@opensoha/contracts 0.1.26 → 0.1.29

package/resource/runtime/resource_graph_network.go

@@ -0,0 +1,224 @@
+package runtime
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+)
+
+// BuildNetworkResourceGraph consumes the same projected facts as topology.
+// Callers own source authorization and bounded collection; no network I/O occurs.
+func BuildNetworkResourceGraph(ctx context.Context, root cr.ResourceRef, snapshot cr.NetworkTopologySnapshot) (cr.ResourceGraph, error) {
+	if err := ctx.Err(); err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	root, err := NormalizeResourceGraphRoot(root)
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	if _, ok := topologySourceFor(root.Kind, root.APIVersion); !ok {
+		return cr.ResourceGraph{}, ErrUnsupportedResourceGraphRoot
+	}
+	snapshot, err = prioritizeNetworkRoot(ctx, root, snapshot)
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	g := buildNetworkTopology(ctx, root.ClusterID, root.Namespace, snapshot, ResourceGraphWorkingNodeLimit, ResourceGraphWorkingEdgeLimit, &root)
+	if err := ctx.Err(); err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	actual := g.objects[topologyKey(root.Kind, root.Namespace, root.Name)]
+	g.objectNode(actual, "backend-group", topologyProvider(actual.source), "")
+	graph := cr.ResourceGraph{ClusterID: root.ClusterID, Namespace: root.Namespace, GeneratedAt: time.Now().UTC().Format(time.RFC3339Nano), RootID: graphNodeID(actual.ref), Nodes: []cr.ResourceGraphNode{}, Edges: []cr.ResourceGraphEdge{}, Evidence: []cr.ResourceEvidence{}, Warnings: []string{}}
+	nodes, edges, evidence, err := networkResourceFacts(ctx, g)
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	selected, chosen, depth, limit, err := networkGraphTraverse(ctx, graph.RootID, edges)
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	for id := range selected {
+		graph.Nodes = append(graph.Nodes, nodes[id])
+	}
+	for _, edge := range edges {
+		if chosen[edge.ID] {
+			graph.Edges = append(graph.Edges, edge)
+		}
+	}
+	for _, e := range evidence {
+		if selected[e.ResourceID] {
+			graph.Evidence = append(graph.Evidence, e)
+		}
+	}
+	sort.Slice(graph.Nodes, func(i, j int) bool { return graph.Nodes[i].ID < graph.Nodes[j].ID })
+	if depth {
+		graph.Warnings = append(graph.Warnings, "network resource graph truncated by depth at 3 hops")
+	}
+	if limit || g.view.Truncated {
+		graph.Warnings = append(graph.Warnings, "network resource graph is partial due to source identity or graph budgets")
+	}
+	seen := map[string]bool{}
+	for _, c := range g.view.Coverage {
+		if c.State != "available" || c.Truncated {
+			w := fmt.Sprintf("network source %s namespace=%s name=%s: %s (%s)", c.SourceID, c.Namespace, c.Name, c.State, c.ReasonCode)
+			if !seen[w] {
+				graph.Warnings = append(graph.Warnings, w)
+				seen[w] = true
+			}
+		}
+	}
+	for _, node := range graph.Nodes {
+		if node.Resource.APIVersion == "v1" && node.Resource.Kind == "Secret" && node.Status != "observed" {
+			graph.Warnings = append(graph.Warnings, "TLS Secret references are declarations; metadata and existence are unverified")
+			break
+		}
+	}
+	for _, node := range g.view.Nodes {
+		if node.ResolutionState == "unsupported_fragment" {
+			graph.Warnings = append(graph.Warnings, "Unsupported network reference fragments could not be resolved")
+			break
+		}
+	}
+	sort.Strings(graph.Warnings)
+	return graph, ctx.Err()
+}
+
+func prioritizeNetworkRoot(ctx context.Context, root cr.ResourceRef, snapshot cr.NetworkTopologySnapshot) (cr.NetworkTopologySnapshot, error) {
+	sources := append([]cr.NetworkTopologySourceResult(nil), snapshot.Sources...)
