using headlamp on a shared remote desktop server read other users kubeconfig

[lombardialess]

Describe the bug

We are using a remote desktop server on Windows Server 2022 where multiple users have access, we tried to install headlamp for all users (later also tried with install only for me option) but the problem is that kubeconfig list is read from another user (probably the last one that used it). So I can see mine until someone else use it.
This is also a security issue in my opinion

To Reproduce

see description above

Environment (please provide info about your environment):

• Installation type: Windows desktop app
• Headlamp Version: 3.7.0
• Other: N/A

Are you able to fix this issue?

No

Additional Context

I have not tested previous versions for this bug

[illume]

Thanks @lombardialess

Yes, Headlamp doesn't work very well for using it with multiple users on one machine.

In the just released Headlamp 0.38.0 there is one improvement for this though. It fixes the way it handles clashing ports, so it will now open a new backend server for each instance of the Headlamp app on the same machine. Meaning each user will access their own kube configs and not share the first logged in users one.

It still needs further work to improve the security when each user is not using token based authentication (eg, cert based kubeconfigs are still are problem).

[illume]

There might also be an issue with closing Headlamp to make sure it closes the headlamp-server process. It searches for the process by name in some cases to make sure the binary is killed... but I'm not certain that those routines are searching processes that belong to those users VS all the processes on the machine.