From 7459fbffc5afc47ad215f4cf0d47860a2d3d8963 Mon Sep 17 00:00:00 2001
From: Eugenio Marzo <eugenio@sourcesense.com>
Date: Sat, 14 Mar 2026 11:27:31 +0100
Subject: [PATCH] some fixes...

---
 Dockerfile                    |  18 +-
 html/css/style.css            |  14 +-
 html/index.html               | 118 ++++++++++-
 html/js/chaos_report.js       |   4 +-
 html/js/globalvars.js         |  47 ++++-
 html/js/kubeinvaders.js       | 135 ++++++++++---
 html/js/programming_mode.js   |   4 +-
 html/js/utils.js              | 358 +++++++++++++++++++++++++++++++++-
 nginx/KubeInvaders.conf       | 113 +++++++++++
 nginx/nginx.conf              |   8 +-
 scripts/chaos-node.lua        | 104 +++++++---
 scripts/ingress.lua           | 104 ++++++++--
 scripts/metrics_loop/start.sh |  15 +-
 scripts/node.lua              |  65 +++++-
 scripts/pod.lua               |  71 ++++++-
 scripts/programming_mode.lua  |  49 ++++-
 scripts/vm.lua                |  94 +++++++--
 scripts/vm_reboot.lua         |  94 +++++++--
 18 files changed, 1255 insertions(+), 160 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index ffbbe66..b83f84f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM nginx:stable
+FROM openresty/openresty:1.25.3.1-4-bookworm-fat
 
 # Update repo and install some utilities and prerequisites
 RUN apt-get update -y
@@ -9,12 +9,14 @@ RUN curl -LO "https://storage.googleapis.com/kubernetes-release/release/$(curl -
 RUN chmod +x ./kubectl
 RUN mv ./kubectl /usr/local/bin/kubectl
 
-# Install Openresty
-RUN wget -O - https://openresty.org/package/pubkey.gpg | apt-key add -
-RUN codename=`grep -Po 'VERSION="[0-9]+ \(\K[^)]+' /etc/os-release` && echo "deb http://openresty.org/package/debian $codename openresty" | tee /etc/apt/sources.list.d/openresty.list
-RUN apt-get update -y
-RUN apt-get -y install openresty
-RUN chmod 777 /usr/local/openresty/nginx
+# # Install Openresty
+# RUN curl -fsSL https://openresty.org/package/pubkey.gpg | gpg --dearmor -o /usr/share/keyrings/openresty.gpg \
+#     && echo "deb [signed-by=/usr/share/keyrings/openresty.gpg] http://openresty.org/package/debian $(. /etc/os-release && echo "$VERSION_CODENAME") openresty" \
+#     > /etc/apt/sources.list.d/openresty.list
+
+# RUN apt-get update -y
+# RUN apt-get -y install openresty
+# RUN chmod 777 /usr/local/openresty/nginx
 
 # Install LUA Module
 RUN apt-get -y install luarocks lua-json lua-socket libyaml-dev
@@ -43,7 +45,7 @@ RUN sed -i.bak 's/listen\(.*\)80;/listen 8081;/' /etc/nginx/conf.d/default.conf
 RUN mkdir -p /usr/local/openresty/nginx/conf/kubeinvaders/data
 COPY nginx/nginx.conf /etc/nginx/nginx.conf
 COPY nginx/KubeInvaders.conf /etc/nginx/conf.d/KubeInvaders.conf
-RUN chmod g+rwx /var/cache/nginx /var/run /var/log/nginx /etc/nginx/conf.d
+RUN chmod g+rwx /var/run /etc/nginx/conf.d
 RUN chmod 777 /var/www/html
 
 # Copy LUA scripts
diff --git a/html/css/style.css b/html/css/style.css
index 2d3b1d2..0a2fcf1 100644
--- a/html/css/style.css
+++ b/html/css/style.css
@@ -148,9 +148,17 @@ hr {
 }
 
 @font-face {
-  font-family: pixel;
-  src: url(".././fonts/Adore64-0vVr.ttf");
-  size: 9px;
+  font-family: "pixel";
+  src:
+    url("../fonts/pixel.ttf") format("truetype"),
+    url("../fonts/Adore64-0vVr.ttf") format("truetype");
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+}
+
+.pixel-font {
+  font-family: "pixel", "Courier New", Courier, monospace;
 }
 
 body {
diff --git a/html/index.html b/html/index.html
index 535b68a..c320c28 100644
--- a/html/index.html
+++ b/html/index.html
@@ -17,10 +17,13 @@
     <link rel="stylesheet" href="./css/style.css">
 
     <style>
-      /* Adjust styling for sidebar */
-      *, button, div, canvas,a,p,h1,h2,h3,h4,h5 {
+      /* Global default font: keep neutral and let component-specific fonts win */
+      body {
         font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
-        font-weight: bold;
+        font-weight: 400;
+      }
+      [style*="font-family: pixel"] {
+        font-family: "pixel", "Courier New", Courier, monospace !important;
       }
       #mainChaosMetrics > div > canvas {
         width: 100% !important;
@@ -45,6 +48,31 @@
         height: 100% !important;
       }
 
+      #splash-screen {
+        position: fixed;
+        inset: 0;
+        background-color: #000;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        z-index: 2000;
+        opacity: 1;
+        visibility: visible;
+        transition: opacity 0.6s ease, visibility 0.6s ease;
+      }
+
+      #splash-screen.hidden {
+        opacity: 0;
+        visibility: hidden;
+        pointer-events: none;
+      }
+
+      .splash-screen-img {
+        max-width: 280px;
+        width: 60%;
+        height: auto;
+      }
+
       .sidebar {
         height: 100%;
         width: 250px;
@@ -208,7 +236,7 @@
         <div class="modal" id="kubeLinterModal" tabindex="-1" role="dialog" aria-labelledby="myModalLabel">
           <div class="modal-dialog modal-xl modal-dialog-scrollable" role="document">
               <div class="modal-body">
-                <p id="currentKubeLinterResult"></hp> 
+                <p id="currentKubeLinterResult"></p> 
               </div>
               <div class="modal-footer">
                 <button type="button" id="closeButton2" class="btn btn-light" data-dismiss="modal" onclick="closeKubeLinterModal()">Close</button>
@@ -354,6 +382,67 @@
         <div class="container" id="gameContainer">
             <!-- START FIRST ROW -->
             <div class="row custom-btn-group" style="margin-top: 2%;">
+
+              <!-- START KUBERNETES CONNECTION FORM -->
+              <div class="row" style="margin-bottom: 2%;">
+              <div class="col">
+                <div class="settings">
+                <h2>Kubernetes Connection</h2>
+                <div class="setting-group">
+                  <label for="k8s_api_endpoint">Kubernetes API Endpoint</label>
+                  <input type="text" id="k8s_api_endpoint" name="k8s_api_endpoint" placeholder="https://kubernetes.default.svc">
+                  
+                  <label for="k8s_token">Kubernetes Token</label>
+                  <input type="password" id="k8s_token" name="k8s_token" placeholder="Enter your token">
+
+                  <label for="k8s_namespaces">Kubernetes Namespaces</label>
+                  <input
+                  type="text"
+                  id="k8s_namespaces"
+                  name="k8s_namespaces"
+                  placeholder="default,kube-system"
+                  >
+                  <small style="display:block; margin-bottom:10px; color:#6c757d; font-weight:normal;">
+                  Comma-separated list of namespaces to target
+                  </small>
+
+                  <label for="k8s_ca_cert">Certification Authority (CA) Certificate</label>
+                  <textarea
+                  id="k8s_ca_cert"
+                  name="k8s_ca_cert"
+                  rows="6"
+                  placeholder="-----BEGIN CERTIFICATE-----&#10;...&#10;-----END CERTIFICATE-----"
+                  style="width: 100%; font-family: 'Courier New', Courier, monospace; font-weight: normal;"
+                  ></textarea>
+                  <small style="display:block; margin-bottom:10px; color:#6c757d; font-weight:normal;">
+                  Optional. Provide the CA certificate when using a self-signed Kubernetes API certificate.
+                  </small>
+
+                    <button onclick="testK8sConnection()">Test Connection</button>
+                    <button onclick="saveK8sConnection()">Save Connection</button>
+                    <div id="k8s-save-status" style="margin-top: 10px; display: none;">
+                      <div id="k8s-save-success" class="alert alert-success" style="display: none;">
+                      ✅ Connection settings saved successfully!
+                      </div>
+                      <div id="k8s-save-error" class="alert alert-danger" style="display: none;">
+                      ❌ Failed to save connection settings: <span id="k8s-save-error-msg"></span>
+                      </div>
+                    </div>
+
+                    <div id="k8s-connection-status" style="margin-top: 10px; display: none;">
+                      <div id="k8s-connection-success" class="alert alert-success" style="display: none;">
+                      ✅ Connection successful!
+                      </div>
+                      <div id="k8s-connection-error" class="alert alert-danger" style="display: none;">
+                      ❌ Connection failed: <span id="k8s-connection-error-msg"></span>
+                      </div>
+                    </div>
+
+                </div>
+                </div>
+              </div>
+              </div>
+              <!-- END KUBERNETES CONNECTION FORM -->
               <!-- START SWITCH BUTTONS FOR MODE (GAME, PROGRAMMING)-->  
               <div class="accordion" id="guide" style="margin-top: 2%; margin-bottom: 2%;">
                 <div class="accordion-item">
@@ -725,8 +814,8 @@ k8s_jobs:
                 <div class="col text-center">
                 </div>
                 <div class="col text-center">
-                  <input type="button" id="zoomInButton" style="margin-top: 2%" class="btn btn-dark id="zoomInGameScreenInput" name="zoomInGameScreenInput" value="+" onclick="zoomIn()">
-                  <input type="button" id="zoomOutButton" style="margin-top: 2%" class="btn btn-dark" id="zoomOutGameScreenInput" name="zoomOutGameScreenInput" value="-" onclick="zoomOut()">
+                  <input type="button" id="zoomInButton" style="margin-top: 2%" class="btn btn-dark" name="zoomInGameScreenInput" value="+" onclick="zoomIn()">
+                  <input type="button" id="zoomOutButton" style="margin-top: 2%" class="btn btn-dark" name="zoomOutGameScreenInput" value="-" onclick="zoomOut()">
                 </div>
                 <div class="col text-center">
                 </div>
@@ -778,6 +867,23 @@ k8s_jobs:
         <script src="./js/chaos_report.js"></script>
         <script>
           // Function to toggle sidebar
+
+          function initSplashScreen() {
+            const splash = document.getElementById('splash-screen');
+            if (!splash) {
+              return;
+            }
+
+            setTimeout(() => {
+              splash.classList.add('hidden');
+            }, 700);
+
+            setTimeout(() => {
+              splash.remove();
+            }, 1400);
+          }
+
+          window.addEventListener('load', initSplashScreen);
           
