@skyhook-io/k8s-ui 1.11.0 → 1.13.0

package/src/components/resources/resource-utils-cnpg.ts

@@ -252,12 +252,19 @@ export function getCNPGClusterPhase(resource: any): string {
   return resource.status?.phase || '-'
 }
 
+// A cluster pinned to an ImageCatalog carries no `spec.imageName` at all — the
+// operator resolves the image from the catalog and records it in `status.image`.
+// Reading spec alone leaves those clusters showing a dash where an image runs.
+function cnpgImage(resource: any): string {
+  return resource.spec?.imageName || resource.status?.image || ''
+}
+
 export function getCNPGClusterImage(resource: any): string {
-  return resource.spec?.imageName || '-'
+  return cnpgImage(resource) || '-'
 }
 
 export function getCNPGClusterImageTag(resource: any): string {
-  const image = resource.spec?.imageName || ''
+  const image = cnpgImage(resource)
   if (!image) return '-'
   const parts = image.split(':')
   if (parts.length > 1) return parts[parts.length - 1]
@@ -293,6 +300,12 @@ export function getCNPGClusterUpdateStrategy(resource: any): string {
 
 export const CNPG_BARMAN_PLUGIN_NAME = 'barman-cloud.cloudnative-pg.io'
 
+/** The API group ObjectStore is served under. `objectstores` is a generic
+ *  plural several operators ship, so every link to one has to be qualified —
+ *  an unqualified link resolves by plural alone and can land on a foreign CRD's
+ *  object of the same name. */
+export const CNPG_BARMAN_OBJECTSTORE_GROUP = 'barmancloud.cnpg.io'
+
 export interface CNPGBarmanPlugin {
   name: string
   /** ObjectStore CR (barmancloud.cnpg.io/v1) holding the real destination + recovery window. */
@@ -354,6 +367,180 @@ export function getCNPGClusterBackupConfig(resource: any): {
   }
 }
 
