backend: charts: Add session-ttl flag and logic#4675
Merged
illume merged 2 commits intokubernetes-sigs:mainfrom Feb 13, 2026
Merged
backend: charts: Add session-ttl flag and logic#4675illume merged 2 commits intokubernetes-sigs:mainfrom
illume merged 2 commits intokubernetes-sigs:mainfrom
Conversation
k8s-ci-robot
added
cncf-cla: yes
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a configurable backend -session-ttl (and corresponding Helm value) to control how long Headlamp’s auth cookie remains valid, addressing in-cluster re-authentication caused by the fixed 24h session duration.
Changes:
- Introduces
session-ttlconfig/flag with validation (bounds) and plumbs it into the server config. - Updates auth cookie issuance to use the configured TTL for
MaxAge. - Updates Helm chart deployment args and refreshes snapshot templates.
Reviewed changes
Copilot reviewed 31 out of 31 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| charts/headlamp/values.yaml | Adds config.sessionTTL default (86400s) to expose session TTL via Helm values. |
| charts/headlamp/templates/deployment.yaml | Passes -session-ttl to the backend container args from Helm values. |
| charts/headlamp/tests/expected_templates/default.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/extra-args.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/extra-manifests.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/host-users-override.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/httproute-enabled.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/me-user-info-url-directly.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/me-user-info-url.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/namespace-override-oidc-create-secret.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/namespace-override.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/non-azure-oidc.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/oidc-create-secret.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/oidc-directly-env.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/oidc-directly.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/oidc-external-secret.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/oidc-pkce.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/oidc-validator-overrides.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/pod-disruption.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/security-context.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/tls-added.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/topology-spread-constraints-custom-selector.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/topology-spread-constraints.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/volumes-added.yaml | Snapshot update to include -session-ttl=86400. |
| charts/headlamp/tests/expected_templates/azure-oidc-with-validators.yaml | Snapshot update to include -session-ttl=86400. |
| backend/pkg/config/config.go | Adds SessionTTL config field, validation, and the -session-ttl flag with default 86400. |
| backend/pkg/headlampconfig/headlampConfig.go | Extends HeadlampCFG to carry SessionTTL through backend components. |
| backend/cmd/server.go | Maps parsed config SessionTTL into the runtime Headlamp config struct. |
| backend/cmd/headlamp.go | Logs Session TTL and passes it when setting/refeshing auth cookies. |
| backend/pkg/auth/cookies.go | Updates SetTokenCookie to take TTL and set cookie MaxAge accordingly. |
| backend/pkg/auth/cookies_test.go | Updates tests for the new SetTokenCookie signature. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
|
@ranjit-parva how does this solution look to you? |
|
LGTM |
ranjit-parva
approved these changes
Feb 11, 2026
mudit06mah
force-pushed
the
feat/session-ttl
branch
from
4e6219e to
e6be205
Compare
Contributor
Author
|
@illume I have made the changes suggested by copilot, Can you please review this again? |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 33 out of 33 changed files in this pull request and generated 4 comments.
Comments suppressed due to low confidence (1)
backend/pkg/auth/cookies_test.go:226
- The chunked-cookie test exercises the new
sessionTTLparameter but doesn’t assert that each emitted cookie chunk inherits the configuredMaxAge. Adding an assertion over the returned cookies would prevent regressions where only some chunks get the correct TTL.
auth.SetTokenCookie(w, req, "test-cluster", longToken, "", 86400)
// Check if cookie was set
cookies := w.Result().Cookies()
if len(cookies) < 2 {
t.Fatalf("Expected at least 2 cookies for a chunked token, got %d", len(cookies))
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
illume
requested changes
Feb 12, 2026
Contributor
illume
left a comment
illume
left a comment
There was a problem hiding this comment.
I checked the suggestions, and I think they are all good suggestions. Can you please have a look?
mudit06mah
force-pushed
the
feat/session-ttl
branch
from
e6be205 to
3e6329b
Compare
mudit06mah
force-pushed
the
feat/session-ttl
branch
from
3e6329b to
1d09077
Compare
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: illume, mudit06mah, ranjit-parva The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds
session-ttlflag to headlamp backend and helm chartRelated Issue
Fixes #4538
Changes
session-ttlflag in backendMaxAgelogic incookies.goSteps to Test
(Not tested yet, having problems with authenticating but have verified this from logs)
-session-ttl=120Notes for the Reviewer
Many files have been changed as charts snapshots have been updated.