A common use-case for any Kubernetes web UI is to deploy it in-cluster and set up an ingress server for having it available to users.
We maintain a simple/vanilla file for setting up a Headlamp deployment and service. Be sure to review it and change anything you need.
If you’re happy with the options in the this deployment file, and assuming
you have a running Kubernetes cluster and your
kubeconfig pointing to it,
you can run:
kubectl apply -f https://raw.githubusercontent.com/kinvolk/headlamp/master/kubernetes-headlamp.yaml
With this, the Headlamp service should be running, but you still need the ingress server as mentioned. We provide an example sample ingress yaml file for this purpose, but you have to manually replace the URL placeholder with the desired URL (the ingress file also assumes that you have contour and a cert-manager set up, but if you don’t then you’ll just not have TLS).
Assuming your URL is
headlamp.mydeployment.io, getting the sample ingress
file and changing the URL can quickly be done by:
curl -s https://raw.githubusercontent.com/kinvolk/headlamp/master/kubernetes-headlamp-ingress-sample.yaml | sed -e s/__URL__/headlamp.mydeployment.io/ > headlamp-ingress.yaml
and with that, you’ll have a configured ingress file, so verify it and apply it:
kubectl apply -f ./headlamp-ingress.yaml
Accessing using OIDC
Headlamp supports OIDC for cluster users to effortlessly log in using a “Sign in” button.
For OIDC to be used, Headlamp needs to know how to configure it, so you have to provide the different OIDC-related arguments to Headlamp from your OIDC provider. Those are:
- the client ID:
- the client secret:
- the issuer URL:
- (optionally) the OpenId scopes:
and you have to tell the OIDC provider about the callback URL, which in Headlamp it is your URL + the
/oidc-callback path, e.g.:
Besides the mandatory openid scope, Headlamp also requests the optional
profile and email
Scopes can be overridden by using the
-oidc-scopes option. Remember to
include the default ones if you need them when using that option.
For example, if you need to keep the default scopes and add Github’s
then add them all to the option:
Note: Before Headlamp 0.3.0, a scope groups was also included, as it’s used by Dex and other services, but since it’s not part of the default spec, it was removed in the mentioned version.
Example: OIDC with Dex
If you are using Dex and want to configure Headlamp to use it for OIDC, then you have to:
- Add the callback URL (e.g.
https://YOUR_URL/oidc-callback) to Dex’s
-oidc-idp-issuer-urlas Dex’s URL (same as in
--oidc-issuer-urlin the Kubernetes APIServer)
-oidc-scopesif needed, e.g.