@skyhook-io/k8s-ui 1.11.0 → 1.13.0

package/src/components/resources/renderers/velero-dead-ends.test.tsx

@@ -0,0 +1,142 @@
+import { describe, expect, it, vi } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { VeleroBackupRenderer } from './VeleroBackupRenderer'
+import { VeleroRestoreRenderer } from './VeleroRestoreRenderer'
+
+/**
+ * Every screen has to end somewhere the reader can act.
+ *
+ * These two pages each name another object as the reason the reader should care
+ * — a storage location that is holding a backup hostage, and the backup a
+ * restore came from — and each rendered that name as plain text. The page said
+ * "go look at dr-replica" and gave no way to get there.
+ *
+ * The link has to disappear cleanly when the host does not wire navigation:
+ * library consumers render these renderers without it, and a button that goes
+ * nowhere is worse than text.
+ */
+
+const backup = (location: string) => ({
+  metadata: { name: 'nightly', namespace: 'velero' },
+  spec: { storageLocation: location },
+  status: { phase: 'Completed' },
+})
+
+const restore = {
+  metadata: { name: 'recovery', namespace: 'velero' },
+  spec: { backupName: 'nightly' },
+  status: { phase: 'Completed' },
+}
+
+describe('a backup that blames its storage location', () => {
+  it('lets the reader get to the location', () => {
+    const html = renderToString(
+      <VeleroBackupRenderer
+        data={backup('dr-replica')}
+        storageLocationPhase="Unavailable"
+        onNavigate={vi.fn()}
+      />,
+    )
+    // The name is a control, not a label.
+    expect(html).toMatch(/<button[^>]*>dr-replica<\/button>/)
+  })
+
+  it('renders the location as text when navigation is not wired', () => {
+    const html = renderToString(
+      <VeleroBackupRenderer data={backup('dr-replica')} storageLocationPhase="Unavailable" />,
+    )
+    expect(html).toContain('dr-replica')
+    expect(html).not.toMatch(/<button[^>]*>dr-replica<\/button>/)
+  })
+
+  // The link is the way to the location whether or not it is broken — a healthy
+  // one is still the thing you check when deciding where a backup lives.
+  it('links the location even when it is healthy', () => {
+    const html = renderToString(
+      <VeleroBackupRenderer data={backup('default')} storageLocationPhase="Available" onNavigate={vi.fn()} />,
+    )
+    expect(html).toMatch(/<button[^>]*>default<\/button>/)
+  })
+})
+
+describe('a restore that names its backup', () => {
+  it('lets the reader get to the backup it restored from', () => {
+    const html = renderToString(<VeleroRestoreRenderer data={restore} onNavigate={vi.fn()} />)
+    expect(html).toMatch(/<button[^>]*>nightly<\/button>/)
+  })
+
+  it('renders the backup as text when navigation is not wired', () => {
+    const html = renderToString(<VeleroRestoreRenderer data={restore} />)
+    expect(html).toContain('nightly')
+    expect(html).not.toMatch(/<button[^>]*>nightly<\/button>/)
+  })
+})
+
+/**
+ * The stalled-run issue says a run is "past the 1m Velero allows for one
+ * operation". That budget is spec.itemOperationTimeout, and the Options section
+ * listed every sibling spec option except it — so the page quoted a number whose
+ * source it did not show, next to the place that source belongs.
+ */
+describe('the budget the stall message measures against', () => {
+  it('shows the timeout the message quotes', () => {
+    const html = renderToString(
+      <VeleroBackupRenderer
+        data={{
+          metadata: { name: 'stuck', namespace: 'velero' },
+          spec: { storageLocation: 'default', itemOperationTimeout: '1m0s' },
+          status: { phase: 'InProgress' },
+        }}
+      />,
+    )
+    expect(html).toContain('Item Operation Timeout')
+    expect(html).toContain('1m0s')
+  })
+
+  // Unset is the common case, and it is not "none" — a default applies. But the
+  // number is not ours to print: Velero's built-in four hours can be overridden
+  // on the controller, so a page that renders "4h" would be stating an install
+  // setting it cannot read.
+  it('does not invent a number when the field is unset', () => {
+    const html = renderToString(
+      <VeleroBackupRenderer
+        data={{
+          metadata: { name: 'plain', namespace: 'velero' },
+          spec: { storageLocation: 'default' },
+          status: { phase: 'InProgress' },
+        }}
+      />,
+    )
+    // 'default' is this file's own word for "unset, and something else decides".
