From e6920dcba4680a8aec12d5e7675215761cfb4b0f Mon Sep 17 00:00:00 2001
From: "privilegedescalation-engineer[bot]"
 <269729446+privilegedescalation-engineer[bot]@users.noreply.github.com>
Date: Wed, 6 May 2026 00:44:06 +0000
Subject: [PATCH] fix(e2e): add E2E workflow for sealed-secrets plugin (#67)

* fix(e2e): add E2E workflow for headlamp-sealed-secrets-plugin

Adds .github/workflows/e2e.yaml calling the shared plugin-e2e.yaml reusable workflow.
Fixes PRI-729: E2E DNS failure caused by missing E2E workflow in this repo.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix(e2e): reference @main workflow after .github merge

Update workflow_call ref from hugh/add-pnpm-support-plugin-e2e to main
now that .github#144 has merged.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix(e2e): use pnpm-capable workflow branch

Reference @hugh/add-pnpm-support-plugin-e2e which has pnpm support via corepack.

PRI-634

* fix(e2e): reference @main workflow after .github merge

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix(e2e): disable automount SA token to avoid kubelet fetch race

Kubelet tries to fetch SA token immediately after deployment creates the pod,
but the SA may not be propagated yet. Setting automountServiceAccountToken: false
avoids this race. The SA token is not needed since E2E tests authenticate
via HEADLAMP_TOKEN passed as env var.

---------

Co-authored-by: Chris Farhood <chris@farhood.org>
Co-authored-by: Paperclip <noreply@paperclip.ing>
---
 .github/workflows/e2e.yaml     | 23 +++++++++++++++++++++++
 scripts/deploy-e2e-headlamp.sh |  3 ++-
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/e2e.yaml

diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
new file mode 100644
index 0000000..0363889
--- /dev/null
+++ b/.github/workflows/e2e.yaml
@@ -0,0 +1,23 @@
+name: E2E Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  e2e:
+    uses: privilegedescalation/.github/.github/workflows/plugin-e2e.yaml@main
+    with:
+      node-version: "22"
+      headlamp-version: v0.40.1
+      e2e-namespace: headlamp-dev
diff --git a/scripts/deploy-e2e-headlamp.sh b/scripts/deploy-e2e-headlamp.sh
index 8f7a872..31bb566 100755
--- a/scripts/deploy-e2e-headlamp.sh
+++ b/scripts/deploy-e2e-headlamp.sh
@@ -97,7 +97,7 @@ spec:
         app.kubernetes.io/instance: ${E2E_RELEASE}
     spec:
       serviceAccountName: ${E2E_RELEASE}
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       securityContext: {}
       containers:
         - name: headlamp
@@ -159,6 +159,7 @@ spec:
 EOF
 
 echo "Waiting for rollout..."
+sleep 2
 kubectl rollout status "deployment/${E2E_RELEASE}" \
   -n "$E2E_NAMESPACE" --timeout=120s