# Headlamp — Manual Token Access

The `charts/headlamp` Helm chart deploys Headlamp with its own in-cluster
ServiceAccount (`headlamp`) and a `cluster-admin` ClusterRoleBinding. That
SA is used by the running pod and does not require manual setup.

To generate a **bearer token** for logging in to the Headlamp UI (e.g. from
a browser), create a separate short-lived token:

```bash
kubectl -n apps create token headlamp --duration=48h
```

If you need a dedicated SA for external/long-lived access instead:

```bash
kubectl -n apps create serviceaccount headlamp-admin
kubectl create clusterrolebinding headlamp-admin \
  --serviceaccount=apps:headlamp-admin \
  --clusterrole=cluster-admin
kubectl -n apps create token headlamp-admin
```