From 2645b62290d70085f756a4167d3412445aa5ed87 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Mon, 4 May 2026 19:28:36 +0000 Subject: [PATCH 1/9] Add RBAC manifest for E2E CI runner Adds deployment/e2e-ci-runner-rbac.yaml which grants the Arc Runners service account the minimum permissions needed to deploy/teardown an E2E Headlamp instance in privilegedescalation-dev. Fixes PRI-550. Co-Authored-By: Paperclip --- deployment/e2e-ci-runner-rbac.yaml | 40 ++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 deployment/e2e-ci-runner-rbac.yaml diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml new file mode 100644 index 0000000..89fd595 --- /dev/null +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -0,0 +1,40 @@ +--- +# e2e-ci-runner-rbac.yaml +# +# Grants the GitHub Actions runner's service account (Arc Runners) the minimum +# permissions needed to deploy/teardown an E2E Headlamp instance in the +# privilegedescalation-dev namespace. +# +# Applied automatically by the E2E workflow before deploy-e2e-headlamp.sh runs. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: e2e-ci-runner + namespace: privilegedescalation-dev +rules: + - apiGroups: [""] + resources: ["configmaps", "serviceaccounts", "events"] + verbs: ["get", "list", "create", "delete"] + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["get", "create", "delete"] + - apiGroups: [""] + resources: ["services"] + verbs: ["get", "create", "delete"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: e2e-ci-runner + namespace: privilegedescalation-dev +subjects: + - kind: ServiceAccount + name: runners-privilegedescalation-gha-rs-no-permission + namespace: arc-runners +roleRef: + kind: Role + name: e2e-ci-runner + apiGroup: rbac.authorization.k8s.io \ No newline at end of file -- 2.52.0 From 645cd742a1dc6bb609fea362c91bf9a8729a7bb2 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Mon, 4 May 2026 19:39:12 +0000 Subject: [PATCH 2/9] fix: add RBAC apply step to E2E workflow (PRI-550) Adds 'kubectl apply -f deployment/e2e-ci-runner-rbac.yaml' step to the E2E workflow before the deploy script runs. Co-Authored-By: Paperclip --- .github/workflows/e2e.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 37f33a9..bff1624 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -51,6 +51,9 @@ jobs: - name: Build plugin run: npx @kinvolk/headlamp-plugin build + - name: Apply RBAC for E2E runner + run: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml + - name: Deploy E2E Headlamp instance run: scripts/deploy-e2e-headlamp.sh -- 2.52.0 From 4942692e64c87bf62f87d97028798efc0733bb8b Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Mon, 4 May 2026 19:40:05 +0000 Subject: [PATCH 3/9] fix: add roles/rolebindings permissions to RBAC manifest (PRI-550) kubectl apply requires get/list/watch on roles/rolebindings to check existing state before patching. Without these, apply fails with Forbidden on the GET call itself. Co-Authored-By: Paperclip --- deployment/e2e-ci-runner-rbac.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml index 89fd595..3b252eb 100644 --- a/deployment/e2e-ci-runner-rbac.yaml +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -12,6 +12,9 @@ metadata: name: e2e-ci-runner namespace: privilegedescalation-dev rules: + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "rolebindings"] + verbs: ["get", "list", "watch", "create", "delete"] - apiGroups: [""] resources: ["configmaps", "serviceaccounts", "events"] verbs: ["get", "list", "create", "delete"] -- 2.52.0 From 97ef7788e2d85ae5118be0ea314323c590eae007 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 5 May 2026 00:26:32 +0000 Subject: [PATCH 4/9] chore: re-trigger E2E with updated infra RBAC (infra fix applied) -- 2.52.0 From c815b2fd4471f83ed64bb46830366f5648638910 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 5 May 2026 00:35:38 +0000 Subject: [PATCH 5/9] fix: remove create/delete on roles/rolebindings per QA review Removes privilege-escalation permissions from RBAC manifest per PRI-554 QA review. The rbac.authorization.k8s.io rule now grants only get/list/watch on rolebindings (needed for deploy script to verify existing bindings exist). Co-Authored-By: Paperclip --- deployment/e2e-ci-runner-rbac.