+    expect(html).toContain('default')
+    expect(html).not.toContain('4h0m0s')
+  })
+})
+
+/**
+ * Claims the phase does not support.
+ *
+ * The warning banner fired on any run with warnings that was not failed or
+ * partially failed — which includes runs still in flight — and said the run
+ * "completed". A count taken mid-run is not a final count, and saying otherwise
+ * is the same defect as calling a Completed backup restorable.
+ */
+describe('a run that has warnings but has not finished', () => {
+  const withWarnings = (phase: string) => ({
+    metadata: { name: 'w', namespace: 'velero' },
+    spec: { storageLocation: 'default' },
+    status: { phase, warnings: 2 },
+  })
+
+  it('does not say a run in flight completed', () => {
+    const html = renderToString(<VeleroBackupRenderer data={withWarnings('InProgress')} />)
+    expect(html).not.toMatch(/completed, with/)
+    expect(html).toContain('not a final count')
+  })
+
+  it('still says completed when it did', () => {
+    const html = renderToString(<VeleroBackupRenderer data={withWarnings('Completed')} />)
+    expect(html).toContain('completed, with 2 warning(s)')
+    expect(html).not.toContain('not a final count')
+  })
+})

package/src/components/resources/resource-utils-calico.test.ts

@@ -0,0 +1,215 @@
+import { describe, expect, it } from 'vitest'
+import {
+  CALICO_SELECTOR_NOT_APPLICABLE,
+  getCalicoApiGroup,
+  getCalicoIPPoolAllowedUses,
+  getCalicoIPPoolBlockSize,
+  getCalicoIPPoolEncapsulation,
+  getCalicoPolicyKindLabel,
+  getCalicoPolicySelector,
+  getCalicoPolicyTypes,
+  getCalicoTierRef,
+  isCalicoApiVersion,
+  isCalicoPolicyResource,
+  isCalicoStagedDeletion,
+  isCalicoStagedKubernetesNetworkPolicyKind,
+  isCoreNetworkPolicyKind,
+} from './resource-utils-calico'
+
+describe('Calico API group matching', () => {
+  it('extracts only supported Calico API groups', () => {
+    expect(getCalicoApiGroup('projectcalico.org/v3')).toBe('projectcalico.org')
+    expect(getCalicoApiGroup('crd.projectcalico.org/v1')).toBe(
+      'crd.projectcalico.org',
+    )
+    expect(getCalicoApiGroup('extension.projectcalico.org/v1')).toBeUndefined()
+  })
+
+  it('builds a cluster-scoped Tier reference with the policy API group', () => {
+    expect(
+      getCalicoTierRef({
+        apiVersion: 'crd.projectcalico.org/v1',
+        spec: { tier: 'security' },
+      }),
+    ).toEqual({
+      kind: 'Tier',
+      namespace: '',
+      name: 'security',
+      group: 'crd.projectcalico.org',
+    })
+  })
+
+  it.each(['projectcalico.org/v3', 'crd.projectcalico.org/v1'])(
+    'accepts the exact Calico group: %s',
+    (apiVersion) => {
+      expect(isCalicoApiVersion(apiVersion)).toBe(true)
+      expect(
+        isCalicoPolicyResource({ apiVersion, kind: 'NetworkPolicy' }),
+      ).toBe(true)
+    },
+  )
+
+  it.each(['projectcalico.org/v3', 'crd.projectcalico.org/v1'])(
+    'recognizes staged Kubernetes network policies in %s',
+    (apiVersion) => {
+      const policy = {
+        apiVersion,
+        kind: 'StagedKubernetesNetworkPolicy',
+        spec: {
+          podSelector: { matchLabels: { app: 'frontend' } },
+          policyTypes: ['Ingress'],
+        },
+      }
+      expect(isCalicoStagedKubernetesNetworkPolicyKind(policy.kind)).toBe(true)
+      expect(isCalicoPolicyResource(policy)).toBe(true)
+      expect(getCalicoPolicySelector(policy)).toBe('app=frontend')
+      expect(getCalicoPolicyKindLabel(policy.kind)).toBe(
+        'CalicoStagedKubernetesNetworkPolicy',
+      )
+    },
+  )
+
+  it.each([
+    'extension.projectcalico.org/v1',
+    'projectcalico.org.evil/v1',
+    'networking.example.io/v1',
+    'v1',
+  ])('rejects a non-Calico group: %s', (apiVersion) => {
