@skyhook-io/k8s-ui 1.11.0 → 1.13.0

package/src/components/resources/resource-utils-kyverno-queue.ts

@@ -0,0 +1,198 @@
+import { healthColors } from './resource-utils'
+import type { StatusBadge } from './resource-utils'
+
+/**
+ * UpdateRequest and EphemeralReport — Kyverno's two working records.
+ *
+ * Both are shaped differently from every other Kyverno object, and in ways the
+ * CRD schema does not warn about. Everything here was read off live objects
+ * captured with a watch on Kyverno 1.18.2 while the rules that produce them
+ * ran, rather than derived from the schema:
+ *
+ *   - A generate UpdateRequest leaves `spec.resource` EMPTY and `spec.rule` an
+ *     empty string. Its triggers live in `spec.ruleContext[].trigger`, and one
+ *     request can carry hundreds of them. A mutate UpdateRequest is the
+ *     opposite: `spec.resource` and `spec.rule` are populated and there is no
+ *     ruleContext at all.
+ *   - An EphemeralReport carries its findings in `spec`, not `status`, and its
+ *     `spec.owner` is present but blank — the subject is only in
+ *     `metadata.ownerReferences` and in the `audit.kyverno.io/resource.*`
+ *     labels.
+ *   - Report timestamps are `{seconds, nanos}` objects, not RFC 3339 strings.
+ */
+
+export type KyvernoRequestType = 'generate' | 'mutate' | 'unknown'
+
+export interface KyvernoTrigger {
+  apiVersion?: string
+  kind?: string
+  name?: string
+  namespace?: string
+  uid?: string
+  /** Whether deleting this trigger also deletes what the rule made for it. */
+  deleteDownstream: boolean
+  rule?: string
+}
+
+export function getKyvernoRequestType(resource: any): KyvernoRequestType {
+  const t = resource?.spec?.requestType
+  return t === 'generate' || t === 'mutate' ? t : 'unknown'
+}
+
+/**
+ * Every resource this request acts on.
+ *
+ * Reading `spec.resource` alone — the obvious field, and the only one the CRD
+ * documents as "the resource" — returns nothing at all for a generate request.
+ */
+export function getKyvernoRequestTriggers(resource: any): KyvernoTrigger[] {
+  const ctx = resource?.spec?.ruleContext
+  if (Array.isArray(ctx) && ctx.length > 0) {
+    return ctx
+      .map((c: any) => ({
+        ...(c?.trigger ?? {}),
+        deleteDownstream: c?.deleteDownstream === true,
+        rule: c?.rule,
+      }))
+      .filter((t: KyvernoTrigger) => !!t.name)
+  }
+  const r = resource?.spec?.resource
+  if (r?.name) {
+    return [{ ...r, deleteDownstream: resource?.spec?.deleteDownstream === true, rule: resource?.spec?.rule }]
+  }
+  return []
+}
+
+/** Resources the request has created so far. Absent on mutate requests. */
+export function getKyvernoRequestGenerated(resource: any): Array<{
+  apiVersion?: string
+  kind?: string
+  name?: string
+  namespace?: string
+}> {
+  const g = resource?.status?.generatedResources
+  return Array.isArray(g) ? g.filter((r: any) => !!r?.name) : []
+}
+
+/**
+ * State of the request.
+ *
+ * `Pending` is the one that matters: a request stuck there is generation that
+ * has silently stopped, which is the reason to look at this object at all.
+ */
+export function getKyvernoRequestState(resource: any): StatusBadge {
+  const state = resource?.status?.state
+  switch (state) {
+    case 'Completed':
+      return { text: 'Completed', color: healthColors.healthy, level: 'healthy' }
+    case 'Failed':
+      return { text: 'Failed', color: healthColors.unhealthy, level: 'unhealthy' }
+    case 'Pending':
+      return { text: 'Pending', color: healthColors.degraded, level: 'degraded' }
+    case 'Skip':
+      return { text: 'Skipped', color: healthColors.neutral, level: 'neutral' }
+    default:
+      return { text: state || 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  }
+}
+
+export function getKyvernoRequestPolicy(resource: any): string | undefined {
