Remove non-browser e2e test infrastructure

- Delete .github/workflows/e2e.yaml
- Delete playwright.config.ts
- Delete e2e/ directory (auth.setup.ts, kube-vip.spec.ts)
- Delete scripts/deploy-e2e-headlamp.sh and teardown-e2e-headlamp.sh
- Remove e2e and e2e:headed scripts from package.json
- Remove @playwright/test devDependency

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/ci.yaml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main, dev]
+    branches: [main]
   pull_request:
-    branches: [main, dev]
+    branches: [main]
   workflow_call:
   workflow_dispatch:
 

.github/workflows/dual-approval.yaml

@@ -9,11 +9,12 @@ on:
   pull_request_review:
     types: [submitted, dismissed]
   pull_request:
-    branches: [main, dev]
+    branches: [main]
     types: [opened, reopened, synchronize]
 
 jobs:
   dual-approval:
+    if: github.event.pull_request != null
     uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
     secrets: inherit
     with:

.github/workflows/renovate-app-token.yaml

@@ -0,0 +1,21 @@
+name: Mend Renovate GitHub App Token
+
+on:
+  workflow_call:
+    outputs:
+      token:
+        description: "Short-lived GitHub App installation token"
+        value: ${{ jobs.app-token.outputs.token }}
+
+jobs:
+  app-token:
+    runs-on: runners-privilegedescalation
+    outputs:
+      token: ${{ steps.app-token.outputs.token }}
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

.gitignore

@@ -5,3 +5,9 @@ dist/
 .env
 .env.local
 .eslintcache
+
+# E2E
+e2e/.auth/
+.env.e2e
+playwright-report/
+test-results/

.markdownlint-cli2.jsonc

@@ -0,0 +1,53 @@
+{
+  "config": {
+    // Line length — not enforced for docs with code examples
+    "MD013": false,
+    // First line heading — files use YAML frontmatter, not headings
+    "MD041": false,
+    // Emphasis as heading — common pattern for Option 1/2/3 sections
+    "MD036": false,
+    // No duplicate heading — changelog files repeat section names intentionally
+    "MD024": false,
+    // Fenced code language — not always applicable for diagram blocks
+    "MD040": false,
+    // Table column style — table alignment is visual, not semantic
+    "MD060": false,
+    // Ordered list item prefix — number resets are intentional in documents
+    "MD029": false,
+    // No inline HTML — each elements are valid in valid Markdown
+    "MD033": false,
+    // List marker space — spacing after list markers varies by editor
+    "MD030": false,
+    // Blanks around headings — not always needed in compact docs
+    "MD022": false,
+    // Blanks around lists — not always needed in compact docs
+    "MD032": false,
+    // Blanks around fences — not always needed between adjacent blocks
+    "MD031": false,
+    // Multiple blanks — editor artifacts, not semantic
+    "MD012": false,
+    // Single title — files may have multiple H1 sections
+    "MD025": false,
+    // Trailing spaces — editor artifacts
+    "MD009": false,
+    // Bare URLs — URL shortening not always needed
+    "MD034": false,
+    // Single trailing newline — editor artifacts
+    "MD047": false,
+    // Trailing punctuation — heading punctuation is intentional
+    "MD026": false,
+    // Space in emphasis — double-asterisk bold spacing varies by renderer
+    "MD037": false,
+    // No hard tabs — some generated docs use tabs for indentation
+    "MD010": false,
+    // Code block style — generated docs may use inconsistent styles
+    "MD046": false,
+    // Comment style — generated docs have no comments
+    "MD048": false,
+    // Commands show output — shell examples intentionally show only commands
+    "MD014": false
+  },
+  "ignores": [
+    "docs/api-reference/generated/**"
+  ]
+}

.markdownlintignore

@@ -0,0 +1 @@
+docs/api-reference/generated/**

CLAUDE.md

@@ -8,7 +8,7 @@ Headlamp plugin for kube-vip virtual IP and load balancer visibility. Read-only
 
 - **Plugin name**: `kube-vip`
 - **Target**: Headlamp >= v0.26
-- **Data sources**: kube-vip DaemonSet/pods in `headlamp`, Services (type:LoadBalancer), Nodes, Leases, `kubevip` ConfigMap
+- **Data sources**: kube-vip DaemonSet/pods in `kube-system`, Services (type:LoadBalancer), Nodes, Leases, `kubevip` ConfigMap
 - **Reference plugin**: `../headlamp-polaris-plugin`
 
 ## Commands
@@ -58,7 +58,7 @@ kube-vip uses **no CRDs**. All state comes from standard Kubernetes resources an
 
 ## Key constants (src/api/k8s.ts)
 
-- Namespace: `headlamp`
+- Namespace: `kube-system`
 - DaemonSet name: `kube-vip-ds`
 - Cloud provider name: `kube-vip-cloud-provider`
 - ConfigMap name: `kubevip`

README.md

@@ -20,7 +20,7 @@ Search for `kube-vip` in the Headlamp Plugin Manager (Settings → Plugins → C
 ## Requirements
 
 - Headlamp >= v0.26
-- kube-vip deployed in `headlamp` (DaemonSet or static pod)
+- kube-vip deployed in `kube-system` (DaemonSet or static pod)
 - Optional: kube-vip-cloud-provider for IP pool management
 
