@skyhook-io/k8s-ui 1.10.3 → 1.10.5

package/src/components/trace/podReach.ts

@@ -0,0 +1,37 @@
+import type { ProbeResult, ProbeLayer } from './types'
+import type { StatusTone } from '../ui/status-tone'
+import { hostFromTarget } from './reachVerdict'
+
+// A Pods-hop probe target is "<name> port <N>" (apiserver path) or "<ip>:<port>"
+// (data path). The pod identity is the first token with any :port stripped, which
+// joins back to the roster's name (apiserver) or ip (data). hostFromTarget is
+// IPv6-aware for the ip:port form.
+export function podProbeKey(target?: string): string {
+  return hostFromTarget((target || '').split(' ')[0])
+}
+
+/**
+ * Summarizes ONE pod's probe results into a single reachability cell: its worst
+ * live outcome (a failure wins, so a bad pod is never masked), else the deepest
+ * layer it reached, with the vantage that produced it.
+ */
+export function podReach(probes: ProbeResult[]): { tone: StatusTone; text: string; vantage: string } {
+  const live = probes.filter((p) => !p.skipped)
+  if (live.length === 0) return { tone: 'neutral', text: 'not tested', vantage: '' }
+  const vantage = live.some((p) => p.vantage === 'in-cluster') ? 'real' : live.some((p) => p.path === 'apiserver') ? 'via API server' : ''
+  const failed = live.find((p) => !p.ok || p.tone === 'unhealthy')
+  if (failed) return { tone: 'unhealthy', text: failed.detail || failed.error || `${failed.layer.toUpperCase()} failed`, vantage }
+  const order: ProbeLayer[] = ['http', 'tls', 'tcp', 'dns']
+  const best = order.map((L) => live.find((p) => p.layer === L && p.ok)).find(Boolean)
+  // Only a real-traffic HTTP 2xx is "verified" (green). A reached 3xx/4xx (tone
+  // 'reached') or a transport-only TCP/TLS/DNS success proves the port answers, not
+  // that the real path serves - so it reads neutral ("reached, not verified"),
+  // matching the route pills, instead of a green dot the headline contradicts.
+  const tone: StatusTone =
+    best?.tone === 'degraded'
+      ? 'degraded'
+      : best?.layer === 'http' && best?.tone !== 'reached'
+        ? 'healthy'
+        : 'neutral'
+  return { tone, text: best?.detail || 'reached', vantage }
+}

package/src/components/trace/probe-display.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest'
+import { collapseSkipRows } from './probe-display'
+import type { ProbeResult } from './types'
+
+const skip = (overrides: Partial<ProbeResult>): ProbeResult => ({
+  layer: 'http',
+  target: 'port 53',
+  vantage: 'local',
+  ok: false,
+  skipped: true,
+  reason: 'Port named "dns" looks non-HTTP.',
+  ...overrides,
+})
+
+const ok = (overrides: Partial<ProbeResult>): ProbeResult => ({
+  layer: 'http',
+  target: 'port 80',
+  vantage: 'local',
+  ok: true,
+  ...overrides,
+})
+
+describe('collapseSkipRows', () => {
+  it('returns empty for empty input', () => {
+    expect(collapseSkipRows([])).toEqual([])
+  })
+
+  it('passes non-skipped rows through unchanged', () => {
+    const rows = [ok({ target: '10.0.0.1:80' }), ok({ target: '10.0.0.2:80' })]
+    expect(collapseSkipRows(rows)).toEqual(rows)
+  })
+
+  it('collapses identical-reason skip rows into one with count', () => {
+    const rows = [skip({ target: 'pod-a port 53' }), skip({ target: 'pod-b port 53' }), skip({ target: 'pod-c port 53' })]
+    const out = collapseSkipRows(rows)
+    expect(out).toHaveLength(1)
+    expect(out[0].target).toBe('3 probes skipped')
+    expect(out[0].skipped).toBe(true)
+  })
+
+  it('keeps single skip rows untouched', () => {
+    const rows = [skip({ target: 'pod-a port 53' })]
+    const out = collapseSkipRows(rows)
+    expect(out).toHaveLength(1)
+    expect(out[0].target).toBe('pod-a port 53')
+  })
+
+  it('keeps skip rows with different reasons separate', () => {
+    const rows = [
+      skip({ reason: 'Port named "dns" looks non-HTTP.' }),
+      skip({ reason: 'Port named "dns-tcp" looks non-HTTP.' }),
+    ]
+    expect(collapseSkipRows(rows)).toHaveLength(2)
+  })
+
+  it('keeps skip rows with different paths separate', () => {
+    const rows = [
+      skip({ path: 'apiserver', target: 'pod-a port 53' }),
+      skip({ path: 'data', target: 'pod-a port 53' }),
+    ]
+    expect(collapseSkipRows(rows)).toHaveLength(2)
+  })
+
+  it('preserves order: collapsed row stays at the position of the first occurrence', () => {
+    const rows = [
+      ok({ target: '10.0.0.1:80' }),
+      skip({ target: 'pod-a port 53' }),
+      ok({ target: '10.0.0.2:80' }),
+      skip({ target: 'pod-b port 53' }),
+    ]
+    const out = collapseSkipRows(rows)
+    expect(out).toHaveLength(3)
+    expect(out[0].target).toBe('10.0.0.1:80')
+    expect(out[1].target).toBe('2 probes skipped')
+    expect(out[2].target).toBe('10.0.0.2:80')
+  })
+
+  it('keeps skip rows with the same reason but different commands separate', () => {
+    // Per-pod port-forward commands differ even when the reason is identical;
+    // collapsing would surface only the first pod's command for all of them.
