release: v1.0.0

.github/workflows/dual-approval.yaml

@@ -1,18 +0,0 @@
-name: Dual Approval (CTO + QA)
-
-# Calls the shared dual-approval-check workflow.
-# Passes when both privilegedescalation-cto and privilegedescalation-qa
-# have approved the PR. Add "Dual Approval (CTO + QA)" to required_status_checks
-# in branch protection to enforce this gate.
-
-on:
-  pull_request_review:
-    types: [submitted, dismissed]
-  pull_request:
-    branches: [main]
-    types: [opened, reopened, synchronize]
-
-jobs:
-  dual-approval:
-    uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
-    secrets: inherit

.github/workflows/e2e.yaml

@@ -1,103 +0,0 @@
-name: E2E Tests
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-# Only one E2E run at a time: the shared E2E_RELEASE (headlamp-e2e) in
-# privilegedescalation-dev cannot be shared across concurrent runs.
-# cancel-in-progress: false (queue, don't cancel) — cancelling in-flight
-# runs may skip the if: always() teardown, leaving dangling cluster resources.
-concurrency:
-  group: e2e-${{ github.repository }}
-  cancel-in-progress: false
-
-env:
-  E2E_NAMESPACE: privilegedescalation-dev
-  E2E_RELEASE: headlamp-e2e
-  # Pin to a known-good Headlamp version. Using :latest is risky because
-  # the tag can change between CI runs, causing flaky failures when a newer
-  # image is pulled on some nodes but not others (IfNotPresent pull policy).
-  # Update this when Headlamp is upgraded in production (kube-system).
-  HEADLAMP_VERSION: v0.40.1
-
-jobs:
-  e2e:
-    runs-on: runners-privilegedescalation
-    timeout-minutes: 15
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '22'
-          cache: 'npm'
-
-      - name: Setup kubectl
-        uses: azure/setup-kubectl@v4
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build plugin
-        run: npx @kinvolk/headlamp-plugin build
-
-      - name: Deploy E2E Headlamp instance
-        run: scripts/deploy-e2e-headlamp.sh
-
-      - name: Load E2E environment
-        run: |
-          if [ -f .env.e2e ]; then
-            cat .env.e2e >> "$GITHUB_ENV"
-          else
-            echo "::error::deploy-e2e-headlamp.sh did not produce .env.e2e"
-            exit 1
-          fi
-
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
-
-      - name: Run E2E tests
-        run: npm run e2e
-        env:
-          HEADLAMP_URL: ${{ env.HEADLAMP_URL }}
-          HEADLAMP_TOKEN: ${{ env.HEADLAMP_TOKEN }}
-
-      - name: Collect deployment diagnostics on failure
-        if: failure()
-        run: |
-          echo "=== Pod state ==="
-          kubectl get pods -n "$E2E_NAMESPACE" -l "app.kubernetes.io/instance=$E2E_RELEASE" 2>&1 || true
-          echo "=== Pod describe ==="
-          kubectl describe pods -n "$E2E_NAMESPACE" -l "app.kubernetes.io/instance=$E2E_RELEASE" 2>&1 || true
-          echo "=== Recent namespace events ==="
-          kubectl get events -n "$E2E_NAMESPACE" --sort-by='.lastTimestamp' 2>&1 | tail -20 || true
-
-      - name: Teardown E2E instance
-        if: always()
-        run: scripts/teardown-e2e-headlamp.sh
-
-      - name: Upload Playwright report
-        uses: actions/upload-artifact@v7
-        if: failure()
-        with:
-          name: playwright-report
-          path: playwright-report/
-          retention-days: 7
-
-      - name: Upload test results
-        uses: actions/upload-artifact@v7
-        if: failure()
-        with:
-          name: test-results
-          path: test-results/
-          retention-days: 7

