diff --git a/.github/workflows/e2e-tests.yaml b/.github/workflows/e2e-tests.yaml
new file mode 100644
index 0000000000000..61884750bcf68
--- /dev/null
+++ b/.github/workflows/e2e-tests.yaml
@@ -0,0 +1,317 @@
+name: E2E tests
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: 'Commit SHA of tests'
+        required: true
+        type: string
+      tested_commit:
+        description: 'Commit SHA to test'
+        required: true
+        type: string
+  workflow_call:
+env:
+  ROX_PRODUCT_BRANDING: stackrox
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  e2e-tests:
+    runs-on: ubuntu-latest
+    env:
+      KUBECONFIG: "/tmp/kubeconfig"
+      FAIL_FAST: "true"
+      INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }}
+      POD_SECURITY_POLICIES: "false"
+      ROX_VULN_MGMT_UNIFIED_CVE_DEFERRAL: "true"
+      ROX_PROCESSES_LISTENING_ON_PORT: "false"
+      REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
+      REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
+      GOOGLE_CREDENTIALS_GCR_SCANNER_V2: ${{ secrets.GOOGLE_CREDENTIALS_GCR_SCANNER_V2 }}
+      GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
+      QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
+      QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
+      QUAY_RHACS_ENG_BEARER_TOKEN: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }}
+      MAIN_IMAGE_TAG: ${{ inputs.tested_commit || github.event.pull_request.base.sha }}
+      TAG: ${{ inputs.tested_commit || github.event.pull_request.base.sha }}
+      GATHER_QA_TEST_DEBUG_LOGS: "false"
+      QA_TEST_DEBUG_LOGS: ""
+      SHARED_DIR: "/tmp"
+      #ORCHESTRATOR_FLAVOR: "openshift"
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 #${{ github.event.pull_request.commits }}
+          fetch-tags: true
+          show-progress: false
+
+      - run: |
+          nohup git fetch origin '+refs/tags/*:refs/tags/*' >>/tmp/git.fetching.log 2>&1 &
+          echo $! | tee /tmp/git.fetching.pid
+
+      - uses: ./.github/actions/job-preamble
+        if: ${{ !env.ACT }}
+        with:
+          gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }}
+
+      - name: Env variables
+        run: |
+          JOB_NAME="${JOB_NAME:-ocp-4-19-qa-e2e-tests}"
+
+          ARTIFACT_DIR="${ARTIFACT_DIR:-${SHARED_DIR}/artifacts/}"
+          mkdir -p "$ARTIFACT_DIR"
+
+          cat >> "$GITHUB_ENV" <<EOF
+          SHARED_DIR=${SHARED_DIR:-/tmp}
+          ARTIFACT_DIR=${ARTIFACT_DIR}
+
+          CI_JOB_NAME=${JOB_NAME}
+          JOB_NAME=${JOB_NAME}
+          JOB_NAME_SAFE=qa-e2e-tests
+          GRADLE_USER_HOME=${HOME}
+          EOF
+
+      #- name: Check if testing on Infra cluster
+      #  timeout-minutes: 5
+      #  continue-on-error: true
+      #  run: |
+      #    source scripts/ci/lib.sh
+      #    test_on_infra | tee -a "$GITHUB_ENV"
+
+      - id: cluster-exists
+        continue-on-error: true
+        run: |
+          kubectl get nodes
+
+      - name: Create k8s Kind Cluster
+        if: ${{ steps.cluster-exists.outcome == 'failure' }}
+        uses: helm/kind-action@v1
+        with:
+          kubeconfig: "${{ env.KUBECONFIG }}"
+
+      - name: Determine cluster flavor
+        timeout-minutes: 5
+        continue-on-error: true
+        run: |
+          set -x
+          if kubectl get scc; then
+            echo "CLUSTER=OPENSHIFT" | tee -a "$GITHUB_ENV"
+          else
+            echo "CLUSTER=K8S" | tee -a "$GITHUB_ENV"
+          fi 
+          exit 0
+          # groovy tests require CLUSTER='OPENSHIFT' for ocp or ='K8S' for GKE.
+          if [[ "$(infractl get "$CLUSTER_NAME" --json | jq -r '.Flavor')" == *"openshift"* ]]; then
+            echo "CLUSTER=OPENSHIFT" | tee -a "$GITHUB_ENV"
+            # default is "K8S"
+          fi
+
+      - name: Check tag lookup
+        timeout-minutes: 0.5
+        continue-on-error: true
+        run: |
+          set -x
+          while [[ "$(git describe --match='*.x' --tags --abbrev=10 --always --dirty --long --exclude '*-nightly-*')" \
+            != *".x-"* ]]; do
+            sleep 1
+            pgrep -F /tmp/git.fetching.pid || break
+          done
+          git describe --tags --abbrev=10 --always --dirty --long --exclude '*-nightly-*' || true
+          set +e
+          # example: 4.9.x-457-g9867327a52
+          MAIN_IMAGE_TAG=$(git describe --match="*.x" --tags --abbrev=10 --long --exclude '*-nightly-*' "${MAIN_IMAGE_TAG:-master}")
+          echo "MAIN_IMAGE_TAG=${MAIN_IMAGE_TAG}" | tee -a "$GITHUB_ENV"
+          echo "TAG=${MAIN_IMAGE_TAG}" | tee -a "$GITHUB_ENV"
+
+      #- name: Remove existing Stackrox
+      #  continue-on-error: true
+      #  if: ${{ steps.cluster-exists.outcome != 'failure' }}
+      #  run: |
+      #    kubectl delete namespace stackrox
+
+      - name: Find or Deploy Stackrox
+        id: rox-exists
+        continue-on-error: true
+        env:
+          DEPLOY_STACKROX_VIA_OPERATOR: "false"
+          # LOAD_BALANCER: "lb"
+          # SCANNER_SUPPORT: "true"
+          SENSOR_HELM_DEPLOY: "true"
+          ROX_SCANNER_V4: "false"
+          MONITORING_SUPPORT: "false"
+          LOCAL_DEPLOYMENT: "true"
+          ROX_BASELINE_GENERATION_DURATION: "1m"
+          ROX_NETWORK_BASELINE_OBSERVATION_PERIOD: "2m"
+        run: |
+          kubectl get namespace stackrox \
+            || { 
+              if [[ "${CLUSTER,,}" == "openshift" ]]; then
+                  kubectl get scc qatest-anyuid \
+                    || {
+                      kubectl create ns stackrox;
+                      kubectl create -f "qa-tests-backend/src/k8s/scc-qatest-anyuid.yaml";
+                    }
+              fi
+              tests/e2e/run-e2e-tests.sh -t "${MAIN_IMAGE_TAG}" --config-only qa && exit 1
+              # CI= ./deploy/deploy-local.sh;
+              find deploy -name password;
+              echo "ROX_USERNAME=admin" >> "$GITHUB_ENV";
+              echo "ROX_ADMIN_PASSWORD=$(cat deploy/*/central-deploy/password)" >> "$GITHUB_ENV";
+              exit 1;
+            }
+
+      - name: Stackrox service and auth lookup
+        id: stackrox-api
+        if: ${{ steps.rox-exists.outcome != 'failure' }}
+        timeout-minutes: 5
+        continue-on-error: true
+        run: |
+          set +e
+          set -x
+          ls -latr /tmp/
+          if [[ -e "${KUBECONFIG:-}" ]]; then
+            if [[ -z "${ROX_ADMIN_PASSWORD:-}" ]]; then
+              password="${ROX_ADMIN_PASSWORD:-$(cat "${KUBECONFIG%kubeconfig}admin-password")}"
+              password="${password:-$(kubectl -n stackrox get secret admin-pass -o json | jq -er '.data.password // ""' | base64 -d)}"
+              password="${password:-$(kubectl -n stackrox get secret central-htpasswd -o json | jq -er '.data.password // ""' | base64 -d)}"
+              echo "ROX_USERNAME=admin" | tee -a "$GITHUB_ENV"
+              echo "ROX_ADMIN_PASSWORD=${password}" >> "$GITHUB_ENV"
+            fi
+            if [[ -z "${API_HOSTNAME:-}" || ( $API_HOSTNAME == 'localhost' && -z "$(pgrep -F /tmp/forward.pid)" ) ]]; then
+              API_HOSTNAME=$(kubectl -n stackrox get route central -o jsonpath='{.status.ingress[0].host}')
+              API_HOSTNAME=${API_HOSTNAME:-$(kubectl -n stackrox get service central-loadbalancer -o jsonpath='{.status.loadBalancer.ingress[0].ip}')}
+              API_HOSTNAME=${API_HOSTNAME:-localhost}
+              echo "API_HOSTNAME=${API_HOSTNAME}" | tee -a "$GITHUB_ENV"
+              API_PORT=${API_PORT:-$(kubectl -n stackrox get route central -o jsonpath='{.spec.port.targetPort}')}
+              API_PORT=${API_PORT:-$(kubectl -n stackrox get service central-loadbalancer -o jsonpath='{.status.loadBalancer.ingress[0].port}')}
+              API_PORT=${API_PORT//https/443}
+              if [[ "$API_HOSTNAME" == 'localhost' ]]; then
+                ps -ef|grep kubectl || true
+                nohup kubectl -n stackrox port-forward svc/central 8000:443 &
+                echo $! | tee /tmp/forward.pid
+                API_PORT=8000
+              fi
+              API_PORT=${API_PORT:-443}
+              echo "API_HOSTNAME=${API_HOSTNAME}" | tee -a "$GITHUB_ENV"
+              echo "API_PORT=${API_PORT}" | tee -a "$GITHUB_ENV"
+            fi
+          fi
+          echo "API_ENDPOINT=${API_HOSTNAME:-localhost}:${API_PORT:-8000}" | tee -a "$GITHUB_ENV"
+
+      - name: Stackrox API test
+        if: ${{ steps.stackrox-api.outcome != 'failure' }}
+        continue-on-error: true
+        run: |
+          if [[ "${API_HOSTNAME:-}" == 'localhost' || -e /tmp/forward.pid ]]; then 
+            cat /tmp/forward.pid || true
+            ps -ef | grep kube || true
+          fi
+
+          curl -sk -u "${ROX_USERNAME}:${ROX_ADMIN_PASSWORD}" "https://${API_ENDPOINT}/v1/clusters" | jq '.'
+
+      # Only needed for Groovy
+      - name: Get secured cluster name
+        continue-on-error: true
+        if: ${{ steps.stackrox-api.outcome != 'failure' }}
+        run: |
+          echo "Groovy tests expect a secured cluster. Default name is 'remote' but the Infra demo clusters set names like 'production'. Look up what secured clusters exist:"
+          set -x
+          CLUSTER_INFO=$(curl -sk -u "${ROX_USERNAME}:${ROX_ADMIN_PASSWORD}" "https://${API_ENDPOINT}/v1/clusters")
+          echo "REMOTE_CLUSTER_NAME=$(jq -r '(.clusters[] | select(.name == "production") | .name) // .clusters[0].name' <<<"$CLUSTER_INFO")" | tee -a "$GITHUB_ENV"
+
+      - run: go get github.com/stackrox/scanner
+
+      - name: install oc cli
+        if: ${{ env.CLUSTER == 'OPENSHIFT' }}
+        run: |
+          # Some tests require `oc`.
+          curl --retry 5 --retry-all-errors -L -o /tmp/openshift-client-linux.tar.gz \
+            https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz
+          tar -C /tmp -xzf /tmp/openshift-client-linux.tar.gz
+          install --mode 755 /tmp/oc /usr/local/bin/
+          install --mode 755 /tmp/kubectl /usr/local/bin/
+
+      ## UI e2e - Cypress tests
+      #- name: UI E2E
+      #  timeout-minutes: 45
+      #  run: |
+      #    set +e
+      #    ls -latr ${SHARED_DIR}**
+      #    source tests/e2e/lib.sh
+      #    setup_automation_flavor_e2e_cluster "${CI_JOB_NAME}"
+      #    set -x
+      #    export DEPLOY_STACKROX_VIA_OPERATOR=true
+      #    export INSTALL_COMPLIANCE_OPERATOR=true
+      #    export ORCHESTRATOR_FLAVOR="${CLUSTER}"
+
+      #    #DEPLOY_DIR="deploy/${ORCHESTRATOR_FLAVOR}"
+      #    #HOSTALIASES=/tmp/hostaliases
+      #    #UI_BASE_URL (set to either "https://central-lb:443" or "https://localhost:${LOCAL_PORT}")
+      #    #make -C ui test-e2e, so these environment variables will be available during that execution.
+
+      #    export VERSION=$(echo "${MAIN_IMAGE_TAG}" | sed -E 's@^(([[:digit:]]+\.)+)x(-)?@\10\3@g')  # operator/Makefile VERSION is CSV_TAG
+      #    tests/e2e/run-ui-e2e.sh
+
+      # QA e2e - groovy tests
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: wrapper
+          #cache-read-only: false
+          cache-overwrite-existing: true
+          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release' }}
+
+      - timeout-minutes: 10
+        run: |
+          make -C qa-tests-backend compile
+
+      - timeout-minutes: 35
+        continue-on-error: true
+        run: |
+          export TEST_TARGET="smoke-test"
+          cd qa-tests-backend && ./gradlew testSMOKE --fail-fast
+
+      - timeout-minutes: 35
+        continue-on-error: true
+        run: |
+          export TEST_TARGET="bat-test"
+          cd qa-tests-backend && ./gradlew testParallelBAT testBAT --fail-fast --warn
+
+      - timeout-minutes: 35
+        run: |
+          export TEST_TARGET="test"
+          cd qa-tests-backend && ./gradlew testParallel testRest --fail-fast --warn
+
+      - name: Check shared dir and artifacts
+        if: always()
+        run: |
+          set +e
+          set -x
+          tail /tmp/git.fetching.log
+          ls -latr ${ARTIFACT_DIR}**
+          ls -latr ${SHARED_DIR}**
+          echo "check daemon:"
+          { pushd qa-tests-backend; ./gradlew --status || true; popd; }
+
+      - name: Publish Test Report
+        id: test-results
+        uses: test-summary/action@v2
+        continue-on-error: true
+        if: always()
+        with:
+          paths: 'qa-tests-backend/build/test-results/**/TEST-*.xml'
+          show: "all"
+
+      - name: Determine cluster flavor
+        if: ${{ steps.test-results.outcome == 'failure' }}
+        timeout-minutes: 5
+        run: |
+          tee -a "$GITHUB_STEP_SUMMARY" <<EOF
+          :boom: ${{ steps.test_summary.outputs.failed }}/${{ steps.test_summary.outputs.total }} failed
+          :seedling: ${{ steps.test_summary.outputs.passed }}/${{ steps.test_summary.outputs.total }} passed
+          :zzz: ${{ steps.test_summary.outputs.skipped }}/${{ steps.test_summary.outputs.total }} skipped
+          EOF
diff --git a/.openshift-ci/base_qa_e2e_test.py b/.openshift-ci/base_qa_e2e_test.py
index 2dccc81553bb7..163d66e340a88 100755
--- a/.openshift-ci/base_qa_e2e_test.py
+++ b/.openshift-ci/base_qa_e2e_test.py
@@ -10,11 +10,11 @@
     QaE2eDBBackupRestoreTest,
     CustomSetTest,
 )
-from post_tests import PostClusterTest, CheckStackroxLogs, FinalPost
+from post_tests import NullPostTest, PostClusterTest, CheckStackroxLogs, FinalPost
 from runners import ClusterTestSetsRunner
 
