docs: correct namespace refs — driver is kube-system, not headlamp

Fix PRI-592. The tns-csi driver runs in kube-system (like most CSI drivers), not in the headlamp namespace. - CLAUDE.md: Driver namespace: headlamp → kube-system - docs/architecture/overview.md: fix API paths for controller pod access from headlamp namespace to kube-system namespace Co-Authored-By: Paperclip <noreply@paperclip.ing>
docs: update install docs and ArtifactHub metadata to headlamp namespace
2026-05-04 21:32:08 +00:00 · 2026-05-04 07:36:05 +00:00
12 changed files with 27 additions and 99 deletions
@@ -7,8 +7,6 @@ on:
        description: 'Release version (e.g. 1.0.0)'
        required: true
        type: string
-  repository_dispatch:
-    types: [release]

 permissions:
  contents: write
@@ -21,5 +19,5 @@ jobs:
      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
    with:
-      version: ${{ inputs.version || github.event.client_payload.version }}
+      version: ${{ inputs.version }}
      upstream-repo: fenio/tns-csi
@@ -1,21 +0,0 @@
-name: Mend Renovate GitHub App Token
-
-on:
-  workflow_call:
-    outputs:
-      token:
-        description: "Short-lived GitHub App installation token"
-        value: ${{ jobs.app-token.outputs.token }}
-
-jobs:
-  app-token:
-    runs-on: runners-privilegedescalation
-    outputs:
-      token: ${{ steps.app-token.outputs.token }}
-    steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
@@ -1,53 +0,0 @@
-{
-  "config": {
-    // Line length — not enforced for docs with code examples
-    "MD013": false,
-    // First line heading — files use YAML frontmatter, not headings
-    "MD041": false,
-    // Emphasis as heading — common pattern for Option 1/2/3 sections
-    "MD036": false,
-    // No duplicate heading — changelog files repeat section names intentionally
-    "MD024": false,
-    // Fenced code language — not always applicable for diagram blocks
-    "MD040": false,
-    // Table column style — table alignment is visual, not semantic
-    "MD060": false,
-    // Ordered list item prefix — number resets are intentional in documents
-    "MD029": false,
-    // No inline HTML — each elements are valid in valid Markdown
-    "MD033": false,
-    // List marker space — spacing after list markers varies by editor
-    "MD030": false,
-    // Blanks around headings — not always needed in compact docs
-    "MD022": false,
-    // Blanks around lists — not always needed in compact docs
-    "MD032": false,
-    // Blanks around fences — not always needed between adjacent blocks
-    "MD031": false,
-    // Multiple blanks — editor artifacts, not semantic
-    "MD012": false,
-    // Single title — files may have multiple H1 sections
-    "MD025": false,
-    // Trailing spaces — editor artifacts
-    "MD009": false,
-    // Bare URLs — URL shortening not always needed
-    "MD034": false,
-    // Single trailing newline — editor artifacts
-    "MD047": false,
-    // Trailing punctuation — heading punctuation is intentional
-    "MD026": false,
-    // Space in emphasis — double-asterisk bold spacing varies by renderer
-    "MD037": false,
-    // No hard tabs — some generated docs use tabs for indentation
-    "MD010": false,
-    // Code block style — generated docs may use inconsistent styles
-    "MD046": false,
-    // Comment style — generated docs have no comments
-    "MD048": false,
-    // Commands show output — shell examples intentionally show only commands
-    "MD014": false
-  },
-  "ignores": [
-    "docs/api-reference/generated/**"
-  ]
-}
@@ -1 +0,0 @@
-docs/api-reference/generated/**
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+### Changed
+
+- **docs: namespace references** — Updated all documentation, README, and ArtifactHub metadata to explicitly reference the `headlamp` namespace instead of generic "controller pod" language. RBAC examples now clearly scope `pods/proxy` access to `kube-system` where the tns-csi controller runs.
+
 ## [1.0.0] - 2026-03-24

 ### Added
@@ -63,12 +63,12 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ## RBAC / Security Setup

-The plugin reads from the Kubernetes API and the tns-csi controller pod's Prometheus endpoint. The Benchmark page additionally creates and deletes Jobs and PVCs.
+The plugin reads from the Kubernetes API and the tns-csi controller pod's Prometheus endpoint (deployed in `kube-system`). The Benchmark page additionally creates and deletes Jobs and PVCs.

