E2E still failing at step 11 after --namespace fix. Adding detailed
diagnostic output to capture actual kubectl error message before
it cascades. Also verifying RoleExists before apply to detect if
Flux already synced the RBAC from infra repo.
Ref: PRI-851
E2E workflow was failing at step 'Apply RBAC for E2E pipeline' with
kubectl apply returning exit code 1 with no output. The RBAC file
contains a Role and RoleBinding with metadata.namespace: headlamp-dev.
Adding explicit --namespace=headlamp-dev to the kubectl apply command
resolves the namespace-scoped resource conflict.
Investigation of run 25444677449 (hugh/add-e2e-workflow-argocd-plugin):
- Step 11 'Apply RBAC for E2E pipeline' failed in <1s
- Subsequent steps 12-17 skipped (cascading failure)
- Diagnostics and teardown steps ran correctly
Ref: PRI-851
- Add Get kubeconfig step (matches polaris pattern for ARC runners)
- Add Apply RBAC for E2E pipeline step + deployment/e2e-ci-runner-rbac.yaml
- Pin kubectl to latest (addresses azure/setup-kubectl@v4 Node.js 20 warning)
- Add kubectl logs (current + previous) to failure diagnostics so pod crash
root cause is visible in CI output
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The argocd-plugin uses pnpm (packageManager: pnpm@10.32.1) but the
original inline workflow used npm commands (npm ci, cache: npm).
This caused the workflow to fail.
Switch to pnpm detection and commands while preserving the
E2E_RELEASE=headlamp-e2e-argocd setting required by the deploy script.
The argocd plugin uses pnpm (packageManager: pnpm@10.32.1) but the
inline workflow was using npm-based commands (npm ci, cache: npm).
This caused 'Setup Node.js' to fail because setup-node@v6 with
cache: npm has issues when no package-lock.json exists.
Switch to the reusable plugin-e2e workflow which properly detects
and uses pnpm for projects with pnpm-lock.yaml.
Fixes PRI-524. Changes push trigger from branches:[main] to branches:['**'] so CI fires on every branch. Adds workflow_dispatch for manual trigger. Adds permissions: contents: read for least-privilege hardening.
All gates clear: CI green, UAT correctly skipped (YAML-only), QA approved (Regina), CTO approved (Nancy).
Chris Farhood
privilegedescalation-engineer[bot]