headlamp.dev

Run Headlamp as a desktop app if you want to manage clusters locally without deploying anything into them, or if you manage several unrelated clusters. Deploy it in-cluster if you want a shared web UI that multiple users reach through an ingress server. The two are not mutually exclusive — Headlamp can be run as a web app, a desktop app, or both.

Desktop app: when local access fits better

Headlamp's desktop build is aimed at users who don't want to deploy it in a cluster, or who want to manage unrelated clusters locally. It runs on Windows, Linux, and macOS.

Install options per platform:

Each platform also offers a direct binary download. Headlamp notes that Windows and macOS may show warnings when running unsigned apps.

Choose this route when you want a single operator working from a local machine, when you don't have permission to install workloads into the clusters you use, or when the clusters you manage aren't related to each other.

In-cluster: when a shared web UI fits better

A common use case for any Kubernetes web UI is to deploy it in-cluster and set up an ingress server so it's available to users. That's the pattern to pick when several people need the same UI and you want to control access centrally.

Install paths:

• Helm

  helm repo add headlamp https://kubernetes-sigs.github.io/headlamp/
  helm install my-headlamp headlamp/headlamp --namespace kube-system
  

• kubectl apply with a configuration file for a deployment and service:

  kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/headlamp/main/kubernetes-headlamp.yaml
  

  Review the file and change what you need before applying.
• Minikube addon

  minikube addons enable headlamp
  minikube service headlamp -n headlamp
  

• Docker Desktop extension — Headlamp ships as a Docker Desktop extension.
• Glasskube

  glasskube install headlamp
  

How the two compare

What stays the same either way

Headlamp adapts to a user's cluster permissions through RBAC-based controls, so what each user sees follows their cluster permissions rather than the deployment mode. It also supports adaptable UI and branding, letting you create custom experiences with minimal effort. Headlamp is an official Kubernetes sub-project and part of SIG UI, and it works with your favorite Kubernetes flavor.

If you're unsure, start with the desktop app to explore a cluster without changing it, then move to an in-cluster deployment once you need to share the UI with a team.

Desktop software is a program you install and run directly on your computer's operating system (Windows, macOS, or Linux), rather than inside a browser tab. You should choose it over a browser extension or web app when your task needs deeper system access, steadier performance, or offline capability — for example, real-time meeting transcription that captures audio from multiple apps. Browser extensions are lighter and install in seconds, but they live inside one browser and inherit its limits.

What "desktop software" actually means

A desktop app is installed on the machine and runs as its own process. It can:

• Read and write local files without a download/upload round trip
• Access system-level resources like the microphone, speakers, camera, and other running apps
• Keep working when the browser is closed or the network drops (depending on the app)
• Persist settings and data locally

This is different from a web app, which runs in a browser tab and depends on a live connection and browser permissions, and from a browser extension, which is a small add-on that modifies or extends one browser's behavior.

Desktop app vs. browser extension vs. web app

The practical takeaway: extensions and web apps are convenient and low-commitment; desktop apps trade a heavier install for capability and stability.

When a desktop app is the better choice

Pick desktop software when the task depends on one or more of these:

• Capturing audio from multiple sources at once — a meeting where you're on a call and taking notes. A desktop notetaker can tap system audio and the mic; a browser extension generally can't reach outside its tab.
• Real-time transcription and live summaries — Otter's Meeting Agent is described as supporting real-time transcription, live chat, automated summaries, insights, and action items. That kind of continuous processing benefits from a local process rather than a single browser tab.
• Long or resource-heavy sessions — recording and transcribing for an hour is more stable outside a tab you might accidentally close.
• Working across apps — if your workflow spans a video call app, a document, and a notes tool, a desktop app can sit across all of them.

Choose a browser extension instead when you only need to enhance one website (for example, adding a button to a specific web tool), want zero install friction, and don't need system-level access.

How to choose and install a desktop app safely

1. Confirm the task fits a desktop app. If you only need to tweak one website, an extension is lighter. If you need system audio, local files, or offline use, go desktop.
2. Check system requirements. Match the OS (Windows/macOS/Linux) and version. Download only from the vendor's official site — for Otter, that's otter.ai.
3. Review permissions before granting. A meeting/transcription app will ask for microphone (and possibly screen or system audio) access. Grant only what the task needs.
4. Install and sign in. Follow the vendor's installer. If the app requires an account, expect a login step.
5. Verify it works. Run a short test — record 30 seconds and confirm transcription or capture appears as expected.
6. Check update and pricing terms. Otter lists a pricing page at otter.ai/pricing; check it for current plan limits rather than assuming a free tier.