 ### Minimal read-only permissions

@@ -90,6 +90,10 @@ rules:
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["pods/proxy"]
+    verbs: ["get"]
+    resourceNames: ["pods"]
 ```

 ### Additional permissions for Benchmark page
@@ -105,13 +109,13 @@ rules:

 ### Metrics access

-The plugin fetches Prometheus metrics from the tns-csi controller pod via the Kubernetes pod proxy sub-resource. Grant `get` on `pods/proxy` in `kube-system`:
+The plugin fetches Prometheus metrics from the tns-csi controller pod via the Kubernetes pod proxy sub-resource in `kube-system`. Grant `get` on `pods/proxy` scoped to `kube-system`:

 ```yaml
  - apiGroups: [""]
    resources: ["pods/proxy"]
    verbs: ["get"]
-    # Optionally scope to the controller pod namespace
+    # Scope to kube-system where the tns-csi controller runs
 ```

 Apply the role and bind it to your Headlamp service account with a ClusterRoleBinding.
@@ -187,7 +187,7 @@ Report security vulnerabilities via:

 The project uses:
 - **npm audit**: Runs automatically during `npm install`
- **Renovate**: Automated dependency updates via Mend Renovate (org-wide configured)
+- **GitHub Dependabot**: Monitors dependencies and creates PRs for updates

 Headlamp itself (`@kinvolk/headlamp-plugin`) is a peer dependency. Security updates to Headlamp should be applied by upgrading your Headlamp installation.

@@ -67,7 +67,7 @@ Welcome to the Headlamp TNS-CSI Plugin documentation.
 ## External Links

 - **[GitHub Repository](https://github.com/privilegedescalation/headlamp-tns-csi-plugin)**
- **[Artifact Hub](https://artifacthub.io/packages/headlamp/headlamp-tns-csi-plugin/headlamp-tns-csi-plugin)**
+- **[Artifact Hub](https://artifacthub.io/packages/headlamp/tns-csi/headlamp-tns-csi-plugin)**
 - **[tns-csi Driver](https://github.com/fenio/tns-csi)**
 - **[kbench](https://github.com/longhorn/kbench)**
 - **[Headlamp](https://headlamp.dev/)**
@@ -28,7 +28,7 @@ The TNS-CSI plugin is a single-page React application bundled as a Headlamp plug
                        │ HTTPS
                        ▼
 ┌─────────────────────────────────────────────────────┐
-│              Headlamp Pod (kube-system)              │
+│              Headlamp Pod (headlamp namespace)              │
 │                                                     │
 │  Headlamp UI server + API proxy                     │
 │  (forwards requests using service account token     │
@@ -13,7 +13,7 @@ helm install headlamp headlamp/headlamp \
  --create-namespace \
  --set config.pluginsDir=/headlamp/plugins \
  --set pluginsManager.sources[0].name=tns-csi \
-  --set pluginsManager.sources[0].url=https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+  --set pluginsManager.sources[0].url=https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ## Complete values.yaml Example
@@ -27,7 +27,7 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz

 serviceAccount:
  name: headlamp
@@ -81,7 +81,7 @@ spec:
    pluginsManager:
      sources:
        - name: tns-csi
-          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ## RBAC Manifest (Apply Separately)
@@ -22,7 +22,7 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 **Via FluxCD HelmRelease:**
@@ -46,7 +46,7 @@ spec:
    pluginsManager:
      sources:
        - name: tns-csi
-          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ### Method 2: Manual Tarball Install
@@ -55,13 +55,10 @@ Download and extract the plugin directly:

 ```bash
 # Download the release tarball
-wget https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
-
-# Verify the checksum
-echo "14a3e8c13d0b894a41aa1cfccbcb1f6af09dcbb8fd95c7040a540987ea2096a7  tns-csi-0.2.4.tar.gz" | sha256sum --check
+wget https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz

 # Extract into your Headlamp plugins directory
-tar xzf tns-csi-0.2.4.tar.gz -C /headlamp/plugins/
+tar xzf tns-csi-1.0.0.tar.gz -C /headlamp/plugins/
 ```

 The plugin directory should appear as `/headlamp/plugins/tns-csi/`.
@@ -81,7 +78,7 @@ initContainers:
      - -c
      - |
        wget -O /tmp/plugin.tar.gz \
-          https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+          https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
        tar xzf /tmp/plugin.tar.gz -C /headlamp/plugins/
    volumeMounts:
      - name: plugins
@@ -98,10 +95,10 @@ cd headlamp-tns-csi-plugin
 npm install
 npm run build
 npm run package
-# Produces tns-csi-0.2.4.tar.gz
+# Produces tns-csi-<version>.tar.gz

 # Extract to your Headlamp plugins directory
-tar xzf tns-csi-0.2.4.tar.gz -C /headlamp/plugins/
+tar xzf tns-csi-<version>.tar.gz -C /headlamp/plugins/
 ```

 Or use `headlamp-plugin extract` for automatic placement:
@@ -28,7 +28,7 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 Then upgrade your Headlamp release: