@skyhook-io/k8s-ui 1.10.4 → 1.11.0

package/src/components/resources/resource-utils.ts

@@ -12,9 +12,10 @@ import { getArgoApplicationStatus, getArgoApplicationSetStatus, getArgoApplicati
 import { getPolicyReportStatus as _getPolicyReportStatus, getKyvernoPolicyStatus as _getKyvernoPolicyStatus } from './resource-utils-kyverno'
 import { getResourceClaimStatus as _getResourceClaimStatus, getResourceClaimDeviceClasses as _getResourceClaimDeviceClasses, getResourceClaimTemplateDeviceClasses as _getResourceClaimTemplateDeviceClasses, getResourceClaimAllocation as _getResourceClaimAllocation, getResourceClaimReservedFor as _getResourceClaimReservedFor } from './resource-utils-dra'
 import { getNvidiaClusterPolicyStatus as _getNvidiaClusterPolicyStatus, getNvidiaClusterPolicyEnabledComponents as _getNvidiaClusterPolicyEnabledComponents, getNvidiaDriverStatus as _getNvidiaDriverStatus } from './resource-utils-nvidia'
-import { getBackupStatus as _getBackupStatus, getRestoreStatus as _getRestoreStatus, getScheduleStatus as _getScheduleStatus, getBSLStatus as _getBSLStatus } from './resource-utils-velero'
+import { getBackupStatus as _getBackupStatus, getRestoreStatus as _getRestoreStatus, getScheduleStatus as _getScheduleStatus, getBSLStatus as _getBSLStatus, getBackupRepositoryStatus as _getBackupRepositoryStatus } from './resource-utils-velero'
 import { getExternalSecretStatus as _getExternalSecretStatus, getClusterExternalSecretStatus as _getClusterExternalSecretStatus, getSecretStoreStatus as _getSecretStoreStatus, getClusterSecretStoreStatus as _getClusterSecretStoreStatus, getSecretStoreProviderType as _getSecretStoreProviderType } from './resource-utils-eso'
 import { getHPATableState, hpaStatusFromState } from './resource-utils-hpa'
+import { getCNPGClusterStatus as _getCNPGClusterStatus, getCNPGBackupStatus as _getCNPGBackupStatus, getCNPGScheduledBackupStatus as _getCNPGScheduledBackupStatus, getCNPGPoolerStatus as _getCNPGPoolerStatus, isApiGroup as _isApiGroup, CNPG_GROUP as _CNPG_GROUP } from './resource-utils-cnpg'
 
 // ============================================================================
 // STATUS & HEALTH UTILITIES
@@ -291,6 +292,14 @@ export function getPodStatus(pod: any): StatusBadge {
       if (unsettled > 0) {
         return { text: `Running (${ready}/${total})`, color: healthColors.degraded, level: 'degraded' }
       }
+      // Batch work in flight is not an all-clear. The Job itself already grades
+      // neutral while running; without the same call here its pods would read
+      // healthy — one piece of work graded two ways. Last, after every failure
+      // check above, so a broken Job pod keeps its real verdict.
+      // Mirrors pkg/health.classifyPodLevel.
+      if (isOwnedByJob(pod)) {
+        return { text: 'Running', color: healthColors.neutral, level: 'neutral' }
+      }
       return { text: 'Running', color: healthColors.healthy, level: 'healthy' }
     }
     case 'Succeeded':
@@ -741,6 +750,30 @@ export function getContainerSquareStates(pod: any): ContainerSquareState[] {
 // WORKLOAD UTILITIES (Deployment, StatefulSet, DaemonSet, ReplicaSet)
 // ============================================================================
 
