@skyhook-io/k8s-ui 1.10.3 → 1.10.5

package/src/components/trace/types.ts

@@ -0,0 +1,389 @@
+// Mirrors internal/trace types.go on the Go side. Keep field names in sync
+// when extending - JSON tags on Go must match these property names exactly.
+
+export type Verdict = 'healthy' | 'degraded' | 'broken' | 'unknown'
+export type FindingSeverity = 'critical' | 'warning' | 'info'
+
+export interface ResourceRef {
+  group?: string
+  kind: string
+  namespace?: string
+  name: string
+}
+
+export interface Finding {
+  code: string
+  severity: FindingSeverity
+  message: string
+  /** Parsed root cause (plain English) when the detector classified the
+   *  failure - e.g. "Image not found in registry", "Exit code 137 (OOMKilled)".
+   *  Empty for generic detections; UI renders message in that case. */
+  cause?: string
+  /** Next-step guidance paired with cause - e.g. "Push the image or fix the
+   *  reference", "Increase the container memory limit". Empty when not parsed. */
+  action?: string
+  remediation?: string
+  command?: string
+  /** Renderable chip strip carrying structured detail a sentence can't hold -
+   *  today the egress-note's allowed destinations. On-chip text is jargon-free;
+   *  the jargon lives in each chip's title. */
+  chips?: FindingChip[]
+  /** Tiny field label printed before the chip strip ("Allowed out"). Empty when
+   *  the chips read on their own (deny-all, anywhere). */
+  chipsLabel?: string
+  /** Quiet tertiary caveats printed under the chips (declared-vs-enforced, the
+   *  gated DNS observation). Kept subordinate to the inbound verdict. */
+  chipNotes?: string[]
+  /** The specific object this finding is about when it differs from the hop it
+   *  hangs on - a pod-fanout hop carries one finding per code but the culprit is
+   *  a named Pod. Empty = the hop's own resource is the subject. */
+  resource?: ResourceRef
+}
+
+/** One tag in a Finding's chip strip. Tone 'accent' renders the info-blue
+ *  variant (anywhere / deny-all); omitted renders the muted variant. */
+export interface FindingChip {
+  text: string
+  title?: string
+  tone?: 'accent' | ''
+}
+
+/** Known hop.meta keys stamped by the Go tracer (buildPodsHop et al. in
+ *  internal/trace). The wire is an open map - property names must match the Go
+ *  meta keys exactly; unknown keys pass through the index signature. */
+export interface HopMeta {
+  /** Count of endpoints the dataplane actually routes to. For a
+   *  publishNotReadyAddresses Service this is the PUBLISHED endpoint count
+   *  (every selected pod, readiness not required) - NOT the kubelet-ready
+   *  count, so it must never render as "N/M ready" there. */
+  ready?: number
+  /** Pods matched by the Service selector. */
+  selected?: number
+  /** Set when the Service publishes endpoints regardless of pod readiness
+   *  (spec.publishNotReadyAddresses) - the signal that meta.ready is a
+   *  published count, not a readiness count. */
+  publishNotReadyAddresses?: boolean
+  /** 'pod-readiness' when endpoints were judged from pod state; 'unknown' when
+   *  the pod lister failed and the count can't be trusted. */
+  endpointSource?: string
+  selectorless?: boolean
+  [key: string]: unknown
+}
+
+export interface Hop {
+  resource: ResourceRef
+  edge: string
+  findings: Finding[]
+  meta?: HopMeta
+  config?: HopConfig
+  probes?: ProbeResult[]
+}
+
+export type ProbeLayer = 'dns' | 'tcp' | 'tls' | 'http'
+export type ProbeVantage = 'in-cluster' | 'local'
+/**
+ * Which route a Service/Pod probe took. "data" = straight to the resource
+ * over the network (kube-proxy for ClusterIP, direct dial for PodIP).