 
-def make_qa_e2e_test_runner(cluster):
+def make_qa_e2e_test_runner(cluster, post_collect=True):
     return ClusterTestSetsRunner(
         cluster=cluster,
         initial_pre_test=PreSystemTests(),
@@ -25,7 +25,7 @@ def make_qa_e2e_test_runner(cluster):
                 "post_test": PostClusterTest(
                     check_stackrox_logs=True,
                     artifact_destination_prefix="part-1",
-                ),
+                ) if post_collect else NullPostTest(),
             },
             {
                 "name": "QA tests part II",
@@ -33,7 +33,7 @@ def make_qa_e2e_test_runner(cluster):
                 "post_test": PostClusterTest(
                     check_stackrox_logs=True,
                     artifact_destination_prefix="part-2",
-                ),
+                ) if post_collect else NullPostTest(),
                 "always_run": False,
             },
             {
@@ -42,7 +42,7 @@ def make_qa_e2e_test_runner(cluster):
                 "post_test": CheckStackroxLogs(
                     check_for_errors_in_stackrox_logs=True,
                     artifact_destination_prefix="db-test",
-                ),
+                ) if post_collect else NullPostTest(),
                 "always_run": False,
             },
         ],
diff --git a/.openshift-ci/begin.sh b/.openshift-ci/begin.sh
index dcb3e34f61b65..27c735730ca4e 100755
--- a/.openshift-ci/begin.sh
+++ b/.openshift-ci/begin.sh
@@ -18,6 +18,8 @@ openshift_ci_import_creds
 setup_gcp
 set_ci_shared_export started_at "$(date -u +%s)"
 
