Compare commits
4 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Chris Farhood
|
56d10a1d40 | ||
|
Chris Farhood
|
1f02811731 | ||
|
Chris Farhood
|
7b58f684cf | ||
|
Chris Farhood
|
e2f220c418 |
+3
-101
@@ -11,15 +11,15 @@ permissions:
|
||||
contents: read
|
||||
|
||||
# Only one E2E run at a time: the shared E2E_RELEASE (headlamp-e2e) in
|
||||
# headlamp-dev cannot be shared across concurrent runs.
|
||||
# privilegedescalation-dev cannot be shared across concurrent runs.
|
||||
# cancel-in-progress: false (queue, don't cancel) — cancelling in-flight
|
||||
# runs may skip the if:always() teardown, leaving dangling cluster resources.
|
||||
# runs may skip the if: always() teardown, leaving dangling cluster resources.
|
||||
concurrency:
|
||||
group: e2e-${{ github.repository }}
|
||||
cancel-in-progress: false
|
||||
|
||||
env:
|
||||
E2E_NAMESPACE: headlamp-dev
|
||||
E2E_NAMESPACE: privilegedescalation-dev
|
||||
E2E_RELEASE: headlamp-e2e
|
||||
# Pin to a known-good Headlamp version. Using :latest is risky because
|
||||
# the tag can change between CI runs, causing flaky failures when a newer
|
||||
@@ -45,104 +45,6 @@ jobs:
|
||||
- name: Setup kubectl
|
||||
uses: azure/setup-kubectl@v4
|
||||
|
||||
- name: Get kubeconfig
|
||||
run: |
|
||||
set -euo pipefail
|
||||
echo "=== Runner environment diagnostic ==="
|
||||
echo "HOME=${HOME:-}"
|
||||
echo "KUBECONFIG=${KUBECONFIG:-}"
|
||||
echo "ACTIONS_KUBECONFIG=${ACTIONS_KUBECONFIG:-}"
|
||||
echo "RUNNER_CONFIG=${RUNNER_CONFIG:-}"
|
||||
echo "RUNNER_CONFIG_DIR=${RUNNER_CONFIG_DIR:-}"
|
||||
echo ""
|
||||
echo "=== Checking known kubeconfig locations ==="
|
||||
for path in /runner/config /home/runner/.kube/config "${HOME:-}/.kube/config" "${HOME:-}/.kube"; do
|
||||
if [ -f "$path" ]; then
|
||||
echo "FOUND kubeconfig at: $path"
|
||||
elif [ -d "$path" ]; then
|
||||
echo "DIR exists at: $path, contents:"
|
||||
ls -la "$path" 2>&1 || echo " (cannot list)"
|
||||
else
|
||||
echo "NOT FOUND: $path"
|
||||
fi
|
||||
done
|
||||
echo ""
|
||||
echo "=== In-cluster service account check ==="
|
||||
in_cluster=false
|
||||
if [ -f /var/run/secrets/kubernetes.io/serviceaccount/token ]; then
|
||||
echo "Service account token present — in-cluster mode available"
|
||||
echo "KUBERNETES_SERVICE_HOST=${KUBERNETES_SERVICE_HOST:-}"
|
||||
echo "KUBERNETES_SERVICE_PORT=${KUBERNETES_SERVICE_PORT:-}"
|
||||
in_cluster=true
|
||||
else
|
||||
echo "No service account token at /var/run/secrets/kubernetes.io/serviceaccount/"
|
||||
fi
|
||||
echo ""
|
||||
if [ -f /runner/config ]; then
|
||||
echo "KUBECONFIG=/runner/config" >> "$GITHUB_ENV"
|
||||
echo "Using kubeconfig from /runner/config"
|
||||
