headlamp
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
Compare:
1
# Default values for headlamp.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
# -- Number of desired pods
6
replicaCount: 1
7
image:
8
# -- Container image registry
9
registry: cgr.dev
10
# -- Container image name
11
repository: chainguard-private/headlamp
12
# -- Image pull policy. One of Always, Never, IfNotPresent
13
pullPolicy: IfNotPresent
14
# -- Container image tag, If "" uses appVersion in Chart.yaml
15
tag: 0.45.0@sha256:901badb53ab73d59e2a76a84db0165f68709efad76012afff51eb52b9b0102a4
16
# -- An optional list of references to secrets in the same namespace to use for pulling any of the images used
17
imagePullSecrets: []
18
# -- Overrides the name of the chart
19
nameOverride: ""
20
# -- Overrides the full name of the chart
21
fullnameOverride: ""
22
# -- Override the deployment namespace; defaults to .Release.Namespace
23
namespaceOverride: ""
24
# -- An optional list of init containers to be run before the main containers.
25
initContainers: []
26
# -- An optional list of extra containers to be run along side the main containers.
27
extraContainers: []
28
config:
29
inCluster: true
30
inClusterContextName: "main"
31
# -- base url path at which headlamp should run
32
baseURL: ""
33
# -- session token TTL in seconds (default is 24 hours)
34
sessionTTL: 86400
35
# -- UNSAFE: authenticate every Headlamp user as the pod's service account when running in-cluster.
36
# This disables per-user authentication and is only safe behind an auth proxy (e.g. OIDC proxy).
37
unsafeUseServiceAccountToken: false
38
# -- path to the service account token file.
39
# Only used when unsafeUseServiceAccountToken is true.
40
# Defaults to /var/run/secrets/kubernetes.io/serviceaccount/token when empty.
41
serviceAccountTokenPath: ""
42
oidc:
43
# Option 1:
44
# @param config.oidc.secret - OIDC secret configuration
45
# If you want to use an existing secret, set create to false and provide the name of the secret.
46
# If you want to create a new secret, set create to true and provide the name of the secret.
47
# Also provide the values for clientID, clientSecret, issuerURL, and scopes.
48
# Example:
49
# config:
50
# oidc:
51
# secret:
52
# create: true
53
# name: oidc
54
secret:
55
# -- Generate OIDC secret. If true, will generate a secret using .config.oidc.
56
create: true
57
# -- Name of the OIDC secret.
58
name: oidc
59
# Option 2:
60
# @param config.oidc - OIDC env configuration
61
# If you want to set the OIDC configuration directly, set the following values.
62
# Example:
63
# config:
64
# oidc:
65
# clientID: "clientID"
66
# clientSecret: "clientSecret"
67
# issuerURL: "issuerURL"
68
# scopes: "scopes"
69
70
# -- OIDC client ID
71
clientID: ""
72
# -- OIDC client secret
73
clientSecret: ""
74
# -- OIDC issuer URL
75
issuerURL: ""
76
# -- OIDC scopes to be used
77
scopes: ""
78
# -- OIDC callback URL
79
callbackURL: ""
80
# -- OIDC client to be used during token validation
81
validatorClientID: ""
82
# -- OIDC Issuer URL to be used during token validation
83
validatorIssuerURL: ""
84
# -- Use 'access_token' instead of 'id_token' when authenticating using OIDC
85
useAccessToken: false
86
# -- Use PKCE (Proof Key for Code Exchange) for enhanced security in OIDC flow
87
usePKCE: false
88
# -- Enable using OIDC cookie for authentication outside of cluster
89
useCookie: false
90
# Option 3:
91
# @param config.oidc - External OIDC secret configuration
92
# If you want to use an external secret for OIDC configuration, enable this option.
93
# Provide the name of the secret to use.
94
# Example:
95
# config:
96
# oidc:
97
# secret:
98
# create: false
99
# externalSecret:
100
# enabled: true
101
# name: oidc
102
externalSecret:
103
enabled: false
104
name: ""
