@skyhook-io/k8s-ui 1.11.0 → 1.13.0

package/src/types/core.ts

@@ -202,6 +202,11 @@ export type CoreNodeKind =
   | 'KubeadmControlPlane' // Cluster API KubeadmControlPlane
   | 'ClusterClass'       // Cluster API ClusterClass
   | 'MachineHealthCheck' // Cluster API MachineHealthCheck
+  | 'CalicoNetworkPolicy'
+  | 'CalicoGlobalNetworkPolicy'
+  | 'CalicoStagedNetworkPolicy'
+  | 'CalicoStagedGlobalNetworkPolicy'
+  | 'CalicoStagedKubernetesNetworkPolicy'
 
 // NodeKind can be a core kind or any arbitrary CRD kind string
 export type NodeKind = CoreNodeKind | (string & {})
@@ -236,6 +241,11 @@ export function displayKind(kind: string): string {
     KubeadmControlPlane: 'Control Plane',
     ClusterClass: 'ClusterClass',
     MachineHealthCheck: 'Health Check',
+    CalicoNetworkPolicy: 'Calico NetworkPolicy',
+    CalicoGlobalNetworkPolicy: 'Calico GlobalNetworkPolicy',
+    CalicoStagedNetworkPolicy: 'Calico StagedNetworkPolicy',
+    CalicoStagedGlobalNetworkPolicy: 'Calico StagedGlobalNetworkPolicy',
+    CalicoStagedKubernetesNetworkPolicy: 'Calico StagedKubernetesNetworkPolicy',
   }
   return shortNames[kind] || kind
 }
@@ -258,6 +268,7 @@ export interface TopologyEdge {
   target: string
   type: EdgeType
   label?: string
+  partial?: boolean
   /** Hover tooltip for the edge label. Used by the Reachability view to keep the
    *  DECLARED route path available when the label shows an overridden tested path. */
   labelTitle?: string
@@ -1204,6 +1215,13 @@ export interface TrafficFlow {
   bytesSent: number
   bytesRecv: number
   connections: number
+  /** The conversation's initiator could not be established, so source and
+   *  destination are ordered arbitrarily rather than describing a caller. */
+  directionUnknown?: boolean
+  /** 5xx responses per second. How a rate-based source reports failures: it
+   *  measures a rate rather than observing individual responses, so it has a
+   *  status code for no single flow. */
+  errorRate?: number
   verdict: string // forwarded, dropped, error
   lastSeen: string // ISO date string
 }
@@ -1236,6 +1254,9 @@ export interface AggregatedFlow {
   bytesRecv: number
   connections: number
   lastSeen: string
+  /** The conversation's initiator could not be established, so the endpoints are
+   *  ordered arbitrarily and the edge is drawn without an arrowhead. */
+  directionUnknown?: boolean
   l7Protocol?: string // HTTP, gRPC, DNS
   requestCount?: number
   errorCount?: number
@@ -1307,6 +1328,11 @@ export interface TrafficFlowsResponse {
   flows: TrafficFlow[]
   aggregated: AggregatedFlow[]
   warning?: string  // Non-fatal warning (e.g., query errors)
+  /** 'transient' (or absent) means the condition may clear on its own and a
+   *  retry is worthwhile. 'partial' means the flows are correct but incomplete
+   *  for a reason retrying cannot change, so show the warning next to them and
+   *  do not refetch. */
+  warningKind?: 'transient' | 'partial'
 }
 
 // Wizard state for traffic setup
@@ -1424,6 +1450,9 @@ export interface WorkloadRevision {
   isCurrent: boolean
   replicas: number
   template?: string // Pod template spec as YAML (for revision diff)
+  // Rollouts only: mid-canary isCurrent (rolling out) and isStable (serving traffic) differ.
+  isStable?: boolean
+  podHash?: string
 }
 