           const sidebar = document.getElementById('sidebar');
           const mainContent = document.querySelector('.main-content');
diff --git a/html/js/chaos_report.js b/html/js/chaos_report.js
index 0fd233e..6a1a7df 100644
--- a/html/js/chaos_report.js
+++ b/html/js/chaos_report.js
@@ -62,7 +62,9 @@ function getIngressLists() {
       parseIngressListJSON(JSON.parse(this.responseText));
     }
   };;
-  oReq.open("GET", k8s_url + "/kube/ingresses?namespace=" + namespace, true);
+  var ingressUrl = appendK8sTargetParam(k8s_url + "/kube/ingresses?namespace=" + namespace);
+  oReq.open("GET", ingressUrl, true);
+  applyK8sConnectionHeaders(oReq);
   oReq.setRequestHeader("Content-Type", "application/json");
   oReq.send();
 }
diff --git a/html/js/globalvars.js b/html/js/globalvars.js
index bc16ff9..e8617bd 100644
--- a/html/js/globalvars.js
+++ b/html/js/globalvars.js
@@ -20,6 +20,30 @@ function checkURLProtocol(url) {
     return url.startsWith("http://") || url.startsWith("https://");
 }
 
+function resolveFrontendBackendUrl(rawEndpoint) {
+    var browserOrigin = window.location.origin;
+    if (!rawEndpoint || rawEndpoint.indexOf("placeholder") !== -1) {
+        return browserOrigin;
+    }
+
+    var endpoint = rawEndpoint;
+    if (!checkURLProtocol(endpoint)) {
+        endpoint = (clu_insecure ? "http://" : "https://") + endpoint;
+    }
+
+    try {
+        var parsed = new URL(endpoint);
+        // Service names like "kube" are reachable in-cluster but not from the browser.
+        if (parsed.hostname === "kube") {
+            return browserOrigin;
+        }
+    } catch (error) {
+        return browserOrigin;
+    }
+
+    return endpoint.replace(/\/+$/, "");
+}
+
 function getCodeName() {
     const prefixes = ['astro', 'cosmo', 'space', 'star', 'nova', 'nebula', 'galaxy', 'super', 'hyper', 'quantum'];
     const suffixes = ['nova', 'tron', 'wave', 'core', 'pulse', 'jump', 'drive', 'ship', 'gate', 'hole'];
@@ -54,22 +78,27 @@ var selected_env_vars = "selected_env_vars_placeholder";
 var maxAliensPerRow = 20;
 var startYforHelp = 700;
 
-if (clu_insecure && !checkURLProtocol(clu_endpoint)) {
-    k8s_url = "http://" + clu_endpoint;
-}
-else if (!clu_insecure && !checkURLProtocol(clu_endpoint)) {
-    k8s_url = "https://" + clu_endpoint;
-}
-else {
-    k8s_url = clu_endpoint;
-}
+k8s_url = resolveFrontendBackendUrl(clu_endpoint);
 
 console.log("[K-INV STARTUP] k8s_url is " + k8s_url);
 console.log("[K-INV STARTUP] platformengineering.it demo_mode is " + String(demo_mode));
 
 var namespaces = [];
+var configured_namespaces = [];
 var namespaces_index = 0;
 var namespace = namespaces[namespaces_index];
+
+var stored_namespaces = localStorage.getItem("k8s_namespaces");
+if (stored_namespaces) {
+    configured_namespaces = stored_namespaces
+        .split(",")
+        .map(function (ns) {
+            return ns.trim();
+        })
+        .filter(function (ns) {
+            return ns !== "";
+        });
+}
 var endpoint = "";
 var modal_opened = false;
 var autoPilot = false;
diff --git a/html/js/kubeinvaders.js b/html/js/kubeinvaders.js
index 608a2b2..e20af02 100644
--- a/html/js/kubeinvaders.js
+++ b/html/js/kubeinvaders.js
@@ -64,14 +64,47 @@ function setSystemSettings() {
 
     sys_element = document.getElementById('sys_openresty_env_vars');
     sys_element.value = selected_env_vars;
-    
-    checkHTTP(k8s_url, 'sys_k8s_proxied_api_http_status_code')
+
+    (function waitForK8sUrl() {
+        if (k8s_url) {
+            if (k8s_url !== "" && /^https?:\/\/.+/.test(k8s_url)) {
+                checkHTTP(k8s_url, 'sys_k8s_proxied_api_http_status_code');
+            }
+            return;
+        }
+        setTimeout(waitForK8sUrl, 100);
+    })();
 }
 
 function currentChaosContainerJsonTextAreaVal() {
     return editor_chaos_container_definition.getValue();
 }
 
+function parseJsonResponseOrNull(xhr, requestLabel) {
+    if (xhr.status < 200 || xhr.status >= 300) {
+        console.warn("[K-INV] " + requestLabel + " returned status " + xhr.status);
+        return null;
+    }
+
+    try {
+        return JSON.parse(xhr.responseText);
+    } catch (error) {
+        console.error("[K-INV] " + requestLabel + " returned non-JSON response", error);
+        return null;
+    }
+}
+
+function getConfiguredK8sApiEndpoint() {
+    var endpoint = localStorage.getItem('k8s_api_endpoint') || '';
+    return endpoint.trim();
+}
+
+function openKubeApiRequest(oReq, method, path, async) {
+    var requestUrl = appendK8sTargetParam(k8s_url + path);
+    oReq.open(method, requestUrl, async !== false);
+    applyK8sConnectionHeaders(oReq);
+}
+
 function setCodeNameToTextInput(elementId) {
     var oReq = new XMLHttpRequest();
     oReq.onreadystatechange = function () {
@@ -230,20 +263,30 @@ function runKubeLinter() {
 
     $('#currentKubeLinterResult').text('KubeLinter launched. Set this regex and start log tail: {"since": "60", "pod":".*", "namespace":"' + namespace + '", "labels":".*", "annotations":".*", "containers":".*"}');
 
-    oReq.open("GET", k8s_url + "/kube/kube-linter?logid=" + random_code +"&namespace=" + namespace);
+    openKubeApiRequest(oReq, "GET", "/kube/kube-linter?logid=" + random_code +"&namespace=" + namespace);
     oReq.send();
 }
 
 function getNamespaces() {
+    if (configured_namespaces && configured_namespaces.length > 0) {
+        namespaces = configured_namespaces;
+        namespaces_index = 0;
+        namespace = namespaces[namespaces_index];
+        console.log("[CURRENT-NAMESPACE] " + namespace);
+        $('#currentGameNamespace').text(namespace);
+        return;
+    }
+
     var oReq = new XMLHttpRequest();
     oReq.onload = function () {
         namespaces = this.responseText;
         namespaces = namespaces.split(",");
+        namespaces_index = 0;
         namespace = namespaces[namespaces_index];
         console.log("[CURRENT-NAMESPACE] " + namespace);
         $('#currentGameNamespace').text(namespace);
     };;
-    oReq.open("GET", k8s_url + "/kube/namespaces");
+    openKubeApiRequest(oReq, "GET", "/kube/namespaces");
     oReq.send();
 }
 
@@ -252,7 +295,7 @@ function getEndpoint() {
     oReq.onload = function () {
         endpoint = this.responseText;
     };;
-    oReq.open("GET", k8s_url + "/kube/endpoint");
+    openKubeApiRequest(oReq, "GET", "/kube/endpoint");
     oReq.send();
 }
 
