multiarch: add libvirt-s390x-vpn-hcp Boskos + secret bootstrap (1/2)

[ibm-adarsh]

Dependency (read first)

Companion PR (2/2): #83138

Merge order:

1. Merge this PR (multiarch: add libvirt-s390x-vpn-hcp Boskos + secret bootstrap (1/2) #83082, 1/2) first — Boskos lease move + ci-secret-bootstrap for cluster-secrets-libvirt-s390x-vpn-hcp
2. Wait until cluster-secrets-libvirt-s390x-vpn-hcp exists in the ci namespace
3. Then merge multiarch: register libvirt-s390x-vpn-hcp cluster profile (2/2) #83138 (2/2) — registers the cluster profile

Do not merge #83138 before this PR and secret sync complete. check-cluster-profiles-config requires the live secret before profile registration (same split as #82161 + #82162).

Summary

• Move libvirt-s390x-oz-3-2 and libvirt-s390x-oz-3-3 (lnxocp14) from libvirt-s390x-vpn-oz into a new libvirt-s390x-vpn-hcp-quota-slice
• Add ci-secret-bootstrap for cluster-secrets-libvirt-s390x-vpn-hcp
• Profile registration is intentionally not in this PR; it lives in multiarch: register libvirt-s390x-vpn-hcp cluster profile (2/2) #83138

HCP needs dedicated IPs on these 2 leases; leaving them in the shared OZ pool would let homogeneous jobs acquire them. Lease names are unchanged so existing CoreDNS rewrites for libvirt-s390x-oz-3-* → lnxocp14 still apply.

Test plan

• check-cluster-profiles-config passes on this PR
• After merge: confirm cluster-secrets-libvirt-s390x-vpn-hcp exists in ci
• Then merge multiarch: register libvirt-s390x-vpn-hcp cluster profile (2/2) #83138 (2/2)

[openshift-ci]

Hi @ibm-adarsh. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Walkthrough

The change adds the libvirt-s390x-vpn-hcp cluster profile, its cluster secrets, and a dedicated quota slice. Two oz-3 lease names move from the existing VPN OZ quota slice to the new HCP quota slice.

Changes

libvirt-s390x HCP integration

Layer / File(s)	Summary
Configure HCP quota slice core-services/prow/02_config/generate-boskos.py, core-services/prow/02_config/_boskos.yaml	Adds the HCP quota-slice configuration and assigns libvirt-s390x-oz-3-2 and libvirt-s390x-oz-3-3 to it.
Wire cluster profile and secrets ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml, core-services/ci-secret-bootstrap/_config.yaml	Adds the libvirt-s390x-vpn-hcp profile and maps its cluster group to shared pull-secret and SSH credentials.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#82263: Both changes update the libvirt-s390x VPN quota-slice configuration and lease assignments.
• openshift/release#83011: Both changes add Boskos quota-slice resource configurations.

Suggested reviewers: mohit-sharma46, jimdaga, amisstea

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only YAML and Python configuration; added-line and repository-wide searches found no Ginkgo test declarations or dynamic test titles.
Test Structure And Quality	✅ Passed	The PR changes only YAML configuration and a Python generator; the patch contains no Ginkgo tests or cluster-interaction operations, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	The PR changes only four YAML/Python configuration files and adds no test paths or Ginkgo declarations, so the MicroShift test compatibility check is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request changes only YAML and Python configuration files; it adds no Ginkgo e2e tests, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The diff changes only cluster-profile, secret-bootstrap, and Boskos configuration; it adds no deployment/controller code or topology-related scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The commit changes only YAML and a Boskos generator; added code has no OTE setup or stdout writes, and the generator writes output to _boskos.yaml.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR changes only YAML configuration and a Boskos generator; it adds no Ginkgo tests or test network logic requiring IPv4 or external connectivity.
No-Weak-Crypto	✅ Passed	The PR adds only YAML and Boskos configuration; exact added-line and structural scans found no weak algorithms, crypto APIs, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	Changed files contain only cluster-profile, secret-bootstrap, Boskos, and generator configuration; added lines contain no Kubernetes workload or privilege fields.
No-Sensitive-Data-In-Logs	✅ Passed	The changes add secret references and cluster/lease configuration only; searches found no logging, print, echo, or console calls and no literal credential values.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: adding the libvirt-s390x-vpn-hcp Boskos configuration and secret bootstrap.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[v78singh]

/ok-to-test

[v78singh]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ibm-adarsh, v78singh
Once this PR has been reviewed and has the lgtm label, please assign psalajova for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• core-services/ci-secret-bootstrap/OWNERS
• core-services/prow/02_config/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@ibm-adarsh: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[ibm-adarsh]

/test check-cluster-profiles-config

[openshift-ci]

@ibm-adarsh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[ibm-adarsh]

Hi @jmguzik @stbenjam Can you please review and approve this & dependent PR.
Thank you!