+    const rows = [
+      skip({ target: 'pod-a port 6379', command: 'kubectl port-forward pod/pod-a -n ns 6379:6379' }),
+      skip({ target: 'pod-b port 6379', command: 'kubectl port-forward pod/pod-b -n ns 6379:6379' }),
+    ]
+    expect(collapseSkipRows(rows)).toHaveLength(2)
+  })
+
+  it('collapses skip rows that share reason AND command', () => {
+    const rows = [
+      skip({ target: 'a', command: 'kubectl auth can-i get services/proxy -n ns' }),
+      skip({ target: 'b', command: 'kubectl auth can-i get services/proxy -n ns' }),
+    ]
+    const out = collapseSkipRows(rows)
+    expect(out).toHaveLength(1)
+    expect(out[0].target).toBe('2 probes skipped')
+    expect(out[0].command).toBe('kubectl auth can-i get services/proxy -n ns')
+  })
+
+  it('does not dedupe a skip row with no reason (defensive)', () => {
+    const rows = [
+      skip({ target: 'pod-a port 53', reason: undefined }),
+      skip({ target: 'pod-b port 53', reason: undefined }),
+    ]
+    const out = collapseSkipRows(rows)
+    expect(out).toHaveLength(2)
+  })
+})

package/src/components/trace/probe-display.ts

@@ -0,0 +1,37 @@
+import type { ProbeResult } from './types'
+
+// collapseSkipRows folds identical (layer, path, reason, command) skip rows
+// into a single row labelled with the collapsed count. Real probe outcomes
+// (success, failure, partial latency rows) pass through unchanged - only
+// "didn't run, here's why" rows get deduped. Driving case: a Pods hop
+// with three replicas and one non-HTTP port produces three skip rows
+// with identical reasons; the operator only needs to read it once. The
+// command is part of the key so rows whose fill-the-gap commands differ
+// (e.g. a per-pod port-forward) stay separate rather than collapse and
+// surface the wrong pod's command.
+export function collapseSkipRows(rows: ProbeResult[]): ProbeResult[] {
+  const out: ProbeResult[] = []
+  const seenIdx = new Map<string, number>()
+  const counts = new Map<string, number>()
+  for (const r of rows) {
+    if (!r.skipped || !r.reason) {
+      out.push(r)
+      continue
+    }
+    const key = [r.layer, r.path ?? '', r.reason, r.command ?? ''].join('|')
+    if (!seenIdx.has(key)) {
+      seenIdx.set(key, out.length)
+      counts.set(key, 1)
+      out.push(r)
+    } else {
+      counts.set(key, (counts.get(key) ?? 1) + 1)
+    }
+  }
+  return out.map((r) => {
+    if (!r.skipped) return r
+    const key = [r.layer, r.path ?? '', r.reason, r.command ?? ''].join('|')
+    const n = counts.get(key) ?? 1
+    if (n <= 1) return r
+    return { ...r, target: `${n} probes skipped` }
+  })
+}

package/src/components/trace/reachFixtures.ts

@@ -0,0 +1,261 @@
+import type { Trace, PodStatus, ProbeResult } from './types'
+
+/**
+ * Fixtures for the dev-only state switcher. These exist so the empty, failing,
+ * sampled and permission-denied states are reachable without engineering a real
+ * cluster into each shape - they are NOT demo data and never render outside a
+ * dev build.
