@skyhook-io/k8s-ui 1.11.0 → 1.12.0

package/src/types/gitops-flux-status.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect } from 'vitest'
+import { fluxConditionsToGitOpsStatus, type FluxCondition } from './gitops'
+
+const c = (type: string, status: string, extra: Partial<FluxCondition> = {}): FluxCondition =>
+  ({ type, status, ...extra } as FluxCondition)
+
+// Mirrors pkg/gitops/fluxstatus_test.go. The two implementations must not drift:
+// they feed the same columns from different sides of the wire.
+describe('fluxConditionsToGitOpsStatus truth table', () => {
+  it('a stale Reconciling does not outvote an applied Ready', () => {
+    // The reported bug: kubectl and k9s read the printer columns and show
+    // READY=True while Radar showed the row as syncing.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'True'), c('Healthy', 'True'), c('Reconciling', 'True')],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+  })
+
+  it('generation drift outranks a stale Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {
+      generation: 2,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('treats the -1 sentinel as drift', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False'), c('Reconciling', 'True')], false, {
+      generation: 1,
+      observedGeneration: -1,
+    })
+    expect(got.sync).toBe('Reconciling')
+  })
+
+  it('does not treat an absent observedGeneration as drift', () => {
+    // Kinds and controller versions that never set it must not all read stale.
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, { generation: 3 }).sync).toBe('Synced')
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {}).sync).toBe('Synced')
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false).sync).toBe('Synced')
+  })
+
+  it('lets Stalled outrank Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True'), c('Stalled', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('separates applied from healthy', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True'), c('Healthy', 'False')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('reports Reconciling when the pass has not reached Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'Unknown'), c('Reconciling', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+  })
+
+  it('keeps a suspended-but-applied object Synced, and drops it on drift', () => {
+    const gen = { generation: 1, observedGeneration: 1 }
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], true, gen).sync).toBe('Synced')
+    expect(
+      fluxConditionsToGitOpsStatus([c('Ready', 'True')], true, { generation: 2, observedGeneration: 1 }).sync,
+    ).toBe('Unknown')
+  })
+
+  it('treats a retrying Ready=False as progressing, not degraded', () => {
+    // Mirrors pkg/gitops/fluxstatus_test.go. Flux composes reasons like
+    // ProgressingWithRetry; a retry in flight is out of sync but not settled.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'False', { reason: 'ProgressingWithRetry' })],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('treats a settled Ready=False as degraded', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False', { reason: 'BuildFailed' })], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+})
+
+
+describe('reconciling activity', () => {
+  it('survives even when it no longer drives the status', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'True'), c('Reconciling', 'True', { lastTransitionTime: '2026-08-11T06:05:00Z' })],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.reconciling).toBe(true)
+    expect(got.reconcilingSince).toBe('2026-08-11T06:05:00Z')
+  })
+
+  it('is absent on a quiet object', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.reconciling).toBeUndefined()
+  })
+})
+
+// Source kinds carry no Healthy condition; HelmRelease uses Released.
+describe('non-Kustomization Flux kinds', () => {
+  it.each([
+    ['GitRepository', [c('Ready', 'True'), c('ArtifactInStorage', 'True')]],
+    ['HelmRepository', [c('Ready', 'True'), c('ArtifactInStorage', 'True')]],
+    ['HelmRelease', [c('Ready', 'True'), c('Released', 'True')]],
+  ])('%s reads as Synced/Healthy', (_kind, conds) => {
+    const got = fluxConditionsToGitOpsStatus(conds as FluxCondition[], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+  })
+})
+
+// The wedged-controller case end to end: a fully-applied object whose reconcile
+// pass never finished must read Synced (it IS applied) AND still carry the
+// in-flight fact, or a stuck controller becomes invisible. Before the sync fix
+// this state showed a permanent "Syncing", which was the wrong word but the
+// only thing in the product that noticed.
+describe('a wedged controller stays visible', () => {
+  it('reports Synced and keeps the in-flight fact with its start time', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [
+        c('Ready', 'True', { lastTransitionTime: '2026-08-11T06:00:00Z' }),
+        c('Healthy', 'True'),
+        c('Reconciling', 'True', { lastTransitionTime: '2026-08-11T06:05:00Z' }),
+      ],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+    // Both are required: without these the indicator has nothing to render and
+    // the operator gets a confident all-clear over a stuck controller.
+    expect(got.reconciling).toBe(true)
+    expect(got.reconcilingSince).toBe('2026-08-11T06:05:00Z')
+  })
+})