elif [ -f /home/runner/.kube/config ]; then
|
||||
echo "KUBECONFIG=/home/runner/.kube/config" >> "$GITHUB_ENV"
|
||||
echo "Using kubeconfig from /home/runner/.kube/config"
|
||||
elif [ -f "${HOME:-}/.kube/config" ]; then
|
||||
echo "KUBECONFIG=${HOME:-}/.kube/config" >> "$GITHUB_ENV"
|
||||
echo "Using kubeconfig from HOME"
|
||||
elif [ "$in_cluster" = true ]; then
|
||||
echo "No static kubeconfig found — generating in-cluster kubeconfig"
|
||||
KUBECFG_DIR="${HOME:-}/.kube"
|
||||
mkdir -p "$KUBECFG_DIR"
|
||||
kubectl config set-cluster in-cluster \
|
||||
--server="https://${KUBERNETES_SERVICE_HOST:-kubernetes.default.svc}:${KUBERNETES_SERVICE_PORT:-443}" \
|
||||
--certificate-authority=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
|
||||
--embed-certs=true \
|
||||
--kubeconfig="$KUBECFG_DIR/config" 2>&1
|
||||
kubectl config set-credentials in-cluster \
|
||||
--token="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" \
|
||||
--kubeconfig="$KUBECFG_DIR/config" 2>&1
|
||||
kubectl config set-context in-cluster \
|
||||
--cluster=in-cluster \
|
||||
--user=in-cluster \
|
||||
--kubeconfig="$KUBECFG_DIR/config" 2>&1
|
||||
kubectl config use-context in-cluster \
|
||||
--kubeconfig="$KUBECFG_DIR/config" 2>&1
|
||||
echo "KUBECONFIG=$KUBECFG_DIR/config" >> "$GITHUB_ENV"
|
||||
echo "Generated in-cluster kubeconfig at $KUBECFG_DIR/config"
|
||||
else
|
||||
echo "::error::No kubeconfig found in /runner/config, /home/runner/.kube/config, HOME, or in-cluster service account"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Apply RBAC for E2E pipeline
|
||||
run: |
|
||||
set -x
|
||||
kubectl apply -f deployment/e2e-ci-runner-rbac.yaml --dry-run=server 2>&1 || true
|
||||
kubectl apply -f deployment/e2e-ci-runner-rbac.yaml 2>&1
|
||||
echo "exit code: $?"
|
||||
echo "Waiting for RBAC propagation..."
|
||||
sleep 5
|
||||
echo "Verifying RBAC resources were created..."
|
||||
kubectl get role e2e-ci-runner -n headlamp-dev 2>&1 | tail -3
|
||||
kubectl get role e2e-ci-runner-polaris -n headlamp-dev 2>&1 | tail -3
|
||||
kubectl get rolebinding e2e-ci-runner-binding -n headlamp-dev 2>&1 | tail -3
|
||||
set +x
|
||||
|
||||
- name: Apply Polaris dashboard RBAC
|
||||
run: kubectl apply -f deployment/polaris-rbac.yaml
|
||||
|
||||
- name: RBAC pre-flight check
|
||||
run: |
|
||||
echo "Checking RBAC resources..."
|
||||
MISSING=0
|
||||
kubectl get role polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
|
||||
kubectl get rolebinding polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
|
||||
kubectl auth can-i delete configmaps -n "$E2E_NAMESPACE" 2>/dev/null || MISSING=1
|
||||
if [ "$MISSING" -eq 0 ]; then
|
||||
echo "RBAC pre-flight check passed."
