fix(headlamp): disable unverified plugin downloads

[devantler]

🤖 Generated by the Daily AI Assistant

Motivation

• A runtime pluginsManager configuration let Headlamp fetch plugins from Artifact Hub by name/version only, which removed pinned artifact integrity (SHA256/digest) from Git and introduced a supply-chain risk of executing unverified same-origin JavaScript in the dashboard.
• Disable dynamic plugin installation until plugin artifacts can be committed/pinned in the GitOps state and to reduce attack surface for cluster-admin-capable dashboard users.

Description

• In k8s/bases/apps/headlamp/helm-release.yaml set config.watchPlugins: false and pluginsManager.enabled: false, and add a clarifying comment explaining the integrity rationale.
• In k8s/bases/apps/headlamp/cilium-network-policy.yaml remove runtime egress allow-list entries for artifacthub.io, GitHub release asset hosts, and registry.npmjs.org, leaving only Dex OIDC egress required for authentication.
• Preserve existing OIDC configuration and other Headlamp runtime settings; the change only disables automatic remote plugin installs and tightens network egress accordingly.
• Changes were committed on the current branch and a PR was opened with the same semantic title.

Testing

• Ran python3 scripts/validate-embedded-json.py, which succeeded.
• Ran python3 scripts/validate-naming.py, which succeeded.
• Ran git diff --check and git status to validate no whitespace / diff issues, which succeeded.
• Could not run ksail workload validate or kubectl kustomize in this environment because ksail and kubectl are not installed, and a local YAML parse check using Python yaml was not run because the yaml module was unavailable; those validations should be executed in CI or a maintainer environment before merge.

---

Codex Task

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_21888ef5-de1d-4067-bac4-c1d59cb80996)

[devantler]

🤖 Generated by the Agentic Engineer

Static exact-head review of 0df00b3df74b775ad27c0fee06ad79e5e33f12ad. One blocking finding is inline below. I did not check out or execute this ownership-unverified branch.

[devantler]

🤖 Generated by the Agentic Engineer

[P1] Replace dynamic downloads without orphaning plugin state

This stops the plugin manager, but the current deployment still creates the headlamp PVC and replaces plugins-dir with that persistent volume, so existing clusters retain the previously downloaded JavaScript rather than revoking it. A clean install has the opposite failure: it receives no plugins, while Crossview’s current manifest states that crossview-headlamp is its only entry point. Please deliver an integrity-bound, GitOps-managed plugin bundle (or another authenticated Crossview route), migrate/delete the old plugin PVC, and prove both upgrade and fresh-install paths.