 ## RBAC
@@ -66,7 +66,7 @@ npm run lint       # ESLint
 
 | Symptom | Cause | Fix |
 |---------|-------|-----|
-| "kube-vip Not Detected" | No kube-vip pods in headlamp namespace | Install kube-vip per https://kube-vip.io/docs/installation/ |
+| "kube-vip Not Detected" | No kube-vip pods in kube-system | Install kube-vip per https://kube-vip.io/docs/installation/ |
 | No IP pools shown | kubevip ConfigMap not found | Install kube-vip-cloud-provider |
 | Services show "Pending" VIP | No IP pool configured or pool exhausted | Add IP ranges to kubevip ConfigMap |
 | Leader shows "—" | No kube-vip leases found | Verify leader election is enabled (`vip_leaderelection=true`) |

SECURITY.md

@@ -12,13 +12,38 @@ This plugin is **read-only**. It does not perform any write operations against t
 
 - Services (type: LoadBalancer)
 - Nodes
-- Pods in `headlamp`
-- DaemonSets in `headlamp`
-- Leases in `headlamp`
-- ConfigMaps in `headlamp`
+- Pods in `kube-system`
+- DaemonSets in `kube-system`
+- Leases in `kube-system`
+- ConfigMaps in `kube-system`
 
 All data is fetched through Headlamp's built-in API proxy, which respects the user's existing RBAC permissions.
 
 ## Reporting a Vulnerability
 
 Please report security vulnerabilities by opening a private issue or emailing the maintainers directly.
+
+## Known Low-Severity Vulnerabilities
+
+### GHSA-848j-6mx2-7j84 (elliptic)
+
+**Severity:** High (but not exploitable in this plugin's context)
+
+**Affected component:** `elliptic` (transitive, via `vite-plugin-node-polyfills` → `node-stdlib-browser` → `crypto-browserify` → `browserify-sign`)
+
+**Description:** The elliptic library used in this plugin's development dependencies contains a prototype pollution vulnerability. This plugin is a **read-only** Headlamp plugin that never executes any cryptographic operations at runtime. The vulnerable code path requires:
+- Use of `elliptic` curve operations on untrusted input, AND
+- Ability for an attacker to influence the `elliptic` curve key generation input
+
+Neither condition is met in this plugin's runtime context.
+
+**Remediation:** No patched version of `elliptic` exists on npm. The current override in `package.json` (`"elliptic": ">=6.6.1"`) is a placeholder — no resolvable version satisfies this constraint.
+
+**Risk acceptance rationale:**
+1. Plugin has no write operations against the cluster
+2. All data flows through Headlamp's API proxy with standard RBAC enforcement
+3. The vulnerable dependency is only in the development/build toolchain, not runtime
+4. No untrusted input can reach `elliptic` curve operations through this plugin
+
+**Review date:** 2026-05-05
+**Reviewed by:** Hugh Hackman (VP Engineering Operations)

audit-ci.jsonc

@@ -1,20 +0,0 @@
-{
-  // Allowlist for inherited dev-dependency CVEs from @kinvolk/headlamp-plugin
-  // CTO decision (PRI-854): these high-severity vulns are dev/build-time only,
-  // trace to @kinvolk/headlamp-plugin transitive deps (Picomatch, Vite, lodash),
-  // and do NOT ship in production plugin artifacts.
-  "allowlist": [
-    {
-      "id": "GHSA-hhpm-516h-p3p6",
-      "reason": "Picomatch ReDoS: devDependency only, does not ship in production plugin bundle"
-    },
-    {
-      "id": "GHSA-36xf-7xpp-53w5",
-      "reason": "Vite arbitrary file read: devDependency only, does not ship in production plugin bundle"
-    },
-    {
-      "id": "GHSA-jf8v-p3pp-93qh",
-      "reason": "lodash code injection via _.template: devDependency only, does not ship in production plugin bundle"
-    }
-  ]
-}

package.json

@@ -33,7 +33,8 @@
     "tar": "^7.5.11",
     "undici": "^7.24.3",
     "lodash": ">=4.18.0",
-    "vite": ">=6.4.2"
+    "vite": ">=6.4.2",
+    "elliptic": ">=6.6.1"
   },
   "devDependencies": {
     "@headlamp-k8s/eslint-config": "^0.6.0",

renovate.json

@@ -1,23 +1,5 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["github>privilegedescalation/.github:renovate-config"],
-  "packageRules": [
-    {
-      "description": "Auto-merge minor and patch updates for @kinvolk/headlamp-plugin",
-      "matchPackageNames": ["@kinvolk/headlamp-plugin"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "automerge": true,
-      "automergeType": "pr",
-      "automergeStrategy": "fast-forward"
-    },
-    {
-      "description": "Auto-merge security patches for @kinvolk/headlamp-plugin immediately",
-      "matchPackageNames": ["@kinvolk/headlamp-plugin"],
-      "matchUpdateTypes": ["security"],
-      "automerge": true,
-      "automergeType": "pr",
-      "automergeStrategy": "fast-forward",
-      "labels": ["security"]
-    }
-  ]
-}
+  "extends": ["github>privilegedescalation/.github:renovate-config"]
+}
+

src/components/OverviewPage.tsx

@@ -21,7 +21,6 @@ import {
   isEgressEnabled,
   isKubeVipService,
   isPodReady,
-  KUBE_VIP_NAMESPACE,
   phaseToStatus,
 } from '../api/k8s';
 import { useKubeVipContext } from '../api/KubeVipDataContext';
@@ -106,9 +105,7 @@ export default function OverviewPage() {
               {
                 name: 'Status',
                 value: (
-                  <StatusLabel status="error">
-                    No kube-vip pods found in {KUBE_VIP_NAMESPACE}
-                  </StatusLabel>
+                  <StatusLabel status="error">No kube-vip pods found in kube-system</StatusLabel>
                 ),
               },
               {