fix: use headlamp-plugins-e2e namespace for E2E tests, revert workflow

headlamp-dev is Flux-managed (kustomization/headlamp-dev reconciles), causing E2E deployment conflicts and test failures. Use a dedicated headlamp-plugins-e2e namespace instead. Reverted .github/workflows/e2e.yaml — Hugh owns CI/CD; will file a child issue to update the workflow namespace.
Replace privilegedescalation-dev with headlamp-dev namespace
2026-05-05 03:10:42 +00:00 · 2026-05-05 01:47:25 +00:00 · 2026-05-05 01:09:30 +00:00 · 2026-05-05 00:50:35 +00:00 · 2026-05-05 00:35:48 +00:00 · 2026-05-05 00:26:32 +00:00
3 changed files with 47 additions and 5 deletions
@@ -0,0 +1,42 @@
+---
+# e2e-ci-runner-rbac.yaml
+#
+# Grants the GitHub Actions runner's service account (Arc Runners) the minimum
+# permissions needed to deploy/teardown an E2E Headlamp instance in the
+# headlamp-plugins-e2e namespace.
+#
+# RBAC is managed via Flux from privilegedescalation/infra — do not apply manually.
+# This manifest is a reference copy in the plugin repo.
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: e2e-ci-runner
+  namespace: headlamp-plugins-e2e
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps", "serviceaccounts", "events"]
+    verbs: ["get", "list", "create", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: e2e-ci-runner
+  namespace: headlamp-plugins-e2e
+subjects:
+  - kind: ServiceAccount
+    name: runners-privilegedescalation-gha-rs-no-permission
+    namespace: arc-runners
+roleRef:
+  kind: Role
+  name: e2e-ci-runner
+  apiGroup: rbac.authorization.k8s.io
@@ -5,7 +5,7 @@
 # a ConfigMap volume mount. No custom Docker images — the plugin is built
 # in CI and injected as a ConfigMap.
 #
-# E2E resources are deployed to the `privilegedescalation-dev` namespace. Nothing
+# E2E resources are deployed to the `headlamp-plugins-e2e` namespace. Nothing
 # persists beyond the test run — teardown cleans up all created resources.
 #
 # Prerequisites:
@@ -14,7 +14,7 @@
 #   - RBAC applied: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
 #
 # Environment:
-#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: privilegedescalation-dev)
+#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: headlamp-plugins-e2e)
 #   E2E_RELEASE       — release/resource name prefix (default: headlamp-e2e)
 #   HEADLAMP_VERSION  — Headlamp image tag (default: latest)
 set -euo pipefail
@@ -22,7 +22,7 @@ set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DIST_DIR="$REPO_ROOT/dist"

-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-plugins-e2e}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
 HEADLAMP_VERSION="${HEADLAMP_VERSION:-latest}"

@@ -4,13 +4,13 @@
 # Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh.
 #
 # Environment:
-#   E2E_NAMESPACE  — namespace to clean up (default: privilegedescalation-dev)
+#   E2E_NAMESPACE  — namespace to clean up (default: headlamp-plugins-e2e)
 #   E2E_RELEASE    — release/resource name prefix (default: headlamp-e2e)
 set -euo pipefail

 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"

-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-plugins-e2e}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"

 echo "=== E2E Headlamp Teardown ==="
Author	SHA1	Message	Date
Chris Farhood	f1aa256559	fix: use headlamp-plugins-e2e namespace for E2E tests, revert workflow headlamp-dev is Flux-managed (kustomization/headlamp-dev reconciles), causing E2E deployment conflicts and test failures. Use a dedicated headlamp-plugins-e2e namespace instead. Reverted .github/workflows/e2e.yaml — Hugh owns CI/CD; will file a child issue to update the workflow namespace.	2026-05-05 03:10:42 +00:00
Chris Farhood	8f998383eb	Replace privilegedescalation-dev with headlamp-dev namespace Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-05 01:47:25 +00:00
Chris Farhood	6fa4745aa1	docs: mark RBAC manifest as Flux-managed reference copy	2026-05-05 01:09:30 +00:00
Chris Farhood	8027e702d8	Fix RBAC manifest per QA review (PRI-554) - Remove rbac.authorization.k8s.io rule (create/delete on rolebindings was privilege escalation; no RBAC self-management needed) - Remove self-applying kubectl apply step from e2e workflow (runner cannot grant its own permissions; RBAC must be pre-applied via Flux from infra repo) Reviewed-by: Hugh Hackman	2026-05-05 00:50:35 +00:00
Chris Farhood	c815b2fd44	fix: remove create/delete on roles/rolebindings per QA review Removes privilege-escalation permissions from RBAC manifest per PRI-554 QA review. The rbac.authorization.k8s.io rule now grants only get/list/watch on rolebindings (needed for deploy script to verify existing bindings exist). Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-05 00:35:48 +00:00
Chris Farhood	97ef7788e2	chore: re-trigger E2E with updated infra RBAC (infra fix applied)	2026-05-05 00:26:32 +00:00
Chris Farhood	4942692e64	fix: add roles/rolebindings permissions to RBAC manifest (PRI-550) kubectl apply requires get/list/watch on roles/rolebindings to check existing state before patching. Without these, apply fails with Forbidden on the GET call itself. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 19:40:05 +00:00
Chris Farhood	645cd742a1	fix: add RBAC apply step to E2E workflow (PRI-550) Adds 'kubectl apply -f deployment/e2e-ci-runner-rbac.yaml' step to the E2E workflow before the deploy script runs. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 19:39:12 +00:00
Chris Farhood	2645b62290	Add RBAC manifest for E2E CI runner Adds deployment/e2e-ci-runner-rbac.yaml which grants the Arc Runners service account the minimum permissions needed to deploy/teardown an E2E Headlamp instance in privilegedescalation-dev. Fixes PRI-550. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 19:28:36 +00:00