headlamp
Helm chart
Request a free trial
Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.
Tag:
1
# Default values for headlamp.
2
# This is a YAML-formatted file.
3
# Declare variables to be passed into your templates.
4
5
# -- Number of desired pods
6
replicaCount: 1
7
image:
8
# -- Container image registry
9
registry: cgr.dev
10
# -- Container image name
11
repository: chainguard-private/headlamp-fips
12
# -- Image pull policy. One of Always, Never, IfNotPresent
13
pullPolicy: IfNotPresent
14
# -- Container image tag, If "" uses appVersion in Chart.yaml
15
tag: latest@sha256:de44524b792e75025352aa7ccc4ec2223813c891af8796599ee246da89f9834b
16
# -- An optional list of references to secrets in the same namespace to use for pulling any of the images used
17
imagePullSecrets: []
18
# -- Overrides the name of the chart
19
nameOverride: ""
20
# -- Overrides the full name of the chart
21
fullnameOverride: ""
22
# -- Override the deployment namespace; defaults to .Release.Namespace
23
namespaceOverride: ""
24
# -- An optional list of init containers to be run before the main containers.
25
initContainers: []
26
# -- An optional list of extra containers to be run along side the main containers.
27
extraContainers: []
28
config:
29
inCluster: true
30
inClusterContextName: "main"
31
# -- base url path at which headlamp should run
32
baseURL: ""
33
# -- session token TTL in seconds (default is 24 hours)
34
sessionTTL: 86400
35
# -- UNSAFE: authenticate every Headlamp user as the pod's service account when running in-cluster.
36
# This disables per-user authentication and is only safe behind an auth proxy (e.g. OIDC proxy).
37
unsafeUseServiceAccountToken: false
38
# -- path to the service account token file.
39
# Only used when unsafeUseServiceAccountToken is true.
40
# Defaults to /var/run/secrets/kubernetes.io/serviceaccount/token when empty.
41
serviceAccountTokenPath: ""
42
oidc:
43
# Option 1:
44
# @param config.oidc.secret - OIDC secret configuration
45
# If you want to use an existing secret, set create to false and provide the name of the secret.
46
# If you want to create a new secret, set create to true and provide the name of the secret.
47
# Also provide the values for clientID, clientSecret, issuerURL, and scopes.
48
# Example:
49
# config:
50
# oidc:
51
# secret:
52
# create: true
53
# name: oidc
54
secret:
55
# -- Generate OIDC secret. If true, will generate a secret using .config.oidc.
56
create: true
57
# -- Name of the OIDC secret.
58
name: oidc
59
# Option 2:
60
# @param config.oidc - OIDC env configuration
61
# If you want to set the OIDC configuration directly, set the following values.
62
# Example:
63
# config:
64
# oidc:
65
# clientID: "clientID"
66
# clientSecret: "clientSecret"
67
# issuerURL: "issuerURL"
68
# scopes: "scopes"
69
70
# -- OIDC client ID
71
clientID: ""
72
# -- OIDC client secret
73
clientSecret: ""
74
# -- OIDC issuer URL
75
issuerURL: ""
76
# -- OIDC scopes to be used
77
scopes: ""
78
# -- OIDC callback URL
79
callbackURL: ""
80
# -- OIDC client to be used during token validation
81
validatorClientID: ""
82
# -- OIDC Issuer URL to be used during token validation
83
validatorIssuerURL: ""
84
# -- Use 'access_token' instead of 'id_token' when authenticating using OIDC
85
useAccessToken: false
86
# -- Use PKCE (Proof Key for Code Exchange) for enhanced security in OIDC flow
87
usePKCE: false
88
# -- Enable using OIDC cookie for authentication outside of cluster
89
useCookie: false
90
# Option 3:
91
# @param config.oidc - External OIDC secret configuration
92
# If you want to use an external secret for OIDC configuration, enable this option.
93
# Provide the name of the secret to use.
94
# Example:
95
# config:
96
# oidc:
97
# secret:
98
# create: false
99
# externalSecret:
100
# enabled: true
101
# name: oidc
102
externalSecret:
103
enabled: false
104
name: ""