@@ -264,13 +307,13 @@ function getCurrentChaosContainer() {
         editor_chaos_container_definition.setValue(job_parsed);
         editor_chaos_container_definition.refresh();  
     };;
-    oReq.open("GET", k8s_url + "/kube/chaos/containers?action=container_definition");
+    openKubeApiRequest(oReq, "GET", "/kube/chaos/containers?action=container_definition");
     oReq.send();
 }
 
 function enableLogTail() {
     var oReq = new XMLHttpRequest();
-    oReq.open("POST", k8s_url + "/kube/chaos/containers?action=enable_log_tail&id=" + random_code, true);
+    openKubeApiRequest(oReq, "POST", "/kube/chaos/containers?action=enable_log_tail&id=" + random_code, true);
     oReq.onreadystatechange = function () {
         if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
             $('#alert_placeholder3').replaceWith(log_tail_alert + 'Logs tail started </div>');
@@ -283,7 +326,7 @@ function enableLogTail() {
 
 function disableLogTail() {
     var oReq = new XMLHttpRequest();
-    oReq.open("POST", k8s_url + "/kube/chaos/containers?action=disable_log_tail&id=" + random_code, true);
+    openKubeApiRequest(oReq, "POST", "/kube/chaos/containers?action=disable_log_tail&id=" + random_code, true);
     oReq.onreadystatechange = function () {
         if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
             $('#alert_placeholder3').replaceWith(log_tail_alert + 'Logs tail stopped </div>');
@@ -298,7 +341,7 @@ function setLogRegex() {
     log_tail_div.style.display = "block";
     $('#alert_placeholder3').replaceWith(log_tail_alert + 'Setting regex for filtering log source (by pod name)</div>');
     var oReq = new XMLHttpRequest();
-    oReq.open("POST", k8s_url + "/kube/chaos/containers?action=set_log_regex&id=" + random_code, true);
+    openKubeApiRequest(oReq, "POST", "/kube/chaos/containers?action=set_log_regex&id=" + random_code, true);
     oReq.onreadystatechange = function () {
         if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
             $('#alert_placeholder3').replaceWith(log_tail_alert + 'New regex has been configured</div>');
@@ -314,7 +357,7 @@ function setChaosContainer() {
     }
     else {
         var oReq = new XMLHttpRequest();
-        oReq.open("POST", k8s_url + "/kube/chaos/containers?action=set", true);
+        openKubeApiRequest(oReq, "POST", "/kube/chaos/containers?action=set", true);
 
         oReq.onreadystatechange = function () {
             if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
@@ -332,7 +375,7 @@ function startChaosNode(node_name) {
         $('#alert_placeholder').replaceWith(alert_div + 'Latest action: Launched chaos job against ' + node_name + '</div>');
     };;
     $('#alert_placeholder').replaceWith(alert_div + 'Latest action: Start chaos job against ' + node_name + '</div>');
-    oReq.open("GET", k8s_url + "/kube/chaos/nodes?nodename=" + node_name + "&namespace=" + namespace);
+    openKubeApiRequest(oReq, "GET", "/kube/chaos/nodes?nodename=" + node_name + "&namespace=" + namespace);
     oReq.send();
 }
 
@@ -342,7 +385,7 @@ function rebootVirtualMachine(vm_name) {
         $('#alert_placeholder').replaceWith(alert_div + 'Latest action: Reboot virtual machine ' + vm_name + '</div>');
     };;
     $('#alert_placeholder').replaceWith(alert_div + 'Latest action: Preparing virtual machine ' + vm_name + '</div>');
-    oReq.open("GET", k8s_url + "/kube/vm_reboot?vm_name=" + vm_name + "&namespace=" + namespace);
+    openKubeApiRequest(oReq, "GET", "/kube/vm_reboot?vm_name=" + vm_name + "&namespace=" + namespace);
     oReq.send();
 }
 
@@ -351,7 +394,7 @@ function deletePods(pod_name) {
     oReq.onload = function () {
         $('#alert_placeholder').replaceWith(alert_div + 'Latest action: Kill ' + pod_name + '</div>');
     };;
-    oReq.open("GET", k8s_url + "/kube/pods?action=delete&pod_name=" + pod_name + "&namespace=" + namespace);
+    openKubeApiRequest(oReq, "GET", "/kube/pods?action=delete&pod_name=" + pod_name + "&namespace=" + namespace);
     oReq.send();
 }
 
@@ -368,9 +411,18 @@ function addNodeAndVMstoPods() {
 
 function getPods() {
     if (chaos_pods) {
+        if (!namespace) {
+            return;
+        }
+
         var oReq = new XMLHttpRequest();
         oReq.onload = function () {
-            let new_pods = JSON.parse(this.responseText)["items"];
+            var jsonData = parseJsonResponseOrNull(this, "GET /kube/pods?action=list");
+            if (!jsonData || !Array.isArray(jsonData.items)) {
+                return;
+            }
+
+            let new_pods = jsonData.items;
             
             // Pod might just be killed in game, but not terminated in k8s yet.
             for (i=0; i<new_pods.length; i++) {
@@ -381,7 +433,7 @@ function getPods() {
             pods = new_pods;
             addNodeAndVMstoPods();
         };;
-        oReq.open("GET", k8s_url + "/kube/pods?action=list&namespace=" + namespace);
+        openKubeApiRequest(oReq, "GET", "/kube/pods?action=list&namespace=" + encodeURIComponent(namespace));
         oReq.send();
     }
     else {
@@ -394,10 +446,14 @@ function getNodes() {
     if (chaos_nodes) {
         var oReq = new XMLHttpRequest();
         oReq.onload = function () {
-            json_parsed = JSON.parse(this.responseText);
-            nodes = json_parsed["items"];
+            var jsonData = parseJsonResponseOrNull(this, "GET /kube/nodes");
+            if (!jsonData || !Array.isArray(jsonData.items)) {
+                return;
+            }
+
+            nodes = jsonData.items;
         };;
-        oReq.open("GET", k8s_url + "/kube/nodes");
+        openKubeApiRequest(oReq, "GET", "/kube/nodes");
         oReq.send();
     }
     else {
@@ -409,7 +465,11 @@ function getVMs() {
     if (chaos_vms) {
         var oReq = new XMLHttpRequest();
         oReq.onload = function () {
-            const jsonData = JSON.parse(this.responseText);
+            const jsonData = parseJsonResponseOrNull(this, "GET /kube/vm");
+            if (!jsonData || !Array.isArray(jsonData.items)) {
+                return;
+            }
+
             virtualMachines = [];
             Array.from(jsonData.items).forEach(vm => {
                 const name = vm.metadata.name; // Nome della VM
@@ -417,7 +477,7 @@ function getVMs() {
                 virtualMachines.push({ name: name, status: status });
             });
         };;
-        oReq.open("GET", k8s_url + "/kube/vm?namespace=" + namespace);
+        openKubeApiRequest(oReq, "GET", "/kube/vm?namespace=" + namespace);
         oReq.send();
     }
     else {
@@ -906,9 +966,12 @@ document.addEventListener("keydown", keyDownHandler, false);
 document.addEventListener("keyup", keyUpHandler, false);
 
 setSystemSettings();
-getEndpoint();
-getNamespaces();
-getSavedPresets();
+
+waitForReachableK8sUrl(function () {
+    getEndpoint();
+    getNamespaces();
+    getSavedPresets();
+});
 
 document.getElementById("gameContainer").style.visibility = "hidden";
 document.getElementById("metricsPresetsRow").style.visibility = "hidden";
@@ -922,4 +985,28 @@ document.getElementById("metricsPresetsRow").style.opacity = 1;
 // TO DO: Apply also when modals are opened
 $('.modal').on('hidden.bs.modal', function () {
  setModalState(false);
-});
\ No newline at end of file
+});
+
+function waitForReachableK8sUrl(onReady, retryMs = 500) {
+    (function poll() {
+        if (!k8s_url || !/^https?:\/\/.+/.test(k8s_url)) {
+            return setTimeout(poll, retryMs);
+        }
+
+        var oReq = new XMLHttpRequest();
+        oReq.timeout = 5000;
+        oReq.onreadystatechange = function () {
+            if (this.readyState === XMLHttpRequest.DONE) {
+                if (this.status >= 200 && this.status < 500) {
+                    onReady();
+                } else {
+                    setTimeout(poll, retryMs);
+                }
+            }
+        };
+        oReq.ontimeout = function () { setTimeout(poll, retryMs); };
+        oReq.onerror = function () { setTimeout(poll, retryMs); };
+        oReq.open('GET', k8s_url, true);
+        oReq.send();
+    })();
+}
\ No newline at end of file
diff --git a/html/js/programming_mode.js b/html/js/programming_mode.js
index 750fb6e..cf4c720 100644
--- a/html/js/programming_mode.js
+++ b/html/js/programming_mode.js
@@ -92,7 +92,9 @@ function runChaosProgram() {
   }
 
   var oReq = new XMLHttpRequest();
-  oReq.open("POST", k8s_url + "/kube/chaos/programming_mode?id=" + random_code, true);
+    var programmingModeUrl = appendK8sTargetParam(k8s_url + "/kube/chaos/programming_mode?id=" + random_code);
+    oReq.open("POST", programmingModeUrl, true);
+    applyK8sConnectionHeaders(oReq);
   oReq.onreadystatechange = function () {
       if (this.readyState === XMLHttpRequest.DONE && this.status == 200) {
         //console.log("[PROGRAMMING_MODE] Chaos program loaded... HTTP Status code: " + this.status);
diff --git a/html/js/utils.js b/html/js/utils.js
index fde78ab..0271704 100644
--- a/html/js/utils.js
+++ b/html/js/utils.js
@@ -16,10 +16,364 @@
 