+ *
+ * The prototype this view was built from carried a tenth state, "conflicting
+ * vantages", where a synthetic probe succeeds and the real caller is refused.
+ * It is deliberately absent: RouteResult holds ONE outcome and ONE confidence,
+ * so two disagreeing origins cannot both be retained. Faking it here would
+ * imply a capability the model does not have.
+ */
+export type DevState = 'mixed' | 'break' | 'front' | 'synth' | 'scale' | 'fanout' | 'none' | 'running' | 'stale' | 'rbac'
+
+export const DEV_STATES: { id: DevState; label: string }[] = [
+  { id: 'mixed', label: '1 · Mixed vantages' },
+  { id: 'break', label: '2 · Confirmed break' },
+  { id: 'front', label: '3 · Front door verified' },
+  { id: 'synth', label: '4 · Synthetic only' },
+  { id: 'scale', label: '5 · Aggregated scale' },
+  { id: 'fanout', label: '6 · Gateway fan-out' },
+  { id: 'none', label: 'No tests yet' },
+  { id: 'running', label: 'Probe running' },
+  { id: 'stale', label: 'Stale + changed' },
+  { id: 'rbac', label: 'Probe not permitted' },
+]
+
+const NS = 'payments'
+const SUBJECT = { kind: 'Service', name: 'checkout-api', namespace: NS }
+
+const probe = (o: Partial<ProbeResult>): ProbeResult => ({
+  layer: 'http',
+  target: 'checkout-api:80',
+  vantage: 'in-cluster',
+  path: 'data',
+  ok: true,
+  tone: 'healthy',
+  ...o,
+})
+
+const pod = (name: string, ready: boolean, ip: string, reason?: string): PodStatus => ({ name, ready, ip, reason })
+
+const PODS = [
+  pod('checkout-api-7d4c-d4wq', true, '10.244.1.17'),
+  pod('checkout-api-7d4c-m8zt', true, '10.244.2.31'),
+  pod('checkout-api-7d4c-k9x2', false, '10.244.3.9', 'readiness probe failing for 12m'),
+]
+
+function base(): Trace {
+  return {
+    subject: SUBJECT,
+    verdict: 'healthy',
+    brokenAt: -1,
+    upstreams: [],
+    downstream: [],
+    coverage: { tested: 2, passed: 2, failed: 0, skipped: 1 },
+    routes: [],
+    notTested: [],
+  }
+}
+
+function serviceHop(clusterIP = '10.96.14.2') {
+  return {
+    resource: SUBJECT,
+    edge: 'service',
+    findings: [],
+    config: { clusterIP, serviceType: 'ClusterIP', selector: { app: 'checkout-api' }, ports: [{ port: 80, targetPort: '8080' }] },
+    probes: [],
+  }
+}
+
+function podsHop(pods: PodStatus[], probes: ProbeResult[], podTotal?: number) {
+  const ready = pods.filter((p) => p.ready).length
+  return {
+    resource: { kind: 'Pods', name: '', namespace: NS },
+    edge: 'service->pods',
+    findings: [],
+    meta: { ready: podTotal ? 236 : ready, selected: podTotal ?? pods.length },
+    config: { pods, podTotal: podTotal ?? pods.length },
+    probes,
+  }
+}
+
+export function devTrace(state: DevState): Trace {
+  const t = base()
+  const okProbes = [
+    probe({ target: '10.244.1.17:8080', detail: 'HTTP 200', latencyNs: 11_000_000 }),
+    probe({ target: '10.244.2.31:8080', detail: 'HTTP 200', latencyNs: 9_000_000 }),
+  ]
+
+  if (state === 'none') {
+    return {
+      ...t,
+      verdict: 'unknown',
+      unknownClass: 'by-design',
+      headline: 'Untested — configuration predicts this path but nothing has been observed',
+      coverage: { tested: 0, passed: 0, failed: 0, skipped: 3 },
+      downstream: [serviceHop(), podsHop(PODS, [])],
+      routes: [
+        { route: 'GET / · :80 → 8080', target: ':80 → 8080', outcome: 'not-tested' },
+        { route: 'gRPC :9090 → 9090', target: ':9090 → 9090', outcome: 'not-tested' },
+      ],
+    }
+  }
+
+  if (state === 'break') {
+    const failed = [
+      probe({ layer: 'tcp', target: '10.244.1.17:8080', ok: false, tone: 'unhealthy', error: 'ECONNREFUSED', detail: 'connection refused' }),
