Skip to content
KubeGlass

KubeGlass vs Headlamp

Headlamp is a Kubernetes UI from Kubernetes SIG UI that runs as a desktop app or in a cluster and is extended with JavaScript plugins. KubeGlass is a web console that runs as one binary on your computer or in a cluster, with Helm, GitOps, access reviews and a change history built in.

Both are free, need no account of their own, work with your kubeconfig, and leave permissions to Kubernetes RBAC. Since the Kubernetes Dashboard was archived, Headlamp is the UI the Kubernetes project points people to (see KubeGlass vs Kubernetes Dashboard).

At a glance

Section titled “At a glance”
Feature KubeGlass Headlamp
License AGPL-3.0 Apache-2.0
Project The KubeGlass maintainers A subproject of Kubernetes SIG UI; latest release v0.45.0, 20 August 2026
Runs as A binary that opens the UI in your browser, a container, or a Helm chart in a cluster A desktop app for Linux, macOS and Windows, or a Helm chart or manifest in a cluster
Team sign-in in a cluster Built-in OIDC sign-in, a pasted token, or an auth proxy such as OAuth2 Proxy. Every request runs as the person: KubeGlass impersonates them in OIDC and proxy modes, so the API server doesn’t have to trust your identity provider Built-in OIDC sign-in, a pasted token, or, since v0.43.0, an identity-aware proxy such as OAuth2 Proxy. OIDC sign-in passes the person’s token to the API server, which has to accept it. Behind a proxy, Headlamp calls the API server as its own ServiceAccount unless the proxy passes on a token the API server accepts. Impersonating each person is an open pull request
Several clusters Every kubeconfig context in one list with its problem counts, and lists and search across several at once; installed in a cluster, it shows only that cluster Every kubeconfig context, with a cluster switcher and an experimental view of several clusters together; installed in a cluster, it can show more clusters from mounted kubeconfig files
Live updates Watches over WebSocket Watches over WebSocket
Logs Merged across a workload’s pods, previous run, search, JSON expansion All pods of a workload in one dialog, previous container, search, severity filter
Shells Pod exec, debug containers with a choice of image and target (and Files through them), node shells (opt-in), a shell on your computer (opt-in); split panes, broadcast, recording Pod exec, node shells, ephemeral debug containers with a choice of target
Files Browse a container’s folders, download files and folders, and upload files of up to 256 MiB. A file goes either way in an image without tar No; copying files to and from containers is an open request
Port forward Pods and Services, when KubeGlass runs on your computer In the desktop app only
YAML Edit with a server-side dry run and a diff; a Secret’s or ConfigMap’s values decoded, one key at a time Edit with a dry run and a Review changes diff; forms for some kinds, and a Secret’s values decoded on its page
Helm Built in: releases, history, values, upgrade, rollback, uninstall and a chart catalog The App Catalog plugin, bundled with the desktop app. In a cluster, Helm is off until you set config.enableHelm (since v0.37.0), and the container image doesn’t include the plugin
Argo CD Built in: applications, sync, refresh, stop, roll back An official plugin in alpha
Flux Built in An official plugin
Argo Rollouts Built in: promote, promote full, abort, retry, restart Not documented
Custom resources Yes Yes
Metrics CPU and memory from metrics-server or Prometheus, PromQL, Alertmanager alerts and silences, rightsizing CPU and memory from metrics-server; Prometheus charts through a plugin bundled with the desktop app and the container image (the chart’s config.staticPlugins.enabled turns it off)
Access review An access matrix for any user, group or ServiceAccount, who can do something, and a form for roles and bindings Lists of roles and bindings; a ServiceAccount’s page shows the bindings that name it; buttons you may not use are hidden
Relationships A tree on each object’s page (owners, what it owns, the Services that select it, its node and what it mounts), and a map of a namespace, application or project that marks the chain leading to a broken object A Map view of the cluster, which plugins can extend
Change history Changes to Deployments, StatefulSets, DaemonSets, CronJobs, Services, Ingresses, ConfigMaps, Secrets and autoscalers while KubeGlass runs, field by field, with who made them, and revert after a dry run. From the first launch it also lists the rollouts, Helm releases and config writes the cluster’s own records hold from before. It lists those kinds, and Secrets for Helm, with KubeGlass’s own credentials: in every namespace, or in up to 25 namespaces when the credentials allow only some Roll back Deployments, DaemonSets and StatefulSets to an earlier revision
What is broken An Overview of every object with a problem, errors first and then the newest, with the likely cause and the change before it A diagnostics section on Pod and workload pages
Grouping Applications: workloads grouped by Helm release, Argo CD application or labels. Projects: a cluster’s namespaces with the same label, Headlamp’s project label included Projects: namespaces across clusters grouped as one
Extending it An extensions file for actions (links, and commands it runs in a local shell or copies), keys, sidebar links, Grafana panels, list columns and palette names; no plugin API Plugins in JavaScript or TypeScript, published on Artifact Hub, with a plugin catalog in the desktop app
Keyboard k9s-style keys in every list, and a command palette with : for any kind Global search on / and a few shortcuts you can change
AI An MCP server with 41 read-only tools for AI clients The AI Assistant plugin (alpha), with your own model provider
UI languages 8 25, including right-to-left scripts

Choose Headlamp if

Section titled “Choose Headlamp if”
  • You want a desktop app that installs like any other, or a UI governed by a Kubernetes SIG with a long release history.
  • You want to add your own views. Headlamp plugins are React code that can add pages, sidebar entries and relations on the map, and there are official plugins for cert-manager, Cluster API, KEDA, Karpenter, Knative, Kyverno, OpenCost and others. KubeGlass has no plugin system.
  • You want one in-cluster install to show several clusters. Headlamp can read extra kubeconfig files mounted into its pod; KubeGlass in a cluster shows only that cluster.
  • You need a language KubeGlass doesn’t have. Headlamp has 25 locales.
  • You want Projects that span clusters, or a map that plugins add to. KubeGlass’s projects are namespaces of one cluster.
  • You want to create a local cluster from the UI. Headlamp’s Local Cluster feature sets one up with Minikube.
  • You run very large clusters. Headlamp 0.44.0 says it works beyond 30,000 pods; KubeGlass hasn’t been tested at that size (see Performance).
  • You prefer the Apache-2.0 license.

Choose KubeGlass if

Section titled “Choose KubeGlass if”
  • You want Helm, Argo CD, Flux and Argo Rollouts without installing plugins, including in a shared deployment in a cluster. Headlamp in a cluster manages Helm releases only with config.enableHelm set and the App Catalog plugin added, and its Argo CD plugin is in alpha.
  • You want to see what changed before something broke and who changed it, including rollouts from before KubeGlass started, and to revert that change after a dry run. In a cluster the chart’s role gives KubeGlass the access that takes.
  • You want to browse a container’s files, download them and upload files into it. Headlamp has no file transfer yet.
  • You want a map that follows a broken Ingress through its Service to the crash-looping pods behind it, and says what is wrong at each step.
  • You review access: what a user, group or ServiceAccount may do, and who may do something.
  • You share one install on a managed cluster such as EKS, whose API server doesn’t trust your identity provider, and want each person to act as themselves. KubeGlass impersonates them; Headlamp needs the API server to accept their token, or acts as its own ServiceAccount behind a proxy.
  • You work from the keyboard the way you do in k9s.
  • You compare clusters, check them for drift on a schedule, or check what blocks the next Kubernetes upgrade.
  • You want an MCP server, so AI clients can query your clusters without being able to change them.
  • You want a read-only switch for the whole server or for one cluster, and production marks that make deleting or scaling to zero ask for the name.

Moving from Headlamp

Section titled “Moving from Headlamp”

  1. Install KubeGlass and start it. It reads ~/.kube/config, or every file in KUBECONFIG, the way Headlamp’s desktop app does, so the same contexts appear:

    Terminal window
    brew install kubeglass/tap/kubeglass
    kubeglass

  2. For a shared deployment, install the Helm chart. Both sign people in with OIDC themselves: register KubeGlass at your provider and set config.authMode=oidc (see Sign-in). People who pasted a token into Headlamp can do the same in token mode. If Headlamp sat behind OAuth2 Proxy or another identity-aware proxy, put KubeGlass behind the same proxy in impersonation mode. Every request runs as the signed-in person.

  3. Replace plugins. Helm, Flux and Prometheus are built in. cert-manager Certificates are under Security › Certificates, Kyverno and Gatekeeper violations under Security › Policies, and other custom resources such as KEDA’s or Karpenter’s get the same list as built-in kinds. For links to Grafana, Grafana panels on a page or commands of your own, use the extensions file.

  4. Keep your names and projects. KubeGlass shows the names Headlamp gave clusters in the kubeconfig, and namespaces Headlamp put in a project appear under Projects, marked Headlamp.

  5. Run both against the same clusters while you try KubeGlass. Neither needs anything installed in the cluster to read it.

Sources

Section titled “Sources”

Checked on 5 October 2026; sign-in, Helm, Prometheus and scale on 7 October 2026; files and Secrets on 9 October 2026.