Add service proxy support and enable Helm integration in headlamp #3532

shahvrushali22 · 2025-06-26T15:01:21Z

Summary

This PR adds in-cluster service proxy support to Headlamp, enables Helm operations with authenticated access, and refactors token validation for consistency. It also ensures namespace scoping in Helm charts and enables secure HTTPS-based readiness and liveness probes.

Changes

Added serviceproxy backend module to enable authenticated in-cluster service access.
Registered new route /clusters/{cluster}/serviceproxy/{namespace}/{name}.
Refactored checkHeadlampBackendToken into a method for consistency.
Enabled Helm support via --enable-helm flag and validated tokens using SelfSubjectReview.
Forwarded Bearer tokens for secure Helm operations.
Updated Helm chart templates:
Added namespace scoping to all resources.
Enabled HTTPS for liveness/readiness probes and services.
Made Helm feature toggleable via values.yaml.
Added config test for enableHelm flag and updated expected chart templates.

Steps to Test

Install Headlamp with Helm support enabled
Test in-cluster service proxy route
Test Helm integration in the UI

k8s-ci-robot · 2025-06-26T15:01:30Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: shahvrushali22
Once this PR has been reviewed and has the lgtm label, please assign joaquimrocha for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot

Pull Request Overview

This PR adds authenticated in-cluster service proxy support and enables Helm operations in Headlamp, alongside refactoring token validation and enhancing Helm charts for namespace scoping and HTTPS readiness/liveness probes.

Introduce a new serviceproxy backend module and route for in-cluster service access
Enable Helm via --enable-helm, forward bearer tokens, and perform a SelfSubjectReview check
Update Helm chart templates for namespace scoping, HTTPS probes, and a toggleable Helm feature

Reviewed Changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
frontend/src/components/account/Auth.tsx	Reload page on successful authentication
frontend/package.json	Add `npx update-browserslist-db@latest` to `prebuild`
frontend/make-env.js	Disable source maps by setting `GENERATE_SOURCEMAP: false`
charts/headlamp/values.yaml	Add `enableHelm` flag and change default service port to 443
charts/headlamp/templates/serviceaccount.yaml	Scope ServiceAccount to release namespace
charts/headlamp/templates/service.yaml	Scope Service and switch `targetPort` to HTTPS
charts/headlamp/templates/deployment.yaml	Scope Deployment, add `-enable-helm`, and enable HTTPS probes
charts/headlamp/templates/secret.yaml	Scope Secret to release namespace
charts/headlamp/templates/pvc.yaml	Scope PVC to release namespace
charts/headlamp/templates/ingress.yaml	Scope Ingress to release namespace
backend/pkg/serviceproxy/service.go	Implement service lookup and URL prefix logic
backend/pkg/serviceproxy/http.go	Provide `HTTPGet` helper for proxied requests
backend/pkg/serviceproxy/handler.go	Handle proxy requests and enforce no-cache headers
backend/pkg/serviceproxy/connection.go	Wrap HTTP calls in a `ServiceConnection` interface
backend/pkg/helm/release.go	Add SelfSubjectReview before Helm install
backend/pkg/config/config.go & config_test.go	Add `enable-helm` flag parsing and tests
backend/cmd/headlamp.go	Register serviceproxy route and refactor token check

Comments suppressed due to low confidence (2)

backend/pkg/serviceproxy/service.go:15

[nitpick] The constant name HTTPScheme is misleading since it holds the "http" scheme. Rename it to something like HTTPSchemeName or HTTPName and use HTT PSScheme for "https" to avoid confusion.

	HTTPScheme  = "http"

backend/pkg/serviceproxy/service.go:1

There are no unit tests for the serviceproxy package. Consider adding tests for getService, getPort, and getServiceURLPrefix to ensure correct behavior and catch regressions.

package serviceproxy

backend/pkg/serviceproxy/http.go

backend/pkg/serviceproxy/handler.go

backend/pkg/helm/release.go

linux-foundation-easycla · 2025-08-18T16:49:14Z

The committers listed above are authorized under a signed CLA.

✅ login: shahvrushali22 / name: Vrushali Shah (7d5f069, 49b470c, 2f23813, 00e563e, eebc481, 9aed917, 79037df)
✅ login: muraliinformal / name: Murali Annamneni (c9ca652, b387e54, dd7c170, efc113a, 960d5e5, 564a352, bb5bfbb, d2133d5, 6e8d9cb)

illume · 2025-08-28T05:43:45Z

Thanks for those changes for the copilot comments.