 /* Utility Functions */
 
+function parseNamespacesInput(input) {
+  if (!input) {
+    return [];
+  }
+
+  return input
+    .split(',')
+    .map(function (ns) {
+      return ns.trim();
+    })
+    .filter(function (ns) {
+      return ns !== '';
+    });
+}
+
+function normalizeK8sEndpoint(rawEndpoint) {
+  if (!rawEndpoint) {
+    return null;
+  }
+
+  var endpoint = rawEndpoint.trim();
+  if (endpoint === '') {
+    return null;
+  }
+
+  if (!/^https?:\/\//i.test(endpoint)) {
+    endpoint = 'https://' + endpoint;
+  }
+
+  var parsedUrl;
+  try {
+    parsedUrl = new URL(endpoint);
+  } catch (error) {
+    return null;
+  }
+
+  if (!parsedUrl.hostname) {
+    return null;
+  }
+
+  // Keep protocol, host, port and optional base path, but remove trailing slash.
+  return (parsedUrl.origin + parsedUrl.pathname).replace(/\/+$/, '');
+}
+
+function getK8sTargetUrl() {
+  var endpointInput = document.getElementById('k8s_api_endpoint');
+  var storedEndpoint = localStorage.getItem('k8s_api_endpoint') || '';
+  var rawEndpoint = endpointInput && endpointInput.value.trim() !== ''
+    ? endpointInput.value.trim()
+    : storedEndpoint;
+
+  var normalizedEndpoint = normalizeK8sEndpoint(rawEndpoint);
+  if (!normalizedEndpoint) {
+    throw new Error('Invalid Kubernetes API endpoint. Use a full endpoint like https://localhost:6443 or http://kubernetes.default.svc');
+  }
+
+  if (endpointInput) {
+    endpointInput.value = normalizedEndpoint;
+  }
+
+  return normalizedEndpoint;
+}
+
+function buildNetworkErrorMessage(targetUrl, action) {
+  var message = action + ' failed: network error while reaching ' + targetUrl + '/healthz.';
+  if (/^https:\/\/(localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(\/|$)/i.test(targetUrl)) {
+    return message + ' Possible cause: TLS certificate is not trusted (ERR_CERT_AUTHORITY_INVALID). Browsers cannot ignore invalid TLS certificates for XHR requests.';
+  }
+
+  return message + ' Possible causes: DNS error (ERR_NAME_NOT_RESOLVED), TLS certificate issue, or unreachable endpoint.';
+}
+
+function getK8sCaCert() {
+  var caCertInput = document.getElementById('k8s_ca_cert');
+  if (!caCertInput) {
+    return '';
+  }
+
+  return caCertInput.value || '';
+}
+
+function getK8sToken() {
+  var tokenInput = document.getElementById('k8s_token');
+  if (!tokenInput) {
+    return '';
+  }
+
+  return tokenInput.value || '';
+}
+
+function getStoredK8sConnectionConfig() {
+  return {
+    target: (localStorage.getItem('k8s_api_endpoint') || '').trim(),
+    token: getK8sToken().trim(),
+    caCert: getK8sCaCert()
+  };
+}
+
+function appendK8sTargetParam(url) {
+  var cfg = getStoredK8sConnectionConfig();
+  if (!cfg.target) {
+    return url;
+  }
+
+  var separator = url.indexOf('?') === -1 ? '?' : '&';
+  return url + separator + 'target=' + encodeURIComponent(cfg.target);
+}
+
+function applyK8sConnectionHeaders(xhr) {
+  var cfg = getStoredK8sConnectionConfig();
+
+  if (cfg.target) {
+    xhr.setRequestHeader('X-K8S-Target', cfg.target);
+  }
+
+  if (cfg.token) {
+    xhr.setRequestHeader('X-K8S-Token', cfg.token);
+  }
+
+  if (cfg.caCert) {
+    try {
+      xhr.setRequestHeader('X-K8S-CA-CERT-B64', btoa(cfg.caCert));
+    } catch (error) {
+      console.warn('[K8S-CONNECTION] Unable to encode CA cert header', error);
+    }
+  }
+}
+
+function requestBackendHealthz(targetUrl, action, caCert) {
+  return new Promise(function(resolve, reject) {
+    var oReq = new XMLHttpRequest();
+    oReq.timeout = 5000;
+
+    oReq.onreadystatechange = function() {
+      if (this.readyState === XMLHttpRequest.DONE) {
+        var payload = null;
+        try {
+          payload = this.responseText ? JSON.parse(this.responseText) : null;
+        } catch (error) {
+          payload = null;
+        }
+
+        if (this.status === 200 && (!payload || payload.ok === true)) {
+          resolve(payload || true);
+        } else {
+          var errorDetails = '';
+          if (payload && payload.error) {
+            errorDetails = ' (' + payload.error + ')';
+          } else if (payload && payload.body) {
+            errorDetails = ' (' + payload.body + ')';
+          } else if (this.responseText) {
+            errorDetails = ' (' + this.responseText + ')';
+          }
+
+          reject(new Error(action + ' failed with status: ' + this.status + errorDetails));
+        }
+      }
+    };
+
+    oReq.ontimeout = function() {
+      reject(new Error(action + ' timeout'));
+    };
+
+    oReq.onerror = function() {
+      reject(new Error(buildNetworkErrorMessage(targetUrl, action)));
+    };
+
+    oReq.open('POST', '/kube/healthz', true);
+    oReq.setRequestHeader('Content-Type', 'application/json');
+    oReq.send(JSON.stringify({
+      target: targetUrl,
+      ca_cert: caCert || ''
+    }));
+  });
+}
+
+var connectionStatusHideTimers = {};
+
+function clearConnectionStatus(prefix) {
+  prefix = prefix || 'k8s-connection';
+  var statusDiv = document.getElementById(prefix + '-status');
+  var successDiv = document.getElementById(prefix + '-success');
+  var errorDiv = document.getElementById(prefix + '-error');
+  var errorMsgSpan = document.getElementById(prefix + '-error-msg');
+
+  if (connectionStatusHideTimers[prefix]) {
+    clearTimeout(connectionStatusHideTimers[prefix]);
+    connectionStatusHideTimers[prefix] = null;
+  }
+
+  if (statusDiv) statusDiv.style.display = 'none';
+  if (successDiv) successDiv.style.display = 'none';
+  if (errorDiv) errorDiv.style.display = 'none';
+  if (errorMsgSpan) errorMsgSpan.textContent = '';
+}
+
+function showConnectionStatus(message, isError, prefix, autoHideDelay) {
+  prefix = prefix || 'k8s-connection';
+  var statusDiv = document.getElementById(prefix + '-status');
+  var successDiv = document.getElementById(prefix + '-success');
+  var errorDiv = document.getElementById(prefix + '-error');
+  var errorMsgSpan = document.getElementById(prefix + '-error-msg');
+
+  if (!statusDiv) {
+    console.log('[K8S-CONNECTION] ' + message);
+    return;
+  }
+
+  statusDiv.style.display = 'block';
+  if (successDiv) successDiv.style.display = 'none';
+  if (errorDiv) errorDiv.style.display = 'none';
+
+  if (connectionStatusHideTimers[prefix]) {
+    clearTimeout(connectionStatusHideTimers[prefix]);
+    connectionStatusHideTimers[prefix] = null;
+  }
+
+  if (isError) {
+    if (errorDiv) errorDiv.style.display = 'block';
+    if (errorMsgSpan) errorMsgSpan.textContent = message;
+  } else {
+    if (successDiv) successDiv.style.display = 'block';
+  }
+
+  if (autoHideDelay && autoHideDelay > 0) {
+    connectionStatusHideTimers[prefix] = setTimeout(function () {
+      clearConnectionStatus(prefix);
+    }, autoHideDelay);
+  }
+}
+
+function testK8sConnectionRequest() {
+  return new Promise((resolve, reject) => {
+    var targetUrl;
+    var caCert = getK8sCaCert();
+    try {
+      targetUrl = getK8sTargetUrl();
+    } catch (error) {
+      reject(error);
+      return;
+    }
+
+    requestBackendHealthz(targetUrl, 'Connection test', caCert)
+      .then(function () {
+        resolve(true);
+      })
+      .catch(function (error) {
+        reject(error);
+      });
+  });
+}
+
+function saveK8sConnectionRequest() {
+  return new Promise((resolve, reject) => {
+    const namespacesInput = document.getElementById('k8s_namespaces');
+    const namespacesRaw = namespacesInput ? namespacesInput.value.trim() : '';
+    const caCert = getK8sCaCert();
+    let targetUrl;
+
+    try {
+      targetUrl = getK8sTargetUrl();
+    } catch (error) {
+      reject(error);
+      return;
+    }
+
+    requestBackendHealthz(targetUrl, 'Save', caCert)
+      .then(function () {
+        localStorage.setItem('k8s_api_endpoint', targetUrl);
+        localStorage.setItem('k8s_namespaces', namespacesRaw);
+        localStorage.setItem('k8s_ca_cert', caCert);
+        configured_namespaces = parseNamespacesInput(namespacesRaw);
+        resolve(true);
+      })
+      .catch(function (error) {
+        reject(error);
+      });
+  });
+}
+
+function testK8sConnection() {
+  clearConnectionStatus('k8s-connection');
+
+  return testK8sConnectionRequest()
+    .then(function () {
+      showConnectionStatus('Connection test succeeded.', false, 'k8s-connection', 3000);
+      return true;
+    })
+    .catch(function (error) {
+      showConnectionStatus(error.message, true, 'k8s-connection', 3000);
+      return false;
+    });
+}
+
+function saveK8sConnection() {
+  clearConnectionStatus('k8s-save');
+
+  return saveK8sConnectionRequest()
+    .then(function () {
+      if (typeof setSystemSettings === 'function') {
+        setSystemSettings();
+      }
+      if (typeof getEndpoint === 'function') {
+        getEndpoint();
+      }
+      if (typeof getNamespaces === 'function') {
+        getNamespaces();
+      }
+
+      showConnectionStatus('', false, 'k8s-save', 3000);
+      return true;
+    })
+    .catch(function (error) {
+      showConnectionStatus(error.message, true, 'k8s-save', 3000);
+      return false;
+    });
+}
+
 document.addEventListener("DOMContentLoaded", function() {
+  // Migrate old localStorage key name used in earlier versions
+  var legacyK8sUrl = localStorage.getItem("k8s_url");
+  if (legacyK8sUrl && !localStorage.getItem("k8s_api_endpoint")) {
+    localStorage.setItem("k8s_api_endpoint", legacyK8sUrl);
+    localStorage.removeItem("k8s_url");
+  }
+
+  var endpointInput = document.getElementById("k8s_api_endpoint");
+  var namespacesInput = document.getElementById("k8s_namespaces");
+  var caCertInput = document.getElementById("k8s_ca_cert");
+  var storedK8sUrl = localStorage.getItem("k8s_api_endpoint");
+  var storedNamespaces = localStorage.getItem("k8s_namespaces");
+  var storedCaCert = localStorage.getItem("k8s_ca_cert");
+
+  if (endpointInput) {
+    endpointInput.value = storedK8sUrl || '';
+  }
+
+  if (namespacesInput) {
+    namespacesInput.value = storedNamespaces || "";
+  }
+
+  if (caCertInput) {
+    caCertInput.value = storedCaCert || "";
+  }
+
+  configured_namespaces = parseNamespacesInput(storedNamespaces || "");
+
   setTimeout(function() {
-      document.getElementById("splash-screen").style.display = "none";
-      document.getElementById("main-game-div").style.display = "block";
+      var splashScreen = document.getElementById("splash-screen");
+      var mainGameDiv = document.getElementById("main-game-div");
+
+      if (splashScreen) {
+        splashScreen.style.display = "none";
+      }
+
+      if (mainGameDiv) {
+        mainGameDiv.style.display = "block";
+      }
   }, 2000);
 });
 
