Fix E2E kubeconfig: locate kubeconfig before RBAC step (#144)

All pipeline gates satisfied: CI ✓, E2E ✓, UAT (Patty/PRI-792) ✓, QA (Regina/PRI-786) ✓, CTO (Nancy) ✓. Resolves PRI-785 and PRI-324.
2026-05-05 21:25:54 +00:00
parent aa1db9215a
commit 3fe787a550
3 changed files with 224 additions and 0 deletions
@@ -45,6 +45,104 @@ jobs:
      - name: Setup kubectl
        uses: azure/setup-kubectl@v4

+      - name: Get kubeconfig
+        run: |
+          set -euo pipefail
+          echo "=== Runner environment diagnostic ==="
+          echo "HOME=${HOME:-}"
+          echo "KUBECONFIG=${KUBECONFIG:-}"
+          echo "ACTIONS_KUBECONFIG=${ACTIONS_KUBECONFIG:-}"
+          echo "RUNNER_CONFIG=${RUNNER_CONFIG:-}"
+          echo "RUNNER_CONFIG_DIR=${RUNNER_CONFIG_DIR:-}"
+          echo ""
+          echo "=== Checking known kubeconfig locations ==="
+          for path in /runner/config /home/runner/.kube/config "${HOME:-}/.kube/config" "${HOME:-}/.kube"; do
+            if [ -f "$path" ]; then
+              echo "FOUND kubeconfig at: $path"
+            elif [ -d "$path" ]; then
+              echo "DIR exists at: $path, contents:"
+              ls -la "$path" 2>&1 || echo "  (cannot list)"
+            else
+              echo "NOT FOUND: $path"
+            fi
+          done
+          echo ""
+          echo "=== In-cluster service account check ==="
+          in_cluster=false
+          if [ -f /var/run/secrets/kubernetes.io/serviceaccount/token ]; then
+            echo "Service account token present — in-cluster mode available"
+            echo "KUBERNETES_SERVICE_HOST=${KUBERNETES_SERVICE_HOST:-}"
+            echo "KUBERNETES_SERVICE_PORT=${KUBERNETES_SERVICE_PORT:-}"
+            in_cluster=true
+          else
+            echo "No service account token at /var/run/secrets/kubernetes.io/serviceaccount/"
+          fi
+          echo ""
+          if [ -f /runner/config ]; then
+            echo "KUBECONFIG=/runner/config" >> "$GITHUB_ENV"
+            echo "Using kubeconfig from /runner/config"
+          elif [ -f /home/runner/.kube/config ]; then
+            echo "KUBECONFIG=/home/runner/.kube/config" >> "$GITHUB_ENV"
+            echo "Using kubeconfig from /home/runner/.kube/config"
+          elif [ -f "${HOME:-}/.kube/config" ]; then
+            echo "KUBECONFIG=${HOME:-}/.kube/config" >> "$GITHUB_ENV"
+            echo "Using kubeconfig from HOME"
+          elif [ "$in_cluster" = true ]; then
+            echo "No static kubeconfig found — generating in-cluster kubeconfig"
+            KUBECFG_DIR="${HOME:-}/.kube"
+            mkdir -p "$KUBECFG_DIR"
+            kubectl config set-cluster in-cluster \
+              --server="https://${KUBERNETES_SERVICE_HOST:-kubernetes.default.svc}:${KUBERNETES_SERVICE_PORT:-443}" \
+              --certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
+              --embed-certs=true \
+              --kubeconfig="$KUBECFG_DIR/config" 2>&1
+            kubectl config set-credentials in-cluster \
+              --token="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
+              --kubeconfig="$KUBECFG_DIR/config" 2>&1
+            kubectl config set-context in-cluster \
+              --cluster=in-cluster \
+              --user=in-cluster \
+              --kubeconfig="$KUBECFG_DIR/config" 2>&1
+            kubectl config use-context in-cluster \
+              --kubeconfig="$KUBECFG_DIR/config" 2>&1
+            echo "KUBECONFIG=$KUBECFG_DIR/config" >> "$GITHUB_ENV"
+            echo "Generated in-cluster kubeconfig at $KUBECFG_DIR/config"
+          else
+            echo "::error::No kubeconfig found in /runner/config, /home/runner/.kube/config, HOME, or in-cluster service account"
+            exit 1
+          fi
+
+      - name: Apply RBAC for E2E pipeline
+        run: |
+          set -x
+          kubectl apply -f deployment/e2e-ci-runner-rbac.yaml --dry-run=server 2>&1 || true
+          kubectl apply -f deployment/e2e-ci-runner-rbac.yaml 2>&1
+          echo "exit code: $?"
+          echo "Waiting for RBAC propagation..."
+          sleep 5
+          echo "Verifying RBAC resources were created..."
+          kubectl get role e2e-ci-runner -n headlamp-dev 2>&1 | tail -3
+          kubectl get role e2e-ci-runner-polaris -n headlamp-dev 2>&1 | tail -3
+          kubectl get rolebinding e2e-ci-runner-binding -n headlamp-dev 2>&1 | tail -3
+          set +x
+
+      - name: Apply Polaris dashboard RBAC
+        run: kubectl apply -f deployment/polaris-rbac.yaml
+
+      - name: RBAC pre-flight check
+        run: |
+          echo "Checking RBAC resources..."
+          MISSING=0
+          kubectl get role polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
+          kubectl get rolebinding polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
+          kubectl auth can-i delete configmaps -n "$E2E_NAMESPACE" 2>/dev/null || MISSING=1
+          if [ "$MISSING" -eq 0 ]; then
+            echo "RBAC pre-flight check passed."
+          else
+            echo "::error::RBAC pre-flight check failed. Missing required permissions."
+            exit 1
+          fi
+
      - name: Install dependencies
        run: npm ci