105
# -- Set to true if your external secret contains an OIDC_SCOPES key.
106
# When false (default), the -oidc-scopes argument is omitted so that
107
# a missing key does not produce an empty or unresolved argument.
108
hasScopes: false
109
# -- URL to fetch additional user info for the /me endpoint.
110
# For oauth2proxy /oauth2/userinfo can be used. Empty and it will not be used.
111
meUserInfoURL: ""
112
# -- directory to look for plugins
113
pluginsDir: "/headlamp/plugins"
114
# Bundled (static) plugins that ship inside the Headlamp image, such as the
115
# Prometheus plugin (the "Show Prometheus metrics" UI).
116
staticPlugins:
117
# -- Serve the bundled static plugins. Set to false to disable them (e.g. to
118
# hide the "Show Prometheus metrics" button) without relying on internal
119
# image paths; this sets HEADLAMP_STATIC_PLUGINS_DIR to an empty string so the backend skips them.
120
enabled: true
121
enableHelm: false
122
watchPlugins: false
123
# -- Default image to use when creating pod debug containers. If empty, Headlamp uses its built-in default.
124
podDebugImage: ""
125
# -- Default image to use when creating node shell pods. If empty, Headlamp uses its built-in default.
126
nodeShellImage: ""
127
# -- Default namespace to use when creating node shell pods. If empty, Headlamp uses its built-in default.
128
nodeShellNamespace: ""
129
# tlsCertPath: "/headlamp-cert/headlamp-ca.crt"
130
# tlsKeyPath: "/headlamp-cert/headlamp-tls.key"
131
clusterInventory:
132
# -- Enable experimental/alpha Cluster Inventory discovery.
133
enabled: false
134
# -- Experimental/alpha Cluster Inventory access providers config. Required when enabled.
135
accessProvidersConfig: {}
136
# accessProvidersConfig:
137
# providers:
138
# - name: secretreader
139
# execConfig:
140
# apiVersion: client.authentication.k8s.io/v1
141
# command: /access-plugins/secretreader/bin/secretreader-plugin
142
# interactiveMode: Never
143
# provideClusterInfo: true
144
# - name: kubeconfig-secretreader
145
# execConfig:
146
# apiVersion: client.authentication.k8s.io/v1
147
# command: /access-plugins/kubeconfig-secretreader/bin/kubeconfig-secretreader-plugin
148
# interactiveMode: Never
149
# provideClusterInfo: true
150
# plugins[] uses the Kubernetes "image" volume type to mount experimental/alpha access provider binaries.
151
plugins: []
152
# plugins:
153
# - name: secretreader
154
# image: registry.k8s.io/cluster-inventory-api/secretreader:v0.1.3@sha256:ec3090dc166aa2b42fb35d714d161c417d8b27bbc463404c8f615f5f4c610a1d
155
# mountPath: /access-plugins/secretreader
156
# - name: kubeconfig-secretreader
157
# image: registry.k8s.io/cluster-inventory-api/kubeconfig-secretreader:v0.1.3@sha256:b92966cc6e4ac78002a63862921022a71d54956826f6e4febcb7247495eb98c0
158
# mountPath: /access-plugins/kubeconfig-secretreader
159
# -- Kubernetes label selector used to filter experimental/alpha ClusterProfile resources.
160
labelSelector: "!headlamp.dev/ignore"
161
# -- Override the experimental/alpha Cluster Inventory root reconcile interval. Empty uses the Headlamp default.
162
rootReconcileInterval: ""
163
# -- Override the experimental/alpha Cluster Inventory no-CRD cache TTL. Empty uses the Headlamp default.
164
noCRDCacheTTL: ""
165
# Extra arguments that can be given to the container. See charts/headlamp/README.md for more information.
166
extraArgs: []
167
# -- An optional list of environment variables
168
# env:
169
# - name: KUBERNETES_SERVICE_HOST
170
# value: "localhost"
171
# - name: KUBERNETES_SERVICE_PORT
172
# value: "6443"
173
174
# -- Mount Service Account token in pod
175
automountServiceAccountToken: true
176
serviceAccount:
177
# -- Specifies whether a service account should be created
178
create: true
179
# -- Annotations to add to the service account
180
annotations: {}
181
# -- The name of the service account to use.(If not set and create is true, a name is generated using the fullname template)
182
name: ""
183
clusterRoleBinding:
184
# -- Specified whether a cluster role binding should be created
185
create: true
186
# -- Set name of the Cluster Role with limited permissions from you cluster
187
# for example - clusterRoleName: user-ro
188
clusterRoleName: cluster-admin
189
# -- Annotations to add to the cluster role binding
190
annotations: {}
191
# -- Annotations to add to the deployment
192
deploymentAnnotations: {}
193
# -- Annotations to add to the pod
194
podAnnotations: {}
195
# -- Labels to add to the pod
196
podLabels: {}
197
# -- Controls user namespace isolation for the Headlamp pod.
198
# When true (default), the pod shares the host user namespace (user namespaces are DISABLED).
199
# When false, the pod uses a separate user namespace (user namespaces are ENABLED) for stronger isolation,
200
# if supported by the cluster. Set this to false if your cluster supports user namespaces and you want
201
# additional isolation; leave as true if user namespaces are not available.
202
# See: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/
203
hostUsers: true
204
# -- Headlamp pod's Security Context
205
podSecurityContext: {}
206
# fsGroup: 2000
207
208
# -- Headlamp containers Security Context
209
# When readOnlyRootFilesystem: true is set, the chart automatically adds a
210
# writable emptyDir volume named "headlamp-tmp" mounted at /tmp so the
211
# application can write temporary files.
212
# You can override this behavior in two ways:
213
# 1. Supply your own volumeMount with mountPath: /tmp — the chart will skip
214
# adding both the automatic mount and the automatic volume.
215
# 2. Supply your own volume named "headlamp-tmp" (e.g. to set sizeLimit) —
216
# the chart will skip creating the volume but will still add the /tmp mount
217
# pointing to your volume.
218
securityContext:
219
# capabilities:
220
# drop:
221
# - ALL
222
# readOnlyRootFilesystem: true
223
runAsNonRoot: true
224
privileged: false
225
runAsUser: 100
226
runAsGroup: 101
227
# Uses these defaults if this is empty.
228
# allowPrivilegeEscalation: false
229
# runAsNonRoot: true
230
# seccompProfile:
231
# type: RuntimeDefault
232
# capabilities:
233
# drop:
234
# - ALL
235
236
service:
237
# -- Annotations to add to the service
238
annotations: {}
239
# -- Kubernetes Service type
240
type: ClusterIP
241
# -- Kubernetes Service port
242
port: 80
243
# -- Kubernetes Service port appProtocol (for the main http port)
244
appProtocol: null
245
# -- Kubernetes Service clusterIP
246
clusterIP: ""
247
# -- Kubernetes Service loadBalancerIP
248
loadBalancerIP: ""
249
# -- Kubernetes Service loadBalancerSourceRanges
250
loadBalancerSourceRanges: []
251
# -- Kubernetes Service Nodeport
252
nodePort: null
253
# -- Additional ports to expose on the Service in addition to the default
254
# http port. Each entry must have a unique `name` and a `port`. `targetPort`
255
# defaults to `port` when omitted. `nodePort` is only honored when
256
# `service.type` is `NodePort` or `LoadBalancer`. A matching containerPort
257
# must be provided by the user (e.g. via a sidecar) for traffic to actually
258
# be routed.
259
extraServicePorts: []
260
# - name: extra
261
# port: 9090
262
# targetPort: extra
263
# protocol: TCP
264
# nodePort: null
265
# -- Headlamp containers volume mounts
266
volumeMounts: []
267
# -- Headlamp pod's volumes
268
volumes: []
269
persistentVolumeClaim:
270
# -- Enable Persistent Volume Claim
271
enabled: false
272
# -- Annotations to add to the persistent volume claim (if enabled)
273
annotations: {}
274
# -- accessModes for the persistent volume claim, eg: ReadWriteOnce, ReadOnlyMany, ReadWriteMany etc.
275
accessModes: []
276
# -- size of the persistent volume claim, eg: 10Gi. Required if enabled is true.
277
size: ""