+#test_on_infra
+
 if [[ -z "${SHARED_DIR:-}" ]]; then
     echo "ERROR: There is no SHARED_DIR for step env sharing"
     exit 0 # not fatal but worth highlighting
diff --git a/.openshift-ci/dispatch.sh b/.openshift-ci/dispatch.sh
index 968ff14e0c72d..93bd855d386b4 100755
--- a/.openshift-ci/dispatch.sh
+++ b/.openshift-ci/dispatch.sh
@@ -12,11 +12,22 @@ source "$ROOT/tests/e2e/lib.sh"
 
 set -euo pipefail
 
-if [[ -f "${SHARED_DIR:-}/shared_env" ]]; then
-    # shellcheck disable=SC1091
-    source "${SHARED_DIR:-}/shared_env"
+if [[ -n "${SHARED_DIR:-}" ]]; then
+    echo "SHARED_DIR: ${SHARED_DIR}"
+    ls -latr "${SHARED_DIR}"
+    if [[ -f "${SHARED_DIR}/shared_env" ]]; then
+        cat "${SHARED_DIR:-}/shared_env"
+        # shellcheck disable=SC1091
+        source "${SHARED_DIR}/shared_env"
+    else
+        echo "shared_env file does not exist in ${SHARED_DIR}"
+    fi
+else
+    echo "SHARED_DIR is not set"
 fi
 
+echo "REMOVE_EXISTING_STACKROX_RESOURCES:${REMOVE_EXISTING_STACKROX_RESOURCES:-}"
+
 openshift_ci_mods
 openshift_ci_import_creds
 create_exit_trap
@@ -40,7 +51,7 @@ case "$ci_job" in
 esac
 
 case "$ci_job" in
-    eks-qa-e2e-tests|osd*qa-e2e-tests)
+    eks-qa-e2e-tests|osd*qa-e2e-tests|ocp*e2e-tests)
         setup_automation_flavor_e2e_cluster "$ci_job"
         ;;
 esac
diff --git a/deploy/k8s/deploy.sh b/deploy/k8s/deploy.sh
index a53b47fd1d6b0..e4ce6f217e501 100755
--- a/deploy/k8s/deploy.sh
+++ b/deploy/k8s/deploy.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -e
 
+echo "(deploy.sh) ROX_SCANNER_V4:${ROX_SCANNER_V4:-}"
 K8S_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd)"
 # shellcheck source=./central.sh
 source "${K8S_DIR}/central.sh"
diff --git a/qa-tests-backend/Makefile b/qa-tests-backend/Makefile
index 10861a71f6079..1f3aa3248d975 100644
--- a/qa-tests-backend/Makefile
+++ b/qa-tests-backend/Makefile
@@ -6,7 +6,7 @@ GRADLE_TEST_ARGS =
 # Stop testing after the first test failure by defining FAIL_FAST. (Can be
 # achieved on a PR with a ci-fail-fast label)
 ifdef FAIL_FAST
-GRADLE_TEST_ARGS = --fail-fast
+GRADLE_TEST_ARGS = --fail-fast --warn
 endif
 
