feat: Configure Prometheus endpoint via Helm chart (#4562)

Add PrometheusEndpoint to backend config and API
- Update frontend to use configured endpoint for Prometheus plugin
- Add config.prometheus.endpoint to Helm chart values
- Use safe quoting for Helm value injection
- Add backend validation for Prometheus URL

Signed-off-by: zyzzmohit <mohitray949@gmail.com>

Author: zyzzmohit

backend/cmd/headlamp.go

@@ -97,6 +97,7 @@ const (
 type clientConfig struct {
 	Clusters                []Cluster `json:"clusters"`
 	IsDynamicClusterEnabled bool      `json:"isDynamicClusterEnabled"`
+	PrometheusEndpoint      string    `json:"prometheusEndpoint"`
 }
 
 type OauthConfig struct {
@@ -1750,7 +1751,7 @@ func parseClusterFromKubeConfig(kubeConfigs []string) ([]Cluster, []error) {
 func (c *HeadlampConfig) getConfig(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 
-	clientConfig := clientConfig{c.getClusters(), c.EnableDynamicClusters}
+	clientConfig := clientConfig{c.getClusters(), c.EnableDynamicClusters, c.PrometheusEndpoint}
 
 	if err := json.NewEncoder(w).Encode(&clientConfig); err != nil {
 		logger.Log(logger.LevelError, nil, err, "encoding config")

backend/cmd/server.go

@@ -101,6 +101,7 @@ func buildHeadlampCFG(conf *config.Config, kubeConfigStore kubeconfig.ContextSto
 		TLSCertPath:           conf.TLSCertPath,
 		TLSKeyPath:            conf.TLSKeyPath,
 		SessionTTL:            conf.SessionTTL,
+		PrometheusEndpoint:    *conf.PrometheusEndpoint,
 	}
 }
 

backend/cmd/stateless.go

@@ -178,7 +178,7 @@ func (c *HeadlampConfig) parseKubeConfig(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	clientConfig := clientConfig{contexts, c.EnableDynamicClusters}
+	clientConfig := clientConfig{contexts, c.EnableDynamicClusters, c.PrometheusEndpoint}
 
 	if err := json.NewEncoder(w).Encode(&clientConfig); err != nil {
 		logger.Log(logger.LevelError, nil, err, "encoding config")

backend/pkg/config/config.go

@@ -85,6 +85,7 @@ type Config struct {
 	// TLS config
 	TLSCertPath string `koanf:"tls-cert-path"`
 	TLSKeyPath  string `koanf:"tls-key-path"`
+	PrometheusEndpoint *string `koanf:"prometheus-endpoint"`
 }
 
 func (c *Config) Validate() error {
@@ -138,12 +139,17 @@ func (c *Config) Validate() error {
 			return errors.New("at least one tracing exporter (jaeger, otlp, or stdout) must be configured")
 		}
 
-		if (c.UseOTLPHTTP != nil && *c.UseOTLPHTTP) &&
 			(c.OTLPEndpoint == nil || *c.OTLPEndpoint == "") {
 			return errors.New("otlp-endpoint must be configured when use-otlp-http is enabled")
 		}
 	}
 
+	if c.PrometheusEndpoint != nil && *c.PrometheusEndpoint != "" {
+		if !strings.HasPrefix(*c.PrometheusEndpoint, "http://") && !strings.HasPrefix(*c.PrometheusEndpoint, "https://") {
+			return errors.New("prometheus-endpoint must start with http:// or https://")
+		}
+	}
+
 	return nil
 }
 
@@ -448,6 +454,7 @@ func addGeneralFlags(f *flag.FlagSet) {
 	f.Uint("port", defaultPort, "Port to listen from")
 	f.String("proxy-urls", "", "Allow proxy requests to specified URLs")
 	f.Bool("enable-helm", false, "Enable Helm operations")
+	f.String("prometheus-endpoint", "", "Prometheus endpoint for the cluster")
 }
 
 func addOIDCFlags(f *flag.FlagSet) {

backend/pkg/headlampconfig/headlampConfig.go

@@ -63,4 +63,5 @@ type HeadlampCFG struct {
 	TLSCertPath           string
 	TLSKeyPath            string
 	SessionTTL            int
+	PrometheusEndpoint    string
 }

charts/headlamp/templates/deployment.yaml

@@ -319,6 +319,9 @@ spec:
             {{- with .Values.config.baseURL }}
             - "-base-url={{ . }}"
             {{- end }}
+            {{- with .Values.config.prometheus.endpoint }}
+            - "-prometheus-endpoint={{ . | quote }}"
+            {{- end }}
             {{- with .Values.config.tlsCertPath }}
             - "-tls-cert-path={{ . }}"
             {{- end }}

charts/headlamp/tests/expected_templates/azure-oidc-with-validators.yaml

@@ -115,7 +115,6 @@ spec:
             - "-in-cluster"
             - "-in-cluster-context-name=main"
             - "-plugins-dir=/headlamp/plugins"
-            - "-session-ttl=86400"
             # Check if externalSecret is disabled
             # Check if clientID is non empty either from env or oidc.config
             - "-oidc-client-id=$(OIDC_CLIENT_ID)"

charts/headlamp/tests/expected_templates/default.yaml

@@ -112,7 +112,6 @@ spec:
             - "-in-cluster"
             - "-in-cluster-context-name=main"
             - "-plugins-dir=/headlamp/plugins"
-            - "-session-ttl=86400"
             # Check if externalSecret is disabled
           ports:
             - name: http

charts/headlamp/tests/expected_templates/extra-args.yaml

@@ -112,7 +112,6 @@ spec:
             - "-in-cluster"
             - "-in-cluster-context-name=main"
             - "-plugins-dir=/headlamp/plugins"
-            - "-session-ttl=86400"
             # Check if externalSecret is disabled
             - -insecure-ssl
           ports:

charts/headlamp/tests/expected_templates/extra-manifests.yaml

@@ -129,7 +129,6 @@ spec:
             - "-in-cluster"
             - "-in-cluster-context-name=main"
             - "-plugins-dir=/headlamp/plugins"
-            - "-session-ttl=86400"
             # Check if externalSecret is disabled
           ports:
             - name: http