.github/workflows/workflow-recovery.yaml

@@ -1,64 +0,0 @@
-name: Workflow Recovery
-
-on:
-  schedule:
-    - cron: '*/5 * * * *'
-  workflow_dispatch:
-
-jobs:
-  recover-stuck-runs:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Generate GitHub App token
-        id: app-token
-        if: vars.RELEASE_APP_ID != ''
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ vars.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-          owner: privilegedescalation
-
-      - name: Detect and re-run stuck action_required runs
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: |
-          echo "Checking for action_required runs in privilegedescalation org..."
-          
-          RUNS=$(curl -sf -H "Authorization: Bearer $GH_TOKEN" \
-            -H "Accept: application/vnd.github+json" \
-            "https://api.github.com/orgs/privilegedescalation/actions/runs?status=action_required&per_page=50" \
-            || echo '{"workflow_runs": []}')
-          
-          COUNT=$(echo "$RUNS" | jq '.workflow_runs | length')
-          echo "Found $COUNT action_required runs"
-          
-          if [ "$COUNT" = "0" ] || [ "$COUNT" = "null" ]; then
-            echo "No stuck runs found. Exiting."
-            exit 0
-          fi
-          
-          echo "$RUNS" | jq -r '.workflow_runs[] | @json' | while read -r run; do
-            RUN_ID=$(echo "$run" | jq -r '.id')
-            WORKFLOW_NAME=$(echo "$run" | jq -r '.name')
-            REPO=$(echo "$run" | jq -r '.repository.full_name')
-            BRANCH=$(echo "$run" | jq -r '.head_branch')
-            CREATED_AT=$(echo "$run" | jq -r '.created_at')
-            
-            echo "Found stuck run: $WORKFLOW_NAME (#$RUN_ID) on $REPO branch $BRANCH"
-            echo "Created at: $CREATED_AT"
-            echo "Re-running..."
-            
-            RESP=$(curl -sf -X POST \
-              -H "Authorization: Bearer $GH_TOKEN" \
-              -H "Accept: application/vnd.github+json" \
-              "https://api.github.com/repos/$REPO/actions/runs/$RUN_ID/rerun" \
-              -w "\n%{http_code}")
-            
-            HTTP_CODE=$(echo "$RESP" | tail -1)
-            if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "204" ]; then
-              echo "Successfully re-ran $WORKFLOW_NAME (#$RUN_ID)"
-            else
-              echo "Failed to re-run $WORKFLOW_NAME (#$RUN_ID): $HTTP_CODE"
-            fi
-          done

.gitignore

@@ -2,7 +2,3 @@ node_modules/
 dist/
 *.tar.gz
 .playwright-mcp/
-e2e/.auth/state.json
-.env.e2e
-test-results/
-playwright-report/

e2e/auth.setup.ts

@@ -1,83 +0,0 @@
-import { test as setup, expect, Page } from '@playwright/test';
-
-const AUTH_STATE_PATH = 'e2e/.auth/state.json';
-
-async function authenticateWithOIDC(page: Page, username: string, password: string): Promise<void> {
-  // Navigate to login — Headlamp redirects / to /c/main/login
-  await page.goto('/');
-  await page.waitForURL('**/login');
-
-  // Click "Sign In" and capture the Authentik popup
-  const popupPromise = page.waitForEvent('popup');
-  await page.getByRole('button', { name: /sign in/i }).click();
-  const popup = await popupPromise;
-
-  // Wait for the Authentik popup to fully load before interacting
-  await popup.waitForLoadState('domcontentloaded');
-  await popup.waitForLoadState('networkidle');
-
-  // Authentik step 1: fill username — wait for the form to render
-  const usernameField = popup.getByRole('textbox', { name: /email or username/i });
-  await usernameField.waitFor({ state: 'visible', timeout: 15_000 });
-  await usernameField.fill(username);
-  await popup.getByRole('button', { name: /log in/i }).click();
-
-  // Authentik step 2: fill password — wait for the next step to load
-  await popup.waitForLoadState('networkidle');
-  const passwordField = popup.getByRole('textbox', { name: /password/i });
-  await passwordField.waitFor({ state: 'visible', timeout: 15_000 });
-  await passwordField.fill(password);
-  await popup.getByRole('button', { name: /continue|log in/i }).click();
-
-  // Wait for the popup to close (Authentik redirects back, Headlamp processes callback)
-  await popup.waitForEvent('close', { timeout: 15_000 });
-
-  // Original page should now be authenticated — wait for sidebar
-  await expect(page.getByRole('navigation', { name: 'Navigation' })).toBeVisible({
-    timeout: 15_000,
-  });
-}
-
-async function authenticateWithToken(page: Page, token: string): Promise<void> {
-  await page.goto('/');
-  // Headlamp goes to /token directly when no OIDC is configured,
-  // or through /login when OIDC is configured
-  await page.waitForURL(/\/(login|token)$/);
-
-  if (page.url().includes('/login')) {
-    // OIDC login page — click "use a token" to reach token auth.
-    // Wait explicitly before clicking so failures surface at 15 s
-    // with a clear message rather than silently timing out at 60 s.
-    const useTokenBtn = page.getByRole('button', { name: /use a token/i });
-    await useTokenBtn.waitFor({ state: 'visible', timeout: 15_000 });
-    await useTokenBtn.click();
-    await page.waitForURL('**/token');
-  }
-
-  // Fill the "ID token" field and submit
-  await page.getByRole('textbox', { name: /id token/i }).fill(token);
-  await page.getByRole('button', { name: /authenticate/i }).click();
-
-  // Wait for the main UI to load
-  await expect(page.getByRole('navigation', { name: 'Navigation' })).toBeVisible({
-    timeout: 15_000,
-  });
-}
-
-setup('authenticate with Headlamp', async ({ page }) => {
-  const username = process.env.AUTHENTIK_USERNAME;
-  const password = process.env.AUTHENTIK_PASSWORD;
-  const token = process.env.HEADLAMP_TOKEN;
-
-  if (username && password) {
-    await authenticateWithOIDC(page, username, password);
-  } else if (token) {
-    await authenticateWithToken(page, token);
-  } else {
-    throw new Error(
-      'Set AUTHENTIK_USERNAME + AUTHENTIK_PASSWORD for OIDC auth, or HEADLAMP_TOKEN for token auth'
-    );
-  }
-
-  await page.context().storageState({ path: AUTH_STATE_PATH });
-});