 // Workload log stream event data

package/src/types/gitops-flux-status.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect } from 'vitest'
+import { fluxConditionsToGitOpsStatus, type FluxCondition } from './gitops'
+
+const c = (type: string, status: string, extra: Partial<FluxCondition> = {}): FluxCondition =>
+  ({ type, status, ...extra } as FluxCondition)
+
+// Mirrors pkg/gitops/fluxstatus_test.go. The two implementations must not drift:
+// they feed the same columns from different sides of the wire.
+describe('fluxConditionsToGitOpsStatus truth table', () => {
+  it('a stale Reconciling does not outvote an applied Ready', () => {
+    // The reported bug: kubectl and k9s read the printer columns and show
+    // READY=True while Radar showed the row as syncing.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'True'), c('Healthy', 'True'), c('Reconciling', 'True')],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+  })
+
+  it('generation drift outranks a stale Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {
+      generation: 2,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('treats the -1 sentinel as drift', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False'), c('Reconciling', 'True')], false, {
+      generation: 1,
+      observedGeneration: -1,
+    })
+    expect(got.sync).toBe('Reconciling')
+  })
+
+  it('does not treat an absent observedGeneration as drift', () => {
+    // Kinds and controller versions that never set it must not all read stale.
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, { generation: 3 }).sync).toBe('Synced')
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {}).sync).toBe('Synced')
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false).sync).toBe('Synced')
+  })
+
+  it('lets Stalled outrank Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True'), c('Stalled', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('separates applied from healthy', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True'), c('Healthy', 'False')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('reports Reconciling when the pass has not reached Ready', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'Unknown'), c('Reconciling', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+  })
+
+  it('keeps a suspended-but-applied object Synced, and drops it on drift', () => {
+    const gen = { generation: 1, observedGeneration: 1 }
+    expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], true, gen).sync).toBe('Synced')
+    expect(
+      fluxConditionsToGitOpsStatus([c('Ready', 'True')], true, { generation: 2, observedGeneration: 1 }).sync,
+    ).toBe('Unknown')
+  })
+
+  it('treats a retrying Ready=False as progressing, not degraded', () => {
+    // Mirrors pkg/gitops/fluxstatus_test.go. Flux composes reasons like
+    // ProgressingWithRetry; a retry in flight is out of sync but not settled.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'False', { reason: 'ProgressingWithRetry' })],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('treats a settled Ready=False as degraded', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False', { reason: 'BuildFailed' })], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+})
+
+
+describe('reconciling activity', () => {
+  it('survives even when it no longer drives the status', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Ready', 'True'), c('Reconciling', 'True', { lastTransitionTime: '2026-08-11T06:05:00Z' })],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.reconciling).toBe(true)
+    expect(got.reconcilingSince).toBe('2026-08-11T06:05:00Z')
+  })
+
+  it('is absent on a quiet object', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.reconciling).toBeUndefined()
+  })
+})
+
+// Source kinds carry no Healthy condition; HelmRelease uses Released.
+describe('non-Kustomization Flux kinds', () => {
+  it.each([
+    ['GitRepository', [c('Ready', 'True'), c('ArtifactInStorage', 'True')]],
+    ['HelmRepository', [c('Ready', 'True'), c('ArtifactInStorage', 'True')]],
+    ['HelmRelease', [c('Ready', 'True'), c('Released', 'True')]],
+  ])('%s reads as Synced/Healthy', (_kind, conds) => {
+    const got = fluxConditionsToGitOpsStatus(conds as FluxCondition[], false, {
+      generation: 1,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+  })
+})
+
+// The wedged-controller case end to end: a fully-applied object whose reconcile
+// pass never finished must read Synced (it IS applied) AND still carry the
+// in-flight fact, or a stuck controller becomes invisible. Before the sync fix
+// this state showed a permanent "Syncing", which was the wrong word but the
+// only thing in the product that noticed.
+describe('a wedged controller stays visible', () => {
+  it('reports Synced and keeps the in-flight fact with its start time', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [
+        c('Ready', 'True', { lastTransitionTime: '2026-08-11T06:00:00Z' }),
+        c('Healthy', 'True'),
+        c('Reconciling', 'True', { lastTransitionTime: '2026-08-11T06:05:00Z' }),
+      ],
+      false,
+      { generation: 1, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Synced')
+    expect(got.health).toBe('Healthy')
+    // Both are required: without these the indicator has nothing to render and
+    // the operator gets a confident all-clear over a stuck controller.
+    expect(got.reconciling).toBe(true)
+    expect(got.reconcilingSince).toBe('2026-08-11T06:05:00Z')
+  })
+})

package/src/types/gitops.ts

@@ -63,6 +63,15 @@ export interface GitOpsStatus {
   message?: string
   lastSyncTime?: string
   suspended: boolean
+  /**
+   * A reconcile pass is executing right now. Activity, not sync and not health —
+   * it never influences either, because a controller being mid-pass says nothing
+   * about whether the declared state is applied. Renderers may show a subtle
+   * indicator; nothing that drives a status word.
+   */
+  reconciling?: boolean
+  /** When the in-flight pass started, so a wedged controller can be told from a routine one. */
+  reconcilingSince?: string
 }
 
