@opensoha/contracts 0.1.27 → 0.1.29

package/resource/runtime/network_relationship_primitives.go

@@ -0,0 +1,66 @@
+package runtime
+
+import (
+	"fmt"
+
+	"k8s.io/apimachinery/pkg/labels"
+)
+
+// servicePodSelector preserves Service's nonempty equality-selector semantics.
+// Malformed values invalidate the selector rather than silently broadening it.
+func servicePodSelector(selector map[string]any) labels.Selector {
+	if len(selector) == 0 {
+		return nil
+	}
+	set := labels.Set{}
+	for key, value := range selector {
+		label, ok := value.(string)
+		if !ok {
+			return nil
+		}
+		set[key] = label
+	}
+	return labels.SelectorFromSet(set)
+}
+
+type ingressBackendDeclaration struct {
+	host            string
+	path            map[string]any
+	serviceName     string
+	port            string
+	fieldPath       string
+	serviceDeclared bool
+}
+
+// forEachIngressBackendDeclaration extracts configured references once. Callers
+// retain their own graph projection, resolution, authorization and budget rules.
+func forEachIngressBackendDeclaration(body map[string]any, active func() bool, visit func(ingressBackendDeclaration)) {
+	if !active() {
+		return
+	}
+	if backend := object(at(body, "spec", "defaultBackend")); len(backend) > 0 {
+		visit(ingressBackendFact("", map[string]any{"path": "/", "pathType": "Default"}, backend, "spec.defaultBackend"))
+	}
+	rules, _ := at(body, "spec", "rules").([]any)
+	for ruleIndex, raw := range rules {
+		if !active() {
+			return
+		}
+		rule := object(raw)
+		paths, _ := at(rule, "http", "paths").([]any)
+		for pathIndex, rawPath := range paths {
+			if !active() {
+				return
+			}
+			path := object(rawPath)
+			visit(ingressBackendFact(text(rule["host"]), path, object(path["backend"]), fmt.Sprintf("spec.rules[%d].http.paths[%d].backend", ruleIndex, pathIndex)))
+		}
+	}
+}
+
+func ingressBackendFact(host string, path, backend map[string]any, fieldPath string) ingressBackendDeclaration {
+	service := object(backend["service"])
+	name, _ := service["name"].(string)
+	port := object(service["port"])
+	return ingressBackendDeclaration{host: host, path: path, serviceName: name, port: firstTopology(text(port["name"]), text(port["number"])), fieldPath: fieldPath, serviceDeclared: len(service) > 0}
+}

package/resource/runtime/network_relationship_primitives_test.go

@@ -0,0 +1,147 @@
+package runtime
+
+import (
+	"encoding/json"
+	"testing"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+func TestNetworkRelationshipServiceSelectorParityAndMalformedValues(t *testing.T) {
+	for _, tc := range []struct {
+		name, selector string
+		match          bool
+	}{
+		{"missing", "null", false}, {"empty", "{}", false},
+		{"match", `{"app":"web"}`, true}, {"different", `{"app":"other"}`, false},
+		{"allLabelsRequired", `{"app":"web","tier":"api"}`, false},
+		{"missingEmptyLabel", `{"missing":""}`, false},
+		{"nonString", `{"app":42}`, false},
+		{"doNotDropMalformedTerm", `{"app":"web","malformed":42}`, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			pod := graphTestObject("v1", "Pod", "pod", "pod-uid")
+			pod.SetLabels(map[string]string{"app": "web"})
+			service := graphTestObject("v1", "Service", "svc", "svc-uid")
+			var selector any
+			if err := json.Unmarshal([]byte(tc.selector), &selector); err != nil {
+				t.Fatal(err)
+			}
+			service.Object["spec"] = map[string]any{"selector": selector}
