@skyhook-io/k8s-ui 1.10.4 → 1.11.0

package/src/utils/inClusterConsent.test.ts

@@ -0,0 +1,109 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { inClusterConsentGiven, rememberInClusterConsent, consentRequestRows } from './inClusterConsent'
+
+describe('inClusterConsent', () => {
+  beforeEach(() => {
+    const store: Record<string, string> = {}
+    vi.stubGlobal('localStorage', {
+      getItem: (k: string) => (k in store ? store[k] : null),
+      setItem: (k: string, v: string) => { store[k] = v },
+      removeItem: (k: string) => { delete store[k] },
+    })
+  })
+
+  it('defaults to not-given', () => {
+    expect(inClusterConsentGiven('prod')).toBe(false)
+  })
+
+  it('remembers consent for a cluster', () => {
+    rememberInClusterConsent('prod')
+    expect(inClusterConsentGiven('prod')).toBe(true)
+  })
+
+  it('is keyed per cluster - consent on one does not grant another', () => {
+    rememberInClusterConsent('dev')
+    expect(inClusterConsentGiven('dev')).toBe(true)
+    expect(inClusterConsentGiven('prod')).toBe(false)
+  })
+
+  it('does not throw when localStorage is unavailable, and reports not-given', () => {
+    vi.stubGlobal('localStorage', {
+      getItem: () => { throw new Error('denied') },
+      setItem: () => { throw new Error('denied') },
+    })
+    expect(() => rememberInClusterConsent('prod')).not.toThrow()
+    expect(inClusterConsentGiven('prod')).toBe(false)
+  })
+})
+
+// No stable cluster identity → consent is never remembered, in ANY store. A
+// persisted fallback key is shared by every cluster a single origin (Radar
+// Hub) serves, and even an in-memory session flag is shared across every
+// identity-less cluster in the session - either would let one cluster's
+// "don't ask again" suppress the pod-creating confirm on all of them. So an
+// identity-less run always asks: given() is always false, remember() no-ops.
+describe('inClusterConsent without a cluster identity', () => {
+  it('never writes to localStorage', () => {
+    const setItem = vi.fn()
+    vi.stubGlobal('localStorage', { getItem: () => null, setItem })
+    rememberInClusterConsent(undefined)
+    rememberInClusterConsent('')
+    expect(setItem).not.toHaveBeenCalled()
+  })
+
+  it('never remembers consent - remember() is a no-op and given() stays false', () => {
+    vi.stubGlobal('localStorage', { getItem: () => null, setItem: () => {} })
+    expect(inClusterConsentGiven(undefined)).toBe(false)
+    rememberInClusterConsent(undefined)
+    expect(inClusterConsentGiven(undefined)).toBe(false)
+    expect(inClusterConsentGiven('')).toBe(false)
+  })
+
+  it('does not read a persisted key when no cluster is known', () => {
+    // Even if some earlier version persisted a shared sentinel, an identity-less
+    // check must not honor it.
+    const store: Record<string, string> = { 'radar.inClusterConsent.current': '1' }
+    vi.stubGlobal('localStorage', {
+      getItem: (k: string) => (k in store ? store[k] : null),
+      setItem: (k: string, v: string) => { store[k] = v },
+    })
+    expect(inClusterConsentGiven(undefined)).toBe(false)
+  })
+
+  it('identity-less remember does not leak into a named cluster', () => {
+    vi.stubGlobal('localStorage', { getItem: () => null, setItem: () => {} })
+    rememberInClusterConsent(undefined)
+    expect(inClusterConsentGiven('prod')).toBe(false)
+  })
+})
+
+describe('consent rows name the traffic the Job actually sends', () => {
+  it('a TCP-only candidate is a TCP connection, never a fabricated GET', () => {
+    const rows = consentRequestRows(
+      [{ route: 'database', target: 'database:6379', inClusterRequest: { protocol: 'tcp' } }],
+      '',
+    )
+    expect(rows).toEqual([{ route: 'database', request: 'TCP connection to database:6379' }])
+  })
+  it('HTTP(S) candidates keep the full request with dialled address and Host header', () => {
+    const rows = consentRequestRows(
+      [{ route: '/web', target: 'shop:80', inClusterRequest: { protocol: 'http', scheme: 'http', host: 'shop.example.com', path: '/web' } }],
+      '',
+    )
+    expect(rows[0].request).toBe('GET http://shop:80/web (Host: shop.example.com)')
+  })
+  it('a path override applies to HTTP only - a TCP dial has no path to override', () => {
+    const rows = consentRequestRows(
+      [
+        { route: 'database', target: 'database:6379', inClusterRequest: { protocol: 'tcp' } },
+        { route: '/web', target: 'shop:80', inClusterRequest: { protocol: 'http', scheme: 'http', path: '/' } },
+      ],
+      '/healthz',
+    )
+    expect(rows[0].request).toBe('TCP connection to database:6379')
+    expect(rows[1].request).toContain('/healthz')
+  })
+  it('benign dormant routes are never presented for approval', () => {
+    expect(consentRequestRows([{ route: 'x', target: 'x:80', benign: true, inClusterRequest: { protocol: 'http' } }], '')).toEqual([])
+  })
+})

package/src/utils/inClusterConsent.ts

@@ -0,0 +1,72 @@
+// Consent memory for the mutating in-cluster reachability test (it creates a
+// short-lived Job/pod). Keyed by CLUSTER so a "don't ask again" on one cluster
+// never silently suppresses the confirm on another - the cluster the pod lands
+// in is the whole point of asking. Switching kube-context re-prompts.
+//
+// No cluster identity → no memory of ANY kind: the operator is asked on every
+// run. localStorage is per-ORIGIN, and one origin (Radar Hub) can front many
+// clusters, so a shared fallback key would let "don't ask again" on one cluster
+// suppress the pod-creating confirm on all of them - and even an in-memory
+// session flag is shared across every identity-less cluster in the session.
+// The dialog hides its "don't ask again" checkbox in that case, so nothing is
+// promised that doesn't stick.
+
+const key = (cluster: string) => `radar.inClusterConsent.${cluster}`
+
+export function inClusterConsentGiven(cluster?: string): boolean {
+  if (!cluster) return false
+  try {
+    return localStorage.getItem(key(cluster)) === '1'
+  } catch {
+    // localStorage unavailable (private mode / non-browser) - fail toward asking.
+    return false
+  }
+}
+
+export function rememberInClusterConsent(cluster?: string): void {
+  if (!cluster) return
+  try {
+    localStorage.setItem(key(cluster), '1')
+  } catch {
+    // Non-fatal: if we can't persist, the user is simply asked again next time.
+  }
+}
+
+/** One consent row per runnable route - the words the operator approves.
+ *  This is the MUTATION CONSENT, so it must name the traffic the Job actually
+ *  sends: a TCP-only candidate (redis, postgres) opens a socket and sends no
+ *  request - presenting it as "GET http://database:6379/" asks approval for
+ *  traffic that will never happen. Path overrides apply to HTTP(S) only. */
+export function consentRequestRows(
+  routes: Array<{
+    route: string
+    target?: string
+    benign?: boolean
+    inClusterRequest?: { protocol?: string; scheme?: string; host?: string; path?: string }
+  }>,
+  override: string,
+): { route: string; request: string }[] {
+  const rows: { route: string; request: string }[] = []
+  for (const r of routes) {
+    const req = r.inClusterRequest
+    if (!req) continue
+    // The runner skips benign (deliberately scaled-to-0) routes outright, so
+    // listing them as requests overstates what the operator is agreeing to.
+    if (r.benign) continue
+    const dialled = r.target || ''
+    if (req.protocol === 'tcp') {
+      rows.push({ route: r.route, request: `TCP connection to ${dialled || req.host || ''}`.trim() })
+      continue
+    }
+    const path = override || req.path || '/'
+    // The probe dials the SERVICE and passes the hostname as a Host/SNI header.
+    // Showing only the hostname put a public-looking address on a consent
+    // screen for traffic that never leaves the cluster - so name the address
+    // actually dialled, and the Host header as the header it is.
+    const scheme = req.scheme || 'http'
+    const addr = dialled ? `${scheme}://${dialled}${path}` : `${scheme}://${req.host ?? ''}${path}`
+    const asHost = req.host && dialled ? ` (Host: ${req.host})` : ''
+    rows.push({ route: r.route, request: `GET ${addr}${asHost}`.trim() })
+  }
+  return rows
+}

package/src/utils/index.ts

@@ -26,4 +26,5 @@ export * from './topology-neighborhood'
 export * from './application-topology'
 export * from './application-history'
 export * from './bulk-workload-actions'
+export * from './inClusterConsent'
 export * from './workflow-execution'

package/src/utils/navigation.test.ts

@@ -1,4 +1,5 @@
 import { describe, test, expect, afterEach } from 'vitest'
+import { englishPlural } from './pluralize'
 import { kindToPlural, pluralToKind, refToSelectedResource, initNavigationMap, resetNavigationMap, laneId, laneResourceKey, groupQualifiesLaneId, parseLaneId } from './navigation'
 
 afterEach(() => {
@@ -65,6 +66,66 @@ describe('kindToPlural', () => {
     expect(kindToPlural('pvc')).toBe('persistentvolumeclaims')
     expect(kindToPlural('PodGroup')).toBe('pods')
   })
+
+  // A cold direct-URL load runs kindToPlural against the URL's plural slug one
+  // round-trip BEFORE initNavigationMap lands, so the discovered-plural guard
+  // can't fire for a CRD absent from BUILTIN_PLURAL_TO_KIND.
+  describe('CRD plurals before the discovery map arrives', () => {
+    test('idempotent on unknown lowercase plurals', () => {
+      expect(kindToPlural('schedules')).toBe('schedules')
+      expect(kindToPlural('validatingpolicies')).toBe('validatingpolicies')
+      expect(kindToPlural('virtualservices')).toBe('virtualservices')
+      expect(kindToPlural('clusters')).toBe('clusters')
+      expect(kindToPlural('backups')).toBe('backups')
+    })
+
+    // Plurals of `*se` singulars — Flux's HelmRelease and coordination.k8s.io's
+    // Lease are both kinds Radar handles, and both reach this cold path.
+    test('idempotent on plurals of *se singulars', () => {
+      expect(kindToPlural('helmreleases')).toBe('helmreleases')
+      expect(kindToPlural('leases')).toBe('leases')
+      expect(kindToPlural('databases')).toBe('databases')
+    })
+
+    test('still pluralizes singular PascalCase CRD kinds', () => {
+      expect(kindToPlural('Schedule')).toBe('schedules')
+      expect(kindToPlural('ValidatingPolicy')).toBe('validatingpolicies')
+      expect(kindToPlural('VirtualService')).toBe('virtualservices')
+      expect(kindToPlural('Cluster')).toBe('clusters')
+    })
+
+    // Lowercase does NOT imply plural. WorkloadViewRoute passes the URL segment
+    // through verbatim, so /workload/deployment/ns/name yields "deployment";
+    // pkg/topology's normalizeKind likewise returns its input unchanged when a
+    // kind resolves through neither its static map nor discovery, so a
+    // ResourceRef can carry "certificaterequest". Both must still pluralize —
+    // including the singulars that already end in 's'.
+    test('still pluralizes lowercase singular kinds', () => {
+      expect(kindToPlural('deployment')).toBe('deployments')
+      expect(kindToPlural('pod')).toBe('pods')
+      expect(kindToPlural('cronjob')).toBe('cronjobs')
+      expect(kindToPlural('certificaterequest')).toBe('certificaterequests')
+      expect(kindToPlural('validatingpolicy')).toBe('validatingpolicies')
+      expect(kindToPlural('ingress')).toBe('ingresses')
+      expect(kindToPlural('nodeclass')).toBe('nodeclasses')
+      expect(kindToPlural('ec2nodeclass')).toBe('ec2nodeclasses')
+      expect(kindToPlural('storageclass')).toBe('storageclasses')
+    })
+
+    test('leaves the empty-string result unchanged', () => {
+      expect(kindToPlural('')).toBe(englishPlural(''))
+    })
+
+    test('agrees with the post-discovery answer', () => {
+      const inputs = ['schedules', 'validatingpolicies', 'Schedule', 'ValidatingPolicy']
+      const cold = inputs.map(kindToPlural)
+      initNavigationMap([
+        { group: 'velero.io', version: 'v1', kind: 'Schedule', name: 'schedules', namespaced: true, isCrd: true, verbs: [] },
+        { group: 'kyverno.io', version: 'v1alpha1', kind: 'ValidatingPolicy', name: 'validatingpolicies', namespaced: false, isCrd: true, verbs: [] },
+      ])
+      expect(inputs.map(kindToPlural)).toEqual(cold)
+    })
+  })
 })
 
 // Demonstrate that the naive .toLowerCase() + 's' pattern used by renderers is broken.

package/src/utils/navigation.ts

@@ -1,5 +1,5 @@
 import type { SelectedResource, ResourceRef, APIResource } from '../types/core'
-import { englishPlural } from './pluralize'
+import { englishPlural, englishSingular, isEnglishPlural } from './pluralize'
 
 /**
  * Canonical callback type for navigating to a resource.
@@ -103,6 +103,15 @@ export function kindToPlural(kind: string): string {
   }
   if (aliases[kindLower]) return aliases[kindLower]
 
+  // Keep the idempotence contract alive for CRD plurals that neither map knows
+  // yet: the discovery map arrives one round-trip after a cold direct-URL load,
+  // and English-pluralizing an already-plural slug yields `scheduleses`. An
+  // all-lowercase input is an API resource name rather than a Kind (Kubernetes
+  // Kinds are PascalCase), and isEnglishPlural separates a real plural from a
+  // singular that merely ends in 's' — `ingress` and `nodeclass` must still be
+  // pluralized, `schedules` and `validatingpolicies` must not.
+  if (kind === kindLower && isEnglishPlural(kindLower)) return kindLower
+
   // Fallback: English pluralization rules (shared with pluralize() in
   // utils/pluralize.ts so a rule change updates both call paths).
   return englishPlural(kindLower)
@@ -125,14 +134,7 @@ export function pluralToKind(plural: string): string {
   }
 
   // Fallback: basic de-pluralization + capitalize first letter
-  let singular = lower
-  if (singular.endsWith('ies')) {
-    singular = singular.slice(0, -3) + 'y'
-  } else if (singular.endsWith('ses') || singular.endsWith('xes') || singular.endsWith('ches') || singular.endsWith('shes')) {
-    singular = singular.slice(0, -2)
-  } else if (singular.endsWith('s')) {
-    singular = singular.slice(0, -1)
-  }
+  const singular = englishSingular(lower)
   return singular.charAt(0).toUpperCase() + singular.slice(1)
 }
 

package/src/utils/pluralize.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { englishPlural, pluralNoun, pluralize } from './pluralize'
+import { englishPlural, englishSingular, isEnglishPlural, pluralNoun, pluralize } from './pluralize'
 
 describe('englishPlural', () => {
   describe('default +s', () => {
@@ -96,3 +96,82 @@ describe('pluralize', () => {
     expect(pluralize(2, 'box')).toBe('2 boxes')
   })
 })
+
+describe('englishSingular', () => {
+  it('inverts englishPlural for regular plurals', () => {
+    expect(englishSingular('clusters')).toBe('cluster')
+    expect(englishSingular('policies')).toBe('policy')
+    expect(englishSingular('classes')).toBe('class')
+    expect(englishSingular('boxes')).toBe('box')
+    expect(englishSingular('batches')).toBe('batch')
+  })
+
+  it('leaves nouns with no plural ending alone', () => {
+    expect(englishSingular('cluster')).toBe('cluster')
+    expect(englishSingular('policy')).toBe('policy')
+  })
+
+  // The `-es` strip over-shortens a `*se` singular ('leases' → 'leas', not
+  // 'lease'), but englishPlural's `s → +es` rule inverts it exactly, so the
+  // round trip these two functions are used for still holds. Only the round
+  // trip is contractual — the intermediate stem is not.
+  it('over-strips *se stems but stays round-trip exact', () => {
+    expect(englishSingular('leases')).toBe('leas')
+    expect(englishPlural('leas')).toBe('leases')
+    expect(englishSingular('helmreleases')).toBe('helmreleas')
+    expect(englishPlural('helmreleas')).toBe('helmreleases')
+  })
+})
+
+describe('isEnglishPlural', () => {
+  it('recognizes regular plurals', () => {
+    expect(isEnglishPlural('schedules')).toBe(true)
+    expect(isEnglishPlural('validatingpolicies')).toBe(true)
+    expect(isEnglishPlural('virtualservices')).toBe(true)
+    expect(isEnglishPlural('gatewayclasses')).toBe(true)
+    expect(isEnglishPlural('endpoints')).toBe(true)
+  })
+
+  // Plurals whose singular ends in `se`. The stem englishSingular produces is
+  // wrong, but the round trip is not — see the englishSingular case above.
+  it('recognizes plurals of *se singulars', () => {
+    expect(isEnglishPlural('leases')).toBe(true)
+    expect(isEnglishPlural('helmreleases')).toBe(true)
+    expect(isEnglishPlural('releases')).toBe(true)
+    expect(isEnglishPlural('licenses')).toBe(true)
+    expect(isEnglishPlural('databases')).toBe(true)
+  })
+
+  // KNOWN LIMIT. A singular ending in a lone `s` whose stem doesn't end in
+  // s/x/ch/sh is indistinguishable from a plural by English rules alone
+  // ('status' → 'statu' → 'status' round-trips exactly like 'clusters' →
+  // 'cluster' → 'clusters'). No Kubernetes Kind Radar handles has this shape,
+  // and kindToPlural's discovered-map lookup takes over the moment discovery
+  // lands, so the mistake is confined to the cold window. Pinned so a future
+  // change to these rules surfaces the boundary rather than moving it silently.
+  it('cannot distinguish singulars ending in a lone s', () => {
+    expect(isEnglishPlural('status')).toBe(true)
+    expect(isEnglishPlural('alias')).toBe(true)
+    expect(isEnglishPlural('canvas')).toBe(true)
+  })
+
+  // The reason this predicate exists rather than a bare endsWith('s'): these
+  // are singular Kubernetes kinds that happen to end in 's'.
+  it('rejects singulars that merely end in s', () => {
+    expect(isEnglishPlural('ingress')).toBe(false)
+    expect(isEnglishPlural('nodeclass')).toBe(false)
+    expect(isEnglishPlural('ec2nodeclass')).toBe(false)
+    expect(isEnglishPlural('storageclass')).toBe(false)
+  })
+
+  it('rejects singulars with no plural ending', () => {
+    expect(isEnglishPlural('cluster')).toBe(false)
+    expect(isEnglishPlural('validatingpolicy')).toBe(false)
+  })
+
+  it('agrees with englishPlural on every round trip', () => {
+    for (const singular of ['cluster', 'policy', 'class', 'box', 'batch', 'schedule', 'service']) {
+      expect(isEnglishPlural(englishPlural(singular))).toBe(true)
+    }
+  })
+})

package/src/utils/pluralize.ts

@@ -30,6 +30,40 @@ export function englishPlural(noun: string): string {
   return noun + 's';
 }
 
+/**
+ * Undo englishPlural's regular rules.
+ *
+ *   englishSingular('classes')  → 'class'
+ *   englishSingular('policies') → 'policy'
+ *   englishSingular('clusters') → 'cluster'
+ *
+ * Lossy by construction — a noun that is already singular comes back mangled
+ * ('ingress' → 'ingres'). Use isEnglishPlural to find out which case you have.
+ */
+export function englishSingular(noun: string): string {
+  const lower = noun.toLowerCase();
+  if (lower.endsWith('ies')) return noun.slice(0, -3) + 'y';
+  if (lower.endsWith('ses') || lower.endsWith('xes') || lower.endsWith('ches') || lower.endsWith('shes')) {
+    return noun.slice(0, -2);
+  }
+  if (lower.endsWith('s')) return noun.slice(0, -1);
+  return noun;
+}
+
+/**
+ * Whether a noun is already the regular English plural of its own singular —
+ * i.e. whether englishPlural would reproduce it. Distinguishes a plural from a
+ * singular that merely ends in 's':
+ *
+ *   isEnglishPlural('schedules') → true   ('schedule' → 'schedules')
+ *   isEnglishPlural('policies')  → true   ('policy'   → 'policies')
+ *   isEnglishPlural('ingress')   → false  ('ingres'   → 'ingreses')
+ *   isEnglishPlural('nodeclass') → false  ('nodeclas' → 'nodeclases')
+ */
+export function isEnglishPlural(noun: string): boolean {
+  return englishPlural(englishSingular(noun)) === noun;
+}
+
 /**
  * Count-aware plural noun. Returns the singular when n===1, else the
  * plural form (passed-in or derived via englishPlural).

package/src/utils/resource-icons.test.ts

@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'vitest'
+import { Database, Server, Puzzle } from 'lucide-react'
+import { getResourceIcon, DEFAULT_RESOURCE_ICON } from './resource-icons'
+
+describe('getResourceIcon', () => {
+  it('disambiguates colliding kinds by API group', () => {
+    // `Cluster` is shipped by CNPG, Cluster API, KubeBlocks and others. Without
+    // the group there is nothing to pick on, so the browser passes it.
+    expect(getResourceIcon('Cluster', 'postgresql.cnpg.io')).toBe(Database)
+    expect(getResourceIcon('Cluster', 'cluster.x-k8s.io')).toBe(Server)
+  })
+
+  it('falls back to the default for an unmapped group', () => {
+    // A third operator's `clusters` CRD must not inherit a Postgres icon.
+    expect(getResourceIcon('Cluster', 'apps.kubeblocks.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('Backup', 'kubevirt.io')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('ignores the group for kinds that do not collide', () => {
+    expect(getResourceIcon('Pod')).not.toBe(Puzzle)
+    expect(getResourceIcon('Pod', 'postgresql.cnpg.io')).toBe(getResourceIcon('Pod'))
+  })
+
+  it('resolves unambiguous CNPG kinds without a group', () => {
+    // Pooler is CNPG-only, so it keys directly and works everywhere.
+    expect(getResourceIcon('Pooler')).not.toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('Pooler')).toBe(getResourceIcon('Pooler', 'postgresql.cnpg.io'))
+  })
+
+  it('returns the default for an entirely unknown kind', () => {
+    expect(getResourceIcon('Widget')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+})

package/src/utils/resource-icons.ts

@@ -29,7 +29,14 @@ import {
   HardDrive,
   Cylinder,
   Database,
+  DatabaseBackup,
+  Waypoints,
   FileSearch,
+  Fingerprint,
+  Wand2,
+  Sparkles,
+  Trash2,
+  ShieldOff,
 