 /**
@@ -97,50 +106,92 @@ export interface FluxCondition {
 // ============================================================================
 
 /**
- * Maps FluxCD conditions to unified GitOpsStatus
+ * Generation tracking for a Flux object. `observedGeneration` has three states,
+ * and the difference matters: absent means the controller never reports it and
+ * we have no signal, which must not be read as drift.
+ */
+export interface FluxGeneration {
+  generation?: number
+  observedGeneration?: number
+}
+
+/**
+ * True when the controller has demonstrably not yet acted on the current spec.
+ * Absent observedGeneration is no signal, not drift — some Flux kinds and older
+ * controllers never set it, and treating absence as drift would mark every
+ * healthy object on them as out of date. A present-but-different value counts,
+ * including the -1 sentinel Flux writes on an object it has never reconciled.
+ */
+function hasGenerationDrift(gen?: FluxGeneration): boolean {
+  if (!gen) return false
+  const { generation, observedGeneration } = gen
+  if (typeof generation !== 'number' || typeof observedGeneration !== 'number') return false
+  return generation !== observedGeneration
+}
+
+/**
+ * Maps FluxCD conditions to unified GitOpsStatus.
+ *
+ * Sync answers "is the declared state applied", which is `Ready` plus
+ * `observedGeneration`. `Reconciling` answers "is the controller mid-pass",
+ * which is neither — the two are independent conditions upstream, and letting
+ * activity outvote readiness reported a healthy object as not synced.
  *
- * FluxCD status patterns:
- * - Ready=True: Synced and healthy
- * - Ready=False + Stalled=True: Degraded
- * - Ready=False + Reconciling=True: Reconciling
- * - Ready=False (other): OutOfSync
- * - Healthy=False: Deployed but unhealthy resources
- * - spec.suspend=true: Suspended
+ * Order matters:
+ * - suspend                                   → Suspended (sync from Ready, unless drifted)
+ * - Stalled=True                              → OutOfSync / Degraded
+ * - Ready=True and no generation drift        → Synced, health from Healthy
+ * - drift, or Reconciling with Ready not True → Reconciling / Progressing
+ * - Ready=False                               → OutOfSync
  */
 export function fluxConditionsToGitOpsStatus(
   conditions: FluxCondition[],
-  suspended: boolean
+  suspended: boolean,
+  generation?: FluxGeneration
 ): GitOpsStatus {
   const readyCondition = conditions.find(c => c.type === 'Ready')
   const reconcilingCondition = conditions.find(c => c.type === 'Reconciling')
   const stalledCondition = conditions.find(c => c.type === 'Stalled')
   const healthyCondition = conditions.find(c => c.type === 'Healthy')
 
-  // Handle suspended state
+  const drifted = hasGenerationDrift(generation)
+  const isReconciling = reconcilingCondition?.status === 'True'
+  // Carried on every result so a wedged controller is visible next to an
+  // otherwise-correct Synced, without any status word claiming a fault.
+  const activity = isReconciling
+    ? { reconciling: true, reconcilingSince: reconcilingCondition?.lastTransitionTime }
+    : {}
+
+  // Handle suspended state. Suspending does not un-apply what was applied, so a
+  // suspended object that was Ready stays Synced — but a spec change made while
+  // suspended will never be picked up, so drift downgrades it to Unknown.
   if (suspended) {
     return {
-      sync: readyCondition?.status === 'True' ? 'Synced' : 'Unknown',
+      sync: readyCondition?.status === 'True' && !drifted ? 'Synced' : 'Unknown',
       health: 'Suspended',
       message: 'Reconciliation is suspended',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: true,
+      ...activity,
     }
   }
 