+// ============================================================================
+// DECLARATIVE OBJECTS — Database, Publication, Subscription
+// ============================================================================
+
+/**
+ * The three declarative kinds share one status shape: `applied` plus a
+ * `message`. The field has three meanings, not two — true, false, and absent —
+ * and absent is "the operator has not reconciled this yet", which is a
+ * different thing from failed. Collapsing them would report a freshly created
+ * object as broken.
+ */
+export function getCNPGDeclarativeStatus(resource: any): StatusBadge {
+  const applied = resource?.status?.applied
+  if (applied === true) return { text: 'Applied', color: healthColors.healthy, level: 'healthy' }
+  if (applied === false) return { text: 'Not Applied', color: healthColors.unhealthy, level: 'unhealthy' }
+  return { text: 'Pending', color: healthColors.unknown, level: 'unknown' }
+}
+
+/** The operator's own explanation for a failure. Never paraphrased. */
+export function getCNPGDeclarativeMessage(resource: any): string | undefined {
+  const m = resource?.status?.message
+  return typeof m === 'string' && m !== '' ? m : undefined
+}
+
+/**
+ * What happens in PostgreSQL when this CR is deleted.
+ *
+ * `delete` drops the real database, publication or subscription; `retain`
+ * leaves it. This is the difference between removing a manifest and losing
+ * data, so it is surfaced rather than left in the YAML. CNPG defaults to
+ * `retain` when unset.
+ */
+export function getCNPGReclaimPolicy(resource: any): { value: string; destructive: boolean } {
+  const spec = resource?.spec ?? {}
+  const raw =
+    spec.databaseReclaimPolicy ?? spec.publicationReclaimPolicy ?? spec.subscriptionReclaimPolicy ?? 'retain'
+  return { value: raw, destructive: String(raw).toLowerCase() === 'delete' }
+}
+
+/** The Cluster this object is declared against. */
+export function getCNPGDeclarativeCluster(resource: any): string | undefined {
+  const n = resource?.spec?.cluster?.name
+  return typeof n === 'string' && n !== '' ? n : undefined
+}
+
+export interface CNPGImageCatalogEntry {
+  major: number
+  image: string
+}
+
+/** Major-version pins, sorted so the list does not reshuffle between reads. */
+export function getCNPGImageCatalogEntries(resource: any): CNPGImageCatalogEntry[] {
+  const raw = resource?.spec?.images
+  if (!Array.isArray(raw)) return []
+  return raw
+    .filter((e: any) => typeof e?.image === 'string')
+    .map((e: any) => ({ major: Number(e.major), image: e.image as string }))
+    .sort((a, b) => a.major - b.major)
+}
+
+// ============================================================================
+// OBJECTSTORE (barmancloud.cnpg.io/v1) — the plugin-path backup destination
+// ============================================================================
+
+export const CNPG_BARMAN_GROUP = 'barmancloud.cnpg.io'
+
+/**
+ * The plugin that took (or will take) a Backup / ScheduledBackup, from
+ * `spec.pluginConfiguration`. Present only when `spec.method` is `plugin`; the
+ * in-tree path leaves it unset, so absence is meaningful rather than missing.
+ */
+export function getCNPGBackupPlugin(resource: any): { name: string; parameters?: Record<string, any> } | null {
+  if (resource?.spec?.method !== 'plugin') return null
+  const cfg = resource?.spec?.pluginConfiguration
+  if (!cfg?.name) return null
+  return { name: cfg.name, parameters: cfg.parameters }
+}
+
+/** True for a barman-cloud ObjectStore. The `objectstores` plural is generic
+ *  enough to belong to another operator, so kind alone is not enough. */
+export function isCNPGObjectStore(resource: any): boolean {
+  return typeof resource?.apiVersion === 'string' && resource.apiVersion.startsWith(`${CNPG_BARMAN_GROUP}/`)
+}
+
+/** Which cloud the credentials point at. Only the provider is reported — the
+ *  values are Secret references and never belong on screen. */
+export function getCNPGObjectStoreProvider(resource: any): string | undefined {
+  const c = resource?.spec?.configuration
+  if (!c) return undefined
+  if (c.s3Credentials) return 'S3'
+  if (c.azureCredentials) return 'Azure Blob Storage'
+  if (c.googleCredentials) return 'Google Cloud Storage'
+  return undefined
+}
+
+/**
+ * The Secret holding the destination's credentials, by name only.
+ *
+ * Named rather than read: the values never belong on screen, but "which Secret"
+ * is the first question when a backup fails on authentication, and a page that
+ * says only "S3" leaves nowhere to go.
+ */
+export function getCNPGObjectStoreCredentialSecret(resource: any): string | undefined {
+  const c = resource?.spec?.configuration
+  const ref =
+    c?.s3Credentials?.accessKeyId ??
+    c?.azureCredentials?.storageAccount ??
+    c?.azureCredentials?.connectionString ??
+    c?.googleCredentials?.applicationCredentials
+  return typeof ref?.name === 'string' && ref.name !== '' ? ref.name : undefined
+}
+
+export interface CNPGObjectStoreRecoveryWindow {
+  server: string
+  firstRecoverabilityPoint?: string
+  lastSuccessfulBackupTime?: string
+  lastFailedBackupTime?: string
+  /** A failure newer than the last success — the window has stopped advancing. */
+  failingSinceLastSuccess: boolean
+}
+
+/**
+ * The recovery window per PostgreSQL server, from
+ * `status.serverRecoveryWindow` — a map keyed by server name.
+ *
+ * This is the payload the Cluster page promises and cannot show: a
+ * plugin-backed Cluster publishes no recovery-point fields of its own, so this
+ * is the only place the restorable range exists.
+ */
+export function getCNPGObjectStoreRecoveryWindows(resource: any): CNPGObjectStoreRecoveryWindow[] {
+  const raw = resource?.status?.serverRecoveryWindow
+  if (!raw || typeof raw !== 'object') return []
+  return Object.entries(raw)
+    .map(([server, w]: [string, any]) => {
+      const lastSuccess = w?.lastSuccessfulBackupTime
+      const lastFailed = w?.lastFailedBackupTime
+      return {
+        server,
+        firstRecoverabilityPoint: w?.firstRecoverabilityPoint,
+        lastSuccessfulBackupTime: lastSuccess,
+        lastFailedBackupTime: lastFailed,
+        failingSinceLastSuccess:
+          !!lastFailed && (!lastSuccess || new Date(lastFailed) > new Date(lastSuccess)),
+      }
+    })
+    .sort((a, b) => a.server.localeCompare(b.server))
+}
+
+/**
+ * Health for the list badge.
+ *
+ * `unknown` rather than healthy when no server has reported: an ObjectStore
+ * with an empty status is configured but holds nothing restorable, and green
+ * there would assert a recovery point that does not exist.
+ */
+export function getCNPGObjectStoreStatus(resource: any): StatusBadge {
+  const windows = getCNPGObjectStoreRecoveryWindows(resource)
+  if (windows.length === 0) {
+    return { text: 'No backups yet', color: healthColors.unknown, level: 'unknown' }
+  }
+  if (windows.some((w) => w.failingSinceLastSuccess)) {
+    return { text: 'Backups Failing', color: healthColors.unhealthy, level: 'unhealthy' }
+  }
+  return { text: 'Recoverable', color: healthColors.healthy, level: 'healthy' }
+}
+
+export function getCNPGObjectStoreDestination(resource: any): string {
+  return resource?.spec?.configuration?.destinationPath || '-'
+}
+
+export function getCNPGObjectStoreRetention(resource: any): string | undefined {
+  return resource?.spec?.retentionPolicy
+}
+
 export function getCNPGClusterMonitoring(resource: any): {
   podMonitorEnabled: boolean
   customQueriesConfigMap?: string[]
@@ -576,6 +763,33 @@ export function getCNPGBackupTarget(resource: any): string {
 // CNPG SCHEDULED BACKUP UTILITIES
 // ============================================================================
 
