Fix npe in bind address & add kubeconfig

backend/server.go

@@ -357,6 +357,9 @@ func (s *Server) GetOIDCProvider(ctx context.Context) (*auth.OIDCServiceProvider
 }
 
 func (s *Server) Addr() net.Addr {
+	if s.WebServer == nil {
+		return nil
+	}
 	return s.WebServer.Addr()
 }
 

cmd/backend/main.go

@@ -98,7 +98,11 @@ func run(ctx context.Context) error {
 	if err := server.Run(ctx); err != nil {
 		return err
 	}
-	logger.Info("Listening", "address", server.Addr())
+	if addr := server.Addr(); addr != nil {
+		logger.Info("Listening", "address", addr)
+	} else {
+		logger.Info("Running in backend-only mode (no HTTP frontend)")
+	}
 
 	<-ctx.Done()
 

deploy/charts/backend/README.md

@@ -27,12 +27,14 @@ See [values.yaml](values.yaml) for the full list of configurable parameters.
 | backend.apiexportEndpointSliceName | string | `""` | APIExport EndpointSlice name to watch |
 | backend.clusterScopeIsolation | string | `"prefix"` | Cluster-scope isolation mode. Options: none, prefix, namespaced |
 | backend.consumerScope | string | `"namespaced"` | Consumer scope. Options: "namespaced" |
+| backend.context | string | `""` | The name of the kubeconfig context to use |
 | backend.cookieEncryptionKey | string | `""` | Cookie encryption key (base64 encoded). Empty generates random key on each start (not for production!) |
 | backend.cookieSigningKey | string | `""` | Cookie signing key (base64 encoded). Empty generates random key on each start (not for production!) |
 | backend.externalAddress | string | `""` | External address clients use to reach the backend |
 | backend.externalServerName | string | `""` | External server name for TLS SNI |
 | backend.extraArgs | list | `[]` | Extra command-line arguments to pass to the backend |
 | backend.frontendDisabled | bool | `false` | Disable the frontend UI |
+| backend.kubeconfig | string | `""` | Path to a kubeconfig file. Only required if out-of-cluster |
 | backend.listenAddress | string | `"0.0.0.0:8080"` | Address the backend listens on |
 | backend.loggingLevel | int | `2` | Logging verbosity level |
 | backend.multiclusterRuntimeProvider | string | `""` | Multicluster runtime provider (e.g., "kcp") |

deploy/charts/backend/templates/deployment.yaml

@@ -58,6 +58,12 @@ spec:
           {{- end }}
           args:
             - --listen-address={{ .Values.backend.listenAddress }}
+            {{- if .Values.backend.kubeconfig }}
+            - --kubeconfig={{ .Values.backend.kubeconfig }}
+            {{- end }}
+            {{- if .Values.backend.context }}
+            - --context={{ .Values.backend.context }}
+            {{- end }}
             {{- if .Values.backend.logLevel }}
             - --log-level={{ .Values.backend.logLevel }}
             {{- end }}

deploy/charts/backend/values.yaml

@@ -9,6 +9,10 @@ replicaCount: 1
 backend:
   # -- Address the backend listens on
   listenAddress: "0.0.0.0:8080"
+  # -- Path to a kubeconfig file. Only required if out-of-cluster
+  kubeconfig: ""
+  # -- The name of the kubeconfig context to use
+  context: ""
   # -- External address clients use to reach the backend
   externalAddress: ""
   # -- External server name for TLS SNI