+/**
+ * Whether the controller has not yet acted on this workload's current spec, so
+ * grading against that spec would report controller lag as an outage. The
+ * scale-up case: spec says 10, the controller is still working from the previous
+ * generation and has created 3.
+ *
+ * Deliberately NOT age-based — "created recently" guesses wrong exactly when a
+ * deploy is broken on arrival. Mirrors pkg/health.converging; keep in step.
+ */
+function isConverging(resource: any): boolean {
+  const generation = resource?.metadata?.generation
+  const observed = resource?.status?.observedGeneration
+  return typeof generation === 'number' && typeof observed === 'number' && observed > 0 && observed < generation
+}
+
+/** Whether the pod was created by a batch Job. The owner's API group is checked
+ *  so a CRD that merely uses Kind "Job" doesn't match. Mirrors
+ *  pkg/health.isOwnedByJob. */
+function isOwnedByJob(pod: any): boolean {
+  const refs = pod?.metadata?.ownerReferences
+  if (!Array.isArray(refs)) return false
+  return refs.some((r: any) => r?.kind === 'Job' && typeof r?.apiVersion === 'string' && r.apiVersion.startsWith('batch/'))
+}
+
 export function getWorkloadStatus(resource: any, kind: string): StatusBadge {
   const status = resource.status || {}
   const spec = resource.spec || {}
@@ -756,6 +789,12 @@ export function getWorkloadStatus(resource: any, kind: string): StatusBadge {
     if (ready === desired && updated === desired) {
       return { text: `${ready}/${desired}`, color: healthColors.healthy, level: 'healthy' }
     }
+    // Convergence grace, same as the replica kinds below. pkg/health.Workload
+    // passes this signal for DaemonSets too, so omitting it here would render a
+    // mid-reconcile DaemonSet unhealthy while the backend calls it neutral.
+    if (isConverging(resource)) {
+      return { text: `${ready}/${desired}`, color: healthColors.neutral, level: 'neutral' }
+    }
     if (ready > 0) {
       return { text: `${ready}/${desired}`, color: healthColors.degraded, level: 'degraded' }
     }
@@ -772,6 +811,16 @@ export function getWorkloadStatus(resource: any, kind: string): StatusBadge {
     return { text: 'Scaled to 0', color: healthColors.neutral, level: 'neutral' }
   }
 
+  // Convergence grace — mirrors pkg/health.replicaVerdict. A workload whose
+  // spec just changed (or that was created moments ago) has not had a chance to
+  // reach its target, so grading against that target reports controller lag as
+  // an outage. Neutral, never healthy: declining to call it broken is not the
+  // same as calling it fine. Guarded on "not already fully ready" so a
+  // converged workload still takes the healthy path below, matching Go's order.
+  if (isConverging(resource) && !(ready === desired && available === desired)) {
+    return { text: `${ready}/${desired}`, color: healthColors.neutral, level: 'neutral' }
+  }
+
   // Check if updating
   if (updated < desired && updated > 0) {
     return { text: `Updating ${updated}/${desired}`, color: healthColors.degraded, level: 'degraded' }
@@ -2091,13 +2140,31 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'nvidiadrivers') return _getNvidiaDriverStatus(resource).text
       if (kindLower === 'resourceclaims') return _getResourceClaimStatus(resource).text
       if (kindLower === 'backups') return _getBackupStatus(resource).text
-      if (kindLower === 'restores') return _getRestoreStatus(resource).text
-      if (kindLower === 'schedules') return _getScheduleStatus(resource).text
+      // Velero's Restore/Schedule keys are group-qualified (see
+      // GROUP_QUALIFIED_COLUMN_KEYS) because those plurals are shared with
+      // rancher/backup-restore-operator and others. The unqualified plural
+      // deliberately does not match: a foreign CRD falls through to the generic
+      // reader below rather than being filtered as though it were Velero.
+      if (kindLower === 'velerorestores') return _getRestoreStatus(resource).text
+      if (kindLower === 'veleroschedules') return _getScheduleStatus(resource).text
       if (kindLower === 'backupstoragelocations') return _getBSLStatus(resource).text
+      if (kindLower === 'backuprepositories') return _getBackupRepositoryStatus(resource).text
       if (kindLower === 'externalsecrets') return _getExternalSecretStatus(resource).text
       if (kindLower === 'clusterexternalsecrets') return _getClusterExternalSecretStatus(resource).text
       if (kindLower === 'secretstores') return _getSecretStoreStatus(resource).text
       if (kindLower === 'clustersecretstores') return _getClusterSecretStoreStatus(resource).text
+      // CNPG. The filter must read the same text the cell renders, or the
+      // dropdown offers strings that appear on no row: CNPG's phase is prose
+      // ("Cluster in healthy state") while the badge is a short state
+      // ("Healthy"). Worse for `cnpgclusters` — a WAL-archiving failure leaves
+      // the phase healthy, so filtering on the raw phase cannot express the
+      // badge at all. `cnpgclusters`/`cnpgbackups` arrive group-qualified;
+      // `scheduledbackups`/`poolers` are bare plurals, so gate those on the
+      // group rather than assume nobody else ships the name.
+      if (kindLower === 'cnpgclusters') return _getCNPGClusterStatus(resource).text
+      if (kindLower === 'cnpgbackups') return _getCNPGBackupStatus(resource).text
+      if (kindLower === 'scheduledbackups' && _isApiGroup(resource.apiVersion, _CNPG_GROUP)) return _getCNPGScheduledBackupStatus(resource).text
+      if (kindLower === 'poolers' && _isApiGroup(resource.apiVersion, _CNPG_GROUP)) return _getCNPGPoolerStatus(resource).text
       // Generic CRDs: try status.phase, then Ready condition
       if (resource.status?.phase) return resource.status.phase
       {

package/src/components/shared/ResourceActionsBar.tsx

@@ -70,6 +70,7 @@ interface ResourceActionsBarProps {
   isDeleting?: boolean
   cascadeDependents?: CascadeDependent[]
   cascadeLoading?: boolean
+  cascadeRootResolved?: boolean
 
