@skyhook-io/k8s-ui 1.10.5 → 1.12.0

package/src/theme/components.css

@@ -273,3 +273,29 @@
 @media (prefers-reduced-motion: reduce) {
   .reach-edge-testing { animation: none; }
 }
+
+/* reach-node-testing: the vantage a test is running FROM, while it runs.
+   The edge already shows the request travelling; the capsule it leaves from
+   stayed inert, so the source of the work looked as static as everything else.
+   A slow border breathe + a lifted surface says "this one is working" without
+   competing with the flowing edge. Semantic: only the running origin gets it. */
+@keyframes reach-node-breathe {
+  0%, 100% { box-shadow: 0 0 0 0 color-mix(in srgb, var(--accent) 45%, transparent); }
+  50% { box-shadow: 0 0 0 4px color-mix(in srgb, var(--accent) 12%, transparent); }
+}
+.reach-node-testing {
+  animation: reach-node-breathe 1.6s ease-in-out infinite;
+}
+/* The label itself pulses gently - "testing now" that never changes reads as
+   a stuck state on a long run. */
+@keyframes reach-label-fade {
+  0%, 100% { opacity: 1; }
+  50% { opacity: 0.55; }
+}
+.reach-label-testing {
+  animation: reach-label-fade 1.6s ease-in-out infinite;
+}
+@media (prefers-reduced-motion: reduce) {
+  .reach-node-testing,
+  .reach-label-testing { animation: none; }
+}

package/src/types/gitops-flux-status.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect } from 'vitest'
+import { fluxConditionsToGitOpsStatus, type FluxCondition } from './gitops'
+
+const c = (type: string, status: string, extra: Partial<FluxCondition> = {}): FluxCondition =>
+  ({ type, status, ...extra } as FluxCondition)
+
+// Mirrors pkg/gitops/fluxstatus_test.go. The two implementations must not drift:
+// they feed the same columns from different sides of the wire.
+describe('fluxConditionsToGitOpsStatus truth table', () => {
+  it('a stale Reconciling does not outvote an applied Ready', () => {
+    // The reported bug: kubectl and k9s read the printer columns and show
+    // READY=True while Radar showed the row as syncing.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'True'), c('Healthy', 'True'), c('Reconciling', 'True')],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+  })
+
+  it('generation drift outranks a stale Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {
+      generation: 2,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('treats the -1 sentinel as drift', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False'), c('Reconciling', 'True')], false, {
+      generation: 1,
+      observedGeneration: -1,
+    })
+    expect(got.sync).toBe('Reconciling')
+  })
+
+  it('does not treat an absent observedGeneration as drift', () => {
+    // Kinds and controller versions that never set it must not all read stale.
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, { generation: 3 }).sync).toBe('Synced')
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {}).sync).toBe('Synced')
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false).sync).toBe('Synced')
+  })
+
+  it('lets Stalled outrank Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True'), c('Stalled', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('separates applied from healthy', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True'), c('Healthy', 'False')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('reports Reconciling when the pass has not reached Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'Unknown'), c('Reconciling', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+  })
+
+  it('keeps a suspended-but-applied object Synced, and drops it on drift', () => {
+    const gen = { generation: 1, observedGeneration: 1 }
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], true, gen).sync).toBe('Synced')
+    expect(
+      fluxConditionsToGitOpsStatus([c('Ready', 'True')], true, { generation: 2, observedGeneration: 1 }).sync,
+    ).toBe('Unknown')
+  })
+
+  it('treats a retrying Ready=False as progressing, not degraded', () => {
+    // Mirrors pkg/gitops/fluxstatus_test.go. Flux composes reasons like
+    // ProgressingWithRetry; a retry in flight is out of sync but not settled.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'False', { reason: 'ProgressingWithRetry' })],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('treats a settled Ready=False as degraded', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False', { reason: 'BuildFailed' })], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+})
+
+
+describe('reconciling activity', () => {
+  it('survives even when it no longer drives the status', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'True'), c('Reconciling', 'True', { lastTransitionTime: '2026-08-11T06:05:00Z' })],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.reconciling).toBe(true)
+    expect(got.reconcilingSince).toBe('2026-08-11T06:05:00Z')
+  })
+
+  it('is absent on a quiet object', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.reconciling).toBeUndefined()
+  })
+})
+
+// Source kinds carry no Healthy condition; HelmRelease uses Released.
+describe('non-Kustomization Flux kinds', () => {
+  it.each([
+    ['GitRepository', [c('Ready', 'True'), c('ArtifactInStorage', 'True')]],
+    ['HelmRepository', [c('Ready', 'True'), c('ArtifactInStorage', 'True')]],
+    ['HelmRelease', [c('Ready', 'True'), c('Released', 'True')]],
+  ])('%s reads as Synced/Healthy', (_kind, conds) => {
+    const got = fluxConditionsToGitOpsStatus(conds as FluxCondition[], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+  })
+})
+
+// The wedged-controller case end to end: a fully-applied object whose reconcile
+// pass never finished must read Synced (it IS applied) AND still carry the
+// in-flight fact, or a stuck controller becomes invisible. Before the sync fix
+// this state showed a permanent "Syncing", which was the wrong word but the
+// only thing in the product that noticed.
+describe('a wedged controller stays visible', () => {
+  it('reports Synced and keeps the in-flight fact with its start time', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [
+        c('Ready', 'True', { lastTransitionTime: '2026-08-11T06:00:00Z' }),
+        c('Healthy', 'True'),
+        c('Reconciling', 'True', { lastTransitionTime: '2026-08-11T06:05:00Z' }),
+      ],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+    // Both are required: without these the indicator has nothing to render and
+    // the operator gets a confident all-clear over a stuck controller.
+    expect(got.reconciling).toBe(true)
+    expect(got.reconcilingSince).toBe('2026-08-11T06:05:00Z')
+  })
+})

