Rename E2E namespace to headlamp-dev; fix RBAC manifest

Per CEO directive on PRI-324: the actual cluster namespace for
shared E2E runs is `headlamp-dev`. References to `privilegedescalation-dev`
in the workflow, scripts, and runner RBAC were stale and prevented the
runner SA from acquiring permissions where they were granted on-cluster.

Also fixes the malformed `e2e-ci-runner-polaris` Role added in 0cd9eb0
which incorrectly carried `subjects:` and `roleRef:` (RoleBinding-only
fields) — kept rules-only on the Role and the binding in the matching
RoleBinding below.

Applies QA nits from PR #123: collapsed MISSING_ROLE/MISSING_ROLEBINDING
into a single MISSING flag in the pre-flight step. Dropped the
non-standard `--quiet` flag on get calls (already redirected to /dev/null).

.github/workflows/e2e.yaml

@@ -11,7 +11,7 @@ permissions:
   contents: read
 
 # Only one E2E run at a time: the shared E2E_RELEASE (headlamp-e2e) in
-# privilegedescalation-dev cannot be shared across concurrent runs.
+# headlamp-dev cannot be shared across concurrent runs.
 # cancel-in-progress: false (queue, don't cancel) — cancelling in-flight
 # runs may skip the if: always() teardown, leaving dangling cluster resources.
 concurrency:
@@ -19,7 +19,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  E2E_NAMESPACE: privilegedescalation-dev
+  E2E_NAMESPACE: headlamp-dev
   E2E_RELEASE: headlamp-e2e
   # Pin to a known-good Headlamp version. Using :latest is risky because
   # the tag can change between CI runs, causing flaky failures when a newer
@@ -51,8 +51,10 @@ jobs:
       - name: RBAC pre-flight check
         run: |
           echo "Checking RBAC resources in polaris namespace..."
-          if kubectl get role polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 && \
+          MISSING=0
-             kubectl get rolebinding polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1; then
+          kubectl get role polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
+          kubectl get rolebinding polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
+          if [ "$MISSING" -eq 0 ]; then
             echo "RBAC pre-flight check passed."
           else
             echo "::error::Role or RoleBinding not found in polaris namespace after apply."

deployment/e2e-ci-runner-rbac.yaml

@@ -2,9 +2,10 @@
 # RBAC for the GitHub Actions CI runner to manage the E2E Headlamp instance.
 # CI-only test fixture — NOT for production use.
 #
-# Grants the ARC runner service account permissions in the privilegedescalation-dev
+# Grants the ARC runner service account permissions in the headlamp-dev
-# namespace to deploy and tear down a dedicated Headlamp instance via Helm.
+# namespace to deploy and tear down a dedicated Headlamp instance via Helm,
-# E2E resources run in `privilegedescalation-dev` — nothing persists beyond a test run.
+# and in the polaris namespace to apply the Polaris dashboard proxy RBAC
+# before the E2E pre-flight check.
 #
 # Plugin is loaded via ConfigMap volume mount — no custom Docker images.
 #
@@ -14,7 +15,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   name: e2e-ci-runner
-  namespace: privilegedescalation-dev
+  namespace: headlamp-dev
 rules:
   # Helm needs to manage these resources for the Headlamp chart
   - apiGroups: ["apps"]
@@ -39,14 +40,6 @@ kind: Role
 metadata:
   name: e2e-ci-runner-polaris
   namespace: polaris
-subjects:
-  - kind: ServiceAccount
-    name: runners-privilegedescalation-gha-rs-no-permission
-    namespace: arc-runners
-roleRef:
-  kind: Role
-  name: e2e-ci-runner-polaris
-  apiGroup: rbac.authorization.k8s.io
 rules:
   - apiGroups: ["rbac.authorization.k8s.io"]
     resources: ["roles", "rolebindings"]
@@ -70,7 +63,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   name: e2e-ci-runner-binding
-  namespace: privilegedescalation-dev
+  namespace: headlamp-dev
 subjects:
   - kind: ServiceAccount
     name: runners-privilegedescalation-gha-rs-no-permission

scripts/deploy-e2e-headlamp.sh

@@ -5,7 +5,7 @@
 # a ConfigMap volume mount. No custom Docker images — the plugin is built
 # in CI and injected as a ConfigMap.
 #
-# E2E resources are deployed to the `privilegedescalation-dev` namespace. Nothing
+# E2E resources are deployed to the `headlamp-dev` namespace. Nothing
 # persists beyond the test run — teardown cleans up all created resources.
 #
 # Prerequisites:
@@ -14,7 +14,7 @@
 #   - RBAC applied: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
 #
 # Environment:
-#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: privilegedescalation-dev)
+#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: headlamp-dev)
 #   E2E_RELEASE       — release/resource name prefix (default: headlamp-e2e)
 #   HEADLAMP_VERSION  — Headlamp image tag (default: v0.40.1, pinned to match production)
 set -euo pipefail
@@ -22,7 +22,7 @@ set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DIST_DIR="$REPO_ROOT/dist"
 
-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
 HEADLAMP_VERSION="${HEADLAMP_VERSION:-v0.40.1}"
 

scripts/teardown-e2e-headlamp.sh

@@ -4,13 +4,13 @@
 # Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh.
 #
 # Environment:
-#   E2E_NAMESPACE  — namespace to clean up (default: privilegedescalation-dev)
+#   E2E_NAMESPACE  — namespace to clean up (default: headlamp-dev)
 #   E2E_RELEASE    — release/resource name prefix (default: headlamp-e2e)
 set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 
-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
 
 echo "=== E2E Headlamp Teardown ==="