@skyhook-io/k8s-ui 1.10.5 → 1.11.0

package/src/components/resources/kyverno-modern-posture.test.ts

@@ -0,0 +1,290 @@
+import { describe, it, expect } from 'vitest'
+import {
+  getKyvernoEnforcementPosture,
+  getKyvernoPolicyFamily,
+  getKyvernoValidationActions,
+  getKyvernoMatchSummary,
+  getModernKyvernoPolicyStatus,
+  isKyvernoAdmissionEnabled,
+  isModernKyvernoPolicy,
+} from './resource-utils-kyverno-modern'
+
+function vpol(spec: any = {}, extra: any = {}) {
+  return {
+    apiVersion: 'policies.kyverno.io/v1',
+    kind: 'ValidatingPolicy',
+    metadata: { name: 'p' },
+    spec,
+    ...extra,
+  }
+}
+
+describe('validationActions defaulting', () => {
+  // Verified against Kyverno 1.18.2: a ValidatingPolicy with no
+  // validationActions rejected a violating request. The legacy family
+  // defaults the analogous field to Audit, so this is the assumption most
+  // likely to be carried over wrongly — and it would under-report the
+  // strictest possible state.
+  it('treats an absent validationActions as Deny', () => {
+    expect(getKyvernoValidationActions(vpol({}))).toEqual(['Deny'])
+    expect(getKyvernoEnforcementPosture(vpol({}), 'validating').blocks).toBe(true)
+  })
+
+  it('treats an empty validationActions array as Deny', () => {
+    expect(getKyvernoValidationActions(vpol({ validationActions: [] }))).toEqual(['Deny'])
+  })
+
+  it('reads explicit actions verbatim', () => {
+    expect(getKyvernoValidationActions(vpol({ validationActions: ['Audit', 'Warn'] }))).toEqual(['Audit', 'Warn'])
+  })
+})
+
+describe('effective enforcement posture', () => {
+  it('reports Deny as blocking when admission evaluation is on', () => {
+    const posture = getKyvernoEnforcementPosture(
+      vpol({ validationActions: ['Deny'], evaluation: { admission: { enabled: true } } }),
+      'validating'
+    )
+    expect(posture.blocks).toBe(true)
+    expect(posture.label).toBe('Deny')
+    expect(posture.level).toBe('unhealthy')
+  })
+
+  // The case the whole posture computation exists for. Verified on Kyverno
+  // 1.18.2: this exact spec did NOT block a violating pod, while the same
+  // policy with admission enabled did. Rendering it as a red "Deny" would
+  // tell an operator the cluster is protected when it is not.
+  it('does not report blocking when admission evaluation is disabled, even for Deny', () => {
+    const posture = getKyvernoEnforcementPosture(
+      vpol({ validationActions: ['Deny'], evaluation: { admission: { enabled: false } } }),
+      'validating'
+    )
+    expect(posture.blocks).toBe(false)
+    expect(posture.label).toBe('Background only')
+    expect(posture.note).toMatch(/never blocked/i)
+  })
+
+  // Tone marks the discrepancy between declared and effective, not the
+  // severity of the declared action. `alert` rather than `degraded` because
+  // `degraded` is already the deliberate Warn posture — "I meant to audit" and
+  // "I meant to block and don't" must not share a tone.
+  it('flags a Deny-declaring background-only policy as a discrepancy', () => {
+    const p = getKyvernoEnforcementPosture(
+      vpol({ validationActions: ['Deny'], evaluation: { admission: { enabled: false } } }),
+      'validating'
+    )
+    expect(p.label).toBe('Background only')
+    expect(p.level).toBe('alert')
+  })
+
+  // No Deny declared means no protection gap — reporting-only either way.
+  it('leaves a non-blocking background-only policy calm', () => {
+    const p = getKyvernoEnforcementPosture(
+      vpol({ validationActions: ['Audit'], evaluation: { admission: { enabled: false } } }),
+      'validating'
+    )
+    expect(p.label).toBe('Background only')
+    expect(p.level).toBe('neutral')
+  })
+
+  // Deliberate postures keep their own tones and must stay distinct from the
+  // discrepancy tier above.
+  it('keeps deliberate Audit and Audit + Warn visually distinct from a discrepancy', () => {
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Audit'] }), 'validating').level).toBe('neutral')
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Audit', 'Warn'] }), 'validating').level).toBe('degraded')
+  })
+
+  it('flags JSON mode as a discrepancy only when the policy declares Deny', () => {
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Deny'], evaluation: { mode: 'JSON' } }), 'validating').level).toBe('alert')