package/src/types/gitops.ts

@@ -63,6 +63,15 @@ export interface GitOpsStatus {
   message?: string
   lastSyncTime?: string
   suspended: boolean
+  /**
+   * A reconcile pass is executing right now. Activity, not sync and not health —
+   * it never influences either, because a controller being mid-pass says nothing
+   * about whether the declared state is applied. Renderers may show a subtle
+   * indicator; nothing that drives a status word.
+   */
+  reconciling?: boolean
+  /** When the in-flight pass started, so a wedged controller can be told from a routine one. */
+  reconcilingSince?: string
 }
 
 /**
@@ -97,50 +106,92 @@ export interface FluxCondition {
 // ============================================================================
 
 /**
- * Maps FluxCD conditions to unified GitOpsStatus
+ * Generation tracking for a Flux object. `observedGeneration` has three states,
+ * and the difference matters: absent means the controller never reports it and
+ * we have no signal, which must not be read as drift.
+ */
+export interface FluxGeneration {
+  generation?: number
+  observedGeneration?: number
+}
+
+/**
+ * True when the controller has demonstrably not yet acted on the current spec.
+ * Absent observedGeneration is no signal, not drift — some Flux kinds and older
+ * controllers never set it, and treating absence as drift would mark every
+ * healthy object on them as out of date. A present-but-different value counts,
+ * including the -1 sentinel Flux writes on an object it has never reconciled.
+ */
+function hasGenerationDrift(gen?: FluxGeneration): boolean {
+  if (!gen) return false
+  const { generation, observedGeneration } = gen
+  if (typeof generation !== 'number' || typeof observedGeneration !== 'number') return false
+  return generation !== observedGeneration
+}
+
+/**
+ * Maps FluxCD conditions to unified GitOpsStatus.
+ *
+ * Sync answers "is the declared state applied", which is `Ready` plus
+ * `observedGeneration`. `Reconciling` answers "is the controller mid-pass",
+ * which is neither — the two are independent conditions upstream, and letting
+ * activity outvote readiness reported a healthy object as not synced.
  *
- * FluxCD status patterns:
- * - Ready=True: Synced and healthy
- * - Ready=False + Stalled=True: Degraded
- * - Ready=False + Reconciling=True: Reconciling
- * - Ready=False (other): OutOfSync
- * - Healthy=False: Deployed but unhealthy resources
- * - spec.suspend=true: Suspended
+ * Order matters:
+ * - suspend                                   → Suspended (sync from Ready, unless drifted)
+ * - Stalled=True                              → OutOfSync / Degraded
+ * - Ready=True and no generation drift        → Synced, health from Healthy
+ * - drift, or Reconciling with Ready not True → Reconciling / Progressing
+ * - Ready=False                               → OutOfSync
  */
 export function fluxConditionsToGitOpsStatus(
   conditions: FluxCondition[],
-  suspended: boolean
+  suspended: boolean,
+  generation?: FluxGeneration
 ): GitOpsStatus {
   const readyCondition = conditions.find(c => c.type === 'Ready')
   const reconcilingCondition = conditions.find(c => c.type === 'Reconciling')
   const stalledCondition = conditions.find(c => c.type === 'Stalled')
   const healthyCondition = conditions.find(c => c.type === 'Healthy')
 
