chore: migrate E2E namespace default from privilegedescalation-dev to headlamp-dev

Part of the org-wide Headlamp namespace migration (PRI-340). Updates the default E2E_NAMESPACE in deploy and teardown scripts to match the new headlamp-dev namespace. The shared workflow (e2e.yaml) already passes headlamp-dev via the e2e-namespace input. Co-Authored-By: Paperclip <noreply@paperclip.ing>
fix: add elliptic override for GHSA-848j-6mx2-7j84 (#70 )
2026-05-08 16:51:02 +00:00 · 2026-05-06 00:44:24 +00:00 · 2026-05-06 00:44:14 +00:00 · 2026-05-06 00:44:06 +00:00
5 changed files with 18916 additions and 9 deletions
@@ -0,0 +1,23 @@
+name: E2E Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  e2e:
+    uses: privilegedescalation/.github/.github/workflows/plugin-e2e.yaml@main
+    with:
+      node-version: "22"
+      headlamp-version: v0.40.1
+      e2e-namespace: headlamp-dev
@@ -53,7 +53,8 @@
    "tar": "^7.5.11",
    "undici": "^7.24.3",
    "vite": ">=6.4.2",
-    "lodash": ">=4.18.0"
+    "lodash": ">=4.18.0",
+    "elliptic": ">=6.6.1"
  },
  "dependencies": {
    "node-forge": "^1.4.0"
@@ -5,16 +5,18 @@
 # a ConfigMap volume mount. No custom Docker images — the plugin is built
 # in CI and injected as a ConfigMap.
 #
-# E2E resources are deployed to the `privilegedescalation-dev` namespace. Nothing
+# E2E resources are deployed to the `headlamp-dev` namespace. Nothing
 # persists beyond the test run — teardown cleans up all created resources.
 #
 # Prerequisites:
 #   - Plugin built (dist/ exists with plugin-main.js + package.json)
 #   - kubectl configured with cluster access
-#   - RBAC applied: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml
+# RBAC is managed via Flux from privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml.
+# The infra repo is the source of truth — do not apply this file directly.
+# Apply RBAC first: kubectl apply -f privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml
 #
 # Environment:
-#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: privilegedescalation-dev)
+#   E2E_NAMESPACE     — namespace for E2E Headlamp (default: headlamp-dev)
 #   E2E_RELEASE       — release/resource name prefix (default: headlamp-e2e)
 #   HEADLAMP_VERSION  — Headlamp image tag (default: latest)
 set -euo pipefail
@@ -22,7 +24,7 @@ set -euo pipefail
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 DIST_DIR="$REPO_ROOT/dist"

-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"
 HEADLAMP_VERSION="${HEADLAMP_VERSION:-latest}"

@@ -35,7 +37,7 @@ fi
 echo "Checking RBAC permissions in namespace '${E2E_NAMESPACE}'..."
 if ! kubectl auth can-i delete configmaps -n "$E2E_NAMESPACE" --quiet 2>/dev/null; then
  echo "ERROR: Missing RBAC — cannot delete configmaps in namespace '${E2E_NAMESPACE}'." >&2
-  echo "  Apply RBAC first: kubectl apply -f deployment/e2e-ci-runner-rbac.yaml" >&2
+  echo "  Apply RBAC first: kubectl apply -f privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml" >&2
  exit 1
 fi

@@ -97,7 +99,7 @@ spec:
        app.kubernetes.io/instance: ${E2E_RELEASE}
    spec:
      serviceAccountName: ${E2E_RELEASE}
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
      securityContext: {}
      containers:
        - name: headlamp
@@ -159,6 +161,7 @@ spec:
 EOF

 echo "Waiting for rollout..."
+sleep 2
 kubectl rollout status "deployment/${E2E_RELEASE}" \
  -n "$E2E_NAMESPACE" --timeout=120s

@@ -3,14 +3,17 @@
 #
 # Tears down the dedicated E2E Headlamp instance deployed by deploy-e2e-headlamp.sh.
 #
+# RBAC is managed via Flux from privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml.
+# The infra repo is the source of truth — do not apply this file directly.
+#
 # Environment:
-#   E2E_NAMESPACE  — namespace to clean up (default: privilegedescalation-dev)
+#   E2E_NAMESPACE  — namespace to clean up (default: headlamp-dev)
 #   E2E_RELEASE    — release/resource name prefix (default: headlamp-e2e)
 set -euo pipefail

 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"

-E2E_NAMESPACE="${E2E_NAMESPACE:-privilegedescalation-dev}"
+E2E_NAMESPACE="${E2E_NAMESPACE:-headlamp-dev}"
 E2E_RELEASE="${E2E_RELEASE:-headlamp-e2e}"

 echo "=== E2E Headlamp Teardown ==="
Author	SHA1	Message	Date
Chris Farhood	576735c168	chore: migrate E2E namespace default from privilegedescalation-dev to headlamp-dev Part of the org-wide Headlamp namespace migration (PRI-340). Updates the default E2E_NAMESPACE in deploy and teardown scripts to match the new headlamp-dev namespace. The shared workflow (e2e.yaml) already passes headlamp-dev via the e2e-namespace input. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-08 16:51:02 +00:00
privilegedescalation-engineer[bot]	84c947ed69	fix: add elliptic override for GHSA-848j-6mx2-7j84 (#70 ) Add pnpm.overrides.elliptic to prevent version regression on the transitive elliptic vulnerability (CVE-2025-14505). Vulnerability path: @kinvolk/headlamp-plugin → vite-plugin-node-polyfills → node-stdlib-browser → crypto-browserify → browserify-sign → elliptic Note: pnpm audit will still report the vulnerability until upstream publishes elliptic 6.6.2+. This override safeguards against pulling a worse version. Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-06 00:44:24 +00:00
privilegedescalation-engineer[bot]	e212e601a9	Reference shared infra RBAC (PRI-750) (#68 ) * Regenerate lockfile for lodash+vite overrides Co-Authored-By: Paperclip <noreply@paperclip.ing> * fix: add markdownlint config to resolve CI failures - Add .markdownlint-cli2.jsonc with 18 rule disables appropriate for plugin docs - Add .markdownlintignore to skip generated API reference docs - Fix remaining errors with --fix Co-Authored-By: Paperclip <noreply@paperclip.ing> * Reference shared infra RBAC in deployment scripts PRI-750: update plugin repos to reference shared infra RBAC (PRI-695 follow-up) - scripts/deploy-e2e-headlamp.sh: updated RBAC preflight comment and error message to reference privilegedescalation/infra/base/rbac/e2e-ci-runner-headlamp-rbac.yaml - scripts/teardown-e2e-headlamp.sh: added RBAC reference comment Infra RBAC is the source of truth managed by Flux GitOps. No E2E workflow exists yet for this plugin. --------- Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-06 00:44:14 +00:00
privilegedescalation-engineer[bot]	e6920dcba4	fix(e2e): add E2E workflow for sealed-secrets plugin (#67 ) * fix(e2e): add E2E workflow for headlamp-sealed-secrets-plugin Adds .github/workflows/e2e.yaml calling the shared plugin-e2e.yaml reusable workflow. Fixes PRI-729: E2E DNS failure caused by missing E2E workflow in this repo. Co-Authored-By: Paperclip <noreply@paperclip.ing> * fix(e2e): reference @main workflow after .github merge Update workflow_call ref from hugh/add-pnpm-support-plugin-e2e to main now that .github#144 has merged. Co-Authored-By: Paperclip <noreply@paperclip.ing> * fix(e2e): use pnpm-capable workflow branch Reference @hugh/add-pnpm-support-plugin-e2e which has pnpm support via corepack. PRI-634 * fix(e2e): reference @main workflow after .github merge Co-Authored-By: Paperclip <noreply@paperclip.ing> * fix(e2e): disable automount SA token to avoid kubelet fetch race Kubelet tries to fetch SA token immediately after deployment creates the pod, but the SA may not be propagated yet. Setting automountServiceAccountToken: false avoids this race. The SA token is not needed since E2E tests authenticate via HEADLAMP_TOKEN passed as env var. --------- Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-06 00:44:06 +00:00