Troubleshooting common desktop software problems

• Install fails — confirm OS version meets requirements, free up disk space, and re-download from the official source (a corrupted installer is a common cause).
• App crashes on launch — update to the latest version, restart the machine, and check whether a security tool is blocking it.
• No audio captured — re-check microphone/system-audio permissions in OS settings, not just in the app.
• Sync or login issues — verify your network and credentials; if the app stores data locally, confirm it isn't blocked by a firewall.
• Extension works but desktop doesn't (or vice versa) — they use different permission models; a feature available in one may not exist in the other.

If your goal is AI meeting transcription with live summaries and action items, a desktop app is usually the more capable choice; if you just need a small tweak inside one website, a browser extension is the faster path.

Headlamp adapts its interface to the permissions a user already has in a Kubernetes cluster. It does not grant new access or maintain its own permission model — instead, it reads the cluster's Role-Based Access Control (RBAC) rules and shows or hides actions accordingly. This means two users opening the same Headlamp instance can see different available operations, based on what their Kubernetes identity is allowed to do.

What "RBAC-based controls" means in Headlamp

Kubernetes RBAC decides who can perform which verbs (get, list, create, update, delete, etc.) on which resources, scoped by Roles, ClusterRoles, and their bindings. Headlamp sits on top of that system:

• It authenticates as the user (or service account) accessing the cluster.
• It queries the cluster's authorization rules to determine what that identity can do.
• It reflects those results in the UI, so the interface matches the user's actual permissions.

The site describes this directly: "Headlamp adapts to a user's cluster permissions." The practical effect is that Headlamp is not a separate security layer — it is a view onto the permissions Kubernetes already enforces.

How the interface changes by permission level

Because Headlamp mirrors RBAC, the visible feature set varies by role. The table below shows typical patterns; exact behavior depends on the cluster's role definitions.

This is why the same deployment can serve developers, operators, and auditors without separate builds — each person sees the slice of the cluster their RBAC role allows.

Why this matters for teams managing access by role

If your team already governs access through Kubernetes Roles and bindings, Headlamp inherits that governance rather than duplicating it. Benefits include:

• One source of truth. Access changes are made in Kubernetes RBAC, not in a separate UI permission system.
• Consistent enforcement. A user who cannot kubectl delete a pod generally cannot delete it through Headlamp either, because the cluster rejects the action regardless of the UI.
• Lower onboarding friction. New team members get the access their role defines, and Headlamp reflects it automatically.

A caveat worth stating: the UI reflecting permissions is a usability feature, not the security boundary. The cluster's API server remains the enforcer. A hidden button is convenience; a denied API call is the actual control.

Deployment choices and how they interact with RBAC

Headlamp can run as a desktop app or in-cluster, and the permission model differs by mode:

• Desktop app: runs locally and connects to clusters using your local kubeconfig credentials, so it inherits the permissions tied to those credentials. This suits users who want to manage clusters without deploying anything in-cluster.
• In-cluster: deployed into the cluster (for example via Helm, kubectl apply, Minikube addon, Docker Desktop extension, or Glasskube) and typically exposed through an ingress. Here, RBAC applies to how users authenticate to that deployment, and Headlamp adapts to each user's cluster permissions.

For teams that need role-based access control to be visible and consistent across users, the in-cluster deployment is the more natural fit, since access is governed centrally by the cluster's RBAC. The desktop app is better for individuals managing clusters locally with their own credentials.

How to verify the behavior yourself

1. Confirm your current identity and permissions, for example with kubectl auth can-i --list.
2. Open Headlamp using those same credentials (desktop) or sign in to the in-cluster instance.
3. Compare the actions offered in the UI against what kubectl auth can-i <verb> <resource> reports.
4. Switch to an identity with a narrower role and reload; the available actions should shrink to match.

If the UI and kubectl disagree, check which kubeconfig context or service account Headlamp is using — a mismatch there is the most common cause.

Headlamp is an official Kubernetes sub-project and part of SIG UI, so its permission behavior follows standard Kubernetes authorization rather than a proprietary scheme.

Headlamp is a user-friendly Kubernetes UI focused on extensibility. It is an official Kubernetes sub-project and part of SIG UI, and it can run as a web app, a desktop app, or both. If you manage Kubernetes clusters and want a graphical interface that adapts to a user's cluster permissions, Headlamp is built for that use case.

