The workflow changes should be handled separately by Hugh Hackman
per PRI-215. This PR should only contain deployment manifests and
scripts, not CI workflow modifications.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Documents the Role and RoleBinding applied to the cluster for the ARC
runner service account. Grants permissions in kube-system needed for
shared volume plugin deployment (PVCs, pods, Helm resources).
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The Headlamp project moved to the kubernetes-sigs org. The old Helm chart
repository URL (headlamp-k8s.github.io) returns 404, causing E2E workflow
failure at the `helm repo add` step.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The self-hosted runner doesn't have kubectl or helm pre-installed.
Add setup steps using azure/setup-kubectl and azure/setup-helm
actions, and add the Headlamp helm repo before the upgrade step.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
The deploy script assumed the PVC was mounted on the CI runner at
/mnt/headlamp-plugins, but the runner pod doesn't have that mount.
Fix by using a temporary pod (kubectl run) that mounts the PVC,
receives the plugin tarball via stdin, and extracts it.
Also adds missing workflow steps to create the PVC and upgrade
Headlamp with the shared volume helm values before deploying.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Simplify deploy step to call scripts/deploy-plugin-via-volume.sh
directly instead of duplicating copy logic. Align env var names
(PLUGIN_VOLUME_PATH, HEADLAMP_DEPLOY) with the deploy script's
expected interface from PR #59.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Replace the old preflight-only approach with a build-and-deploy flow
that uses a shared volume (hostPath) between the CI runner and the
Headlamp pod. The workflow now builds the plugin from source, copies
the artifact to a shared volume path, and optionally calls Gandalf's
deploy script for Headlamp rollout coordination.
Removes kubectl exec/cp references and version-match preflight in
favor of deploying the PR's actual build artifact.
Refs: PRI-216, PRI-195
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Replace the init container plugin installation with a shared PVC volume
between the CI runner and Headlamp pod. The runner builds the plugin and
copies it to the shared mount; Headlamp reads from the same volume.
- Add deployment/headlamp-e2e-values.yaml (PVC-backed shared volume)
- Add deployment/headlamp-plugins-pvc.yaml (PVC manifest)
- Add scripts/deploy-plugin-via-volume.sh (build + copy + restart)
- Remove deployment/headlamp-static-plugin-values.yaml (init container)
This is CI-only test infrastructure — ArtifactHub remains the sole
user-facing distribution channel.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Two root causes for the remaining 6 E2E failures after PR #50:
1. AppBarScoreBadge: Router.createRouteURL('polaris') was called without
the cluster parameter, producing '/polaris' instead of '/c/main/polaris'.
Now uses K8s.useCluster() to pass the active cluster. (appbar.spec.ts:18)
2. Plugin settings: registerPluginSettings was called with 'polaris' but
the package.json name is 'headlamp-polaris'. Headlamp matches settings
registrations to the package name, so the component never rendered.
(settings.spec.ts — all 5 tests)
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Fix badge navigation to use cluster-scoped path via Router.createRouteURL
instead of hardcoded '/polaris'. Remove hardcoded RGB color assertions in
badge color test. Scope ambiguous /%/ and 'Resources' selectors in polaris
E2E tests. Fix settings tests to click into plugin settings before asserting.
Fixes: PRI-151
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Per CEO directive, ArtifactHub via the Headlamp plugin installer is the
only approved installation method. No exceptions.
Co-authored-by: null-pointer-nancy[bot] <266300690+null-pointer-nancy[bot]@users.noreply.github.com>
Co-authored-by: Paperclip <noreply@paperclip.ing>
Adds missing TypeScript type declarations for React and React-DOM as devDependencies.
QA-approved by Regression Regina.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Polaris is already installed on the CI cluster. The E2E workflow
was failing because the runner SA lacks RBAC to deploy to the
polaris namespace. Remove Setup Helm, Setup kubectl, Deploy Polaris,
Apply RBAC, and Wait for readiness steps.
Resolves: PRI-28, PRI-109
Co-authored-by: Null Pointer Nancy <nancy@privilegedescalation.dev>
These type references were causing tsc to fail because neither vite nor
vite-plugin-svgr is installed as a dependency. The codebase does not use
any Vite-specific APIs or SVG imports, so the references are unnecessary.
Fixes#36
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Adds Helm-based Polaris dashboard deployment step to E2E workflow, fixing the long-standing E2E failure where Polaris was not accessible in the CI cluster.
- Wait for Authentik popup to fully load (domcontentloaded + networkidle)
before interacting with form elements
- Add explicit waitFor on username/password fields with 15s timeout
- Enable screenshot capture on test failure for better diagnostics
- Increase auth setup timeout to 60s to accommodate slow IdP responses
The auth setup was failing because the popup form elements weren't
ready when Playwright tried to fill them — this adds proper load
state waits between each interaction step.
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Enhances the preflight step to:
- Check the deployed plugin version against the repo version
- Emit a clear warning annotation when there's a mismatch
- Report the plugin name from artifacthub metadata
- Still runs tests (warning, not error) so we catch other issues
This makes plugin version mismatches immediately visible in the
CI summary instead of requiring investigators to dig through
14 timeout failures.
Co-authored-by: hugh-hackman[bot] <hugh-hackman[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Updates package.json and artifacthub-pkg.yml for the v0.7.0 release.
Includes all changes since v0.6.0:
- RBAC fix for Polaris dashboard proxy access (PR #22)
- Settings test selector fix (PR #22)
- Package name correction from solaris to polaris (PR #26)
- E2E preflight check (PR #24)
- Missing test dependencies (PR #28)
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
vitest, @testing-library/react, @testing-library/user-event,
@testing-library/jest-dom, jsdom, react, react-dom, @mui/material,
and react-router-dom were all used directly but only available as
transitive dependencies through @kinvolk/headlamp-plugin. pnpm's
strict module resolution prevented them from being resolved.