   // Workload restart
   onRestart?: (params: { kind: string; namespace: string; name: string }, callbacks?: { onSuccess?: () => void; onError?: (err: unknown) => void }) => void
@@ -130,7 +131,7 @@ export function ResourceActionsBar({
   canExec, canViewLogs, canPortForward,
   onOpenTerminal, onOpenLogs: openLogs, onOpenWorkloadLogs: openWorkloadLogs, onCopyCommand,
   renderPortForward,
-  onDelete, isDeleting, cascadeDependents, cascadeLoading,
+  onDelete, isDeleting, cascadeDependents, cascadeLoading, cascadeRootResolved,
   onRestart, isRestarting,
   revisions: revisionsList, revisionsLoading, revisionsError, onRollback, isRollingBack,
   onTriggerCronJob, isTriggeringCronJob,
@@ -608,6 +609,7 @@ export function ResourceActionsBar({
         isLoading={isDeleting ?? false}
         cascadeDependents={cascadeDependents}
         cascadeLoading={cascadeLoading}
+        cascadeRootResolved={cascadeRootResolved}
       />
 
       {/* Node cordon confirmation */}

package/src/components/shared/ResourceRendererDispatch.test.tsx

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import { renderToString } from 'react-dom/server'
-import { ResourceRendererDispatch, type RendererOverrides } from './ResourceRendererDispatch'
+import { ResourceRendererDispatch, getResourceStatus, type RendererOverrides } from './ResourceRendererDispatch'
 import type { ResourceRef } from '../../types'
 