What Headlamp Does

Headlamp gives you a UI for working with Kubernetes. Its core characteristics, based on the project's own description, are:

• Extensible UI and branding — you can create custom experiences with minimal effort.
• RBAC-based controls — Headlamp adapts to a user's cluster permissions.
• Desktop and web deployment — it can run as a web app, a desktop app, or both.

Because it is an official Kubernetes sub-project under SIG UI, it sits within the Kubernetes ecosystem rather than being a third-party add-on.

When to Use the Desktop App vs. In-Cluster

Headlamp supports two main ways of running, and the choice depends on what you need to manage.

If you only need to manage clusters from your own machine, the desktop app avoids deploying anything into the cluster. If you need a shared, browser-accessible UI for a team, the in-cluster deployment is the usual path.

How to Install Headlamp

Desktop App

Download a binary for your platform, or use a package manager:

• Windows: winget install headlamp or choco install headlamp
• Linux: flatpak install flathub io.kinvolk.Headlamp (make sure the Flathub repository is set up)
• macOS: brew install --cask headlamp

The project notes that Windows and Mac may show warnings when running Headlamp unsigned apps.

In-Cluster

A common approach is to deploy Headlamp in-cluster and set up an ingress server so users can reach it. Installation options include:

• Helm:

  helm repo add headlamp https://kubernetes-sigs.github.io/headlamp/
  helm install my-headlamp headlamp/headlamp --namespace kube-system
  

• kubectl apply with a configuration file for the deployment and service:

  kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/headlamp/main/kubernetes-headlamp.yaml
  

• Minikube addon:

  minikube addons enable headlamp
  minikube service headlamp -n headlamp
  

• Docker Desktop extension — Headlamp ships as a Docker Desktop extension.
• Glasskube:

  glasskube install headlamp
  

Headlamp works with your favorite Kubernetes flavor, so the in-cluster route is not tied to a single distribution.

What to Check Before Choosing It

• Permissions behavior: Headlamp adapts to a user's cluster permissions via RBAC-based controls, so what a given user sees depends on their cluster access.
• Deployment preference: decide up front whether you want a local desktop tool or a shared in-cluster UI, since the install path differs.
• Extensibility needs: if you want custom UI or branding, extensibility is a stated focus of the project.

The project's own framing is straightforward: it is a user-friendly Kubernetes UI focused on extensibility, runnable as a web app, desktop app, or both.

Headlamp can be installed two ways: as a desktop app (Windows, Linux, macOS) for managing clusters locally without deploying anything in-cluster, or in-cluster as a web UI using Helm, kubectl, Minikube, Docker Desktop, or Glasskube. Pick the desktop route if you want to manage unrelated clusters from your machine; pick in-cluster if you want a shared web UI reachable by a team.

Desktop App Installation

Headlamp's desktop app suits users who don't want to deploy it in a cluster, or who want to manage unrelated clusters locally.

Windows

• Download the binary directly, or install via a package manager:
  • WinGet: winget install headlamp
  • Chocolatey: choco install headlamp

Note: Windows may show warnings when running Headlamp as an unsigned app.

Linux

• Download the binary directly, or install via Flatpak (make sure the Flathub repository is set up first):
  • flatpak install flathub io.kinvolk.Headlamp

macOS

• Download the binary directly, or install via Homebrew:
  • brew install --cask headlamp

Note: macOS may show warnings when running Headlamp as an unsigned app.

In-Cluster Installation

A common use case for any Kubernetes web UI is to deploy it in-cluster and set up an ingress server so it's available to users. Headlamp supports several in-cluster install paths.

Helm

helm repo add headlamp https://kubernetes-sigs.github.io/headlamp/
helm install my-headlamp headlamp/headlamp --namespace kube-system

kubectl apply

Use a configuration file to set up a Headlamp deployment and service. Review it and change anything you need before applying:

kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/headlamp/main/kubernetes-headlamp.yaml

Minikube

minikube addons enable headlamp
minikube service headlamp -n headlamp

Docker Desktop

Headlamp ships as a Docker Desktop extension — install it from the Docker Desktop extensions catalog.

Glasskube

glasskube install headlamp

Choosing Between Desktop and In-Cluster

Both forms can also be run together — Headlamp can run as a web app, a desktop app, or both.

What You Get Either Way

• Adaptable UI & branding — create custom experiences with minimal effort.
• RBAC-based controls — Headlamp adapts to a user's cluster permissions.
• Kubernetes flavor compatibility — Headlamp works with your favorite Kubernetes flavor.

Headlamp is an official Kubernetes sub-project and part of SIG UI.