|
||||
else
|
||||
echo "::error::RBAC pre-flight check failed. Missing required permissions."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Install dependencies
|
||||
run: npm ci
|
||||
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
{
|
||||
"config": {
|
||||
// Line length — not enforced for docs with code examples
|
||||
"MD013": false,
|
||||
// First line heading — files use YAML frontmatter, not headings
|
||||
"MD041": false,
|
||||
// Emphasis as heading — common pattern for Option 1/2/3 sections
|
||||
"MD036": false,
|
||||
// No duplicate heading — changelog files repeat section names intentionally
|
||||
"MD024": false,
|
||||
// Fenced code language — not always applicable for diagram blocks
|
||||
"MD040": false,
|
||||
// Table column style — table alignment is visual, not semantic
|
||||
"MD060": false,
|
||||
// Ordered list item prefix — number resets are intentional in documents
|
||||
"MD029": false,
|
||||
// No inline HTML — each elements are valid in valid Markdown
|
||||
"MD033": false,
|
||||
// List marker space — spacing after list markers varies by editor
|
||||
"MD030": false,
|
||||
// Blanks around headings — not always needed in compact docs
|
||||
"MD022": false,
|
||||
// Blanks around lists — not always needed in compact docs
|
||||
"MD032": false,
|
||||
// Blanks around fences — not always needed between adjacent blocks
|
||||
"MD031": false,
|
||||
// Multiple blanks — editor artifacts, not semantic
|
||||
"MD012": false,
|
||||
// Single title — files may have multiple H1 sections
|
||||
"MD025": false,
|
||||
// Trailing spaces — editor artifacts
|
||||
"MD009": false,
|
||||
// Bare URLs — URL shortening not always needed
|
||||
"MD034": false,
|
||||
// Single trailing newline — editor artifacts
|
||||
"MD047": false,
|
||||
// Trailing punctuation — heading punctuation is intentional
|
||||
"MD026": false,
|
||||
// Space in emphasis — double-asterisk bold spacing varies by renderer
|
||||
"MD037": false,
|
||||
// No hard tabs — some generated docs use tabs for indentation
|
||||
"MD010": false,
|
||||
// Code block style — generated docs may use inconsistent styles
|
||||
"MD046": false,
|
||||
// Comment style — generated docs have no comments
|
||||
"MD048": false,
|
||||
// Commands show output — shell examples intentionally show only commands
|
||||
"MD014": false
|
||||
},
|
||||
"ignores": [
|
||||
"docs/api-reference/generated/**"
|
||||
]
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
docs/api-reference/generated/**
|
||||
@@ -229,7 +229,7 @@ Headlamp v0.39.0 with default `watchPlugins: true` treats catalog-managed plugin
|
||||
**Action Items:**
|
||||
- [ ] Parallelize test execution
|
||||
- [ ] Add npm cache to GitHub Actions
|
||||
- [x] Renovate is configured org-wide via `github>privilegedescalation/.github:renovate-config`
|
||||
- [ ] Integrate Dependabot
|
||||
- [ ] Add semantic-release
|
||||
|
||||
---
|
||||
|
||||
+1
-1
@@ -212,7 +212,7 @@ If you discover a security vulnerability in this plugin, please report it via:
|
||||
|
||||
The project uses:
|
||||
- **npm audit**: Runs automatically during `npm install`
|
||||
- **Renovate**: Automated dependency updates via Mend Renovate (org-wide configured)
|
||||
- **Dependabot**: GitHub Dependabot monitors dependencies and creates PRs for updates
|
||||
- **GitHub Actions**: CI workflow runs `npm audit` on every commit
|
||||
|
||||
### Updating Dependencies
|
||||
|
||||
@@ -1,98 +0,0 @@
|
||||
# PRI-324 Spec: Make E2E Workflow Self-Sufficient with RBAC
|
||||
|
||||
## Context
|
||||
|
||||
PR #123 introduced an RBAC pre-flight check to the E2E workflow. QA (Nancy, acting as QA) verified the "fails fast without RBAC" path works, but found that the "with RBAC passes" path had no green CI evidence — the workflow did not apply RBAC before the pre-flight check.
|
||||
|
||||
PR #131 attempted to fix this by adding `kubectl apply` steps and extending the CI runner RBAC, but its merge commit (739db6fe) was reverted by the next commit on main (aa1db921) due to a vulnerability fix PR (#128).
|
||||
|
||||
The current E2E workflow on `main` lacks the RBAC apply steps and CI runner permissions needed to make the pre-flight check meaningful.