+    expect(isCalicoApiVersion(apiVersion)).toBe(false)
+    expect(isCalicoPolicyResource({ apiVersion, kind: 'NetworkPolicy' })).toBe(
+      false,
+    )
+  })
+
+  it('recognizes only the core networking.k8s.io policy', () => {
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', 'networking.k8s.io/v1'),
+    ).toBe(true)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', 'projectcalico.org/v3'),
+    ).toBe(false)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', 'other.example.io/v1'),
+    ).toBe(false)
+    expect(isCoreNetworkPolicyKind('NetworkPolicy', undefined)).toBe(true)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', undefined, 'networking.k8s.io'),
+    ).toBe(true)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', undefined, 'other.example.io'),
+    ).toBe(false)
+  })
+
+  it('does not let the exact core fallback classify foreign kinds', () => {
+    expect(
+      isCoreNetworkPolicyKind('GlobalNetworkPolicy', 'networking.k8s.io/v1'),
+    ).toBe(false)
+    expect(isCoreNetworkPolicyKind('Widget', undefined)).toBe(false)
+  })
+})
+
+describe('staged deletions', () => {
+  const deletion = {
+    apiVersion: 'projectcalico.org/v3',
+    kind: 'StagedNetworkPolicy',
+    metadata: { name: 'retire-frontend', namespace: 'demo' },
+    // The Calico API rejects any other spec field alongside a Delete action.
+    spec: { stagedAction: 'Delete', tier: 'default' },
+  }
+
+  it('does not read an absent selector as every workload', () => {
+    expect(isCalicoStagedDeletion(deletion)).toBe(true)
+    expect(getCalicoPolicySelector(deletion)).toBe(
+      CALICO_SELECTOR_NOT_APPLICABLE,
+    )
+  })
+
+  it('leaves a staged Set reading its real selector', () => {
+    const set = {
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'StagedNetworkPolicy',
+      metadata: { name: 'tighten', namespace: 'demo' },
+      spec: { stagedAction: 'Set', selector: "app == 'web'" },
+    }
+    expect(isCalicoStagedDeletion(set)).toBe(false)
+    expect(getCalicoPolicySelector(set)).toBe("app == 'web'")
+  })
+
+  it('still reads an enforced policy with no selector as every workload', () => {
+    const enforced = {
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'NetworkPolicy',
+      metadata: { name: 'catch-all', namespace: 'demo' },
+      spec: {},
+    }
+    expect(getCalicoPolicySelector(enforced)).toBe('all workloads')
+  })
+})
+
+describe('IPPool derivations', () => {
+  it("applies Calico's block size default per address family", () => {
+    expect(getCalicoIPPoolBlockSize({ spec: { cidr: '192.168.0.0/16' } })).toBe(
+      26,
+    )
+    expect(getCalicoIPPoolBlockSize({ spec: { cidr: 'fd00::/48' } })).toBe(122)
+    expect(
+      getCalicoIPPoolBlockSize({ spec: { cidr: '10.0.0.0/8', blockSize: 24 } }),
+    ).toBe(24)
+    expect(getCalicoIPPoolBlockSize({ spec: {} })).toBeUndefined()
+  })
+
+  it('names the tunnel a pool encapsulates through', () => {
+    expect(getCalicoIPPoolEncapsulation({ spec: {} })).toBe('None')
+    expect(getCalicoIPPoolEncapsulation({ spec: { ipipMode: 'Always' } })).toBe(
+      'IPIP Always',
+    )
+    expect(
+      getCalicoIPPoolEncapsulation({ spec: { vxlanMode: 'CrossSubnet' } }),
+    ).toBe('VXLAN CrossSubnet')
+  })
+
+  it("falls back to Calico's default allowed uses", () => {
+    expect(getCalicoIPPoolAllowedUses({ spec: {} })).toBe('Workload, Tunnel')
+    expect(
+      getCalicoIPPoolAllowedUses({ spec: { allowedUses: ['Tunnel'] } }),
+    ).toBe('Tunnel')
+  })
+})
+
+describe('derived policy types', () => {
+  // Verified against Calico v3.32.1: applying these without spec.types and
+  // reading them back yields exactly these values.