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Audit'], evaluation: { mode: 'JSON' } }), 'validating').level).toBe('neutral')
+  })
+
+  // A policy that evaluates nothing at all declared *something* and delivers
+  // none of it, whatever that something was.
+  it('flags a fully inactive policy as a discrepancy regardless of declared action', () => {
+    const ev = { admission: { enabled: false }, background: { enabled: false } }
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Deny'], evaluation: ev }), 'validating').level).toBe('alert')
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Audit'], evaluation: ev }), 'validating').level).toBe('alert')
+  })
+
+  it('flags an inactive mutating policy as a discrepancy', () => {
+    const p = getKyvernoEnforcementPosture(vpol({ evaluation: { admission: { enabled: false } } }), 'mutating')
+    expect(p.label).toBe('Inactive')
+    expect(p.level).toBe('alert')
+  })
+
+  it('says the policy does nothing when both admission and background are off', () => {
+    const posture = getKyvernoEnforcementPosture(
+      vpol({
+        validationActions: ['Deny'],
+        evaluation: { admission: { enabled: false }, background: { enabled: false } },
+      }),
+      'validating'
+    )
+    expect(posture.blocks).toBe(false)
+    expect(posture.label).toBe('Inactive')
+    expect(posture.note).toMatch(/does nothing/i)
+  })
+
+  // JSON mode evaluates against payloads outside the cluster, so it never
+  // participates in admission regardless of declared actions.
+  it('does not report blocking in JSON evaluation mode', () => {
+    const posture = getKyvernoEnforcementPosture(
+      vpol({ validationActions: ['Deny'], evaluation: { mode: 'JSON' } }),
+      'validating'
+    )
+    expect(posture.blocks).toBe(false)
+    expect(posture.label).toBe('JSON mode')
+  })
+
+  it('treats Audit and Warn as non-blocking', () => {
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Audit'] }), 'validating').blocks).toBe(false)
+    expect(getKyvernoEnforcementPosture(vpol({ validationActions: ['Warn'] }), 'validating').blocks).toBe(false)
+  })
+
+  it('reports Deny as blocking when combined with other actions', () => {
+    const posture = getKyvernoEnforcementPosture(vpol({ validationActions: ['Deny', 'Audit'] }), 'validating')
+    expect(posture.blocks).toBe(true)
+    expect(posture.label).toBe('Deny + Audit')
+  })
+
+  // failurePolicy governs what happens when the ENGINE errors, not when the
+  // policy fails, so it must not move the blocking verdict either way.
+  it('ignores failurePolicy when deciding whether the policy blocks', () => {
+    const ignore = getKyvernoEnforcementPosture(
+      vpol({ validationActions: ['Deny'], failurePolicy: 'Ignore' }),
+      'validating'
+    )
+    const fail = getKyvernoEnforcementPosture(vpol({ validationActions: ['Deny'], failurePolicy: 'Fail' }), 'validating')
+    expect(ignore.blocks).toBe(true)
+    expect(fail.blocks).toBe(true)
+  })
+})
+
+describe('non-validating families', () => {
+  it('describes mutating policies as mutating, never blocking', () => {
+    const posture = getKyvernoEnforcementPosture(vpol({ mutations: [] }), 'mutating')
+    expect(posture.blocks).toBe(false)
+    expect(posture.label).toBe('Mutates on admission')
+  })
+
+  it('marks a mutating policy inactive when admission is disabled and it mutates nothing existing', () => {
+    const posture = getKyvernoEnforcementPosture(
+      vpol({ evaluation: { admission: { enabled: false } } }),
+      'mutating'
+    )
+    expect(posture.label).toBe('Inactive')
+  })
+
+  // Codex #7: mutateExisting rewrites resources that already exist,
+  // independently of the admission path. Calling such a policy "Inactive"
+  // tells an operator nothing is changing while it actively rewrites their
+  // cluster. Verified against the upstream CRD: MutatingPolicy's
+  // spec.evaluation.mutateExisting.enabled defaults to false, the opposite of
+  // admission/background.
+  it('does not call a mutating policy inactive when mutateExisting is on', () => {
+    const posture = getKyvernoEnforcementPosture(
+      vpol({ evaluation: { admission: { enabled: false }, mutateExisting: { enabled: true } } }),
+      'mutating'
+    )
+    expect(posture.label).toBe('Mutates existing')
+    expect(posture.label).not.toBe('Inactive')
