Merge branch 'main' into patch-2

Author: onedr0p

.github/scripts/generate-release-issue-body.js

@@ -0,0 +1,202 @@
+#!/usr/bin/env node
+
+/*
+ * Copyright 2025 The Kubernetes Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * Generate the release coordination issue body or release notes template
+ * Usage:
+ *   node generate-release-issue-body.js issue <releaseName> <prevTag> <author>
+ *   node generate-release-issue-body.js release-notes
+ */
+
+const mode = process.argv[2];
+
+if (mode === 'release-notes') {
+  const releaseNotesTemplate = `## ✨ Enhancements:
+* Feature 1
+* Feature 2
+
+## 🐞 Bug fixes
+* Fix 1
+* Fix 2
+
+## 💻 Development
+* Development experience related change 1
+* Development experience related change 2
+
+## 📖 Documentation
+* Docs change 1
+* Docs change 2`;
+
+  console.log(releaseNotesTemplate);
+  process.exit(0);
+}
+
+if (mode !== 'issue') {
+  console.error('Usage:');
+  console.error('  node generate-release-issue-body.js issue <releaseName> <prevTag> <author>');
+  console.error('  node generate-release-issue-body.js release-notes');
+  process.exit(1);
+}
+
+const releaseName = process.argv[3];
+const prevTag = process.argv[4];
+const author = process.argv[5];
+
+if (!releaseName || !prevTag || !author) {
+  console.error('Usage: node generate-release-issue-body.js issue <releaseName> <prevTag> <author>');
+  process.exit(1);
+}
+
+const testBattery = `# Release testing
+
+NOTE: the release isn't frozen yet for testing.
+
+Please write a comment if you're going to test an item and if you've completed testing an item.
+
+- [ ] **Test web sockets**
+  - Run the app in static server mode (\`./backend/headlamp-server -static-html-dir ./frontend/build...\`)
+  - Open the pods list view
+  - Delete a pod using kubectl
+  - Verify that the list reflects the changes
+
+- [ ] **App: Run with plugins**
+  - Build app with plugins: \`make && make app\`
+  - Run the app (UI should load in less than 1 minute)
+  - Verify plugins are present: App Catalog, Prometheus, App Catalog
+
+- [ ] **App: Test Prometheus plugin**
+  - Run the app
+  - Go to the Pods page and choose a pod
+  - Verify the Prometheus plugin shows at the top and displays correctly
+
+- [ ] **Image: Test Prometheus plugin**
+  - Run headlamp from image
+  - Go to the Pods page and choose a pod
+  - Verify the Prometheus plugin shows at the top and displays correctly
+
+- [ ] **App: Test Plugin Catalog**
+  - Run the app
+  - Verify the Plugin Catalog sidebar item is available and open it
+  - Verify plugins appear from ArtifactHub
+  - Install a plugin
+  - Verify the plugin shows as installed
+  - Delete the plugin
+  - Verify the plugin shows as available to install
+
+- [ ] **Test creating a resource through edit button**
+  - Open Headlamp via app or image
+  - Choose a cluster where you have admin rights
+  - Click Create (bottom left), add a resource (e.g., ConfigMap), and apply
+  - Verify the resource is created
+
+- [ ] **Check Workloads page**
+  - Open Headlamp via app or image
+  - Go to the Workloads page of a cluster with diverse resource types
+  - Verify resources and top charts display correctly
+
+- [ ] **Check cluster renaming**
+  - Open Headlamp via app or image
+  - Open cluster settings
+  - Rename the cluster
+  - Verify the cluster name changed
+  - Reload the app
+  - Verify the new name persists
+
+- [ ] **App: Check running on Mac**
+  - Open app on Mac
+  - Verify it loaded in less than 30 seconds
+
+- [ ] **App: Check running on Windows**
+  - Open app on Windows
+  - Verify it loaded in less than 30 seconds
+
+- [ ] **App: Check running on Linux**
+  - Open app on Linux
+  - Verify it loaded in less than 30 seconds
+
+- [ ] **App: Load more than one cluster**
+  - Open app
+  - Add a new cluster from a kubeconfig file
+  - Add another cluster from another kubeconfig file
+
+- [ ] **Flatpak: Install a plugin**
+  - Install a plugin from the app catalog
+  - Verify it doesn't fail on cross-device linking
+
+- [ ] **App: Load kubeconfig with context != cluster name**
+  - Open app
+  - Click Add Cluster
+  - Choose a kubeconfig where a cluster name differs from the context name
+  - Verify the cluster loads successfully
+
+- [ ] **Allowed Namespaces**
+  - Open Headlamp in any flavor
+  - Configure allowed namespaces in cluster settings
+  - Verify views honor allowed namespaces
+  - Verify the map honors allowed namespaces
+
+- [ ] **Create resources in the intended cluster**
+  - Reproduce: "Create dialog doesn't update cluster when it's changed" (Issue #2441)
+  - Verify resource creation targets the intended cluster
+
+- [ ] **Check these plugins have settings**
+  - Build a new app
+  - Go to Settings > Plugins
+  - Click each plugin to verify settings render
+  - Plugins: Prometheus, App catalog, Plugin catalog
+`;
+
+const releaseNotesTemplate = `## Release Notes
+
+Please fill in the release notes below in the following format and then copy them to the release draft:
+
+### ✨ Enhancements:
+* Feature 1
+* Feature 2
+
+### 🐞 Bug fixes
+* Fix 1
+* Fix 2
+
+### 💻 Development
+* Development experience related change 1
+* Development experience related change 2
+
+### 📖 Documentation
+* Docs change 1
+* Docs change 2
+`;
+
+const issueBody = `${testBattery}
+
+---
+
+## Changelog
+
+@${author}, please run the following command to generate the changelog and paste it here:
+
+\`\`\`bash
+git log --oneline --cherry --topo-order ${prevTag}..HEAD
+\`\`\`
+
+---
+
+${releaseNotesTemplate}
+`;
+
+console.log(issueBody);