   // Cluster
   Cpu,
@@ -65,6 +72,11 @@ import {
   HeartPulse,
   BookOpen,
 
+  // Velero
+  Cloud,
+  Camera,
+  Package,
+
   // Fallback
   Puzzle,
 } from 'lucide-react'
@@ -196,6 +208,12 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   // Contour
   httpproxy: Globe,
 
+  // CloudNativePG. Pooler is unambiguous so it keys directly; CNPG's colliding
+  // kinds resolve through GROUP_QUALIFIED_KIND_ICONS below. Topology
+  // pseudo-kinds (cnpgcluster/…) belong here only once pkg/topology's
+  // KindForGVK emits them — it has no CNPG case today.
+  pooler: Waypoints,
+
   // Cluster API
   capicluster: Server,
   machinedeployment: Layers,
@@ -227,16 +245,61 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   azuremachinetemplate: Cpu,
   azuremanagedcluster: Server,
 
+  // Kyverno — legacy kyverno.io family, modern policies.kyverno.io CEL
+  // family, and the wgpolicyk8s.io reports every engine writes into.
+  policy: Shield,
+  clusterpolicy: Shield,
+  policyreport: FileSearch,
+  clusterpolicyreport: FileSearch,
+  validatingpolicy: ShieldCheck,
+  namespacedvalidatingpolicy: ShieldCheck,
+  imagevalidatingpolicy: Fingerprint,
+  namespacedimagevalidatingpolicy: Fingerprint,
+  mutatingpolicy: Wand2,
+  namespacedmutatingpolicy: Wand2,
+  generatingpolicy: Sparkles,
+  namespacedgeneratingpolicy: Sparkles,
+  deletingpolicy: Trash2,
+  namespaceddeletingpolicy: Trash2,
+  policyexception: ShieldOff,
+  cleanuppolicy: Trash2,
+  clustercleanuppolicy: Trash2,
+
   // Trivy Operator
   vulnerabilityreport: Shield,
   configauditreport: ShieldCheck,
   exposedsecretreport: ShieldAlert,
   sbomreport: FileSearch,
+
+  // Velero. Only kinds whose names no other operator claims: this map is keyed
+  // on kind alone with no group awareness, so a shared name would give a foreign
+  // resource a Velero icon. That rules out `backup` (CNPG), `restore`
+  // (rancher/backup-restore-operator) and `schedule` (several operators).
+  backupstoragelocation: Cloud,
+  volumesnapshotlocation: Camera,
+  backuprepository: Package,
 }
 
 /** Get the icon for a Kubernetes resource kind (case-insensitive). */
-export function getResourceIcon(kind: string): LucideIcon {
-  return KIND_ICON_MAP[kind.toLowerCase()] ?? Puzzle
+/**
+ * Kinds shared by more than one operator, where the icon can only be chosen
+ * once the API group is known. The resource browser passes the group; callers
+ * that don't have one fall through to the ungrouped map.
+ */
+const GROUP_QUALIFIED_KIND_ICONS: Record<string, Record<string, LucideIcon>> = {
+  cluster: { 'postgresql.cnpg.io': Database, 'cluster.x-k8s.io': Server },
+  backup: { 'postgresql.cnpg.io': DatabaseBackup },
+  scheduledbackup: { 'postgresql.cnpg.io': DatabaseBackup },
+  pooler: { 'postgresql.cnpg.io': Waypoints },
+}
+
+export function getResourceIcon(kind: string, group?: string): LucideIcon {
+  const k = kind.toLowerCase()
+  if (group) {
+    const byGroup = GROUP_QUALIFIED_KIND_ICONS[k]?.[group]
+    if (byGroup) return byGroup
+  }
+  return KIND_ICON_MAP[k] ?? Puzzle
 }
 
 /** Get the icon for a topology node kind, including virtual kinds (Internet, PodGroup). */