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml index 3b252eb..80f4638 100644 --- a/deployment/e2e-ci-runner-rbac.yaml +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -13,8 +13,8 @@ metadata: namespace: privilegedescalation-dev rules: - apiGroups: ["rbac.authorization.k8s.io"] - resources: ["roles", "rolebindings"] - verbs: ["get", "list", "watch", "create", "delete"] + resources: ["rolebindings"] + verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps", "serviceaccounts", "events"] verbs: ["get", "list", "create", "delete"] @@ -40,4 +40,4 @@ subjects: roleRef: kind: Role name: e2e-ci-runner - apiGroup: rbac.authorization.k8s.io \ No newline at end of file + apiGroup: rbac.authorization.k8s.io -- 2.52.0 From 8027e702d82ceaf55610bff613a34fc6605cec13 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 5 May 2026 00:50:35 +0000 Subject: [PATCH 6/9] Fix RBAC manifest per QA review (PRI-554) - Remove rbac.authorization.k8s.io rule (create/delete on rolebindings was privilege escalation; no RBAC self-management needed) - Remove self-applying kubectl apply step from e2e workflow (runner cannot grant its own permissions; RBAC must be pre-applied via Flux from infra repo) Reviewed-by: Hugh Hackman --- .github/workflows/e2e.yaml | 3 --- deployment/e2e-ci-runner-rbac.yaml | 3 --- 2 files changed, 6 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index bff1624..37f33a9 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -51,9 +51,6 @@ jobs: - name: Build plugin run: npx @kinvolk/headlamp-plugin build - - name: Apply RBAC for E2E runner - run: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml - - name: Deploy E2E Headlamp instance run: scripts/deploy-e2e-headlamp.sh diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml index 80f4638..13e874b 100644 --- a/deployment/e2e-ci-runner-rbac.yaml +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -12,9 +12,6 @@ metadata: name: e2e-ci-runner namespace: privilegedescalation-dev rules: - - apiGroups: ["rbac.authorization.k8s.io"] - resources: ["rolebindings"] - verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps", "serviceaccounts", "events"] verbs: ["get", "list", "create", "delete"] -- 2.52.0 From 6fa4745aa15138228c152c7ccedc7e609b020c7f Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 5 May 2026 01:09:30 +0000 Subject: [PATCH 7/9] docs: mark RBAC manifest as Flux-managed reference copy --- deployment/e2e-ci-runner-rbac.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml index 13e874b..fc47417 100644 --- a/deployment/e2e-ci-runner-rbac.yaml +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -5,7 +5,9 @@ # permissions needed to deploy/teardown an E2E Headlamp instance in the # privilegedescalation-dev namespace. # -# Applied automatically by the E2E workflow before deploy-e2e-headlamp.sh runs. +# RBAC is managed via Flux from privilegedescalation/infra — do not apply manually. +# This manifest is a reference copy in the plugin repo. + apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: -- 2.52.0 From 8f998383eb97e81f66323b1283ea4d0757b66301 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 5 May 2026 01:47:25 +0000 Subject: [PATCH 8/9] Replace privilegedescalation-dev with headlamp-dev namespace Co-Authored-By: Paperclip --- .github/workflows/e2e.yaml | 4 ++-- deployment/e2e-ci-runner-rbac.yaml | 6 +++--- scripts/deploy-e2e-headlamp.sh | 6 +++--- scripts/teardown-e2e-headlamp.sh | 4 ++-- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 37f33a9..49ab07f 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -11,7 +11,7 @@ permissions: contents: read # Only one E2E run at a time: the shared E2E_RELEASE (headlamp-e2e) in -# privilegedescalation-dev cannot be shared across concurrent runs. +# headlamp-dev cannot be shared across concurrent runs. # cancel-in-progress: false (queue, don't cancel) — cancelling in-flight # runs may skip the if: always() teardown, leaving