+ * "apiserver" = through the K8s API server's proxy subresource. Empty when
+ * the question doesn't apply (DNS, HTTP to an Ingress hostname, etc.).
+ */
+export type ProbePath = 'data' | 'apiserver'
+
+/**
+ * Tone classifies a Result for the UI when ok alone is too coarse. It encodes
+ * the honest distinction between reaching a target, verifying what we asked
+ * for, and the server erroring:
+ *   healthy   - reached AND verified (HTTP 2xx; clean DNS/TCP/TLS)
+ *   reached   - reached an HTTP server, but the thing we asked for is unproven
+ *               (3xx redirect not followed, or 4xx route/auth not what we hit).
+ *               NOT a reachability failure; never renders as "verified" or
+ *               "degraded".
+ *   degraded  - reached, but the server answered 5xx. Traffic passed.
+ *   unhealthy - could not reach (transport failure).
+ * Empty falls back to (skipped → unknown, !ok → unhealthy, ok → healthy).
+ */
+export type ProbeTone = 'healthy' | 'reached' | 'degraded' | 'unhealthy'
+
+export interface ProbeResult {
+  layer: ProbeLayer
+  target: string
+  vantage: ProbeVantage
+  path?: ProbePath
+  ok: boolean
+  tone?: ProbeTone
+  skipped?: boolean
+  /** Structured skip class from the producer. 'informational' means the probe
+   *  RAN and was deliberately kept out of the verdict - a disposition, never a
+   *  coverage gap. */
+  skipClass?: string
+  reason?: string
+  latencyNs?: number
+  /** The Service/target port this result is for, when port-scoped (lets the UI group
+   *  per-port results into one row per path across directions). */
+  port?: number
+  /** Declared L4 protocol when not TCP - two ServicePorts may share a number. */
+  protocol?: string
+  detail?: string
+  error?: string
+  /** What a DNS lookup resolved to. */
+  addresses?: string[]
+  /** Scope of those addresses. Describes the ADDRESS, not the journey: a public
+   *  address does not prove a packet crossed the public internet. */
+  addressScope?: 'public' | 'private' | 'mixed'
+  /** WHO issued this probe. Radar's own process and a throwaway probe Job are
+   *  both in-cluster over the data path but are different observers with
+   *  different identities. Absent means 'radar'. */
+  source?: 'radar' | 'probe-job'
+  /** Copyable command to verify what this probe couldn't (non-HTTP port, HTTPS
+   *  backend, an address only reachable in-cluster). Set at the skip site. */
+  command?: string
+}
+
+export interface PortMap {
+  name?: string
+  port: number
+  targetPort?: string
+  protocol?: string
+  appProtocol?: string
+}
+
+export interface ContainerPortRef {
+  container: string
+  name?: string
+  port: number
+  protocol?: string
+}
+
+/** One row of the Pods hop's per-pod reachability grid. Mirrors Go trace.PodStatus.
+ *  A ready pod joins its probe result by name (apiserver path) or ip (data path);
+ *  a not-ready pod has no probe and reads its cause from `reason`. */
+export interface PodStatus {
+  name: string
+  ip?: string
+  ready: boolean
+  reason?: string
+}
+
+export interface ProbeRef {
+  container: string
+  type: string
+  port?: string
+  path?: string
+  scheme?: string
+}
+
+export interface BackendRef {
+  kind: string
+  name: string
+  namespace?: string
+  port?: string
+}
+
+export interface RouteRule {
+  hosts?: string[]
+  paths?: string[]
+  backends?: BackendRef[]
+}
+
+export interface GatewayListener {
+  name?: string
+  port: number
+  protocol?: string
+  hostname?: string
+}
+
+export interface HopConfig {
+  ports?: PortMap[]
+  serviceType?: string
+  clusterIP?: string
+  selector?: Record<string, string>
+  containerPorts?: ContainerPortRef[]
+  probes?: ProbeRef[]
+  hostnames?: string[]
+  rules?: RouteRule[]
+  tlsHosts?: string[]
+  listeners?: GatewayListener[]
+  addresses?: string[]
+  servedBy?: string
+  servedByTitle?: string
+  podIPs?: string[]
+  podNames?: string[]
+  pods?: PodStatus[]
+  podTotal?: number
+  /** What RUNS these Pods, resolved through their owner chain by the producer.
+   *  Absent when the selected Pods have no single owner - a bare Pod, or two
+   *  workloads behind one Service, where naming one would be a guess. */
+  workload?: ResourceRef
+}
+
+export type UnknownClass = 'by-design' | 'investigate'
+
+export interface Trace {
+  subject: ResourceRef
+  upstreams: Hop[]
+  downstream: Hop[]
+  verdict: Verdict
+  brokenAt: number
+  reason?: string
+  /** Where RADAR ITSELF ran the inline probes from: 'in-cluster' when Radar is
+   *  a Pod (its direct dials are real pod-to-pod traffic, issued with Radar's
+   *  own identity) or 'local' when it runs on a workstation. Without this an
+   *  in-cluster probe with no `source` is ambiguous between Radar's own dial and
+   *  the throwaway Job's. */
+  runVantage?: 'in-cluster' | 'local'
+  /** Distinguishes the two flavors of the unknown verdict so the UI can
+   *  pick the right visual register. 'by-design' covers configurations
+   *  where auto-verification doesn't apply (e.g. selectorless Service);
+   *  the banner renders as informational. 'investigate' covers cases
+   *  where the trace tried and couldn't read state (RBAC, cache cold,
+   *  lookup failure); the banner renders as warning. Absent on
+   *  non-unknown verdicts. */
+  unknownClass?: UnknownClass
+  truncated?: boolean
+  // Coverage-honest projection (server-authoritative, mirrors internal/trace/coverage.go).
+  // These describe ONLY what was actually tested. Localization on a RouteResult is the
+  // behind-the-gate evidence, kept separate so it can never feed the headline/outcome.
+  coverage?: Coverage
+  routes?: RouteResult[]
+  notTested?: RouteSkip[]
+  brokenRoute?: ResourceRef
+  /** The single coverage-honest banner sentence - same string the MCP renders. */
+  headline?: string
+  /** The one finding that matters - cause, the named culprit, the next action -
+   *  promoted from the path so a consumer reads the "why + what next" without
+   *  walking the hop chain. Absent when there is nothing to diagnose (every
+   *  route verified over real traffic). */
+  diagnosis?: Diagnosis
+}
+
+/** Hoisted lead diagnosis, mirrors internal/trace/coverage.go Diagnosis. Every
+ *  field is PROMOTED from a real finding (or coverage state), never synthesized.
+ *  causeCode is the structured code, present ONLY for trustworthy structural
+ *  fingerprints (missing-ref / svc:*); a pod-state code is omitted and summary
+ *  carries the honest prose instead. */
+export interface Diagnosis {
+  causeCode?: string
+  /** Which route this diagnosis explains, when attributable to exactly one.