+  const policy = (spec: any) => ({
+    apiVersion: 'projectcalico.org/v3',
+    kind: 'NetworkPolicy',
+    spec: { selector: "app == 'x'", ...spec },
+  })
+
+  it('derives the types from which rule lists exist', () => {
+    expect(getCalicoPolicyTypes(policy({ egress: [{ action: 'Allow' }] }))).toEqual(['Egress'])
+    expect(getCalicoPolicyTypes(policy({ ingress: [{ action: 'Allow' }] }))).toEqual(['Ingress'])
+    expect(
+      getCalicoPolicyTypes(policy({ ingress: [{ action: 'Allow' }], egress: [{ action: 'Allow' }] })),
+    ).toEqual(['Ingress', 'Egress'])
+    expect(getCalicoPolicyTypes(policy({}))).toEqual(['Ingress'])
+  })
+
+  it('follows the Kubernetes rule for the Kubernetes-shaped staged kind', () => {
+    // Kubernetes: every policy affects ingress, egress only when an egress
+    // section exists. Calico leaves policyTypes empty on this kind, so the
+    // derivation below is what the UI renders.
+    const staged = (spec: any) => ({
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'StagedKubernetesNetworkPolicy',
+      spec: { podSelector: { matchLabels: { app: 'x' } }, stagedAction: 'Set', ...spec },
+    })
+    expect(getCalicoPolicyTypes(staged({ egress: [{ to: [] }] }))).toEqual(['Ingress', 'Egress'])
+    expect(getCalicoPolicyTypes(staged({ ingress: [{ from: [] }] }))).toEqual(['Ingress'])
+    expect(getCalicoPolicyTypes(staged({}))).toEqual(['Ingress'])
+  })
+
+  it('prefers what the policy actually declares', () => {
+    expect(getCalicoPolicyTypes(policy({ types: ['Egress'], ingress: [{ action: 'Allow' }] }))).toEqual(['Egress'])
+    expect(getCalicoPolicyTypes({ spec: undefined })).toEqual([])
+  })
+})

package/src/components/resources/resource-utils-calico.ts

@@ -0,0 +1,261 @@
+import type { ResourceRef } from '../../types'
+import { isApiGroup } from './resource-utils-cnpg'
+
+export const CALICO_GROUPS = [
+  'projectcalico.org',
+  'crd.projectcalico.org',
+] as const
+
+export type CalicoApiGroup = (typeof CALICO_GROUPS)[number]
+
+const CALICO_POLICY_KINDS = new Set([
+  'networkpolicy',
+  'networkpolicies',
+  'globalnetworkpolicy',
+  'globalnetworkpolicies',
+  'stagednetworkpolicy',
+  'stagednetworkpolicies',
+  'stagedglobalnetworkpolicy',
+  'stagedglobalnetworkpolicies',
+  'stagedkubernetesnetworkpolicy',
+  'stagedkubernetesnetworkpolicies',
+])
+
+const CALICO_POLICY_LABELS: Record<string, string> = {
+  networkpolicy: 'CalicoNetworkPolicy',
+  networkpolicies: 'CalicoNetworkPolicy',
+  globalnetworkpolicy: 'CalicoGlobalNetworkPolicy',
+  globalnetworkpolicies: 'CalicoGlobalNetworkPolicy',
+  stagednetworkpolicy: 'CalicoStagedNetworkPolicy',
+  stagednetworkpolicies: 'CalicoStagedNetworkPolicy',
+  stagedglobalnetworkpolicy: 'CalicoStagedGlobalNetworkPolicy',
+  stagedglobalnetworkpolicies: 'CalicoStagedGlobalNetworkPolicy',
+  stagedkubernetesnetworkpolicy: 'CalicoStagedKubernetesNetworkPolicy',
+  stagedkubernetesnetworkpolicies: 'CalicoStagedKubernetesNetworkPolicy',
+}
+
+function apiGroup(apiVersion: unknown): string {
+  if (typeof apiVersion !== 'string') return ''
+  const parts = apiVersion.split('/')
+  return parts.length === 2 ? parts[0] : ''
+}
+
+export function isCalicoApiGroup(group: unknown): group is CalicoApiGroup {
+  return (
+    typeof group === 'string' &&
+    (CALICO_GROUPS as readonly string[]).includes(group)
+  )
+}
+
+export function isCalicoApiVersion(apiVersion: unknown): boolean {
+  return isCalicoApiGroup(apiGroup(apiVersion))
+}
+
+export function getCalicoApiGroup(
+  apiVersion: unknown,
+): CalicoApiGroup | undefined {
+  const group = apiGroup(apiVersion)
+  return isCalicoApiGroup(group) ? group : undefined
+}
+
+export function getCalicoTierRef(policy: any): ResourceRef {
+  return {
+    kind: 'Tier',