.github/workflows/app-artifacts-embedded.yml

@@ -0,0 +1,66 @@
+name: Build and upload embedded binaries
+
+on:
+  workflow_dispatch:
+    inputs:
+      buildBranch:
+        description: 'Headlamp ref/branch/tag'
+        required: true
+        default: 'main'
+      version:
+        description: 'Version for the binaries (defaults to app/package.json version)'
+        required: false
+        default: ''
+
+permissions:
+  contents: read
+
+jobs:
+  build-embedded:
+    permissions:
+      actions: write # needed to upload artifacts
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      with:
+        ref: ${{ github.event.inputs.buildBranch }}
+    - name: Setup nodejs
+      uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+      with:
+        node-version: 20.x
+        cache: 'npm'
+        cache-dependency-path: |
+          frontend/package-lock.json
+    - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      with:
+        go-version: '1.24.*'
+        cache-dependency-path: |
+          backend/go.sum
+    - name: Get version
+      id: get-version
+      run: |
+        if [ -n "${{ github.event.inputs.version }}" ]; then
+          VERSION="${{ github.event.inputs.version }}"
+        else
+          VERSION=$(node -p "require('./app/package.json').version")
+        fi
+        echo "version=$VERSION" >> $GITHUB_OUTPUT
+        echo "Building embedded binaries with version: $VERSION"
+    - name: Build frontend
+      run: |
+        make frontend
+    - name: Prepare backend for embedding
+      run: |
+        make backend-embed-prepare
+    - name: Build embedded binaries
+      run: |
+        make backend-embed-all-compressed VERSION=${{ steps.get-version.outputs.version }}
+    - name: Upload embedded binaries
+      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      with:
+        name: embedded-binaries
+        path: ./backend/dist/*.tar.gz
+        if-no-files-found: error
+        retention-days: 2
+

.github/workflows/backend-test.yml

@@ -76,6 +76,10 @@ jobs:
           rm ~/.config/Headlamp/kubeconfigs/config
         shell: bash
 
+      - name: Run fuzz tests
+        run: npm run backend:fuzz
+        shell: bash
+
       - name: Upload coverage report as artifact
         id: upload-artifact
         uses: actions/upload-artifact@84480863f228bb9747b473957fcc9e309aa96097 # v4.4.2