e2e/intel-gpu.spec.ts

@@ -1,85 +0,0 @@
-import { test, expect } from '@playwright/test';
-
-test.describe('Intel GPU plugin smoke tests', () => {
-  test('sidebar contains intel-gpu entry', async ({ page }) => {
-    await page.goto('/');
-    const sidebar = page.getByRole('navigation', { name: 'Navigation' });
-    await expect(sidebar).toBeVisible({ timeout: 15_000 });
-    await expect(sidebar.getByRole('button', { name: 'intel-gpu' })).toBeVisible();
-  });
-
-  test('sidebar intel-gpu entry is clickable and navigates to overview', async ({ page }) => {
-    await page.goto('/');
-    const sidebar = page.getByRole('navigation', { name: 'Navigation' });
-    await expect(sidebar).toBeVisible({ timeout: 15_000 });
-
-    const gpuEntry = sidebar.getByRole('button', { name: 'intel-gpu' });
-    await expect(gpuEntry).toBeVisible();
-    await gpuEntry.click();
-
-    // Should navigate to the overview route
-    await expect(page).toHaveURL(/\/intel-gpu$/);
-    await expect(page.getByRole('heading', { name: /intel.gpu/i })).toBeVisible();
-  });
-
-  test('overview page renders GPU device list or empty state', async ({ page }) => {
-    await page.goto('/c/main/intel-gpu');
-
-    // Overview heading should be present
-    await expect(page.getByRole('heading', { name: /intel.gpu/i })).toBeVisible({
-      timeout: 15_000,
-    });
-
-    // Either a populated table/list or an empty-state indicator must be visible
-    const hasTable = await page.locator('table').first().isVisible().catch(() => false);
-    const hasEmptyState = await page
-      .locator('text=/no.*gpu|no.*device|0 node|empty/i')
-      .first()
-      .isVisible()
-      .catch(() => false);
-    expect(hasTable || hasEmptyState).toBe(true);
-  });
-
-  test('device plugins page renders or shows empty state', async ({ page }) => {
-    await page.goto('/c/main/intel-gpu/device-plugins');
-
-    await expect(page.getByRole('heading', { name: /device plugin/i })).toBeVisible({
-      timeout: 15_000,
-    });
-
-    const hasTable = await page.locator('table').first().isVisible().catch(() => false);
-    const hasEmptyState = await page
-      .locator('text=/no.*plugin|no.*device|empty/i')
-      .first()
-      .isVisible()
-      .catch(() => false);
-    expect(hasTable || hasEmptyState).toBe(true);
-  });
-
-  test('navigation between plugin views works', async ({ page }) => {
-    // Headlamp sidebar child links only appear when already on a child route,
-    // not after clicking the parent entry from the overview. Test route
-    // accessibility via direct navigation — each route must render its heading.
-    await page.goto('/c/main/intel-gpu');
-    await expect(page.getByRole('heading', { name: /intel.gpu/i })).toBeVisible({
-      timeout: 15_000,
-    });
-
-    await page.goto('/c/main/intel-gpu/nodes');
-    await expect(page.getByRole('heading', { name: /node/i })).toBeVisible({ timeout: 15_000 });
-
-    await page.goto('/c/main/intel-gpu/pods');
-    await expect(page.getByRole('heading', { name: /pod/i })).toBeVisible({ timeout: 15_000 });
-
-    await page.goto('/c/main/intel-gpu/metrics');
-    await expect(page.getByRole('heading', { name: /metric/i })).toBeVisible({ timeout: 15_000 });
-  });
-
-  test('plugin settings page shows intel-gpu plugin entry', async ({ page }) => {
-    await page.goto('/settings/plugins');
-
-    // Wait for plugin list to load — plugin scripts load asynchronously
-    const pluginEntry = page.locator('text=intel-gpu').first();
-    await expect(pluginEntry).toBeVisible({ timeout: 30_000 });
-  });
-});

package-lock.json

@@ -10,7 +10,6 @@
       "license": "Apache-2.0",
       "devDependencies": {
         "@kinvolk/headlamp-plugin": "^0.13.0",
-        "@playwright/test": "^1.58.2",
         "@testing-library/jest-dom": "^6.4.8",
         "@testing-library/react": "^16.0.0",
         "@testing-library/user-event": "^14.5.2",
@@ -2497,22 +2496,6 @@
         "node": ">=14"
       }
     },
-    "node_modules/@playwright/test": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
-      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "playwright": "1.58.2"
-      },
-      "bin": {
-        "playwright": "cli.js"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@popperjs/core": {
       "version": "2.11.8",
       "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.8.tgz",
@@ -13845,53 +13828,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/playwright": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
-      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "playwright-core": "1.58.2"
-      },
-      "bin": {
-        "playwright": "cli.js"
-      },
-      "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "fsevents": "2.3.2"
-      }
-    },
-    "node_modules/playwright-core": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
-      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "playwright-core": "cli.js"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/playwright/node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
     "node_modules/possible-typed-array-names": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",

package.json

@@ -22,9 +22,7 @@
     "format": "prettier --write src/",
     "format:check": "prettier --check src/",
     "test": "vitest run",
-    "test:watch": "vitest",
-    "e2e": "playwright test",
-    "e2e:headed": "playwright test --headed"
+    "test:watch": "vitest"
   },
   "peerDependencies": {
     "react": "^18.0.0",
@@ -32,7 +30,6 @@
   },
   "devDependencies": {
     "@kinvolk/headlamp-plugin": "^0.13.0",
-    "@playwright/test": "^1.58.2",
     "@testing-library/jest-dom": "^6.4.8",
     "@testing-library/react": "^16.0.0",
     "@testing-library/user-event": "^14.5.2",

playwright.config.ts

@@ -1,27 +0,0 @@
-import { defineConfig, devices } from '@playwright/test';
-
-export default defineConfig({
-  testDir: './e2e',
-  timeout: 30_000,
-  expect: { timeout: 10_000 },
-  fullyParallel: false,
-  forbidOnly: !!process.env.CI,
-  retries: process.env.CI ? 1 : 0,
-  reporter: 'list',
-  use: {
-    baseURL: process.env.HEADLAMP_URL || (() => { throw new Error('HEADLAMP_URL is required — run scripts/deploy-e2e-headlamp.sh first'); })(),
-    trace: 'on-first-retry',
-    screenshot: 'only-on-failure',
-  },
-  projects: [
-    { name: 'setup', testMatch: /auth\.setup\.ts/, timeout: 60_000 },
-    {
-      name: 'chromium',
-      use: {
-        ...devices['Desktop Chrome'],
-        storageState: 'e2e/.auth/state.json',
-      },
-      dependencies: ['setup'],
-    },
-  ],
-});

renovate.json

@@ -1,5 +1,19 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>privilegedescalation/.github:renovate-config"]
+  "extends": ["config:recommended"],
+  "baseBranches": ["main"],
+  "schedule": ["every weekend"],
+  "prConcurrentLimit": 10,
+  "packageRules": [
+    {
+      "matchManagers": ["npm"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "npm minor and patch"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "github-actions minor and patch"
+    }
+  ]
 }
-