+   *  Absent means it describes the resource as a whole. The selected-path panel
+   *  must not present another path's cause as this path's. */
+  route?: string
+  summary: string
+  culpritResource?: ResourceRef
+  nextAction?: string
+  command?: string
+}
+
+/** Per-route outcome (pairs with a confidence). Mirrors the Go Outcome* constants. */
+export type RouteOutcome = 'verified' | 'reached' | 'server-error' | 'unreachable' | 'not-tested'
+/** How an outcome was learned: 'real' = real-traffic path; 'indirect' = apiserver proxy
+ *  (annotates, never sets the headline). '' for a static-known break (missing backend). */
+export type RouteConfidence = 'real' | 'indirect' | ''
+/** Skip impact: 'coverage' + 'vantage' are real gaps (cap green); 'benign' loses no coverage. */
+export type SkipReasonClass = 'coverage' | 'benign' | 'vantage'
+
+export interface Coverage {
+  tested: number
+  passed: number
+  failed: number
+  skipped: number
+  /** Routes known broken WITHOUT being dialled - from what is declared, or from
+   *  current cluster state. Real breaks, but not test results, so they are
+   *  reported apart from tested/passed/failed rather than as requests that
+   *  failed. */
+  derived?: number
+}
+
+export interface ProbeFact {
+  layer: string
+  path?: string
+  target?: string
+  ok: boolean
+  tone?: string
+  detail?: string
+}
+
+export interface RouteResult {
+  route: string
+  target?: string
+  /** Backend Service namespace - set when it differs from the subject namespace
+   *  (cross-namespace Gateway API backendRef) so the in-cluster probe dials an FQDN. */
+  targetNamespace?: string
+  outcome: RouteOutcome
+  /** Which layer failed on a non-reachable route, so the UI can say exactly what
+   *  broke: 'tcp' | 'tls' | 'http' (unreachable), or 'upstream' for a 502/504 where
+   *  HTTP was reached but the gateway couldn't reach its backend. */
+  failedLayer?: 'tcp' | 'tls' | 'http' | 'upstream'
+  confidence?: RouteConfidence
+  evidence?: string
+  command?: string
+  /** Unreachable by DESIGN (backing workload intentionally scaled to 0) - read
+   *  amber-benign, not red. */
+  benign?: boolean
+  /** Behind-the-gate facts (apiserver/direct-pod). Render as plain "checked behind it"
+   *  sub-lines - never label them "localization" in the UI. */
+  localization?: ProbeFact[]
+  /** Best-guess concrete request to test this route from inside the cluster.
+   *  A STARTING POINT the user edits before running; pathGuessed marks a path
+   *  derived from a pattern (no single faithful request exists). */
+  inClusterRequest?: ProbeRequest
+  /** Where this route's `outcome` came from. Absent (the normal case) means it
+   *  was OBSERVED and `byVantage` says by whom. Otherwise it was DERIVED and no
+   *  vantage dialled it, so it must never be rendered as the selected origin's
+   *  observation nor in the language of a request:
+   *
+   *   - 'declared-config'  read off what is declared (a backendRef naming a
+   *                        Service that does not exist) - broken regardless of
+   *                        what the cluster is currently doing.
+   *   - 'cluster-state'    read off current state (no ready endpoints) - true
+   *                        now, and changes when the workload does. */
+  basis?: 'declared-config' | 'cluster-state'
+  /** Each vantage's OWN view of this route.
+   *
+   *  `outcome` / `confidence` / `evidence` above are a documented lossy rollup:
+   *  the producer buckets by mechanism and takes worst-wins, so a route that
+   *  works in-cluster and fails from a laptop collapses to "unreachable" with no
+   *  field left to say where it DID work. Anything answering "did this path work
+   *  from THIS vantage" must read this instead of the rollup. */
+  byVantage?: VantageResult[]
+}
+
+/** One vantage's unmerged view of a route. Keyed by (vantage, path): the same
+ *  vantage relayed through the API server is a different claim from one that
+ *  used the real network path. */
+export interface VantageResult {
+  vantage: ProbeVantage
+  path: ProbePath
+  /** Who dialled: 'radar' (Radar's own process) or 'probe-job' (a throwaway Pod
+   *  Radar created). Absent means 'radar'. Kept apart from `vantage` because the
+   *  two share (in-cluster, data) but are different observers. */