+	sort.SliceStable(sources, func(i, j int) bool { return sources[i].Coverage.Name != "" && sources[j].Coverage.Name == "" })
+	for _, s := range sources {
+		for _, item := range s.Objects {
+			if err := ctx.Err(); err != nil {
+				return snapshot, err
+			}
+			if item.Resource.Kind != root.Kind || item.Resource.APIVersion != root.APIVersion || item.Resource.Namespace != root.Namespace || item.Resource.Name != root.Name {
+				continue
+			}
+			if root.UID != "" && item.Resource.UID != root.UID {
+				return snapshot, invalidGraphRoot("network root UID changed")
+			}
+			if _, ok := decodeTopologyObject(root.ClusterID, s, item); !ok {
+				return snapshot, invalidGraphRoot("invalid projected network root")
+			}
+			first := cr.NetworkTopologySourceResult{Coverage: s.Coverage, Objects: []cr.NetworkTopologySourceObject{item}}
+			snapshot.Sources = append([]cr.NetworkTopologySourceResult{first}, snapshot.Sources...)
+			return snapshot, nil
+		}
+	}
+	return snapshot, invalidGraphRoot("network resource graph root not present")
+}
+
+func networkResourceFacts(ctx context.Context, g *topologyGraph) (map[string]cr.ResourceGraphNode, []cr.ResourceGraphEdge, []cr.ResourceEvidence, error) {
+	nodes := map[string]cr.ResourceGraphNode{}
+	ids := map[string]string{}
+	evidence := []cr.ResourceEvidence{}
+	keys := make([]string, 0, len(g.nodes))
+	for id := range g.nodes {
+		keys = append(keys, id)
+	}
+	sort.Strings(keys)
+	for _, id := range keys {
+		if err := ctx.Err(); err != nil {
+			return nil, nil, nil, err
+		}
+		n := g.nodes[id]
+		if ref, ok := g.hiddenRefs[id]; ok {
+			n.Resource = &ref
+		}
+		if n.Resource == nil || n.Resource.Name == "" || n.Resource.APIVersion == "" {
+			continue
+		}
+		ref := *n.Resource
+		rid := graphNodeID(ref)
+		ids[id] = rid
+		state := "unresolved"
+		if o, ok := g.objects[topologyKey(ref.Kind, ref.Namespace, ref.Name)]; ok && o.ref.APIVersion == ref.APIVersion && o.ref.UID == ref.UID {
+			state = "observed"
+		}
+		if previous, ok := nodes[rid]; !ok || previous.Status != "observed" {
+			nodes[rid] = cr.ResourceGraphNode{ID: rid, Resource: ref, Status: state}
+		}
+		if ref.Kind == "NetworkPolicy" && n.Rule == nil {
+			for i, p := range n.Properties {
+				evidence = append(evidence, cr.ResourceEvidence{ID: fmt.Sprintf("%s:policy:%d", rid, i), Type: "policy-declaration", Severity: "info", Summary: p.Name + ": " + p.Value, ObservedAt: g.view.GeneratedAt, ResourceID: rid})
+			}
+		}
+	}
+	edges := []cr.ResourceGraphEdge{}
+	seen := map[string]bool{}
+	for _, e := range g.view.Edges {
+		if err := ctx.Err(); err != nil {
+			return nil, nil, nil, err
+		}
+		source, target := ids[e.Source], ids[e.Target]
+		if source == "" || target == "" || source == target {
+			continue
+		}
+		relation := e.Relation
+		if relation == "forwards" || relation == "weights" {
+			relation = "routes-to"
+		}
+		if relation == "matches" {
+			relation = "attaches-to"
+		}
+		edge := cr.ResourceGraphEdge{SourceID: source, TargetID: target, Relation: relation, ResolutionState: e.ResolutionState, Protocol: e.Protocol, Port: e.Port, SectionName: e.SectionName, FieldPath: e.FieldPath, Note: e.Note, SourceRef: e.SourceRef}
+		edge.ID = strings.Join([]string{relation, source, target, e.Protocol, e.Port, e.SectionName, e.FieldPath}, "|")
+		if !seen[edge.ID] {
+			seen[edge.ID] = true
+			edges = append(edges, edge)
+		}
+	}
+	sort.Slice(edges, func(i, j int) bool { return edges[i].ID < edges[j].ID })
+	return nodes, edges, evidence, nil
+}
+
+// The two walks never reverse direction at a selector, a class, or shared
+// reference target. Work is bounded by the already bounded relationship set.
