Updated project to improve guidance

apps/headlamp/helmrelease.yaml

@@ -1,8 +1,9 @@
-# Deliberately no ingress here — the official Dashboard grants whatever the
-# logged-in identity can do, and a leaked cluster-admin token to a publicly
-# reachable Dashboard is a well-known real-world breach vector (see e.g. the
-# 2018 Tesla incident). Access is via `kubectl port-forward` only
-# (docs/SETUP.md step 12) — no standing hostname, no attack surface between
+# Deliberately no ingress here — Headlamp (like the Kubernetes Dashboard it
+# replaces, and like any cluster admin UI) grants whatever the logged-in
+# identity can do, and a leaked cluster-admin token to a publicly reachable
+# admin UI is a well-known real-world breach vector (see e.g. the 2018
+# Tesla incident). Access is via `kubectl port-forward` only
+# (docs/03-flux.md step 5) — no standing hostname, no attack surface between
 # sessions.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease

apps/headlamp/helmrepository.yaml

@@ -1,3 +1,6 @@
+# Same role as apps/podinfo/helmrepository.yaml: just the chart index
+# source-controller polls, cached as an artifact for helmrelease.yaml to
+# install from.
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:

apps/headlamp/kustomization.yaml

@@ -1,3 +1,5 @@
+# Inventory of this app's manifests — see apps/podinfo/kustomization.yaml
+# for why listed order here doesn't matter for apply ordering.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

apps/headlamp/rbac.yaml

@@ -1,5 +1,5 @@
 # Cluster-admin ServiceAccount + long-lived token, used both to log in to
-# the Dashboard (docs/SETUP.md step 12) and as the client identity for
+# Headlamp (docs/03-flux.md step 5) and as the client identity for
 # direct LAN kubectl access if you'd rather not manage the SSH-fetched
 # kubeconfig from step 6. Fine for a single-user homelab; split into
 # narrower-scoped accounts if more people get access later.