+    namespace: '',
+    name: String(policy?.spec?.tier ?? 'default'),
+    group: getCalicoApiGroup(policy?.apiVersion),
+  }
+}
+
+export function isCalicoPolicyKind(kind: unknown): boolean {
+  return typeof kind === 'string' && CALICO_POLICY_KINDS.has(kind.toLowerCase())
+}
+
+export function isCalicoNetworkPolicyKind(kind: unknown): boolean {
+  return (
+    typeof kind === 'string' &&
+    ['networkpolicy', 'networkpolicies'].includes(kind.toLowerCase())
+  )
+}
+
+export function isCalicoStagedKubernetesNetworkPolicyKind(
+  kind: unknown,
+): boolean {
+  return (
+    typeof kind === 'string' &&
+    [
+      'stagedkubernetesnetworkpolicy',
+      'stagedkubernetesnetworkpolicies',
+    ].includes(kind.toLowerCase())
+  )
+}
+
+export function isCalicoPolicyResource(data: any): boolean {
+  return isCalicoApiVersion(data?.apiVersion) && isCalicoPolicyKind(data?.kind)
+}
+
+export function isCoreNetworkPolicyApiVersion(apiVersion: unknown): boolean {
+  return isApiGroup(apiVersion, 'networking.k8s.io')
+}
+
+export function isCoreNetworkPolicyResource(data: any): boolean {
+  return isCoreNetworkPolicyKind(data?.kind, data?.apiVersion)
+}
+
+export function isCoreNetworkPolicyKind(
+  kind: unknown,
+  apiVersion: unknown,
+  group?: string,
+): boolean {
+  if (!isCalicoNetworkPolicyKind(kind)) return false
+  if (apiVersion !== undefined && apiVersion !== null && apiVersion !== '') {
+    return isCoreNetworkPolicyApiVersion(apiVersion)
+  }
+  return group === undefined || group === '' || group === 'networking.k8s.io'
+}
+
+export function getCalicoPolicyKindLabel(kind: unknown): string {
+  if (typeof kind !== 'string') return 'CalicoNetworkPolicy'
+  return CALICO_POLICY_LABELS[kind.toLowerCase()] ?? 'CalicoNetworkPolicy'
+}
+
+export function getCalicoPolicyTypes(policy: any): string[] {
+  const raw = policy?.spec?.types ?? policy?.spec?.policyTypes
+  if (Array.isArray(raw) && raw.length > 0) return raw.map(String)
+  if (typeof raw === 'string' && raw !== '') return [raw]
+  if (policy?.spec === undefined) return []
+  const hasIngress = Array.isArray(policy.spec.ingress) && policy.spec.ingress.length > 0
+  const hasEgress = Array.isArray(policy.spec.egress) && policy.spec.egress.length > 0
+
+  // The two families default this field by different rules, and a
+  // StagedKubernetesNetworkPolicy carries the Kubernetes shape. Kubernetes
+  // treats every policy as affecting ingress and adds egress only when an
+  // egress section exists; Calico derives from which rule lists exist, so an
+  // egress-only Calico policy is egress ONLY. Calico stores its own derivation
+  // but leaves policyTypes empty on the Kubernetes-shaped kind, so this runs.
+  if (isCalicoStagedKubernetesNetworkPolicyKind(policy?.kind)) {
+    return hasEgress ? ['Ingress', 'Egress'] : ['Ingress']
+  }
+  if (hasEgress && !hasIngress) return ['Egress']
+  return hasEgress ? ['Ingress', 'Egress'] : ['Ingress']
+}
+
+export function getCalicoPolicyRuleCount(policy: any): {
+  ingress: number
+  egress: number
+} {
+  return {
+    ingress: Array.isArray(policy?.spec?.ingress)
+      ? policy.spec.ingress.length
+      : 0,
+    egress: Array.isArray(policy?.spec?.egress) ? policy.spec.egress.length : 0,
+  }
+}
+
+/** The staged action, lower-cased. Absent means Set, which is Calico's default. */
+export function getCalicoStagedAction(policy: any): string {
+  const action = policy?.spec?.stagedAction
+  return typeof action === 'string' ? action.toLowerCase() : ''
+}
+
+/**
+ * A staged policy that stages a removal rather than a change. Calico requires
+ * the rest of its spec to be empty, so it has no selector and no rules — an
+ * absent selector here means "not applicable", never "every workload".