-  // Handle suspended state
+  const drifted = hasGenerationDrift(generation)
+  const isReconciling = reconcilingCondition?.status === 'True'
+  // Carried on every result so a wedged controller is visible next to an
+  // otherwise-correct Synced, without any status word claiming a fault.
+  const activity = isReconciling
+    ? { reconciling: true, reconcilingSince: reconcilingCondition?.lastTransitionTime }
+    : {}
+
+  // Handle suspended state. Suspending does not un-apply what was applied, so a
+  // suspended object that was Ready stays Synced — but a spec change made while
+  // suspended will never be picked up, so drift downgrades it to Unknown.
   if (suspended) {
     return {
-      sync: readyCondition?.status === 'True' ? 'Synced' : 'Unknown',
+      sync: readyCondition?.status === 'True' && !drifted ? 'Synced' : 'Unknown',
       health: 'Suspended',
       message: 'Reconciliation is suspended',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: true,
+      ...activity,
     }
   }
 
-  // Handle reconciling state
-  if (reconcilingCondition?.status === 'True') {
+  // Stalled is a terminal failure and outranks readiness: it means the
+  // controller has given up, whatever the last successful apply left behind.
+  if (stalledCondition?.status === 'True') {
     return {
-      sync: 'Reconciling',
-      health: 'Progressing',
-      message: reconcilingCondition.message || 'Reconciliation in progress',
+      sync: 'OutOfSync',
+      health: 'Degraded',
+      message: stalledCondition.message || 'Reconciliation stalled',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
-  // Handle ready state
-  if (readyCondition?.status === 'True') {
-    // Check if deployed resources are healthy
+  // The applied state. Ahead of the reconciling branch on purpose — this is the
+  // whole point of the ordering.
+  if (readyCondition?.status === 'True' && !drifted) {
     const isHealthy = healthyCondition?.status !== 'False'
     return {
       sync: 'Synced',
@@ -148,17 +199,20 @@ export function fluxConditionsToGitOpsStatus(
       message: isHealthy ? undefined : healthyCondition?.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
-  // Handle stalled state (permanent failure)
-  if (stalledCondition?.status === 'True') {
+  // Genuinely not applied: the controller has not observed the current spec, or
+  // it is working and has not reached Ready.
+  if (drifted || isReconciling) {
     return {
-      sync: 'OutOfSync',
-      health: 'Degraded',
-      message: stalledCondition.message || 'Reconciliation stalled',
+      sync: 'Reconciling',
+      health: 'Progressing',
+      message: reconcilingCondition?.message || 'Reconciliation in progress',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
@@ -173,6 +227,7 @@ export function fluxConditionsToGitOpsStatus(
       message: readyCondition.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
@@ -182,6 +237,7 @@ export function fluxConditionsToGitOpsStatus(
     health: 'Unknown',
     message: 'Status cannot be determined',
     suspended: false,
+    ...activity,
   }
 }
 

