Add support for service account auth for incluster deployments by tylergmuir · Pull Request #4552 · kubernetes-sigs/headlamp

tylergmuir · 2026-02-04T23:41:43Z

The backend now supports two flags that can be used to make the incluster deployment authenticated by default, this allows the users to use OIDC proxies in front of headlamp without having to deal with service account token. For more details refer the issue

Fixes: #3606

This is a re-attempt to implement the abandoned PR in #3607.

…l users.

linux-foundation-easycla · 2026-02-04T23:41:50Z

The committers listed above are authorized under a signed CLA.

✅ login: tylergmuir / name: Tyler Muir (f179de4)

k8s-ci-robot · 2026-02-04T23:41:52Z

Welcome @tylergmuir!

It looks like this is your first PR to kubernetes-sigs/headlamp 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/headlamp has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2026-02-04T23:41:52Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tylergmuir
Once this PR has been reviewed and has the lgtm label, please assign yolossn for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tylergmuir · 2026-02-04T23:48:32Z

This is also a potential option to address #1801.

k8s-ci-robot · 2026-02-07T06:30:46Z

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

illume

Thanks for this.

Can you please check the failing github checks?

For the github message, we do a Linux kernel style. It’s documented in the contributing guide on the website, or look at other git log messages in the backend folder.

Copilot

Pull request overview

Adds an opt-in “use service account token” authentication mode for in-cluster deployments, enabling setups where an external OIDC proxy handles end-user auth while Headlamp uses a Kubernetes service account token to talk to the API server.

Changes:

Introduces backend flags/config for --use-service-account-token and --service-account-token-path, and wires them into in-cluster context creation.
Updates Helm chart values + deployment args to pass the new flags, with added chart render test cases/fixtures.
Adds a backend unit test for the new flags.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
charts/headlamp/values.yaml	Adds chart values for enabling SA-token auth and optional token path.
charts/headlamp/templates/deployment.yaml	Emits the new CLI args into the Deployment manifest.
charts/headlamp/tests/test_cases/service-account-token*.yaml	Adds Helm template test inputs for the new values.
charts/headlamp/tests/expected_templates/service-account-token*.yaml	Adds expected rendered outputs for the new Helm test cases.
backend/pkg/config/config.go	Adds config fields/constants + CLI flags for SA-token auth.
backend/pkg/config/config_test.go	Adds flag parsing test coverage for the new flags.
backend/pkg/headlampconfig/headlampConfig.go	Extends HeadlampCFG with SA-token settings.
backend/cmd/server.go	Maps parsed config into HeadlampCFG including new SA-token fields.
backend/cmd/headlamp.go	Passes SA-token options into in-cluster context creation (and logs a warning).
backend/pkg/kubeconfig/kubeconfig.go	Sets in-cluster kubeconfig AuthInfo.TokenFile when opt-in is enabled.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-07T15:25:23Z

charts/headlamp/templates/deployment.yaml

+            {{- if .Values.config.useServiceAccountToken }}
+            - "-use-service-account-token"
+            {{- end }}
+            {{- if and .Values.config.useServiceAccountToken .Values.config.serviceAccountTokenPath }}


The Helm template adds -use-service-account-token (and the token path flag) even if .Values.config.inCluster is false. That will cause the backend to fail config validation/startup because --use-service-account-token is only valid in in-cluster mode. Gate these args behind and .Values.config.inCluster .Values.config.useServiceAccountToken (and similarly for the path).

Suggested change

{{- if .Values.config.useServiceAccountToken }}

- "-use-service-account-token"

{{- end }}

{{- if and .Values.config.useServiceAccountToken .Values.config.serviceAccountTokenPath }}

{{- if and .Values.config.inCluster .Values.config.useServiceAccountToken }}

- "-use-service-account-token"

{{- end }}

{{- if and .Values.config.inCluster .Values.config.useServiceAccountToken .Values.config.serviceAccountTokenPath }}

Copilot · 2026-02-07T15:25:23Z

backend/pkg/config/config_test.go

+		{
+			name: "use_service_account_token_flag",
+			args: []string{"go run ./cmd", "--use-service-account-token", "--service-account-token-path=/custom/token/path"},
+			verify: func(t *testing.T, conf *config.Config) {
+				assert.Equal(t, true, conf.UseServiceAccountToken)
+				assert.Equal(t, "/custom/token/path", conf.ServiceAccountTokenPath)
+			},


This test enables --use-service-account-token without also setting --in-cluster. config.Parse() runs Validate() and should return an error for this combination, so this test will fail. Add --in-cluster to the args (or update the validation expectations if the intent is to support it out of cluster).