+			old, err := BuildResourceGraphFromObjects(graphTestRoot("Pod", "pod"), []*unstructured.Unstructured{pod, service})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := graphTestEdge(old, "selects", "svc", "pod"); got != tc.match {
+				t.Fatalf("Workload selector match=%v want=%v", got, tc.match)
+			}
+			networkService := topologyFixture("kubernetes.services", "ns", "svc", `{"spec":{"selector":`+tc.selector+`}}`)
+			networkPod := topologyFixture("kubernetes.pods", "ns", "pod", `{"metadata":{"labels":{"app":"web"}}}`)
+			network := networkFixtureGraph(t, networkService, networkPod)
+			if got := len(networkEdges(network, "selects")) > 0; got != tc.match {
+				t.Fatalf("Network selector match=%v want=%v", got, tc.match)
+			}
+		})
+	}
+}
+
+func TestNetworkRelationshipIngressDefaultAndPathsPreserveBothViews(t *testing.T) {
+	for _, tc := range []struct {
+		name, spec   string
+		names, paths []string
+	}{
+		{"defaultOnly", `{"defaultBackend":{"service":{"name":"default","port":{"name":"http"}}}}`, []string{"default"}, []string{"spec.defaultBackend"}},
+		{"pathsOnly", `{"rules":[{"host":"a.test","http":{"paths":[{"path":"/a","pathType":"Prefix","backend":{"service":{"name":"first","port":{"number":80}}}},{"path":"/b","backend":{"service":{"name":"second","port":{"number":80}}}}]}},{"host":"b.test","http":{"paths":[{"backend":{"service":{"name":"last","port":{"number":80}}}}]}}]}`, []string{"first", "second", "last"}, []string{"spec.rules[0].http.paths[0].backend", "spec.rules[0].http.paths[1].backend", "spec.rules[1].http.paths[0].backend"}},
+		{"defaultAndPath", `{"defaultBackend":{"service":{"name":"default","port":{"name":"http"}}},"rules":[{"host":"a.test","http":{"paths":[{"path":"/a","backend":{"service":{"name":"first","port":{"number":80}}}}]}}]}`, []string{"default", "first"}, []string{"spec.defaultBackend", "spec.rules[0].http.paths[0].backend"}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var spec map[string]any
+			if err := json.Unmarshal([]byte(tc.spec), &spec); err != nil {
+				t.Fatal(err)
+			}
+			pod := graphTestObject("v1", "Pod", "pod", "pod-uid")
+			pod.SetLabels(map[string]string{"app": "web"})
+			ingress := graphTestObject("networking.k8s.io/v1", "Ingress", "ing", "ing-uid")
+			ingress.Object["spec"] = spec
+			objects := []*unstructured.Unstructured{pod, ingress}
+			sources := []cr.NetworkTopologySourceResult{}
+			for _, name := range tc.names {
+				service := graphTestObject("v1", "Service", name, name+"-uid")
+				service.Object["spec"] = map[string]any{"selector": map[string]any{"app": "web"}}
+				objects = append(objects, service)
+				sources = append(sources, topologyFixture("kubernetes.services", "ns", name, `{"spec":{"ports":[{"name":"http","port":80}]}}`))
+			}
+			workload, err := BuildResourceGraphFromObjects(graphTestRoot("Pod", "pod"), objects)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, name := range tc.names {
+				if !graphTestEdge(workload, "routes-to", "ing", name) {
+					t.Fatalf("Workload dropped backend %s: %+v", name, workload.Edges)
+				}
+			}
+			if edges := networkEdges(workload, "routes-to"); len(edges) != len(tc.names) {
+				t.Fatalf("Workload changed name-only edge count: %+v", edges)
+			} else {
+				for _, edge := range edges {
+					if edge.Port != "" || edge.FieldPath != "" {
+						t.Fatalf("Workload adopted network-only facts: %+v", edge)
+					}
+				}
+			}
+			networkIngress := topologyFixture("kubernetes.ingresses", "ns", "ing", `{"spec":`+tc.spec+`}`)
+			network := networkFixtureGraph(t, networkIngress, sources...)