It looks like there's some conflicts with the main branch at the moment. Would you be able to have a look?

muraliinformal · 2025-09-16T17:13:03Z

@joaquimrocha @illume Could you please take a look ?

joaquimrocha · 2025-09-16T17:47:54Z

I will let @illume continue the review.

muraliinformal · 2025-09-22T19:51:39Z

@illume Could you please review the changes when you get chance ? Thanks

…ormat of path dir

Signed-off-by: Murali Annamneni <[email protected]>

illume

Thanks for those changes.

Seems there's some backend lint/formatting issues and some chart issues. You can run these locally:

make backend-lint
make backend-format
make helm-template-test

I marked some conversations as resolved, and left a few open that need to be addressed.

charts/headlamp/templates/deployment.yaml

charts/headlamp/templates/service.yaml

frontend/make-env.js

frontend/package.json

backend/pkg/serviceproxy/handler.go

backend/pkg/helm/release.go

Copilot

Pull Request Overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 5 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-26T18:54:00Z

frontend/src/components/account/Auth.tsx

          })
        );
+        // On successful authentication, reload the page
+        window.location.reload();


Using window.location.reload() forces a full page reload which can be disruptive to user experience. Consider using React state management or router navigation to update the UI state instead of a hard reload.

Suggested change

window.location.reload();

// window.location.reload(); // Removed to avoid full page reload

Is this window reload really needed? (We seem to be ok without it so far.)

I wonder if there is a way to reproduce any issue where it's not working?

This is removed

backend/pkg/helm/release.go

backend/cmd/headlamp.go

backend/pkg/serviceproxy/http.go

Signed-off-by: Murali Annamneni <[email protected]>

Copilot

Pull Request Overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-03T18:32:47Z

backend/pkg/serviceproxy/connection.go

+
+// Get - perform the get request.
+func (c *Connection) Get(requestURI string) ([]byte, error) {
+	uri := fmt.Sprintf("%s/%s", c.URI, requestURI)


The requestURI parameter is directly concatenated without validation, which could lead to path traversal attacks. Consider validating and sanitizing the requestURI parameter to prevent malicious paths like '../../../etc/passwd'.

Copilot · 2025-10-03T18:32:48Z

backend/pkg/helm/release.go

-	installClient.Description = req.Description
-	installClient.CreateNamespace = req.CreateNamespace
+	installClient.ReleaseName, installClient.Namespace = req.Name, req.Namespace
+	installClient.Description, installClient.CreateNamespace = req.Description, req.CreateNamespace


[nitpick] Multiple assignments on a single line reduce readability. Consider splitting these into separate lines for better maintainability.

Suggested change

installClient.Description, installClient.CreateNamespace = req.Description, req.CreateNamespace

installClient.Description = req.Description

installClient.CreateNamespace = req.CreateNamespace

Copilot · 2025-10-03T18:32:48Z

backend/pkg/serviceproxy/service.go

+// TODO - what if both exist?
+func getPort(ports []corev1.ServicePort) (*corev1.ServicePort, error) {
+	for i, port := range ports {
+		if port.Name == HTTPSScheme || port.Name == HTTPScheme {
+			return &ports[i], nil
+		}
+	}


The TODO comment indicates incomplete logic handling. The function should clarify the priority when both 'http' and 'https' ports exist, or implement proper logic to handle this scenario.

Suggested change

// TODO - what if both exist?

func getPort(ports []corev1.ServicePort) (*corev1.ServicePort, error) {

for i, port := range ports {

if port.Name == HTTPSScheme || port.Name == HTTPScheme {

return &ports[i], nil

}

}

// Prefer "https" over "http" if both exist.

func getPort(ports []corev1.ServicePort) (*corev1.ServicePort, error) {

// First, look for "https"

for i, port := range ports {

if port.Name == HTTPSScheme {

return &ports[i], nil

}

}

// Then, look for "http"

for i, port := range ports {

if port.Name == HTTPScheme {

return &ports[i], nil

}

}

Copilot · 2025-10-03T18:32:48Z

backend/pkg/helm/release.go

 	}

+	values := make(map[string]interface{})
+


[nitpick] The values variable is declared after decoding but could be declared closer to its usage for better code organization.

Suggested change

illume · 2025-10-03T18:45:59Z

@muraliinformal theres a few open conversations. Can you please let me know what you think about each of them?