Also adds process.env.NODE_ENV="test" to vitest config so React
loads its development build (required for act() support in tests).
Fixes#27
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Adds a diagnostic step before E2E tests that:
- Logs the expected plugin version from package.json
- Verifies Headlamp is reachable (fails fast if not)
- Attempts to list installed plugins for debugging
This surfaces version mismatches and connectivity issues immediately
instead of requiring analysis of cryptic test timeout failures.
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* ci: add E2E preflight check for Headlamp connectivity and plugin version
Adds a diagnostic step before E2E tests that:
- Logs the expected plugin version from package.json
- Verifies Headlamp is reachable (fails fast if not)
- Attempts to list installed plugins for debugging
This surfaces version mismatches and connectivity issues immediately
instead of requiring analysis of cryptic test timeout failures.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: correct package name from headlamp-solaris to headlamp-polaris
The package name was misspelled as "solaris" instead of "polaris" in
artifacthub-pkg.yml, package.json, and package-lock.json.
Fixes PRI-49
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: correct package name from headlamp-solaris to headlamp-polaris
Fixes the ArtifactHub package name typo introduced in 0.6.0.
Only changes the name field in artifacthub-pkg.yml, package.json,
and package-lock.json. No dependency or workflow changes.
Fixes#25
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Update package name and Artifact Hub repository ID to reflect the
rename from polaris to headlamp-solaris (new ID: 0243bdaf-c926-44dc-b411-a7c291bf1fcd).
Files updated:
- package.json: name polaris -> headlamp-solaris
- package-lock.json: name polaris -> headlamp-solaris
- artifacthub-pkg.yml: name headlamp-polaris-plugin -> headlamp-solaris
- artifacthub-repo.yml: repositoryID updated to new ID
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
* fix: correct settings test selector to match plugin name
The settings E2E test looked for 'headlamp-polaris-plugin' but the
plugin is registered as 'polaris' (package.json name and
registerPluginSettings call). Fix the selector to match.
Refs: PRI-28
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci: add RBAC manifest for Polaris dashboard service proxy access
E2E tests fail with 403 because users lack RBAC to proxy to the Polaris
dashboard service. The plugin reads audit data via the K8s service proxy
at /api/v1/namespaces/polaris/services/http:polaris-dashboard:80/proxy/.
Add deployment/polaris-rbac.yaml with:
- Role granting `get` on `services/proxy` for polaris-dashboard
- RoleBinding granting this to all authenticated users (read-only)
The E2E workflow also needs a `kubectl apply -f deployment/polaris-rbac.yaml`
step added before running tests. This requires the `workflows` permission
on the GitHub App, which is tracked separately.
Refs: PRI-28
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci: add Polaris RBAC apply and readiness check to E2E workflow
The E2E tests fail because the CI runner lacks RBAC permissions to
proxy to the Polaris dashboard service. Apply the RBAC manifest
(added in this PR) and verify Polaris is reachable before running tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci: remove kubectl steps from E2E workflow
The CI runner (local-ubuntu-latest) has no kubectl or cluster access.
E2E tests are browser-only via Playwright against a remote Headlamp URL.
The Polaris RBAC fix (deployment/polaris-rbac.yaml) must be applied
directly to the cluster by an operator with kubectl access.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Configures the reusable release workflow to fetch the latest release
tag from FairwindsOps/polaris and set appVersion in artifacthub-pkg.yml.
This keeps our Artifact Hub listing in sync with the upstream project.
Co-authored-by: Hugh Hackman <hugh@privilegedescalation.dev>
Enable manual triggering of the CI workflow via GitHub Actions UI.
The release workflow already supports workflow_dispatch.
Co-authored-by: hugh-hackman[bot] <hugh-hackman[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: restore badge emoji, fix aria-label, and correct service proxy URL
Three root causes for E2E test failures since March 4:
1. Service proxy URL missing http: protocol prefix — Kubernetes requires
the format http:service-name:port, not service-name:port. This caused
all data fetches to fail, making data-dependent components render
empty states instead of expected content.
2. AppBarScoreBadge aria-label "Polaris cluster score: X%" doesn't match
the E2E test regex /Polaris: \d+%/. Simplified to "Polaris: X%".
3. Shield emoji was removed from badge in commit 514de78 but E2E tests
still assert its presence.
Fixes PRI-20
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* style: format polaris.ts to pass prettier check
The service proxy URL fix in 61bf1fe exceeded the line length limit.
Run prettier to split the long line.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The CI and release workflows use Node 22, but E2E was still on Node 20.
This aligns all workflows to the same Node version for consistency.
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Target main branch explicitly
- Set weekly schedule (weekends)
- Limit concurrent PRs to 10
- Group minor/patch updates for npm and github-actions to reduce PR noise
Ref: PRI-16
Co-authored-by: gandalf-the-greybeard[bot] <gandalf-the-greybeard[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Adds Claude Code agent skill for ArtifactHub metadata and publishing,
sourced from headlamp-agent-skills repository.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds Claude Code agent skill for Headlamp plugin development,
sourced from headlamp-agent-skills repository.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gh CLI is not installed on the self-hosted runner. Switch to
softprops/action-gh-release@v2 which was used before the
standardization broke it.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove broken mv logic and use gh CLI for release creation,
matching the proven workflow from other headlamp plugins.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Gandalf the Greybeard
Hugh Hackman
Chris Farhood