+  source?: 'radar' | 'probe-job'
+  outcome: RouteOutcome
+  confidence?: RouteConfidence
+  evidence?: string
+  failedLayer?: 'tcp' | 'tls' | 'http' | 'upstream'
+  /** Which hop-to-hop boundary broke, when two observations either side of it
+   *  establish that. Empty means we could not tell - the common case, and never
+   *  to be guessed at in the UI. */
+  failedBoundary?: 'service-routing'
+  /** Which part of the DECLARED path this row's dial exercised. 'backend' means
+   *  the dial bypassed the route's front door, so this row can never vouch for
+   *  the entry path. Empty when there is no separate entry segment. */
+  segment?: 'backend'
+}
+
+/** A concrete request the in-cluster runner can send to the Service. HTTP
+ * fields are absent for transport-only TCP probes. */
+export interface ProbeRequest {
+  protocol: 'http' | 'https' | 'tcp'
+  scheme?: 'http' | 'https'
+  host?: string
+  path?: string
+  pathGuessed?: boolean
+}
+
+export interface RouteSkip {
+  route?: string
+  reason: string
+  reasonClass?: SkipReasonClass
+  command?: string
+}

package/src/components/ui/InClusterConsentDialog.test.tsx

@@ -0,0 +1,83 @@
+import { describe, expect, it } from 'vitest'
+import { inClusterConsentDetails } from './InClusterConsentDialog'
+
+const req = (route: string, request: string) => ({ route, request })
+
+describe('inClusterConsentDetails', () => {
+  it('names the requests it is about to send, not just where they land', () => {
+    // This is the last screen before real pod-to-pod traffic. It used to show
+    // only the cluster and namespace, so the operator confirmed requests they
+    // were never shown.
+    const out = inClusterConsentDetails({
+      cluster: 'prod-us-east1',
+      namespace: 'payments',
+      requests: [req('checkout.example.com/', 'GET https://checkout.example.com/healthz')],
+    })
+    expect(out).toContain('prod-us-east1')
+    expect(out).toContain('payments')
+    expect(out).toContain('GET https://checkout.example.com/healthz')
+  })
+
+  it('shows each route its OWN path — a single "GET /" was wrong in the default case', () => {
+    // With no path override the server keeps every route's declared path, so one
+    // shared "/" is least accurate exactly when it used to be displayed.
+    const out = inClusterConsentDetails({
+      namespace: 'payments',
+      requests: [
+        req('a.example.com/api', 'GET https://a.example.com/api'),
+        req('b.example.com/health', 'GET https://b.example.com/health'),
+      ],
+    })
+    expect(out).toContain('/api')
+    expect(out).toContain('/health')
+  })
+
+  it('counts declared paths that have no derivable request', () => {
+    // They are part of the scope being agreed to; omitting them undercounted
+    // what the run covers.
+    const out = inClusterConsentDetails({
+      namespace: 'payments',
+      requests: [req('a/', 'GET http://svc:80/')],
+      untestedCount: 2,
+    })
+    expect(out).toMatch(/Declared:\s+3 paths/)
+    expect(out).toMatch(/2 paths with no derivable request/)
+  })
+
+  it('says "path" singular for one', () => {
+    expect(inClusterConsentDetails({ namespace: 'p', requests: [req('a', 'GET /')] })).toMatch(/Declared:\s+1 path\b(?!s)/)
+  })
+
+  it('caps the listed requests but says how many are hidden', () => {
+    const many = Array.from({ length: 9 }, (_, i) => req(`r${i}`, `GET http://svc:80/${i}`))
+    const out = inClusterConsentDetails({ namespace: 'p', requests: many })
+    expect(out).toMatch(/Declared:\s+9 paths/)
+    expect(out).toMatch(/and 3 more/)
+  })
+
+  it('omits the coverage block entirely when nothing is known, rather than guessing', () => {
+    const out = inClusterConsentDetails({ namespace: 'payments' })
+    expect(out).not.toMatch(/Declared:/)
+    expect(out).toMatch(/Namespace: payments/)
+  })
+
+  it('omits the cluster line when identity is unavailable', () => {
+    expect(inClusterConsentDetails({ namespace: 'payments' })).not.toMatch(/Cluster:/)
+  })
+  it('discloses the probe-Pod cap instead of implying full coverage', () => {
+    // Route order is deterministic server-side, so routes past the cap are not
+    // deferred - re-running starts from the same first five and never reaches
+    // them. A screen that counts them as covered is the misleading part.