Please see the commit guidelines https://headlamp.dev/docs/latest/contributing#2-follow-commit-guidelines

Could you please squash your changes and rebase against main? If it makes sense to break it up into some smaller independent atomic commits, please do that?

illume

Left a note about the enableHelm chart variable needing documentation.

illume · 2025-10-03T18:58:18Z

charts/headlamp/values.yaml

      name: ""
  # -- directory to look for plugins
  pluginsDir: "/headlamp/plugins"
+  enableHelm: false


We’ll need to add an entry to the documentation for this variable in charts/headlamp/README.md

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jun 26, 2025

k8s-ci-robot requested review from joaquimrocha and sniok June 26, 2025 15:01

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 26, 2025

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jun 26, 2025

illume requested a review from Copilot July 2, 2025 10:20

Copilot AI reviewed Jul 2, 2025

View reviewed changes

backend/pkg/serviceproxy/http.go Outdated Show resolved Hide resolved

backend/pkg/serviceproxy/handler.go Outdated Show resolved Hide resolved

backend/pkg/helm/release.go Outdated Show resolved Hide resolved

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 6, 2025

muraliinformal force-pushed the add-serviceproxy branch from 916eeca to 6b7ac23 Compare August 20, 2025 16:17

k8s-ci-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Aug 20, 2025

muraliinformal force-pushed the add-serviceproxy branch from c02511f to 067168f Compare September 16, 2025 16:38

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 16, 2025

muraliinformal force-pushed the add-serviceproxy branch 2 times, most recently from 40d09c2 to 16e1d15 Compare September 22, 2025 19:50

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 25, 2025

shahvrushali22 added 3 commits September 26, 2025 10:33

backend: serviceproxy changes

00e563e

remove mistakenly added words

eebc481

backend: Update headlamp charts for serviceproxy and release namespace

49b470c

shahvrushali22 and others added 7 commits September 26, 2025 10:41

backend: Remove backend-arch-build in Makefile

9aed917

backend: add k8s.io/client-go for Kubernetes API interactions

7d5f069

backend: avoid the conflict with adding serviceproxy dir

2f23813

backend: fix the serviceproxy dir path to match the kubernetes-sigs f…

79037df

…ormat of path dir

Address review comments from copilot

b387e54

Signed-off-by: Murali Annamneni <[email protected]>

Updated imports with kubernetes-sigs

bb5bfbb

Signed-off-by: Murali Annamneni <[email protected]>

Rebase

c9ca652

Signed-off-by: Murali Annamneni <[email protected]>

muraliinformal force-pushed the add-serviceproxy branch from cbf124c to c9ca652 Compare September 26, 2025 10:41

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Sep 26, 2025

illume mentioned this pull request Sep 26, 2025

app-catalog: Support serviceproxy and support helm repos in the catalog headlamp-k8s/plugins#304

Open

illume requested changes Sep 26, 2025

View reviewed changes

illume requested a review from Copilot September 26, 2025 18:52

Copilot AI reviewed Sep 26, 2025

View reviewed changes

muraliinformal and others added 6 commits September 29, 2025 21:24

Address review comments

efc113a

Signed-off-by: Murali Annamneni <[email protected]>

Merge branch 'main' into add-serviceproxy

564a352

Merge branch 'main' into add-serviceproxy

6e8d9cb

Merge branch 'main' into add-serviceproxy

960d5e5

Merge branch 'main' into add-serviceproxy

d2133d5

Set Authorization token from cookie for serviceproxy

dd7c170

Signed-off-by: Murali Annamneni <[email protected]>

illume requested a review from Copilot October 3, 2025 18:31

Copilot AI reviewed Oct 3, 2025

View reviewed changes

illume reviewed Oct 3, 2025

View reviewed changes

	window.location.reload();
	// window.location.reload(); // Removed to avoid full page reload

	installClient.Description, installClient.CreateNamespace = req.Description, req.CreateNamespace
	installClient.Description = req.Description
	installClient.CreateNamespace = req.CreateNamespace

Add service proxy support and enable Helm integration in headlamp #3532

Are you sure you want to change the base?

Add service proxy support and enable Helm integration in headlamp #3532

Uh oh!

Conversation

shahvrushali22 commented Jun 26, 2025

Summary

Changes

Steps to Test

Uh oh!

k8s-ci-robot commented Jun 26, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

linux-foundation-easycla bot commented Aug 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

illume commented Aug 28, 2025

Uh oh!

muraliinformal commented Sep 16, 2025

Uh oh!

joaquimrocha commented Sep 16, 2025

Uh oh!

muraliinformal commented Sep 22, 2025

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

illume Sep 26, 2025

Choose a reason for hiding this comment

Uh oh!

muraliinformal Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 3, 2025

Choose a reason for hiding this comment

Uh oh!

illume commented Oct 3, 2025

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

illume Oct 3, 2025

Choose a reason for hiding this comment

linux-foundation-easycla bot commented Aug 18, 2025 •

edited

Loading