backstage-kuberneteslisted

# Backstage Kubernetes Make a service's real cluster workloads — including your own custom resources — appear on its entity page. Four things must line up: the cluster is reachable, Backstage is authorised on it, the entity is annotated, and the object type is requested. A miss on any one shows as an empty tab. ## Preconditions - Backend generation known. New backend system: `backend.add(import('@backstage/plugin-kubernetes-backend'))` in `packages/backend/src/index.ts`. Legacy: a `createRouter` under `packages/backend/src/plugins/`, which must be migrated before adding modules (`backstage-plugin-migrate`). Frontend: NFS consumes the plugin's `/alpha` export; legacy imports `EntityKubernetesContent` into the entity page. - Cluster reachability from the **backend**, not from your laptop. A cluster behind a VPN the backend pod cannot reach fails identically to a wrong URL. - Exact config shapes read from the installed `@backstage/plugin-kubernetes-backend` `config.schema.json`, and exact annotation constants from `@backstage/plugin-kubernetes-common`. Both move. - Read access to the cluster's RBAC, because surfacing a CRD needs an explicit grant and that grant is usually the missing piece. - Any change to a real cluster's RBAC or service accounts is external mutation: stop and return a BLOCKED report with the exact Role and ClusterRole rules needed, rather than applying them. ## Procedure 1. **Establish which of the four layers is missing** before edi