+    const many = Array.from({ length: 8 }, (_, i) => req(`r${i}`, `GET http://svc:80/${i}`))
+    const out = inClusterConsentDetails({ namespace: 'p', requests: many, maxProbes: 5 })
+    expect(out).toMatch(/Will run:\s+5 requests/)
+    expect(out).toMatch(/3 beyond the 5-Pod limit/)
+    expect(out).toMatch(/same first 5/)
+  })
+
+  it('says nothing about a cap when everything fits under it', () => {
+    const out = inClusterConsentDetails({ namespace: 'p', requests: [req('a', 'GET http://svc:80/')], maxProbes: 5 })
+    expect(out).toMatch(/Will run:\s+1 request\b(?!s)/)
+    expect(out).not.toMatch(/beyond the/)
+  })
+})

package/src/components/ui/InClusterConsentDialog.tsx

@@ -0,0 +1,141 @@
+import { useState } from 'react'
+import { ConfirmDialog } from './ConfirmDialog'
+import { rememberInClusterConsent } from '../../utils/inClusterConsent'
+
+/** One request the in-cluster job will actually send. */
+export interface ConsentRequest {
+  /** Route label, for the operator to recognise which path this is. */
+  route: string
+  /** Concrete request, e.g. "GET https://checkout.example.com/healthz". */
+  request: string
+}
+
+interface InClusterConsentDialogProps {
+  open: boolean
+  cluster?: string
+  namespace: string
+  /** The requests this run will send, one per declared route. */
+  requests?: ConsentRequest[]
+  /** Declared paths the run covers but for which no concrete request could be
+   *  derived. They still count toward the scope the operator is agreeing to. */
+  untestedCount?: number
+  /** Server-side ceiling on probe Pods per call. */
+  maxProbes?: number
+  onClose: () => void
+  onConfirm: () => void
+}
+
+/** Rows are capped so the dialog stays a confirmation, not a report. */
+const MAX_LISTED_REQUESTS = 6
+
+/**
+ * The fact block the operator confirms against. It is the last screen before
+ * real pod-to-pod traffic, so it must name the requests being sent - it used to
+ * show only where the Job would land, and then only a single "GET /" that was
+ * wrong in the DEFAULT case: with no path override the server keeps each
+ * route's OWN declared path, so "/" is least accurate exactly when it is shown.
+ */
+export function inClusterConsentDetails(o: {
+  cluster?: string
+  namespace: string
+  requests?: ConsentRequest[]
+  untestedCount?: number
+  /** Server-side ceiling on probe Pods per call. Routes past it do not run, and
+   *  since ordering is deterministic they are not reached by re-running either -
+   *  so the screen must say so rather than imply full coverage. */
+  maxProbes?: number
+}): string {
+  const reqs = o.requests ?? []
+  const untested = o.untestedCount ?? 0
+  const total = reqs.length + untested
+  const cap = o.maxProbes ?? 0
+  const willRun = cap > 0 ? Math.min(reqs.length, cap) : reqs.length
+  const lines = [cluster(o.cluster), `Namespace: ${o.namespace}`]
+  if (total > 0) {
+    lines.push(`Declared:  ${total} path${total === 1 ? '' : 's'} on this resource`)
+    // "0 requests, one Pod each" is nonsense, and it describes a run that would
+    // create nothing at all - so say that instead of counting to zero.
+    lines.push(
+      willRun === 0
+        ? 'Will run:  nothing — no request could be derived from these paths'
+        : `Will run:  ${willRun} request${willRun === 1 ? '' : 's'}, one Pod each`,
+    )
+  }
+  for (const r of reqs.slice(0, MAX_LISTED_REQUESTS)) {
+    lines.push(`  → ${r.request}`)
+  }
+  const hidden = reqs.length - Math.min(reqs.length, MAX_LISTED_REQUESTS)
+  if (hidden > 0) lines.push(`  → …and ${hidden} more`)
+  // Named, never silently dropped: they are part of the scope being agreed to
+  // even though no concrete request could be derived for them.