+    expect(posture.summary).toMatch(/rewritten/i)
+    expect(posture.note).toMatch(/mutateExisting is on/i)
+  })
+
+  it('mentions existing-resource rewriting even when admission is enabled', () => {
+    const posture = getKyvernoEnforcementPosture(
+      vpol({ evaluation: { admission: { enabled: true }, mutateExisting: { enabled: true } } }),
+      'mutating'
+    )
+    expect(posture.label).toBe('Mutates on admission')
+    expect(posture.summary).toMatch(/existing/i)
+  })
+
+  // A deleting policy has no "violations" — the generic non-blocking sentence
+  // must not leak into a family it does not describe.
+  it('describes deletion in its own terms, not violation terms', () => {
+    const posture = getKyvernoEnforcementPosture(vpol({ schedule: '0 2 * * *' }), 'deleting')
+    expect(posture.summary).toMatch(/deleted/i)
+    expect(posture.summary).not.toMatch(/violation/i)
+  })
+
+  it('describes generation in its own terms', () => {
+    const posture = getKyvernoEnforcementPosture(vpol({ generate: [] }), 'generating')
+    expect(posture.summary).not.toMatch(/violation/i)
+  })
+
+  it('surfaces the cron in a deleting policy posture', () => {
+    const posture = getKyvernoEnforcementPosture(vpol({ schedule: '0 */6 * * *' }), 'deleting')
+    expect(posture.blocks).toBe(false)
+    expect(posture.label).toContain('0 */6 * * *')
+  })
+
+  it('flags a deleting policy with no schedule as never running', () => {
+    const posture = getKyvernoEnforcementPosture(vpol({}), 'deleting')
+    expect(posture.note).toMatch(/will not run/i)
+  })
+})
+
+describe('status badge', () => {
+  // A policy that failed to compile enforces nothing whatever its spec says,
+  // so readiness has to outrank the declared posture.
+  it('reports Not Ready ahead of the enforcement posture', () => {
+    const badge = getModernKyvernoPolicyStatus(
+      vpol({ validationActions: ['Deny'] }, { status: { conditionStatus: { ready: false } } })
+    )
+    expect(badge.text).toBe('Not Ready')
+    expect(badge.level).toBe('unhealthy')
+  })
+
+  it('falls back to the posture when ready', () => {
+    const badge = getModernKyvernoPolicyStatus(
+      vpol({ validationActions: ['Audit'] }, { status: { conditionStatus: { ready: true } } })
+    )
+    expect(badge.text).toBe('Audit')
+  })
+})
+
+describe('family + group detection', () => {
+  it('collapses namespaced twins onto their cluster-scoped family', () => {
+    expect(getKyvernoPolicyFamily('NamespacedValidatingPolicy')).toBe('validating')
+    expect(getKyvernoPolicyFamily('ValidatingPolicy')).toBe('validating')
+    expect(getKyvernoPolicyFamily('NamespacedImageValidatingPolicy')).toBe('imageValidating')
+    expect(getKyvernoPolicyFamily('DeletingPolicy')).toBe('deleting')
+    expect(getKyvernoPolicyFamily('SomethingElse')).toBeUndefined()
+  })
+
+  // The guard that stops a foreign CRD sharing a generic plural like
+  // `validatingpolicies` from being described in Kyverno's vocabulary.
+  it('only matches the policies.kyverno.io group', () => {
+    expect(isModernKyvernoPolicy({ apiVersion: 'policies.kyverno.io/v1' })).toBe(true)
+    expect(isModernKyvernoPolicy({ apiVersion: 'kyverno.io/v1' })).toBe(false)
+    expect(isModernKyvernoPolicy({ apiVersion: 'example.com/v1' })).toBe(false)
+    expect(isModernKyvernoPolicy({})).toBe(false)
+  })
+
+  it('defaults admission evaluation to enabled when unset', () => {
+    expect(isKyvernoAdmissionEnabled(vpol({}))).toBe(true)
+    expect(isKyvernoAdmissionEnabled(vpol({ evaluation: {} }))).toBe(true)
+    expect(isKyvernoAdmissionEnabled(vpol({ evaluation: { admission: { enabled: false } } }))).toBe(false)
+  })
+})
+
+describe('match summary', () => {
+  it('summarizes matched resources and truncates long lists', () => {
+    const spec = {
+      matchConstraints: {
+        resourceRules: [
+          { apiGroups: [''], apiVersions: ['v1'], resources: ['pods', 'configmaps'], operations: ['CREATE'] },
+          { apiGroups: ['apps'], apiVersions: ['v1'], resources: ['deployments', 'statefulsets'], operations: ['CREATE'] },
+        ],
+      },
+    }
+    expect(getKyvernoMatchSummary(vpol(spec))).toBe('pods, configmaps, deployments +1')
+  })
+
+  it('returns a dash when nothing is matched', () => {
+    expect(getKyvernoMatchSummary(vpol({}))).toBe('-')
+  })
+})

