headlamp

# Default values for headlamp.

# This is a YAML-formatted file.

# Declare variables to be passed into your templates.

# -- Number of desired pods

replicaCount: 1

image:

# -- Container image registry

registry: cgr.dev

# -- Container image name

repository: chainguard-private/headlamp-fips

# -- Image pull policy. One of Always, Never, IfNotPresent

pullPolicy: IfNotPresent

# -- Container image tag, If "" uses appVersion in Chart.yaml

tag: 0.46.0-r1@sha256:c43d89a8de34674fcf0877b8772259e20ef878dbccf1a57df1deee14322a829f

# -- An optional list of references to secrets in the same namespace to use for pulling any of the images used

imagePullSecrets: []

# -- Overrides the name of the chart

nameOverride: ""

# -- Overrides the full name of the chart

fullnameOverride: ""

# -- Override the deployment namespace; defaults to .Release.Namespace

namespaceOverride: ""

# -- An optional list of init containers to be run before the main containers.

initContainers: []

# -- An optional list of extra containers to be run along side the main containers.

extraContainers: []

config:

inCluster: true

inClusterContextName: "main"

# -- base url path at which headlamp should run

baseURL: ""

# -- session token TTL in seconds (default is 24 hours)

sessionTTL: 86400

# -- UNSAFE: authenticate every Headlamp user as the pod's service account when running in-cluster.

# This disables per-user authentication and is only safe behind an auth proxy (e.g. OIDC proxy).

unsafeUseServiceAccountToken: false

# -- path to the service account token file.

# Only used when unsafeUseServiceAccountToken is true.

# Defaults to /var/run/secrets/kubernetes.io/serviceaccount/token when empty.

serviceAccountTokenPath: ""

oidc:

# Option 1:

# @param config.oidc.secret - OIDC secret configuration

# If you want to use an existing secret, set create to false and provide the name of the secret.

# If you want to create a new secret, set create to true and provide the name of the secret.

# Also provide the values for clientID, clientSecret, issuerURL, and scopes.

# Example:

# config:

# oidc:

# secret:

# create: true

# name: oidc

secret:

# -- Generate OIDC secret. If true, will generate a secret using .config.oidc.

create: true

# -- Name of the OIDC secret.

name: oidc

# Option 2:

# @param config.oidc - OIDC env configuration

# If you want to set the OIDC configuration directly, set the following values.

# Example:

# config:

# oidc:

# clientID: "clientID"

# clientSecret: "clientSecret"

# issuerURL: "issuerURL"

# scopes: "scopes"

# -- OIDC client ID

clientID: ""

# -- OIDC client secret

clientSecret: ""

# -- OIDC issuer URL

issuerURL: ""

# -- OIDC scopes to be used

scopes: ""

# -- OIDC callback URL

callbackURL: ""

# -- OIDC client to be used during token validation

validatorClientID: ""

# -- OIDC Issuer URL to be used during token validation

validatorIssuerURL: ""

# -- Use 'access_token' instead of 'id_token' when authenticating using OIDC

useAccessToken: false

# -- Use PKCE (Proof Key for Code Exchange) for enhanced security in OIDC flow

usePKCE: false

# -- Enable using OIDC cookie for authentication outside of cluster

useCookie: false

# -- Enable automatic redirect to the OIDC provider

autoLogin: false

# Option 3:

# @param config.oidc - External OIDC secret configuration

# If you want to use an external secret for OIDC configuration, enable this option.

# Provide the name of the secret to use.

# Example:

# config:

# oidc:

# secret:

# create: false

# externalSecret:

# enabled: true

# name: oidc

externalSecret:

enabled: false

name: ""

# -- Set to true if your external secret contains an OIDC_SCOPES key.

# When false (default), the -oidc-scopes argument is omitted so that

# a missing key does not produce an empty or unresolved argument.

hasScopes: false

# -- URL to fetch additional user info for the /me endpoint.

# For oauth2proxy /oauth2/userinfo can be used. Empty and it will not be used.

meUserInfoURL: ""

# -- directory to look for plugins

pluginsDir: "/headlamp/plugins"

# Bundled (static) plugins that ship inside the Headlamp image, such as the

# Prometheus plugin (the "Show Prometheus metrics" UI).

staticPlugins:

# -- Serve the bundled static plugins. Set to false to disable them (e.g. to

# hide the "Show Prometheus metrics" button) without relying on internal

# image paths; this sets HEADLAMP_STATIC_PLUGINS_DIR to an empty string so the backend skips them.

enabled: true

enableHelm: false

watchPlugins: false

# -- Default image to use when creating pod debug containers. If empty, Headlamp uses its built-in default.

podDebugImage: ""