+      probe({ layer: 'tcp', target: '10.244.2.31:8080', ok: false, tone: 'unhealthy', error: 'ECONNREFUSED', detail: 'connection refused' }),
+    ]
+    return {
+      ...t,
+      verdict: 'broken',
+      brokenAt: 1,
+      headline: 'Unreachable — every eligible endpoint refused the connection on 8080',
+      coverage: { tested: 2, passed: 0, failed: 2, skipped: 1 },
+      downstream: [serviceHop(), podsHop(PODS, failed)],
+      diagnosis: {
+        causeCode: 'svc:port-mismatch',
+        summary: 'The Service targetPort (8080) does not match the container port (8081).',
+        nextAction: 'Edit the Service targetPort to 8081.',
+        culpritResource: SUBJECT,
+      },
+      routes: [
+        { route: 'GET / · :80 → 8080', target: ':80 → 8080', outcome: 'unreachable', failedLayer: 'tcp', confidence: 'real', evidence: 'ECONNREFUSED at both endpoints' },
+        { route: 'gRPC :9090 → 9090', target: ':9090 → 9090', outcome: 'reached', confidence: 'indirect', evidence: 'stream reset via proxy' },
+      ],
+    }
+  }
+
+  if (state === 'scale') {
+    const many: PodStatus[] = Array.from({ length: 8 }, (_, i) => pod(`checkout-api-7d4c-s${i}`, true, `10.244.4.${i + 10}`))
+    many.push(pod('checkout-api-7d4c-q7r2', true, '10.244.4.99'))
+    const probes = [
+      ...many.slice(0, 7).map((p) => probe({ target: `${p.ip}:8080`, detail: 'HTTP 200', latencyNs: 12_000_000 })),
+      probe({ target: '10.244.4.99:8080', ok: false, tone: 'unhealthy', layer: 'tcp', error: 'ECONNREFUSED', detail: 'connection refused' }),
+      probe({ target: '10.244.4.10:8080', detail: 'HTTP 200', latencyNs: 1_900_000_000 }),
+    ]
+    return {
+      ...t,
+      verdict: 'degraded',
+      headline: 'Mostly reachable — one eligible endpoint refuses connections and most were not probed',
+      coverage: { tested: 8, passed: 7, failed: 1, skipped: 228 },
+      downstream: [serviceHop(), podsHop(many, probes, 240)],
+      routes: [{ route: 'GET / · :80 → 8080', target: ':80 → 8080', outcome: 'reached', confidence: 'real', evidence: '7 of 8 sampled endpoints returned HTTP 200' }],
+    }
+  }
+
+  if (state === 'front') {
+    const allReady = PODS.map((p) => ({ ...p, ready: true, reason: undefined }))
+    return {
+      ...t,
+      headline: 'Reachable — the front door itself was exercised from outside the cluster',
+      coverage: { tested: 3, passed: 3, failed: 0, skipped: 0 },
+      upstreams: [
+        {
+          resource: { kind: 'Gateway', name: 'primary-gateway', namespace: NS },
+          edge: 'gateway->service',
+          findings: [],
+          config: { addresses: ['203.0.113.7'], listeners: [{ name: 'https', port: 443, protocol: 'HTTPS' }] },
+          probes: [probe({ layer: 'tls', vantage: 'local', target: '203.0.113.7:443', detail: 'TLS handshake OK' })],
+        },
+      ],
+      downstream: [serviceHop(), podsHop(allReady, okProbes)],
+      routes: [
+        { route: 'front door · primary-gateway', target: ':443 → 80', outcome: 'verified', confidence: 'real', evidence: 'HTTP 200 · 41 ms from outside the cluster' },
+        { route: 'GET / · :80 → 8080', target: ':80 → 8080', outcome: 'verified', confidence: 'real', evidence: 'HTTP 200 · 11 ms' },
+      ],
+    }
+  }
+
+
+  // A Gateway with several attached routes - the ONE shape where the topology
+  // itself is the information rather than a formality. It is also the shape the
+  // fixtures never covered, which is how a listener-hostname bug survived: the
+  // front-door fixture declares a listener with no hostname, so the code path
+  // that reads listener hostnames was never exercised here.
