Headlamp 0.46.0 introduces alpha support for Kubernetes Dynamic Resource Allocation, making device classes, GPU claims, and claim templates visible in the dashboard. New hierarchical workload views, Job suspend and resume actions, a configurable details drawer, and a guided Endpoints form simplify everyday cluster work, while service port-forwards reconnect automatically after pod restarts. The release also improves OIDC login and logout, strengthens plugin credential isolation and release signing, and expands integration points for desktop products. Accessibility, localization, frontend build tooling, and reliability improvements round out the release across web and desktop.
🌟 Dynamic Resource Allocation (alpha): see how workloads get GPUs and other devices
Headlamp now shows Kubernetes Dynamic Resource Allocation (DRA), the Kubernetes API that workloads use to request GPUs and other devices. A new Devices section appears on clusters that serve resource.k8s.io/v1 (Kubernetes 1.34+). DRA support is in alpha.
Devices section and Device Classes
Browse the device classes your cluster offers, with their CEL selectors, driver settings, and extended resource names, in a Devices section that only appears where DRA is served.
Device Class details
See the CEL selectors a class uses to pick devices, shown exactly as written, along with its extended resource name and driver settings.
Resource Claims
See whether each claim is waiting for a device, allocated, or in use, along with the devices it was granted and the node they are on.
Resource Claim Templates
Templates describe the devices a Pod asks for, and Kubernetes makes a new claim from them for every Pod. See each template's namespace, how many requests it makes, and which device classes it uses.
Implemented across #7724, #7820, and #7971. Thanks to @Anjali-Chauhan1. Feedback is welcome on #4831.
✨ Enhancements (part 1)
|
|
|---|---|
| Adds an OIDC auto-login server flag and Helm setting so users are redirected straight to the identity provider without clicking a login button, fixing post-login redirect bugs along the way. | Thanks to: @Suyog241005 @mudit06mah. Thanks to @menardorama for reporting. #7071 |
| Adds Suspend and Resume actions for Jobs in the details header and table row menu, so users can toggle spec.suspend without editing YAML or using kubectl. | Thanks to @PixelRobots. #7698 |
| Adds a setting to open the details drawer on the right, left, or bottom instead of a hardcoded right side, letting users place the panel where they prefer, with the choice saved locally. | Thanks to @WasThatRudy. Thanks to @jasoncologix for reporting. #7126 |
| Added French translations for 75 missing strings, mostly in the new create forms and address validation messages, so French-speaking users see these forms in their language while Kubernetes API values stay untranslated. | Thanks to @berlewis. #7902 |
| The desktop build manifest now accepts a product-owned company name and a separate Linux maintainer contact, mapped to Electron Builder metadata, so branded products can set their own publisher details. | Thanks to @illume. #7746 |
| Products can now declare an explicit approvedCommands list separate from plugin-authorized commands, giving product-owned defaults without seeding user settings or auto-approving every shipped plugin command. | Thanks to @illume. #7685 |
| Added a guided create form for Endpoints that edits subsets, addresses and ports and validates them like the API server, so users avoid hand-writing YAML and catch errors such as loopback IPs before submitting. | Thanks to @vyncent-t. #7666 |
Adds Suspend and Resume actions for Jobs in the details header and table row menu, so users can toggle spec.suspend without editing YAML or using kubectl.
✨ Enhancements (part 2)
|
|
|
|---|---|
| Added CompositePodGroup views for hierarchical gang scheduling, so users can see the nested pod group tree and tell which part of a nested workload failed to schedule. | Thanks to @Anjali-Chauhan1. #7542 |
| Browser document titles now include the configured product name, so branded Headlamp builds remain identifiable in tabs and browser history. | Thanks to: @illume @sniok. #7298 |
| Branded Headlamp builds can now set an optional distribution product version that the top-bar menu shows, while the version dialog keeps the Headlamp version and Git commit for clear identification. | Thanks to: @illume @joaquimrocha. #7287 |
| Adds a validated registry for desktop OAuth callback providers that routes startup, second-instance and macOS protocol callbacks to them, while unmatched product URLs keep using the existing deep-link path. | Thanks to: @illume @gambtho. #7281 |
| Exporting stable IDs for the built-in project creation choices lets plugins replace the namespace or YAML option with their own creator, while additional plugin choices stay after the two built-in ones. | Thanks to: @illume @gambtho. #7280 |
| Project overview cards from plugins are now hidden when their component renders nothing, so users no longer see empty cards while populated sections keep the standard three-column layout. | Thanks to: @illume @sniok @ashu8912. #7279 |
| The desktop app now reads checkForUpdates from the packaged build manifest, falling back to HEADLAMP_CHECK_FOR_UPDATES, so downstream builds can configure update checks at packaging time. | Thanks to: @illume @sniok. #7278 |
| Service-backed port-forwards now reconnect automatically by resolving a new pod through the Endpoints API after a pod restart, so rolling updates no longer leave them stopped and needing a manual restart. | Thanks to @Slambot01. #7273 |
| The desktop app now reads its protocol scheme from product metadata and rejects malformed or other-product deep links, so branded builds handle only their own links while headlamp remains the default. | Thanks to: @illume @gambtho. #7252 |
Added CompositePodGroup views for hierarchical gang scheduling, so users can see the nested pod group tree and tell which part of a nested workload failed to schedule.
