ci: rework E2E infrastructure to use default namespace

Board directive: E2E tests must run in the `default` namespace.
Nothing should persist beyond a test run; no dedicated namespace needed.

Changes:
- e2e-ci-runner-rbac.yaml: retarget Role/RoleBinding to `default`,
  remove ClusterRole/ClusterRoleBinding (no longer needed since we
  don't need cluster-scoped namespace read permission)
- e2e.yaml: set E2E_NAMESPACE=default
- deploy-e2e-headlamp.sh: default namespace to `default`, remove
  namespace existence check (default always exists)
- teardown-e2e-headlamp.sh: default namespace to `default`, remove
  namespace existence check guard
- headlamp-e2e-values.yaml: update usage comment
- e2e/README.md: remove namespace creation prerequisite

Closes #78 #79

Co-Authored-By: Paperclip <noreply@paperclip.ing>

deployment/e2e-ci-runner-rbac.yaml

@@ -2,20 +2,19 @@
 # RBAC for the GitHub Actions CI runner to manage the E2E Headlamp instance.
 # CI-only test fixture — NOT for production use.
 #
-# Grants the ARC runner service account permissions in the headlamp-e2e
-# namespace to deploy and tear down a dedicated Headlamp instance via Helm.
+# Grants the ARC runner service account permissions in the default namespace
+# to deploy and tear down a dedicated Headlamp instance via Helm.
+# E2E resources run in `default` — nothing persists beyond a test run.
 #
-# No kube-system access needed — E2E tests use a separate namespace.
 # Plugin is loaded via ConfigMap volume mount — no custom Docker images.
 #
 # Prerequisites:
-#   kubectl create namespace headlamp-e2e
 #   kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: e2e-ci-runner
-  namespace: headlamp-e2e
+  namespace: default
 rules:
   # Helm needs to manage these resources for the Headlamp chart
   - apiGroups: ["apps"]
@@ -36,7 +35,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: e2e-ci-runner-binding
-  namespace: headlamp-e2e
+  namespace: default
 subjects:
   - kind: ServiceAccount
     name: runners-privilegedescalation-gha-rs-no-permission
@@ -45,29 +44,3 @@ roleRef:
   kind: Role
   name: e2e-ci-runner
   apiGroup: rbac.authorization.k8s.io
----
-# ClusterRole to allow the runner SA to verify the headlamp-e2e namespace
-# exists before attempting namespaced operations. kubectl get namespace is a
-# cluster-scoped operation not coverable by a namespaced Role.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: e2e-ci-namespace-reader
-rules:
-  - apiGroups: [""]
-    resources: ["namespaces"]
-    verbs: ["get"]
-    resourceNames: ["headlamp-e2e"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: e2e-ci-namespace-reader-binding
-subjects:
-  - kind: ServiceAccount
-    name: runners-privilegedescalation-gha-rs-no-permission
-    namespace: arc-runners
-roleRef:
-  kind: ClusterRole
-  name: e2e-ci-namespace-reader
-  apiGroup: rbac.authorization.k8s.io

deployment/headlamp-e2e-values.yaml

@@ -7,7 +7,7 @@
 #
 # Usage:
 #   helm install headlamp-e2e headlamp/headlamp \
-#     -n headlamp-e2e --create-namespace \
+#     -n default \
 #     -f deployment/headlamp-e2e-values.yaml \
 #     --set image.registry=ghcr.io \
 #     --set image.repository=headlamp-k8s/headlamp \