# -- Default image to use when creating node shell pods. If empty, Headlamp uses its built-in default.

nodeShellImage: ""

# -- Default namespace to use when creating node shell pods. If empty, Headlamp uses its built-in default.

nodeShellNamespace: ""

# tlsCertPath: "/headlamp-cert/headlamp-ca.crt"

# tlsKeyPath: "/headlamp-cert/headlamp-tls.key"

clusterInventory:

# -- Enable experimental/alpha Cluster Inventory discovery.

enabled: false

# -- Experimental/alpha Cluster Inventory access providers config. Required when enabled.

accessProvidersConfig: {}

# accessProvidersConfig:

# providers:

# - name: secretreader

# execConfig:

# apiVersion: client.authentication.k8s.io/v1

# command: /access-plugins/secretreader/bin/secretreader-plugin

# interactiveMode: Never

# provideClusterInfo: true

# - name: kubeconfig-secretreader

# execConfig:

# apiVersion: client.authentication.k8s.io/v1

# command: /access-plugins/kubeconfig-secretreader/bin/kubeconfig-secretreader-plugin

# interactiveMode: Never

# provideClusterInfo: true

# plugins[] uses the Kubernetes "image" volume type to mount experimental/alpha access provider binaries.

plugins: []

# plugins:

# - name: secretreader

# image: registry.k8s.io/cluster-inventory-api/secretreader:v0.1.3@sha256:ec3090dc166aa2b42fb35d714d161c417d8b27bbc463404c8f615f5f4c610a1d

# mountPath: /access-plugins/secretreader

# - name: kubeconfig-secretreader

# image: registry.k8s.io/cluster-inventory-api/kubeconfig-secretreader:v0.1.3@sha256:b92966cc6e4ac78002a63862921022a71d54956826f6e4febcb7247495eb98c0

# mountPath: /access-plugins/kubeconfig-secretreader

# -- Kubernetes label selector used to filter experimental/alpha ClusterProfile resources.

labelSelector: "!headlamp.dev/ignore"

# -- Namespaces watched for experimental/alpha ClusterProfile resources. Empty uses the Headlamp pod namespace for in-cluster roots and the kubeconfig context namespace for kubeconfig roots; ["*"] watches all and requires equivalent cluster-wide RBAC permissions.

namespaces: []

# -- Override the experimental/alpha Cluster Inventory root reconcile interval. Empty uses the Headlamp default.

rootReconcileInterval: ""

# -- Override the experimental/alpha Cluster Inventory no-CRD cache TTL. Empty uses the Headlamp default.

noCRDCacheTTL: ""

# Extra arguments that can be given to the container. See charts/headlamp/README.md for more information.

extraArgs: []

# -- An optional list of environment variables

# env:

# - name: KUBERNETES_SERVICE_HOST

# value: "localhost"

# - name: KUBERNETES_SERVICE_PORT

# value: "6443"

# -- Mount Service Account token in pod

automountServiceAccountToken: true

serviceAccount:

# -- Specifies whether a service account should be created

create: true

# -- Annotations to add to the service account

annotations: {}

# -- The name of the service account to use.(If not set and create is true, a name is generated using the fullname template)

name: ""

clusterRoleBinding:

# -- Specified whether a cluster role binding should be created

create: true

# -- Set name of the Cluster Role with limited permissions from you cluster

# for example - clusterRoleName: user-ro

clusterRoleName: cluster-admin

# -- Annotations to add to the cluster role binding

annotations: {}

# -- Annotations to add to the deployment

deploymentAnnotations: {}

# -- Annotations to add to the pod

podAnnotations: {}

# -- Labels to add to the pod

podLabels: {}

# -- Controls user namespace isolation for the Headlamp pod.

# When true (default), the pod shares the host user namespace (user namespaces are DISABLED).

# When false, the pod uses a separate user namespace (user namespaces are ENABLED) for stronger isolation,

# if supported by the cluster. Set this to false if your cluster supports user namespaces and you want

# additional isolation; leave as true if user namespaces are not available.

# See: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/

hostUsers: true

# -- Headlamp pod's Security Context

podSecurityContext: {}

# fsGroup: 2000

# -- Headlamp containers Security Context

# When readOnlyRootFilesystem: true is set, the chart automatically adds a

# writable emptyDir volume named "headlamp-tmp" mounted at /tmp so the

# application can write temporary files.

# You can override this behavior in two ways:

# 1. Supply your own volumeMount with mountPath: /tmp — the chart will skip

# adding both the automatic mount and the automatic volume.

# 2. Supply your own volume named "headlamp-tmp" (e.g. to set sizeLimit) —

# the chart will skip creating the volume but will still add the /tmp mount

# pointing to your volume.

securityContext:

# capabilities:

# drop:

# - ALL

# readOnlyRootFilesystem: true

runAsNonRoot: true

privileged: false

runAsUser: 100

runAsGroup: 101

# Uses these defaults if this is empty.

# allowPrivilegeEscalation: false

# runAsNonRoot: true

# seccompProfile:

# type: RuntimeDefault

# capabilities:

# drop:

# - ALL

service:

# -- Annotations to add to the service

annotations: {}

# -- Kubernetes Service type

type: ClusterIP

# -- Kubernetes Service port

port: 80

# -- Kubernetes Service port appProtocol (for the main http port)

appProtocol: null

# -- Kubernetes Service clusterIP

clusterIP: ""

# -- Kubernetes Service loadBalancerIP

loadBalancerIP: ""

# -- Kubernetes Service loadBalancerSourceRanges

loadBalancerSourceRanges: []

# -- Kubernetes Service Nodeport

nodePort: null

# -- Additional ports to expose on the Service in addition to the default

# http port. Each entry must have a unique `name` and a `port`. `targetPort`

# defaults to `port` when omitted. `nodePort` is only honored when

# `service.type` is `NodePort` or `LoadBalancer`. A matching containerPort

# must be provided by the user (e.g. via a sidecar) for traffic to actually

# be routed.

extraServicePorts: []

# - name: extra

# port: 9090

# targetPort: extra

# protocol: TCP

# nodePort: null

# -- Headlamp containers volume mounts

volumeMounts: []

# -- Headlamp pod's volumes

volumes: []

persistentVolumeClaim:

# -- Enable Persistent Volume Claim

enabled: false

# -- Annotations to add to the persistent volume claim (if enabled)

annotations: {}

# -- accessModes for the persistent volume claim, eg: ReadWriteOnce, ReadOnlyMany, ReadWriteMany etc.

accessModes: []

# -- size of the persistent volume claim, eg: 10Gi. Required if enabled is true.

size: ""

# -- storageClassName for the persistent volume claim.

storageClassName: ""

# -- selector for the persistent volume claim.

selector: {}

# -- volumeMode for the persistent volume claim, eg: Filesystem, Block.

volumeMode: ""

ingress:

# -- Enable ingress controller resource

enabled: false

# -- Annotations for Ingress resource

annotations: {}

# kubernetes.io/tls-acme: "true"

# -- Additional labels to add to the Ingress resource

labels: {}

# app.kubernetes.io/part-of: traefik

# environment: prod

# -- Ingress class name. replacement for the deprecated "kubernetes.io/ingress.class" annotation

ingressClassName: ""

# -- Hostname(s) for the Ingress resource

# Please refer to https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec for more information.

# Each path may optionally specify `backend.service.{name,port}` to override

# the default Headlamp Service / `service.port`. `name` supports `tpl` so

# values like `{{ .Release.Name }}-extra` can be used. `port` accepts either

# `number` or `name` (matching `service.extraServicePorts[].name`).

hosts: []

# - host: chart-example.local

# paths:

# - path: /

# type: ImplementationSpecific

# - path: /extra

# type: ImplementationSpecific

# backend:

# service:

# port:

# name: extra

# -- Ingress TLS configuration

tls: []

# - secretName: chart-example-tls

# hosts:

# - chart-example.local

# HTTPRoute configuration for Gateway API

# Please refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRoute

httpRoute:

# -- Enable HTTPRoute resource for Gateway API

enabled: false

# -- Annotations for HTTPRoute resource

annotations: {}

# -- Additional labels for HTTPRoute resource

labels: {}

# -- Parent references (REQUIRED when enabled - HTTPRoute will not work without this)

# Example:

# parentRefs:

# - name: my-gateway

# namespace: gateway-namespace

parentRefs: []

# -- Hostnames for the HTTPRoute

# Example:

# hostnames:

# - headlamp.example.com

hostnames: []

# -- Custom routing rules (optional, defaults to path prefix /)

# If not specified, a default rule routing all traffic to the service is used

rules: []

# Example custom rules:

# rules:

# - matches:

# - path:

# type: PathPrefix

# value: /headlamp

# backendRefs:

# - name: "{{ .Release.Name }}-headlamp"

# port: 80

# -- CPU/Memory resource requests/limits

resources: {}

# We usually recommend not to specify default resources and to leave this as a conscious

# choice for the user. This also increases chances charts run on environments with little

# resources, such as Minikube. If you do want to specify resources, uncomment the following

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

# -- Node labels for pod assignment

nodeSelector: {}

# -- Toleration labels for pod assignment

tolerations: []

