/usr/bin/headlamp-server

Usage of config:
  -allow-kubeconfig-changes
    	Allow Headlamp to make changes to the known kubeconfigs when needed. E.g. to remove a cluster via the UI. May not be recommendable when Headlamp is deployed as a service.
  -app-name string
    	Application name used in version output, the browser title, and Kubernetes User-Agent headers (default "Headlamp")
  -base-url string
    	Base URL path. eg. /headlamp
  -cache-enabled
    	K8s cache in backend
  -cluster-inventory-label-selector string
    	Label selector used to filter ClusterProfile resources for experimental/alpha Cluster Inventory
  -cluster-inventory-namespaces string
    	Comma-separated namespaces watched for experimental/alpha ClusterProfile resources; "*" watches all
  -cluster-inventory-no-crd-cache-ttl duration
    	How long to cache that an API server has no experimental/alpha ClusterProfile CRD (default 2h0m0s)
  -cluster-inventory-provider-file string
    	Path to the JSON configuration file for experimental/alpha Cluster Inventory access providers
  -cluster-inventory-root-reconcile-interval duration
    	Interval for reconciling experimental/alpha Cluster Inventory roots (default 5m0s)
  -default-dark-theme string
    	Default theme to use when user prefers dark mode
  -default-light-theme string
    	Default theme to use when user prefers light mode
  -dev
    	Allow connections from other origins
  -enable-cluster-inventory
    	Enable experimental/alpha automatic discovery of clusters from ClusterProfile resources
  -enable-dynamic-clusters
    	Enable dynamic clusters, which stores stateless clusters in the frontend.
  -enable-helm
    	Enable Helm operations
  -force-theme string
    	Force a specific theme, overriding user preferences
  -html-static-dir string
    	Static HTML directory to serve
  -in-cluster
    	Set when running from a k8s cluster
  -in-cluster-context-name string
    	Name to use for the in-cluster Kubernetes context. If unset, it is derived from the kube-system/kubeadm-config ConfigMap (treating "kubernetes" as unset), falling back to "main"
  -insecure-ssl
    	Accept/Ignore all server SSL certificates
  -kubeconfig string
    	Absolute path to the kubeconfig file
  -kubeconfig-dir string
    	Directory for Headlamp-managed kubeconfig files
  -listen-addr string
    	Address to listen on; default is empty, which means listening to any address
  -log-level string
    	Set backend log verbosity. Options: debug, info (default), warn, error (default "info")
  -me-email-path string
    	Comma separated JMESPath expressions used to read email from the JWT payload (default "email")
  -me-groups-path string
    	Comma separated JMESPath expressions used to read groups from the JWT payload (default "groups,realm_access.roles")
  -me-user-info-url string
    	URL to fetch additional user info for the /me endpoint. For oauth2proxy /oauth2/userinfo can be used.
  -me-username-path string
    	Comma separated JMESPath expressions used to read username from the JWT payload (default "preferred_username,upn,username,name")
  -metrics-enabled
    	Enable metrics collection
  -no-browser
    	Disable automatically opening the browser when using embedded frontend
  -node-shell-image string
    	Default image to use when creating node shell pods
  -node-shell-namespace string
    	Default namespace to use when creating node shell pods
  -oidc-auto-login
    	Automatic Redirect to OIDC provider
  -oidc-ca-file string
    	CA file for OIDC
  -oidc-callback-url string
    	OIDC callback URL and trusted logout return origin
  -oidc-client-id string
    	ClientID for OIDC
  -oidc-client-secret string
    	ClientSecret for OIDC
  -oidc-idp-issuer-url string
    	Identity provider issuer URL for OIDC
  -oidc-scopes string
    	A comma separated list of scopes needed from the OIDC provider (default "profile,email")
  -oidc-skip-logout
    	Skip logout from OIDC provider
  -oidc-skip-tls-verify
    	Skip TLS verification for OIDC
  -oidc-use-access-token
    	Setup oidc to pass through the access_token instead of the default id_token
  -oidc-use-cookie
    	Enable OIDC cookie usage even when not running in-cluster
  -oidc-use-pkce
    	Use PKCE (Proof Key for Code Exchange) for enhanced security in OIDC flow
  -oidc-use-token-broadcast
    	After a successful OIDC login, also set the auth cookie for other kubeconfig contexts whose OIDC auth-provider has the same idp-issuer-url and client-id. Disabled by default. Preconditions and caveats: https://headlamp.dev/docs/latest/installation/in-cluster/oidc/
  -oidc-validator-client-id string
    	Override ClientID for OIDC during validation
  -oidc-validator-idp-issuer-url string
    	Override Identity provider issuer URL for OIDC during validation
  -otlp-endpoint string
    	OTLP collector endpoint (default "localhost:4317")
  -plugins-dir string
    	Specify the plugins directory to build the backend with (default "/tmp/.config/Headlamp/plugins")
  -pod-debug-image string
    	Default image to use when creating pod debug containers
  -port uint
    	Port to listen from (default 4466)
  -proxy-auth
    	Enable bypass of authentication when identity-aware proxy headers are present
  -proxy-auth-email-header string
    	Header name to read the authenticated email from (default "X-Forwarded-Email")
  -proxy-auth-group-header string
    	Header name to read the authenticated groups from (default "X-Forwarded-Group")
  -proxy-auth-token-header string
    	Header name to read the proxy Id token from (default "X-Forwarded-Id-Token")
  -proxy-auth-username-header string
    	Header name to read the authenticated username from (default "X-Forwarded-User")
  -proxy-urls string
    	Allow proxy requests to specified URLs
  -sampling-rate float
    	Sampling rate for traces (default 1)
  -service-account-token-path string
    	Path to the service account token. Only used when --unsafe-use-service-account-token is set and in-cluster
  -service-name string
    	Service name for telemetry (default "headlamp")
  -service-version string
    	Service version for telemetry (default "0.30.0")
  -session-ttl int
    	The time in seconds for the session to be valid(Default: 86400/24h, Min: 1 , Max: 31536000/1yr ) (default 86400)
  -skipped-kube-contexts string
    	Context name which should be ignored in kubeconfig file
  -stdout-trace-enabled
    	Enable tracing output to stdout
  -tls-cert-path string
    	Certificate for serving TLS
  -tls-key-path string
    	Key for serving TLS
  -tracing-enabled
    	Enable distributed tracing
  -unsafe-use-service-account-token
    	UNSAFE: use the pod's service account token to authenticate all users in-cluster. Disables per-user auth; only safe behind an auth proxy
  -use-otlp-http
    	Use HTTP instead of gRPC for OTLP export
  -user-plugins-dir string
    	Specify the user-installed plugins directory (default "/tmp/.config/Headlamp/user-plugins")
  -version
    	Print version information and exit
  -watch-plugins-changes
    	Reloads plugins when there are changes to them or their directory (default true)
{"level":"error","source":"github.com/kubernetes-sigs/headlamp/backend/pkg/config/config.go","line":300,"error":"flag: help requested","time":"2026-11-08T04:19:11Z","message":"parsing flags"}
{"level":"error","source":"github.com/kubernetes-sigs/headlamp/backend/cmd/server.go","line":55,"error":"error parsing flags: flag: help requested","time":"2026-11-08T04:19:11Z","message":"fetching config:%v"}