From 884452db783ca2e86833b680343e3dfe8c17e14f Mon Sep 17 00:00:00 2001
From: Lancelot Robson <lancelot.robson@gmail.com>
Date: Tue, 9 Dec 2025 18:51:49 +0000
Subject: [PATCH] Add OCP-HCP runs to e2es

---
 .../end-to-end/pipelines/certification.yml    |  99 +++++++++--
 .../end-to-end/scripts/body_standard.sh       | 105 ++++++++----
 .../end-to-end/scripts/global_epilogue.sh     | 162 ++++++++++++++----
 .../end-to-end/scripts/global_prologue.sh     |  35 +++-
 4 files changed, 311 insertions(+), 90 deletions(-)

diff --git a/.semaphore/end-to-end/pipelines/certification.yml b/.semaphore/end-to-end/pipelines/certification.yml
index 0fc5edb92ac..4a0d15afb5e 100644
--- a/.semaphore/end-to-end/pipelines/certification.yml
+++ b/.semaphore/end-to-end/pipelines/certification.yml
@@ -7,7 +7,7 @@ name: banzai-calico Openshift Certification
 
 agent:
   machine:
-    type: f1-standard-2
+    type: c1-standard-1
     os_image: ubuntu2204
 
 execution_time_limit:
@@ -31,34 +31,85 @@ global_job_config:
       value: "ocp-cert"
     - name: STERN_CHECK
       value: "DISABLED"
+    - name: PROVISIONER
+      value: aws-openshift
+    - name: INSTALLER
+      value: operator
+    - name: DATAPLANE
+      value: "CalicoIptables"
 
 blocks:
-  - name: Openshift OCP
+  - name: Standalone cluster tests
     dependencies: []
     task:
+      agent:
+        machine:
+          type: f1-standard-2
+          os_image: ubuntu2204
       jobs:
-        - name: CNI & Virtualization tests
+        - name: Standalone cluster tests (cert)
           execution_time_limit:
             hours: 6
           commands:
             - ~/calico/.semaphore/end-to-end/scripts/body_standard.sh
           matrix:
             - env_var: OPENSHIFT_VERSION
-              values:
-                - "4.16.38"
-                - "4.17.25"
-                - "4.18.9"
+              values: ["4.20.1", "4.19.17", "4.18.27"]
           env_vars:
-            - name: USE_HASH_RELEASE
-              value: "false"
-            - name: PROVISIONER
-              value: aws-openshift
-            - name: INSTALLER
-              value: operator
+            - name: OPENSHIFT_CLUSTER_TYPE
+              value: "Standalone"
+            - name: TEST_TYPE
+              value: "ocp-cert"
             - name: ENABLE_OCP_VIRT
               value: "true"
-            - name: DATAPLANE
-              value: "CalicoIptables"
+
+  - name: HCP setup hosting
+    dependencies: []
+    task:
+      jobs:
+        # only define one provisioner per job. if you wish to create multiple hosting clusters,
+        # use separate jobs per hosting cluster and update the `HOSTING_CLUSTER` value in hosted block
+        # do not forget to add the `HOSTING_CLUSTER` value to the "teardown hosting" block
+        - name: HCP setup hosting
+          execution_time_limit:
+            hours: 3
+          commands:
+            - ~/calico/.semaphore/end-to-end/scripts/body_standard.sh
+          env_vars:
+            - name: OPENSHIFT_VERSION
+              value: "4.20.1"
+            - name: OPENSHIFT_CLUSTER_TYPE
+              value: "HCP-hosting"
+            - name: HOSTING_CLUSTER
+              value: "hcp-shared-hosting"
+            - name: HCP_STAGE
+              value: "setup-hosting"
+
+  - name: HCP hosted setup and tests
+    dependencies: ["HCP setup hosting"]
+    task:
+      agent:
+        machine:
+          type: f1-standard-2
+          os_image: ubuntu2204
+      jobs:
+        - name: HCP tests - hosted (cert)
+          execution_time_limit:
+            hours: 6
+          commands:
+            - ~/calico/.semaphore/end-to-end/scripts/body_standard.sh
+          matrix:
+            - env_var: OPENSHIFT_VERSION
+              values: ["4.20.1", "4.19.17", "4.18.27"]
+          env_vars:
+            - name: HCP_STAGE
+              value: "hosted"
+            - name: OPENSHIFT_CLUSTER_TYPE
+              value: "HCP-hosted"
+            - name: HOSTING_CLUSTER
+              value: "hcp-shared-hosting"
+            - name: TEST_TYPE
+              value: "ocp-cert"
 
