Currently the 'dump cluster' command requires public access to the guest cluster to dump its contents. It should be possible for it to access the guest cluster via the kube-apiserver service on the mgmt cluster. This would enable it for private clusters as well.