9249f151a8
kubectl get namespace is cluster-scoped and requires a ClusterRole. The runner SA only had a namespaced Role, causing E2E to fail with Forbidden even when the namespace existed. Adds a minimal ClusterRole restricted to get on headlamp-e2e only. Co-Authored-By: Paperclip <noreply@paperclip.ing>