diff --git a/nginx/KubeInvaders.conf b/nginx/KubeInvaders.conf
index 29226b8..3cb3abe 100644
--- a/nginx/KubeInvaders.conf
+++ b/nginx/KubeInvaders.conf
@@ -74,6 +74,119 @@ server {
     access_by_lua_file "/usr/local/openresty/nginx/conf/kubeinvaders/vm_reboot.lua";
   }
 
+  location /kube/healthz {
+    content_by_lua_block {
+      local https = require "ssl.https"
+      local ltn12 = require "ltn12"
+      local json = require "lunajson"
+
+      ngx.header['Access-Control-Allow-Origin'] = '*'
+      ngx.header['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
+      ngx.header['Access-Control-Allow-Headers'] = 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'
+      ngx.header['Access-Control-Expose-Headers'] = 'Content-Length,Content-Range';
+
+      if ngx.var.request_method == "OPTIONS" then
+        ngx.status = 204
+        return
+      end
+
+      local args = ngx.req.get_uri_args()
+      local target = args["target"]
+      local ca_cert = nil
+
+      if ngx.var.request_method == "POST" then
+        ngx.req.read_body()
+        local data = ngx.req.get_body_data()
+
+        if data and data ~= "" then
+          local ok, decoded = pcall(json.decode, data)
+          if ok and decoded then
+            if decoded["target"] and decoded["target"] ~= "" then
+              target = decoded["target"]
+            end
+            if decoded["ca_cert"] and decoded["ca_cert"] ~= "" then
+              ca_cert = decoded["ca_cert"]
+            end
+          end
+        end
+      end
+
+      if not target or target == "" then
+        if os.getenv("KUBERNETES_SERVICE_HOST") then
+          target = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+        else
+          target = os.getenv("ENDPOINT")
+        end
+      end
+
+      if not target or target == "" then
+        ngx.status = 400
+        ngx.say("Missing Kubernetes endpoint")
+        return
+      end
+
+      if not string.match(target, "^https?://") then
+        target = "https://" .. target
+      end
+
+      target = string.gsub(target, "/+$", "")
+      local healthz_url = target .. "/healthz"
+
+      local disable_tls_env = string.lower(tostring(os.getenv("DISABLE_TLS") or "false"))
+      local disable_tls = disable_tls_env == "true" or disable_tls_env == "1" or disable_tls_env == "yes"
+
+      local request_opts = {
+        url = healthz_url,
+        method = "GET",
+        verify = disable_tls and "none" or "peer"
+      }
+
+      if not disable_tls and ca_cert and ca_cert ~= "" then
+        local ca_file_path = "/tmp/kubeinv-custom-ca.crt"
+        local ca_file = io.open(ca_file_path, "w")
+
+        if not ca_file then
+          ngx.status = 500
+          ngx.say("Unable to persist CA certificate")
+          return
+        end
+
+        ca_file:write(ca_cert)
+        ca_file:close()
+        request_opts.cafile = ca_file_path
+      end
+
+      local resp = {}
+      request_opts.sink = ltn12.sink.table(resp)
+      local ok, statusCode, response_headers, status_line = https.request(request_opts)
+      local numeric_status = tonumber(statusCode)
+
+      if not numeric_status then
+        numeric_status = ok and 200 or 502
+      end
+
+      ngx.status = numeric_status
+      ngx.header['Content-Type'] = 'application/json'
+
+      local body = table.concat(resp)
+      local response = {
+        ok = ok and numeric_status >= 200 and numeric_status < 300,
+        status = numeric_status,
+        target = healthz_url
+      }
+
+      if body ~= "" then
+        response["body"] = body
+      end
+
+      if not ok then
+        response["error"] = tostring(statusCode or "unknown")
+      end
+
+      ngx.say(json.encode(response))
+    }
+  }
+
   location /kube/chaos/programming_mode {
     access_by_lua_file "/usr/local/openresty/nginx/conf/kubeinvaders/programming_mode.lua";
   }
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 5308e49..fc550fe 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -1,5 +1,5 @@
 worker_processes  2;
-error_log  /dev/stdout info;
+error_log  /dev/stdout debug;
 pid        /var/run/nginx.pid;
 env REDIS_HOST;
 env TOKEN;
@@ -16,14 +16,16 @@ events {
 }
 
 http {
-    include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
     log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
-                      '"$http_user_agent" "$http_x_forwarded_for"';
+                      '"$http_user_agent" "$http_x_forwarded_for" '
+                      'rt=$request_time uct=$upstream_connect_time uht=$upstream_header_time urt=$upstream_response_time '
+                      'cs=$upstream_cache_status';
 
     access_log  /dev/stdout  main;
+    error_log   /dev/stderr  debug;
     sendfile        on;
     keepalive_timeout  30;
     client_body_buffer_size 1000K;
diff --git a/scripts/chaos-node.lua b/scripts/chaos-node.lua
index 9a88654..60c9844 100644
--- a/scripts/chaos-node.lua
+++ b/scripts/chaos-node.lua
@@ -22,15 +22,57 @@ local http = require("socket.http")
 math.randomseed(os.clock()*100000000000)
 local rand = math.random(999, 9999)
 local arg = ngx.req.get_uri_args()
+local req_headers = ngx.req.get_headers()
 local k8s_url = ""
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
 
-if os.getenv("KUBERNETES_SERVICE_HOST") then
-  k8s_url = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+if kube_host and kube_host ~= "" then
+  local port_suffix = ""
+  if kube_port and kube_port ~= "" then
+    port_suffix = ":" .. kube_port
+  end
+  k8s_url = "https://" .. kube_host .. port_suffix
 else
-  k8s_url = os.getenv("ENDPOINT")
+  k8s_url = endpoint or ""
 end
 
-local token = os.getenv("TOKEN")
+local target = arg['target'] or req_headers["x-k8s-target"] or req_headers["X-K8S-Target"]
+if target and target ~= "" then
+  if not string.match(target, "^https?://") then
+    target = "https://" .. target
+  end
+  k8s_url = string.gsub(target, "/+$", "")
+end
+
+if k8s_url == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes endpoint configuration. Set KUBERNETES_SERVICE_HOST or ENDPOINT.")
+  ngx.exit(ngx.OK)
+end
+
+if not string.match(k8s_url, "^https?://") then
+  k8s_url = "https://" .. k8s_url
+end
+
+k8s_url = string.gsub(k8s_url, "/+$", "")
+
+local token = req_headers["x-k8s-token"] or req_headers["X-K8S-Token"] or tostring(os.getenv("TOKEN") or "")
+if token == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes API token configuration.")
+  ngx.exit(ngx.OK)
+end
+
+local ca_cert_b64 = req_headers["x-k8s-ca-cert-b64"] or req_headers["X-K8S-CA-CERT-B64"]
+local ca_cert = nil
+if ca_cert_b64 and ca_cert_b64 ~= "" then
+  ca_cert = ngx.decode_base64(ca_cert_b64)
+end
+
+local disable_tls_env = string.lower(tostring(os.getenv("DISABLE_TLS") or "false"))
+local disable_tls = disable_tls_env == "true" or disable_tls_env == "1" or disable_tls_env == "yes"
 local namespace = arg['namespace']
 local node_name =  arg['nodename']
 local url = k8s_url .. "/apis/batch/v1/namespaces/" .. namespace  .. "/jobs"
@@ -123,16 +165,38 @@ local headers2 = {
   ["Content-Length"] = string.len(body)
 }
 