105
# -- Set to true if your external secret contains an OIDC_SCOPES key.
106
# When false (default), the -oidc-scopes argument is omitted so that
107
# a missing key does not produce an empty or unresolved argument.
108
hasScopes: false
109
# -- URL to fetch additional user info for the /me endpoint.
110
# For oauth2proxy /oauth2/userinfo can be used. Empty and it will not be used.
111
meUserInfoURL: ""
112
# -- directory to look for plugins
113
pluginsDir: "/headlamp/plugins"
114
# Bundled (static) plugins that ship inside the Headlamp image, such as the
115
# Prometheus plugin (the "Show Prometheus metrics" UI).
116
staticPlugins:
117
# -- Serve the bundled static plugins. Set to false to disable them (e.g. to
118
# hide the "Show Prometheus metrics" button) without relying on internal
119
# image paths; this sets HEADLAMP_STATIC_PLUGINS_DIR to an empty string so the backend skips them.
120
enabled: true
121
enableHelm: false
122
watchPlugins: false
123
# -- Default image to use when creating pod debug containers. If empty, Headlamp uses its built-in default.
124
podDebugImage: ""
125
# -- Default image to use when creating node shell pods. If empty, Headlamp uses its built-in default.
126
nodeShellImage: ""
127
# -- Default namespace to use when creating node shell pods. If empty, Headlamp uses its built-in default.
128
nodeShellNamespace: ""
129
# tlsCertPath: "/headlamp-cert/headlamp-ca.crt"
130
# tlsKeyPath: "/headlamp-cert/headlamp-tls.key"
131
clusterInventory:
132
# -- Enable experimental/alpha Cluster Inventory discovery.
133
enabled: false
134
# -- Experimental/alpha Cluster Inventory access providers config. Required when enabled.
135
accessProvidersConfig: {}
136
# accessProvidersConfig:
137
# providers:
138
# - name: secretreader
139
# execConfig:
140
# apiVersion: client.authentication.k8s.io/v1
141
# command: /access-plugins/secretreader/bin/secretreader-plugin
142
# interactiveMode: Never
143
# provideClusterInfo: true
144
# - name: kubeconfig-secretreader
145
# execConfig:
146
# apiVersion: client.authentication.k8s.io/v1
147
# command: /access-plugins/kubeconfig-secretreader/bin/kubeconfig-secretreader-plugin
148
# interactiveMode: Never
149
# provideClusterInfo: true
150
# plugins[] uses the Kubernetes "image" volume type to mount experimental/alpha access provider binaries.
151
plugins: []
152
# plugins:
153
# - name: secretreader
154
# image: registry.k8s.io/cluster-inventory-api/secretreader:v0.1.3@sha256:ec3090dc166aa2b42fb35d714d161c417d8b27bbc463404c8f615f5f4c610a1d
155
# mountPath: /access-plugins/secretreader
156
# - name: kubeconfig-secretreader
157
# image: registry.k8s.io/cluster-inventory-api/kubeconfig-secretreader:v0.1.3@sha256:b92966cc6e4ac78002a63862921022a71d54956826f6e4febcb7247495eb98c0
158
# mountPath: /access-plugins/kubeconfig-secretreader
159
# -- Kubernetes label selector used to filter experimental/alpha ClusterProfile resources.
160
labelSelector: "!headlamp.dev/ignore"
161
# -- Namespaces watched for experimental/alpha ClusterProfile resources. Empty uses the Headlamp pod namespace for in-cluster roots and the kubeconfig context namespace for kubeconfig roots; ["*"] watches all and requires equivalent cluster-wide RBAC permissions.
162
namespaces: []
163
# -- Override the experimental/alpha Cluster Inventory root reconcile interval. Empty uses the Headlamp default.
164
rootReconcileInterval: ""
165
# -- Override the experimental/alpha Cluster Inventory no-CRD cache TTL. Empty uses the Headlamp default.
166
noCRDCacheTTL: ""