+			actual := map[string]bool{}
+			for _, edge := range networkEdges(network, "routes-to") {
+				actual[edge.FieldPath] = true
+				if edge.Port == "" {
+					t.Fatal("Network dropped backend port")
+				}
+			}
+			if len(actual) != len(tc.paths) {
+				t.Fatalf("Network changed backend declarations: %+v", actual)
+			}
+			for _, path := range tc.paths {
+				if !actual[path] {
+					t.Fatalf("Network dropped declaration %s", path)
+				}
+			}
+			view := fixtureView(append([]cr.NetworkTopologySourceResult{networkIngress}, sources...)...)
+			if tc.name != "defaultOnly" {
+				found := false
+				for _, node := range view.Nodes {
+					if node.Rule != nil {
+						for _, group := range node.Rule.MatchGroups {
+							for _, match := range group {
+								if match.Type == "host" && match.Value == "a.test" {
+									found = true
+								}
+							}
+						}
+					}
+				}
+				if !found {
+					t.Fatal("Topology lost match context")
+				}
+			}
+		})
+	}
+}
+
+func TestNetworkRelationshipIngressIterationHonorsBudgetAndUnsupportedBackend(t *testing.T) {
+	body := map[string]any{}
+	if err := json.Unmarshal([]byte(`{"spec":{"defaultBackend":{"resource":{"apiGroup":"example.io","kind":"Bucket","name":"custom"}},"rules":[{"http":{"paths":[{"backend":{"service":{"name":"later"}}}]}}]}}`), &body); err != nil {
+		t.Fatal(err)
+	}
+	count := 0
+	forEachIngressBackendDeclaration(body, func() bool { return count == 0 }, func(ref ingressBackendDeclaration) {
+		count++
+		if ref.fieldPath != "spec.defaultBackend" || ref.serviceDeclared || ref.serviceName != "" {
+			t.Fatalf("unsupported backend fabricated a Service: %+v", ref)
+		}
+	})
+	if count != 1 {
+		t.Fatalf("iterator ignored caller budget: %d", count)
+	}
+}

package/resource/runtime/network_topology.go

@@ -29,6 +29,12 @@ func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clu
 	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
 	output := resource.NetworkTopologySnapshot{Version: resource.NetworkTopologySnapshotFeature, Sources: make([]resource.NetworkTopologySourceResult, len(input.Queries))}
+	for _, query := range input.Queries {
+		if query.Name != "" {
+			output.Version = resource.NetworkTopologyNamedRootFeature
+			break
+		}
+	}
 	budget := &topologyReadBudget{remaining: resource.NetworkTopologyMaxTotalBytes}
 	sem := make(chan struct{}, 4)
 	var wg sync.WaitGroup
@@ -47,6 +53,9 @@ func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clu
 		}(index, query)
 	}
 	wg.Wait()
+	if err := ctx.Err(); err != nil {
+		return resource.NetworkTopologySnapshot{}, err
+	}
 	total := 0
 	for i := range output.Sources {
 		source := &output.Sources[i]
@@ -69,10 +78,13 @@ func ReadNetworkTopologySnapshot(ctx context.Context, client rest.Interface, clu
 
 func topologySourceFailure(query resource.NetworkTopologySourceQuery, state, reason string) resource.NetworkTopologySourceResult {
 	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
-	return resource.NetworkTopologySourceResult{Coverage: resource.NetworkTopologyCoverage{Provider: definition.Provider, SourceID: query.SourceID, Namespace: query.Namespace, State: state, ReasonCode: reason, CheckedAt: time.Now().UTC().Format(time.RFC3339), SupportedKinds: []string{definition.Kind}}, Objects: []resource.NetworkTopologySourceObject{}}
+	return resource.NetworkTopologySourceResult{Coverage: resource.NetworkTopologyCoverage{Provider: definition.Provider, SourceID: query.SourceID, Name: query.Name, Namespace: query.Namespace, State: state, ReasonCode: reason, CheckedAt: time.Now().UTC().Format(time.RFC3339), SupportedKinds: []string{definition.Kind}}, Objects: []resource.NetworkTopologySourceObject{}}