+  return resource?.spec?.policy || undefined
+}
+
+export function getKyvernoRequestMessage(resource: any): string | undefined {
+  const m = resource?.status?.message
+  return typeof m === 'string' && m !== '' ? m : undefined
+}
+
+// ============================================================================
+// EphemeralReport
+// ============================================================================
+
+export interface KyvernoReportSubject {
+  apiVersion?: string
+  kind?: string
+  name?: string
+  namespace?: string
+  uid?: string
+}
+
+/**
+ * The resource an EphemeralReport is about.
+ *
+ * `spec.owner` exists on every one of these and is blank on every one observed,
+ * so the owner reference is the real source and the labels are the fallback for
+ * a report whose owner has already been deleted.
+ */
+export function getKyvernoReportSubject(resource: any): KyvernoReportSubject | undefined {
+  const owner = resource?.spec?.owner
+  if (owner?.name) return owner
+
+  const ref = (resource?.metadata?.ownerReferences ?? [])[0]
+  if (ref?.name) {
+    return {
+      apiVersion: ref.apiVersion,
+      kind: ref.kind,
+      name: ref.name,
+      namespace: resource?.metadata?.namespace,
+      uid: ref.uid,
+    }
+  }
+
+  const labels = resource?.metadata?.labels ?? {}
+  const kind = labels['audit.kyverno.io/resource.kind']
+  if (!kind) return undefined
+  const group = labels['audit.kyverno.io/resource.group']
+  const version = labels['audit.kyverno.io/resource.version']
+  return {
+    apiVersion: group ? `${group}/${version}` : version,
+    kind,
+    namespace: resource?.metadata?.namespace,
+    uid: labels['audit.kyverno.io/resource.uid'],
+  }
+}
+
+/** How the report was produced — background scan or admission. */
+export function getKyvernoReportSource(resource: any): string | undefined {
+  return resource?.metadata?.labels?.['audit.kyverno.io/source'] || undefined
+}
+
+export function getKyvernoReportSummary(resource: any): {
+  pass: number
+  fail: number
+  warn: number
+  error: number
+  skip: number
+  total: number
+} {
+  const s = resource?.spec?.summary ?? {}
+  const n = (v: unknown) => (typeof v === 'number' ? v : 0)
+  const out = { pass: n(s.pass), fail: n(s.fail), warn: n(s.warn), error: n(s.error), skip: n(s.skip) }
+  return { ...out, total: out.pass + out.fail + out.warn + out.error + out.skip }
+}
+
+export function getKyvernoReportResults(resource: any): any[] {
+  const r = resource?.spec?.results
+  return Array.isArray(r) ? r : []
+}
+
+/**
+ * Report timestamps are `{seconds, nanos}`, and `new Date(...)` on that object
+ * yields Invalid Date rather than failing loudly.
+ */
+export function kyvernoReportTimestamp(ts: any): string | undefined {
+  if (typeof ts === 'string') return ts || undefined
+  const seconds = ts?.seconds
+  if (typeof seconds !== 'number' || seconds <= 0) return undefined
+  return new Date(seconds * 1000).toISOString()
+}
+
+/** List badge: worst outcome in the report, matching the PolicyReport columns. */
+export function getKyvernoReportStatus(resource: any): StatusBadge {
+  const s = getKyvernoReportSummary(resource)
+  if (s.total === 0) return { text: 'No results', color: healthColors.neutral, level: 'neutral' }
+  if (s.error > 0) return { text: `${s.error} error`, color: healthColors.alert, level: 'alert' }
+  if (s.fail > 0) return { text: `${s.fail} fail`, color: healthColors.unhealthy, level: 'unhealthy' }
+  if (s.warn > 0) return { text: `${s.warn} warn`, color: healthColors.degraded, level: 'degraded' }
+  return { text: `${s.pass} pass`, color: healthColors.healthy, level: 'healthy' }
+}

package/src/components/resources/resource-utils-kyverno.ts

@@ -115,14 +115,47 @@ export function getKyvernoPolicyStatus(resource: any): StatusBadge {
   return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
 }
 