+  if (state === 'fanout') {
+    const GW = { kind: 'Gateway', name: 'primary-gateway', namespace: 'edge' }
+    const routeHop = (name: string, host: string, findings: Trace['downstream'][number]['findings'] = []) => ({
+      resource: { kind: 'HTTPRoute', name, namespace: NS },
+      edge: 'Gateway->HTTPRoute',
+      findings,
+      config: { hostnames: [host] },
+      probes: [],
+    })
+    return {
+      ...t,
+      subject: GW,
+      verdict: 'degraded',
+      headline: 'One of seven routes has no backend - the rest are configured and untested',
+      upstreams: [],
+      downstream: [
+        routeHop('shop', 'shop.example.com'),
+        routeHop('checkout', 'checkout.example.com', [
+          { code: 'route:no-backend', severity: 'critical', message: "Service 'checkout-api' in namespace 'payments' doesn't exist, so this route's backend receives no traffic.", cause: 'Backend Service missing', action: 'Create the Service or fix the backendRef' },
+        ]),
+        routeHop('account', 'account.example.com'),
+        routeHop('admin', 'admin.example.com', [
+          { code: 'route:not-accepted', severity: 'warning', message: 'Not Accepted by the parent Gateway - hostname not covered by any listener.', cause: 'Hostname not served by a listener' },
+        ]),
+        routeHop('docs', 'docs.example.com'),
+        routeHop('status', 'status.example.com'),
+        routeHop('api', 'api.example.com'),
+      ],
+      coverage: { tested: 0, passed: 0, failed: 0, skipped: 7 },
+      routes: [
+        { route: 'checkout.example.com/', target: 'checkout-api:80', outcome: 'unreachable', confidence: 'real', evidence: 'no backend to reach', failedLayer: 'tcp' },
+        { route: 'shop.example.com/', target: 'shop:80', outcome: 'verified', confidence: 'real', evidence: 'HTTP 200 · 14 ms' },
+        { route: 'admin.example.com/', target: 'admin:80', outcome: 'not-tested', evidence: 'hostname not covered by any listener' },
+      ],
+      notTested: [
+        { route: 'account.example.com/', reason: 'route not actively tested', reasonClass: 'coverage' },
+        { route: 'docs.example.com/', reason: 'route not actively tested', reasonClass: 'coverage' },
+      ],
+    }
+  }
+
+  if (state === 'rbac') {
+    return {
+      ...t,
+      verdict: 'degraded',
+      headline: 'Only control-plane evidence — Radar is not permitted to probe the dataplane',
+      coverage: { tested: 1, passed: 1, failed: 0, skipped: 2 },
+      downstream: [
+        serviceHop(),
+        podsHop(PODS, [probe({ vantage: 'local', path: 'apiserver', target: 'checkout-api port 80', detail: 'HTTP 200 via proxy', latencyNs: 12_000_000 })]),
+      ],
+      routes: [{ route: 'GET / · :80 → 8080', target: ':80 → 8080', outcome: 'verified', confidence: 'indirect', evidence: 'HTTP 200 through the apiserver proxy' }],
+      notTested: [{ route: 'gRPC :9090 → 9090', reason: 'probe creation denied by RBAC', reasonClass: 'vantage' }],
+    }
+  }
+
+  if (state === 'synth') {
+    return {
+      ...t,
+      verdict: 'degraded',
+      headline: 'Reachable from a synthetic probe — the real caller is still unproven',
+      downstream: [serviceHop(), podsHop(PODS, okProbes)],
+      routes: [{ route: 'GET / · :80 → 8080', target: ':80 → 8080', outcome: 'verified', confidence: 'real', evidence: 'HTTP 200 · 11 ms from the probe Pod' }],
+    }
+  }
+
+  // mixed / running / stale share the same trace; the last two are driven by
+  // props (inClusterRunning, clusterChangedSinceTest) layered over it.
+  return {
+    ...t,
+    headline: 'Reachable in-cluster on :80 — front door and real caller still unproven',
+    downstream: [
+      serviceHop(),
+      podsHop(PODS, [...okProbes, probe({ vantage: 'local', path: 'apiserver', target: 'checkout-api port 80', detail: 'HTTP 200 via proxy', latencyNs: 12_000_000 })]),
+    ],
+    routes: [
+      { route: 'GET / · :80 → 8080', target: ':80 → 8080', outcome: 'verified', confidence: 'real', evidence: 'DNS 2 ms · TCP 1 ms · HTTP 200 · 11 ms' },
+      { route: 'gRPC :9090 → 9090', target: ':9090 → 9090', outcome: 'reached', confidence: 'indirect', evidence: 'connected, stream reset' },
+    ],
+    notTested: [{ route: 'front door · primary-gateway', reason: 'no request has entered through the Gateway', reasonClass: 'coverage' }],
+  }
+}