# Deliberately no ingress here — Headlamp (like the Kubernetes Dashboard it
# replaces, and like any cluster admin UI) grants whatever the logged-in
# identity can do, and a leaked cluster-admin token to a publicly reachable
# admin UI is a well-known real-world breach vector (see e.g. the 2018
# Tesla incident). Access is via `kubectl port-forward` only
# (docs/03-flux.md step 5) — no standing hostname, no attack surface between
# sessions.
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: headlamp
  namespace: headlamp
spec:
  interval: 10m
  chart:
    spec:
      chart: headlamp
      version: ">=0.40.0"
      sourceRef:
        kind: HelmRepository
        name: headlamp
        namespace: headlamp
  values: {}