Behind the scenes, everything on mashupsoft.com — this blog included — runs on a single-node k3s cluster. Up to now, checking on it meant SSHing in and running kubectl by hand. Not anymore: we just stood up a proper web dashboard.
Meet Headlamp
Headlamp is an open-source, general-purpose UI for Kubernetes clusters. We deployed it in-cluster and put it behind its own subdomain, dash.mashupsoft.com, so we can see pods, deployments, and cluster health at a glance instead of grepping terminal output.
How it’s secured
Access is gated by a Kubernetes ServiceAccount token with cluster-admin rights, scoped to Headlamp alone — the same mechanism the Kubernetes API itself trusts, rather than a bolted-on password layer. We initially fronted it with HTTP Basic Auth at the ingress too, but pulled that back out: Headlamp sends its own Authorization: Bearer header on API calls, and that clashes with Basic credentials on the same header, so the two auth layers couldn’t stack. The ServiceAccount token now does the job on its own, and the token itself never leaves the cluster.
TLS is handled the same way as the rest of the domains here — cert-manager and Let’s Encrypt, auto-renewing.
Small addition, but it makes day-to-day cluster upkeep a lot less command-line-dependent. It’s not the only plumbing we’ve added recently either — we also wired this blog up to MCP so AI agents can talk to it. More about the team behind all this on our About page.
Leave a Reply