|
||||
|
||||
## Required Changes
|
||||
|
||||
### 1. `.github/workflows/e2e.yaml`
|
||||
|
||||
Add between the "Setup kubectl" and "Install dependencies" steps:
|
||||
|
||||
```yaml
|
||||
- name: Apply RBAC for E2E pipeline
|
||||
run: |
|
||||
set -x
|
||||
kubectl apply -f deployment/e2e-ci-runner-rbac.yaml --dry-run=server 2>&1 || true
|
||||
kubectl apply -f deployment/e2e-ci-runner-rbac.yaml 2>&1
|
||||
echo "exit code: $?"
|
||||
echo "Waiting for RBAC propagation..."
|
||||
sleep 5
|
||||
echo "Verifying CI runner permissions..."
|
||||
kubectl auth can-i create roles -n headlamp-dev --as="system:serviceaccount:arc-runners:runners-privilegedescalation-gha-rs-no-permission" 2>&1 || { echo "::error::CI runner still lacks roles permission after propagation wait"; exit 1; }
|
||||
set +x
|
||||
|
||||
- name: Apply Polaris dashboard RBAC
|
||||
run: kubectl apply -f deployment/polaris-rbac.yaml
|
||||
|
||||
- name: RBAC pre-flight check
|
||||
run: |
|
||||
echo "Checking RBAC resources..."
|
||||
MISSING=0
|
||||
kubectl get role polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
|
||||
kubectl get rolebinding polaris-dashboard-proxy-reader -n polaris -o name >/dev/null 2>&1 || MISSING=1
|
||||
kubectl auth can-i delete configmaps -n "$E2E_NAMESPACE" --quiet 2>/dev/null || MISSING=1
|
||||
if [ "$MISSING" -eq 0 ]; then
|
||||
echo "RBAC pre-flight check passed."
|
||||
else
|
||||
echo "::error::RBAC pre-flight check failed. Missing required permissions."
|
||||
exit 1
|
||||
fi
|
||||
```
|
||||
|
||||
### 2. `deployment/e2e-ci-runner-rbac.yaml`
|
||||
|
||||
Add a new Role + RoleBinding for the `polaris` namespace (from PR #131):
|
||||
|
||||
```yaml
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: e2e-ci-runner-polaris
|
||||
namespace: polaris
|
||||
rules:
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources: ["roles", "rolebindings"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: e2e-ci-runner-polaris
|
||||
namespace: polaris
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: runners-privilegedescalation-gha-rs-no-permission
|
||||
namespace: arc-runners
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: e2e-ci-runner-polaris
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
```
|
||||
|
||||
And add to the existing `e2e-ci-runner` Role in the `headlamp-dev` namespace:
|
||||
```yaml
|
||||
# Apply Polaris dashboard RBAC in the polaris namespace
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources: ["roles", "rolebindings"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
```
|
||||
|
||||
## Acceptance Criteria
|
||||
|
||||
- [ ] Workflow applies `deployment/e2e-ci-runner-rbac.yaml` before the pre-flight check
|
||||
- [ ] Workflow applies `deployment/polaris-rbac.yaml` before the pre-flight check
|
||||
- [ ] CI runner has RBAC to apply the manifests (added via new Role+RoleBinding in polaris namespace)
|
||||
- [ ] E2E pipeline passes on the PR branch (proof of green path)
|
||||
- [ ] `kubectl get … --quiet` flag removed (QA nit)
|
||||
- [ ] `MISSING_ROLE`/`MISSING_ROLEBINDING` collapsed to single `MISSING` flag (QA nit)
|
||||
|
||||
## Definition of Done
|
||||
|
||||
PR #123 QA changes-requested are addressed: the workflow is self-sufficient (applies its own RBAC), the green path is demonstrated, and QA review is re-requested.