Project overview cards from plugins are now hidden when their component renders nothing, so users no longer see empty cards while populated sections keep the standard three-column layout.
✨ Enhancements (part 3)
|
|
|
|---|---|
Headlamp's custom Table now honors enableTopToolbar={false} and enableRowSelection={false}, so hidden toolbars stay hidden and independent checkbox cells keep their native behavior.
| Thanks to: @illume @sniok. #7051 |
Plugins can register custom project namespace grouping through registerProjectGrouping, while default grouping and repeated project IDs stay distinct so namespaces are not wrongly merged.
| Thanks to: @illume @yolossn. #6905 |
| LogViewer gains a Copy to Clipboard action, allowing users to copy log output directly without downloading it first. | Thanks to @Priyanshu-rgbb. #6813 |
🐞 Bug fixes (part 1)
|
|
|
|---|---|
| Adds RP-initiated OIDC logout for server-owned contexts so signing out ends the provider's SSO session instead of silently signing the same user straight back in. | Thanks to: @big-appled @skoeva. Thanks to @manujayanth for reporting. #5972 |
| Quiets the kubeconfig watcher when kubeconfig files are missing, so a default in-cluster Headlamp no longer fills its pod log with misleading ERROR lines when nothing is wrong. | Thanks to @govindup63. Thanks to @NoamBrodie and @BigFlagBurito for reporting. #5731 |
| Checks the latest Helm release revision instead of only deployed ones, so failed or pending releases can be viewed, rolled back, or uninstalled and missing releases correctly return 404. | Thanks to @NachiketPatil26. Thanks to @ghost for reporting. #7859 |
| Service pod lookup for port-forwarding now uses the service resource's own cluster, so the port-forward button no longer goes missing when service details are opened from a project view. | Thanks to @tejhan. #7958 |
| EndpointSlices are now matched to Services via the kubernetes.io/service-name label before falling back to ownerReferences, so API-server-created slices like the default kubernetes one link to their Service. | Thanks to @aashu2006. #7931 |
| Editing a container port in the create resource form now preserves other ports and the edited port's fields like name and protocol, preventing silent data loss and crashes on partially typed YAML rows. | Thanks to @HarshPopat23. #7914 |
| Fixed a crash in the Service details view when an EndpointSlice has null endpoints, so services with no ready backends, such as a Deployment scaled to 0, still display correctly. | Thanks to @Pradyuman-aviator. #7909 |
| Service External IP now shows the external name for ExternalName services and <pending> for LoadBalancers without ingress, matching kubectl instead of showing a misleading "-". | Thanks to @Aarti-panchal01. #7907 |
| Diagnostics now surface negative-polarity conditions like ReplicaFailure=True, so workloads blocked by a ResourceQuota or admission controller from creating pods show the explanatory failure message. | Thanks to @HarshPopat23. #7904 |
| StorageClass now recognizes the beta is-default-class annotation as well as the GA one, so default classes show as default in list and details views, matching kubectl get sc. | Thanks to @NachiketPatil26. Thanks to @ghost for reporting. #7900 |
EndpointSlices now link to their Services
🐞 Bug fixes (part 2)
|
|
|
|---|---|
| The PVC create form now keeps the StorageClass input visible while its text is being edited, so replacing a name no longer hides the field and creates the PVC with the default StorageClass instead. | Thanks to @9p-tech. #7897 |
| Replica count helpers now tolerate workloads with no status, such as JobSets waiting on a Kueue MultiKueue manager cluster, preventing the Workloads overview from crashing. | Thanks to @glassharbor. #7893 |
| Custom resource date printer columns are now formatted only when the field has a value, so unset dates show an empty cell instead of "Invalid Date". | Thanks to @Aarti-panchal01. #7892 |