package/src/types/index.ts

@@ -5,3 +5,4 @@ export * from './gitops-tree'
 export * from './gitops-insights'
 export * from './rbac'
 export * from './capacity'
+export * from './policy'

package/src/types/policy.ts

@@ -0,0 +1,42 @@
+// Per-resource policy findings, from GET /api/policy/resource/{kind}/{ns}/{name}.
+//
+// The coverage fields are not decoration. An empty `findings` array means one of
+// several very different things — nothing violated, no engine installed, the
+// caller may not read the reports, the index is still warming — and a section
+// that renders all of them as blank space tells an operator they are compliant
+// in the cases where we simply do not know.
+
+export type PolicyResult = 'pass' | 'fail' | 'warn' | 'error' | 'skip' | string
+
+export interface PolicyResourceFinding {
+  policy: string
+  rule?: string
+  result: PolicyResult
+  severity?: string
+  category?: string
+  message?: string
+  engine?: string
+}
+
+export interface PolicyResourceCounts {
+  pass: number
+  fail: number
+  warn: number
+  error: number
+  skip: number
+}
+
+export interface PolicyResourceResponse {
+  /** False whenever the answer is "we could not check". Never treat an empty
+   *  findings array as "clean" without consulting this first. */
+  evaluated: boolean
+  status: string
+  reasonCode?: string
+  /** Report families the caller could not read. Present even when evaluated:
+   *  the answer is real but incomplete. */
+  deniedGroups?: string[]
+  /** False when the index is frozen at its initial contents. */
+  liveUpdates: boolean
+  counts: PolicyResourceCounts
+  findings: PolicyResourceFinding[]
+}

package/src/utils/api-resources.ts

@@ -207,6 +207,8 @@ export function formatGroupName(group: string): string {
     'eks.amazonaws.com': 'EKS',
     'networking.k8s.aws': 'AWS Networking',
     'acid.zalan.do': 'Zalando Postgres',
+    'postgresql.cnpg.io': 'CloudNativePG',
+    'barmancloud.cnpg.io': 'CloudNativePG',
     'serving.kserve.io': 'KServe',
     'ray.io': 'KubeRay',
     'leaderworkerset.x-k8s.io': 'LeaderWorkerSet',

package/src/utils/resource-icons.test.ts

@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'vitest'
+import { Database, Server, Puzzle } from 'lucide-react'
+import { getResourceIcon, DEFAULT_RESOURCE_ICON } from './resource-icons'
+
+describe('getResourceIcon', () => {
+  it('disambiguates colliding kinds by API group', () => {
+    // `Cluster` is shipped by CNPG, Cluster API, KubeBlocks and others. Without
+    // the group there is nothing to pick on, so the browser passes it.
+    expect(getResourceIcon('Cluster', 'postgresql.cnpg.io')).toBe(Database)
+    expect(getResourceIcon('Cluster', 'cluster.x-k8s.io')).toBe(Server)
+  })
+
+  it('falls back to the default for an unmapped group', () => {
+    // A third operator's `clusters` CRD must not inherit a Postgres icon.
+    expect(getResourceIcon('Cluster', 'apps.kubeblocks.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('Backup', 'kubevirt.io')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('ignores the group for kinds that do not collide', () => {
+    expect(getResourceIcon('Pod')).not.toBe(Puzzle)
+    expect(getResourceIcon('Pod', 'postgresql.cnpg.io')).toBe(getResourceIcon('Pod'))
+  })
+
+  it('resolves unambiguous CNPG kinds without a group', () => {
+    // Pooler is CNPG-only, so it keys directly and works everywhere.
+    expect(getResourceIcon('Pooler')).not.toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('Pooler')).toBe(getResourceIcon('Pooler', 'postgresql.cnpg.io'))
+  })
+
+  it('returns the default for an entirely unknown kind', () => {
+    expect(getResourceIcon('Widget')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+})

package/src/utils/resource-icons.ts

@@ -29,7 +29,14 @@ import {
   HardDrive,
   Cylinder,
   Database,
+  DatabaseBackup,
+  Waypoints,
   FileSearch,
+  Fingerprint,
+  Wand2,
+  Sparkles,
+  Trash2,
+  ShieldOff,
 