 promotions:
   - name: Cleanup jobs
@@ -68,7 +119,25 @@ promotions:
 
 after_pipeline:
   task:
+    secrets:
+      - name: banzai-secrets
     jobs:
       - name: Reports
         commands:
           - test-results gen-pipeline-report --force
+      - name: Destroy Hosting Clusters
+        execution_time_limit:
+          hours: 3
+        commands:
+          - checkout
+          - source ~/calico/.semaphore/end-to-end/scripts/global_prologue.sh
+          - unset CLUSTER_NAME
+          - ~/calico/.semaphore/end-to-end/scripts/body_standard.sh
+          - ~/calico/.semaphore/end-to-end/scripts/global_epilogue.sh
+        env_vars:
+          - name: HCP_STAGE
+            value: "destroy-hosting"
+        matrix:
+          - env_var: HOSTING_CLUSTER
+            values:
+              - "hcp-shared-hosting"
diff --git a/.semaphore/end-to-end/scripts/body_standard.sh b/.semaphore/end-to-end/scripts/body_standard.sh
index 0aa22319cea..6f4c8b3c670 100755
--- a/.semaphore/end-to-end/scripts/body_standard.sh
+++ b/.semaphore/end-to-end/scripts/body_standard.sh
@@ -8,52 +8,81 @@ else
   VERBOSE=""
 fi
 
-cd "${BZ_HOME}"
+if [[ "${HCP_ENABLED}" == "true" ]]; then
+  echo "[INFO] starting hcp job..."
 
-echo "[INFO] starting bz provision..."
-bz provision $VERBOSE | tee >(gzip --stdout > ${BZ_LOGS_DIR}/provision.log.gz)
+  echo "[INFO] starting hcp provision..."
+  hcp-provision.sh |& tee ${BZ_LOGS_DIR}/provision.log
 
-cache delete $SEMAPHORE_JOB_ID
-cache store ${SEMAPHORE_JOB_ID} ${BZ_HOME}
+  cache delete ${SEMAPHORE_JOB_ID}
+  cache store ${SEMAPHORE_JOB_ID} ${BZ_HOME}
 
-echo "[INFO] starting bz install..."
-bz install $VERBOSE | tee >(gzip --stdout > ${BZ_LOGS_DIR}/install.log.gz)
+  echo "[INFO] Test logs will be available here after the run: ${SEMAPHORE_ORGANIZATION_URL}/artifacts/jobs/${SEMAPHORE_JOB_ID}?path=semaphore%2Flogs"
+  echo "[INFO] Alternatively, you can view logs while job is running using 'sem attach ${SEMAPHORE_JOB_ID}' and then 'tail -f ${BZ_LOGS_DIR}/${TEST_TYPE}-tests.log'"
 
-# Put the bin dir into the PATH
-export PATH=$PATH:${BZ_LOCAL_DIR}/bin
+  echo "[INFO] starting hcp testing..."
+  hcp-test.sh |& tee ${BZ_LOGS_DIR}/${TEST_TYPE}-tests.log
 