+/**
+ * Reconcile latency between a backup coming due and the operator starting it.
+ * Not a backup policy — nothing here decides how often backups should run.
+ * Kept in step with the detector that raises the matching issue.
+ */
+const CNPG_SCHEDULED_BACKUP_GRACE_MS = 10 * 60 * 1000
+
+/**
+ * How far past its own next-run time this schedule is, or null when it is not
+ * meaningfully overdue.
+ *
+ * The expectation belongs to the operator: CNPG publishes `nextScheduleTime`
+ * and updates it whenever it runs a backup. A value still in the past therefore
+ * means no backup happened. Suspended schedules are excluded because the
+ * operator stops maintaining the field, so the stale value would read as missed
+ * on every deliberately paused schedule.
+ */
+export function getCNPGScheduledBackupOverdueMs(resource: any): number | null {
+  if (resource?.spec?.suspend === true) return null
+  const next = resource?.status?.nextScheduleTime
+  if (!next) return null
+  const dueAt = new Date(next).getTime()
+  if (Number.isNaN(dueAt)) return null
+  const overdue = Date.now() - dueAt
+  return overdue > CNPG_SCHEDULED_BACKUP_GRACE_MS ? overdue : null
+}
+
 export function getCNPGScheduledBackupStatus(resource: any): StatusBadge {
   const isSuspended = resource.spec?.suspend === true
 
@@ -583,6 +797,14 @@ export function getCNPGScheduledBackupStatus(resource: any): StatusBadge {
     return { text: 'Suspended', color: healthColors.neutral, level: 'neutral' }
   }
 
+  // The operator said when the next backup was due and it has not happened.
+  // Checked before lastScheduleTime: a schedule that ran once and then stopped
+  // has both, and reporting it healthy contradicted the next-run figure sitting
+  // on the same row.
+  if (getCNPGScheduledBackupOverdueMs(resource) !== null) {
+    return { text: 'Overdue', color: healthColors.degraded, level: 'degraded' }
+  }
+
   // If we have a last schedule time, it's active
   if (resource.status?.lastScheduleTime) {
     return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
@@ -615,10 +837,20 @@ export function getCNPGScheduledBackupLastSchedule(resource: any): string {
 export function getCNPGScheduledBackupNextSchedule(resource: any): string {
   const next = resource.status?.nextScheduleTime
   if (!next) return '-'
+  // A suspended schedule keeps whatever next-run time it had when it was
+  // paused, and the operator stops maintaining it. Counting down to it, or
+  // calling it due, would both describe a run that is not coming.
+  if (resource.spec?.suspend === true) return 'suspended'
   const nextDate = new Date(next)
   const now = new Date()
   const diffMs = nextDate.getTime() - now.getTime()
-  if (diffMs <= 0) return 'overdue'
+  // Past due, but inside the window where the operator has simply not picked it
+  // up yet. Calling that "overdue" while the badge still reads healthy is the
+  // contradiction this pair is meant to avoid.
+  if (diffMs <= 0) {
+    const overdue = getCNPGScheduledBackupOverdueMs(resource)
+    return overdue === null ? 'due now' : `overdue by ${formatDuration(overdue)}`
+  }
   return `in ${formatDuration(diffMs)}`
 }
 
