From 77b1ad0aa4b68937fbb253c7e3696d36773e9394 Mon Sep 17 00:00:00 2001
From: Mangirdas Judeikis <mangirdas@judeikis.lt>
Date: Mon, 30 Mar 2026 14:15:55 +0300
Subject: [PATCH 1/2] Fix npe in bind address & add kubeconfig

---
 backend/server.go                               | 3 +++
 cmd/backend/main.go                             | 6 +++++-
 deploy/charts/backend/templates/deployment.yaml | 6 ++++++
 deploy/charts/backend/values.yaml               | 4 ++++
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/backend/server.go b/backend/server.go
index 176906293..8cbb05551 100644
--- a/backend/server.go
+++ b/backend/server.go
@@ -357,6 +357,9 @@ func (s *Server) GetOIDCProvider(ctx context.Context) (*auth.OIDCServiceProvider
 }
 
 func (s *Server) Addr() net.Addr {
+	if s.WebServer == nil {
+		return nil
+	}
 	return s.WebServer.Addr()
 }
 
diff --git a/cmd/backend/main.go b/cmd/backend/main.go
index 8efecbb75..b110f9b41 100644
--- a/cmd/backend/main.go
+++ b/cmd/backend/main.go
@@ -98,7 +98,11 @@ func run(ctx context.Context) error {
 	if err := server.Run(ctx); err != nil {
 		return err
 	}
-	logger.Info("Listening", "address", server.Addr())
+	if addr := server.Addr(); addr != nil {
+		logger.Info("Listening", "address", addr)
+	} else {
+		logger.Info("Running in backend-only mode (no HTTP frontend)")
+	}
 
 	<-ctx.Done()
 
diff --git a/deploy/charts/backend/templates/deployment.yaml b/deploy/charts/backend/templates/deployment.yaml
index 64d3977c1..ad73ee6ec 100644
--- a/deploy/charts/backend/templates/deployment.yaml
+++ b/deploy/charts/backend/templates/deployment.yaml
@@ -58,6 +58,12 @@ spec:
           {{- end }}
           args:
             - --listen-address={{ .Values.backend.listenAddress }}
+            {{- if .Values.backend.kubeconfig }}
+            - --kubeconfig={{ .Values.backend.kubeconfig }}
+            {{- end }}
+            {{- if .Values.backend.context }}
+            - --context={{ .Values.backend.context }}
+            {{- end }}
             {{- if .Values.backend.logLevel }}
             - --log-level={{ .Values.backend.logLevel }}
             {{- end }}
diff --git a/deploy/charts/backend/values.yaml b/deploy/charts/backend/values.yaml
index 9680b4564..40546ecd4 100644
--- a/deploy/charts/backend/values.yaml
+++ b/deploy/charts/backend/values.yaml
@@ -9,6 +9,10 @@ replicaCount: 1
 backend:
   # -- Address the backend listens on
   listenAddress: "0.0.0.0:8080"
+  # -- Path to a kubeconfig file. Only required if out-of-cluster
+  kubeconfig: ""
+  # -- The name of the kubeconfig context to use
+  context: ""
   # -- External address clients use to reach the backend
   externalAddress: ""
   # -- External server name for TLS SNI

From 7276dbb4149913ada5bc04d073f1b90b0b283092 Mon Sep 17 00:00:00 2001
From: Mangirdas Judeikis <mangirdas@judeikis.lt>
Date: Mon, 30 Mar 2026 14:51:07 +0300
Subject: [PATCH 2/2] update helm docs

---
 deploy/charts/backend/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/deploy/charts/backend/README.md b/deploy/charts/backend/README.md
index 8f613f444..d192c1bfb 100644
--- a/deploy/charts/backend/README.md
+++ b/deploy/charts/backend/README.md
@@ -27,12 +27,14 @@ See [values.yaml](values.yaml) for the full list of configurable parameters.
 | backend.apiexportEndpointSliceName | string | `""` | APIExport EndpointSlice name to watch |
 | backend.clusterScopeIsolation | string | `"prefix"` | Cluster-scope isolation mode. Options: none, prefix, namespaced |
 | backend.consumerScope | string | `"namespaced"` | Consumer scope. Options: "namespaced" |
+| backend.context | string | `""` | The name of the kubeconfig context to use |
 | backend.cookieEncryptionKey | string | `""` | Cookie encryption key (base64 encoded). Empty generates random key on each start (not for production!) |
 | backend.cookieSigningKey | string | `""` | Cookie signing key (base64 encoded). Empty generates random key on each start (not for production!) |
 | backend.externalAddress | string | `""` | External address clients use to reach the backend |
 | backend.externalServerName | string | `""` | External server name for TLS SNI |
 | backend.extraArgs | list | `[]` | Extra command-line arguments to pass to the backend |
 | backend.frontendDisabled | bool | `false` | Disable the frontend UI |
+| backend.kubeconfig | string | `""` | Path to a kubeconfig file. Only required if out-of-cluster |
 | backend.listenAddress | string | `"0.0.0.0:8080"` | Address the backend listens on |
 | backend.loggingLevel | int | `2` | Logging verbosity level |
 | backend.multiclusterRuntimeProvider | string | `""` | Multicluster runtime provider (e.g., "kcp") |