mshriver started a thread (https://redhat-internal.slack.com/archives/CCRND57FW/p1706537311976019) w/ app-sre requesting higher privileges in the namespace they run their stage-post-deploy test jobs in.

His team moved their IQE jobs to run on the appsres05ue1 cluster. Previously they ran the jobs on the crcs cluster, but this cluster lacks access to things that can only be reached while inside the red hat corp network (such as console.stage.redhat.com). The appsres05ue1 cluster has proper access.  (Updated cluster from original, we're on appsres05ue1)

However, since app-sre runs production deploy workflows from this cluster they do not want to grant high level access to it.

We are thinking the path forward here may be for teams to start running stage post-deploy jobs on a consoledot-owned cluster.

If we can get one of our clusters to have access to stage.redhat.com (and other internal stuff) then teams could deploy their test runner pods there. We could carve out a namespace where teams deploy their IQE pods to and we could grant them higher access rights to the namespace so they can monitor/debug the tests fully.

Example SAAS for an IQE pod using the container-debug entrypoint:
https://gitlab.cee.redhat.com/service/app-interface/-/blob/master/data/services/insights/host-inventory/testing-integration-debug-container.yml

And the namespace where this job runs:
https://gitlab.cee.redhat.com/service/app-interface/-/blob/master/data/services/insights/host-inventory/namespaces/host-inventory-stage-testing.appsres05ue1.yml