Copilot · 2026-02-07T15:25:23Z

backend/pkg/config/config.go

 	f.String("proxy-urls", "", "Allow proxy requests to specified URLs")
 	f.Bool("enable-helm", false, "Enable Helm operations")
+	f.Bool("use-service-account-token", false, "Use the service account token for in-cluster authentication")
+	f.String("service-account-token-path", DefaultServiceAccountTokenPath, "Path to the service account token")


--service-account-token-path is given a non-empty default value. This makes it hard to distinguish "flag not set" from "set", and it also prevents mode validation similar to the OIDC flags (because the value is always non-empty). Consider defaulting this flag to an empty string and applying the default path only when --use-service-account-token is true (the kubeconfig code already has this fallback).

Suggested change

f.String("service-account-token-path", DefaultServiceAccountTokenPath, "Path to the service account token")

f.String("service-account-token-path", "", "Path to the service account token")

Copilot · 2026-02-07T15:25:24Z

backend/pkg/kubeconfig/kubeconfig.go

 	inClusterAuthInfo := &api.AuthInfo{}
+	if useServiceAccountToken {
+		if serviceAccountTokenPath == "" {
+			serviceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"


The default token path is hard-coded here. Since you already have clusterConfig from rest.InClusterConfig(), consider using clusterConfig.BearerTokenFile as the default when serviceAccountTokenPath is empty. That keeps the behavior aligned with client-go defaults if they ever change and avoids duplicating the path constant.

Suggested change

serviceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"

if clusterConfig.BearerTokenFile != "" {

serviceAccountTokenPath = clusterConfig.BearerTokenFile

} else {

serviceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"

}

Copilot · 2026-02-07T15:25:24Z

charts/headlamp/values.yaml

+  useServiceAccountToken: false
+  # -- path to the service account token file
+  # if useServiceAccountToken is true, this path will be used to read the service account token
+  # if not set, the default path will be used: /var/run/secrets/kubernetes.io/serviceaccount/token  


Trailing whitespace at the end of the comment line (after .../serviceaccount/token). Please remove it to avoid noisy diffs/lint issues.

Suggested change

# if not set, the default path will be used: /var/run/secrets/kubernetes.io/serviceaccount/token

# if not set, the default path will be used: /var/run/secrets/kubernetes.io/serviceaccount/token

Add functionality for using in-cluster service account to validate al…

f179de4

…l users.

k8s-ci-robot requested review from ashu8912 and illume February 4, 2026 23:41

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 7, 2026

illume requested a review from Copilot February 7, 2026 15:18

Copilot started reviewing on behalf of illume February 7, 2026 15:19 View session

illume requested changes Feb 7, 2026

View reviewed changes

Copilot AI reviewed Feb 7, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for service account auth for incluster deployments#4552

Add support for service account auth for incluster deployments#4552
tylergmuir wants to merge 1 commit intokubernetes-sigs:mainfrom
tylergmuir:main

tylergmuir commented Feb 4, 2026

Uh oh!

linux-foundation-easycla bot commented Feb 4, 2026 •

edited

Loading

Uh oh!

k8s-ci-robot commented Feb 4, 2026

Uh oh!

k8s-ci-robot commented Feb 4, 2026

Uh oh!

tylergmuir commented Feb 4, 2026

Uh oh!

k8s-ci-robot commented Feb 7, 2026

Uh oh!

illume left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Copilot AI Feb 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	f.String("service-account-token-path", DefaultServiceAccountTokenPath, "Path to the service account token")
	f.String("service-account-token-path", "", "Path to the service account token")

-			serviceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+			if clusterConfig.BearerTokenFile != "" {
+				serviceAccountTokenPath = clusterConfig.BearerTokenFile
+			} else {
+				serviceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+			}

	# if not set, the default path will be used: /var/run/secrets/kubernetes.io/serviceaccount/token
	# if not set, the default path will be used: /var/run/secrets/kubernetes.io/serviceaccount/token

Conversation

tylergmuir commented Feb 4, 2026

Uh oh!

linux-foundation-easycla bot commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Feb 4, 2026

Uh oh!

k8s-ci-robot commented Feb 4, 2026

Uh oh!

tylergmuir commented Feb 4, 2026

Uh oh!

k8s-ci-robot commented Feb 7, 2026

Uh oh!

illume left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 7, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

linux-foundation-easycla bot commented Feb 4, 2026 •

edited

Loading