 }
 
 func readTopologySource(ctx context.Context, client rest.Interface, clusterID string, query resource.NetworkTopologySourceQuery, budget *topologyReadBudget) resource.NetworkTopologySourceResult {
+	if query.Name != "" {
+		return readNetworkGraphNamedSource(ctx, client, clusterID, query, budget)
+	}
 	definition, _ := resource.LookupNetworkTopologySource(query.SourceID)
 	result := topologySourceFailure(query, "available", "")
 	version, err := discoverTopologySource(ctx, client, definition, budget)
@@ -142,10 +154,10 @@ func topologyAPIBase(group, version string) string {
 }
 
 func discoverTopologySource(ctx context.Context, client rest.Interface, definition resource.NetworkTopologySourceDefinition, budget *topologyReadBudget) (string, error) {
-	versions := []string{definition.Version}
-	if definition.FallbackVersion != "" {
-		versions = append(versions, definition.FallbackVersion)
-	}
+	return discoverTopologySourceVersions(ctx, client, definition, budget, resource.NetworkTopologySourceVersions(definition))
+}
+
+func discoverTopologySourceVersions(ctx context.Context, client rest.Interface, definition resource.NetworkTopologySourceDefinition, budget *topologyReadBudget, versions []string) (string, error) {
 	for _, version := range versions {
 		raw, err := boundedTopologyGET(ctx, client, topologyAPIBase(definition.Group, version), false, budget)
 		if apierrors.IsNotFound(err) {

package/resource/runtime/network_topology_builder.go

@@ -0,0 +1,405 @@
+package runtime
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	cr "github.com/opensoha/soha-contracts/resource"
+)
+
+type topologyObject struct {
+	source     string
+	ref        cr.ResourceRef
+	generation int64
+	body       map[string]any
+}
+type topologyGraph struct {
+	view        cr.NetworkTopologyView
+	objects     map[string]topologyObject
+	ordered     []topologyObject
+	nodes       map[string]cr.NetworkTopologyGraphNode
+	expanded    map[string]bool
+	legacyWalks int
+	ctx         context.Context
+	nodeLimit   int
+	edgeLimit   int
+	hiddenRefs  map[string]cr.ResourceRef
+}
+
+// The public topology permits coverage for both issued and denied source queries.
+const topologyCoverageLimit = 128
+
+// BuildNetworkTopology joins authorized, projected sources. It never treats absent coverage as an empty resource list.
+func BuildNetworkTopology(clusterID, namespace string, snapshot cr.NetworkTopologySnapshot) cr.NetworkTopologyView {
+	return buildNetworkTopology(context.Background(), clusterID, namespace, snapshot, cr.NetworkTopologyDefaultNodes, cr.NetworkTopologyDefaultEdges, nil).view
+}
+
+func buildNetworkTopology(ctx context.Context, clusterID, namespace string, snapshot cr.NetworkTopologySnapshot, nodeLimit, edgeLimit int, root *cr.ResourceRef) *topologyGraph {
+	now := time.Now().UTC().Format(time.RFC3339)
+	g := &topologyGraph{hiddenRefs: map[string]cr.ResourceRef{}, ctx: ctx, nodeLimit: nodeLimit, edgeLimit: edgeLimit, view: cr.NetworkTopologyView{ClusterID: clusterID, Namespace: namespace, GraphVersion: "v1", Source: "kubernetes-snapshot", GeneratedAt: now, Nodes: []cr.NetworkTopologyGraphNode{}, Edges: []cr.NetworkTopologyGraphEdge{}, Traces: []cr.NetworkTopologyTraceView{}}, objects: map[string]topologyObject{}, nodes: map[string]cr.NetworkTopologyGraphNode{}, expanded: map[string]bool{}}
+	totalBytes := 0
+	for sourceIndex, source := range snapshot.Sources {