@@ -666,6 +898,12 @@ export function getCNPGPoolerStatus(resource: any): StatusBadge {
     return { text: 'Degraded', color: healthColors.degraded, level: 'degraded' }
   }
 
+  // Faults outrank intent: a Pooler that is both paused and unscheduled has a
+  // problem worth fixing before the pause is worth mentioning.
+  if (isCNPGPoolerPaused(resource)) {
+    return { text: 'Paused', color: healthColors.degraded, level: 'degraded' }
+  }
+
   if (desired > 0 && scheduled >= desired) {
     return { text: 'Scheduled', color: healthColors.healthy, level: 'healthy' }
   }
@@ -673,6 +911,16 @@ export function getCNPGPoolerStatus(resource: any): StatusBadge {
   return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
 }
 
+/**
+ * PgBouncer holds client connections instead of serving them while paused, and
+ * every pod stays scheduled and Ready throughout - the one Pooler state that
+ * pod counts cannot express. CRD-defaulted to false, so only an explicit true
+ * pauses.
+ */
+export function isCNPGPoolerPaused(resource: any): boolean {
+  return resource.spec?.pgbouncer?.paused === true
+}
+
 /** Name of the Deployment CNPG generates for this Pooler — where real readiness lives. */
 export function getCNPGPoolerDeploymentName(resource: any): string {
   return resource.metadata?.name || ''
@@ -707,3 +955,76 @@ export function getCNPGPoolerAuthQuerySecret(resource: any): { name: string } |
   if (!secret?.name) return undefined
   return { name: secret.name }
 }
+
+/**
+ * Volume health for a CNPG cluster, read from the arrays the operator publishes
+ * on status. Radar previously showed only the REQUESTED size and storage class,
+ * which are spec-side intentions — a cluster whose volumes had failed rendered
+ * a cheerful "20Gi" with nothing to suggest otherwise.
+ *
+ * `unusablePVC` is the sharp one. Upstream defines it as a volume that cannot be
+ * used because a paired volume is missing, which is why a database instance can
+ * be permanently unable to start while every other field looks ordinary.
+ *
+ * Returns null when the operator has published nothing, so the section can stay
+ * silent rather than claim zero problems it never checked for.
+ */
+export interface CNPGVolumeHealth {
+  total?: number
+  healthy: string[]
+  unusable: string[]
+  dangling: string[]
+  resizing: string[]
+  initializing: string[]
+}
+
+export function getCNPGVolumeHealth(resource: any): CNPGVolumeHealth | null {
+  const s = resource?.status
+  if (!s) return null
+  const list = (v: any): string[] => (Array.isArray(v) ? v.filter((x: any) => typeof x === 'string') : [])
+  const health: CNPGVolumeHealth = {
+    total: typeof s.pvcCount === 'number' ? s.pvcCount : undefined,
+    healthy: list(s.healthyPVC),
+    unusable: list(s.unusablePVC),
+    dangling: list(s.danglingPVC),
+    resizing: list(s.resizingPVC),
+    initializing: list(s.initializingPVC),
+  }
+  const reportedAnything =
+    health.total !== undefined ||
+    health.healthy.length > 0 ||
+    health.unusable.length > 0 ||
+    health.dangling.length > 0 ||
+    health.resizing.length > 0 ||
+    health.initializing.length > 0
+  return reportedAnything ? health : null
+}
+
+/**
+ * Splits declarative objects by what the operator has actually said about them.
+ *
+ * Three buckets, not two. `applied: true` is live. `applied: false` is a failure
+ * the operator can explain. ABSENT is not yet reconciled — and folding that in
+ * with the failures tells the reader an object "exists in Kubernetes and not in
+ * PostgreSQL" during the seconds before anything has looked at it.
+ */
+export function splitCNPGDeclarativeByApplied<T>(objects: T[]): {
+  applied: T[]
+  notApplied: T[]
+  pending: T[]
+} {
+  const out = { applied: [] as T[], notApplied: [] as T[], pending: [] as T[] }
+  for (const o of objects) {
+    switch (getCNPGDeclarativeStatus(o).level) {
+      case 'healthy':
+        out.applied.push(o)
+        break
+      case 'unhealthy':
+        out.notApplied.push(o)
+        break
+      default:
+        out.pending.push(o)
+    }
+  }
+  return out
+}

package/src/components/resources/resource-utils-crossplane.test.ts

@@ -9,6 +9,7 @@ import {
   getProviderConfigStatus,
   getProviderConfigRef,
   getCrossplaneResourceRefs,
+  getBoundXRRef,
   getExternalName,
   getComposingXRRef,
   isCrossplanePaused,
@@ -512,6 +513,73 @@ describe('getCrossplaneResourceRefs', () => {
   })
 })
 