+  if (untested > 0) {
+    lines.push(`  → ${untested} path${untested === 1 ? '' : 's'} with no derivable request`)
+  }
+  const beyond = reqs.length - willRun
+  if (beyond > 0) {
+    lines.push(`  → ${beyond} beyond the ${cap}-Pod limit — not tested, and re-running starts from the same first ${cap}`)
+  }
+  return lines.filter(Boolean).join('\n')
+}
+
+function cluster(name?: string): string {
+  return name ? `Cluster:   ${name}` : ''
+}
+
+// Confirms the mutating in-cluster reachability test before it spawns a Job/pod,
+// naming the cluster it lands in. Permission is enforced upstream (the button only
+// renders when the capability SSAR allows), so this is a safety confirm, not authz.
+export function InClusterConsentDialog({ open, cluster, namespace, requests, untestedCount, maxProbes, onClose, onConfirm }: InClusterConsentDialogProps) {
+  const [dontAskAgain, setDontAskAgain] = useState(false)
+
+  function handleClose() {
+    onClose()
+    setDontAskAgain(false)
+  }
+
+  function handleConfirm() {
+    if (dontAskAgain && cluster) rememberInClusterConsent(cluster)
+    setDontAskAgain(false)
+    onConfirm()
+  }
+
+  return (
+    <ConfirmDialog
+      open={open}
+      onClose={handleClose}
+      onConfirm={handleConfirm}
+      // Wide enough for a real cluster identity: a GKE context name runs past
+      // 50 characters and wrapped mid-name at the default width.
+      className="w-full max-w-xl"
+      title="Run in-cluster reachability test?"
+      message="This creates one short-lived, self-deleting Job per request, sending real pod-to-pod traffic from inside the cluster. Each Pod runs under the target namespace’s default ServiceAccount with no token mounted — not as you — and your cluster may inject sidecars into it."
+      details={inClusterConsentDetails({ cluster, namespace, requests, untestedCount, maxProbes })}
+      // Nothing to send means nothing to confirm. The button was live for a run
+      // that would create no Pods and change no evidence.
+      confirmDisabled={(requests?.length ?? 0) === 0}
+      confirmLabel="Run test"
+      cancelLabel="Cancel"
+      variant="warning"
+    >
+      {/* "Don't ask again" is stored per cluster. Without a cluster identity
+          there is nothing safe to key it on (one origin can front many
+          clusters), so consent is never remembered - hide the checkbox rather
+          than promise a persistence that doesn't stick. */}
+      {cluster ? (
+        <label className="flex items-center gap-2 text-sm text-theme-text-secondary">
+          <input
+            type="checkbox"
+            checked={dontAskAgain}
+            onChange={(e) => setDontAskAgain(e.target.checked)}
+            className="w-4 h-4 rounded border-theme-border bg-theme-base text-amber-600 focus:ring-amber-500 focus:ring-offset-0"
+          />
+          <span>Don&apos;t ask again for this cluster</span>
+        </label>
+      ) : (
+        <p className="text-xs text-theme-text-tertiary">
+          Cluster identity unavailable - this confirmation can&apos;t be saved, so it will be asked on every run.
+        </p>
+      )}
+    </ConfirmDialog>
+  )
+}

package/src/components/ui/index.ts

@@ -27,6 +27,7 @@ export * from './drawer-components'
 export { Collapse, CollapseChevron } from './Collapse'
 export { ResourceBar } from './ResourceBar'
 export { ForceDeleteConfirmDialog } from './ForceDeleteConfirmDialog'
+export { InClusterConsentDialog } from './InClusterConsentDialog'
 export { ToastProvider, useToast, showApiError, showApiSuccess } from './Toast'
 export { CodeViewer } from './CodeViewer'
 export { YamlEditor, YamlDiffEditor } from './YamlEditor'