   // Cluster
   Cpu,
@@ -65,6 +72,11 @@ import {
   HeartPulse,
   BookOpen,
 
+  // Velero
+  Cloud,
+  Camera,
+  Package,
+
   // Fallback
   Puzzle,
 } from 'lucide-react'
@@ -196,6 +208,12 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   // Contour
   httpproxy: Globe,
 
+  // CloudNativePG. Pooler is unambiguous so it keys directly; CNPG's colliding
+  // kinds resolve through GROUP_QUALIFIED_KIND_ICONS below. Topology
+  // pseudo-kinds (cnpgcluster/…) belong here only once pkg/topology's
+  // KindForGVK emits them — it has no CNPG case today.
+  pooler: Waypoints,
+
   // Cluster API
   capicluster: Server,
   machinedeployment: Layers,
@@ -227,16 +245,61 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   azuremachinetemplate: Cpu,
   azuremanagedcluster: Server,
 
+  // Kyverno — legacy kyverno.io family, modern policies.kyverno.io CEL
+  // family, and the wgpolicyk8s.io reports every engine writes into.
+  policy: Shield,
+  clusterpolicy: Shield,
+  policyreport: FileSearch,
+  clusterpolicyreport: FileSearch,
+  validatingpolicy: ShieldCheck,
+  namespacedvalidatingpolicy: ShieldCheck,
+  imagevalidatingpolicy: Fingerprint,
+  namespacedimagevalidatingpolicy: Fingerprint,
+  mutatingpolicy: Wand2,
+  namespacedmutatingpolicy: Wand2,
+  generatingpolicy: Sparkles,
+  namespacedgeneratingpolicy: Sparkles,
+  deletingpolicy: Trash2,
+  namespaceddeletingpolicy: Trash2,
+  policyexception: ShieldOff,
+  cleanuppolicy: Trash2,
+  clustercleanuppolicy: Trash2,
+
   // Trivy Operator
   vulnerabilityreport: Shield,
   configauditreport: ShieldCheck,
   exposedsecretreport: ShieldAlert,
   sbomreport: FileSearch,
+
+  // Velero. Only kinds whose names no other operator claims: this map is keyed
+  // on kind alone with no group awareness, so a shared name would give a foreign
+  // resource a Velero icon. That rules out `backup` (CNPG), `restore`
+  // (rancher/backup-restore-operator) and `schedule` (several operators).
+  backupstoragelocation: Cloud,
+  volumesnapshotlocation: Camera,
+  backuprepository: Package,
 }
 
 /** Get the icon for a Kubernetes resource kind (case-insensitive). */
-export function getResourceIcon(kind: string): LucideIcon {
-  return KIND_ICON_MAP[kind.toLowerCase()] ?? Puzzle
+/**
+ * Kinds shared by more than one operator, where the icon can only be chosen
+ * once the API group is known. The resource browser passes the group; callers
+ * that don't have one fall through to the ungrouped map.
+ */
+const GROUP_QUALIFIED_KIND_ICONS: Record<string, Record<string, LucideIcon>> = {
+  cluster: { 'postgresql.cnpg.io': Database, 'cluster.x-k8s.io': Server },
+  backup: { 'postgresql.cnpg.io': DatabaseBackup },
+  scheduledbackup: { 'postgresql.cnpg.io': DatabaseBackup },
+  pooler: { 'postgresql.cnpg.io': Waypoints },
+}
+
+export function getResourceIcon(kind: string, group?: string): LucideIcon {
+  const k = kind.toLowerCase()
+  if (group) {
+    const byGroup = GROUP_QUALIFIED_KIND_ICONS[k]?.[group]
+    if (byGroup) return byGroup
+  }
+  return KIND_ICON_MAP[k] ?? Puzzle
 }
 
 /** Get the icon for a topology node kind, including virtual kinds (Internet, PodGroup). */