+describe('getBoundXRRef', () => {
+  it('returns the singular spec.resourceRef of a v1 claim', () => {
+    const claim = {
+      spec: {
+        compositionRef: { name: 'database' },
+        resourceRef: {
+          apiVersion: 'platform.example.org/v1alpha1',
+          kind: 'Database',
+          name: 'example-database-x7k2m',
+        },
+      },
+    } as const
+    const ref = getBoundXRRef(claim)
+    expect(ref?.kind).toBe('Database')
+    expect(ref?.name).toBe('example-database-x7k2m')
+    expect(ref?.apiVersion).toBe('platform.example.org/v1alpha1')
+  })
+
+  it('returns null when resourceRef is absent or malformed', () => {
+    expect(getBoundXRRef({ spec: {} } as const)).toBeNull()
+    expect(getBoundXRRef({ spec: { resourceRef: { name: 'no-kind' } } } as const)).toBeNull()
+    expect(getBoundXRRef({ spec: { resourceRef: { kind: 'X' } } } as const)).toBeNull()
+    expect(getBoundXRRef({} as const)).toBeNull()
+  })
+})
+
+describe('claim vs XR composed-refs split', () => {
+  // A v1 claim carries NO resourceRefs of its own — only a singular resourceRef
+  // to its bound XR. The composed refs live on that XR. The claim panel must
+  // follow the ref rather than read the claim, or it shows "No composed
+  // resources" for a claim that has composed plenty.
+  const claim = {
+    spec: {
+      compositionRef: { name: 'database' },
+      resourceRef: {
+        apiVersion: 'platform.example.org/v1alpha1',
+        kind: 'Database',
+        name: 'example-database-x7k2m',
+      },
+    },
+  } as const
+  const boundXR = {
+    spec: {
+      resourceRefs: [
+        { apiVersion: 'database.example.org/v1beta1', kind: 'Instance', name: 'example-database-x7k2m' },
+        { apiVersion: 'identity.example.org/v1beta1', kind: 'Role', name: 'example-database-access' },
+        { apiVersion: 'kubernetes.crossplane.io/v1alpha2', kind: 'Object', name: 'example-database-connection' },
+      ],
+    },
+  } as const
+
+  it('reads nothing off the claim itself', () => {
+    expect(getCrossplaneResourceRefs(claim)).toEqual([])
+  })
+
+  it('is detected as a claim with a bound XR', () => {
+    expect(isClaim(claim)).toBe(true)
+    expect(getBoundXRRef(claim)?.name).toBe('example-database-x7k2m')
+  })
+
+  it('reads the composed refs off the bound XR', () => {
+    const refs = getCrossplaneResourceRefs(boundXR)
+    expect(refs).toHaveLength(3)
+    expect(refs.map(r => r.kind)).toEqual(['Instance', 'Role', 'Object'])
+  })
+})
+
 describe('getExternalName', () => {
   it('reads the crossplane.io/external-name annotation', () => {
     const resource = {

package/src/components/resources/resource-utils-kyverno-modern.ts

@@ -143,6 +143,30 @@ export function getKyvernoFailurePolicy(resource: any): string {
   return resource?.spec?.failurePolicy || ''
 }
 
+/**
+ * `spec.failurePolicy` with the CRD's own default applied.
+ *
+ * An ABSENT failurePolicy means Fail — "Allowed values are Ignore or Fail.
+ * Defaults to Fail", per the published schema, and most policies never set it.
+ * Reading absent as anything else inverts the consequence of an engine error:
+ * the screen would say those admissions are "allowed through unchecked" when the
+ * cluster is in fact rejecting them. Same defaulting trap as validationActions
+ * above, in the other direction.
+ *
+ * Kept separate from the raw reader so the Evaluation section can still show
+ * only what the policy actually declares.
+ */
+export function getKyvernoEffectiveFailurePolicy(resource: any): string {
+  return (
+    resource?.spec?.failurePolicy ||
+    // Where the legacy family keeps it since 1.13. Reading only the modern
+    // location would default a policy that explicitly set Ignore to Fail, and
+    // announce a rejection the cluster is not making.
+    resource?.spec?.webhookConfiguration?.failurePolicy ||
+    'Fail'
+  )
+}
+
 /**
  * Computes what the policy actually does, rather than echoing a single field.
  *