+func networkGraphTraverse(ctx context.Context, root string, edges []cr.ResourceGraphEdge) (map[string]bool, map[string]bool, bool, bool, error) {
+	adjacency := map[int]map[string][]cr.ResourceGraphEdge{1: {}, -1: {}}
+	for _, e := range edges {
+		adjacency[1][e.SourceID] = append(adjacency[1][e.SourceID], e)
+		adjacency[-1][e.TargetID] = append(adjacency[-1][e.TargetID], e)
+	}
+	selected, chosen := map[string]bool{root: true}, map[string]bool{}
+	depthTruncated, limitTruncated := false, false
+	for _, direction := range []int{1, -1} {
+		queue := []graphTraversalState{{id: root, direction: direction}}
+		visited := map[string]bool{root: true}
+		for len(queue) > 0 {
+			if err := ctx.Err(); err != nil {
+				return nil, nil, false, false, err
+			}
+			current := queue[0]
+			queue = queue[1:]
+			for _, edge := range adjacency[direction][current.id] {
+				next := edge.TargetID
+				if direction == -1 {
+					next = edge.SourceID
+				}
+				if current.depth >= 3 {
+					if !visited[next] {
+						depthTruncated = true
+					}
+					continue
+				}
+				if !selected[next] && len(selected) >= cr.NetworkTopologyMaxNodes || !chosen[edge.ID] && len(chosen) >= cr.NetworkTopologyMaxEdges {
+					limitTruncated = true
+					continue
+				}
+				selected[next] = true
+				chosen[edge.ID] = true
+				if !visited[next] {
+					visited[next] = true
+					queue = append(queue, graphTraversalState{id: next, depth: current.depth + 1, direction: direction})
+				}
+			}
+		}
+	}
+	return selected, chosen, depthTruncated, limitTruncated, nil
+}

package/resource/runtime/resource_graph_network_collect.go

@@ -0,0 +1,174 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/metadata"
+	"k8s.io/client-go/rest"
+)
+
+var errNetworkGraphNamedNotFound = errors.New("named network graph root not found")
+
+func networkGraphRootKind(kind string) bool {
+	switch kind {
+	case "Service", "Ingress", "IngressClass", "GatewayClass", "Gateway", "HTTPRoute", "GRPCRoute", "BackendTLSPolicy", "ReferenceGrant", "EndpointSlice", "NetworkPolicy":
+		return true
+	}
+	return false
+}
+
+func networkGraphRootSource(root cr.ResourceRef) (cr.NetworkTopologySourceDefinition, bool) {
+	for _, definition := range cr.NetworkTopologySources() {
+		if definition.Kind != root.Kind || !networkGraphRootKind(root.Kind) {
+			continue
+		}
+		if root.APIVersion == "" {
+			return definition, true
+		}
+		for _, version := range cr.NetworkTopologySourceVersions(definition) {
+			if root.APIVersion == strings.TrimPrefix(definition.Group+"/"+version, "/") {
+				return definition, true
+			}
+		}
+
+	}
+	return cr.NetworkTopologySourceDefinition{}, false
+}
+
+// BuildKubernetesResourceGraphWithNetworkSources preserves the ordinary Graph
+// collector and reuses the bounded topology reader for known network roots.