+		if sourceIndex >= topologyCoverageLimit {
+			g.view.Truncated = true
+			break
+		}
+		g.view.Coverage = append(g.view.Coverage, source.Coverage)
+		g.view.Truncated = g.view.Truncated || source.Coverage.Truncated
+		if source.Coverage.ObservedAt > g.view.ObservedAt {
+			g.view.ObservedAt = source.Coverage.ObservedAt
+		}
+		for objectIndex, item := range source.Objects {
+			if objectIndex >= cr.NetworkTopologyMaxSourceItems {
+				g.view.Truncated = true
+				break
+			}
+			if _, exists := g.objects[topologyKey(item.Resource.Kind, item.Resource.Namespace, item.Resource.Name)]; exists {
+				continue
+			}
+			totalBytes += len(item.Content)
+			if totalBytes > cr.NetworkTopologyMaxTotalBytes {
+				g.view.Truncated = true
+				break
+			}
+			if ctx.Err() != nil || len(g.ordered) >= ResourceGraphWorkingNodeLimit {
+				g.view.Truncated = true
+				break
+			}
+			if object, ok := decodeTopologyObject(clusterID, source, item); ok {
+				key := topologyKey(object.ref.Kind, object.ref.Namespace, object.ref.Name)
+				if _, exists := g.objects[key]; !exists {
+					g.objects[key] = object
+					g.ordered = append(g.ordered, object)
+					if root != nil && object.ref.Kind == root.Kind && object.ref.Namespace == root.Namespace && object.ref.Name == root.Name && object.ref.APIVersion == root.APIVersion {
+						g.objectNode(object, "backend-group", topologyProvider(object.source), "")
+					}
+				}
+			} else if source.Coverage.State == "available" || source.Coverage.State == "partial" {
+				index := len(g.view.Coverage) - 1
+				g.view.Coverage[index].State = "partial"
+				g.view.Coverage[index].ReasonCode = "invalid_projection"
+				g.view.Truncated = true
+			}
+		}
+	}
+	sort.Slice(g.ordered, func(i, j int) bool { return g.ordered[i].id() < g.ordered[j].id() })
+	prioritized := g.prioritizeRoot(root)
+	for _, object := range g.ordered {
+		if object.id() == prioritized {
+			continue
+		}
+		g.addRoute(object)
+	}
+	for _, object := range g.ordered {
+		if object.ref.Kind == "Service" && object.id() != prioritized {
+			g.service(object, "")
+		}
+	}
+	for _, o := range g.ordered {
+		if o.source == "kubernetes.endpointslices" && !g.expanded["slice:"+o.id()] {
+			g.endpointSlice(topologyObject{}, o, "", "")
+		}
+	}
+	g.declarations(prioritized)
+	for i := range g.view.Edges {
+		e := &g.view.Edges[i]
+		e.ID = strings.Join([]string{e.Source, e.Target, e.Relation, e.Protocol, e.Port, e.SectionName, e.FieldPath, fmt.Sprint(i)}, "|")
+	}
+	for _, node := range g.nodes {
+		g.view.Nodes = append(g.view.Nodes, node)
+		g.countNode(node)
+	}
+	sort.Slice(g.view.Nodes, func(i, j int) bool { return g.view.Nodes[i].ID < g.view.Nodes[j].ID })
+	sort.Slice(g.view.Edges, func(i, j int) bool { return g.view.Edges[i].ID < g.view.Edges[j].ID })
+	if root == nil {
+		g.projectLegacy()
+	}
+	return g
+}
+
+func (o topologyObject) id() string {
+	return strings.Join([]string{o.ref.ClusterID, o.ref.APIVersion, o.ref.Kind, o.ref.Namespace, o.ref.Name, o.ref.UID}, "|")
+}
+func topologyKey(kind, namespace, name string) string { return kind + "/" + namespace + "/" + name }
+func (g *topologyGraph) addNode(node cr.NetworkTopologyGraphNode) string {
+	if g.ctx.Err() != nil {
+		return ""
+	}
+	if _, ok := g.nodes[node.ID]; ok {
+		return node.ID
+	}
+	if len(g.nodes) >= g.nodeLimit {
+		g.view.Truncated = true
+		return ""
+	}
+	g.nodes[node.ID] = node
+	return node.ID
+}
+func (g *topologyGraph) objectNode(o topologyObject, nodeType, provider, protocol string) string {
+	ref := o.ref