+local function create_request_opts(request_url, request_headers, request_method, request_source)
+  local request_opts = {
+    url = request_url,
+    headers = request_headers,
+    method = request_method,
+    verify = disable_tls and "none" or "peer",
+    sink = ltn12.sink.table(resp)
+  }
+
+  if request_source then
+    request_opts.source = request_source
+  end
+
+  if not disable_tls and ca_cert and ca_cert ~= "" then
+    local ca_file_path = "/tmp/kubeinv-custom-ca.crt"
+    local ca_file = io.open(ca_file_path, "w")
+    if ca_file then
+      ca_file:write(ca_cert)
+      ca_file:close()
+      request_opts.cafile = ca_file_path
+    end
+  end
+
+  return request_opts
+end
+
 local url = k8s_url .. "/apis/batch/v1/namespaces/" .. namespace  .. "/jobs"
 ngx.log(ngx.INFO, "Creating chaos_node job kubeinvaders-chaos-" ..rand)
 
-local ok, statusCode, headers, statusText = https.request{
-  url = url,
-  headers = headers2,
-  method = "POST",
-  sink = ltn12.sink.table(resp),
-  source = ltn12.source.string(body)
-}
+local ok, statusCode, headers, statusText = https.request(
+  create_request_opts(url, headers2, "POST", ltn12.source.string(body))
+)
 
 ngx.log(ngx.INFO, ok)
 ngx.log(ngx.INFO, statusCode)
@@ -141,12 +205,9 @@ ngx.log(ngx.INFO, statusText)
 local url = k8s_url.. "/apis/batch/v1/namespaces/" .. namespace  .. "/jobs"
 ngx.log(ngx.INFO, "Getting JobList" .. rand)
 
-local ok, statusCode, headers, statusText = https.request{
-  url = url,
-  headers = headers,
-  method = "GET",
-  sink = ltn12.sink.table(resp)
-}
+local ok, statusCode, headers, statusText = https.request(
+  create_request_opts(url, headers, "GET")
+)
 
 ngx.log(ngx.INFO, ok)
 ngx.log(ngx.INFO, statusCode)
@@ -167,12 +228,9 @@ end
 local url = k8s_url.. "/api/v1/namespaces/" .. namespace  .. "/pods"
 ngx.log(ngx.INFO, "Getting PodList" .. rand)
 
-local ok, statusCode, headers, statusText = https.request{
-  url = url,
-  headers = headers,
-  method = "GET",
-  sink = ltn12.sink.table(resp)
-}
+local ok, statusCode, headers, statusText = https.request(
+  create_request_opts(url, headers, "GET")
+)
 
 ngx.log(ngx.INFO, ok)
 ngx.log(ngx.INFO, statusCode)
diff --git a/scripts/ingress.lua b/scripts/ingress.lua
index 2b74358..c274cb3 100644
--- a/scripts/ingress.lua
+++ b/scripts/ingress.lua
@@ -5,6 +5,12 @@ local redis = require "resty.redis"
 local http = require("resty.http")
 
 local k8s_url = ""
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
 
 function convert_table_to_string(table)
   local str = ""
@@ -23,15 +29,61 @@ function check_table_key_exists(table, key)
   return false
 end
 
-if os.getenv("KUBERNETES_SERVICE_HOST") then
-  k8s_url = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+if kube_host and kube_host ~= "" then
+  local port_suffix = ""
+  if kube_port and kube_port ~= "" then
+    port_suffix = ":" .. kube_port
+  end
+  k8s_url = "https://" .. kube_host .. port_suffix
 else
-  k8s_url = os.getenv("ENDPOINT")
+  k8s_url = endpoint or ""
 end
 
-local token = os.getenv("TOKEN")
+if k8s_url == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes endpoint configuration. Set KUBERNETES_SERVICE_HOST or ENDPOINT.")
+  ngx.exit(ngx.OK)
+end
+
+if not string.match(k8s_url, "^https?://") then
+  k8s_url = "https://" .. k8s_url
+end
+
+k8s_url = string.gsub(k8s_url, "/+$", "")
+
+local req_headers = ngx.req.get_headers()
+local target = arg["target"] or req_headers["x-k8s-target"] or req_headers["X-K8S-Target"]
+if target and target ~= "" then
+  if not string.match(target, "^https?://") then
+    target = "https://" .. target
+  end
+  k8s_url = string.gsub(target, "/+$", "")
+end
+
+local token = req_headers["x-k8s-token"] or req_headers["X-K8S-Token"] or tostring(os.getenv("TOKEN") or "")
+if token == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes API token configuration.")
+  ngx.exit(ngx.OK)
+end
+
+local ca_cert_b64 = req_headers["x-k8s-ca-cert-b64"] or req_headers["X-K8S-CA-CERT-B64"]
+local ca_cert = nil
+if ca_cert_b64 and ca_cert_b64 ~= "" then
+  ca_cert = ngx.decode_base64(ca_cert_b64)
+end
+
+local disable_tls_env = string.lower(tostring(os.getenv("DISABLE_TLS") or "false"))
+local disable_tls = disable_tls_env == "true" or disable_tls_env == "1" or disable_tls_env == "yes"
+
 local arg = ngx.req.get_uri_args()
 local namespace = arg["namespace"]
+if not namespace or namespace == "" then
+  ngx.status = 400
+  ngx.say("Missing required query parameter: namespace")
+  ngx.exit(ngx.OK)
+end
+
 local url = k8s_url .. "/apis/networking.k8s.io/v1/namespaces/" .. namespace .. "/ingresses"
 local decoded = nil
 local host_list = {}
@@ -43,25 +95,37 @@ ngx.header['Access-Control-Expose-Headers'] = 'Content-Length,Content-Range';
 
 ngx.log(ngx.INFO, "Requesting nodes using this url: " .. url)
 
-local httpc = http.new()
+local resp = {}
+local request_opts = {
+  url = url,
+  method = "GET",
+  headers = {
+    ["Accept"] = "application/json",
+    ["Content-Type"] = "application/json",
+    ["Authorization"] = "Bearer " .. token
+  },
+  verify = disable_tls and "none" or "peer",
+  sink = ltn12.sink.table(resp)
+}
 
--- Esegui la richiesta
-local res, err = httpc:request_uri(url, {
-    method = "GET",
-    ssl_verify = false, -- TODO: use a valid certificate
-    headers = {
-        ["Accept"] = "application/json",
-        ["Content-Type"] = "application/json",
-        ["Authorization"] = "Bearer " .. token
-    }
-})
-
-if not res then
-    ngx.log(ngx.ERR, "Errore durante la richiesta HTTP: ", err)
-    return
+if not disable_tls and ca_cert and ca_cert ~= "" then
+  local ca_file_path = "/tmp/kubeinv-custom-ca.crt"
+  local ca_file = io.open(ca_file_path, "w")
+  if ca_file then
+    ca_file:write(ca_cert)
+    ca_file:close()
+    request_opts.cafile = ca_file_path
+  end
 end
 
-decoded = json.decode(res.body)
+local ok, statusCode, response_headers, statusText = https.request(request_opts)
+if not ok then
+  ngx.status = tonumber(statusCode) or 502
+  ngx.say("[]")
+  return
+end
+
+decoded = json.decode(table.concat(resp))
 ngx.log(ngx.ERR, "Decoded: " .. json.encode(decoded))
 
 for k2,v2 in ipairs(decoded["items"]) do
diff --git a/scripts/metrics_loop/start.sh b/scripts/metrics_loop/start.sh
index 16534ae..40b0b2f 100755
--- a/scripts/metrics_loop/start.sh
+++ b/scripts/metrics_loop/start.sh
@@ -8,10 +8,13 @@ else
   export TOKEN="$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)"
 fi
 
-python3 /opt/metrics_loop/start.py https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS} &
+if python3 -c "import urllib.request; urllib.request.urlopen('https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}', timeout=5)" 2>/dev/null; then
+  python3 /opt/metrics_loop/start.py https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS} &
+  while true
+  do
+    pgrep -a -f -c "^python3.*metrics_loop.*$" > /dev/null || ( python3 /opt/metrics_loop/start.py https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS} & )
+    sleep 2
+  done
+fi
+
 
-while true
-do
-  pgrep -a -f -c "^python3.*metrics_loop.*$" > /dev/null || ( python3 /opt/metrics_loop/start.py https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS} & )
-  sleep 2
-done
diff --git a/scripts/node.lua b/scripts/node.lua
index 8b56af3..d18b1c6 100644
--- a/scripts/node.lua
+++ b/scripts/node.lua
@@ -4,15 +4,57 @@ local json = require 'lunajson'
 local redis = require "resty.redis"
 
 local k8s_url = ""
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
 
-if os.getenv("KUBERNETES_SERVICE_HOST") then
-  k8s_url = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+if kube_host and kube_host ~= "" then
+  local port_suffix = ""
+  if kube_port and kube_port ~= "" then
+    port_suffix = ":" .. kube_port
+  end
+  k8s_url = "https://" .. kube_host .. port_suffix
 else
-  k8s_url = os.getenv("ENDPOINT")
+  k8s_url = endpoint or ""
 end
 
-local token = os.getenv("TOKEN")
+local disable_tls_env = string.lower(tostring(os.getenv("DISABLE_TLS") or "false"))
+local disable_tls = disable_tls_env == "true" or disable_tls_env == "1" or disable_tls_env == "yes"
 local arg = ngx.req.get_uri_args()
+local req_headers = ngx.req.get_headers()
+local target = arg['target'] or req_headers["x-k8s-target"] or req_headers["X-K8S-Target"]
+local token = req_headers["x-k8s-token"] or req_headers["X-K8S-Token"] or tostring(os.getenv("TOKEN") or "")
+local ca_cert_b64 = req_headers["x-k8s-ca-cert-b64"] or req_headers["X-K8S-CA-CERT-B64"]
+local ca_cert = nil
+if ca_cert_b64 and ca_cert_b64 ~= "" then
+  ca_cert = ngx.decode_base64(ca_cert_b64)
+end
+
+if target and target ~= "" then
+  if not string.match(target, "^https?://") then
+    target = "https://" .. target
+  end
+  k8s_url = string.gsub(target, "/+$", "")
+end
+
+if k8s_url == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes endpoint configuration. Set KUBERNETES_SERVICE_HOST or ENDPOINT.")
+  ngx.exit(ngx.OK)
+end
+
+if not string.match(k8s_url, "^https?://") then
+  k8s_url = "https://" .. k8s_url
+end
+
+k8s_url = string.gsub(k8s_url, "/+$", "")
+
+if token == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes API token configuration.")
+  ngx.exit(ngx.OK)
+end
+
 local url = k8s_url.. "/api/v1/nodes"
 local decoded = nil
 local nodes = {}
@@ -65,13 +107,26 @@ local headers = {
 
 local resp = {}
 
-local ok, statusCode, headers, statusText = https.request{
+local request_opts = {
   url = url,
   headers = headers,
   method = "GET",
+  verify = disable_tls and "none" or "peer",
   sink = ltn12.sink.table(resp)
 }
 
+if not disable_tls and ca_cert and ca_cert ~= "" then
+  local ca_file_path = "/tmp/kubeinv-custom-ca.crt"
+  local ca_file = io.open(ca_file_path, "w")
+  if ca_file then
+    ca_file:write(ca_cert)
+    ca_file:close()
+    request_opts.cafile = ca_file_path
+  end
+end
+
+local ok, statusCode, headers, statusText = https.request(request_opts)
+
 ngx.log(ngx.INFO, "REQUEST LOGS...")
 ngx.log(ngx.INFO, ok)
 ngx.log(ngx.INFO, statusCode)
diff --git a/scripts/pod.lua b/scripts/pod.lua
index d353781..b881bfb 100644
--- a/scripts/pod.lua
+++ b/scripts/pod.lua
@@ -5,15 +5,56 @@ local redis = require "resty.redis"
 local incr = 0
 
 local k8s_url = ""
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
 
-if os.getenv("KUBERNETES_SERVICE_HOST") then
-  k8s_url = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+if kube_host and kube_host ~= "" then
+  local port_suffix = ""
+  if kube_port and kube_port ~= "" then
+    port_suffix = ":" .. kube_port
+  end
+  k8s_url = "https://" .. kube_host .. port_suffix
 else
-  k8s_url = os.getenv("ENDPOINT")
+  k8s_url = endpoint or ""
 end
 
-local token = os.getenv("TOKEN")
+if k8s_url == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes endpoint configuration. Set KUBERNETES_SERVICE_HOST or ENDPOINT.")
+  ngx.exit(ngx.OK)
+end
+
+if not string.match(k8s_url, "^https?://") then
+  k8s_url = "https://" .. k8s_url
+end
+
+k8s_url = string.gsub(k8s_url, "/+$", "")
+
+local token = tostring(os.getenv("TOKEN") or "")
+if token == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes API token configuration.")
+  ngx.exit(ngx.OK)
+end
+
+local disable_tls_env = string.lower(tostring(os.getenv("DISABLE_TLS") or "false"))
+local disable_tls = disable_tls_env == "true" or disable_tls_env == "1" or disable_tls_env == "yes"
 local arg = ngx.req.get_uri_args()
+local req_headers = ngx.req.get_headers()
+local target = arg['target'] or req_headers["x-k8s-target"] or req_headers["X-K8S-Target"]
+local header_token = req_headers["x-k8s-token"] or req_headers["X-K8S-Token"]
+local ca_cert_b64 = req_headers["x-k8s-ca-cert-b64"] or req_headers["X-K8S-CA-CERT-B64"]
+local ca_cert = nil
+
+if ca_cert_b64 and ca_cert_b64 ~= "" then
+  ca_cert = ngx.decode_base64(ca_cert_b64)
+end
+
+if header_token and header_token ~= "" then
+  token = header_token
+end
+
 local namespace = arg['namespace']
 local decoded = nil
 local action = arg['action']
@@ -22,6 +63,13 @@ local pods = {}
 local method = 'GET'
 local pods_not_found = true;
 
+if target and target ~= "" then
+  if not string.match(target, "^https?://") then
+    target = "https://" .. target
+  end
+  k8s_url = string.gsub(target, "/+$", "")
+end
+
 ngx.header['Access-Control-Allow-Origin'] = '*'
 ngx.header['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
 ngx.header['Access-Control-Allow-Headers'] = 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range'
@@ -82,13 +130,26 @@ local headers = {
 
 local resp = {}
 
-local ok, statusCode, headers, statusText = https.request{
+local request_opts = {
   url = url,
   headers = headers,
   method = method,
+  verify = disable_tls and "none" or "peer",
   sink = ltn12.sink.table(resp)
 }
 
+if not disable_tls and ca_cert and ca_cert ~= "" then
+  local ca_file_path = "/tmp/kubeinv-custom-ca.crt"
+  local ca_file = io.open(ca_file_path, "w")
+  if ca_file then
+    ca_file:write(ca_cert)
+    ca_file:close()
+    request_opts.cafile = ca_file_path
+  end
+end
+
+local ok, statusCode, headers, statusText = https.request(request_opts)
+
 if action == "list" then
   local i = 1
   local j = 0
diff --git a/scripts/programming_mode.lua b/scripts/programming_mode.lua
index e30b432..d8ae931 100644
--- a/scripts/programming_mode.lua
+++ b/scripts/programming_mode.lua
@@ -5,11 +5,47 @@ local redis = require "resty.redis"
 local red = redis:new()
 local okredis, errredis = red:connect("unix:/tmp/redis.sock")
 local k8s_url = ""
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
+local req_headers = ngx.req.get_headers()
+local target = arg["target"] or req_headers["x-k8s-target"] or req_headers["X-K8S-Target"]
+local token = req_headers["x-k8s-token"] or req_headers["X-K8S-Token"] or tostring(os.getenv("TOKEN") or "")
+local ca_cert_b64 = req_headers["x-k8s-ca-cert-b64"] or req_headers["X-K8S-CA-CERT-B64"]
 
-if os.getenv("KUBERNETES_SERVICE_HOST") then
-  k8s_url = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+if kube_host and kube_host ~= "" then
+  local port_suffix = ""
+  if kube_port and kube_port ~= "" then
+    port_suffix = ":" .. kube_port
+  end
+  k8s_url = "https://" .. kube_host .. port_suffix
 else
-  k8s_url = os.getenv("ENDPOINT")
+  k8s_url = endpoint or ""
+end
+
+if target and target ~= "" then
+  if not string.match(target, "^https?://") then
+    target = "https://" .. target
+  end
+  k8s_url = string.gsub(target, "/+$", "")
+end
+
+if not string.match(k8s_url, "^https?://") then
+  k8s_url = "https://" .. k8s_url
+end
+
+k8s_url = string.gsub(k8s_url, "/+$", "")
+
+if k8s_url == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes endpoint configuration. Set KUBERNETES_SERVICE_HOST or ENDPOINT.")
+  ngx.exit(ngx.OK)
+end
+
+if token == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes API token configuration.")
+  ngx.exit(ngx.OK)
 end
 
 if okredis then
@@ -68,7 +104,12 @@ else
 end
 
 ngx.log(ngx.INFO, "[PROGRAMMING_MODE] Starting Chaos Program using /opt/programming_mode/start.py")
-handle = io.popen("python3 /opt/programming_mode/start.py " .. file_name .. " " .. k8s_url .. "; echo $? > " .. file_name .. ".check")
+local ca_cert_env = ""
+if ca_cert_b64 and ca_cert_b64 ~= "" then
+  ca_cert_env = ca_cert_b64
+end
+local token_b64 = ngx.encode_base64(token)
+handle = io.popen("K8S_TOKEN_B64='" .. token_b64 .. "' K8S_CA_CERT_B64='" .. ca_cert_env .. "' python3 /opt/programming_mode/start.py " .. file_name .. " " .. k8s_url .. "; echo $? > " .. file_name .. ".check")
 result = handle:read("*a")
 ngx.log(ngx.INFO, "[PROGRAMMING_MODE] Output for starting Chaos Program is " .. result)
 handle = io.popen("cat " .. file_name .. ".check")
diff --git a/scripts/vm.lua b/scripts/vm.lua
index d443f6e..b54b8ac 100644
--- a/scripts/vm.lua
+++ b/scripts/vm.lua
@@ -5,15 +5,57 @@ local redis = require "resty.redis"
 local http = require("resty.http")
 
 local k8s_url = ""
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
 
-if os.getenv("KUBERNETES_SERVICE_HOST") then
-  k8s_url = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+if kube_host and kube_host ~= "" then
+  local port_suffix = ""
+  if kube_port and kube_port ~= "" then
+    port_suffix = ":" .. kube_port
+  end
+  k8s_url = "https://" .. kube_host .. port_suffix
 else
-  k8s_url = os.getenv("ENDPOINT")
+  k8s_url = endpoint or ""
 end
 