 function renderWithScalers(scalers: ResourceRef[]): string {
@@ -146,3 +146,121 @@ describe('DRA renderers dispatch', () => {
     expect(html).toContain('device.driver')
   })
 })
+
+// ============================================================================
+// COLLIDING CRD PLURALS — `clusters` (CNPG / CAPI / third parties) and
+// `backups` (CNPG / Velero). Both used to be resolved with a negative guard,
+// so any third operator's CRD inherited whichever branch was the fallback.
+// ============================================================================
+
+function renderCollidingKind(kind: string, apiVersion: string): string {
+  return renderToString(
+    <ResourceRendererDispatch
+      resource={{ kind, namespace: 'default', name: 'thing' }}
+      data={{ apiVersion, kind: 'Cluster', metadata: { name: 'thing', namespace: 'default' }, spec: {}, status: {} }}
+      onCopy={() => {}}
+      copied={null}
+      showCommonSections={false}
+    />,
+  )
+}
+
+describe('getResourceStatus — colliding plurals', () => {
+  it('fabricates no PostgreSQL status for a third-party clusters CRD', () => {
+    // KubeBlocks, Redis/Valkey operators and friends all ship `clusters`. With
+    // no status of their own they get nothing; with a phase they get the
+    // generic phase badge, never a CNPG-derived one.
+    expect(getResourceStatus('clusters', { apiVersion: 'apps.kubeblocks.io/v1alpha1', status: {} })).toBeNull()
+    expect(getResourceStatus('clusters', { apiVersion: 'apps.kubeblocks.io/v1alpha1', status: { phase: 'Running' } }))
+      .toMatchObject({ text: 'Running' })
+    // CNPG would have rendered "Not Ready" from the absent instance counts.
+    expect(getResourceStatus('clusters', { apiVersion: 'redis.redis.opstreelabs.in/v1beta2', spec: { instances: 3 }, status: {} })).toBeNull()
+  })
+
+  it('still resolves both known clusters engines positively', () => {
+    expect(getResourceStatus('clusters', {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      spec: { instances: 2 },
+      status: { phase: 'Cluster in healthy state', readyInstances: 2 },
+    })).toMatchObject({ text: 'Healthy' })
+
+    expect(getResourceStatus('clusters', {
+      apiVersion: 'cluster.x-k8s.io/v1beta1',
+      status: { phase: 'Provisioned' },
+    })).not.toBeNull()
+  })
+
+  it('fabricates no engine status for a third-party backups CRD', () => {
+    expect(getResourceStatus('backups', { apiVersion: 'kubevirt.io/v1', status: {} })).toBeNull()
+    expect(getResourceStatus('backups', { apiVersion: 'kubevirt.io/v1', status: { phase: 'Running' } }))
+      .toMatchObject({ text: 'Running' })
+  })
+
+  it('still resolves both known backups engines positively', () => {
+    expect(getResourceStatus('backups', {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      status: { phase: 'completed' },
+    })).toMatchObject({ text: 'Completed' })
+
+    expect(getResourceStatus('backups', {
+      apiVersion: 'velero.io/v1',
+      status: { phase: 'Completed' },
+    })).not.toBeNull()
+  })
+
+  it('gives no CNPG badge to third-party scheduledbackups and poolers', () => {
+    // CNPG's Pooler getter would have said "Not Scheduled" from spec.instances.
+    expect(getResourceStatus('poolers', { apiVersion: 'other.io/v1', spec: { instances: 2 }, status: {} })).toBeNull()
+    expect(getResourceStatus('scheduledbackups', { apiVersion: 'other.io/v1', spec: {}, status: {} })).toBeNull()
+  })
+})
+
+describe('ResourceRendererDispatch — colliding plurals fall through', () => {
+  // These plurals are in KNOWN_KINDS, which suppresses the generic renderer.
+  // Making every render line apiVersion-gated without an explicit fall-through
+  // renders a blank drawer for a foreign CRD — the trap the Crossplane
+  // collision block documents.
+  it.each([
+    ['clusters', 'apps.kubeblocks.io/v1alpha1'],
+    ['backups', 'kubevirt.io/v1'],
+    ['scheduledbackups', 'other.io/v1'],
+    ['poolers', 'other.io/v1'],
+  ])('renders something for a foreign %s CRD', (kind, apiVersion) => {
+    expect(renderCollidingKind(kind, apiVersion).trim()).not.toBe('')
+  })
+
+  it('does not double-render when a known engine matches', () => {
+    const html = renderCollidingKind('clusters', 'postgresql.cnpg.io/v1')
+    expect(html).toContain('Cluster Overview')
+    // The generic renderer's raw-spec dump must not appear alongside it.
+    expect(html.match(/Cluster Overview/g)).toHaveLength(1)
+  })
+})
+
+describe('colliding plurals — near-match API groups', () => {
+  // A substring guard would hand these to CNPG/Velero. They are different groups.
+  it.each([
+    ['clusters', 'extension.postgresql.cnpg.io/v1'],
+    ['clusters', 'barmancloud.cnpg.io/v1'],
+    ['backups', 'extension.postgresql.cnpg.io/v1'],
+    ['backups', 'backup.velero.io/v1'],
+    ['poolers', 'sub.postgresql.cnpg.io/v1'],
+    ['scheduledbackups', 'sub.postgresql.cnpg.io/v1'],
+  ])('does not give %s/%s an engine-specific status', (kind, apiVersion) => {
+    const s = getResourceStatus(kind, { apiVersion, spec: { instances: 2 }, status: { phase: 'completed' } })
+    // The generic fallback echoes the phase verbatim; the CNPG/Velero getters
+    // would have mapped it to "Completed" or read the instance counts.
+    expect(s?.text).not.toBe('Completed')
+    expect(s?.text).not.toBe('Not Scheduled')
+    expect(s?.text).not.toBe('Not Ready')
+  })
+
+  it.each([
+    ['clusters', 'extension.postgresql.cnpg.io/v1'],
+    ['backups', 'backup.velero.io/v1'],
+  ])('falls %s/%s through to the generic renderer', (kind, apiVersion) => {
+    const html = renderCollidingKind(kind, apiVersion)
+    expect(html.trim()).not.toBe('')
+    expect(html).not.toContain('Cluster Overview')
+  })
+})

