SIGHUP Distribution Utilities

Overview

SIGHUP Distribution Utilities provides general purpose tools to operate and use the clusters of SD. Today it ships a web UI for Kubernetes based on the Headlamp project, extended with plugins for the SD modules.

The web UI gives you a single place to see the state of the cluster and of the SD modules: cluster overview, Prometheus alerts, certificate expiry, Kubernetes events, logs from Loki or OpenSearch, Velero backups, and Kyverno or Gatekeeper policy violations. Users log in with a Kubernetes token or with SSO through Pomerium, and see what their Kubernetes RBAC allows.

Module's repository: https://github.com/sighupio/module-utilities

Packages

SIGHUP Distribution Utilities provides the following packages:

Package	Description
headlamp	Web UI for Kubernetes, extended with plugins for the SD modules

info

All the components are deployed in the headlamp namespace in the cluster.

Compatibility

Kubernetes Version	Compatibility	Notes
1.33.x	✅	No known issues.
1.34.x	✅	No known issues.
1.35.x	✅	No known issues.
1.36.x	✅	No known issues.

Check the compatibility matrix for additional information on previous releases of the module.

Headlamp

Headlamp is a web UI for Kubernetes. The module deploys the SIGHUP Distribution build of Headlamp: the upstream Headlamp server with the SD plugins (alerts, certificates, events, logs, backups, policy and more).

Headlamp calls the in-cluster API server and sends it the bearer token of the user with every request, so the users get the permissions of their own token.

SD: Utilities module

The Utilities module is available for the OnPremises and Immutable kinds. furyctl deploys it when you create or update the cluster.

You choose whether and how to deploy the web UI under spec.distribution.modules.utilities.headlamp in your furyctl.yaml. The type field selects how the users log in:

Type	Description
none	Headlamp is not installed.
token-auth	The users log in with their own Kubernetes token and get the permissions of that token.
sso	Headlamp is behind Pomerium, the users log in with SSO, and the group in oidcGroup gets read access.

The UI is exposed at dashboard.<baseDomain>.

Token authentication

With token-auth, the users log in with their own Kubernetes token and get the permissions of that token. Set the optional clusterRole field to bind a ClusterRole to the headlamp ServiceAccount, so that its token can also be used to log in:

apiVersion: kfd.sighup.io/v1alpha2
kind: OnPremises
spec:
  distribution:
    modules:
      utilities:
        headlamp:
          # How the users log in: none, token-auth or sso
          type: token-auth
          clusterRole: view

SSO

With sso, the UI is behind Pomerium and the users log in with SSO. The group in oidcGroup gets read-only access to the cluster. This type requires the SSO auth provider:

apiVersion: kfd.sighup.io/v1alpha2
kind: OnPremises
spec:
  distribution:
    modules:
      auth:
        provider:
          type: sso
      utilities:
        headlamp:
          type: sso
          oidcGroup: authors

With sso, the API server also accepts the pomerium audience in the OIDC tokens, unless it is already the client_id in spec.kubernetes.advanced.oidc.

See the configuration reference for your cluster kind for the full list of available options: OnPremises or Immutable.