-  // Handle reconciling state
-  if (reconcilingCondition?.status === 'True') {
+  // Stalled is a terminal failure and outranks readiness: it means the
+  // controller has given up, whatever the last successful apply left behind.
+  if (stalledCondition?.status === 'True') {
     return {
-      sync: 'Reconciling',
-      health: 'Progressing',
-      message: reconcilingCondition.message || 'Reconciliation in progress',
+      sync: 'OutOfSync',
+      health: 'Degraded',
+      message: stalledCondition.message || 'Reconciliation stalled',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
-  // Handle ready state
-  if (readyCondition?.status === 'True') {
-    // Check if deployed resources are healthy
+  // The applied state. Ahead of the reconciling branch on purpose — this is the
+  // whole point of the ordering.
+  if (readyCondition?.status === 'True' && !drifted) {
     const isHealthy = healthyCondition?.status !== 'False'
     return {
       sync: 'Synced',
@@ -148,17 +199,20 @@ export function fluxConditionsToGitOpsStatus(
       message: isHealthy ? undefined : healthyCondition?.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
-  // Handle stalled state (permanent failure)
-  if (stalledCondition?.status === 'True') {
+  // Genuinely not applied: the controller has not observed the current spec, or
+  // it is working and has not reached Ready.
+  if (drifted || isReconciling) {
     return {
-      sync: 'OutOfSync',
-      health: 'Degraded',
-      message: stalledCondition.message || 'Reconciliation stalled',
+      sync: 'Reconciling',
+      health: 'Progressing',
+      message: reconcilingCondition?.message || 'Reconciliation in progress',
       lastSyncTime: readyCondition?.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
@@ -173,6 +227,7 @@ export function fluxConditionsToGitOpsStatus(
       message: readyCondition.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,
+      ...activity,
     }
   }
 
@@ -182,6 +237,7 @@ export function fluxConditionsToGitOpsStatus(
     health: 'Unknown',
     message: 'Status cannot be determined',
     suspended: false,
+    ...activity,
   }
 }
 

package/src/types/index.ts

@@ -5,3 +5,4 @@ export * from './gitops-tree'
 export * from './gitops-insights'
 export * from './rbac'
 export * from './capacity'
+export * from './policy'