package/src/components/shared/ResourceRendererDispatch.tsx

@@ -51,9 +51,19 @@ import { getNodePoolStatus, getNodeClaimStatus, getEC2NodeClassStatus } from '..
 import { getScaledObjectStatus, getScaledJobStatus } from '../resources/resource-utils-keda'
 import { getServiceMonitorStatus, getPrometheusRuleStatus, getPodMonitorStatus } from '../resources/resource-utils-prometheus'
 import { getPolicyReportStatus, getKyvernoPolicyStatus } from '../resources/resource-utils-kyverno'
+import {
+  KYVERNO_MODERN_PLURALS,
+  getModernKyvernoPolicyStatus,
+  isModernKyvernoPolicy,
+} from '../resources/resource-utils-kyverno-modern'
+import {
+  getKyvernoCleanupPolicyStatus,
+  getKyvernoPolicyExceptionStatus,
+  isAnyKyvernoPolicyException,
+} from '../resources/resource-utils-kyverno-exceptions'
 import { getResourceClaimStatus, getResourceClaimTemplateStatus, getDeviceClassStatus, getResourceSliceStatus } from '../resources/resource-utils-dra'
 import { getNvidiaClusterPolicyStatus, getNvidiaDriverStatus } from '../resources/resource-utils-nvidia'
-import { getBackupStatus, getRestoreStatus, getScheduleStatus, getBSLStatus } from '../resources/resource-utils-velero'
+import { getBackupStatus, getRestoreStatus, getScheduleStatus, getBSLStatus, isVeleroResource } from '../resources/resource-utils-velero'
 import {
   getVirtualServiceStatus,
   getDestinationRuleStatus,
@@ -62,7 +72,7 @@ import {
   getPeerAuthenticationStatus,
   getAuthorizationPolicyStatus,
 } from '../resources/resource-utils-istio'
-import { getCNPGClusterStatus, getCNPGBackupStatus, getCNPGScheduledBackupStatus, getCNPGPoolerStatus } from '../resources/resource-utils-cnpg'
+import { getCNPGClusterStatus, getCNPGBackupStatus, getCNPGScheduledBackupStatus, getCNPGPoolerStatus, isApiGroup, CNPG_GROUP } from '../resources/resource-utils-cnpg'
 import { getExternalSecretStatus, getClusterExternalSecretStatus, getSecretStoreStatus, getClusterSecretStoreStatus } from '../resources/resource-utils-eso'
 import {
   getKnativeConditionStatus,
@@ -140,6 +150,13 @@ import {
   PodMonitorRenderer,
   PolicyReportRenderer,
   KyvernoPolicyRenderer,
+  KyvernoValidatingPolicyRenderer,
+  KyvernoImageValidatingPolicyRenderer,
+  KyvernoMutatingPolicyRenderer,
+  KyvernoGeneratingPolicyRenderer,
+  KyvernoDeletingPolicyRenderer,
+  KyvernoPolicyExceptionRenderer,
+  KyvernoCleanupPolicyRenderer,
   VeleroBackupRenderer,
   VeleroRestoreRenderer,
   VeleroScheduleRenderer,
@@ -339,6 +356,13 @@ const KNOWN_KINDS = new Set([
   'triggerauthentications', 'clustertriggerauthentications',
   'servicemonitors', 'prometheusrules', 'podmonitors',
   'policyreports', 'clusterpolicyreports', 'kyvernopolicies', 'clusterpolicies',
+  // Kyverno modern CEL family (policies.kyverno.io) + its namespaced twins.
+  'validatingpolicies', 'namespacedvalidatingpolicies',
+  'imagevalidatingpolicies', 'namespacedimagevalidatingpolicies',
+  'mutatingpolicies', 'namespacedmutatingpolicies',
+  'generatingpolicies', 'namespacedgeneratingpolicies',
+  'deletingpolicies', 'namespaceddeletingpolicies',
+  'policyexceptions', 'cleanuppolicies', 'clustercleanuppolicies',
   'resourceclaims', 'resourceclaimtemplates', 'deviceclasses', 'resourceslices',
   'nvidiadrivers',
   'vulnerabilityreports', 'configauditreports', 'exposedsecretreports',
@@ -488,6 +512,54 @@ export function ResourceRendererDispatch({
   )
   const crossplaneCollisionFallthrough = isCollisionGatedKind && !crossplaneApiVersionMatched
 