package/src/types/gitops.ts

@@ -63,6 +63,15 @@ export interface GitOpsStatus {
   message?: string
   lastSyncTime?: string
   suspended: boolean
+  /**
+   * A reconcile pass is executing right now. Activity, not sync and not health —
+   * it never influences either, because a controller being mid-pass says nothing
+   * about whether the declared state is applied. Renderers may show a subtle
+   * indicator; nothing that drives a status word.
+   */
+  reconciling?: boolean
+  /** When the in-flight pass started, so a wedged controller can be told from a routine one. */
+  reconcilingSince?: string
 }
 
 /**
@@ -97,50 +106,92 @@ export interface FluxCondition {
 // ============================================================================
 
 /**
- * Maps FluxCD conditions to unified GitOpsStatus
+ * Generation tracking for a Flux object. `observedGeneration` has three states,
+ * and the difference matters: absent means the controller never reports it and
+ * we have no signal, which must not be read as drift.
+ */
+export interface FluxGeneration {
+  generation?: number
+  observedGeneration?: number
+}
+
+/**
+ * True when the controller has demonstrably not yet acted on the current spec.
+ * Absent observedGeneration is no signal, not drift — some Flux kinds and older
+ * controllers never set it, and treating absence as drift would mark every
+ * healthy object on them as out of date. A present-but-different value counts,
+ * including the -1 sentinel Flux writes on an object it has never reconciled.
+ */
+function hasGenerationDrift(gen?: FluxGeneration): boolean {
+  if (!gen) return false
+  const { generation, observedGeneration } = gen
+  if (typeof generation !== 'number' || typeof observedGeneration !== 'number') return false
+  return generation !== observedGeneration
+}
+
+/**
+ * Maps FluxCD conditions to unified GitOpsStatus.
+ *
+ * Sync answers "is the declared state applied", which is `Ready` plus
+ * `observedGeneration`. `Reconciling` answers "is the controller mid-pass",
+ * which is neither — the two are independent conditions upstream, and letting
+ * activity outvote readiness reported a healthy object as not synced.
  *
- * FluxCD status patterns:
- * - Ready=True: Synced and healthy
- * - Ready=False + Stalled=True: Degraded
- * - Ready=False + Reconciling=True: Reconciling
- * - Ready=False (other): OutOfSync
- * - Healthy=False: Deployed but unhealthy resources
- * - spec.suspend=true: Suspended
+ * Order matters:
+ * - suspend                                   → Suspended (sync from Ready, unless drifted)
+ * - Stalled=True                              → OutOfSync / Degraded
+ * - Ready=True and no generation drift        → Synced, health from Healthy
+ * - drift, or Reconciling with Ready not True → Reconciling / Progressing
+ * - Ready=False                               → OutOfSync
  */
 export function fluxConditionsToGitOpsStatus(
   conditions: FluxCondition[],
-  suspended: boolean
+  suspended: boolean,
+  generation?: FluxGeneration
 ): GitOpsStatus {
   const readyCondition = conditions.find(c => c.type === 'Ready')
   const reconcilingCondition = conditions.find(c => c.type === 'Reconciling')
   const stalledCondition = conditions.find(c => c.type === 'Stalled')
   const healthyCondition = conditions.find(c => c.type === 'Healthy')
 
