fix(e2e): apply RBAC before deploy step #85

Closed

privilegedescalation-engineer[bot] wants to merge 2 commits from fix/e2e-rbac-apply-step into main

Author	SHA1	Message	Date
Hugh Hackman	2734e0f554	revert(e2e): remove Apply RBAC step — CI runner lacks RBAC read permissions The CI runner service account (runners-privilegedescalation-gha-rs-no-permission) does not have `get` on roles/rolebindings, so kubectl apply returns Forbidden before it can apply anything. This is a circular dependency: the runner needs RBAC to operate, but can't apply its own RBAC. The correct fix is to bootstrap the privilegedescalation/infra repo into the cluster's Flux instance. The RBAC manifest is already at base/rbac/e2e-ci-runner-rbac.yaml with a kustomization — Flux will apply it once the infra-production GitRepository+Kustomization are registered with the cluster's Flux. See: https://github.com/privilegedescalation/headlamp-polaris-plugin/issues/79 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-21 14:16:13 +00:00
Hugh Hackman	088550744f	fix(e2e): apply RBAC before deploy step The deploy script preflight check (deploy-e2e-headlamp.sh:37-41) verifies RBAC permissions before proceeding, but the workflow never applied the RBAC manifest. Add the missing Apply RBAC step after Setup Helm and before Deploy. Fixes https://github.com/privilegedescalation/headlamp-polaris-plugin/issues/79 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-03-21 14:10:54 +00:00

Author

SHA1

Message

Date

Hugh Hackman

2734e0f554

revert(e2e): remove Apply RBAC step — CI runner lacks RBAC read permissions

The CI runner service account (runners-privilegedescalation-gha-rs-no-permission)
does not have `get` on roles/rolebindings, so kubectl apply returns Forbidden
before it can apply anything. This is a circular dependency: the runner needs
RBAC to operate, but can't apply its own RBAC.

The correct fix is to bootstrap the privilegedescalation/infra repo into
the cluster's Flux instance. The RBAC manifest is already at
base/rbac/e2e-ci-runner-rbac.yaml with a kustomization — Flux will apply it
once the infra-production GitRepository+Kustomization are registered with
the cluster's Flux.

See: https://github.com/privilegedescalation/headlamp-polaris-plugin/issues/79

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-21 14:16:13 +00:00

Hugh Hackman

088550744f

fix(e2e): apply RBAC before deploy step

The deploy script preflight check (deploy-e2e-headlamp.sh:37-41) verifies
RBAC permissions before proceeding, but the workflow never applied the RBAC
manifest. Add the missing Apply RBAC step after Setup Helm and before Deploy.

Fixes https://github.com/privilegedescalation/headlamp-polaris-plugin/issues/79

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-03-21 14:10:54 +00:00

fix(e2e): apply RBAC before deploy step #85

2 Commits