+  // Kyverno's modern CEL family uses plurals generic enough that another
+  // vendor could ship the same ones (`validatingpolicies`, `mutatingpolicies`,
+  // `generatingpolicies`, ...), and `policyexceptions` collides with Kyverno
+  // ITSELF — the same Kind and plural exists in both kyverno.io and
+  // policies.kyverno.io with different spec shapes. Every render line below is
+  // therefore group-gated, which means each needs the same fall-through the
+  // Crossplane block documents above: without it a foreign CR with a colliding
+  // plural matches no renderer and, being in KNOWN_KINDS, renders blank.
+  const isKyvernoModernPlural = KYVERNO_MODERN_PLURALS.has(kind)
+  const kyvernoModernMatched = isKyvernoModernPlural && isModernKyvernoPolicy(data)
+  const isKyvernoLegacyExtraPlural = kind === 'cleanuppolicies' || kind === 'clustercleanuppolicies'
+  const kyvernoLegacyExtraMatched =
+    isKyvernoLegacyExtraPlural && data?.apiVersion?.startsWith('kyverno.io/')
+  // PolicyException is served by both families; either group is a match.
+  const isPolicyExceptionPlural = kind === 'policyexceptions'
+  const policyExceptionMatched = isPolicyExceptionPlural && isAnyKyvernoPolicyException(data)
+  const kyvernoCollisionFallthrough =
+    (isKyvernoModernPlural && !kyvernoModernMatched) ||
+    (isKyvernoLegacyExtraPlural && !kyvernoLegacyExtraMatched) ||
+    (isPolicyExceptionPlural && !policyExceptionMatched)
+
+  // Same shape as the Crossplane fall-through above: these Velero plurals are
+  // in KNOWN_KINDS but their render lines are gated on the velero.io group, so
+  // a foreign CR with the same plural (rancher/backup-restore-operator ships
+  // restores.resources.cattle.io; several operators ship `schedules`) matches
+  // no renderer AND is suppressed from GenericRenderer — i.e. renders blank.
+  // `backups` is deliberately absent here — it is shared with CNPG, so both of
+  // its render lines are positively group-gated and it falls through via
+  // isGroupGatedKind below rather than through this Velero-only check.
+  const isVeleroCollisionGatedKind =
+    kind === 'restores' || kind === 'schedules'
+    || kind === 'backupstoragelocations' || kind === 'volumesnapshotlocations'
+  const veleroCollisionFallthrough = isVeleroCollisionGatedKind && !isVeleroResource(data)
+
+  // Same rule as the Crossplane block above, for the plurals shared by two
+  // named operators: `clusters` (CNPG / CAPI — plus KubeBlocks, Redis/Valkey
+  // and friends in the wild) and `backups` (CNPG / Velero). Both render lines
+  // are positively apiVersion-gated, so a third CRD with the plural matches
+  // neither and needs an explicit fall-through or the drawer renders blank.
+  const isGroupGatedKind =
+    kind === 'clusters' || kind === 'backups' || kind === 'scheduledbackups' || kind === 'poolers'
+  const isCNPGApiVersion = isApiGroup(data?.apiVersion, CNPG_GROUP)
+  const groupGatedMatched =
+    (kind === 'clusters' && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'cluster.x-k8s.io')))
+    || (kind === 'backups' && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'velero.io')))
+    || ((kind === 'scheduledbackups' || kind === 'poolers') && isCNPGApiVersion)
+  const groupGatedFallthrough = isGroupGatedKind && !groupGatedMatched
+
   const isKnownKind = KNOWN_KINDS.has(kind) || isCrossplaneMR || isCrossplaneClaim || isCrossplaneXR
 