-if [[ "${ENABLE_EXTERNAL_NODE}" == "true" ]]; then
-  export EXT_USER=ubuntu
-  EXT_IP=$(cat "${BZ_LOCAL_DIR}"/external_ip)
-  export EXT_IP
-  export EXT_KEY=${BZ_LOCAL_DIR}/external_key
-  export K8S_E2E_DOCKER_EXTRA_FLAGS="-v $EXT_KEY:/key --env EXT_USER --env EXT_KEY=/key --env EXT_IP $K8S_E2E_DOCKER_EXTRA_FLAGS"
-  echo "EXT_USER=ubuntu EXT_IP=$EXT_IP, EXT_KEY=$EXT_KEY"
-  echo "K8S_E2E_DOCKER_EXTRA_FLAGS=$K8S_E2E_DOCKER_EXTRA_FLAGS"
-fi
+else
+  echo "[INFO] starting job..."
+  echo "[INFO] BZ_HOME=${BZ_HOME}"
 
-if [ -n "${IPAM_TEST_POOL_SUBNET}" ]; then
-  export K8S_E2E_DOCKER_EXTRA_FLAGS="$K8S_E2E_DOCKER_EXTRA_FLAGS --env IPAM_TEST_POOL_SUBNET"
-  echo "IPAM_TEST_POOL_SUBNET=$IPAM_TEST_POOL_SUBNET"
-fi
+  cd "${BZ_HOME}"
+  if [[ "${HCP_STAGE}" == "hosting" || "${HCP_STAGE}" == "destroy-hosting" ]]; then
+    :  # Skip provisioning for hosting stages as cluster already exists
+  else
+    echo "[INFO] starting bz provision..."
+    bz provision $VERBOSE |& tee >(gzip --stdout > ${BZ_LOGS_DIR}/provision.log.gz)
 
-if [ "${FAILSAFE_443}" == "true" ]; then
-  KUBECONFIG=${BZ_LOCAL_DIR}/kubeconfig kubectl patch felixconfiguration default --type=merge -p '{"spec":{"failsafeOutboundHostPorts": [{"protocol": "udp", "port":53},{"protocol": "udp", "port":67},{"protocol": "tcp", "port":179},{"protocol": "tcp", "port":2379},{"protocol": "tcp", "port":2380},{"protocol": "tcp", "port":5473},{"protocol": "tcp", "port":443},{"protocol": "tcp", "port":6666},{"protocol": "tcp", "port":6667}]}}'
-fi
+    cache delete $SEMAPHORE_JOB_ID
+    cache store ${SEMAPHORE_JOB_ID} ${BZ_HOME}
 
-# Perform the operator migration following the instructions here:
-# https://projectcalico.docs.tigera.io/maintenance/operator-migration
-if [[ -n "$OPERATOR_MIGRATE" ]]; then
-  ${HOME}/${SEMAPHORE_GIT_DIR}/.semaphore/end-to-end/scripts/test_scripts/operator_migrate.sh
-fi
+    echo "[INFO] starting bz install..."
+    bz install $VERBOSE |& tee >(gzip --stdout > ${BZ_LOGS_DIR}/install.log.gz)
 
-if [[ -n "$UPLEVEL_RELEASE_STREAM" ]]; then
-  echo "[INFO] starting bz upgrade..."
-  bz upgrade $VERBOSE | tee >(gzip --stdout > ${BZ_LOGS_DIR}/upgrade.log.gz)
-fi
+    if [[ "${HCP_STAGE}" == "setup-hosting" ]]; then
+      echo "[INFO] HCP_STAGE=${HCP_STAGE}, storing hosting cluster profile in cache"
+      cache store ${SEMAPHORE_WORKFLOW_ID}-hosting-${HOSTING_CLUSTER} ${BZ_HOME}
+    fi
+  fi
 
-echo "[INFO] Test logs will be available here after the run: ${SEMAPHORE_ORGANIZATION_URL}/artifacts/jobs/${SEMAPHORE_JOB_ID}?path=semaphore%2Flogs"
-echo "[INFO] Alternatively, you can view logs while job is running using 'sem attach ${SEMAPHORE_JOB_ID}' and then 'tail -f ${BZ_LOGS_DIR}/${TEST_TYPE}-tests.log'"
+  # Put the bin dir into the PATH
+  export PATH=$PATH:${BZ_LOCAL_DIR}/bin
 
-echo "[INFO] starting bz testing..."
-bz tests $VERBOSE | tee >(gzip --stdout > ${BZ_LOGS_DIR}/${TEST_TYPE}-tests.log.gz)
+  if [[ "${ENABLE_EXTERNAL_NODE}" == "true" ]]; then
+    export EXT_USER=ubuntu
+    EXT_IP=$(cat "${BZ_LOCAL_DIR}"/external_ip)
+    export EXT_IP
+    export EXT_KEY=${BZ_LOCAL_DIR}/external_key
+    export K8S_E2E_DOCKER_EXTRA_FLAGS="-v $EXT_KEY:/key --env EXT_USER --env EXT_KEY=/key --env EXT_IP $K8S_E2E_DOCKER_EXTRA_FLAGS"
+    echo "EXT_USER=ubuntu EXT_IP=$EXT_IP, EXT_KEY=$EXT_KEY"
+    echo "K8S_E2E_DOCKER_EXTRA_FLAGS=$K8S_E2E_DOCKER_EXTRA_FLAGS"
+  fi
+
+  if [ -n "${IPAM_TEST_POOL_SUBNET}" ]; then
+    export K8S_E2E_DOCKER_EXTRA_FLAGS="$K8S_E2E_DOCKER_EXTRA_FLAGS --env IPAM_TEST_POOL_SUBNET"
+    echo "IPAM_TEST_POOL_SUBNET=$IPAM_TEST_POOL_SUBNET"
+  fi
+
+  if [ "${FAILSAFE_443}" == "true" ]; then
+    KUBECONFIG=${BZ_LOCAL_DIR}/kubeconfig kubectl patch felixconfiguration default --type=merge -p '{"spec":{"failsafeOutboundHostPorts": [{"protocol": "udp", "port":53},{"protocol": "udp", "port":67},{"protocol": "tcp", "port":179},{"protocol": "tcp", "port":2379},{"protocol": "tcp", "port":2380},{"protocol": "tcp", "port":5473},{"protocol": "tcp", "port":443},{"protocol": "tcp", "port":6666},{"protocol": "tcp", "port":6667}]}}'
+  fi
+
+  # Perform the operator migration following the instructions here:
+  # https://projectcalico.docs.tigera.io/maintenance/operator-migration
+  if [[ -n "$OPERATOR_MIGRATE" ]]; then
+    ${HOME}/${SEMAPHORE_GIT_DIR}/.semaphore/end-to-end/scripts/test_scripts/operator_migrate.sh |& tee >(gzip --stdout > ${BZ_LOGS_DIR}/operator_migrate.log.gz)
+  fi
+
+  if [[ -n "$UPLEVEL_RELEASE_STREAM" ]]; then
+    echo "[INFO] starting bz upgrade..."
+    bz upgrade $VERBOSE |& tee >(gzip --stdout > ${BZ_LOGS_DIR}/upgrade.log.gz)
+  fi
+  if [[ ${MCM_STAGE:-} != *-mgmt* ]] && [[ ${HCP_STAGE:-} != *-hosting* ]]; then
+    echo "[INFO] Test logs will be available here after the run: ${SEMAPHORE_ORGANIZATION_URL}/artifacts/jobs/${SEMAPHORE_JOB_ID}?path=semaphore%2Flogs"
+    echo "[INFO] Alternatively, you can view logs while job is running using 'sem attach ${SEMAPHORE_JOB_ID}' and then 'tail -f ${BZ_LOGS_DIR}/${TEST_TYPE}-tests.log'"
+
+    echo "[INFO] starting bz testing..."
+    bz tests $VERBOSE |& tee >(gzip --stdout > ${BZ_LOGS_DIR}/${TEST_TYPE}-tests.log.gz)
+  fi
+fi
diff --git a/.semaphore/end-to-end/scripts/global_epilogue.sh b/.semaphore/end-to-end/scripts/global_epilogue.sh
index 9a679d494bc..3154da6b296 100755
--- a/.semaphore/end-to-end/scripts/global_epilogue.sh
+++ b/.semaphore/end-to-end/scripts/global_epilogue.sh
@@ -1,6 +1,67 @@
 #!/usr/bin/env bash
 set -eo pipefail
 
