Hugh Hackman
e679216660
The CI runner SA cannot access cluster-scoped resources (ClusterRole, ClusterRoleBinding) needed by helm upgrade's 3-way merge. Replace the helm upgrade step with kubectl patch commands that add the shared volume mount directly to the Headlamp deployment. This eliminates the need for cluster-admin intervention: - kubectl patch adds PVC volume + volumeMount to the deployment - kubectl set env configures the plugins directory - kubectl rollout status waits for the update Also removes the now-unnecessary ClusterRole/ClusterRoleBinding from the RBAC manifest — only namespace-scoped Role/RoleBinding is needed. Co-Authored-By: Paperclip <noreply@paperclip.ing>
60 lines
1.9 KiB
YAML
60 lines
1.9 KiB
YAML
---
|
|
# RBAC for the GitHub Actions CI runner to perform E2E test setup.
|
|
# CI-only test fixture — NOT for production use.
|
|
#
|
|
# Grants the ARC runner service account namespace-scoped permissions in
|
|
# kube-system to patch the Headlamp deployment (add shared volume mount),
|
|
# manage PVCs, run temporary pods, and restart deployments.
|
|
#
|
|
# No cluster-scoped permissions needed — the E2E workflow uses kubectl patch
|
|
# instead of helm upgrade, avoiding the need to read ClusterRole/ClusterRoleBinding.
|
|
#
|
|
# Apply with: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: e2e-ci-runner
|
|
namespace: kube-system
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["persistentvolumeclaims"]
|
|
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "create", "delete", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["pods/attach"]
|
|
verbs: ["create", "get"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get", "list", "patch", "watch"]
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments/scale"]
|
|
verbs: ["patch"]
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["configmaps"]
|
|
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["services"]
|
|
verbs: ["get", "list", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["serviceaccounts"]
|
|
verbs: ["get", "list"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: e2e-ci-runner-binding
|
|
namespace: kube-system
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: local-ubuntu-latest-gha-rs-no-permission
|
|
namespace: arc-runners
|
|
roleRef:
|
|
kind: Role
|
|
name: e2e-ci-runner
|
|
apiGroup: rbac.authorization.k8s.io
|