.github/workflows/build-container.yml

@@ -122,10 +122,13 @@ jobs:
         cd ../../
         ls -laR .plugins
     - name: Remove unnecessary files
-      if: steps.cache-image-restore2.outputs.cache-hit != 'true'
       run: |
         sudo rm -rf /usr/share/dotnet
         sudo rm -rf "$AGENT_TOOLSDIRECTORY"
+        sudo rm -rf /usr/local/lib/android
+        sudo rm -rf /opt/ghc
+        sudo rm -rf /usr/share/swift
+        sudo apt-get clean
     - name: Build image
       if: steps.cache-image-restore2.outputs.cache-hit != 'true'
       run: |
@@ -137,8 +140,12 @@ jobs:
     - name: Import images to kind
       run: |
         export SHELL=/bin/bash
+        # Load images into Cluster 1 (test)
         kind load docker-image ghcr.io/headlamp-k8s/headlamp-plugins-test:latest --name test
         kind load docker-image ghcr.io/headlamp-k8s/headlamp:latest --name test
+
+        # Load Headlamp image into Cluster 2 (test2) so it can run in-cluster tests there
+        kind load docker-image ghcr.io/headlamp-k8s/headlamp:latest --name test2
     - name: Test .plugins folder
       if: steps.cache-image-restore2.outputs.cache-hit != 'true'
       run: |
@@ -231,6 +238,70 @@ jobs:
         else
           echo "Playwright tests passed successfully"
         fi
+    - name: Deploy Headlamp in in-cluster mode and run TS API tests
+      run: |
+        # Reuse Cluster 2 context for in-cluster tests
+        kubectl config use-context test2
+
+        # Setup service account and RBAC for Headlamp
+        kubectl create serviceaccount headlamp --namespace kube-system || true
+        kubectl create clusterrolebinding headlamp --serviceaccount=kube-system:headlamp --clusterrole=cluster-admin || true
+        kubectl get serviceaccount headlamp -n kube-system
+
+        # Deploy Headlamp with in-cluster mode
+        kubectl apply -f e2e-tests/kubernetes-headlamp-incluster-ci.yaml
+
+        echo "Waiting for headlamp deployment to be available (in-cluster)..."
+        kubectl wait deployment -n kube-system headlamp --for condition=Available=True --timeout=120s
+        kubectl get pods -n kube-system -l app.kubernetes.io/name=headlamp
+
+        echo "Checking headlamp pod status (in-cluster)..."
+        kubectl logs -n kube-system -l app.kubernetes.io/name=headlamp --tail=50 || true
+
+        # Start port-forward in background
+        echo "Starting port-forward to headlamp service (in-cluster)..."
+        kubectl port-forward -n kube-system service/headlamp 8080:80 &
+        PORT_FORWARD_PID=$!
+
+        # Wait for port-forward to be ready
+        sleep 5
+
+        # Verify port-forward is working
+        if ! kill -0 $PORT_FORWARD_PID 2>/dev/null; then
+          echo "❌ Port-forward failed to start for in-cluster test"
+          exit 1
+        fi
+
+        export HEADLAMP_TEST_URL="http://localhost:8080"
+        echo "In-cluster Headlamp URL: $HEADLAMP_TEST_URL"
+
+        # Get service account token for API checks
+        echo "Getting service account token for in-cluster test..."
+        export HEADLAMP_SA_TOKEN=$(kubectl create token headlamp --duration=1h -n kube-system)
+
+        if [ -z "$HEADLAMP_SA_TOKEN" ]; then
+          echo "❌ Failed to get service account token for in-cluster test"
+          kill $PORT_FORWARD_PID 2>/dev/null || true
+          exit 1
+        fi
+
+        echo "✅ Service account token obtained"
+        echo "Running in-cluster API Playwright tests..."
+
+        # Run the TypeScript in-cluster API tests
+        cd e2e-tests
+        npm ci
+        npx playwright install --with-deps
+        npx playwright test tests/incluster-api.spec.ts
+        EXIT_CODE=$?
+
+        # Cleanup port-forward
+        kill $PORT_FORWARD_PID 2>/dev/null || true
+
+        if [ $EXIT_CODE -ne 0 ]; then
+          echo "❌ In-cluster API tests failed with exit code $EXIT_CODE"
+          exit $EXIT_CODE
+        fi
     # Clear disk space by removing unnecessary files, apt files and uninstall some playwright dependencies
     - name: Clear Disk Space
       if: steps.cache-image-restore2.outputs.cache-hit != 'true'