+ */
+export function isCalicoStagedDeletion(policy: any): boolean {
+  return getCalicoStagedAction(policy) === 'delete'
+}
+
+/**
+ * A staged policy Calico skips entirely. It previews nothing, so presenting its
+ * rules as a preview of protection is the same overstatement as reading a
+ * deletion's absent selector as "every workload".
+ */
+export function isCalicoStagedIgnored(policy: any): boolean {
+  return getCalicoStagedAction(policy) === 'ignore'
+}
+
+export const CALICO_SELECTOR_NOT_APPLICABLE = '-'
+
+export function getCalicoPolicySelector(policy: any): string {
+  if (isCalicoStagedDeletion(policy)) return CALICO_SELECTOR_NOT_APPLICABLE
+  const kubernetesPolicy = isCalicoStagedKubernetesNetworkPolicyKind(
+    policy?.kind,
+  )
+  const selector = kubernetesPolicy
+    ? policy?.spec?.podSelector
+    : policy?.spec?.selector
+  if (kubernetesPolicy) return formatKubernetesLabelSelector(selector)
+  return selector === undefined || selector === null || selector === ''
+    ? 'all workloads'
+    : String(selector)
+}
+
+export function formatKubernetesLabelSelector(selector: any): string {
+  if (!selector || typeof selector !== 'object') return 'all workloads'
+  const parts: string[] = []
+  for (const [key, value] of Object.entries(selector.matchLabels ?? {})) {
+    parts.push(`${key}=${String(value)}`)
+  }
+  for (const expression of Array.isArray(selector.matchExpressions)
+    ? selector.matchExpressions
+    : []) {
+    if (!expression || typeof expression !== 'object') continue
+    const item = expression as {
+      key?: string
+      operator?: string
+      values?: unknown[]
+    }
+    const values = Array.isArray(item.values)
+      ? item.values.map(String).join(',')
+      : ''
+    parts.push(
+      values
+        ? `${item.key ?? '?'} ${item.operator ?? '?'} (${values})`
+        : `${item.key ?? '?'} ${item.operator ?? '?'}`,
+    )
+  }
+  return parts.length > 0 ? parts.join(', ') : 'all workloads'
+}
+
+export function getCalicoPolicyNamespaceSelector(policy: any): string {
+  const selector = policy?.spec?.namespaceSelector
+  return selector === undefined || selector === null || selector === ''
+    ? '-'
+    : String(selector)
+}
+
+export function getCalicoPolicyServiceAccountSelector(policy: any): string {
+  const selector = policy?.spec?.serviceAccountSelector
+  return selector === undefined || selector === null || selector === ''
+    ? '-'
+    : String(selector)
+}
+
+/**
+ * Calico's own defaults for an IPPool, applied when a field is absent. The pool
+ * behaves this way whether or not the field is written, so a reader that shows
+ * only what is set describes the pool inaccurately.
+ */
+export function getCalicoIPPoolBlockSize(pool: any): number | undefined {
+  if (pool?.spec?.blockSize !== undefined) return Number(pool.spec.blockSize)
+  const cidr = pool?.spec?.cidr
+  if (typeof cidr !== 'string') return undefined
+  return cidr.includes(':') ? 122 : 26
+}
+
+/** The tunnel a pool encapsulates through, or "None" when it routes directly. */
+export function getCalicoIPPoolEncapsulation(pool: any): string {
+  const ipip = String(pool?.spec?.ipipMode ?? 'Never')
+  const vxlan = String(pool?.spec?.vxlanMode ?? 'Never')
+  if (ipip !== 'Never') return `IPIP ${ipip}`
+  if (vxlan !== 'Never') return `VXLAN ${vxlan}`
+  return 'None'
+}
+
+export function getCalicoIPPoolAllowedUses(pool: any): string {
+  const uses = pool?.spec?.allowedUses
+  if (!Array.isArray(uses)) return 'Workload, Tunnel'
+  return uses.length > 0 ? uses.map(String).join(', ') : '-'
+}