+func BuildKubernetesResourceGraphWithNetworkSources(ctx context.Context, typed kubernetes.Interface, metadataClient metadata.Interface, client rest.Interface, root cr.ResourceRef) (cr.ResourceGraph, error) {
+	root, err := NormalizeResourceGraphRoot(root)
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	definition, network := networkGraphRootSource(root)
+	if !network {
+		return BuildKubernetesResourceGraphWithMetadata(ctx, typed, metadataClient, root)
+	}
+	if client == nil {
+		return cr.ResourceGraph{}, fmt.Errorf("%w: network resource graph reader unavailable", ErrUnsupportedResourceGraphRoot)
+	}
+	ctx, cancel := context.WithTimeout(ctx, ResourceGraphTimeout)
+	defer cancel()
+	object, err := getNetworkGraphRoot(ctx, client, definition, root, &topologyReadBudget{remaining: cr.NetworkTopologyMaxTotalBytes})
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	request := cr.NetworkTopologySnapshotRequest{}
+	for _, source := range cr.NetworkTopologySources() {
+		if source.Provider == "kubernetes" || source.Provider == "gateway" && !source.RequiresCustomResourceAccess() {
+			request.Queries = append(request.Queries, cr.NetworkTopologySourceQuery{SourceID: source.ID})
+		}
+	}
+	snapshot, err := ReadNetworkTopologySnapshot(ctx, client, root.ClusterID, request)
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	appendNetworkGraphRoot(&snapshot, definition.ID, object)
+	graph, err := BuildNetworkResourceGraph(ctx, object.Resource, snapshot)
+	if err != nil {
+		return cr.ResourceGraph{}, err
+	}
+	return graph, ctx.Err()
+}
+
+func getNetworkGraphRoot(ctx context.Context, client rest.Interface, definition cr.NetworkTopologySourceDefinition, root cr.ResourceRef, budget *topologyReadBudget) (cr.NetworkTopologySourceObject, error) {
+	if err := cr.ValidateNetworkTopologySnapshotRequest(cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{{SourceID: definition.ID, Namespace: root.Namespace, Name: root.Name}}}); err != nil {
+		return cr.NetworkTopologySourceObject{}, invalidGraphRoot("invalid named network graph scope")
+	}
+	versions := cr.NetworkTopologySourceVersions(definition)
+	if root.APIVersion != "" {
+		versions = []string{strings.TrimPrefix(root.APIVersion, definition.Group+"/")}
+	}
+	version, err := discoverTopologySourceVersions(ctx, client, definition, budget, versions)
+	if err != nil {
+		return cr.NetworkTopologySourceObject{}, err
+	}
+	path := topologyAPIBase(definition.Group, version)
+	if definition.Namespaced {
+		path += "/namespaces/" + root.Namespace
+	}
+	raw, err := boundedTopologyGET(ctx, client, path+"/"+definition.Resource+"/"+root.Name, false, budget)
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			return cr.NetworkTopologySourceObject{}, fmt.Errorf("%w: %w", errNetworkGraphNamedNotFound, err)
+		}
+		return cr.NetworkTopologySourceObject{}, err
+	}
+	var input map[string]any
+	api := strings.TrimPrefix(definition.Group+"/"+version, "/")
+	if json.Unmarshal(raw, &input) != nil || input["apiVersion"] != api || input["kind"] != root.Kind {
+		return cr.NetworkTopologySourceObject{}, invalidGraphRoot("network graph root GVK changed")
+	}
+	projected, err := cr.ProjectNetworkTopologyObject(definition.ID, input)
+	if err != nil {
+		return cr.NetworkTopologySourceObject{}, err
+	}
+	meta, _ := projected["metadata"].(map[string]any)
+	namespace, _ := meta["namespace"].(string)
+	uid, _ := meta["uid"].(string)
+	if meta["name"] != root.Name || namespace != root.Namespace || uid == "" || root.UID != "" && root.UID != uid {
+		return cr.NetworkTopologySourceObject{}, invalidGraphRoot("network graph root identity changed")
+	}
+	root.APIVersion, root.UID, root.ScopeMode = api, uid, topologyScope(definition.Namespaced)
+	root.ResourceVersion, _ = meta["resourceVersion"].(string)
+	content, _ := json.Marshal(projected)
+	generation, _ := meta["generation"].(float64)
+	return cr.NetworkTopologySourceObject{Resource: root, Generation: int64(generation), Content: string(content)}, nil
+}
+
+func appendNetworkGraphRoot(snapshot *cr.NetworkTopologySnapshot, sourceID string, root cr.NetworkTopologySourceObject) {
+	// The named root must survive a truncated page and stale list observations.
+	total := len(root.Content)
+	for index := range snapshot.Sources {
+		source := &snapshot.Sources[index]
+		objects := source.Objects[:0]
+		for _, object := range source.Objects {
+			if object.Resource.Kind == root.Resource.Kind && object.Resource.Namespace == root.Resource.Namespace && object.Resource.Name == root.Resource.Name {
+				continue
+			}
+			if total+len(object.Content) > cr.NetworkTopologyMaxTotalBytes {
+				source.Coverage.State, source.Coverage.Truncated, source.Coverage.ReasonCode = "partial", true, "total_budget"
+				continue
+			}
+			total += len(object.Content)
+			objects = append(objects, object)
+		}
+		source.Objects = objects
+		if source.Coverage.SourceID == sourceID {
+			if len(source.Objects) >= cr.NetworkTopologyMaxSourceItems {
+				source.Objects = source.Objects[:cr.NetworkTopologyMaxSourceItems-1]
+				source.Coverage.Truncated = true
+			}
+			source.Objects = append(source.Objects, root)
+			if source.Coverage.State != "available" {
+				source.Coverage.State = "partial"
+			}
+		}
+	}
+}
+
+func readNetworkGraphNamedSource(ctx context.Context, client rest.Interface, clusterID string, query cr.NetworkTopologySourceQuery, budget *topologyReadBudget) cr.NetworkTopologySourceResult {
+	definition, _ := cr.LookupNetworkTopologySource(query.SourceID)
+	result := topologySourceFailure(query, "available", "named_get")
+	// Named reads use the same fixed catalog and projection, never arbitrary GVRs.
