https://github.com/bats-core/bats-core.git "${BATS_TMP}/bats-core"
-        sudo bash "${BATS_TMP}/bats-core/install.sh" /usr/local
-        rm -rf "${BATS_TMP}"
+        BATS_VERSION="1.11.0"
+        BATS_URL="https://github.com/bats-core/bats-core/archive/refs/tags/v${BATS_VERSION}.tar.gz"
+        curl -fsSL "${BATS_URL}" -o /tmp/bats.tar.gz || {
+            echo "ERROR: Failed to download bats from ${BATS_URL}."
+            exit 1
+        }
+        tar -xzf /tmp/bats.tar.gz -C /tmp
+        bash /tmp/bats-core-${BATS_VERSION}/install.sh /tmp/bin
+        rm -rf /tmp/bats.tar.gz /tmp/bats-core-${BATS_VERSION}
         echo "  [OK] bats $(bats --version)"
     else
-        echo "  [OK] bats ($(bats --version))"
+        echo "  [OK] bats $(bats --version)"
     fi
 
-    # --- helm: download s390x binary ---
+    # Install helm to /tmp/bin if not present
     if ! command -v helm &>/dev/null; then
-        echo "Installing helm (s390x)..."
-        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4
-        chmod 700 get_helm.sh
-        ./get_helm.sh
-        rm -rf ./get_helm.sh
-        echo "  [OK] helm ($(helm version --short))"
+        echo "Installing helm (amd64 for build farm pod)..."
+        HELM_VERSION="3.16.4"
+        HELM_TARBALL="helm-v${HELM_VERSION}-linux-amd64.tar.gz"
+        HELM_URL="https://get.helm.sh/${HELM_TARBALL}"
+        curl -fsSL "${HELM_URL}" -o /tmp/helm.tar.gz || {
+            echo "ERROR: Failed to download helm from ${HELM_URL}."
+            exit 1
+        }
+        tar -xzf /tmp/helm.tar.gz -C /tmp
+        mv /tmp/linux-amd64/helm /tmp/bin/helm
+        chmod +x /tmp/bin/helm
+        rm -rf /tmp/helm.tar.gz /tmp/linux-amd64
+        echo "  [OK] helm $(helm version --short)"
     else
-        echo "  [OK] helm ($(helm version --short))"
+        echo "  [OK] helm $(helm version --short)"
     fi
 
     echo
@@ -156,6 +176,9 @@ clone_repo() {
     else
         echo "Cloning from ${REPO_URL}..."
         git clone "${REPO_URL}" "${REPO_DIR}"
+        cd "${REPO_DIR}"
+        echo "Checking out branch for release ${BRANCH}..."
+        git checkout "release-${BRANCH}" || git checkout main
     fi
 
     echo "Repository ready at: ${REPO_DIR}"
diff --git a/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.metadata.json b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.metadata.json
new file mode 100644
index 0000000000000..0e5804bffd365
--- /dev/null
+++ b/ci-operator/step-registry/openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.metadata.json
@@ -0,0 +1,17 @@
+{
+	"path": "openshift/e2e/libvirt-s390x/csi/secrets-store/test-vault/openshift-e2e-libvirt-s390x-csi-secrets-store-test-vault-ref.yaml",
+	"owners": {
+		"approvers": [
+			"chiragkyal",
+			"mytreya-rh",
+			"sandisamp",
+			"v78singh"
+		],
+		"reviewers": [
+			"chiragkyal",
+			"mytreya-rh",
+			"sandisamp",
+			"v78singh"
+		]
+	}
+}
\ No newline at end of file