Looking for help about enabling TLS termination at the backend

[ehlesp]

Hello there! I am trying to deploy Headlamp with the TLS enabled at the backend as specified in the documentation but the Headlamp pod never reaches the Ready state and eventually gets flagged with a CrashLoopBackOff error. This happens using either env vars or the arguments, so I was wondering if I am missing something in my deployment setup (samples attached at the end of this post). The logs I get from the pod are these:

{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":372,"time":"2025-10-10T08:07:01Z","message":"Creating Headlamp handler"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":373,"time":"2025-10-10T08:07:01Z","message":"Listen address: :4466"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":374,"time":"2025-10-10T08:07:01Z","message":"Kubeconfig path: "}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":375,"time":"2025-10-10T08:07:01Z","message":"Static plugin dir: /headlamp/static-plugins"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":376,"time":"2025-10-10T08:07:01Z","message":"Plugins dir: /headlamp/plugins"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":377,"time":"2025-10-10T08:07:01Z","message":"Dynamic clusters support: false"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":378,"time":"2025-10-10T08:07:01Z","message":"Helm support: false"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":379,"time":"2025-10-10T08:07:01Z","message":"Proxy URLs: []"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":380,"time":"2025-10-10T08:07:01Z","message":"TLS certificate path: /certs/tls.crt"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":381,"time":"2025-10-10T08:07:01Z","message":"TLS key path: /certs/tls.key"}
{"level":"info","context":"main","clusterURL":"https://10.43.0.1:443","source":"/headlamp/backend/pkg/kubeconfig/kubeconfig.go","line":356,"time":"2025-10-10T08:07:01Z","message":"Proxy setup"}
*** Headlamp Server ***
  API Routers:
{"level":"error","source":"/headlamp/backend/cmd/headlamp.go","line":439,"error":"error loading kubeconfig files: error reading kubeconfig file: open : no such file or directory","time":"2025-10-10T08:07:01Z","message":"loading kubeconfig"}
{"level":"info","source":"/headlamp/backend/cmd/headlamp.go","line":447,"time":"2025-10-10T08:07:01Z","message":"prometheus metrics endpoint: /metrics"}
{"level":"error","source":"/headlamp/backend/cmd/headlamp.go","line":459,"error":"error loading kubeconfig files: error reading kubeconfig file: open /home/headlamp/.config/Headlamp/kubeconfigs/config: no such file or directory","time":"2025-10-10T08:07:01Z","message":"loading dynamic kubeconfig"}
2025/10/10 08:07:32 http: TLS handshake error from 10.42.2.1:44910: client sent an HTTP request to an HTTPS server
2025/10/10 08:07:38 http: TLS handshake error from 10.42.2.1:50554: client sent an HTTP request to an HTTPS server
2025/10/10 08:07:42 http: TLS handshake error from 10.42.2.1:50562: client sent an HTTP request to an HTTPS server

As odd as it might sound, I haven't discovered to which resource the 10.42.2.1 cluster IP repeatedly appearing in the TLS handshake error belongs to. It is neither a pod nor a service running in my K3s cluster. The main thing I suspect that could be an issue is with the port. Since the 4466 port is already defined for HTTP, which one is used for HTTPS communications? Maybe there is a conflict there and that's what is preventing the pod from running properly with TLS termination enabled.

My setup runs in a K3s cluster (v1.33.4+k3s1) with Traefik as Ingress controller, MetalLB as loadbalancer and the standard metrics-server (not the one embedded in K3s, but one deployed independently). In a non-TLS setup, Headlamp runs fine.

Here I attach two files declaring my Headlamp deployment attempts. I know the IngressRoute object is probably wrong, but I don't think is the cause for the Headlamp pod's fail:

• Headlamp deployment using TLS arguments
• Headlamp deployment using TLS env variables

[vyncent-t]

Greetings @ehlesp thanks for mentioning this, if you are still facing this issue can you tell me which OS you are currently running and which ver of Headlamp you use? I would like to look into this further 👍