+	return g.addNode(cr.NetworkTopologyGraphNode{ID: o.id(), Type: nodeType, Label: ref.Name, Provider: provider, Protocol: protocol, Resource: &ref, Generation: o.generation, ResolutionState: "resolved"})
+}
+func (g *topologyGraph) link(source, target, relation, protocol, port string) *cr.NetworkTopologyGraphEdge {
+	if source == "" || target == "" {
+		return &cr.NetworkTopologyGraphEdge{}
+	}
+	if _, ok := g.nodes[source]; !ok {
+		return &cr.NetworkTopologyGraphEdge{}
+	}
+	if _, ok := g.nodes[target]; !ok {
+		return &cr.NetworkTopologyGraphEdge{}
+	}
+	if len(g.view.Edges) >= g.edgeLimit {
+		g.view.Truncated = true
+		return &cr.NetworkTopologyGraphEdge{}
+	}
+	edge := cr.NetworkTopologyGraphEdge{ID: fmt.Sprintf("%s>%s:%s:%d", source, target, relation, len(g.view.Edges)), Source: source, Target: target, Relation: relation, Protocol: protocol, Port: port, SourceRef: g.nodes[source].Resource, ResolutionState: g.nodes[target].ResolutionState}
+	if ref := g.nodes[target].Resource; ref != nil && ref.Kind == "Service" {
+		if service, ok := g.objects[topologyKey("Service", ref.Namespace, ref.Name)]; ok && target == service.id() {
+			edge.ResolutionState = "resolved"
+			if port != "" && !servicePortExists(service, port, protocol) {
+				edge.ResolutionState = "unresolved"
+			}
+		}
+	}
+	g.view.Edges = append(g.view.Edges, edge)
+	return &g.view.Edges[len(g.view.Edges)-1]
+}
+func (g *topologyGraph) unknown(parent, kind, namespace, name, state string) string {
+	if state == "" {
+		state = g.referenceState(kind, namespace)
+	}
+	if state == "unsupported_fragment" {
+		return g.addNode(cr.NetworkTopologyGraphNode{ID: fmt.Sprintf("%s:unsupported:%d", parent, len(g.nodes)), Type: "backend-group", Label: "Unsupported reference", Provider: g.nodes[parent].Provider, ResolutionState: state})
+	}
+	label := name
+	api := "v1"
+	for _, d := range cr.NetworkTopologySources() {
+		if d.Kind == kind {
+			api = strings.TrimPrefix(d.Group+"/"+d.Version, "/")
+			break
+		}
+	}
+	ref := &cr.ResourceRef{ClusterID: g.view.ClusterID, Kind: kind, Namespace: namespace, Name: name, APIVersion: api, ScopeMode: cr.ResourceScopeModeNamespace}
+	if namespace == "" {
+		ref.ScopeMode = cr.ResourceScopeModeCluster
+	}
+	id := fmt.Sprintf("%s:unresolved:%d", parent, len(g.nodes))
+	visibility := g.referenceState(kind, namespace)
+	if state == "not_visible" || state == "unknown" || visibility == "not_visible" || visibility == "unknown" {
+		g.hiddenRefs[id] = *ref
+		ref = nil
+		label = "Unresolved reference"
+	}
+	return g.addNode(cr.NetworkTopologyGraphNode{ID: id, Type: "backend-group", Label: label, Provider: g.nodes[parent].Provider, ResolutionState: state, Resource: ref})
+}
+
+func (g *topologyGraph) referenceState(kind, namespace string) string {
+	definition := map[string]string{"Service": "kubernetes.services", "Pod": "kubernetes.pods", "Gateway": "gateway.gateways", "TraefikService": "traefik.traefikservices", "Middleware": "traefik.middlewares", "MiddlewareTCP": "traefik.middlewaretcps"}[kind]
+	state := "not_visible"
+	for _, coverage := range g.view.Coverage {
+		if coverage.Name != "" || coverage.SourceID != definition || (coverage.Namespace != "" && coverage.Namespace != namespace) {
+			continue
+		}
+		if coverage.State == "available" {
+			return "not_found"
+		}
+		if coverage.State == "partial" {
+			state = "unknown"
+		}
+	}
+	return state
+}
+func (g *topologyGraph) addRoute(object topologyObject) {
+	switch object.ref.Kind {
+	case "Ingress":
+		g.ingress(object)
+	case "HTTPRoute", "GRPCRoute", "TCPRoute", "TLSRoute", "UDPRoute":