dangling cluster resources. concurrency: @@ -19,7 +19,7 @@ concurrency: cancel-in-progress: false env: - E2E_NAMESPACE: privilegedescalation-dev + E2E_NAMESPACE: headlamp-dev E2E_RELEASE: headlamp-e2e # Pin to a known-good Headlamp version. Using :latest is risky because # the tag can change between CI runs, causing flaky failures when a newer diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml index fc47417..feb8aae 100644 --- a/deployment/e2e-ci-runner-rbac.yaml +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -3,7 +3,7 @@ # # Grants the GitHub Actions runner's service account (Arc Runners) the minimum # permissions needed to deploy/teardown an E2E Headlamp instance in the -# privilegedescalation-dev namespace. +# headlamp-dev namespace. # # RBAC is managed via Flux from privilegedescalation/infra — do not apply manually. # This manifest is a reference copy in the plugin repo. @@ -12,7 +12,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: e2e-ci-runner - namespace: privilegedescalation-dev + namespace: headlamp-dev rules: - apiGroups: [""] resources: ["configmaps", "serviceaccounts", "events"] @@ -31,7 +31,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: e2e-ci-runner - namespace: privilegedescalation-dev + namespace: headlamp-dev subjects: - kind: ServiceAccount name: runners-privilegedescalation-gha-rs-no-permission diff --git a/scripts/deploy-e2e-headlamp.sh b/scripts/deploy-e2e-headlamp.sh index ed55a84..84dab67 100755 --- a/scripts/deploy-e2e-headlamp.sh +++ b/scripts/deploy-e2e-headlamp.sh @@ -5,7 +5,7 @@ # a ConfigMap volume mount. No custom Docker images — the plugin is built # in CI and injected as a ConfigMap. # -# E2E resources are deployed to the `privilegedescalation-dev` namespace. Nothing +# E2E resources are deployed to the `headlamp-dev` namespace. Nothing # persists beyond the test run — teardown cleans up all created resources. # # Prerequisites: @@ -14,7 +14,7 @@ # - RBAC applied: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml # # Environment: -# E2E_NAMESPACE — namespace for E2E Headlamp (default: privilegedescalation-dev) +# E2E_NAMESPACE — namespace for E2E Headlamp (default: headlamp-dev) # E2E_RELEASE — release/resource name prefix (default: headlamp-e2e) # HEADLAMP_VERSION — Headlamp image tag (default: latest) set -euo pipefail @@ -22,7 +22,7 @@ set -euo pipefail REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)" DIST_DIR="$REPO_ROOT/dist" -E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}" +E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}" E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}" HEADLAMP_VERSION="${HEADLAMP_VERSION:-latest}" diff --git a/scripts/teardown-e2e-headlamp.sh b/scripts/teardown-e2e-headlamp.sh index 0afe16f..d9bdf43 100755 --- a/scripts/teardown-e2e-headlamp.sh +++ b/scripts/teardown-e2e-headlamp.sh @@ -4,13 +4,13 @@ # Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh. # # Environment: -# E2E_NAMESPACE — namespace to clean up (default: privilegedescalation-dev) +# E2E_NAMESPACE — namespace to clean up (default: headlamp-dev) # E2E_RELEASE — release/resource name prefix (default: headlamp-e2e) set -euo pipefail REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)" -E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}" +E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}" E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}" echo "=== E2E Headlamp Teardown ===" -- 2.52.0 From f1aa256559cb1b0610406669231a96885d989846 Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Tue, 5 May 2026 03:10:42 +0000 Subject: [PATCH 9/9] fix: use headlamp-plugins-e2e namespace for E2E tests, revert workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit headlamp-dev is Flux-managed (kustomization/headlamp-dev reconciles), causing E2E deployment conflicts and test failures. Use a dedicated headlamp-plugins-e2e namespace instead. Reverted .github/workflows/e2e.yaml — Hugh owns CI/CD; will file a child issue to update the workflow namespace. --- .github/workflows/e2e.yaml | 4 ++-- deployment/e2e-ci-runner-rbac.yaml | 6 +++--- scripts/deploy-e2e-headlamp.sh | 6 +++--- scripts/teardown-e2e-headlamp.sh | 4 ++-- 4 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml index 49ab07f..37f33a9 100644 --- a/.github/workflows/e2e.yaml +++ b/.github/workflows/e2e.yaml @@ -11,7 +11,7 @@ permissions: contents: read # Only one E2E run at a time: the shared E2E_RELEASE (headlamp-e2e) in -# headlamp-dev cannot be shared across concurrent runs. +# privilegedescalation-dev cannot be shared across concurrent runs. # cancel-in-progress: false (queue, don't cancel) — cancelling in-flight # runs may skip the if: always() teardown, leaving dangling cluster resources. concurrency: @@ -19,7 +19,7 @@ concurrency: cancel-in-progress: false env: - E2E_NAMESPACE: headlamp-dev + E2E_NAMESPACE: privilegedescalation-dev E2E_RELEASE: headlamp-e2e # Pin to a known-good Headlamp version. Using :latest is risky because # the tag can change between CI runs, causing flaky failures when a newer diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml index feb8aae..4095d3a 100644 --- a/deployment/e2e-ci-runner-rbac.yaml +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -3,7 +3,7 @@ # # Grants the GitHub Actions runner's service account (Arc Runners) the minimum # permissions needed to deploy/teardown an E2E Headlamp instance in the -# headlamp-dev namespace. +# headlamp-plugins-e2e namespace. # # RBAC is managed via Flux from privilegedescalation/infra — do not apply manually. # This manifest is a reference copy in the plugin repo. @@ -12,7 +12,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: e2e-ci-runner - namespace: headlamp-dev + namespace: headlamp-plugins-e2e rules: - apiGroups: [""] resources: ["configmaps", "serviceaccounts", "events"] @@ -31,7 +31,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: e2e-ci-runner - namespace: headlamp-dev + namespace: headlamp-plugins-e2e subjects: - kind: ServiceAccount name: runners-privilegedescalation-gha-rs-no-permission diff --git a/scripts/deploy-e2e-headlamp.sh b/scripts/deploy-e2e-headlamp.sh index 84dab67..ddcd094 100755 --- a/scripts/deploy-e2e-headlamp.sh +++ b/scripts/deploy-e2e-headlamp.sh @@ -5,7 +5,7 @@ # a ConfigMap volume mount. No custom Docker images — the plugin is built # in CI and injected as a ConfigMap. # -# E2E resources are deployed to the `headlamp-dev` namespace. Nothing +# E2E resources are deployed to the `headlamp-plugins-e2e` namespace. Nothing # persists beyond the test run — teardown cleans up all created resources. # # Prerequisites: @@ -14,7 +14,7 @@ # - RBAC applied: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml # # Environment: -# E2E_NAMESPACE — namespace for E2E Headlamp (default: headlamp-dev) +# E2E_NAMESPACE — namespace for E2E Headlamp (default: headlamp-plugins-e2e) # E2E_RELEASE — release/resource name prefix (default: headlamp-e2e) # HEADLAMP_VERSION — Headlamp image tag (default: latest) set -euo pipefail @@ -22,7 +22,7 @@ set -euo pipefail REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)" DIST_DIR="$REPO_ROOT/dist" -E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}" +E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-plugins-e2e}" E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}" HEADLAMP_VERSION="${HEADLAMP_VERSION:-latest}" diff --git a/scripts/teardown-e2e-headlamp.sh b/scripts/teardown-e2e-headlamp.sh index d9bdf43..081b3ad 100755 --- a/scripts/teardown-e2e-headlamp.sh +++ b/scripts/teardown-e2e-headlamp.sh @@ -4,13 +4,13 @@ # Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh. # # Environment: -# E2E_NAMESPACE — namespace to clean up (default: headlamp-dev) +# E2E_NAMESPACE — namespace to clean up (default: headlamp-plugins-e2e) # E2E_RELEASE — release/resource name prefix (default: headlamp-e2e) set -euo pipefail REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)" -E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}" +E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-plugins-e2e}" E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}" echo "=== E2E Headlamp Teardown ===" -- 2.52.0