Headlamp 0.36.0: Plugin manager sidecar crashes with npm permissions error

[vkoaala]

Describe the bug

The plugin manager sidecar container in Headlamp chart version 0.36.0 fails with npm EACCES permissions error when installing @headlamp-k8s/pluginctl, causing CrashLoopBackOff. The container exits with code 127 (pluginctl: not found) leaving the pod with only 1/2 containers ready.

To Reproduce

1. Deploy Headlamp using Helm chart version 0.36.0
2. Enable plugin manager:

pluginsManager:
  enabled: true
  configContent: |
    plugins:
      - name: flux
        source: https://artifacthub.io/packages/headlamp/headlamp-plugins/headlamp_flux
        version: 0.4.0

3. Check pod status: kubectl get pods -n headlamp
4. See CrashLoopBackOff with 1/2 Ready
5. Check logs: kubectl logs <pod> -c headlamp-plugin

Environment

• Installation type: Helm (via FluxCD)
• Headlamp Version: 0.36.0
• Other: Talos Linux, containerd

Are you able to fix this issue?

No, but happy to test fixes.

Additional Context

Error logs:

npm error code EACCES
npm error syscall mkdir
npm error path /.npm
npm error errno EACCES
...
/bin/sh: pluginctl: not found

Root cause: The node:lts-alpine image runs as non-root but /.npm directory has incorrect permissions, preventing npm from installing the global package. Despite echoing "Installed successfully", pluginctl binary isn't actually available.

Regression: Yes. Version 0.35.0 worked without this issue. Plugin manager appears to be new in 0.36.0.

Workarounds:

• Roll back to 0.35.0
• Set pluginsManager.enabled: false

Suggested fixes:

• Set NPM_CONFIG_CACHE env var to /tmp/.npm
• Add init container to create /.npm with proper ownership
• Use npm --cache flag pointing to writable location

[darylgraham]

Setting NPM_CONFIG_CACHE: /tmp/npm on the plugin manager container did not work for me. It got past the initial step of creating the cache dir but then failed to install the plugins:

Error: EACCES: permission denied, mkdir '/usr/local/lib/node_modules/@headlamp-k8s'

[juissi-t]

I changed the security context for now:

pluginsManager:
  enabled: true
  securityContext:
    readOnlyRootFilesystem: false
    runAsNonRoot: false
    runAsUser: 0

Don't know if all of those are needed, but at least the sidecar now works.

[illume]

This is fixed in the PR

• charts/headlamp: Fix for pluginctl without global install #4094

It will be released in the coming Headlamp 0.37.0 soon.