+	root := cr.ResourceRef{ClusterID: clusterID, Kind: definition.Kind, Namespace: query.Namespace, Name: query.Name}
+	object, err := getNetworkGraphRoot(ctx, client, definition, root, budget)
+	if err != nil {
+		result.Coverage.State, result.Coverage.ReasonCode = topologyReadError(err)
+		if errors.Is(err, errNetworkGraphNamedNotFound) {
+			result.Coverage.ReasonCode = "named_not_found"
+		}
+		return result
+	}
+	result.Objects = []cr.NetworkTopologySourceObject{object}
+	return result
+}

package/resource/runtime/resource_graph_network_collect_test.go

@@ -0,0 +1,147 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/kubernetes/fake"
+	"k8s.io/client-go/rest"
+)
+
+func TestNetworkGraphNamedRootOutsideBoundedPage(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		switch r.URL.Path {
+		case "/api/v1":
+			_, _ = fmt.Fprint(w, `{"resources":[{"name":"services","kind":"Service","namespaced":true}]}`)
+		case "/api/v1/namespaces/team/services/root":
+			_, _ = fmt.Fprint(w, `{"apiVersion":"v1","kind":"Service","metadata":{"name":"root","namespace":"team","uid":"root-uid"},"spec":{"type":"ClusterIP"}}`)
+		case "/api/v1/services":
+			if r.URL.Query().Get("limit") != "200" {
+				t.Error("unbounded list")
+			}
+			items := []any{}
+			for i := 0; i < 201; i++ {
+				items = append(items, map[string]any{"metadata": map[string]any{"name": fmt.Sprint("svc-", i), "namespace": "team", "uid": fmt.Sprint("uid-", i)}})
+			}
+			_ = json.NewEncoder(w).Encode(map[string]any{"metadata": map[string]any{"continue": "next"}, "items": items})
+		default:
+			if strings.Contains(r.URL.Path, "secrets") {
+				t.Error("Secret data read")
+			}
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	client, _ := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	graph, err := BuildKubernetesResourceGraphWithNetworkSources(context.Background(), client, nil, client.CoreV1().RESTClient(), cr.ResourceRef{ClusterID: "c", Namespace: "team", Kind: "service", Name: "root"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, node := range graph.Nodes {
+		if node.ID == graph.RootID && node.Resource.Name == "root" && node.Resource.UID == "root-uid" {
+			found = true
+		}
+	}
+	if !found || len(graph.Warnings) == 0 {
+		t.Fatalf("named root or truncation missing: %+v", graph)
+	}
+}
+
+func TestNetworkGraphNamedSnapshotIdentityErrors(t *testing.T) {
+	for _, tc := range []struct{ name, body string }{
+		{"GVK", `{"apiVersion":"example.io/v1","kind":"Service","metadata":{"name":"root","namespace":"team","uid":"uid"}}`},
+		{"namespace", `{"apiVersion":"v1","kind":"Service","metadata":{"name":"root","namespace":"other","uid":"uid"}}`},
+		{"UID", `{"apiVersion":"v1","kind":"Service","metadata":{"name":"root","namespace":"team","uid":""}}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path == "/api/v1" {
+					_, _ = fmt.Fprint(w, `{"resources":[{"name":"services","kind":"Service","namespaced":true}]}`)
+				} else {
+					_, _ = fmt.Fprint(w, tc.body)
+				}
+			}))
+			defer server.Close()
+			client, _ := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+			_, err := BuildKubernetesResourceGraphWithNetworkSources(context.Background(), client, nil, client.CoreV1().RESTClient(), cr.ResourceRef{ClusterID: "c", Namespace: "team", Kind: "Service", Name: "root"})
+			if !errors.Is(err, ErrInvalidResourceGraphRoot) {
+				t.Fatalf("identity accepted: %v", err)
+			}
+		})
+	}
+}
+
+func TestNetworkGraphNamedSnapshotCoverageAndCancellation(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		status int
