Set HEADLAMP_CONFIG_BASE_URL to https://headlamp.basicstack.de to ensure
the OIDC callback URL is generated correctly with HTTPS scheme. When
running behind Traefik without explicit base URL, Headlamp may generate
http:// callback URLs instead of https://, causing OIDC flow failures.
Also added traefik.ingress.kubernetes.io/preserve-host annotation to
ensure proper header forwarding.
Fixes: DEV-324
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Headlamp's BASE_URL config expects a path prefix (e.g., "/headlamp") or empty
string, not a full URL. Since Headlamp is deployed at the domain root, BASE_URL
should be empty.
The OIDC redirect URIs in Pocket ID are correctly configured and the user has
been added to the headlamp group, which should resolve the authentication issue.
Related to DEV-324
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Set HEADLAMP_CONFIG_BASE_URL to https://headlamp.basicstack.de (was empty)
- Fix environment variable names to use underscores (OIDC_IDP_ISSUER_URL, etc.)
- Update image version to v0.43.0 to match deployed version
The missing BASE_URL caused the OIDC redirect flow to fail, resulting in the
auth popup closing immediately. Environment variable name corrections ensure
consistency with Headlamp's expected configuration format.
Resolves DEV-324
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Add clear documentation for both OIDC and token-based authentication.
Include troubleshooting section for common 403 errors caused by
using tokens from wrong namespace.
Fixes issue where token was generated from kube-system instead of
headlamp namespace, causing 403 errors on metrics API.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Deploy Headlamp v0.27.0 in dedicated namespace
- Configure OIDC authentication with Pocket ID
- Grant cluster-admin access via service account
- Expose via Traefik ingress at headlamp.basicstack.de
- Seal OIDC client credentials
- Enable access for andreas.leinen@basicstack.de and admin@basicstack.de
Co-Authored-By: Paperclip <noreply@paperclip.ing>