# -- Affinity settings for pod assignment

affinity: {}

# -- Host aliases to add to the pod's /etc/hosts file

hostAliases: []

# -- Topology Spread Constraints for pod assignment

topologySpreadConstraints: []

# - maxSkew: 1

# topologyKey: topology.kubernetes.io/zone

# whenUnsatisfiable: ScheduleAnyway

# matchLabelKeys:

# - pod-template-hash

# - maxSkew: 1

# topologyKey: kubernetes.io/hostname

# whenUnsatisfiable: DoNotSchedule

# matchLabelKeys:

# - pod-template-hash

# -- Pod priority class

priorityClassName: ""

# Probe configuration for liveness and readiness checks

probes:

# -- Scheme to use for liveness and readiness probes (HTTP or HTTPS).

# Set to HTTPS when TLS is enabled at the backend server.

scheme: HTTP

livenessProbe:

# -- Initial delay in seconds before starting liveness probe

initialDelaySeconds: 0

# -- Period in seconds between liveness probe checks

periodSeconds: 10

# -- Timeout in seconds for liveness probe

timeoutSeconds: 1

# -- Minimum consecutive successes for the probe to be considered successful (must be 1 for liveness probes per Kubernetes API)

successThreshold: 1

# -- Minimum consecutive failures for the probe to be considered failed

failureThreshold: 3

readinessProbe:

# -- Initial delay in seconds before starting readiness probe

initialDelaySeconds: 0

# -- Period in seconds between readiness probe checks

periodSeconds: 10

# -- Timeout in seconds for readiness probe

timeoutSeconds: 1

# -- Minimum consecutive successes for the probe to be considered successful

successThreshold: 1

# -- Minimum consecutive failures for the probe to be considered failed

failureThreshold: 3

# Plugin Manager Sidecar Container Configuration

pluginsManager:

# -- Enable plugin manager

enabled: false

# -- Plugin configuration file name

configFile: "plugin.yml"

# -- Plugin configuration content in YAML format. This is required if plugins.enabled is true.

configContent: ""

# -- Base node image to use

baseImage: cgr.dev/chainguard-private/node-fips:v26.12.1-r2@sha256:df295ee3f519602b6e50c36f67573c838cebb15c592cfce024a2fc3da58b0c05

# -- Headlamp plugin package version to install

version: latest

# -- Plugin manager containers volume mounts

volumeMounts: []

# -- Plugin manager env variable configuration

# env:

# - name: HTTPS_PROXY

# value: "proxy.example.com:8080"

# -- Specify resrouces

# resources:

# requests:

# cpu: "500m"

# memory: "2048Mi"

# limits:

# cpu: "1000m"

# memory: "4096Mi"

# If omitted, the plugin manager will inherit the global securityContext.

# When readOnlyRootFilesystem: true is active (set here or inherited), the

# chart automatically adds a writable emptyDir volume named

# "headlamp-plugins-tmp" mounted at /tmp in the plugin manager container.

# Override behavior mirrors the main container: supply your own /tmp

# volumeMount to skip both, or supply your own "headlamp-plugins-tmp" volume

# (e.g. to set sizeLimit) to have the chart only add the mount.

securityContext: {}

# runAsUser: 1001

# runAsNonRoot: true

# allowPrivilegeEscalation: false

# readOnlyRootFilesystem: true

# capabilities:

# drop:

# - ALL

podDisruptionBudget:

# -- enable PodDisruptionBudget

# ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/

enabled: false

# @schema

# type: [null, integer, string]

# @schema

# -- Minimum number/percentage of pods that should remain scheduled.

# When it's set, maxUnavailable must be disabled by `maxUnavailable: null`

minAvailable: 0

# @schema

# type: [null, integer, string]

# @schema

# -- Maximum number/percentage of pods that may be made unavailable

maxUnavailable: null

# @schema

# type: [null, string]

# @schema

# -- How are unhealthy, but running, pods counted for eviction

unhealthyPodEvictionPolicy: null

# -- Additional Kubernetes manifests to be deployed. Include the manifest as nested YAML.

extraManifests: []

# - |

# apiVersion: v1

# kind: ConfigMap

# metadata:

# name: my-config

# data:

# key: value

# - |

# apiVersion: v1

# kind: ConfigMap

# metadata:

# name: my-config-too

# data:

# key: value