Helm Chart: Adding support for secrets enabled multi-cluster by cmcgalliard · Pull Request #4938 · kubernetes-sigs/headlamp

cmcgalliard · 2026-03-22T22:20:01Z

Summary

This simplifies the process of configuring kubeconfigs in secrets for Headlamp. This functionality already exists; the Helm chart just doesn't make it easy to configure.

Changes

Updated Deployments YAML to add volumes for each secret
Updated Deployments YAML to target each kubeconfig mount in the KUBECONFIG envvar
Updated values file to allow for a list of secrets containing kubeconfigs
Updated helm documentation

Steps to Test

Create 1+ secret containing a kubeconfig
Configure the kubeconfigSecrets

# kubeconfigSecrets:
  #   - secretName: prod-cluster-kubeconfig
  #     key: config  # optional, defaults to "config"

Disable the inCluster kubeconfkg (there is a conflict in the code here, documented in my PR)

config:
  inCluster: false

helm install headlamp
navigate to clusters, validate that you can see multiple clusters configured with secrets you provided.

Screenshots (if applicable)

Notes for the Reviewer

I considered changing it so we could use the in-cluster kubeconfig, but I'm not sure whether you all have intentionally chosen this pattern.

…sing secrets

k8s-ci-robot · 2026-03-22T22:20:07Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: cmcgalliard
Once this PR has been reviewed and has the lgtm label, please assign yolossn for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

linux-foundation-easycla · 2026-03-22T22:20:09Z

✅ login: cmcgalliard / name: Corey McGalliard (c0f3b24, d8c6dfc, 32a6212, 4ca3790, 7383beb, 848f3a7, b65a044, e6171fd, f7a6182)
❌ - login: @Copilot / name: Copilot . The commit (d8c6dfc) is not authorized under a signed CLA. Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

k8s-ci-robot · 2026-03-22T22:20:11Z

Welcome @cmcgalliard!

It looks like this is your first PR to kubernetes-sigs/headlamp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/headlamp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

Copilot

Pull request overview

Adds Helm chart support for configuring Headlamp multi-cluster access via one or more kubeconfig files stored in Kubernetes Secrets, by mounting each secret and building a KUBECONFIG env var pointing at the mounted files.

Changes:

Introduces config.kubeconfigSecrets in chart values and documents how to use it.
Updates the Deployment template to mount each referenced secret and set KUBECONFIG accordingly.
Adds Helm helper templates to detect/configure kubeconfig secret usage.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
charts/headlamp/values.yaml	Adds `config.kubeconfigSecrets` values entry with inline documentation.
charts/headlamp/templates/deployment.yaml	Mounts kubeconfig secrets as volumes/volumeMounts and sets `KUBECONFIG` env var.
charts/headlamp/templates/_helpers.tpl	Adds helpers to build the `KUBECONFIG` path and detect whether secrets are configured.
charts/headlamp/README.md	Documents multi-cluster configuration via kubeconfig secrets.

Copilot · 2026-03-29T18:20:51Z

charts/headlamp/README.md

+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| config.kubeconfigSecrets | list | `[]` | List of secrets containing kubeconfig files |
+| config.kubeconfigSecrets[].secretName | string | required | Name of the secret containing kubeconfig |
+| config.kubeconfigSecrets[].key | string | `"config"` | Key within the secret data (optional, defaults to "config") |
+


The multi-cluster table is malformed Markdown: the header and rows start with || instead of |, so it won’t render as a proper table. Please fix the leading pipes for the table in this section.

I don't see a line where this is the case

Copilot · 2026-03-29T18:20:52Z

charts/headlamp/templates/deployment.yaml

+            {{- if include "headlamp.hasKubeconfigSecrets" . }}
+            - name: KUBECONFIG
+              value: {{ include "headlamp.kubeconfigPath" . | quote }}
+            {{- end }}
+            {{- if .Values.env }}
            {{- toYaml .Values.env | nindent 12 }}
+            {{- end }}
          {{- end }}
          {{- else }}
          env:
+            {{- if include "headlamp.hasKubeconfigSecrets" . }}
+            - name: KUBECONFIG
+              value: {{ include "headlamp.kubeconfigPath" . | quote }}
+            {{- end }}


This adds KUBECONFIG support via config.kubeconfigSecrets, but the chart doesn’t currently enforce the documented requirement that config.inCluster must be false. Consider adding a template validation (e.g., required/fail) when kubeconfigSecrets is non-empty and inCluster is true, so Helm install fails fast instead of silently ignoring the mounted kubeconfigs.