scripts/deploy-e2e-headlamp.sh

@@ -1,204 +0,0 @@
-#!/usr/bin/env bash
-# deploy-e2e-headlamp.sh
-#
-# Deploys a stock Headlamp instance with the intel-gpu plugin loaded via
-# a ConfigMap volume mount. No custom Docker images — the plugin is built
-# in CI and injected as a ConfigMap.
-#
-# E2E resources are deployed to the `privilegedescalation-dev` namespace. Nothing
-# persists beyond the test run — teardown cleans up all created resources.
-#
-# Prerequisites:
-#   - Plugin built (dist/ exists with plugin-main.js + package.json)
-#   - kubectl configured with cluster access
-#   - RBAC applied: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
-#
-# Environment:
-#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: privilegedescalation-dev)
-#   E2E_RELEASE       — release/resource name prefix (default: headlamp-e2e)
-#   HEADLAMP_VERSION  — Headlamp image tag (default: latest)
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-DIST_DIR="$REPO_ROOT/dist"
-
-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
-E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
-HEADLAMP_VERSION="${HEADLAMP_VERSION:-latest}"
-
-if [ ! -d "$DIST_DIR" ]; then
-  echo "ERROR: dist/ not found. Run 'npm run build' first." >&2
-  exit 1
-fi
-
-# --- Preflight: verify RBAC before touching the cluster ---
-echo "Checking RBAC permissions in namespace '${E2E_NAMESPACE}'..."
-if ! kubectl auth can-i delete configmaps -n "$E2E_NAMESPACE" --quiet 2>/dev/null; then
-  echo "ERROR: Missing RBAC — cannot delete configmaps in namespace '${E2E_NAMESPACE}'." >&2
-  echo "  Apply RBAC first: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml" >&2
-  exit 1
-fi
-
-echo "=== E2E Headlamp Deployment ==="
-echo "  Image:     ghcr.io/headlamp-k8s/headlamp:${HEADLAMP_VERSION}"
-echo "  Namespace: $E2E_NAMESPACE"
-echo "  Release:   $E2E_RELEASE"
-
-# --- Create ConfigMap from built plugin ---
-echo ""
-echo "Creating ConfigMap with plugin files..."
-
-# Delete existing ConfigMap if present (idempotent redeploy)
-kubectl delete configmap headlamp-intel-gpu-plugin \
-  -n "$E2E_NAMESPACE" --ignore-not-found
-
-# Create ConfigMap from dist/ contents and package.json
-kubectl create configmap headlamp-intel-gpu-plugin \
-  -n "$E2E_NAMESPACE" \
-  --from-file="$DIST_DIR" \
-  --from-file=package.json="$REPO_ROOT/package.json"
-
-# --- Tear down any existing E2E deployment for a clean start ---
-echo ""
-echo "Removing any existing E2E deployment (clean-start)..."
-kubectl delete deployment "${E2E_RELEASE}" -n "$E2E_NAMESPACE" --ignore-not-found --wait
-kubectl delete service "${E2E_RELEASE}" -n "$E2E_NAMESPACE" --ignore-not-found --wait
-kubectl delete serviceaccount "${E2E_RELEASE}" -n "$E2E_NAMESPACE" --ignore-not-found --wait
-
-# --- Deploy Headlamp via kubectl apply ---
-echo ""
-echo "Deploying Headlamp E2E instance..."
-
-kubectl apply -f - <<EOF
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ${E2E_RELEASE}
-  namespace: ${E2E_NAMESPACE}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ${E2E_RELEASE}
-  namespace: ${E2E_NAMESPACE}
-  labels:
-    app.kubernetes.io/name: headlamp
-    app.kubernetes.io/instance: ${E2E_RELEASE}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: headlamp
-      app.kubernetes.io/instance: ${E2E_RELEASE}
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: headlamp
-        app.kubernetes.io/instance: ${E2E_RELEASE}
-    spec:
-      serviceAccountName: ${E2E_RELEASE}
-      automountServiceAccountToken: true
-      securityContext: {}
-      containers:
-        - name: headlamp
-          image: ghcr.io/headlamp-k8s/headlamp:${HEADLAMP_VERSION}
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsNonRoot: true
-            privileged: false
-            runAsUser: 100
-            runAsGroup: 101
-          args:
-            - "-in-cluster"
-            - "-in-cluster-context-name=main"
-            - "-plugins-dir=/headlamp/plugins"
-          ports:
-            - name: http
-              containerPort: 4466
-              protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            failureThreshold: 6
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-            initialDelaySeconds: 10
-            periodSeconds: 10
-          volumeMounts:
-            - name: intel-gpu-plugin
-              mountPath: /headlamp/plugins/headlamp-intel-gpu
-              readOnly: true
-      volumes:
-        - name: intel-gpu-plugin
-          configMap:
-            name: headlamp-intel-gpu-plugin
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ${E2E_RELEASE}
-  namespace: ${E2E_NAMESPACE}
-  labels:
-    app.kubernetes.io/name: headlamp
-    app.kubernetes.io/instance: ${E2E_RELEASE}
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: headlamp
-    app.kubernetes.io/instance: ${E2E_RELEASE}
-  ports:
-    - name: http
-      port: 80
-      targetPort: http
-      protocol: TCP
-EOF
-
-echo "Waiting for rollout..."
-kubectl rollout status "deployment/${E2E_RELEASE}" \
-  -n "$E2E_NAMESPACE" --timeout=120s
-
-# --- Generate a service URL for tests ---
-SVC_URL="http://${E2E_RELEASE}.${E2E_NAMESPACE}.svc.cluster.local"
-
-# --- Wait for DNS and HTTP reachability ---
-echo ""
-echo "Waiting for ${SVC_URL} to be reachable..."
-ATTEMPTS=0
-MAX_ATTEMPTS=24  # 24 × 5s = 120s max
-until curl -sf --max-time 5 "${SVC_URL}" -o /dev/null 2>/dev/null; do
-  ATTEMPTS=$((ATTEMPTS + 1))
-  if [ "$ATTEMPTS" -ge "$MAX_ATTEMPTS" ]; then
-    echo "ERROR: ${SVC_URL} not reachable after $((MAX_ATTEMPTS * 5))s" >&2
-    exit 1
-  fi
-  echo "  [${ATTEMPTS}/${MAX_ATTEMPTS}] not yet reachable, retrying in 5s..."
-  sleep 5
-done
-echo ""
-echo "E2E Headlamp is ready at: ${SVC_URL}"
-echo "  export HEADLAMP_URL=${SVC_URL}"
-
-# --- Generate a token for test auth ---
-echo ""
-echo "Creating service account token for E2E auth..."
-kubectl create serviceaccount headlamp-e2e-test \
-  -n "$E2E_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
-
-TOKEN=$(kubectl create token headlamp-e2e-test -n "$E2E_NAMESPACE" --duration=1h 2>/dev/null || echo "")
-if [ -n "$TOKEN" ]; then
-  echo "  export HEADLAMP_TOKEN=<generated>"
-  echo ""
-  echo "HEADLAMP_URL=${SVC_URL}" > "$REPO_ROOT/.env.e2e"
-  echo "HEADLAMP_TOKEN=${TOKEN}" >> "$REPO_ROOT/.env.e2e"
-  echo "Wrote .env.e2e with HEADLAMP_URL and HEADLAMP_TOKEN"
-else
-  echo "  WARNING: Could not generate token. Set HEADLAMP_TOKEN manually or use OIDC."
-fi
-
-echo ""
-echo "E2E deployment complete."

scripts/teardown-e2e-headlamp.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# teardown-e2e-headlamp.sh
-#
-# Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh.
-#
-# Environment:
-#   E2E_NAMESPACE  — namespace to clean up (default: privilegedescalation-dev)
-#   E2E_RELEASE    — release/resource name prefix (default: headlamp-e2e)
-set -euo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-
-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
-E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
-
-echo "=== E2E Headlamp Teardown ==="
-echo "  Namespace: $E2E_NAMESPACE"
-echo "  Release:   $E2E_RELEASE"
-
-echo "Removing Headlamp Deployment, Service, and ServiceAccount..."
-kubectl delete deployment "${E2E_RELEASE}" -n "$E2E_NAMESPACE" --ignore-not-found
-kubectl delete service "${E2E_RELEASE}" -n "$E2E_NAMESPACE" --ignore-not-found
-kubectl delete serviceaccount "${E2E_RELEASE}" -n "$E2E_NAMESPACE" --ignore-not-found
-
-echo "Cleaning up ConfigMap..."
-kubectl delete configmap headlamp-intel-gpu-plugin -n "$E2E_NAMESPACE" --ignore-not-found
-
-echo "Cleaning up test service account..."
-kubectl delete serviceaccount headlamp-e2e-test -n "$E2E_NAMESPACE" --ignore-not-found
-
-# Clean up .env.e2e if present
-if [ -f "$REPO_ROOT/.env.e2e" ]; then
-  rm "$REPO_ROOT/.env.e2e"
-  echo "Removed .env.e2e"
-fi
-
-echo ""
-echo "E2E teardown complete."