backend: serve /healthz and /api/healthz from a single handler

backend/http/handler.go

@@ -152,7 +152,6 @@ func NewHandler(
 
 func (h *handler) AddRoutes(mux *mux.Router) error {
 	// Public API routes (no authentication required)
-	mux.HandleFunc("/api/healthz", h.handleHealthz).Methods(http.MethodGet)
 	mux.HandleFunc("/api/bindable-resources", h.handleBindableResources).Methods(http.MethodGet)
 	// Intentionally unauthenticated: serves static, deterministic deployment YAML
 	// (konnector image tag is the only variable, derived from the server's own version).
@@ -197,11 +196,6 @@ func (h *handler) AddRoutes(mux *mux.Router) error {
 	return nil
 }
 
-func (h *handler) handleHealthz(w http.ResponseWriter, r *http.Request) {
-	prepareNoCache(w)
-	w.WriteHeader(http.StatusOK)
-}
-
 func (h *handler) handlePing(w http.ResponseWriter, r *http.Request) {
 	prepareNoCache(w)
 	w.WriteHeader(http.StatusOK)

backend/http/server.go

@@ -41,9 +41,21 @@ func NewServer(options *options.Serve) (*Server, error) {
 		listener: options.Listener,
 	}
 
+	// Health endpoints are registered here, rather than with the API routes,
+	// so they are served even when the frontend is disabled. /healthz is used
+	// by the Kubernetes probes, /api/healthz is kept for API clients.
+	server.Router.HandleFunc("/healthz", handleHealthz).Methods(http.MethodGet)
+	server.Router.HandleFunc("/api/healthz", handleHealthz).Methods(http.MethodGet)
+
 	return server, nil
 }
 
+func handleHealthz(w http.ResponseWriter, r *http.Request) {
+	prepareNoCache(w)
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte("ok")) //nolint:errcheck
+}
+
 func (s *Server) Addr() net.Addr {
 	return s.listener.Addr()
 }

backend/http/server_test.go

@@ -0,0 +1,43 @@
+/*
+Copyright 2026 The Kube Bind Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package http
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/kube-bind/kube-bind/backend/options"
+)
+
+func TestHealthzEndpoints(t *testing.T) {
+	server, err := NewServer(options.NewServe())
+	require.NoError(t, err)
+
+	for _, path := range []string{"/healthz", "/api/healthz"} {
+		t.Run(path, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			server.Router.ServeHTTP(rec, httptest.NewRequestWithContext(t.Context(), http.MethodGet, path, nil))
+
+			require.Equal(t, http.StatusOK, rec.Code)
+			require.Equal(t, "ok", rec.Body.String())
+			require.Equal(t, noCacheHeaders["Cache-Control"], rec.Header().Get("Cache-Control"))
+		})
+	}
+}

backend/server.go

@@ -21,7 +21,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"net"
-	nethttp "net/http"
 	"strings"
 	"sync"
 
@@ -118,12 +117,6 @@ func NewServer(ctx context.Context, c *Config) (*Server, error) {
 		return nil, fmt.Errorf("error setting up HTTP Server: %w", err)
 	}
 
-	// Register health check endpoint
-	s.WebServer.Router.HandleFunc("/healthz", func(w nethttp.ResponseWriter, r *nethttp.Request) {
-		w.WriteHeader(nethttp.StatusOK)
-		w.Write([]byte("ok")) //nolint:errcheck
-	}).Methods("GET")
-
 	if c.Options.FrontendDisabled {
 		logger.Info("Frontend is disabled; running in backend only mode")
 	} else {