I am still not sure whether the lack of the in-cluster kubeconfig mapping here was intentional. I also asked about this in the CNCF Slack. It would be nice if someone from the project could let me know what you all would like :)

charts/headlamp/templates/deployment.yaml

Copilot · 2026-03-29T18:20:53Z

charts/headlamp/values.yaml

+  # Example:
+  # kubeconfigSecrets:
+  #   - secretName: prod-cluster-kubeconfig
+  #     key: config  # optional, defaults to "config"
+  #   - secretName: dev-cluster-kubeconfig
+  #     key: kubeconfig
+  #   - secretName: staging-cluster-kubeconfig


The commented example under config.kubeconfigSecrets is missing the surrounding config: key/indentation, which can be confusing when users copy/paste it into their values file. Please adjust the example to reflect the actual nesting under config:.

Suggested change

# Example:

# kubeconfigSecrets:

# - secretName: prod-cluster-kubeconfig

# key: config # optional, defaults to "config"

# - secretName: dev-cluster-kubeconfig

# key: kubeconfig

# - secretName: staging-cluster-kubeconfig

# Example (in values.yaml):

# config:

# kubeconfigSecrets:

# - secretName: prod-cluster-kubeconfig

# key: config # optional, defaults to "config"

# - secretName: dev-cluster-kubeconfig

# key: kubeconfig

# - secretName: staging-cluster-kubeconfig

Adding config: would be more confusing than helpful, as it would add a duplicate line if someone were to just uncomment the code.

…ulticluster

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Corey McGalliard <59486473+cmcgalliard@users.noreply.github.com>

cmcgalliard · 2026-03-30T01:54:52Z

Tested this evening after adjusting for code review and it seems to work as expected.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

charts/headlamp/templates/deployment.yaml

charts/headlamp/tests/expected_templates/multi-cluster.yaml

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Copilot · 2026-03-30T02:11:23Z

charts/headlamp/templates/deployment.yaml

+            - name: KUBECONFIG
+              value: {{ include "headlamp.kubeconfigPath" . | quote }}
+            {{- end }}
+            {{- if .Values.env }}
            {{- toYaml .Values.env | nindent 12 }}


If users also set .Values.env with a KUBECONFIG entry, this template will emit duplicate env: entries with the same name (one from kubeconfigSecrets, one from toYaml .Values.env). That can lead to unpredictable results during apply/patch. Consider either (a) only setting KUBECONFIG when it’s not already present in .Values.env, or (b) explicitly failing with a clear message when both are configured.

I think handling this edge case will make the helm difficult to read - most folks will not use both if they get this far, IMO.

updating helm chart to enable managing multiple kubernetes clusters u…

3ea9ee2

…sing secrets

k8s-ci-robot requested review from sniok and yolossn March 22, 2026 22:20

cmcgalliard and others added 2 commits March 23, 2026 12:45

reverting accidential removal of comment

84bf95f

Merge branch 'main' into multicluster

cc0bc9f

illume requested a review from Copilot March 29, 2026 18:03

Copilot started reviewing on behalf of illume March 29, 2026 18:17 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

cmcgalliard and others added 3 commits March 30, 2026 01:23

saving tests

7383beb

Merge branch 'multicluster' of github.com:cmcgalliard/headlamp into m…

32a6212

…ulticluster

Apply suggestion from @Copilot

d8c6dfc

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Corey McGalliard <59486473+cmcgalliard@users.noreply.github.com>

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 30, 2026

cmcgalliard and others added 3 commits March 30, 2026 01:32

saving tests

f7a6182

saving after correcting helm template issue

848f3a7

Merge branch 'main' into multicluster

c0f3b24

cmcgalliard requested a review from Copilot March 30, 2026 01:55

Copilot started reviewing on behalf of cmcgalliard March 30, 2026 01:55 View session

saving tests

b65a044

Copilot AI reviewed Mar 30, 2026

View reviewed changes

charts/headlamp/templates/deployment.yaml Show resolved Hide resolved

charts/headlamp/tests/expected_templates/multi-cluster.yaml Show resolved Hide resolved

charts/headlamp/tests/expected_templates/multi-cluster.yaml Show resolved Hide resolved

saving tests

4ca3790

cmcgalliard requested a review from Copilot March 30, 2026 02:07

Copilot started reviewing on behalf of cmcgalliard March 30, 2026 02:07 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

saving tests

e6171fd

Conversation

cmcgalliard commented Mar 22, 2026

Summary

Changes

Steps to Test

Screenshots (if applicable)

Notes for the Reviewer

Uh oh!

k8s-ci-robot commented Mar 22, 2026

Uh oh!

linux-foundation-easycla bot commented Mar 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Mar 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

cmcgalliard Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

cmcgalliard Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

cmcgalliard Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

cmcgalliard commented Mar 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

cmcgalliard Mar 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

linux-foundation-easycla bot commented Mar 22, 2026 •

edited

Loading