+delete_artifacts() {
+  echo "[INFO] Deleting artifacts that are already pushed"
+  # Validate variables before destructive commands
+  if [[ -n "${BZ_LOCAL_DIR}" && -n "${DIAGS_ARCHIVE_FILENAME}" ]]; then
+    sudo rm -rf "${BZ_LOCAL_DIR}/${DIAGS_ARCHIVE_FILENAME}" || true
+  else
+    echo "[WARN] BZ_LOCAL_DIR or DIAGS_ARCHIVE_FILENAME is unset or empty, skipping deletion of archive file."
+  fi
+  if [[ -n "${BZ_LOCAL_DIR}" ]]; then
+    sudo rm -rf "${BZ_LOCAL_DIR}/diags" || true
+  else
+    echo "[WARN] BZ_LOCAL_DIR is unset or empty, skipping deletion of diags directory."
+  fi
+  sudo rm -rf ~/.cache/* /var/lib/apt/lists/* || true
+}
+
+delete_calicoctl() {
+  echo "[INFO] Deleting calicoctl"
+  if [[ -n "${BZ_LOGS_DIR}" ]]; then
+    sudo rm -rf "${BZ_LOGS_DIR}/bin/kubectl-calico" || true
+    sudo rm -rf "${BZ_LOGS_DIR}/bin/calico-*" || true
+  else
+    echo "[WARN] BZ_LOGS_DIR is unset or empty, skipping deletion of calicoctl binaries."
+  fi
+}
+
+delete_gcloud() {
+  if [[ ! $PROVISIONER =~ ^gcp-.* ]]; then
+    sudo NEEDRESTART_SUSPEND=1 NEEDRESTART_MODE=a apt remove google-cloud-cli google-cloud-cli-gke-gcloud-auth-plugin -y && sudo needrestart -r a || true
+  fi
+}
+
+run_non_hcp_reports_and_diags() {
+  if [[ "$SEMAPHORE_JOB_RESULT" != "passed" || "$TEST_TYPE" == "ocp-cert" ]]; then
+    echo "[INFO] global_epilogue: capturing diags"
+    bz diags $VERBOSE |& tee ${BZ_LOGS_DIR}/diagnostic.log || true
+    artifact push job ${BZ_LOCAL_DIR}/${DIAGS_ARCHIVE_FILENAME} --destination semaphore/diags.tgz || true
+    if [[ "$GS_BUCKET" != "" ]]; then
+      echo "[INFO] bucket_upload: capturing diags"
+      gsutil cp ${BZ_LOCAL_DIR}/${DIAGS_ARCHIVE_FILENAME} gs://${GS_BUCKET}/${METADATA}/${DIAGS_ARCHIVE_FILENAME} || true
+    fi
+  fi
+
+  delete_artifacts; delete_calicoctl; delete_gcloud
+
+  REPORT_DIR=${REPORT_DIR:-"${BZ_LOCAL_DIR}/report/${TEST_TYPE}"}
+  echo "[INFO] global_epilogue: pushing report artifacts"
+  artifact push job ${REPORT_DIR} --destination semaphore/test-results || true
+  cp ${REPORT_DIR}/junit.xml . || true
+
+  echo "[INFO] publish new semaphore test results"
+  test_publish=0
+  test-results publish ${REPORT_DIR}/junit.xml --name "$SEMAPHORE_JOB_NAME" || test_publish=1
+  echo "[INFO] Status of Publishing test results to Semaphore: ${test_publish}"
+}
+
+run_non_hcp_destroy() {
+  echo "[INFO] global_epilogue: destroy"
+  bz destroy $VERBOSE |& tee ${BZ_LOGS_DIR}/destroy.log || true
+}
+
 echo "[INFO] starting global_epilogue"
 
 cd "${BZ_HOME}"
@@ -29,44 +90,75 @@ if [[ "$GS_BUCKET" != "" ]]; then
   METADATA=${METADATA}/$(date -d @${SEMAPHORE_PIPELINE_STARTED_AT} -u +%H:%M)
 fi
 