+/** The rule blocks whose failure an admission request can be rejected for. */
+function rejectingActions(rule: any): string[] {
+  if (!rule) return []
+  const actions: string[] = []
+  if (rule.validate) actions.push(rule.validate.failureAction)
+  if (Array.isArray(rule.verifyImages)) {
+    for (const v of rule.verifyImages) actions.push(v?.failureAction)
+  }
+  return actions.filter(Boolean)
+}
+
+/**
+ * Whether this policy can REJECT an admission request, as Audit or Enforce.
+ *
+ * Three things make the obvious reading wrong. A rule-level failureAction
+ * OVERRIDES `spec.validationFailureAction` rather than deferring to it, so
+ * consulting the spec field first answers Audit for a policy whose rule
+ * enforces. Image verification carries its own failureAction on
+ * `verifyImages[]` rather than under `validate`, so a signing policy blocks
+ * without either of the fields the name suggests. And the spec field is
+ * defaulted to Audit when absent, so its presence proves nothing.
+ *
+ * Only validate and verifyImages rules can reject at all, so only they inherit
+ * the spec-level action — a mutate or generate rule sitting in the same policy
+ * would otherwise carry Enforce into a policy where nothing enforces.
+ *
+ * Rules can disagree, and one value has to stand for the whole policy. The
+ * question worth answering is whether anything here can reject, so any Enforce
+ * wins; the Rules section is where a mixed policy is read rule by rule.
+ */
 export function getKyvernoPolicyAction(resource: any): string {
-  // Check spec-level validationFailureAction (deprecated but still widely used)
-  const action = resource.spec?.validationFailureAction
-  if (action) return action
-  // Fallback: check first rule's validate.failureAction
+  const specAction = resource.spec?.validationFailureAction
   const rules = resource.spec?.rules || []
-  for (const rule of rules) {
-    if (rule.validate?.failureAction) return rule.validate.failureAction
+  if (rules.length === 0) return specAction || 'Audit'
+  const rejecting = rules.filter((rule: any) => rule?.validate || rule?.verifyImages)
+  // Rules, but none that can reject: the spec-level action governs nothing here.
+  if (rejecting.length === 0) return 'Audit'
+  for (const rule of rejecting) {
+    const overrides = rejectingActions(rule)
+    const effective = overrides.length > 0 ? overrides : [specAction]
+    if (effective.includes('Enforce')) return 'Enforce'
   }
   return 'Audit'
 }
@@ -184,7 +217,10 @@ export function getKyvernoPolicyRuleCountByType(resource: any): {
       validate: statusCount.validate ?? 0,
       mutate: statusCount.mutate ?? 0,
       generate: statusCount.generate ?? 0,
-      verifyImages: statusCount.verifyImages ?? 0,
+      // Kyverno writes this key all-lowercase (`verifyimages`), verified on
+      // 1.18.2. Reading the camelCase spelling alone returns 0 for every
+      // image-verification policy in existence.
+      verifyImages: statusCount.verifyImages ?? statusCount.verifyimages ?? 0,
     }
   }
 

package/src/components/resources/resource-utils-velero.test.ts

@@ -9,6 +9,7 @@ import {
   isVeleroResource,
   getScheduleCronInfo,
   getBackupRepositoryStatus,
+  resolveBackupStorageLocation,
 } from './resource-utils-velero'
 