| The log viewer search now subscribes to result changes before running findNext, so the match count updates correctly while typing instead of showing "Too many matches" or a stale count. | Thanks to @9p-tech. #7889 |
| Docker extension releases now build, publish and sign the image without pushing a version bump to main, which Prow rejects, so the extension can update beyond 0.35.0 again. | Thanks to @govindup63. Thanks to @skoeva for reporting. #7877 |
| The desktop app's deep-link handler now adds a missing slash after the # in the URL, so returns from flows like OAuth route to the correct page. | Thanks to @sapnilbiswas. #7872 |
| The Home Warnings column now merges results from every allowed namespace per cluster instead of keeping only the last, so warning counts are correct with multiple namespaces. | Thanks to @9p-tech. #7866 |
| Renaming a cluster back to its original name now works and clears the saved custom name, instead of failing with a 'custom name already in use' error. | Thanks to @h55n. Thanks to @9p-tech for reporting. #7843 |
| Backend start scripts now run through cross-env, so npm start works on Windows where cmd.exe can't parse POSIX-style variable prefixes and the backend previously never started. | Thanks to @carterpewpew. Thanks to @Adi-204 for reporting. #7839 |
| Request tracing and metrics middleware are now attached to the router that actually serves requests, restoring HTTP spans with -tracing-enabled while keeping streaming responses working. | Thanks to @dlanov. Thanks to @silvioincalza for reporting. #7762 |
🐞 Bug fixes (part 3)
|
|
|
|---|---|
| Node Details now shows all capacity and allocatable resources instead of a hardcoded key list, so extended resources such as GPUs and hugepages are visible to users. | Thanks to @Anushka-2905. Thanks to @jayaprajapatii for reporting. #7603 |
| The Release Notes dialog now keeps GitHub's zero-height table header images and their sizing instead of stripping them, so release note tables and images render readably. | Thanks to @NachiketPatil26. Thanks to @sniok for reporting. #7573 |
| Settings now reads the app's live theme through useTheme() instead of importing a test-only fixture, so production code no longer depends on TestHelpers and follows the real theme. | Thanks to @Priyanshu-rgbb. #7493 |
| Safe requests are now retried after client-go refreshes an exec credential following a transient 401, so users no longer see the token login dialog when the next request would succeed. | Thanks to @nungster. #7483 |
| The macOS tray icon now uses 16×16 and 32×32 template images in place of the 22×22 and 44×44 ones, so it matches the size of neighboring menu-bar icons instead of looking oversized. | Thanks to @nova9. #7476 |
| CronJob Spawn Job now binds the request to the CronJob's own cluster, so the Job is no longer created on the wrong cluster when the URL cluster differs after the grace period. | Thanks to: @YousufFFFF @yolossn. #7304 |
| Desktop runCommand IPC listeners are now released when commands exit or are rejected, preventing leaked subscriptions and making plugin manager command cleanup consistent. | Thanks to: @illume @tejhan. #7277 |
Lowercase k is now parsed as kilo in byte quantities, so Kubernetes values like 500k read as 500000 bytes instead of being silently under-reported by 1000x.
| Thanks to: @omlahore @skoeva. #7073 |
| Query retries now stop immediately for permanent HTTP errors below 500 while still retrying temporary ones like 408 and 429, avoiding pointless repeat requests that cannot succeed. | Thanks to: @illume @sniok. #6907 |
Release notes render tables and images correctly
🐞 Bug fixes (part 4)
|
|
|
|---|---|
| Electron Zoom In, Zoom Out, and Reset menu actions are restored after plugin menu serialization strips callbacks, so users can zoom the app again from the menu. | Thanks to: @illume @skoeva. #6891 |
Byte-quantity parsing now handles micro (u) and nano (n) suffixes, so fractional values no longer fall through as raw bytes and skew memory usage percentages by about 1000x.