-if [[ "$SEMAPHORE_JOB_RESULT" != "passed" ]] || [[ "$TEST_TYPE" == "ocp-cert" ]]; then
-  echo "[INFO] global_epilogue: capturing diags"
-  bz diags $VERBOSE | tee ${BZ_LOGS_DIR}/diagnostic.log || true
-  artifact push job ${BZ_LOCAL_DIR}/${DIAGS_ARCHIVE_FILENAME} --destination semaphore/diags.tgz || true
-  if [[ "$GS_BUCKET" != "" ]]; then
-    echo "[INFO] bucket_upload: capturing diags"
-    gsutil cp ${BZ_LOCAL_DIR}/${DIAGS_ARCHIVE_FILENAME} gs://${GS_BUCKET}/${METADATA}/${DIAGS_ARCHIVE_FILENAME} || true
+case "${HCP_STAGE:-}" in
+  setup-hosting|hosting|destroy-hosting)
+    # Do nothing for hosting stages
+    ;;
+  *)
+    echo "[INFO] create report and push test results to Lens"
+    cd ./scripts
+    echo "[INFO] downloading lens uploader script"
+    curl -H "Authorization: token ${GITHUB_ACCESS_TOKEN}" \
+        -H "Accept: application/vnd.github.v3.raw" \
+        -o ./run-lens.sh \
+          https://raw.githubusercontent.com/tigera/banzai-lens/main/uploader/run-lens.sh || true
+    echo "[INFO] running Lens uploader script"
+    chmod +x ./run-lens.sh || true
+    ./run-lens.sh || true
+    docker system prune -f || true
+    ;;
+esac
+
+echo "[INFO] BZ_HOME=${BZ_HOME}"
+cd "${BZ_HOME}"
+
+if [[ "${HCP_ENABLED}" == "true" ]]; then
+  # if test isn't passed OR if test_type is ocp-certification, capture diags
+  if [[ "$SEMAPHORE_JOB_RESULT" != "passed" || "$TEST_TYPE" == "ocp-cert" ]]; then
+    echo "[INFO] global_epilogue: hcp: capturing diags"
+    hcp-diags.sh |& tee ${BZ_LOGS_DIR}/diagnostic.log || true
+    artifact push job ${BZ_PROFILES_PATH}/.diags --destination semaphore/diags || true
   fi
-  rm -rf "${BZ_LOCAL_DIR:?}/${DIAGS_ARCHIVE_FILENAME:?}"
-  rm -rf ${BZ_LOCAL_DIR}/diags
-fi
 
-echo "[INFO] global_epilogue: pushing report artifacts"
-artifact push job ${REPORT_DIR} --destination semaphore/test-results || true
-test-results publish ${REPORT_DIR}/junit.xml --name "$SEMAPHORE_JOB_NAME" || true
-if [[ "$GS_BUCKET" != "" ]]; then
-  echo "[INFO] bucket_upload: pushing report artifacts"
-  gsutil cp ${REPORT_DIR}/junit.xml gs://${GS_BUCKET}/${METADATA}/junit.xml || true
+  echo "[INFO] global_epilogue: hcp: pushing report artifacts"
+  artifact push job ${BZ_PROFILES_PATH}/.report --destination semaphore/test-results || true
 
