Hugh Hackman
4826604a02
The E2E Headlamp instance runs in privilegedescalation-dev but needs to proxy to the Polaris dashboard service in the polaris namespace to fetch audit results. Root cause: - E2E tests consistently fail with 'Polaris dashboard not reachable' because the in-cluster Headlamp (running as ServiceAccount headlamp-e2e-test in privilegedescalation-dev) lacks permission to proxy to polaris-dashboard in the polaris namespace - The default RBAC only covered the privilegedescalation-dev namespace - The error manifests as a 503 from the Kubernetes API proxy, causing the loading spinner to persist indefinitely in E2E runs Fix: - Add a new Role + RoleBinding for the polaris namespace that grants get+proxy on the polaris-dashboard service - The ARC runner's ServiceAccount (runners-privilegedescalation-gha-rs-no-permission in arc-runners) is the subject for both bindings, matching the existing pattern - Add a pre-flight check in deploy-e2e-headlamp.sh that warns if Polaris proxy RBAC is missing, so CI output makes the issue self-diagnosing Note: This RBAC change must be applied to the cluster before E2E runs will pass. The deploy script detects and warns about the missing permission. Co-Authored-By: Paperclip <noreply@paperclip.ing>
74 lines
2.3 KiB
YAML
74 lines
2.3 KiB
YAML
---
|
|
# RBAC for the GitHub Actions CI runner to manage the E2E Headlamp instance.
|
|
# CI-only test fixture — NOT for production use.
|
|
#
|
|
# Grants the ARC runner service account permissions in the privilegedescalation-dev
|
|
# namespace to deploy and tear down a dedicated Headlamp instance via Helm.
|
|
# E2E resources run in `privilegedescalation-dev` — nothing persists beyond a test run.
|
|
#
|
|
# Plugin is loaded via ConfigMap volume mount — no custom Docker images.
|
|
#
|
|
# Prerequisites:
|
|
# kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: e2e-ci-runner
|
|
namespace: privilegedescalation-dev
|
|
rules:
|
|
# Helm needs to manage these resources for the Headlamp chart
|
|
- apiGroups: ["apps"]
|
|
resources: ["deployments"]
|
|
verbs: ["get", "list", "create", "update", "patch", "delete", "watch"]
|
|
- apiGroups: [""]
|
|
resources: ["services", "serviceaccounts", "configmaps", "secrets"]
|
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get", "list", "watch"]
|
|
# Token creation for E2E test auth
|
|
- apiGroups: [""]
|
|
resources: ["serviceaccounts/token"]
|
|
verbs: ["create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: e2e-ci-runner-binding
|
|
namespace: privilegedescalation-dev
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: runners-privilegedescalation-gha-rs-no-permission
|
|
namespace: arc-runners
|
|
roleRef:
|
|
kind: Role
|
|
name: e2e-ci-runner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: e2e-ci-runner
|
|
namespace: polaris
|
|
rules:
|
|
# E2E Headlamp needs to proxy to the Polaris dashboard service to fetch audit results.
|
|
# The service account in privilegedescalation-dev is granted get+proxy on polaris-dashboard.
|
|
- apiGroups: [""]
|
|
resources: ["services/proxy"]
|
|
verbs: ["get"]
|
|
resourceNames: ["polaris-dashboard"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: e2e-ci-runner-binding
|
|
namespace: polaris
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: runners-privilegedescalation-gha-rs-no-permission
|
|
namespace: arc-runners
|
|
roleRef:
|
|
kind: Role
|
|
name: e2e-ci-runner
|
|
apiGroup: rbac.authorization.k8s.io
|