Headlamp Logins Inherit the Kubernetes Token Behind Them

Headlamp is a Kubernetes management interface that can be accessed via a web interface or desktop application. When logging in to Headlamp within a cluster, users can utilize a service account token or client certificate. A proxy in front of Headlamp may authenticate users, while Kubernetes handles authorization based on the identity forwarded by Headlamp. The distinction between authentication and authorization is crucial.

The Headlamp login page can either hide a shared high-privilege service account or be correctly configured for per-user OIDC (OpenID Connect) and impersonation. However, this distinction cannot be determined solely by examining the external Headlamp page. Kubernetes RBAC (Role-Based Access Control) is used to verify access, and Headlamp recommends using a service account token for in-cluster login.

An example configuration demonstrates a proxy authenticating the browser but Kubernetes granting every signed-in user the permissions of the Headlamp ServiceAccount. This failure mode highlights the importance of correctly wiring per-user authentication and authorization. The Kubernetes audit log may record a shared service-account identity, necessitating additional integration for per-user attribution and least privilege.

When deploying Headlamp, it is advised not to create an Ingress for the Headlamp Service when a proxy is intended to serve as the authentication gate. Direct routing might bypass the gate. The product is named "Headlamp," which also refers to vehicle and camping equipment. While the basic search returns numerous results, a more targeted query using title and specific domain restrictions returns only zero results at a specific timestamp. This indicates that Headlamp deployments may be limited or otherwise constrained at that time.