Removes the Headlamp crossview-headlamp plugin and serves Crossview as a standalone, top-level app, surfaced via a Homepage tile in a new Infrastructure as Code group.

Why

The crossview-headlamp plugin embeds https://crossview.platform.devantler.tech in an iframe inside Headlamp. Crossview's "Sign in with OIDC" runs the whole auth flow inside that frame, and it traverses Dex → GitHub. github.com returns x-frame-options: deny on its OAuth/login pages, so the GitHub leg can never render inside the iframe and the sign-in dead-ends. (Even a silent pass-through fails — github.com's session cookie is third-party in the frame and gets blocked by ITP/3p-cookie protection.) This is a browser-security wall, not a config bug: every other platform app authenticates top-level and works.

Fix: stop embedding Crossview. Serve it standalone at crossview.${domain}, where its native Dex OIDC already works exactly like Headlamp / Budget / Vault, and surface it from the Homepage dashboard instead of from inside Headlamp.

Changes

• Remove the plugin — drop crossview-headlamp from Headlamp's pluginsManager (apps/headlamp/helm-release.yaml).
• Homepage tile — add gethomepage.dev/* annotations to the Crossview HTTPRoute (group: Infrastructure as Code, icon mdi-graph-outline, app-pod status selector), and add the Infrastructure as Code group to the Homepage layout, positioned between Internal Developer Platform and Kubernetes (apps/homepage/config-map.yaml).
• Standalone cleanup of the iframe scaffolding in apps/crossview/:
  • Delete ingress.yaml — it existed only so the plugin could resolve the embed URL; removed from kustomization.yaml.
  • httproute.yaml — tighten the framing CSP from frame-ancestors 'self' https://headlamp.${domain} to frame-ancestors 'self' and stop stripping X-Frame-Options (standalone clickjacking protection).
  • networkpolicy.yaml — remove the host/remote-node ingress rule that existed only for the plugin's desktop port-forward; kubelet health probes continue via Cilium's implicit allow-localhost=auto path (same as every other app, e.g. headlamp).
  • Comment updates in helm-release.yaml / httproute.yaml to reflect standalone.

Validation

• ksail workload validate (local + prod) — 374 files validated, pass.
• kubectl kustomize k8s/clusters/{local,prod}/ — build clean.

Notes

• Crossplane isn't in Simple Icons or dashboard-icons, so the tile uses MDI icons (mdi-cube-outline group, mdi-graph-outline for Crossview — it renders the Crossplane resource graph). Easy to swap for a brand SVG later.
• After this merges and reconciles, sign-in works by visiting crossview.platform.devantler.tech directly (or clicking the Homepage tile).

🤖 Generated with Claude Code