Compare commits

..

2 Commits

Author SHA1 Message Date
Chris Farhood 69b0ba3bcb fix(e2e): restore Build plugin step indentation
The RBAC step removal accidentally moved Build plugin to root level.
Fixes YAML parse error that would prevent E2E workflow from running.
2026-05-05 00:56:31 +00:00
Chris Farhood 587aef820f fix(e2e): remove kubectl apply RBAC step
The RBAC manifest must be pre-applied via Flux (infra repo) by a
privileged actor before the first workflow run. The Arc Runners
service account cannot self-apply RBAC — it has no permissions to
retrieve the Role to patch it.

Fixes PRI-594.
2026-05-05 00:44:03 +00:00
2 changed files with 1 additions and 43 deletions
+1 -1
View File
@@ -100,4 +100,4 @@ jobs:
with:
name: test-results
path: test-results/
retention-days: 7
retention-days: 7
-42
View File
@@ -1,42 +0,0 @@
---
# e2e-ci-runner-rbac.yaml
#
# Grants the GitHub Actions runner's service account (Arc Runners) the minimum
# permissions needed to deploy/teardown an E2E Headlamp instance in the
# privilegedescalation-dev namespace.
#
# RBAC is managed via Flux from privilegedescalation/infra — do not apply manually.
# This manifest is a reference copy in the plugin repo.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: e2e-ci-runner
namespace: privilegedescalation-dev
rules:
- apiGroups: [""]
resources: ["configmaps", "serviceaccounts", "events"]
verbs: ["get", "list", "create", "delete"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "create", "delete"]
- apiGroups: [""]
resources: ["services"]
verbs: ["get", "create", "delete"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: e2e-ci-runner
namespace: privilegedescalation-dev
subjects:
- kind: ServiceAccount
name: runners-privilegedescalation-gha-rs-no-permission
namespace: arc-runners
roleRef:
kind: Role
name: e2e-ci-runner
apiGroup: rbac.authorization.k8s.io