package/src/components/resources/resource-utils-kyverno-queue.test.ts

@@ -0,0 +1,164 @@
+import { describe, it, expect } from 'vitest'
+import {
+  getKyvernoRequestType,
+  getKyvernoRequestTriggers,
+  getKyvernoRequestGenerated,
+  getKyvernoRequestState,
+  getKyvernoReportSubject,
+  getKyvernoReportSummary,
+  getKyvernoReportResults,
+  getKyvernoReportStatus,
+  kyvernoReportTimestamp,
+} from './resource-utils-kyverno-queue'
+
+/**
+ * The fixtures below are trimmed copies of objects captured with a watch on a
+ * live Kyverno 1.18.2 while a generateExisting rule and a mutate-existing rule
+ * ran: 251 UpdateRequests and 3322 EphemeralReports. Every assertion here
+ * exists because the obvious reading of the CRD produces a blank screen.
+ */
+
+const GENERATE_REQUEST = {
+  metadata: { name: 'ur-j8qjv', namespace: 'kyverno', labels: { 'generate.kyverno.io/policy-name': 'probe-generate-existing' } },
+  spec: {
+    policy: 'probe-generate-existing',
+    requestType: 'generate',
+    deleteDownstream: false,
+    // Both empty on every generate request observed.
+    resource: {},
+    rule: '',
+    ruleContext: [
+      { rule: 'companion-for-existing', deleteDownstream: false, trigger: { apiVersion: 'v1', kind: 'ConfigMap', name: 'bulk-001', namespace: 'policy-demo', uid: 'a' } },
+      { rule: 'companion-for-existing', deleteDownstream: false, trigger: { apiVersion: 'v1', kind: 'ConfigMap', name: 'bulk-002', namespace: 'policy-demo', uid: 'b' } },
+    ],
+  },
+  status: {
+    state: 'Completed',
+    generatedResources: [{ apiVersion: 'networking.k8s.io/v1', kind: 'NetworkPolicy', name: 'bulk-250-probe', namespace: 'policy-demo' }],
+  },
+}
+
+const MUTATE_REQUEST = {
+  metadata: { name: 'ur-2mhmq', namespace: 'kyverno' },
+  spec: {
+    policy: 'probe-mutate-existing',
+    requestType: 'mutate',
+    rule: 'label-existing-configmaps',
+    deleteDownstream: false,
+    resource: { apiVersion: 'v1', kind: 'ConfigMap', name: 'bulk-001', namespace: 'policy-demo', uid: 'a' },
+  },
+  status: { state: 'Completed' },
+}
+
+describe('UpdateRequest', () => {
+  it('reads triggers off ruleContext for a generate request', () => {
+    // spec.resource is {} here — reading it alone renders an empty page.
+    const t = getKyvernoRequestTriggers(GENERATE_REQUEST)
+    expect(t).toHaveLength(2)
+    expect(t[0].name).toBe('bulk-001')
+    expect(t[0].kind).toBe('ConfigMap')
+    expect(t[0].rule).toBe('companion-for-existing')
+  })
+
+  it('reads the single trigger off spec.resource for a mutate request', () => {
+    const t = getKyvernoRequestTriggers(MUTATE_REQUEST)
+    expect(t).toHaveLength(1)
+    expect(t[0].name).toBe('bulk-001')
+  })
+
+  it('reports no triggers rather than a blank row when neither is present', () => {
+    expect(getKyvernoRequestTriggers({ spec: { requestType: 'generate', resource: {}, ruleContext: [] } })).toEqual([])
+  })
+
+  it('distinguishes the two request types', () => {
+    expect(getKyvernoRequestType(GENERATE_REQUEST)).toBe('generate')
+    expect(getKyvernoRequestType(MUTATE_REQUEST)).toBe('mutate')
+    expect(getKyvernoRequestType({ spec: {} })).toBe('unknown')
+  })
+
+  it('lists what was created, and only on the request that creates', () => {
+    expect(getKyvernoRequestGenerated(GENERATE_REQUEST)).toHaveLength(1)
+    expect(getKyvernoRequestGenerated(MUTATE_REQUEST)).toEqual([])
+  })
+
+  // Pending is the state worth surfacing: work queued and never done.
+  it('separates queued from done from failed', () => {