|
||||
@@ -1,74 +1,12 @@
|
||||
---
|
||||
# RBAC for the GitHub Actions CI runner to manage the E2E Headlamp instance.
|
||||
# RBAC for the GitHub Actions CI runner to manage E2E Headlamp instances.
|
||||
# CI-only test fixture — NOT for production use.
|
||||
#
|
||||
# Grants the ARC runner service account permissions in the headlamp-dev
|
||||
# namespace to deploy and tear down a dedicated Headlamp instance via Helm.
|
||||
# E2E resources run in `headlamp-dev` — nothing persists beyond a test run.
|
||||
# This file is a REFERENCE ONLY. The canonical manifest lives in:
|
||||
# privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml
|
||||
#
|
||||
# Plugin is loaded via ConfigMap volume mount — no custom Docker images.
|
||||
# The infra repo is managed by Flux GitOps and is the source of truth.
|
||||
# Do not apply this file directly — it is kept here for developer reference only.
|
||||
#
|
||||
# Note: This RBAC is mirrored in privilegedescalation/infra (base/rbac/)
|
||||
# and managed by Flux GitOps. The infra repo is the source of truth.
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: e2e-ci-runner
|
||||
namespace: headlamp-dev
|
||||
rules:
|
||||
# Helm needs to manage these resources for the Headlamp chart
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services", "serviceaccounts", "configmaps", "secrets", "events"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Token creation for E2E test auth
|
||||
- apiGroups: [""]
|
||||
resources: ["serviceaccounts/token"]
|
||||
verbs: ["create"]
|
||||
# Apply Polaris dashboard RBAC in the polaris namespace
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources: ["roles", "rolebindings"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: e2e-ci-runner-polaris
|
||||
namespace: polaris
|
||||
rules:
|
||||
- apiGroups: ["rbac.authorization.k8s.io"]
|
||||
resources: ["roles", "rolebindings"]
|
||||
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: e2e-ci-runner-polaris
|
||||
namespace: polaris
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: runners-privilegedescalation-gha-rs-no-permission
|
||||
namespace: arc-runners
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: e2e-ci-runner-polaris
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: e2e-ci-runner-binding
|
||||
namespace: headlamp-dev
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: runners-privilegedescalation-gha-rs-no-permission
|
||||
namespace: arc-runners
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: e2e-ci-runner
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
# E2E resources run in `privilegedescalation-dev` — nothing persists beyond a test run.
|
||||
# RBAC is managed via Flux from privilegedescalation/infra — do not apply manually.
|
||||
|
||||
@@ -160,7 +160,7 @@ spec:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
kubernetes.io/metadata.name: headlamp
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
component: kube-apiserver
|
||||
|
||||
@@ -41,7 +41,7 @@ spec:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
kubernetes.io/metadata.name: headlamp
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
component: kube-apiserver
|
||||
|
||||
@@ -318,7 +318,7 @@ spec:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
kubernetes.io/metadata.name: headlamp
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
component: kube-apiserver
|
||||
|
||||
+3
-3
@@ -41,8 +41,8 @@ The default base URL is `https://headlamp.animaniacs.farh.net`. Override with `H
|
||||
### Option 2: K8s bearer token (port-forward)
|
||||
|
||||
```bash
|
||||
kubectl port-forward -n kube-system svc/headlamp 4466:80
|
||||
export HEADLAMP_TOKEN=$(kubectl create token headlamp -n kube-system)
|
||||
kubectl port-forward -n headlamp svc/headlamp 4466:80
|
||||
export HEADLAMP_TOKEN=$(kubectl create token headlamp -n headlamp)
|
||||
HEADLAMP_URL=http://localhost:4466 npm run e2e
|
||||
```
|
||||
|
||||
@@ -143,7 +143,7 @@ cp .env.example .env
|
||||
|
||||
# 3. Set environment variables
|
||||
export HEADLAMP_URL=https://your-headlamp-instance.com
|
||||
export HEADLAMP_TOKEN=$(kubectl create token headlamp -n kube-system)
|
||||
export HEADLAMP_TOKEN=$(kubectl create token headlamp -n headlamp)
|
||||
|
||||
# 4. Run tests
|
||||
npm run e2e
|
||||
|
||||
+1
-5
@@ -35,11 +35,7 @@
|
||||
"overrides": {
|
||||
"tar": "^7.5.11",
|
||||
"undici": "^7.24.3",
|
||||
"flatted": "^3.4.2",
|
||||
"lodash": ">=4.18.0",
|
||||
"picomatch": ">=4.0.4",
|
||||
"vite": ">=6.4.2",
|
||||
"elliptic": ">=6.6.1"
|
||||
"flatted": "^3.4.2"
