Headlamp¶
Headlamp is a Kubernetes web interface. This package wraps the upstream Headlamp chart and adds Big Bang integration for routing, network policy, monitoring, and optional OpenID Connect (OIDC) authentication.
For application features, plugins, and the complete upstream configuration surface, see the Headlamp documentation and the versioned upstream values.
Configuration¶
When deployed directly, configure this chart through its Big Bang-owned values
and the upstream passthrough parent. The upstream section is passed to the
versioned upstream Headlamp chart; see the upstream values link above rather
than copying individual upstream settings into this guide.
When Big Bang deploys Headlamp as a built-in package, configure it at
packages.headlamp with packageConfiguration.version: v1. Existing Big Bang
3.x configurations can continue to use the legacy addons.headlamp path.
Headlamp is disabled by default.
The umbrella selects the Headlamp namespace and package source, configures its
route through the selected Istio gateway, and supplies package values. The
package route targets the headlamp-headlamp Service on port 4466. Set the
package ingress.gateway value in the umbrella configuration to select a
different Big Bang gateway.
Access control and OIDC¶
Headlamp access is a security boundary. Review the upstream chart’s default
service-account binding and configure least-privilege Kubernetes RBAC before
making the UI available to users. This chart can create ClusterRole and
ClusterRoleBinding resources through bigbang.rbac; see the
RBAC guide for the supported value shape and access-model guidance.
Big Bang can enable OIDC for Headlamp through the umbrella package’s sso
settings. When enabled, the umbrella supplies the configured client ID and SSO
issuer URL, enables PKCE, creates the required package secret when credentials
are provided, and permits outbound access to the SSO host. Authentication alone
does not grant Kubernetes permissions: the API server and Kubernetes RBAC must
be configured for the identity and group claims used by the deployment. See the
OIDC and Keycloak guide for the integration boundary and
operator considerations.
Network, mesh, and monitoring integration¶
The chart uses bb-common for routes, Istio resources, and network policies.
With network policies enabled, Headlamp is allowed to reach the Kubernetes API;
the umbrella additionally enables SSO egress when OIDC is enabled. bb-common is
consumed as a subchart, so its configuration lives under the package’s
bb-common key. Add only required external destinations through
bb-common.networkPolicies and bb-common.routes, following the
bb-common network-policy and routing documentation.
When Istio is enabled, Big Bang configures the package for mesh integration. The umbrella can also add monitoring ingress for the Prometheus blackbox exporter when metric scraping is enabled. Configure Headlamp’s monitoring settings through the package values; the umbrella controls cross-package monitoring and mesh ordering.
Operations¶
Use the package’s generated README for the documented Big Bang value entry points and the development and maintenance guide for package maintainer validation and upgrade procedures. The guide is for maintainers; it is not an end-user deployment runbook.
This chart includes a wait Job and optional UI, script, and SSO test resources. Rendering or enabling those resources does not validate browser behavior, identity-provider claims, or a cluster’s effective RBAC. Validate those boundaries in an appropriate disposable integration environment.