-  // Handle suspended state
+  const drifted = hasGenerationDrift(generation)
+  const isReconciling = reconcilingCondition?.status === 'True'
+  // Carried on every result so a wedged controller is visible next to an
+  // otherwise-correct Synced, without any status word claiming a fault.
+  const activity = isReconciling
+    ? { reconciling: true, reconcilingSince: reconcilingCondition?.lastTransitionTime }
+    : {}
+
+  // Handle suspended state. Suspending does not un-apply what was applied, so a
+  // suspended object that was Ready stays Synced — but a spec change made while
+  // suspended will never be picked up, so drift downgrades it to Unknown.
   if (suspended) {
     return {
-      sync: readyCondition?.status === 'True' ? 'Synced' : 'Unknown',
+      sync: readyCondition?.status === 'True' && !drifted ? 'Synced' : 'Unknown',
       health: 'Suspended',
       message: 'Reconciliation is suspended',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: true,
+      ...activity,
     }
   }
 
-  // Handle reconciling state
-  if (reconcilingCondition?.status === 'True') {
+  // Stalled is a terminal failure and outranks readiness: it means the
+  // controller has given up, whatever the last successful apply left behind.
+  if (stalledCondition?.status === 'True') {
     return {
-      sync: 'Reconciling',
-      health: 'Progressing',
-      message: reconcilingCondition.message || 'Reconciliation in progress',
+      sync: 'OutOfSync',
+      health: 'Degraded',
+      message: stalledCondition.message || 'Reconciliation stalled',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
-  // Handle ready state
-  if (readyCondition?.status === 'True') {
-    // Check if deployed resources are healthy
+  // The applied state. Ahead of the reconciling branch on purpose — this is the
+  // whole point of the ordering.
+  if (readyCondition?.status === 'True' && !drifted) {
     const isHealthy = healthyCondition?.status !== 'False'
     return {
       sync: 'Synced',
@@ -148,17 +199,20 @@ export function fluxConditionsToGitOpsStatus(
       message: isHealthy ? undefined : healthyCondition?.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
-  // Handle stalled state (permanent failure)
-  if (stalledCondition?.status === 'True') {
+  // Genuinely not applied: the controller has not observed the current spec, or
+  // it is working and has not reached Ready.
+  if (drifted || isReconciling) {
     return {
-      sync: 'OutOfSync',
-      health: 'Degraded',
-      message: stalledCondition.message || 'Reconciliation stalled',
+      sync: 'Reconciling',
+      health: 'Progressing',
+      message: reconcilingCondition?.message || 'Reconciliation in progress',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
@@ -173,6 +227,7 @@ export function fluxConditionsToGitOpsStatus(
       message: readyCondition.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
@@ -182,6 +237,7 @@ export function fluxConditionsToGitOpsStatus(
     health: 'Unknown',
     message: 'Status cannot be determined',
     suspended: false,
+    ...activity,
   }
 }
 

package/src/types/index.ts

@@ -5,3 +5,4 @@ export * from './gitops-tree'
 export * from './gitops-insights'
 export * from './rbac'
 export * from './capacity'
+export * from './policy'

package/src/types/policy.ts

@@ -0,0 +1,42 @@
+// Per-resource policy findings, from GET /api/policy/resource/{kind}/{ns}/{name}.
+//
+// The coverage fields are not decoration. An empty `findings` array means one of
+// several very different things — nothing violated, no engine installed, the
+// caller may not read the reports, the index is still warming — and a section
+// that renders all of them as blank space tells an operator they are compliant
+// in the cases where we simply do not know.
+
+export type PolicyResult = 'pass' | 'fail' | 'warn' | 'error' | 'skip' | string
+
+export interface PolicyResourceFinding {
+  policy: string
+  rule?: string
+  result: PolicyResult
+  severity?: string
+  category?: string
+  message?: string
+  engine?: string
+}
+
+export interface PolicyResourceCounts {
+  pass: number
+  fail: number
+  warn: number
+  error: number
+  skip: number
+}
+
+export interface PolicyResourceResponse {
+  /** False whenever the answer is "we could not check". Never treat an empty
+   *  findings array as "clean" without consulting this first. */
+  evaluated: boolean
+  status: string
+  reasonCode?: string
+  /** Report families the caller could not read. Present even when evaluated:
+   *  the answer is real but incomplete. */
+  deniedGroups?: string[]
+  /** False when the index is frozen at its initial contents. */
+  liveUpdates: boolean
+  counts: PolicyResourceCounts
+  findings: PolicyResourceFinding[]
+}