|
||||
}
|
||||
},
|
||||
"devDependencies": {
|
||||
|
||||
Generated
+141
-519
File diff suppressed because it is too large
Load Diff
@@ -5,16 +5,18 @@
|
||||
# a ConfigMap volume mount. No custom Docker images — the plugin is built
|
||||
# in CI and injected as a ConfigMap.
|
||||
#
|
||||
# E2E resources are deployed to the `headlamp-dev` namespace. Nothing
|
||||
# persists beyond a test run — teardown cleans up all created resources.
|
||||
# E2E resources are deployed to the `privilegedescalation-dev` namespace. Nothing
|
||||
# persists beyond the test run — teardown cleans up all created resources.
|
||||
#
|
||||
# Prerequisites:
|
||||
# - Plugin built (dist/ exists with plugin-main.js + package.json)
|
||||
# - kubectl configured with cluster access
|
||||
# - RBAC applied (managed by Flux GitOps in privilegedescalation/infra)
|
||||
# RBAC is managed via Flux from privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml.
|
||||
# The infra repo is the source of truth — do not apply this file directly.
|
||||
# Apply RBAC first: kubectl apply -f privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml
|
||||
#
|
||||
# Environment:
|
||||
# E2E_NAMESPACE — namespace for E2E Headlamp (default: headlamp-dev)
|
||||
# E2E_NAMESPACE — namespace for E2E Headlamp (default: privilegedescalation-dev)
|
||||
# E2E_RELEASE — release/resource name prefix (default: headlamp-e2e)
|
||||
# HEADLAMP_VERSION — Headlamp image tag (default: v0.40.1, pinned to match production)
|
||||
set -euo pipefail
|
||||
@@ -22,7 +24,7 @@ set -euo pipefail
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
DIST_DIR="$REPO_ROOT/dist"
|
||||
|
||||
E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
|
||||
E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
|
||||
E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
|
||||
HEADLAMP_VERSION="${HEADLAMP_VERSION:-v0.40.1}"
|
||||
|
||||
@@ -35,7 +37,7 @@ fi
|
||||
echo "Checking RBAC permissions in namespace '${E2E_NAMESPACE}'..."
|
||||
if ! kubectl auth can-i delete configmaps -n "$E2E_NAMESPACE" --quiet 2>/dev/null; then
|
||||
echo "ERROR: Missing RBAC — cannot delete configmaps in namespace '${E2E_NAMESPACE}'." >&2
|
||||
echo " Apply RBAC first: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml" >&2
|
||||
echo " Apply RBAC first: kubectl apply -f privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
@@ -3,14 +3,17 @@
|
||||
#
|
||||
# Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh.
|
||||
#
|
||||
# RBAC is managed via Flux from privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml.
|
||||
# The infra repo is the source of truth — do not apply this file directly.
|
||||
#
|
||||
# Environment:
|
||||
# E2E_NAMESPACE — namespace to clean up (default: headlamp-dev)
|
||||
# E2E_NAMESPACE — namespace to clean up (default: privilegedescalation-dev)
|
||||
# E2E_RELEASE — release/resource name prefix (default: headlamp-e2e)
|
||||
set -euo pipefail
|
||||
|
||||
REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
||||
|
||||
E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
|
||||
E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
|
||||
E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
|
||||
|
||||
echo "=== E2E Headlamp Teardown ==="
|
||||
|
||||
Reference in New Issue
Block a user