 ###########
@@ -15,7 +15,7 @@ endif
 .PHONY: style
 style: compile
 	@echo "+ $@"
-	@$(GRADLE) --continue codenarcMain codenarcTest ; \
+	$(GRADLE) --continue codenarcMain codenarcTest ; \
 	STATUS=$$? ; \
 	if [ $$STATUS -ne 0 ]; then \
 	    cat build/reports/codenarc/main.txt build/reports/codenarc/test.txt >&2 2>/dev/null ; \
@@ -25,12 +25,12 @@ style: compile
 .PHONY: compile
 compile: build/generated
 	@echo "+ $@"
-	@$(GRADLE) assemble testClasses
+	$(GRADLE) assemble testClasses
 
 .PHONY: style-fix
 style-fix:
 	@echo "+ $@"
-	@scripts/fix_lint.py .
+	scripts/fix_lint.py .
 
 .PHONY: proto-generated-srcs
 proto-generated-srcs: build/generated
@@ -42,7 +42,7 @@ build/generated: src/main/proto/scanner
 src/main/proto/scanner: ../go.mod
 	@echo "+ copy scanner protos"
 	-rm -rf src/main/proto/scanner
-	@scripts/copy_scanner_protos.sh
+	scripts/copy_scanner_protos.sh
 
 .PHONY: clean-generated-srcs
 clean-generated-srcs:
diff --git a/qa-tests-backend/scripts/run-part-1.sh b/qa-tests-backend/scripts/run-part-1.sh
index 355a5355a8596..96cd642c595a5 100755
--- a/qa-tests-backend/scripts/run-part-1.sh
+++ b/qa-tests-backend/scripts/run-part-1.sh
@@ -25,7 +25,14 @@ set -euo pipefail
 run_part_1() {
     info "Starting test (qa-tests-backend part I)"
 
-    config_part_1
+    if [[ "${REMOVE_EXISTING_STACKROX_RESOURCES:-true}" == 'false' ]]; then
+      info 'Skipping config. Tests will be performed on the existing stackrox resources.'
+      kubectl get ns || true
+      kubectl get pods -n stackrox || true
+      { kubectl get pods -A | grep stackrox; } || true
+    else
+      config_part_1
+    fi
     test_part_1
 }
 
@@ -67,6 +74,21 @@ reuse_config_part_1() {
 
     export_test_environment
     setup_deployment_env false false
+
+    if [[ "${REMOVE_EXISTING_STACKROX_RESOURCES:-true}" == 'false' ]]; then
+      DEPLOY_DIR="deploy/${ORCHESTRATOR_FLAVOR}"
+
+      # requires "stackrox" namespace
+      deploy_webhook_server "$ROOT/$DEPLOY_DIR/webhook_server_certs"
+
+      get_ECR_docker_pull_password
+
+      wait_for_api "${EXISTING_STACKROX_NAMESPACE:-stackrox}"
+      export_central_basic_auth_creds
+
+      export CLUSTER="${ORCHESTRATOR_FLAVOR^^}"
+      return 0
+    fi
     export_default_TLS_certs "$ROOT/$DEPLOY_DIR/default_TLS_certs"
     export_client_TLS_certs "$ROOT/$DEPLOY_DIR/client_TLS_certs"
 
diff --git a/qa-tests-backend/src/main/groovy/services/ClusterService.groovy b/qa-tests-backend/src/main/groovy/services/ClusterService.groovy
index 62ca18ec32064..1bcb4910e29af 100644
--- a/qa-tests-backend/src/main/groovy/services/ClusterService.groovy
+++ b/qa-tests-backend/src/main/groovy/services/ClusterService.groovy
@@ -12,6 +12,8 @@ import io.stackrox.proto.storage.ClusterOuterClass.Cluster
 import io.stackrox.proto.storage.ClusterOuterClass.ClusterMetadata.Type
 import io.stackrox.proto.storage.ClusterOuterClass.DynamicClusterConfig
 
+import util.Env
+
 @CompileStatic
 @Slf4j
 class ClusterService extends BaseService {
@@ -30,7 +32,7 @@ class ClusterService extends BaseService {
         return getClusterServiceClient().getCluster(Common.ResourceByID.newBuilder().setId(clusterId).build()).cluster
     }
 
-    static String getClusterId(String name = DEFAULT_CLUSTER_NAME) {
+    static String getClusterId(String name = Env.get("REMOTE_CLUSTER_NAME", DEFAULT_CLUSTER_NAME.toString())) {
         return getClusterServiceClient().getClusters(
                 GetClustersRequest.newBuilder().setQuery("Cluster:${name}").build()
         ).clustersList.find { it.name == name }?.id
diff --git a/qa-tests-backend/src/main/groovy/util/Env.groovy b/qa-tests-backend/src/main/groovy/util/Env.groovy
index 58cde2dd3078a..2f668d9e97c48 100644
--- a/qa-tests-backend/src/main/groovy/util/Env.groovy
+++ b/qa-tests-backend/src/main/groovy/util/Env.groovy
@@ -35,6 +35,8 @@ class Env {
     // the remote cluster arch can be ppc64le or s390x, default is x86_64
     static final String REMOTE_CLUSTER_ARCH = System.getenv("REMOTE_CLUSTER_ARCH") ?: "x86_64"
 