-  echo "[INFO] bucket_upload: pushing log artifacts"
-  gsutil cp -r -z ${BZ_LOGS_DIR}/* gs://${GS_BUCKET}/${METADATA}/logs/ || true
-fi
+  echo "[INFO] publish new semaphore test results"
+  test-results publish semaphore/test-results/junit.xml || true
 
-echo "[INFO] create and push test results to Lens"
-echo "[INFO] downloading lens uploader script"
-curl --retry 9 --retry-all-errors -H "Authorization: token ${GITHUB_ACCESS_TOKEN}" \
-     -H "Accept: application/vnd.github.v3.raw" \
-     -o ./run-lens.sh \
-      https://raw.githubusercontent.com/tigera/banzai-lens/main/uploader/run-lens.sh || true
-echo "[INFO] running Lens Uploader"
-chmod +x ./run-lens.sh || true
-./run-lens.sh || true
-cd "${BZ_HOME}"
+  delete_artifacts; delete_calicoctl; delete_gcloud
 
-echo "[INFO] global_epilogue: destroy"
-bz destroy $VERBOSE | tee >(gzip --stdout > ${BZ_LOGS_DIR}/destroy.log.gz) || true
-echo "[INFO] global_epilogue: pushing log artifacts"
-artifact push job ${BZ_LOGS_DIR} --destination semaphore/logs || true
+  echo "[INFO] global_epilogue: hcp destroy"
+  hcp-destroy.sh |& tee ${BZ_LOGS_DIR}/destroy.log || true
 
-echo "[INFO] global_epilogue: deleting cache"
-cache delete $SEMAPHORE_JOB_ID
+  echo "[INFO] global_epilogue: hcp: pushing log artifacts"
+  artifact push job ${BZ_LOGS_DIR} --destination semaphore/logs || true
+else
+  case "${HCP_STAGE:-}" in
+    setup-hosting)
+      artifact push workflow ${BZ_LOCAL_DIR}/kubeconfig -f --destination hosting-${HOSTING_CLUSTER}-kubeconfig
+      # setup-hosting preserves cache; no deletion
+      ;;
+    hosting)
+      # Hosting stages keep the cluster up; skip diags/destroy.
+      # Hosting cluster is persistent and should not have its cache deleted
+      :
+      ;;
+    destroy-hosting)
+      run_non_hcp_destroy
+      echo "[INFO] global_epilogue: deleting hosting cache"
+      artifact yank workflow hosting-${HOSTING_CLUSTER}-kubeconfig
+      cache delete ${SEMAPHORE_WORKFLOW_ID}-hosting-${HOSTING_CLUSTER}
+      cache delete "$(basename "$PWD")"
+      ;;
+    *)
+      run_non_hcp_reports_and_diags
+      run_non_hcp_destroy
+      echo "[INFO] global_epilogue: deleting job cache"
+      cache delete ${SEMAPHORE_JOB_ID}
+      ;;
+  esac
+
+  echo "[INFO] global_epilogue: pushing log artifacts"
+  artifact push job ${BZ_LOGS_DIR} --destination semaphore/logs || true
+fi
diff --git a/.semaphore/end-to-end/scripts/global_prologue.sh b/.semaphore/end-to-end/scripts/global_prologue.sh
index c8d278f0c64..456fbaa78c0 100755
--- a/.semaphore/end-to-end/scripts/global_prologue.sh
+++ b/.semaphore/end-to-end/scripts/global_prologue.sh
@@ -163,9 +163,40 @@ cp ~/secrets/docker_cfg.json "$HOME/.docker/config.json"
 mkdir -p "${BZ_LOGS_DIR}"
 