167
# Extra arguments that can be given to the container. See charts/headlamp/README.md for more information.
168
extraArgs: []
169
# -- An optional list of environment variables
170
# env:
171
# - name: KUBERNETES_SERVICE_HOST
172
# value: "localhost"
173
# - name: KUBERNETES_SERVICE_PORT
174
# value: "6443"
175
176
# -- Mount Service Account token in pod
177
automountServiceAccountToken: true
178
serviceAccount:
179
# -- Specifies whether a service account should be created
180
create: true
181
# -- Annotations to add to the service account
182
annotations: {}
183
# -- The name of the service account to use.(If not set and create is true, a name is generated using the fullname template)
184
name: ""
185
clusterRoleBinding:
186
# -- Specified whether a cluster role binding should be created
187
create: true
188
# -- Set name of the Cluster Role with limited permissions from you cluster
189
# for example - clusterRoleName: user-ro
190
clusterRoleName: cluster-admin
191
# -- Annotations to add to the cluster role binding
192
annotations: {}
193
# -- Annotations to add to the deployment
194
deploymentAnnotations: {}
195
# -- Annotations to add to the pod
196
podAnnotations: {}
197
# -- Labels to add to the pod
198
podLabels: {}
199
# -- Controls user namespace isolation for the Headlamp pod.
200
# When true (default), the pod shares the host user namespace (user namespaces are DISABLED).
201
# When false, the pod uses a separate user namespace (user namespaces are ENABLED) for stronger isolation,
202
# if supported by the cluster. Set this to false if your cluster supports user namespaces and you want
203
# additional isolation; leave as true if user namespaces are not available.
204
# See: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/
205
hostUsers: true
206
# -- Headlamp pod's Security Context
207
podSecurityContext: {}
208
# fsGroup: 2000
209
210
# -- Headlamp containers Security Context
211
# When readOnlyRootFilesystem: true is set, the chart automatically adds a
212
# writable emptyDir volume named "headlamp-tmp" mounted at /tmp so the
213
# application can write temporary files.
214
# You can override this behavior in two ways:
215
# 1. Supply your own volumeMount with mountPath: /tmp — the chart will skip
216
# adding both the automatic mount and the automatic volume.
217
# 2. Supply your own volume named "headlamp-tmp" (e.g. to set sizeLimit) —
218
# the chart will skip creating the volume but will still add the /tmp mount
219
# pointing to your volume.
220
securityContext:
221
# capabilities:
222
# drop:
223
# - ALL
224
# readOnlyRootFilesystem: true
225
runAsNonRoot: true
226
privileged: false
227
runAsUser: 100
228
runAsGroup: 101
229
# Uses these defaults if this is empty.
230
# allowPrivilegeEscalation: false
231
# runAsNonRoot: true
232
# seccompProfile:
233
# type: RuntimeDefault
234
# capabilities:
235
# drop:
236
# - ALL
237
238
service:
239
# -- Annotations to add to the service
240
annotations: {}
241
# -- Kubernetes Service type
242
type: ClusterIP
243
# -- Kubernetes Service port
244
port: 80
245
# -- Kubernetes Service port appProtocol (for the main http port)
246
appProtocol: null
247
# -- Kubernetes Service clusterIP
248
clusterIP: ""
249
# -- Kubernetes Service loadBalancerIP
250
loadBalancerIP: ""
251
# -- Kubernetes Service loadBalancerSourceRanges
252
loadBalancerSourceRanges: []
253
# -- Kubernetes Service Nodeport
254
nodePort: null
255
# -- Additional ports to expose on the Service in addition to the default
256
# http port. Each entry must have a unique `name` and a `port`. `targetPort`
257
# defaults to `port` when omitted. `nodePort` is only honored when
258
# `service.type` is `NodePort` or `LoadBalancer`. A matching containerPort
259
# must be provided by the user (e.g. via a sidecar) for traffic to actually
260
# be routed.
261
extraServicePorts: []
262
# - name: extra
263
# port: 9090
264
# targetPort: extra
265
# protocol: TCP
266
# nodePort: null
267
# -- Headlamp containers volume mounts
268
volumeMounts: []
269
# -- Headlamp pod's volumes
270
volumes: []
271
persistentVolumeClaim:
272
# -- Enable Persistent Volume Claim
273
enabled: false
274
# -- Annotations to add to the persistent volume claim (if enabled)
275
annotations: {}
276
# -- accessModes for the persistent volume claim, eg: ReadWriteOnce, ReadOnlyMany, ReadWriteMany etc.
277
accessModes: []
278
# -- size of the persistent volume claim, eg: 10Gi. Required if enabled is true.
279
size: ""
280
# -- storageClassName for the persistent volume claim.
281
storageClassName: ""
282
# -- selector for the persistent volume claim.
283
selector: {}
284
# -- volumeMode for the persistent volume claim, eg: Filesystem, Block.
285
volumeMode: ""
286
ingress:
287
# -- Enable ingress controller resource
288
enabled: false
289
# -- Annotations for Ingress resource
290
annotations: {}
291
# kubernetes.io/tls-acme: "true"
292
293
# -- Additional labels to add to the Ingress resource
294
labels: {}
295
# app.kubernetes.io/part-of: traefik
296
# environment: prod
297
298
# -- Ingress class name. replacement for the deprecated "kubernetes.io/ingress.class" annotation
299
ingressClassName: ""
300
# -- Hostname(s) for the Ingress resource
301
# Please refer to https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec for more information.
302
# Each path may optionally specify `backend.service.{name,port}` to override
303
# the default Headlamp Service / `service.port`. `name` supports `tpl` so
304
# values like `{{ .Release.Name }}-extra` can be used. `port` accepts either
305
# `number` or `name` (matching `service.extraServicePorts[].name`).
306
hosts: []
307
# - host: chart-example.local
308
# paths:
309
# - path: /
310
# type: ImplementationSpecific
311
# - path: /extra
312
# type: ImplementationSpecific
313
# backend:
314
# service:
315
# port:
316
# name: extra
317
# -- Ingress TLS configuration
318
tls: []
319
# - secretName: chart-example-tls
320
# hosts:
321
# - chart-example.local
322
# HTTPRoute configuration for Gateway API
323
# Please refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRoute
324
httpRoute:
325
# -- Enable HTTPRoute resource for Gateway API
326
enabled: false
327
# -- Annotations for HTTPRoute resource
328
annotations: {}
329
# -- Additional labels for HTTPRoute resource
330
labels: {}
331
# -- Parent references (REQUIRED when enabled - HTTPRoute will not work without this)
332
# Example:
333
# parentRefs:
334
# - name: my-gateway
335
# namespace: gateway-namespace
336
parentRefs: []
337
# -- Hostnames for the HTTPRoute
338
# Example:
339
# hostnames:
340
# - headlamp.example.com
341
hostnames: []
342
# -- Custom routing rules (optional, defaults to path prefix /)
343
# If not specified, a default rule routing all traffic to the service is used
344
rules: []
345
# Example custom rules:
346
# rules:
347
# - matches:
348
# - path:
349
# type: PathPrefix
350
# value: /headlamp
351
# backendRefs:
352
# - name: "{{ .Release.Name }}-headlamp"
353
# port: 80
354
# -- CPU/Memory resource requests/limits
355
resources: {}
356
# We usually recommend not to specify default resources and to leave this as a conscious
357
# choice for the user. This also increases chances charts run on environments with little
358
# resources, such as Minikube. If you do want to specify resources, uncomment the following
359
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
360
# limits:
361
# cpu: 100m
362
# memory: 128Mi
363
# requests:
364
# cpu: 100m
365
# memory: 128Mi
366
367
# -- Node labels for pod assignment
368
nodeSelector: {}
369
# -- Toleration labels for pod assignment
370
tolerations: []
371
# -- Affinity settings for pod assignment
372
affinity: {}
373
# -- Host aliases to add to the pod's /etc/hosts file
374
hostAliases: []
375
# -- Topology Spread Constraints for pod assignment
376
topologySpreadConstraints: []
377
# - maxSkew: 1
378
# topologyKey: topology.kubernetes.io/zone
379
# whenUnsatisfiable: ScheduleAnyway
380
# matchLabelKeys:
381
# - pod-template-hash
382
# - maxSkew: 1
383
# topologyKey: kubernetes.io/hostname
384
# whenUnsatisfiable: DoNotSchedule
385
# matchLabelKeys:
386
# - pod-template-hash
387
388
# -- Pod priority class
389
priorityClassName: ""
390
# Probe configuration for liveness and readiness checks
391
probes:
392
# -- Scheme to use for liveness and readiness probes (HTTP or HTTPS).
393
# Set to HTTPS when TLS is enabled at the backend server.
394
scheme: HTTP
395
livenessProbe:
396
# -- Initial delay in seconds before starting liveness probe
397
initialDelaySeconds: 0
398
# -- Period in seconds between liveness probe checks
399
periodSeconds: 10
400
# -- Timeout in seconds for liveness probe
401
timeoutSeconds: 1
402
# -- Minimum consecutive successes for the probe to be considered successful (must be 1 for liveness probes per Kubernetes API)
403
successThreshold: 1
404
# -- Minimum consecutive failures for the probe to be considered failed
405
failureThreshold: 3
406
readinessProbe:
407
# -- Initial delay in seconds before starting readiness probe
408
initialDelaySeconds: 0
409
# -- Period in seconds between readiness probe checks
410
periodSeconds: 10
411
# -- Timeout in seconds for readiness probe
412
timeoutSeconds: 1
413
# -- Minimum consecutive successes for the probe to be considered successful
414
successThreshold: 1
415
# -- Minimum consecutive failures for the probe to be considered failed
416
failureThreshold: 3
417
# Plugin Manager Sidecar Container Configuration
418
pluginsManager:
419
# -- Enable plugin manager
420
enabled: false
421
# -- Plugin configuration file name
422
configFile: "plugin.yml"
423
# -- Plugin configuration content in YAML format. This is required if plugins.enabled is true.
424
configContent: ""
425
# -- Base node image to use
426
baseImage: cgr.dev/chainguard-private/node:26.8.1@sha256:55274c10b40f743cc6dab4960d8348730d4f050fbb8cdd57fea8df3dea09ce5c
427
# -- Headlamp plugin package version to install
428
version: latest
429
# -- Plugin manager containers volume mounts
430
volumeMounts: []
431
# -- Plugin manager env variable configuration
432
# env:
433
# - name: HTTPS_PROXY
434
# value: "proxy.example.com:8080"
435
# -- Specify resrouces
436
# resources:
437
# requests:
438
# cpu: "500m"
439
# memory: "2048Mi"
440
# limits:
441
# cpu: "1000m"
442
# memory: "4096Mi"
443
# If omitted, the plugin manager will inherit the global securityContext.
444
# When readOnlyRootFilesystem: true is active (set here or inherited), the
445
# chart automatically adds a writable emptyDir volume named
446
# "headlamp-plugins-tmp" mounted at /tmp in the plugin manager container.
447
# Override behavior mirrors the main container: supply your own /tmp
448
# volumeMount to skip both, or supply your own "headlamp-plugins-tmp" volume
449
# (e.g. to set sizeLimit) to have the chart only add the mount.
450
securityContext: {}
451
# runAsUser: 1001
452
# runAsNonRoot: true
453
# allowPrivilegeEscalation: false
454
# readOnlyRootFilesystem: true
455
# capabilities:
456
# drop:
457
# - ALL
458
podDisruptionBudget:
459
# -- enable PodDisruptionBudget
460
# ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
461
enabled: false
462
# @schema
463
# type: [null, integer, string]
464
# @schema
465
# -- Minimum number/percentage of pods that should remain scheduled.
466
# When it's set, maxUnavailable must be disabled by `maxUnavailable: null`
467
minAvailable: 0
468
# @schema
469
# type: [null, integer, string]
470
# @schema
471
# -- Maximum number/percentage of pods that may be made unavailable
472
maxUnavailable: null
473
# @schema
474
# type: [null, string]
475
# @schema
476
# -- How are unhealthy, but running, pods counted for eviction
477
unhealthyPodEvictionPolicy: null
478
# -- Additional Kubernetes manifests to be deployed. Include the manifest as nested YAML.
479
extraManifests: []
480
# - |
481
# apiVersion: v1
482
# kind: ConfigMap
483
# metadata:
484
# name: my-config
485
# data:
486
# key: value
487
# - |
488
# apiVersion: v1
489
# kind: ConfigMap
490
# metadata:
491
# name: my-config-too
492
# data:
493
# key: value
494
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.