package/src/components/resources/renderers/CNPGClusterRenderer.test.tsx

@@ -0,0 +1,85 @@
+import { describe, expect, it } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { CNPGClusterRenderer } from './CNPGClusterRenderer'
+import { getCNPGClusterStatus } from '../resource-utils-cnpg'
+
+const cluster = (phase: string, readyInstances: number, extra: any = {}) => ({
+  apiVersion: 'postgresql.cnpg.io/v1',
+  kind: 'Cluster',
+  metadata: { name: 'pg', namespace: 'db' },
+  spec: { instances: 3 },
+  status: { phase, readyInstances, ...extra },
+})
+
+const html = (resource: any) => renderToString(<CNPGClusterRenderer data={resource} />)
+
+describe('CNPGClusterRenderer — the drawer must not contradict the badge', () => {
+  it('does not raise Degraded for a shortfall the phase already explains', () => {
+    // Mid-switchover at 2/3 is the operation, not a fault. The badge says
+    // "Switchover"; the drawer used to say "Degraded Cluster" beside it.
+    const switching = cluster('Switchover in progress', 2)
+    expect(getCNPGClusterStatus(switching).text).toBe('Switchover')
+    expect(html(switching)).not.toContain('Degraded Cluster')
+  })
+
+  it.each([
+    ['Upgrading cluster', 'transient'],
+    ['Waiting for user action', 'attention'],
+    ['Failing over', 'failing'],
+    ['Cluster is unrecoverable and needs manual intervention', 'terminal'],
+  ])('suppresses the Degraded banner during %s (%s)', (phase) => {
+    expect(html(cluster(phase, 2))).not.toContain('Degraded Cluster')
+  })
+
+  it('still raises Degraded when the phase does NOT explain the shortfall', () => {
+    // The regression guard for the fix: a settled cluster missing an instance
+    // is a genuine problem, and both surfaces must say so.
+    const settled = cluster('Cluster in healthy state', 2)
+    expect(getCNPGClusterStatus(settled).text).toBe('Degraded')
+    expect(html(settled)).toContain('Degraded Cluster')
+  })
+
+  it('still raises Cluster Down at zero ready, whatever the phase', () => {
+    // No phase excuses a database with nothing serving.
+    expect(html(cluster('Upgrading cluster', 0))).toContain('Cluster Down')
+  })
+
+  it('renders a failed last backup at the same tier as the badge and detector', () => {
+    // Three surfaces, one severity: badge `degraded`, Go SeverityWarning, and
+    // the banner. An error banner made the drawer the loudest of the three.
+    const failed = cluster('Cluster in healthy state', 3, {
+      conditions: [{ type: 'LastBackupSucceeded', status: 'False', reason: 'BackupFailed', message: 'upload rejected' }],
+    })
+    const out = html(failed)
+    expect(out).toContain('Last backup failed')
+    expect(getCNPGClusterStatus(failed).level).toBe('degraded')
+    // AlertBanner keys its tone off the variant; the error tone must be absent
+    // for this banner while the warning tone is present.
+    const banner = out.slice(out.indexOf('Last backup failed') - 400, out.indexOf('Last backup failed'))
+    expect(banner).not.toMatch(/status-unhealthy|text-red-/)
+  })
+})
+
+describe('the WAL banner must not claim nothing else looks wrong when something does', () => {
+  const walFailing = (phase: string, ready: number) => cluster(phase, ready, {
+    conditions: [{ type: 'ContinuousArchiving', status: 'False', reason: 'ContinuousArchivingFailing' }],
+  })
+  const CLAIM = 'otherwise serving normally'
+
+  it('makes the claim on a genuinely healthy cluster', () => {
+    expect(html(walFailing('Cluster in healthy state', 3))).toContain(CLAIM)
+  })
+
+  it('drops it mid-switchover, where a Switchover banner sits right above', () => {
+    // Regression guard for a sibling the phase gate itself introduced: this
+    // clause used to be suppressed by isDegraded, which a phase-explained
+    // shortfall no longer sets.
+    const out = html(walFailing('Switchover in progress', 2))
+    expect(out).toContain('Switchover in Progress')
+    expect(out).not.toContain(CLAIM)
+  })
+
+  it.each(['Waiting for user action', 'Upgrading cluster', 'Failing over'])('drops it during %s', (phase) => {
+    expect(html(walFailing(phase, 2))).not.toContain(CLAIM)
+  })
+})

package/src/components/resources/renderers/CNPGClusterRenderer.tsx

@@ -18,7 +18,11 @@ import {
   getCNPGClusterPostgresParams,
   getCNPGClusterInstancesReportedState,
   getCNPGClusterCertificateExpirations,
+  getCNPGWALArchivingFailure,
+  getCNPGLastBackupFailure,
+  classifyCNPGClusterPhase,
 } from '../resource-utils-cnpg'
+import { formatAge } from '../resource-utils'
 
 interface CNPGClusterRendererProps {
   data: any
@@ -28,7 +32,12 @@ interface CNPGClusterRendererProps {
 export function CNPGClusterRenderer({ data, onNavigate }: CNPGClusterRendererProps) {
   const conditions = data.status?.conditions || []
   const instances = data.spec?.instances ?? 0
-  const readyInstances = data.status?.readyInstances ?? 0
+  // Presence matters — see getCNPGClusterStatus. A cluster whose status has no
+  // readyInstances yet is unknown, not zero; defaulting to 0 raised a "Cluster
+  // Down" banner on a cluster that had simply not reported yet.
+  const readyKnown = typeof data.status?.readyInstances === 'number'
+  const readyInstances: number = readyKnown ? data.status.readyInstances : 0
+  const countsKnown = instances > 0 && readyKnown
   const phase = getCNPGClusterPhase(data)
   const backupConfig = getCNPGClusterBackupConfig(data)
   const monitoring = getCNPGClusterMonitoring(data)
@@ -57,15 +66,46 @@ export function CNPGClusterRenderer({ data, onNavigate }: CNPGClusterRendererPro
   // Last failed backup
   const lastFailedBackup = data.status?.lastFailedBackup
 
+  // WAL archiving / backup health, straight from the operator's own conditions.
+  const walArchivingFailure = getCNPGWALArchivingFailure(data)
+  const lastBackupFailure = getCNPGLastBackupFailure(data)
+  const phaseBucket = classifyCNPGClusterPhase(phase)
+
   // Problem detection
-  const isDown = instances > 0 && readyInstances === 0
-  const isDegraded = instances > 0 && readyInstances < instances && readyInstances > 0
-  const isFailover = phase.toLowerCase().includes('failing over')
-  const isSwitchover = phase.toLowerCase().includes('switchover')
+  const isDown = countsKnown && readyInstances === 0
+  // A shortfall the PHASE already explains is not a separate problem. Mirrors
+  // source_cnpg.go's phaseExplained gate and the badge's ordering, both of
+  // which check the phase before the instance counts: mid-switchover or waiting
+  // on a supervised update, running below the desired count is the operation,
+  // not a fault. Without this the drawer raised "Degraded Cluster" while the
+  // badge deliberately said "Switchover" — the same two-surfaces-one-cluster
+  // disagreement this integration exists to remove, inverted.
+  const phaseExplainsShortfall =
+    phaseBucket === 'terminal' || phaseBucket === 'failing'
+    || phaseBucket === 'attention' || phaseBucket === 'transient'
+  const isDegraded = countsKnown && readyInstances < instances && readyInstances > 0 && !phaseExplainsShortfall
+  const isFailover = phaseBucket === 'failing'
+  const isSwitchover = phase === 'Switchover in progress'
+  const isTerminal = phaseBucket === 'terminal'
+  // "The cluster is otherwise serving normally, so nothing else here will look
+  // wrong" is a claim about the REST OF THIS DRAWER, so any other banner
+  // falsifies it. It can no longer lean on isDegraded now that a
+  // phase-explained shortfall doesn't set it: a cluster mid-switchover at 2/3
+  // would assert nothing else looks wrong directly beneath a Switchover banner.
+  const hasOtherProblemBanner =
+    isDown || isDegraded || primaryMismatch || hasSplitBrain
+    || (phaseBucket !== 'healthy' && phaseBucket !== 'unknown')
 
   return (
     <>
       {/* Problem alerts */}
+      {isTerminal && (
+        <AlertBanner
+          variant="error"
+          title="Reconciliation has stopped"
+          message={`${phase}. This state does not resolve on its own — the operator has stopped reconciling this cluster and it needs manual intervention.`}
+        />
+      )}
       {hasSplitBrain && (
         <AlertBanner
           variant="error"
@@ -88,8 +128,13 @@ export function CNPGClusterRenderer({ data, onNavigate }: CNPGClusterRendererPro
         />
       )}
       {isFailover && (
+        // Warning, not error: the badge renders failover at the alert tier and
+        // the issue detector reports it as a warning. A failover that has also
+        // taken every instance down still gets the red "Cluster Down" banner
+        // above, so severity is not lost — this just stops one surface shouting
+        // louder than the other two about the same event.
         <AlertBanner
-          variant="error"
+          variant="warning"
           title="Failover in Progress"
           message={`Cluster is performing a failover. Current phase: ${phase}`}
         />
@@ -108,11 +153,39 @@ export function CNPGClusterRenderer({ data, onNavigate }: CNPGClusterRendererPro
           message={`Target primary is ${targetPrimary} but current primary is ${currentPrimary}.`}
         />
       )}
-      {lastFailedBackup && (
+      {walArchivingFailure && (
         <AlertBanner
           variant="error"
-          title="Last Backup Failed"
-          message={`Last backup failed at ${lastFailedBackup}. WAL archiving may be impacted and RPO is growing.`}
+          title="WAL archiving is failing"
+          message={
+            // Precision matters here. The condition proves the last archival
+            // attempt did not complete and has stayed False since its
+            // transition — it does not prove a continuous run of failures, and
+            // it says nothing about an exact RPO. The "still serving" framing
+            // is gated on the cluster actually being up: asserting it next to a
+            // Cluster Down banner would be plainly false.
+            `CNPG reports that the last WAL archival did not complete${walArchivingFailure.lastTransitionTime ? `, and archiving has been in this state for ${formatAge(walArchivingFailure.lastTransitionTime)}` : ''}. ` +
+            'Recovery-point advancement is uncertain — check the backup destination before relying on point-in-time recovery.' +
+            (hasOtherProblemBanner
+              ? ''
+              : ' The cluster is otherwise serving normally, so nothing else here will look wrong.') +
+            (walArchivingFailure.message ? ` Operator reported: ${walArchivingFailure.message}` : '')
+          }
+        />
+      )}
+      {lastBackupFailure && (
+        // Warning, not error: the badge renders this at the degraded tier and
+        // the issue detector reports SeverityWarning. One failed attempt puts
+        // the recovery window at risk and CNPG will retry — unlike the
+        // archiving failure above, which is continuous and stays red on all
+        // three surfaces.
+        <AlertBanner
+          variant="warning"
+          title="Last backup failed"
+          message={
+            `The most recent backup attempt failed${lastBackupFailure.lastTransitionTime ? ` ${formatAge(lastBackupFailure.lastTransitionTime)} ago` : ''}.` +
+            (lastBackupFailure.message ? ` Operator reported: ${lastBackupFailure.message}` : '')
+          }
         />
       )}
       {expiredCerts.length > 0 && (
@@ -242,6 +315,22 @@ export function CNPGClusterRenderer({ data, onNavigate }: CNPGClusterRendererPro
       {backupConfig.configured && (
         <Section title="Backup" icon={Clock} defaultExpanded>
           <PropertyList>
+            {backupConfig.plugin && (
+              <Property label="Managed By" value="barman-cloud plugin" />
+            )}
+            {backupConfig.plugin?.barmanObjectName && (
+              <Property label="Object Store" value={
+                <ResourceLink
+                  name={backupConfig.plugin.barmanObjectName}
+                  kind="objectstores"
+                  namespace={data.metadata?.namespace || ''}
+                  onNavigate={onNavigate}
+                />
+              } />
+            )}
+            {backupConfig.plugin?.isWALArchiver && (
+              <Property label="WAL Archiver" value="This plugin" />
+            )}
             {backupConfig.destinationPath && (
               <Property label="Destination" value={backupConfig.destinationPath} />
             )}
@@ -258,6 +347,17 @@ export function CNPGClusterRenderer({ data, onNavigate }: CNPGClusterRendererPro
               <Property label="First Recoverability" value={backupConfig.firstRecoverabilityPoint} />
             )}
           </PropertyList>
+          {/* Without this note the section renders empty on plugin-migrated
+              clusters, which is indistinguishable from "no backups configured" —
+              the worst possible ambiguity for a recovery-point display. */}
+          {backupConfig.rpoTrackedOnObjectStore && (
+            <div className="mt-2 pt-2 border-t border-theme-border text-xs text-theme-text-secondary">
+              Recovery-point fields are not published on the Cluster when backups run through the
+              barman-cloud plugin. The recovery window is tracked on the ObjectStore
+              {backupConfig.plugin?.barmanObjectName ? ` "${backupConfig.plugin.barmanObjectName}"` : ''}
+              {backupConfig.plugin?.serverName ? `, under server "${backupConfig.plugin.serverName}"` : ''}.
+            </div>
+          )}
         </Section>
       )}
 

package/src/components/resources/renderers/CNPGPoolerRenderer.tsx

@@ -17,8 +17,12 @@ interface CNPGPoolerRendererProps {
 
 export function CNPGPoolerRenderer({ data, onNavigate }: CNPGPoolerRendererProps) {
   const desired = data.spec?.instances ?? 0
-  const ready = data.status?.instances ?? 0
-  const isDegraded = desired > 0 && ready < desired
+  // status.instances is the number of pods trying to be SCHEDULED, not ready
+  // pods — a Pooler whose PgBouncer pods are all Pending still reports the full
+  // count. Naming it `ready` here is what let the banner claim a readiness the
+  // CR never establishes.
+  const scheduled = data.status?.instances ?? 0
+  const isDegraded = desired > 0 && scheduled < desired
   const clusterName = getCNPGPoolerCluster(data)
   const parameters = getCNPGPoolerParameters(data)
   const authQuery = getCNPGPoolerAuthQuery(data)
@@ -31,7 +35,7 @@ export function CNPGPoolerRenderer({ data, onNavigate }: CNPGPoolerRendererProps
         <AlertBanner
           variant="warning"
           title="Pooler Degraded"
-          message={`Only ${ready} of ${desired} pooler instances are ready.`}
+          message={`Only ${scheduled} of ${desired} pooler instances are scheduled. Readiness is tracked on the "${data.metadata?.name}" Deployment, not on the Pooler.`}
         />
       )}
 
@@ -40,7 +44,7 @@ export function CNPGPoolerRenderer({ data, onNavigate }: CNPGPoolerRendererProps
         <PropertyList>
           <Property label="Type" value={getCNPGPoolerType(data)} />
           <Property label="Pool Mode" value={getCNPGPoolerMode(data)} />
-          <Property label="Instances" value={getCNPGPoolerInstances(data)} />
+          <Property label="Instances Scheduled" value={getCNPGPoolerInstances(data)} />
         </PropertyList>
       </Section>
 

package/src/components/resources/renderers/EventRenderer.test.tsx

@@ -0,0 +1,23 @@
+import { renderToString } from 'react-dom/server'
+import { describe, expect, it } from 'vitest'
+
+import { EventRenderer } from './EventRenderer'
+
+describe('EventRenderer', () => {
+  it.each([
+    ['Warning', 'status-degraded'],
+    ['Normal', 'status-neutral'],
+  ])('uses the theme-aware status tone for %s events', (type, statusClass) => {
+    const html = renderToString(<EventRenderer data={{
+      type,
+      reason: 'FailedScheduling',
+      message: 'No nodes are available',
+    }} />)
+
+    expect(html).toContain(statusClass)
+    expect(html).toContain('FailedScheduling')
+    expect(html).toContain('No nodes are available')
+    expect(html).not.toMatch(/text-(?:amber|blue)-(?:200|300|400)/)
+    expect(html).not.toContain('opacity-')
+  })
+})