 cd "$HOME" || exit
+hcp_scripts="echo \"[INFO] Initializing Banzai utilities...\""
+hcp_scripts="$hcp_scripts; git clone git@github.com:tigera/banzai-utils.git \"${HOME}/banzai-utils\""
+hcp_scripts="$hcp_scripts; cp -R \"${HOME}/banzai-utils\"/ocp-hcp/*.sh \"${BZ_GLOBAL_BIN}\""
+if [[ "${HCP_ENABLED}" == "true" ]]; then eval $hcp_scripts; fi
+
 std="echo \"[INFO] Initializing Banzai profile...\""
-std="$std; bz init profile -n ${SEMAPHORE_JOB_ID} --skip-prompt ${BANZAI_CORE_BRANCH} --secretsPath $HOME/secrets | tee >(gzip --stdout > ${BZ_LOGS_DIR}/initialize.log.gz)"
+std="$std; bz init profile -n ${SEMAPHORE_JOB_ID} --skip-prompt ${BANZAI_CORE_BRANCH} --secretsPath $HOME/secrets 2>&1 | tee >(gzip --stdout > ${BZ_LOGS_DIR}/initialize.log.gz)"
 std="$std; cache store ${SEMAPHORE_JOB_ID} ${BZ_HOME}"
-eval "$std"
+
+hcp="unset CLUSTER_NAME; unset DIAGS_ARCHIVE_FILENAME; unset K8S_VERSION"
+hcp="$hcp; echo \"[INFO] starting hcp init...\""
+hcp="$hcp; hcp-init.sh 2>&1 | tee \"${BZ_LOGS_DIR}/initialize.log\""
+hcp="$hcp; cache store ${SEMAPHORE_JOB_ID} ${BZ_HOME}"
+
+restore_hcp_hosting="echo \"[INFO] Restoring from ${SEMAPHORE_WORKFLOW_ID}-hosting-${HOSTING_CLUSTER} cache\""
+restore_hcp_hosting="$restore_hcp_hosting; cache restore ${SEMAPHORE_WORKFLOW_ID}-hosting-${HOSTING_CLUSTER} |& tee ${BZ_LOGS_DIR}/restore.log"
+
+if [[ "${HCP_ENABLED}" == "true" ]]; then std=$hcp; elif [[ "${HCP_STAGE}" == "hosting" || "${HCP_STAGE}" == "destroy-hosting" ]]; then std=$restore_hcp_hosting; fi
+echo "$std"; eval "$std"
+
+restore_hcp_hosting_home="echo \"[INFO] Setting BZ_HOME env var from restored cache\""
+restore_hcp_hosting_home="$restore_hcp_hosting_home; unset BZ_HOME; export BZ_HOME=$(cat ${BZ_LOGS_DIR}/restore.log | grep -oP 'Restored: \K(.*)(?=.)' || echo '')"
+if [[ "${HCP_STAGE}" == "hosting" || "${HCP_STAGE}" == "destroy-hosting" ]]; then echo "$restore_hcp_hosting_home"; eval "$restore_hcp_hosting_home"; fi
+
+if [[ "${HCP_STAGE}" == "hosting" || "${HCP_STAGE}" == "destroy-hosting" ]]; then python3 -m pip install -r ${BZ_HOME}/scripts/requirements.txt; export PROVISIONER=aws-openshift; pip3 install --upgrade --user awscli; fi
+export BZ_LOCAL_DIR=${BZ_LOCAL_DIR:-"${BZ_HOME}/.local"}
+
+cmd="sudo apt-get install -y putty-tools"
+if [[ "$CREATE_WINDOWS_NODES" == "true" ]]; then eval "$cmd"; fi
+
+if [[ "${HCP_STAGE}" == "hosted" ]]; then artifact pull workflow hosting-${HOSTING_CLUSTER}-kubeconfig -f --destination ${BZ_LOCAL_DIR}/hosting-kubeconfig; fi
+
+rm_firmware_cmd="echo \"[INFO] Removing /usr/lib/firmware to free disk space\""
+rm_firmware_cmd="$rm_firmware_cmd; sudo rm -rf /usr/lib/firmware"
+if [[ "${HCP_STAGE}" == "hosted" ]]; then echo "$rm_firmware_cmd"; eval "$rm_firmware_cmd"; fi
 
 echo "[INFO] exiting prologue"