| Thanks to @Pratikdeb07. #6817 |
| MCP clients no longer restart when only secondary selected clusters are reordered, avoiding unnecessary disruption while keeping the current cluster first and backend context order deterministic. | Thanks to @rootp1. #6536 |
🔒 Security
|
|
|
|---|---|
| Added grouped weekly Dependabot updates for Go modules, GitHub Actions and Docker base images, so dependencies and pinned actions stay current without manual work or one PR per backend module. | Thanks to @skoeva. #7864 |
| Release signing now works for checksums, container images and release tags, dropping the broken GPG signature, so users can verify releases and tags are signed consistently. | Thanks to @skoeva. #7858 |
| Added a provider-neutral cluster registration framework to the desktop app, allowing authorized product plugins to retrieve cluster credentials and safely register clusters in the user's kubeconfig. | Thanks to @illume. #7744 |
| Service proxy requests with a relative URI now keep the configured URIPrefix base path and block encoded traversal, so requests like /status resolve under /api/v1/proxy instead of the host root. | Thanks to @zanarellidev. #7594 |
| Desktop plugins can now use Electron safeStorage through a frozen pluginSecureStorage API with per-plugin namespaces and token-based access, so each plugin's encrypted values stay isolated from others. | Thanks to: @illume @gambtho. #7253 |
| MCP desktop debug logging is now off by default and redacts values when HEADLAMP_MCP_DEBUG=true, so arguments and cluster metadata no longer leak into logs. | Thanks to @rootp1. #6529 |
| Desktop MCP child processes now get only the SDK's default platform environment plus explicitly configured server env values, so the full Headlamp process environment is no longer inherited. | Thanks to @rootp1. #6521 |
♿ Accessibility
|
|
|
|---|---|
| Adds alt+shift+p and alt+shift+d hotkeys for Pods and Deployments that keep the selected namespace filter, so users no longer have to re-select it after keyboard navigation. | Thanks to @aditya-c7. Thanks to @Rucha0901 for reporting. #7851 |
| Removes a stale RestartMultipleButton entry from the accessibility baseline, so CI strictly enforces the already-fixed aria-required-parent rule and catches regressions. | Thanks to @Bhargava-Ram-Thunga. Thanks to @illume for reporting. #7395 |
| Cluster Overview pod and node status pie charts now link to filtered list views, so users can jump straight to unready pods, cordoned nodes, or unready nodes when troubleshooting. | Thanks to @Suyog241005. Thanks to @kriswuollett for reporting. #6748 |
| Removed the resolved scrollable-region-focusable entry from the Storybook accessibility baseline for ClusterChooserPopup, keeping the baseline accurate now that the list is keyboard-focusable and axe-core no longer flags it. | Thanks to @ubermensch177. Thanks to @illume for reporting. #7898 |
| DropZoneBox now uses a theme-aware border instead of hardcoded pure black, so the drop area outline stays visible in dark mode. | Thanks to @Priyanshu-rgbb. #7551 |
| The editor dialog now asks for confirmation before discarding unsaved changes via Close, X, Escape or backdrop, preventing accidental loss of edits while pristine editors still close immediately. | Thanks to @Adi-204. #7443 |
| VersionDialog now falls back to 'Headlamp' when the product name is unset and stale axe baseline entries are removed, so the dialog always has an accessible name and title. | Thanks to @Bhargava-Ram-Thunga. Thanks to @illume for reporting. #7425 |
| Project Details can now grow past the viewport, the resources grid keeps a 300 px minimum height and the category list is capped and scrollable, keeping content usable at high zoom. | Thanks to: @illume @gambtho. #7293 |
| ShowHideLabel's expand/collapse button now sits outside the label element and carries the aria-expanded and aria-controls attributes, fixing an accessibility issue for assistive technology users. | Thanks to @Alok-work23. Thanks to @illume for reporting. #7267 |
| Stale label-title-only entries were removed from the accessibility baseline for the Settings stories, so the baseline reflects the fixed Debug Image field and no longer lists resolved violations. | Thanks to @Bhargava-Ram-Thunga. Thanks to @illume for reporting. #7224 |
| Resource-map labels now reflow instead of using fixed sizing, preventing content from being clipped at 200% text zoom. | Thanks to: @illume @gambtho. #6910 |
| Kubeconfig load dialog errors now use the themed MUI Alert component instead of a hardcoded red box, so they follow the active theme and include an error icon rather than relying on color alone. | Thanks to @Satyam087. #7751 |
Visible file upload borders in dark mode
Confirmation before discarding unsaved edits
Themed kubeconfig error alerts
⚡ Performance and Build Speed
|
|
|
|---|---|
| Table filters now reuse stable row models and cache dropdown options on demand, avoiding repeated work while restoring Status and Namespace filters on large clusters with their memory safeguards intact. | Thanks to @srebb. #7486 |
| Makes Rsbuild the default frontend builder while keeping Vite scripts available, addressing build crashes on low-memory CI and slow or broken dev mode on Windows. | Thanks to @illume. Thanks to @vyncent-t for reporting. #7712 |