+    static final String REMOTE_CLUSTER_NAME = System.getenv("REMOTE_CLUSTER_NAME")
+
     // ONLY_SECURED_CLUSTER specifies that the remote cluster being used to execute tests
     // only has secured-cluster deployed and connects to a remote central
     static final String ONLY_SECURED_CLUSTER = System.getenv("ONLY_SECURED_CLUSTER") ?: "false"
@@ -49,6 +51,7 @@ class Env {
     }
 
     static String mustGet(String key) {
+        LOG.info("Env.mustGet(\"${key}\")")
         return INSTANCE.mustGetInternal(key)
     }
 
diff --git a/qa-tests-backend/src/test/groovy/LocalQaPropsTest.groovy b/qa-tests-backend/src/test/groovy/LocalQaPropsTest.groovy
index 48353aa789692..b5c4a53823f03 100644
--- a/qa-tests-backend/src/test/groovy/LocalQaPropsTest.groovy
+++ b/qa-tests-backend/src/test/groovy/LocalQaPropsTest.groovy
@@ -27,7 +27,7 @@ class LocalQaPropsTest extends Specification {
         def canonicalJson = JsonOutput.toJson(rawData)
         def canonicalJsonSha256 = DigestUtils.sha256Hex(canonicalJson)
         then:
-        canonicalJsonSha256 == 'f75d8cf9ea0c7886293f689478daafe75126c719313b4366c02bd41d69bb05e5'
+        canonicalJsonSha256 == '86fc788697b3f201422cda5ee1e7a98882f8929c02e668599c6c190d080230c2'
     }
 
     def "CheckPropertyFileInputValue > GOOGLE_CREDENTIALS_GCR_NO_ACCESS_KEY_V2"() {
diff --git a/scripts/ci/jobs/ocp_qa_e2e_tests.py b/scripts/ci/jobs/ocp_qa_e2e_tests.py
index 933e618d8d019..d00e95a310af1 100755
--- a/scripts/ci/jobs/ocp_qa_e2e_tests.py
+++ b/scripts/ci/jobs/ocp_qa_e2e_tests.py
@@ -16,4 +16,15 @@
 os.environ["ROX_RISK_REPROCESSING_INTERVAL"] = "15s"
 os.environ["ROX_SENSOR_CONNECTION_RETRY_MAX_INTERVAL"] = "30s"
 
-make_qa_e2e_test_runner(cluster=AutomationFlavorsCluster()).run()
+make_qa_e2e_test_runner(cluster=AutomationFlavorsCluster(), post_collect=False).run()
+#ClusterTestRunner(
+#    cluster=GKECluster("nongroovy-test"),
+#    pre_test=PreSystemTests(),
+#    test=NonGroovyE2e(),
+#    post_test=PostClusterTest(
+#        check_stackrox_logs=False,
+#    ),
+#    final_post=FinalPost(
+#        store_qa_tests_data=False,
+#    ),
+#).run()
diff --git a/scripts/ci/lib.sh b/scripts/ci/lib.sh
index 491388d97d6b1..2ec920d97d59e 100755
--- a/scripts/ci/lib.sh
+++ b/scripts/ci/lib.sh
@@ -820,7 +820,7 @@ populate_stackrox_image_list() {
     local image_list="$1"
 
     local tag
-    tag="$(make --quiet --no-print-directory tag)"
+    tag="${MAIN_IMAGE_TAG:-$(make --quiet --no-print-directory tag)}"
     local operator_metadata_tag
     operator_metadata_tag="$(echo "v${tag}" | sed 's,x,0,')"
     local operator_controller_tag="${tag//x/0}"
@@ -2406,6 +2406,102 @@ _record_cluster_info() {
     set_ci_shared_export "cut_container_runtime_version" "$containerRuntimeVersion"
 }
 