+		g.gatewayRoute(object)
+	case "IngressRoute", "IngressRouteTCP", "IngressRouteUDP":
+		g.traefikRoute(object)
+	case "ApisixRoute":
+		g.apisixRoute(object)
+	case "ApisixTls":
+		id := g.objectNode(object, "entry", "apisix", "TLS")
+		g.properties(id, cr.NetworkTopologyProperty{Name: "SNI", Value: strings.Join(texts(at(object.body, "spec", "hosts")), ", ")})
+		if text(at(object.body, "spec", "secret", "name")) != "" {
+			g.properties(id, cr.NetworkTopologyProperty{Name: "Certificate reference", Value: "Configured; Secret existence and TLS activation unverified"})
+		}
+	}
+}
+func (g *topologyGraph) rule(object topologyObject, provider, protocol string, index int, name string, groups [][]cr.NetworkTopologyMatch) string {
+	suffix := fmt.Sprint(index)
+	if name != "" {
+		suffix = name
+	}
+	ref := object.ref
+	return g.addNode(cr.NetworkTopologyGraphNode{ID: object.id() + "/rule/" + suffix, Type: "rule", Label: firstTopology(name, fmt.Sprintf("Rule %d", index+1)), Provider: provider, Protocol: protocol, ResolutionState: "resolved", Resource: &ref, Generation: object.generation, Rule: &cr.NetworkTopologyRule{Name: name, Index: index, MatchGroups: groups}})
+}
+func (g *topologyGraph) properties(id string, values ...cr.NetworkTopologyProperty) {
+	node, ok := g.nodes[id]
+	if !ok {
+		return
+	}
+	node.Properties = append(node.Properties, values...)
+	g.nodes[id] = node
+}
+func (g *topologyGraph) state(id, state string) {
+	node, ok := g.nodes[id]
+	if ok {
+		node.ResolutionState = state
+		g.nodes[id] = node
+	}
+}
+func (g *topologyGraph) countNode(node cr.NetworkTopologyGraphNode) {
+	switch node.Type {
+	case "entry":
+		g.view.Summary.EntryCount++
+	case "rule":
+		g.view.Summary.RouteCount++
+		if node.ResolutionState != "resolved" {
+			g.view.Summary.PendingRouteCount++
+		}
+	case "service":
+		g.view.Summary.ServiceCount++
+	case "pod":
+		g.view.Summary.BackendPodCount++
+	case "backend-group":
+		if node.ResolutionState == "not_found" {
+			g.view.Summary.MissingServiceCount++
+		}
+	}
+}
+func at(object map[string]any, path ...string) any {
+	var value any = object
+	for _, key := range path {
+		item, ok := value.(map[string]any)
+		if !ok {
+			return nil
+		}
+		value = item[key]
+	}
+	return value
+}
+func object(value any) map[string]any { item, _ := value.(map[string]any); return item }
+func items(value any) []map[string]any {
+	array, _ := value.([]any)
+	result := []map[string]any{}
+	for _, item := range array {
+		if row, ok := item.(map[string]any); ok {
+			result = append(result, row)
+		}
+	}
+	return result
+}
+func texts(value any) []string {
+	array, _ := value.([]any)
+	result := []string{}
+	for _, item := range array {
+		if text, ok := item.(string); ok {
+			result = append(result, text)
+		}
+	}
+	return result
+}
+func text(value any) string {
+	if value == nil {
+		return ""
+	}
+	return fmt.Sprint(value)
+}
+func integer(value any, defaultValue int64) int64 {
+	if number, ok := value.(float64); ok {
+		return int64(number)
+	}
+	return defaultValue
+}
+func firstTopology(values ...string) string {
+	for _, value := range values {
+		if value != "" {
+			return value
+		}
+	}
+	return ""
+}
+
+func (g *topologyGraph) budgetReached() bool {
+	if len(g.nodes) >= g.nodeLimit || len(g.view.Edges) >= g.edgeLimit {
+		g.view.Truncated = true
+		return true
+	}
+	return false
+}
+
+// decodeTopologyObject enforces the fixed source's exact GVK and re-applies the
+// allowlist before any relationship interpretation (also for local snapshots).