| Packaging no longer runs an intermediate unpacked Electron Builder pass and adds a prepared-assets path, so repeated package preparation is avoided and builds with prebuilt assets skip redundant work. | Thanks to @illume. #7727 |
| The Build App workflow now caches npm and Go dependencies and cancels superseded runs on new pushes, making one of the slowest PR checks faster and avoiding wasted builds. | Thanks to @skoeva. #6210 |
| Removed the dead base-branch coverage step from the backend-test workflow, so PRs run the test suite once instead of twice and save roughly 40-50 seconds. | Thanks to @skoeva. #6190 |
📖 Documentation
|
|
|
|---|---|
| The identity-aware proxy guide now includes a Pomerium example with Ingress Controller setup and Headlamp Helm values, helping users configure it and understand the shared service account for API access. | Thanks to @desimone. #7227 |
💻 Development (part 1)
|
|
|
|---|---|
| Wraps the SettingsCluster loading text in the translation function, so the loading indicator appears in the user's chosen language like other loaders. | Thanks to @Priyanshu-rgbb. #7553 |
| Bundled Plugin Catalog updated from 0.4.4 to 0.4.5 with its new archive SHA-256 checksum pinned, so builds ship the latest catalog release with a verified archive. | Thanks to @illume. #7979 |
| Added the missing Portuguese translation key for the table filter message, so the frontend i18n check passes again on main. | Thanks to @Aarti-panchal01. #7953 |
| Terminal storybook snapshots now normalize xterm's counter-based ids in injected style tags, making the storyshots independent of how many xterm instances were created earlier in the test run. | Thanks to @Priyanshu-rgbb. #7908 |
| Added unit tests for the BackLink component covering its label, styling and back navigation, so regressions in this shared navigation element are caught early. | Thanks to @sapnilbiswas. #7895 |
| Added unit tests for the SectionBox layout component covering its content and title rendering, so regressions in this widely used common component are caught early. | Thanks to @sapnilbiswas. #7884 |
| Added unit tests for the EmptyContent component covering string and ReactNode children and color forwarding, helping catch regressions in how it renders. | Thanks to @sapnilbiswas. #7868 |
| Packaging now reports start times and elapsed durations for backend, app assembly, post-pack and artifact build phases, making it easier for developers to see where build time goes. | Thanks to @illume. #7731 |
💻 Development (part 2)
|
|
|
|---|---|
| The product manifest's display name is now applied to the Electron runtime before storage modules load, so branded development builds use their own default profile directory instead of sharing Headlamp's. | Thanks to @illume. #7615 |
| Adds empty batch/v1 Job and CronJob list responses to the frontend and plugin-template Storybook mocks, so workload list stories no longer depend on unhandled Kubernetes API requests. | Thanks to: @illume @skoeva. #7473 |
| Expands Storybook apps/v1 workload mocks to cover namespaced and cluster-prefixed requests, with end-to-end regressions for all four apps workload list pages so these stories render reliably. | Thanks to: @illume @skoeva. #7438 |
| Desktop command execution now reports distinct exit codes (-1, -2, -3) for invalid data, rejected permission secrets and denied consent, letting renderer callers tell these rejections apart. | Thanks to: @illume @tejhan. #7294 |
| Added regression tests for ActivitiesRenderer's route-change policy, so ordinary split-right activities stay visible while blocking activities and details drawers are minimized as intended. | Thanks to @illume. #6323 |
💻 Development (part 3)
|
|
|
|---|---|
| Frontend product name, version and source revision are now generated from the selected build manifest and safely escaped for Vite's dotenv format, so packaged-source metadata is preserved without comment or expansion corruption. | Thanks to @illume. #7474 |
| Added TypeScript declarations and test coverage for the shared i18next parser and runtime configuration, making locale selection and right-to-left direction verifiable for developers. | Thanks to: @illume @sniok. #7066 |
| Added a Storybook story for the EventsLifetimeInfo component, giving it snapshot test coverage through the repo's storybook tests where it previously had none. | Thanks to @xonas1101. #6507 |
| The warning bar in the PerformanceTest2000Pods story now uses full width and border-box sizing, so it stays aligned when Change % is set to 25% or 50%. | Thanks to @anurag-p6. #7477 |
Added TypeScript declarations and test coverage for the shared i18next parser and runtime configuration, making locale selection and right-to-left direction verifiable for developers.
Container image: 🐳 ghcr.io/headlamp-k8s/headlamp:v0.46.0
Desktop Apps:
⚠️ Important: Information on warnings from Windows when running Headlamp unsigned apps.
🐧 Flatpak / Linux (AMD64)
🐧 Linux AppImage AMD64, ARM64, ARMv7l
🐧 Linux Tarball AMD64, ARM64, ARMv7l
🐧 Debian / Linux AMD64
🍏 Mac (AMD64)
🍏 Mac (ARM/M1)
🟦 Windows (AMD64)
🟦 Windows (ARM64)