   const PodComp = rendererOverrides?.PodRenderer ?? PodRenderer
@@ -594,25 +666,34 @@ export function ResourceRendererDispatch({
         {(kind === 'policyreports' || kind === 'clusterpolicyreports') && <PolicyReportRenderer data={data} />}
         {(kind === 'kyvernopolicies' || (kind === 'clusterpolicies' && !data?.apiVersion?.startsWith('nvidia.com/'))) && <KyvernoPolicyRenderer data={data} />}
         {(kind === 'clusterpolicies' && data?.apiVersion?.startsWith('nvidia.com/')) && <NvidiaClusterPolicyRenderer data={data} />}
+        {/* Kyverno modern CEL family. Each Namespaced* twin shares its
+            cluster-scoped counterpart's renderer — same spec, narrower scope. */}
+        {kyvernoModernMatched && (kind === 'validatingpolicies' || kind === 'namespacedvalidatingpolicies') && <KyvernoValidatingPolicyRenderer data={data} />}
+        {kyvernoModernMatched && (kind === 'imagevalidatingpolicies' || kind === 'namespacedimagevalidatingpolicies') && <KyvernoImageValidatingPolicyRenderer data={data} />}
+        {kyvernoModernMatched && (kind === 'mutatingpolicies' || kind === 'namespacedmutatingpolicies') && <KyvernoMutatingPolicyRenderer data={data} />}
+        {kyvernoModernMatched && (kind === 'generatingpolicies' || kind === 'namespacedgeneratingpolicies') && <KyvernoGeneratingPolicyRenderer data={data} />}
+        {kyvernoModernMatched && (kind === 'deletingpolicies' || kind === 'namespaceddeletingpolicies') && <KyvernoDeletingPolicyRenderer data={data} />}
+        {policyExceptionMatched && <KyvernoPolicyExceptionRenderer data={data} />}
+        {kyvernoLegacyExtraMatched && <KyvernoCleanupPolicyRenderer data={data} />}
         {kind === 'nvidiadrivers' && <NvidiaDriverRenderer data={data} />}
         {/* DRA (resource.k8s.io) */}
         {kind === 'resourceclaims' && <ResourceClaimRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'resourceclaimtemplates' && <ResourceClaimTemplateRenderer data={data} />}
         {kind === 'deviceclasses' && <DeviceClassRenderer data={data} />}
         {kind === 'resourceslices' && <ResourceSliceRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'backups' && data.apiVersion?.includes('cnpg.io') && <CNPGBackupRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'backups' && !data.apiVersion?.includes('cnpg.io') && <VeleroBackupRenderer data={data} />}
-        {kind === 'restores' && <VeleroRestoreRenderer data={data} />}
-        {kind === 'schedules' && <VeleroScheduleRenderer data={data} />}
-        {kind === 'backupstoragelocations' && <VeleroBSLRenderer data={data} />}
-        {kind === 'volumesnapshotlocations' && <VeleroVSLRenderer data={data} />}
+        {kind === 'backups' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGBackupRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'backups' && isApiGroup(data.apiVersion, 'velero.io') && <VeleroBackupRenderer data={data} />}
+        {kind === 'restores' && isVeleroResource(data) && <VeleroRestoreRenderer data={data} />}
+        {kind === 'schedules' && isVeleroResource(data) && <VeleroScheduleRenderer data={data} />}
+        {kind === 'backupstoragelocations' && isVeleroResource(data) && <VeleroBSLRenderer data={data} />}
+        {kind === 'volumesnapshotlocations' && isVeleroResource(data) && <VeleroVSLRenderer data={data} />}
         {kind === 'externalsecrets' && <ExternalSecretRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'clusterexternalsecrets' && <ClusterExternalSecretRenderer data={data} onNavigate={onNavigate} />}
         {(kind === 'secretstores' || kind === 'clustersecretstores') && <SecretStoreRenderer data={data} />}
-        {kind === 'clusters' && !data?.apiVersion?.includes('cluster.x-k8s.io') && <CNPGClusterRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'clusters' && data?.apiVersion?.includes('cluster.x-k8s.io') && <CAPIClusterRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'scheduledbackups' && <CNPGScheduledBackupRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'poolers' && <CNPGPoolerRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'clusters' && isApiGroup(data?.apiVersion, CNPG_GROUP) && <CNPGClusterRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'clusters' && isApiGroup(data?.apiVersion, 'cluster.x-k8s.io') && <CAPIClusterRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'scheduledbackups' && isApiGroup(data?.apiVersion, CNPG_GROUP) && <CNPGScheduledBackupRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'poolers' && isApiGroup(data?.apiVersion, CNPG_GROUP) && <CNPGPoolerRenderer data={data} onNavigate={onNavigate} />}
         {/* Cluster API (CAPI) */}
         {'topology.cluster.x-k8s.io/owned' in (data?.metadata?.labels ?? {}) && data?.apiVersion?.includes('cluster.x-k8s.io') && (
           <AlertBanner
@@ -706,7 +787,7 @@ export function ResourceRendererDispatch({
             for known-plural collisions where no apiVersion-gated renderer
             matched (e.g. a Knative Configuration sharing the `configurations`
             plural with Crossplane Configuration). */}
-        {(!isKnownKind || crossplaneCollisionFallthrough) && <GenericRenderer data={data} />}
+        {(!isKnownKind || crossplaneCollisionFallthrough || kyvernoCollisionFallthrough || veleroCollisionFallthrough || groupGatedFallthrough) && <GenericRenderer data={data} />}
 