+get_infra_cluster_files() {
+    local cluster_name="${1}"
+    local data_dir="${SCRATCH:-/tmp}"
+    ls -la "${data_dir}" || true
+    infractl --version \
+      || { set -x; curl --retry 8 --fail -sL https://infra.rox.systems/v1/cli/linux/amd64/upgrade \
+        | jq -r ".result.fileChunk" \
+        | base64 -d > ./infractl;
+          file ./infractl || true;
+          install infractl ${GOPATH:-/opt}/bin/infractl || install infractl /usr/local/bin/; }
+    retry 5 true infractl whoami
+    for I in {1..5}; do
+        infractl artifacts ${cluster_name} \
+          --download-dir "${data_dir}"
+        if [[ -d "${data_dir}" ]]; then
+          break
+        fi
+        printf "%s - Waiting for infra cluster [${cluster_name}]" "$(date -u)"
+        sleep 60
+    done
+    echo "$cluster_name"
+    cp "${data_dir}/auth/kubeconfig" "${SHARED_DIR}/kubeconfig" || true
+    cp "${data_dir}/dotenv" "${SHARED_DIR}/" || true
+    cp "${data_dir}/admin-password" "${SHARED_DIR}/" || true
+
+    ls -la "${SHARED_DIR:-/tmp}" || true
+    grep -o '^[A-Z_]*=' "${SHARED_DIR:-/tmp}/"*env || true
+
+    export KUBECONFIG="${SHARED_DIR}/kubeconfig"
+    kubectl get nodes -o wide
+}
+
+test_on_infra() {
+    local event_json body
+    export PULL_NUMBER="${PULL_NUMBER:-${GITHUB_REF_NAME:+${GITHUB_REF_NAME%%/merge}}}"
+    echo "PULL_NUMBER=${PULL_NUMBER}"
+    export SHARED_DIR="${SHARED_DIR:-${GITHUB_WORKSPACE:+${RUNNER_TEMP}}}"
+    if ! touch "${SHARED_DIR}/file_write_test"; then
+      export SHARED_DIR="/tmp/"
+      touch "${SHARED_DIR}/file_write_test"
+    fi
+    echo "SHARED_DIR=${SHARED_DIR}" >&2
+    local REPO_NAME=${REPO_NAME:-stackrox}
+    local REPO_OWNER=${REPO_OWNER:-stackrox}
+    local tries=4
+    event_json=''
+    body='null'
+    for (( tries=4; tries>0; tries-- )); do
+      event_json=$(set -x; curl --silent \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        -H "Accept: application/vnd.github+json" \
+        -o - "https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${PULL_NUMBER}")
+      if [[ -z "$event_json" ]]; then
+        echo 'No pr description found.' .&2
+      else
+        body=$(jq -r '.body' <<<"${event_json}" \
+          | tee >(cat >&2) | grep '^/test-on-infra') || true
+        if [[ "$body" == 'null' ]]; then
+          echo 'No PR description found.' >&2
+        else
+          echo 'PR description found.' >&2
+          echo "$body" | grep '^/test-on-infra' \
+            || return 0
+          break
+        fi
+      fi
+      if [[ $tries -gt 0 ]]; then
+        sleep 30
+        echo "Retry fetch github pr description $(( tries-- ))" >&2
+      else
+        break
+      fi
+    done
+      if [[ -z "$body" ]]; then
+        echo 'No Infra clusters listed.'
+        continue
+      fi
+    while read -r cmd cluster_name job_name_match; do
+      job_name_match=${job_name_match%%]*}
+      job_name_match=${job_name_match##*[}
+      if [[ -z "$job_name_match" ]]; then
+        echo 'Job name match is empty'
+        continue
+      fi
+      echo "Comparing job_name string '${JOB_NAME:-}' to *${job_name_match}* for infra cluster ${cluster_name}." >&2
+      if [[ "${JOB_NAME:-}" == *"$job_name_match"* ]]; then
+        echo "Match found. Tests will run on ${cluster_name} instead of starting a new cluster." >&2
+        echo "https://infra.rox.systems/cluster/${cluster_name}" >&2
+        get_infra_cluster_files "${cluster_name}" >&2
+        echo "CLUSTER_NAME=${cluster_name}" | tee -a "${SHARED_DIR}/shared_env" || true
+        echo "KUBECONFIG=${KUBECONFIG}" | tee -a "${SHARED_DIR}/shared_env" || true
+        break
+      fi
+    done <<<"$body"
+}
+
 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
     if [[ "$#" -lt 1 ]]; then
         die "When invoked at the command line a method is required."
diff --git a/tests/e2e/lib.sh b/tests/e2e/lib.sh
index e87bbe4eb6c3c..339e130ae8754 100755
--- a/tests/e2e/lib.sh
+++ b/tests/e2e/lib.sh
@@ -13,7 +13,7 @@ source "$TEST_ROOT/scripts/ci/lib.sh"
 # shellcheck source=../../scripts/ci/test_state.sh
 source "$TEST_ROOT/scripts/ci/test_state.sh"
 
-export QA_TEST_DEBUG_LOGS="/tmp/qa-tests-backend-logs"
+export QA_TEST_DEBUG_LOGS="${QA_TEST_DEBUG_LOGS:-/tmp/qa-tests-backend-logs}"
 export QA_DEPLOY_WAIT_INFO="/tmp/wait-for-kubectl-object"
 