+    expect(getKyvernoRequestState({ status: { state: 'Pending' } }).level).toBe('degraded')
+    expect(getKyvernoRequestState({ status: { state: 'Completed' } }).level).toBe('healthy')
+    expect(getKyvernoRequestState({ status: { state: 'Failed' } }).level).toBe('unhealthy')
+    expect(getKyvernoRequestState({}).level).toBe('unknown')
+  })
+})
+
+const REPORT = {
+  metadata: {
+    name: 'eae46cfc-2733-466c-b20a-f1a354b6f73b-7b47h',
+    namespace: 'kube-system',
+    labels: {
+      'audit.kyverno.io/resource.kind': 'Pod',
+      'audit.kyverno.io/resource.group': '',
+      'audit.kyverno.io/resource.version': 'v1',
+      'audit.kyverno.io/resource.uid': 'eae46cfc-2733-466c-b20a-f1a354b6f73b',
+      'audit.kyverno.io/source': 'background-scan',
+    },
+    ownerReferences: [{ apiVersion: 'v1', kind: 'Pod', name: 'coredns-7d764666f9-dl4p6', uid: 'eae46cfc' }],
+  },
+  spec: {
+    // Present and blank on every report observed.
+    owner: { apiVersion: '', kind: '', name: '', uid: '' },
+    summary: { error: 0, fail: 1, pass: 2, skip: 0, warn: 0 },
+    results: [
+      { message: 'mutation is not applied', policy: 'add-default-labels', result: 'fail', source: 'KyvernoMutatingPolicy', timestamp: { seconds: 1786622539, nanos: 0 } },
+    ],
+  },
+}
+
+describe('EphemeralReport', () => {
+  // spec.owner is the documented field and is useless; the owner reference is
+  // where the subject actually is.
+  it('takes the subject from the owner reference when spec.owner is blank', () => {
+    const s = getKyvernoReportSubject(REPORT)
+    expect(s?.kind).toBe('Pod')
+    expect(s?.name).toBe('coredns-7d764666f9-dl4p6')
+    expect(s?.namespace).toBe('kube-system')
+  })
+
+  it('falls back to the labels when the subject is already gone', () => {
+    const { ownerReferences, ...meta } = REPORT.metadata as any
+    const s = getKyvernoReportSubject({ ...REPORT, metadata: meta })
+    expect(s?.kind).toBe('Pod')
+    expect(s?.name).toBeUndefined()
+    expect(s?.apiVersion).toBe('v1')
+  })
+
+  it('prefers spec.owner when a future version starts filling it in', () => {
+    const s = getKyvernoReportSubject({
+      ...REPORT,
+      spec: { ...REPORT.spec, owner: { apiVersion: 'apps/v1', kind: 'Deployment', name: 'web', uid: 'x' } },
+    })
+    expect(s?.kind).toBe('Deployment')
+  })
+
+  // The findings live in spec, not status, which is the reverse of every other
+  // report-shaped object here.
+  it('reads results and summary out of spec', () => {
+    expect(getKyvernoReportResults(REPORT)).toHaveLength(1)
+    expect(getKyvernoReportResults({ status: { results: [{}] } })).toEqual([])
+    const s = getKyvernoReportSummary(REPORT)
+    expect(s).toMatchObject({ fail: 1, pass: 2, total: 3 })
+  })
+
+  it('reports the worst outcome for the list badge', () => {
+    expect(getKyvernoReportStatus(REPORT).level).toBe('unhealthy')
+    expect(getKyvernoReportStatus({ spec: { summary: { pass: 4 } } }).text).toBe('4 pass')
+    expect(getKyvernoReportStatus({ spec: {} }).text).toBe('No results')
+  })
+
+  // `new Date({seconds, nanos})` is Invalid Date, not an error.
+  it('converts the seconds/nanos timestamp rather than passing it to Date', () => {
+    expect(kyvernoReportTimestamp({ seconds: 1786622539, nanos: 0 })).toBe('2026-08-13T12:02:19.000Z')
+    expect(kyvernoReportTimestamp({ seconds: 0 })).toBeUndefined()
+    expect(kyvernoReportTimestamp(undefined)).toBeUndefined()
+    expect(kyvernoReportTimestamp('2026-08-13T09:22:19Z')).toBe('2026-08-13T09:22:19Z')
+  })
+})