fix(apps): remove the Headlamp demo app

.github/retired-repo-links.json

@@ -5,7 +5,6 @@
     "README.md", "CONTRIBUTING.md", "AGENTS.md", "CLAUDE.md", "SECURITY.md", "docs", ".claude/skills",
     "k8s/bases/README.md",
     "k8s/bases/apps/README.md",
-    "k8s/bases/apps/headlamp/README.md",
     "k8s/bases/infrastructure/README.md",
     "k8s/bases/infrastructure/audit-log-forwarder/README.md",
     "k8s/bases/infrastructure/controllers/cert-manager/README.md",

AGENTS.md

@@ -56,7 +56,7 @@ k8s/                    # All Kubernetes manifests
     bootstrap/          # Flux post-build substitution variables (base ConfigMap + SOPS secret)
     infrastructure/     # Organized by resource type: controllers/, certificates/, gateway/,
                         #   cluster-policies/, external-secrets/, alerts/, vault-*/ (OpenBao), etc.
-    apps/               # App deployments — whoami, homepage, headlamp
+    apps/               # App deployments — whoami, homepage
   components/           # Shared Kustomize components: HelmRelease defaults and drift detection
                         #   (listed by every HelmRelease-owning kustomization), plus the
                         #   opt-in profile transformations

docs/ARCHITECTURE.md

@@ -33,7 +33,6 @@ controllers to save resources (noted inline).
 ### Demo apps
 
 - **Homepage** — a dashboard landing page for the platform
-- **Headlamp** — a Kubernetes web UI
 - **whoami** — a tiny debug echo service
 
 They are deliberately lightweight, so a new platform has something to look at. To run **your own**

docs/TEMPLATING.md

@@ -73,8 +73,8 @@ ksail --config ksail.prod.yaml cluster update
 ksail --config ksail.prod.yaml workload reconcile
 ```
 
-This profile is transitional. It enables Coroot, removes OpenCost and its Headlamp
-plugin, retires the legacy Loki and Alloy log path, and keeps kube-prometheus-stack
+This profile is transitional. It enables Coroot, removes OpenCost,
+retires the legacy Loki and Alloy log path, and keeps kube-prometheus-stack
 until the metrics and alerting migration is proven separately. Cost allocation is therefore unavailable in this
 profile; it does not connect OpenCost to Coroot Prometheus. Coroot is the only
 observability UI in this profile: it removes the Grafana, Prometheus and Alertmanager
@@ -250,8 +250,7 @@ See [`.github/workflows/`](../.github/workflows) for the exact names in use.
   Kyverno, alerting configs, OpenBao vault, External Secrets Operator,
   ClusterSecretStore, vault-config Job, vault-seed PushSecrets, vault-backup CronJob,
   and the rest of the controller set.
-- [`k8s/bases/apps/`](../k8s/bases/apps) — the demo applications (homepage, whoami,
-  headlamp).
+- [`k8s/bases/apps/`](../k8s/bases/apps) — the demo applications (homepage, whoami).
 - [`k8s/components/`](../k8s/components) — shared transformations: the HelmRelease
   retry defaults and drift detection every HelmRelease-owning kustomization lists, and opt-in
   profile transformations such as removing OpenCost across controller,

docs/TENANTS.md

@@ -1,6 +1,6 @@
 # Onboarding a GitOps tenant
 
-The platform ships with a few lightweight **demo apps** (homepage, whoami, headlamp)
+The platform ships with a few lightweight **demo apps** (homepage, whoami)
 in [`k8s/bases/apps/`](../k8s/bases/apps). To run **your own** application on the
 platform, add it as a **tenant**: an application that runs on the cluster but lives in
 its **own repository**. The tenant repo builds a container image and publishes its

hosts

@@ -1,6 +1,5 @@
 127.0.0.1 dex.platform.lan
 127.0.0.1 flux.platform.lan
-127.0.0.1 headlamp.platform.lan
 127.0.0.1 oauth2-proxy.platform.lan
 127.0.0.1 platform.lan
 127.0.0.1 whoami.platform.lan

k8s/bases/apps/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- headlamp/
 - homepage/
 - whoami/