+		reason string
+	}{{"missing", 404, "named_not_found"}, {"denied", 403, "kubernetes_rbac"}} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				if r.URL.Path == "/api/v1" {
+					_, _ = fmt.Fprint(w, `{"resources":[{"name":"services","kind":"Service","namespaced":true}]}`)
+					return
+				}
+				w.WriteHeader(tc.status)
+				_ = json.NewEncoder(w).Encode(map[string]any{"kind": "Status", "apiVersion": "v1", "code": tc.status, "reason": map[int]string{404: "NotFound", 403: "Forbidden"}[tc.status], "message": "private details"})
+			}))
+			defer server.Close()
+			client, _ := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+			query := cr.NetworkTopologySourceQuery{SourceID: "kubernetes.services", Namespace: "team", Name: "root"}
+			snapshot, err := ReadNetworkTopologySnapshot(context.Background(), client.CoreV1().RESTClient(), "c", cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{query}})
+			if err != nil || snapshot.Version != cr.NetworkTopologyNamedRootFeature || len(snapshot.Sources) != 1 || snapshot.Sources[0].Coverage.Name != "root" || snapshot.Sources[0].Coverage.ReasonCode != tc.reason {
+				t.Fatalf("coverage lost: %+v %v", snapshot, err)
+			}
+			raw, _ := json.Marshal(snapshot)
+			if strings.Contains(string(raw), "private details") {
+				t.Fatal("provider detail leaked")
+			}
+			ctx, cancel := context.WithCancel(context.Background())
+			cancel()
+			if _, err := ReadNetworkTopologySnapshot(ctx, client.CoreV1().RESTClient(), "c", cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{query}}); !errors.Is(err, context.Canceled) {
+				t.Fatalf("cancel lost: %v", err)
+			}
+		})
+	}
+}
+
+func TestNetworkGraphNonNetworkFakeKeepsExistingCollector(t *testing.T) {
+	client := fake.NewClientset(&corev1.Pod{ObjectMeta: metav1.ObjectMeta{Name: "pod", Namespace: "team", UID: "uid"}})
+	graph, err := BuildKubernetesResourceGraphWithNetworkSources(context.Background(), client, nil, nil, cr.ResourceRef{ClusterID: "c", Namespace: "team", Kind: "Pod", Name: "pod"})
+	if err != nil || len(graph.Nodes) == 0 {
+		t.Fatalf("nonnetwork fallback: %+v %v", graph, err)
+	}
+	if _, err := BuildKubernetesResourceGraphWithNetworkSources(context.Background(), client, nil, nil, cr.ResourceRef{ClusterID: "c", Namespace: "team", Kind: "Service", Name: "root"}); !errors.Is(err, ErrUnsupportedResourceGraphRoot) {
+		t.Fatalf("missing network transport: %v", err)
+	}
+}
+
+func TestNetworkGraphNamedRootByteBudget(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/v1" {
+			_, _ = fmt.Fprint(w, `{"resources":[{"name":"services","kind":"Service","namespaced":true}]}`)
+			return
+		}
+		_, _ = fmt.Fprint(w, `{"apiVersion":"v1","kind":"Service","metadata":{"name":"root","namespace":"team","uid":"uid","annotations":{"oversized":"`+strings.Repeat("x", cr.NetworkTopologyMaxSourceBytes)+`"}}}`)
+	}))
+	defer server.Close()
+	client, _ := kubernetes.NewForConfig(&rest.Config{Host: server.URL})
+	snapshot, err := ReadNetworkTopologySnapshot(context.Background(), client.CoreV1().RESTClient(), "c", cr.NetworkTopologySnapshotRequest{Queries: []cr.NetworkTopologySourceQuery{{SourceID: "kubernetes.services", Namespace: "team", Name: "root"}}})
+	if err != nil || len(snapshot.Sources) != 1 || snapshot.Sources[0].Coverage.State != "partial" || snapshot.Sources[0].Coverage.ReasonCode != "byte_budget" || len(snapshot.Sources[0].Objects) != 0 {
+		t.Fatalf("named byte limit lost: %+v %v", snapshot, err)
+	}
+}