 const backup = (phase: string, extra: Record<string, unknown> = {}) => ({
@@ -235,3 +236,28 @@ describe('getScheduleCronInfo', () => {
     expect(getScheduleCronInfo({ spec: {} })).toEqual({ cron: '-', readable: '', malformed: false })
   })
 })
+
+describe('which location holds a backup', () => {
+  const locations = [
+    { metadata: { name: 'primary' }, spec: { default: true } },
+    { metadata: { name: 'dr-replica' }, spec: { default: false } },
+  ]
+
+  it('uses the location the backup names', () => {
+    expect(resolveBackupStorageLocation({ spec: { storageLocation: 'dr-replica' } }, locations)).toBe('dr-replica')
+  })
+
+  // The rule Velero actually applies: the flag, not the name.
+  it('resolves an unset location through spec.default', () => {
+    expect(resolveBackupStorageLocation({ spec: {} }, locations)).toBe('primary')
+  })
+
+  // Velero's own fallback when nothing claims the flag.
+  it('falls back to the conventional name when no location is marked default', () => {
+    expect(resolveBackupStorageLocation({ spec: {} }, [{ metadata: { name: 'only' }, spec: {} }])).toBe('default')
+  })
+
+  it('falls back when the list has not been read', () => {
+    expect(resolveBackupStorageLocation({ spec: {} }, undefined)).toBe('default')
+  })
+})

package/src/components/resources/resource-utils-velero.ts

@@ -131,10 +131,34 @@ export function getBackupQueuePosition(resource: any): number | null {
   return typeof pos === 'number' ? pos : null
 }
 
+// The name a Backup carries, applying Velero's fallback by name only. Callers
+// that hold the location list should prefer resolveBackupStorageLocation, which
+// applies Velero's actual rule.
 export function getBackupStorageLocation(resource: any): string {
   return resource.spec?.storageLocation || 'default'
 }
 
+// Velero resolves an unset spec.storageLocation to whichever location carries
+// spec.default — a flag, not a name. The literal name "default" is only the
+// fallback when nothing claims the flag, and an install that renamed its
+// default location has no such object at all: the health lookup finds nothing
+// and the link points at a name that does not exist.
+//
+// Mirrors the server-side resolution behind the stored-backups endpoint so the
+// two cannot disagree about which location holds a backup.
+export function getVeleroDefaultLocationName(locations: any[] | undefined): string {
+  for (const l of locations ?? []) {
+    if (l?.spec?.default === true && l?.metadata?.name) return l.metadata.name
+  }
+  return ''
+}
+
+export function resolveBackupStorageLocation(resource: any, locations: any[] | undefined): string {
+  const declared = resource?.spec?.storageLocation
+  if (declared) return declared
+  return getVeleroDefaultLocationName(locations) || 'default'
+}
+
 export function getBackupIncludedNamespaces(resource: any): string[] {
   return resource.spec?.includedNamespaces || []
 }
@@ -196,6 +220,22 @@ export function getBackupTTL(resource: any): string {
   return resource.spec?.ttl || '-'
 }
 
+/**
+ * How long this backup allows a single operation before it has outlived its own
+ * budget. Shown because the stalled-run issue measures against this field and
+ * quotes it — without it on the page, the message cites a number from a spec
+ * option the page lists every sibling of.
+ *
+ * Unset renders as "default", the same word getBackupSnapshotVolumes uses for
+ * the same situation — not as a number. Velero's built-in is four hours, but the
+ * controller takes `--default-item-operation-timeout` and distributions ship
+ * their own, so printing 4h here would state an install setting nothing on this
+ * page can read.
+ */
+export function getBackupItemOperationTimeout(resource: any): string {
+  return resource.spec?.itemOperationTimeout || 'default'
+}
+
 export function getBackupSnapshotVolumes(resource: any): string {
   const val = resource.spec?.snapshotVolumes
   if (val === undefined || val === null) return 'default'
@@ -483,3 +523,31 @@ export function getBackupRepositoryStatus(resource: any): StatusBadge {
 export function getBackupRepositoryType(resource: any): string {
   return resource.spec?.repositoryType || '-'
 }
+
+// The namespace whose volumes this repository holds. One repository per
+// (namespace, location, type) is how Velero partitions them, so this is what
+// the repository is *for* rather than where the object lives.
+export function getBackupRepositoryVolumeNamespace(resource: any): string {
+  return resource.spec?.volumeNamespace || '-'
+}
+
+export function getBackupRepositoryLocation(resource: any): string {
+  return resource.spec?.backupStorageLocation || '-'
+}
+
+export function getBackupRepositoryMaintenanceFrequency(resource: any): string {
+  return resource.spec?.maintenanceFrequency || '-'
+}
+
+export function getBackupRepositoryLastMaintenance(resource: any): string {
+  const at = resource.status?.lastMaintenanceTime
+  if (!at) return '-'
+  return formatAge(at)
+}
+
+// Why the repository is not ready, in the controller's own words. Velero writes
+// it on the object and nowhere else, so without it the phase is the whole story
+// a reader gets.
+export function getBackupRepositoryMessage(resource: any): string {
+  return resource.status?.message || ''
+}