         {/* Common sections - can be disabled when parent handles them separately */}
         {showCommonSections && (
@@ -833,25 +914,38 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
     if (data?.apiVersion?.startsWith('nvidia.com/')) return getNvidiaClusterPolicyStatus(data)
     return getKyvernoPolicyStatus(data)
   }
+  // Modern CEL family — group-gated so a foreign CRD sharing one of these
+  // generic plurals falls through to the default status rather than being
+  // described in Kyverno's vocabulary.
+  if (KYVERNO_MODERN_PLURALS.has(k) && isModernKyvernoPolicy(data)) return getModernKyvernoPolicyStatus(data)
+  if (k === 'policyexceptions' && isAnyKyvernoPolicyException(data)) return getKyvernoPolicyExceptionStatus(data)
+  if ((k === 'cleanuppolicies' || k === 'clustercleanuppolicies') && data?.apiVersion?.startsWith('kyverno.io/')) {
+    return getKyvernoCleanupPolicyStatus(data)
+  }
   if (k === 'nvidiadrivers') return getNvidiaDriverStatus(data)
   if (k === 'resourceclaims') return getResourceClaimStatus(data)
   if (k === 'resourceclaimtemplates') return getResourceClaimTemplateStatus(data)
   if (k === 'deviceclasses') return getDeviceClassStatus(data)
   if (k === 'resourceslices') return getResourceSliceStatus(data)
+  // Positive guards both ways. A third `backups` CRD matches neither and falls
+  // through to the generic phase/conditions handling at the end of this
+  // function, rather than borrowing whichever engine used to be the fallback.
   if (k === 'backups') {
-    if (data.apiVersion?.includes('cnpg.io')) return getCNPGBackupStatus(data)
-    return getBackupStatus(data)
+    if (isApiGroup(data.apiVersion, CNPG_GROUP)) return getCNPGBackupStatus(data)
+    if (isApiGroup(data.apiVersion, 'velero.io')) return getBackupStatus(data)
   }
-  if (k === 'restores') return getRestoreStatus(data)
-  if (k === 'schedules') return getScheduleStatus(data)
-  if (k === 'backupstoragelocations') return getBSLStatus(data)
+  if (k === 'restores' && isVeleroResource(data)) return getRestoreStatus(data)
+  if (k === 'schedules' && isVeleroResource(data)) return getScheduleStatus(data)
+  if (k === 'backupstoragelocations' && isVeleroResource(data)) return getBSLStatus(data)
   if (k === 'externalsecrets') return getExternalSecretStatus(data)
   if (k === 'clusterexternalsecrets') return getClusterExternalSecretStatus(data)
   if (k === 'secretstores') return getSecretStoreStatus(data)
   if (k === 'clustersecretstores') return getClusterSecretStoreStatus(data)
   if (k === 'clusters') {
-    if (data.apiVersion?.includes('cluster.x-k8s.io')) return getCAPIClusterStatus(data)
-    return getCNPGClusterStatus(data)
+    if (isApiGroup(data.apiVersion, 'cluster.x-k8s.io')) return getCAPIClusterStatus(data)
+    if (isApiGroup(data.apiVersion, CNPG_GROUP)) return getCNPGClusterStatus(data)
+    // Third-party `clusters` CRDs (KubeBlocks, Redis/Valkey) fall through to the
+    // generic handling below instead of getting a fabricated PostgreSQL status.
   }
   if (k === 'machines' && data.apiVersion?.includes('cluster.x-k8s.io')) return getMachineStatus(data)
   if (k === 'machinedeployments') return getMachineDeploymentStatus(data)
@@ -875,8 +969,8 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
   if (k === 'azuremanagedmachinepools') return getAzureMMPStatus(data)
   if (k === 'azuremachines') return getAzureMachineStatus(data)
   if (k === 'azuremanagedclusters') return getAzureManagedClusterStatus(data)
-  if (k === 'scheduledbackups') return getCNPGScheduledBackupStatus(data)
-  if (k === 'poolers') return getCNPGPoolerStatus(data)
+  if (k === 'scheduledbackups' && isApiGroup(data.apiVersion, CNPG_GROUP)) return getCNPGScheduledBackupStatus(data)
+  if (k === 'poolers' && isApiGroup(data.apiVersion, CNPG_GROUP)) return getCNPGPoolerStatus(data)
   if (k === 'virtualservices') return getVirtualServiceStatus(data)
   if (k === 'destinationrules') return getDestinationRuleStatus(data)
   if (k === 'serviceentries') return getServiceEntryStatus(data)

package/src/components/topology/K8sResourceNode.tsx

@@ -128,6 +128,12 @@ function getIssueTooltip(issue: string | undefined): React.ReactNode {
         "A validating/mutating admission webhook rejected pod creation.",
       action: "Check the webhook policy that denied the request.",
     },
+    WebhookUnavailable: {
+      title: "Admission Webhook Unavailable",
+      description:
+        "Pod creation could not reach a required admission webhook backend.",
+      action: "Restore the webhook Service and its ready endpoints.",
+    },
     Evicted: {
       title: "Pod Evicted",
       description:
@@ -282,6 +288,11 @@ function getSubtitle(
   kind: NodeKind,
   nodeData: Record<string, unknown>,
 ): string {
+  // An explicit override wins over the per-kind computed subtitle: the Reachability
+  // diagram precomputes a functional one-liner (port→targetPort, readiness) the
+  // generic per-kind logic can't know. '' is a deliberate "no subtitle", honored as
+  // such. App-topology nodes never set this, so their behavior is unchanged.
+  if (typeof nodeData.subtitleOverride === 'string') return nodeData.subtitleOverride;
   const base = baseSubtitle(kind, nodeData);
   const ps = nodeData.podSummary as PodSummary | undefined;
   if (ps && SUMMARY_POD_KINDS.has(kind)) {