+func decodeTopologyObject(cluster string, source cr.NetworkTopologySourceResult, item cr.NetworkTopologySourceObject) (topologyObject, bool) {
+	d, ok := cr.LookupNetworkTopologySource(source.Coverage.SourceID)
+
+	ref := item.Resource
+	ref.APIVersion = strings.TrimPrefix(ref.APIVersion, "/")
+	if !ok || ref.ClusterID != cluster || ref.Kind != d.Kind || !topologyDefinitionAPI(d, ref.APIVersion) || ref.Name == "" || len(item.Content) > cr.NetworkTopologyMaxObjectBytes {
+		return topologyObject{}, false
+	}
+	if d.Namespaced && ref.Namespace == "" || !d.Namespaced && ref.Namespace != "" || source.Coverage.Namespace != "" && ref.Namespace != source.Coverage.Namespace {
+		return topologyObject{}, false
+	}
+	if source.Coverage.Name != "" && source.Coverage.Name != ref.Name {
+		return topologyObject{}, false
+	}
+	if source.Coverage.State != "available" && source.Coverage.State != "partial" {
+		return topologyObject{}, false
+	}
+	var body map[string]any
+	if json.Unmarshal([]byte(item.Content), &body) != nil {
+		return topologyObject{}, false
+	}
+	for key, want := range map[string]string{"name": ref.Name, "namespace": ref.Namespace, "uid": ref.UID} {
+		if actual := text(at(body, "metadata", key)); actual != "" && actual != want {
+			return topologyObject{}, false
+		}
+	}
+	body, err := cr.ProjectNetworkTopologyObject(d.ID, body)
+	if err != nil {
+		return topologyObject{}, false
+	}
+	ref.ScopeMode = cr.ResourceScopeModeCluster
+	if d.Namespaced {
+		ref.ScopeMode = cr.ResourceScopeModeNamespace
+	}
+	return topologyObject{source: d.ID, ref: ref, generation: item.Generation, body: body}, true
+}
+
+func topologyDefinitionAPI(d cr.NetworkTopologySourceDefinition, api string) bool {
+	for _, version := range cr.NetworkTopologySourceVersions(d) {
+		if api == strings.TrimPrefix(d.Group+"/"+version, "/") {
+			return true
+		}
+	}
+	return false
+}
+
+// Interpret the selected root before unrelated high-fanout sources can consume
+// the bounded relationship set. Reuse the same rule methods; do not rescan input.
+func (g *topologyGraph) prioritizeRoot(root *cr.ResourceRef) string {
+	if root == nil {
+		return ""
+	}
+	o, ok := g.objects[topologyKey(root.Kind, root.Namespace, root.Name)]
+	if !ok {
+		return ""
+	}
+	g.addRoute(o)
+	switch o.source {
+	case "kubernetes.services":
+		g.service(o, "")
+	case "kubernetes.endpointslices":
+		g.endpointSlice(topologyObject{}, o, "", "")
+	}
+	g.objectDeclarations(o)
+	return o.id()
+}