package/src/components/resources/resource-utils.ts

@@ -16,6 +16,7 @@ import { getBackupStatus as _getBackupStatus, getRestoreStatus as _getRestoreSta
 import { getExternalSecretStatus as _getExternalSecretStatus, getClusterExternalSecretStatus as _getClusterExternalSecretStatus, getSecretStoreStatus as _getSecretStoreStatus, getClusterSecretStoreStatus as _getClusterSecretStoreStatus, getSecretStoreProviderType as _getSecretStoreProviderType } from './resource-utils-eso'
 import { getHPATableState, hpaStatusFromState } from './resource-utils-hpa'
 import { getCNPGClusterStatus as _getCNPGClusterStatus, getCNPGBackupStatus as _getCNPGBackupStatus, getCNPGScheduledBackupStatus as _getCNPGScheduledBackupStatus, getCNPGPoolerStatus as _getCNPGPoolerStatus, isApiGroup as _isApiGroup, CNPG_GROUP as _CNPG_GROUP } from './resource-utils-cnpg'
+import { getCalicoIPPoolAllowedUses, getCalicoIPPoolBlockSize, getCalicoIPPoolEncapsulation, getCalicoPolicyNamespaceSelector, getCalicoPolicyServiceAccountSelector, getCalicoPolicyTypes, isCalicoApiVersion, isCalicoPolicyResource } from './resource-utils-calico'
 
 // ============================================================================
 // STATUS & HEALTH UTILITIES
@@ -1492,6 +1493,42 @@ export function getRolloutStatus(rollout: any): StatusBadge {
   }
 }
 