-local token = os.getenv("TOKEN")
 local arg = ngx.req.get_uri_args()
+local req_headers = ngx.req.get_headers()
+local target = arg["target"] or req_headers["x-k8s-target"] or req_headers["X-K8S-Target"]
+if target and target ~= "" then
+  if not string.match(target, "^https?://") then
+    target = "https://" .. target
+  end
+  k8s_url = string.gsub(target, "/+$", "")
+end
+
+if k8s_url == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes endpoint configuration. Set KUBERNETES_SERVICE_HOST or ENDPOINT.")
+  ngx.exit(ngx.OK)
+end
+
+if not string.match(k8s_url, "^https?://") then
+  k8s_url = "https://" .. k8s_url
+end
+
+k8s_url = string.gsub(k8s_url, "/+$", "")
+
+local token = req_headers["x-k8s-token"] or req_headers["X-K8S-Token"] or tostring(os.getenv("TOKEN") or "")
+if token == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes API token configuration.")
+  ngx.exit(ngx.OK)
+end
+
+local ca_cert_b64 = req_headers["x-k8s-ca-cert-b64"] or req_headers["X-K8S-CA-CERT-B64"]
+local ca_cert = nil
+if ca_cert_b64 and ca_cert_b64 ~= "" then
+  ca_cert = ngx.decode_base64(ca_cert_b64)
+end
+
+local disable_tls_env = string.lower(tostring(os.getenv("DISABLE_TLS") or "false"))
+local disable_tls = disable_tls_env == "true" or disable_tls_env == "1" or disable_tls_env == "yes"
 local namespace = arg["namespace"]
 local url = k8s_url .. "/apis/kubevirt.io/v1/namespaces/" .. namespace .. "/virtualmachines"
 local decoded = nil
@@ -25,22 +67,34 @@ ngx.header['Access-Control-Expose-Headers'] = 'Content-Length,Content-Range';
 
 ngx.log(ngx.INFO, "Requesting nodes using this url: " .. url)
 
-local httpc = http.new()
+local resp = {}
+local request_opts = {
+  url = url,
+  method = "GET",
+  headers = {
+    ["Accept"] = "application/json",
+    ["Content-Type"] = "application/json",
+    ["Authorization"] = "Bearer " .. token
+  },
+  verify = disable_tls and "none" or "peer",
+  sink = ltn12.sink.table(resp)
+}
 
--- Esegui la richiesta
-local res, err = httpc:request_uri(url, {
-    method = "GET",
-    ssl_verify = false, -- TODO: use a valid certificate
-    headers = {
-        ["Accept"] = "application/json",
-        ["Content-Type"] = "application/json",
-        ["Authorization"] = "Bearer " .. token
-    }
-})
-
-if not res then
-    ngx.log(ngx.ERR, "Errore durante la richiesta HTTP: ", err)
-    return
+if not disable_tls and ca_cert and ca_cert ~= "" then
+  local ca_file_path = "/tmp/kubeinv-custom-ca.crt"
+  local ca_file = io.open(ca_file_path, "w")
+  if ca_file then
+    ca_file:write(ca_cert)
+    ca_file:close()
+    request_opts.cafile = ca_file_path
+  end
 end
 
-ngx.say(res.body)
\ No newline at end of file
+local ok, statusCode, response_headers, statusText = https.request(request_opts)
+if not ok then
+  ngx.status = tonumber(statusCode) or 502
+  ngx.say(statusText or "Kubernetes VM request failed")
+  return
+end
+
+ngx.say(table.concat(resp))
\ No newline at end of file
diff --git a/scripts/vm_reboot.lua b/scripts/vm_reboot.lua
index 8b001e4..e7f0e12 100644
--- a/scripts/vm_reboot.lua
+++ b/scripts/vm_reboot.lua
@@ -5,15 +5,57 @@ local redis = require "resty.redis"
 local http = require("resty.http")
 
 local k8s_url = ""
+local kube_host = os.getenv("KUBERNETES_SERVICE_HOST")
+local kube_port = os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+local endpoint = os.getenv("ENDPOINT")
 
-if os.getenv("KUBERNETES_SERVICE_HOST") then
-  k8s_url = "https://" .. os.getenv("KUBERNETES_SERVICE_HOST") .. ":" .. os.getenv("KUBERNETES_SERVICE_PORT_HTTPS")
+if kube_host and kube_host ~= "" then
+  local port_suffix = ""
+  if kube_port and kube_port ~= "" then
+    port_suffix = ":" .. kube_port
+  end
+  k8s_url = "https://" .. kube_host .. port_suffix
 else
-  k8s_url = os.getenv("ENDPOINT")
+  k8s_url = endpoint or ""
 end
 
-local token = os.getenv("TOKEN")
 local arg = ngx.req.get_uri_args()
+local req_headers = ngx.req.get_headers()
+local target = arg["target"] or req_headers["x-k8s-target"] or req_headers["X-K8S-Target"]
+if target and target ~= "" then
+  if not string.match(target, "^https?://") then
+    target = "https://" .. target
+  end
+  k8s_url = string.gsub(target, "/+$", "")
+end
+
+if k8s_url == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes endpoint configuration. Set KUBERNETES_SERVICE_HOST or ENDPOINT.")
+  ngx.exit(ngx.OK)
+end
+
+if not string.match(k8s_url, "^https?://") then
+  k8s_url = "https://" .. k8s_url
+end
+
+k8s_url = string.gsub(k8s_url, "/+$", "")
+
+local token = req_headers["x-k8s-token"] or req_headers["X-K8S-Token"] or tostring(os.getenv("TOKEN") or "")
+if token == "" then
+  ngx.status = 500
+  ngx.say("Missing Kubernetes API token configuration.")
+  ngx.exit(ngx.OK)
+end
+
+local ca_cert_b64 = req_headers["x-k8s-ca-cert-b64"] or req_headers["X-K8S-CA-CERT-B64"]
+local ca_cert = nil
+if ca_cert_b64 and ca_cert_b64 ~= "" then
+  ca_cert = ngx.decode_base64(ca_cert_b64)
+end
+
+local disable_tls_env = string.lower(tostring(os.getenv("DISABLE_TLS") or "false"))
+local disable_tls = disable_tls_env == "true" or disable_tls_env == "1" or disable_tls_env == "yes"
 local namespace = arg["namespace"]
 local vm_name = arg["vm_name"]
 local url = k8s_url .. "/apis/subresources.kubevirt.io/v1/namespaces/" .. namespace .. "/virtualmachines/" .. vm_name .. "/restart"
@@ -27,22 +69,34 @@ ngx.header['Access-Control-Expose-Headers'] = 'Content-Length,Content-Range';
 
 ngx.log(ngx.INFO, "Requesting nodes using this url: " .. url)
 
-local httpc = http.new()
+local resp = {}
+local request_opts = {
+  url = url,
+  method = "PUT",
+  headers = {
+    ["Accept"] = "*/*",
+    ["Content-Type"] = "application/json",
+    ["Authorization"] = "Bearer " .. token
+  },
+  verify = disable_tls and "none" or "peer",
+  sink = ltn12.sink.table(resp)
+}
 
--- Esegui la richiesta
-local res, err = httpc:request_uri(url, {
-    method = "PUT",
-    ssl_verify = false, -- TODO: use a valid certificate
-    headers = {
-        ["Accept"] = "*/*",
-        ["Content-Type"] = "application/json",
-        ["Authorization"] = "Bearer " .. token
-    }
-})
-
-if not res then
-    ngx.log(ngx.ERR, "Errore durante la richiesta HTTP: ", err)
-    return
+if not disable_tls and ca_cert and ca_cert ~= "" then
+  local ca_file_path = "/tmp/kubeinv-custom-ca.crt"
+  local ca_file = io.open(ca_file_path, "w")
+  if ca_file then
+    ca_file:write(ca_cert)
+    ca_file:close()
+    request_opts.cafile = ca_file_path
+  end
 end
 
-ngx.say(res.body)
\ No newline at end of file
+local ok, statusCode, response_headers, statusText = https.request(request_opts)
+if not ok then
+  ngx.status = tonumber(statusCode) or 502
+  ngx.say(statusText or "Kubernetes VM reboot request failed")
+  return
+end
+
+ngx.say(table.concat(resp))
\ No newline at end of file