From a65743dea3ee70a1f98ee7e0f8c505e1e1e354fc Mon Sep 17 00:00:00 2001 From: Chris Farhood Date: Sun, 3 May 2026 15:13:03 +0000 Subject: [PATCH] fix(e2e): grant CI runner read access to polaris namespace for RBAC pre-flight check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The RBAC pre-flight check workflow step (commit 46350c5) verifies that polaris-dashboard-proxy-reader Role and RoleBinding exist in the polaris namespace before running E2E tests. However, the CI runner's RBAC (e2e-ci-runner-role in privilegedescalation-dev) did not include permission to read roles/rolebindings in the polaris namespace, causing the pre-flight check to fail with a generic kubectl error on all branches. Fix: add rules to e2e-ci-runner-role allowing get on roles/rolebindings in privilegedescalation-dev (for the pre-flight check itself), plus a new Role + RoleBinding in the polaris namespace granting the runner read access to rbac resources there. Without this fix, the pre-flight check exits 1 on every branch until someone SSHs into the runner pod and manually applies the polaris RBAC manifest — which they shouldn't need to do. Co-Authored-By: Paperclip --- deployment/e2e-ci-runner-rbac.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/deployment/e2e-ci-runner-rbac.yaml b/deployment/e2e-ci-runner-rbac.yaml index ea93cff..89a608d 100644 --- a/deployment/e2e-ci-runner-rbac.yaml +++ b/deployment/e2e-ci-runner-rbac.yaml @@ -30,6 +30,35 @@ rules: - apiGroups: [""] resources: ["serviceaccounts/token"] verbs: ["create"] + # RBAC pre-flight check: verify polaris namespace has proxy-reader Role + RoleBinding + # before running E2E tests. Required by the "RBAC pre-flight check" workflow step. + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "rolebindings"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: e2e-ci-runner-polaris-reader + namespace: polaris +rules: + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "rolebindings"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: e2e-ci-runner-polaris-reader-binding + namespace: polaris +subjects: + - kind: ServiceAccount + name: runners-privilegedescalation-gha-rs-no-permission + namespace: arc-runners +roleRef: + kind: Role + name: e2e-ci-runner-polaris-reader + apiGroup: rbac.authorization.k8s.io --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding -- 2.52.0