openshift · maximunited · Jun 23, 2026
diff --git a/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml b/ci-operator/config/medik8s/system-tests/medik8s-system-tests-main__4.22-konflux.yaml
@@ -3,6 +3,10 @@ base_images:
     name: "4.22"
     namespace: ocp
     tag: aws-efs-csi-operator-create-efs
+  hypershift-operator:
+    name: hypershift-operator
+    namespace: hypershift
+    tag: latest
   upi-installer:
     name: "4.22"
     namespace: ocp
@@ -199,6 +203,78 @@ tests:
           cpu: 100m
           memory: 200Mi
     workflow: ipi-aws
+- always_run: false
+  as: e2e-sbr-hypershift-aws-odf
+  capabilities:
+  - intranet
+  optional: true
+  steps:
+    cluster_profile: medik8s-aws
+    env:
+      ECO_TEST_FEATURES: sbr-operator
+      HYPERSHIFT_INSTANCE_TYPE: m5.4xlarge
+      HYPERSHIFT_NODE_COUNT: "3"
+      OCP_VERSION: "422"
+      ODF_OPERATOR_SUB_CHANNEL: stable-4.21
+      OO_CHANNEL: stable
+      OPERATORS: storage-based-remediation
+      SC_WAIT_TIMEOUT: 10m
+      SKIP_IDMS: "true"
+    test:
+    - ref: medik8s-sbr-hypershift-switch-kubeconfig
+    - ref: medik8s-sbr-hypershift-wait-nodes
+    - ref: medik8s-catalogsource
+    - ref: medik8s-operator-subscribe
+    - ref: odf-prepare-cluster
+    - ref: operatorhub-subscribe-odf-operator
+    - ref: odf-apply-storage-cluster
+    - as: e2e-test
+      cli: latest
+      commands: make run-tests
+      env:
+      - name: ECO_TEST_FEATURES
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+    workflow: medik8s-sbr-hypershift
+- always_run: false
+  as: e2e-sbr-hypershift-persistent-aws-odf
+  capabilities:
+  - intranet
+  optional: true
+  steps:
+    cluster_profile: hypershift-aws
+    env:
+      ECO_TEST_FEATURES: sbr-operator
+      HYPERSHIFT_INSTANCE_TYPE: m5.4xlarge
+      HYPERSHIFT_NODE_COUNT: "3"
+      OCP_VERSION: "422"
+      ODF_OPERATOR_SUB_CHANNEL: stable-4.21
+      OO_CHANNEL: stable
+      OPERATORS: storage-based-remediation
+      SC_WAIT_TIMEOUT: 10m
+      SKIP_IDMS: "true"
+    test:
+    - ref: medik8s-sbr-hypershift-switch-kubeconfig
+    - ref: medik8s-sbr-hypershift-wait-nodes
+    - ref: medik8s-catalogsource
+    - ref: medik8s-operator-subscribe
+    - ref: odf-prepare-cluster
+    - ref: operatorhub-subscribe-odf-operator
+    - ref: odf-apply-storage-cluster
+    - as: e2e-test
+      cli: latest
+      commands: make run-tests
+      env:
+      - name: ECO_TEST_FEATURES
+      from: src
+      resources:
+        requests:
+          cpu: 100m
+          memory: 200Mi
+    workflow: medik8s-sbr-hypershift-persistent
 - always_run: false
   as: e2e-snr-aws
   capabilities:

diff --git a/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-presubmits.yaml b/ci-operator/jobs/medik8s/system-tests/medik8s-system-tests-main-presubmits.yaml
@@ -528,6 +528,182 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )4.22-konflux-e2e-sbr-aws-odf,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build05
+    context: ci/prow/4.22-konflux-e2e-sbr-hypershift-aws-odf
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+    labels:
+      capability/intranet: intranet
+      ci-operator.openshift.io/cloud: aws
+      ci-operator.openshift.io/cloud-cluster-profile: medik8s-aws
+      ci-operator.openshift.io/variant: 4.22-konflux
+      ci.openshift.io/generator: prowgen
+      job-release: "4.22"
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-hypershift-aws-odf
+    optional: true
+    rerun_command: /test 4.22-konflux-e2e-sbr-hypershift-aws-odf
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-sbr-hypershift-aws-odf
+        - --variant=4.22-konflux
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )4.22-konflux-e2e-sbr-hypershift-aws-odf,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build05
+    context: ci/prow/4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+    labels:
+      capability/intranet: intranet
+      ci-operator.openshift.io/cloud: hypershift-aws
+      ci-operator.openshift.io/cloud-cluster-profile: hypershift-aws
+      ci-operator.openshift.io/variant: 4.22-konflux
+      ci.openshift.io/generator: prowgen
+      job-release: "4.22"
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-medik8s-system-tests-main-4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf
+    optional: true
+    rerun_command: /test 4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-sbr-hypershift-persistent-aws-odf
+        - --variant=4.22-konflux
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )4.22-konflux-e2e-sbr-hypershift-persistent-aws-odf,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:

diff --git a/ci-operator/step-registry/medik8s/catalogsource/medik8s-catalogsource-commands.sh b/ci-operator/step-registry/medik8s/catalogsource/medik8s-catalogsource-commands.sh
@@ -14,6 +14,7 @@ declare CATALOG_MODE="${CATALOG_MODE:-konflux}"
 declare CATALOG_SOURCE_NAME="${CATALOG_SOURCE_NAME:-medik8s-catalog}"
 declare CATALOG_IMAGE=""
 declare IDMS_NAME="${IDMS_NAME:-medik8s-konflux}"
+declare SKIP_IDMS="${SKIP_IDMS:-false}"
 declare OCP_VERSION="${OCP_VERSION:-}"
 declare FBC_COMMIT_SHA="${FBC_COMMIT_SHA:-}"
 declare FBC_SHA_PINNED="${FBC_COMMIT_SHA:+true}"
@@ -267,7 +268,11 @@ main() {
         fi
         resolve_commit_sha
         verify_fbc_image
-        apply_idms
+        if [[ "${SKIP_IDMS}" == "true" ]]; then
+            log "Skipping IDMS (SKIP_IDMS=true) — cluster can pull from quay.io directly"
+        else
+            apply_idms
+        fi
         CATALOG_IMAGE="${FBC_IMAGE_REPO}/${FBC_IMAGE_PREFIX}-${OCP_VERSION}:${FBC_COMMIT_SHA}"
     fi
 

diff --git a/ci-operator/step-registry/medik8s/catalogsource/medik8s-catalogsource-ref.yaml b/ci-operator/step-registry/medik8s/catalogsource/medik8s-catalogsource-ref.yaml
@@ -43,6 +43,13 @@ ref:
   - name: IDMS_NAME
     documentation: The name of the ImageDigestMirrorSet to create. Only used in konflux mode.
     default: "medik8s-konflux"
+  - name: SKIP_IDMS
+    documentation: |-
+      When "true", skip applying the ImageDigestMirrorSet in konflux mode.
+      Required on HyperShift hosted clusters where IDMS must go through the HostedCluster
+      object and the ValidatingAdmissionPolicy blocks direct application.
+      Safe to use on connected clusters where the FBC image is reachable from quay.io directly.
+    default: "false"
   documentation: |-
     Creates a CatalogSource for medik8s/RHWA operator testing.
     Two modes: "konflux" (default) resolves Konflux FBC artifacts from Quay with IDMS

diff --git a/ci-operator/step-registry/medik8s/sbr/OWNERS b/ci-operator/step-registry/medik8s/sbr/OWNERS
@@ -0,0 +1,16 @@
+approvers:
+  - beekhof
+  - clobrano
+  - maximunited
+  - mshitrit
+  - razo7
+  - slintes
+  - ugreener
+reviewers:
+  - beekhof
+  - clobrano
+  - maximunited
+  - mshitrit
+  - razo7
+  - slintes
+  - ugreener
diff --git a/ci-operator/step-registry/medik8s/sbr/hypershift-persistent/OWNERS b/ci-operator/step-registry/medik8s/sbr/hypershift-persistent/OWNERS
@@ -0,0 +1,16 @@
+approvers:
+  - beekhof
+  - clobrano
+  - maximunited
+  - mshitrit
+  - razo7
+  - slintes
+  - ugreener
+reviewers:
+  - beekhof
+  - clobrano
+  - maximunited
+  - mshitrit
+  - razo7
+  - slintes
+  - ugreener
diff --git a/...edik8s/sbr/hypershift-persistent/medik8s-sbr-hypershift-persistent-workflow.metadata.json b/...edik8s/sbr/hypershift-persistent/medik8s-sbr-hypershift-persistent-workflow.metadata.json
@@ -0,0 +1,23 @@
+{
+	"path": "medik8s/sbr/hypershift-persistent/medik8s-sbr-hypershift-persistent-workflow.yaml",
+	"owners": {
+		"approvers": [
+			"beekhof",
+			"clobrano",
+			"maximunited",
+			"mshitrit",
+			"razo7",
+			"slintes",
+			"ugreener"
+		],
+		"reviewers": [
+			"beekhof",
+			"clobrano",
+			"maximunited",
+			"mshitrit",
+			"razo7",
+			"slintes",
+			"ugreener"
+		]
+	}
+}
diff --git a/...egistry/medik8s/sbr/hypershift-persistent/medik8s-sbr-hypershift-persistent-workflow.yaml b/...egistry/medik8s/sbr/hypershift-persistent/medik8s-sbr-hypershift-persistent-workflow.yaml
@@ -0,0 +1,17 @@
+workflow:
+  as: medik8s-sbr-hypershift-persistent
+  documentation: |-
+    HyperShift AWS cluster lifecycle for medik8s SBR e2e tests using the
+    shared persistent management cluster (hypershift-aws cluster profile).
+    Skips management cluster provisioning and teardown — only the HostedCluster
+    is created and destroyed per run. Requires cluster_profile: hypershift-aws.
+  steps:
+    pre:
+    - ref: ipi-install-rbac
+    - chain: hypershift-setup-root-management-cluster
+    - chain: hypershift-aws-create
+    - ref: medik8s-sbr-hypershift-apply-image-sources
+    post:
+    - ref: medik8s-sbr-hypershift-restore-kubeconfig
+    - chain: hypershift-dump
+    - chain: hypershift-aws-destroy