 # If `envsubst` is contained in a non-standard directory `env -i` won't be able to
@@ -511,6 +511,9 @@ export_central_basic_auth_creds() {
     elif [[ -n "${ROX_ADMIN_PASSWORD:-}" ]]; then
         info "Using existing ROX_ADMIN_PASSWORD env"
     else
+        ROX_ADMIN_PASSWORD=$(kubectl -n stackrox get secret central-htpasswd -o go-template='{{index .data "password" | base64decode}}')
+    fi
+    if [[ -z "${ROX_ADMIN_PASSWORD:-}" ]]; then
         echo "Expected to find file ${DEPLOY_DIR}/central-deploy/password or ROX_ADMIN_PASSWORD env"
         exit 1
     fi
@@ -980,6 +983,11 @@ collect_and_check_stackrox_logs() {
 # system tests against the same cluster.
 # shellcheck disable=SC2120
 remove_existing_stackrox_resources() {
+    if [[ "${REMOVE_EXISTING_STACKROX_RESOURCES:-true}" == 'false' ]]; then
+      info 'Skipped removal of existing stackrox resources [REMOVE_EXISTING_STACKROX_RESOURCES=false].'
+      return
+    fi
+
     info "Will remove any existing stackrox resources"
     local namespaces=( "$@" )
     local psps_supported=false
@@ -1480,13 +1488,32 @@ setup_automation_flavor_e2e_cluster() {
     ls -l "${SHARED_DIR}"
     export KUBECONFIG="${SHARED_DIR}/kubeconfig"
 
-    if [[ "$ci_job" =~ ^osd ]]; then
-        info "Logging in to an OSD cluster"
+    if [[ "$ci_job" =~ ^(osd|ocp) ]]; then
+        info "Logging in to the ${ci_job:0:3} cluster"
         source "${SHARED_DIR}/dotenv"
+
+        # OSD and OCP require one of (CLUSTER_|OPENSHIFT_CONSOLE_) var groups.
+        # Fail if neither are found from the dotenv.
+        export CLUSTER_CONSOLE_URL="${CLUSTER_CONSOLE_ENDPOINT:-${OPENSHIFT_CONSOLE_URL:-$(oc whoami --show-console)}}"
+        export CLUSTER_API_ENDPOINT="${CLUSTER_API_ENDPOINT:-$(oc whoami --show-server)}"
+        export CLUSTER_USERNAME="${CLUSTER_USERNAME:-${OPENSHIFT_CONSOLE_USERNAME:-kubeadmin}}"
+        export CLUSTER_PASSWORD="${CLUSTER_PASSWORD:-${OPENSHIFT_CONSOLE_PASSWORD}}"
+
         oc login "$CLUSTER_API_ENDPOINT" \
                 --username "$CLUSTER_USERNAME" \
                 --password "$CLUSTER_PASSWORD" \
                 --insecure-skip-tls-verify=true
+
+        info "Testing client certs for OCP cluster"
+        echo "KUBECONFIG:${KUBECONFIG:-}"
+        oc whoami || true
+        oc version
+        #if [[ "$ci_job" == *ui-e2e* ]]; then
+        #    export ACS_API_SERVICE_URL="${API_ENDPOINT:-http://localhost:8000}"
+        #    ./ui/apps/platform/scripts/start-ocp-console.sh 2>&1 > &
+        #    echo $! > /tmp/
+        #    curl --retry=5 'http://localhost:9000' || true
+        #fi
     fi
 }
 
diff --git a/tests/e2e/run-ui-e2e.sh b/tests/e2e/run-ui-e2e.sh
index b56490112d2fd..a840c641af6cd 100755
--- a/tests/e2e/run-ui-e2e.sh
+++ b/tests/e2e/run-ui-e2e.sh
@@ -25,12 +25,14 @@ test_ui_e2e() {
     export_test_environment
 
     setup_deployment_env false false
-    remove_existing_stackrox_resources
-    setup_default_TLS_certs
+    kubectl get ns stackrox || {
+        remove_existing_stackrox_resources
+        setup_default_TLS_certs
 
-    # deploy the optional components before stackrox
-    deploy_optional_e2e_components
-    deploy_stackrox
+        # deploy the optional components before stackrox
+        deploy_optional_e2e_components
+        deploy_stackrox
+    }
 
     run_ui_e2e_tests
 }
@@ -56,9 +58,11 @@ run_ui_e2e_tests() {
         export UI_BASE_URL="https://localhost:${LOCAL_PORT}"
     fi
 
+    echo "Calling make"
     make -C ui test-e2e || touch FAIL
+    echo "make finished."
 
-    store_test_results "ui/test-results/reports/cypress/integration/." "cy-reps"
+    store_test_results "ui/test-results/reports/cypress/integration*/." "cy-reps"
 
     if is_OPENSHIFT_CI; then
         cp -a ui/test-results/artifacts/* "${ARTIFACT_DIR}/" || true
diff --git a/tests/scripts/setup-certs.sh b/tests/scripts/setup-certs.sh
index ed251cae65105..fb13018f37e0f 100755
--- a/tests/scripts/setup-certs.sh
+++ b/tests/scripts/setup-certs.sh
@@ -38,7 +38,7 @@ keyUsage = critical, digitalSignature, cRLSign, keyCertSign
   basicConstraints=CA:TRUE,pathlen:1
   "
     # Root CA
-    openssl req -quiet -nodes -config <(echo "$root_ca_exts") -new -x509 -keyout ca.key -out ca.crt -subj "/CN=Root ${ca_name}"
+    openssl req -nodes -config <(echo "$root_ca_exts") -new -x509 -keyout ca.key -out ca.crt -subj "/CN=Root ${ca_name}"
 
     # Intermediate CA
     openssl genrsa -out intermediate.key 4096