+export function getAnalysisRunStatus(run: any): StatusBadge {
+  const phase = run.status?.phase || 'Unknown'
+  switch (phase) {
+    case 'Successful':
+      return { text: 'Successful', color: healthColors.healthy, level: 'healthy' }
+    case 'Running':
+    case 'Pending':
+      return { text: phase, color: healthColors.degraded, level: 'degraded' }
+    case 'Inconclusive':
+      return { text: 'Inconclusive', color: healthColors.alert, level: 'alert' }
+    case 'Failed':
+    case 'Error':
+      return { text: phase, color: healthColors.unhealthy, level: 'unhealthy' }
+    default:
+      return { text: phase, color: healthColors.unknown, level: 'unknown' }
+  }
+}
+
+// Counts only verdict-bearing metrics: Argo excludes dryRun results from the run's
+// phase, and Running/Pending have not passed yet.
+export function summarizeAnalysisMetrics(run: any): {
+  total: number
+  passing: number
+  notPassing: number
+  dryRun: number
+} {
+  const results: any[] = run?.status?.metricResults || []
+  const scored = results.filter((m) => !m.dryRun)
+  return {
+    total: scored.length,
+    passing: scored.filter((m) => m.phase === 'Successful').length,
+    notPassing: scored.filter((m) => ['Failed', 'Error', 'Inconclusive'].includes(m.phase)).length,
+    dryRun: results.length - scored.length,
+  }
+}
+
 export function getRolloutStrategy(rollout: any): string {
   if (rollout.spec?.strategy?.canary) return 'Canary'
   if (rollout.spec?.strategy?.blueGreen) return 'BlueGreen'
@@ -2114,6 +2151,7 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'persistentvolumeclaims') return getPVCStatus(resource).text
       if (kindLower === 'persistentvolumes') return getPVStatus(resource).text
       if (kindLower === 'rollouts') return getRolloutStatus(resource).text
+      if (kindLower === 'analysisruns') return getAnalysisRunStatus(resource).text
       if (kindLower === 'workflows') return getWorkflowStatus(resource).text
       if (kindLower === 'cronworkflows') return getCronWorkflowStatus(resource).text
       if (kindLower === 'hpas' || kindLower === 'horizontalpodautoscalers') return getHPAStatus(resource).text
@@ -2200,7 +2238,67 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       return getServiceAccountAutomount(resource)
     case 'policyTypes':
       return getNetworkPolicyTypes(resource)
+    case 'types':
+      if (isCalicoPolicyResource(resource)) return getCalicoPolicyTypes(resource).join(', ')
+      break
+    case 'namespaceSelector':
+      if (isCalicoPolicyResource(resource)) return getCalicoPolicyNamespaceSelector(resource)
+      break
+    case 'serviceAccountSelector':
+      if (isCalicoPolicyResource(resource)) return getCalicoPolicyServiceAccountSelector(resource)
+      break
+    case 'tier':
+      if (isCalicoPolicyResource(resource)) return String(resource.spec?.tier ?? 'default')
+      break
+    case 'cidr':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.cidr ?? '')
+      break
+    case 'blockSize':
+      if (isCalicoApiVersion(resource?.apiVersion)) {
+        const size = getCalicoIPPoolBlockSize(resource)
+        return size === undefined ? '' : String(size)
+      }
+      break
+    case 'natOutgoing':
+      if (isCalicoApiVersion(resource?.apiVersion)) return resource.spec?.natOutgoing ? 'Yes' : 'No'
+      break
+    case 'nodeSelector':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.nodeSelector ?? 'all()')
+      break
+    case 'allowedUses':
+      if (isCalicoApiVersion(resource?.apiVersion)) return getCalicoIPPoolAllowedUses(resource)
+      break
+    case 'expectedIPs':
+      if (isCalicoApiVersion(resource?.apiVersion)) {
+        return Array.isArray(resource.spec?.expectedIPs) ? resource.spec.expectedIPs.map(String).join(', ') : ''
+      }
+      break
+    case 'profiles':
+      if (isCalicoApiVersion(resource?.apiVersion)) {
+        return Array.isArray(resource.spec?.profiles) ? resource.spec.profiles.map(String).join(', ') : ''
+      }
+      break
+    case 'encapsulation':
+      if (isCalicoApiVersion(resource?.apiVersion)) return getCalicoIPPoolEncapsulation(resource)
+      break
+    case 'disabled':
+      if (isCalicoApiVersion(resource?.apiVersion)) return resource.spec?.disabled === true ? 'Disabled' : 'No'
+      break
+    case 'interfaceName':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.interfaceName ?? '')
+      break
+    case 'defaultAction':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.defaultAction ?? 'Deny')
+      break
+    case 'order':
+      if (isCalicoPolicyResource(resource) && resource.spec?.order !== undefined) return String(resource.spec.order)
+      break
+    case 'stagedAction':
+      if (isCalicoPolicyResource(resource)) return String(resource.spec?.stagedAction ?? '')
+      break
     case 'node':
+      // A Calico HostEndpoint names its node in spec.node; a Pod uses spec.nodeName.
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.node ?? '')
       return resource.spec?.nodeName || ''
     case 'version':
       if (kindLower === 'nodes') return getNodeVersion(resource)