278
# -- storageClassName for the persistent volume claim.
279
storageClassName: ""
280
# -- selector for the persistent volume claim.
281
selector: {}
282
# -- volumeMode for the persistent volume claim, eg: Filesystem, Block.
283
volumeMode: ""
284
ingress:
285
# -- Enable ingress controller resource
286
enabled: false
287
# -- Annotations for Ingress resource
288
annotations: {}
289
# kubernetes.io/tls-acme: "true"
290
291
# -- Additional labels to add to the Ingress resource
292
labels: {}
293
# app.kubernetes.io/part-of: traefik
294
# environment: prod
295
296
# -- Ingress class name. replacement for the deprecated "kubernetes.io/ingress.class" annotation
297
ingressClassName: ""
298
# -- Hostname(s) for the Ingress resource
299
# Please refer to https://kubernetes.io/docs/reference/kubernetes-api/service-resources/ingress-v1/#IngressSpec for more information.
300
# Each path may optionally specify `backend.service.{name,port}` to override
301
# the default Headlamp Service / `service.port`. `name` supports `tpl` so
302
# values like `{{ .Release.Name }}-extra` can be used. `port` accepts either
303
# `number` or `name` (matching `service.extraServicePorts[].name`).
304
hosts: []
305
# - host: chart-example.local
306
# paths:
307
# - path: /
308
# type: ImplementationSpecific
309
# - path: /extra
310
# type: ImplementationSpecific
311
# backend:
312
# service:
313
# port:
314
# name: extra
315
# -- Ingress TLS configuration
316
tls: []
317
# - secretName: chart-example-tls
318
# hosts:
319
# - chart-example.local
320
# HTTPRoute configuration for Gateway API
321
# Please refer to https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRoute
322
httpRoute:
323
# -- Enable HTTPRoute resource for Gateway API
324
enabled: false
325
# -- Annotations for HTTPRoute resource
326
annotations: {}
327
# -- Additional labels for HTTPRoute resource
328
labels: {}
329
# -- Parent references (REQUIRED when enabled - HTTPRoute will not work without this)
330
# Example:
331
# parentRefs:
332
# - name: my-gateway
333
# namespace: gateway-namespace
334
parentRefs: []
335
# -- Hostnames for the HTTPRoute
336
# Example:
337
# hostnames:
338
# - headlamp.example.com
339
hostnames: []
340
# -- Custom routing rules (optional, defaults to path prefix /)
341
# If not specified, a default rule routing all traffic to the service is used
342
rules: []
343
# Example custom rules:
344
# rules:
345
# - matches:
346
# - path:
347
# type: PathPrefix
348
# value: /headlamp
349
# backendRefs:
350
# - name: "{{ .Release.Name }}-headlamp"
351
# port: 80
352
# -- CPU/Memory resource requests/limits
353
resources: {}
354
# We usually recommend not to specify default resources and to leave this as a conscious
355
# choice for the user. This also increases chances charts run on environments with little
356
# resources, such as Minikube. If you do want to specify resources, uncomment the following
357
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
358
# limits:
359
# cpu: 100m
360
# memory: 128Mi
361
# requests:
362
# cpu: 100m
363
# memory: 128Mi
364
365
# -- Node labels for pod assignment
366
nodeSelector: {}
367
# -- Toleration labels for pod assignment
368
tolerations: []
369
# -- Affinity settings for pod assignment
370
affinity: {}
371
# -- Host aliases to add to the pod's /etc/hosts file
372
hostAliases: []
373
# -- Topology Spread Constraints for pod assignment
374
topologySpreadConstraints: []
375
# - maxSkew: 1
376
# topologyKey: topology.kubernetes.io/zone
377
# whenUnsatisfiable: ScheduleAnyway
378
# matchLabelKeys:
379
# - pod-template-hash
380
# - maxSkew: 1
381
# topologyKey: kubernetes.io/hostname
382
# whenUnsatisfiable: DoNotSchedule
383
# matchLabelKeys:
384
# - pod-template-hash
385
386
# -- Pod priority class
387
priorityClassName: ""
388
# Probe configuration for liveness and readiness checks
389
probes:
390
# -- Scheme to use for liveness and readiness probes (HTTP or HTTPS).
391
# Set to HTTPS when TLS is enabled at the backend server.
392
scheme: HTTP
393
livenessProbe:
394
# -- Initial delay in seconds before starting liveness probe
395
initialDelaySeconds: 0
396
# -- Period in seconds between liveness probe checks
397
periodSeconds: 10
398
# -- Timeout in seconds for liveness probe
399
timeoutSeconds: 1
400
# -- Minimum consecutive successes for the probe to be considered successful (must be 1 for liveness probes per Kubernetes API)
401
successThreshold: 1
402
# -- Minimum consecutive failures for the probe to be considered failed
403
failureThreshold: 3
404
readinessProbe:
405
# -- Initial delay in seconds before starting readiness probe
406
initialDelaySeconds: 0
407
# -- Period in seconds between readiness probe checks
408
periodSeconds: 10
409
# -- Timeout in seconds for readiness probe
410
timeoutSeconds: 1
411
# -- Minimum consecutive successes for the probe to be considered successful
412
successThreshold: 1
413
# -- Minimum consecutive failures for the probe to be considered failed
414
failureThreshold: 3
415
# Plugin Manager Sidecar Container Configuration
416
pluginsManager:
417
# -- Enable plugin manager
418
enabled: false
419
# -- Plugin configuration file name
420
configFile: "plugin.yml"
421
# -- Plugin configuration content in YAML format. This is required if plugins.enabled is true.
422
configContent: ""
423
# -- Base node image to use
424
baseImage: cgr.dev/chainguard-private/node-fips:latest@sha256:caef145f1755968bc8f6b9d8bfff88331822f18af557a2f695566e190e347cc9
425
# -- Headlamp plugin package version to install
426
version: latest
427
# -- Plugin manager containers volume mounts
428
volumeMounts: []
429
# -- Plugin manager env variable configuration
430
# env:
431
# - name: HTTPS_PROXY
432
# value: "proxy.example.com:8080"
433
# -- Specify resrouces
434
# resources:
435
# requests:
436
# cpu: "500m"
437
# memory: "2048Mi"
438
# limits:
439
# cpu: "1000m"
440
# memory: "4096Mi"
441
# If omitted, the plugin manager will inherit the global securityContext.
442
# When readOnlyRootFilesystem: true is active (set here or inherited), the
443
# chart automatically adds a writable emptyDir volume named
444
# "headlamp-plugins-tmp" mounted at /tmp in the plugin manager container.
445
# Override behavior mirrors the main container: supply your own /tmp
446
# volumeMount to skip both, or supply your own "headlamp-plugins-tmp" volume
447
# (e.g. to set sizeLimit) to have the chart only add the mount.
448
securityContext: {}
449
# runAsUser: 1001
450
# runAsNonRoot: true
451
# allowPrivilegeEscalation: false
452
# readOnlyRootFilesystem: true
453
# capabilities:
454
# drop:
455
# - ALL
456
podDisruptionBudget:
457
# -- enable PodDisruptionBudget
458
# ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
459
enabled: false
460
# @schema
461
# type: [null, integer, string]
462
# @schema
463
# -- Minimum number/percentage of pods that should remain scheduled.
464
# When it's set, maxUnavailable must be disabled by `maxUnavailable: null`
465
minAvailable: 0
466
# @schema
467
# type: [null, integer, string]
468
# @schema
469
# -- Maximum number/percentage of pods that may be made unavailable
470
maxUnavailable: null
471
# @schema
472
# type: [null, string]
473
# @schema
474
# -- How are unhealthy, but running, pods counted for eviction
475
unhealthyPodEvictionPolicy: null
476
# -- Additional Kubernetes manifests to be deployed. Include the manifest as nested YAML.
477
extraManifests: []
478
# - |
479
# apiVersion: v1
480
# kind: ConfigMap
481
# metadata:
482
# name: my-config
483
# data:
484
# key: value
485
# - |
486
# apiVersion: v1
487
# kind: ConfigMap
488
# metadata:
489
# name: my-config-too
490
# data:
491
# key: value
492
The trusted source for open source
Talk to an expertProduct
Customers
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.