package/src/types/policy.ts

@@ -0,0 +1,193 @@
+// Per-resource policy findings, from GET /api/policy/resource/{kind}/{ns}/{name}.
+//
+// The coverage fields are not decoration. An empty `findings` array means one of
+// several very different things — nothing violated, no engine installed, the
+// caller may not read the reports, the index is still warming — and a section
+// that renders all of them as blank space tells an operator they are compliant
+// in the cases where we simply do not know.
+
+export type PolicyResult = 'pass' | 'fail' | 'warn' | 'error' | 'skip' | string
+
+export interface PolicyResourceFinding {
+  policy: string
+  rule?: string
+  result: PolicyResult
+  severity?: string
+  category?: string
+  message?: string
+  engine?: string
+}
+
+export interface PolicyResourceCounts {
+  pass: number
+  fail: number
+  warn: number
+  error: number
+  skip: number
+}
+
+/** One resource a policy recorded an outcome for, from
+ *  GET /api/policy/policies/{policy}. */
+export interface PolicyCoverageSubject {
+  group?: string
+  kind: string
+  namespace?: string
+  name: string
+  result: PolicyResult
+  message?: string
+  /** Matched through a rule Kyverno synthesised from an authored Pod rule,
+   *  not through a rule the user wrote. */
+  autogen?: boolean
+}
+
+export interface PolicyCoverageRule {
+  /** Empty for the modern CEL families, which have no named rules. */
+  rule: string
+  counts: PolicyResourceCounts
+  subjects: PolicyCoverageSubject[]
+  total: number
+  truncated?: boolean
+  /** How many of `total` the namespace view filter held back. `counts` still
+   *  describe every outcome, so the two must be read together. */
+  hiddenByFilter?: number
+  /** The non-passing part of `hiddenByFilter`. Only non-passing subjects are
+   *  listed, so this is what separates a row the server cap dropped from one
+   *  the view filter held back. */
+  hiddenNotable?: number
+}
+
+/** What one policy decided about the cluster — the inverse of
+ *  PolicyResourceResponse.
+ *
+ *  Carries one partiality the per-resource view never needed: a resource may be
+ *  missing because the caller cannot read its namespace, so an absent subject is
+ *  not evidence of absence. `withheldNamespaces` is how the UI says so. */
+export interface PolicyCoverageResponse {
+  evaluated: boolean
+  status: string
+  reasonCode?: string
+  deniedGroups?: string[]
+  liveUpdates: boolean
+  /** The report-side name that matched — namespaced policies report as
+   *  "namespace/name". */
+  policy: string
+  counts: PolicyResourceCounts
+  scopeNamespaces: number
+  withheldNamespaces: number
+  clusterScoped?: boolean
+  /** Separate from withheldNamespaces — a cluster-scoped subject has no
+   *  namespace to name. */
+  withheldClusterScoped?: boolean
+  /** Outcomes dropped because they came only from a report family this caller
+   *  cannot read. The server drops them before counting, so the note can state
+   *  how many were left out rather than hedging that some might have been. */
+  withheldByFamily?: number
+  /** Report families the CALLER cannot read. Distinct from deniedGroups, which
+   *  are the ones radar's own probe could not read. */
+  unreadableFamilies?: string[]
+  /** How many distinct resources these outcomes describe, and how many of those
+   *  have at least one non-passing outcome. One resource matched by two rules
+   *  produces two outcomes, so any sentence saying "resources" needs these —
+   *  `counts` and `examined` are checks. Not derivable client-side: the per-rule
+   *  subject lists are capped. */
+  subjects?: number
+  subjectsFailing?: number
+  /** How many outcomes back these counts. */
+  examined: number
+  /** How many subjects the namespace view filter held back, across all rules. */
+  hiddenByFilter?: number
+  engines?: string[]
+  rules: PolicyCoverageRule[]
+}
+
+export interface PolicyResourceResponse {
+  /** False whenever the answer is "we could not check". Never treat an empty
+   *  findings array as "clean" without consulting this first. */
+  evaluated: boolean
+  status: string
+  reasonCode?: string
+  /** Report families RADAR's own probe could not read, so nobody's answer
+   *  carries them — not the same as `withheldByFamily`, which is what THIS
+   *  caller may not see. Present even when evaluated: the answer is real but
+   *  incomplete. */
+  deniedGroups?: string[]
+  /** False when the index is frozen at its initial contents. */
+  liveUpdates: boolean
+  counts: PolicyResourceCounts
+  findings: PolicyResourceFinding[]
+  /** Findings dropped because they came only from a report family this caller
+   *  cannot read. `counts` excludes them too, so an all-passing count with this
+   *  set is not an all-clear — it is the part of the answer they may see. */
+  withheldByFamily?: number
+}
+
+/** Background work Kyverno currently has in flight for one policy, from
+ *  GET /api/policy/policies/{policy}/queued. Computed server-side: the requests
+ *  live in the engine's namespace, not the policy's. */
+export interface PolicyQueuedResponse {
+  /** Zero is a real answer — Kyverno deletes these seconds after they complete. */
+  requests: number
+  byState?: Record<string, number>
+  /** Separates healthy churn from a stopped controller. */
+  oldestPending?: string
+  /** The only diagnosis these objects carry. */
+  messages?: string[]
+}
+
+/** One Cluster pinned to a CloudNativePG image catalog. */
+export interface CNPGCatalogUser {
+  namespace: string
+  name: string
+  /** Absent when the reference carries no major — the screen must not render
+   *  "asks for PostgreSQL 0". */
+  major?: number
+  /** A catalog-pinned Cluster has no spec.imageName, so this is the only place
+   *  the image it actually resolved appears. */
+  image?: string
+}
+
+/** Clusters referencing one image catalog, from the CNPG catalog-users endpoint. */
+export interface CNPGCatalogUsersResponse {
+  clusters: CNPGCatalogUser[]
+}
+
+/** What one Velero BackupStorageLocation holds, from the stored-backups lookup. */
+export interface VeleroStoredBackupsResponse {
+  backups: Array<{
+    namespace: string
+    name: string
+    phase?: string
+    expiration?: string
+    completed?: string
+  }>
+  /** How many reached Completed and are still inside their retention — the rest
+   *  are stored here but are not something to restore from. Counted over the
+   *  whole location, like `stored`: recomputing it from the capped list above
+   *  undercounts every location big enough to be capped. */
+  restorable: number
+  /** How many reached Completed but have aged out. Same scope as `restorable`. */
+  expired?: number
+  /** How many the location holds in total, counted before the list was capped. */
+  stored?: number
+  /** The list above is a page, not the whole location. */
+  truncated?: boolean
+}
+
+/** One warning or error behind a Velero run's counts, with the scope Velero
+ *  filed it under: "velero", "cluster", or a namespace name. */
+export interface VeleroMessage {
+  scope: string
+  message: string
+}
+
+/** What a Backup or Restore actually reported, fetched on demand.
+ *
+ *  The counts live on the CR; these messages do not — they are in a results
+ *  file in object storage that only Velero's controller can hand out a link to.
+ *  So this is never present until someone asks for it. */
+export interface VeleroRunMessagesResponse {
+  warnings: VeleroMessage[]
+  errors: VeleroMessage[]
+  /** Set when the results file held more than were returned. */
+  truncated?: boolean
+}

package/src/utils/navigation.test.ts

@@ -24,6 +24,11 @@ describe('kindToPlural', () => {
 
   test('handles kinds ending in consonant+y (changes to -ies)', () => {
     expect(kindToPlural('NetworkPolicy')).toBe('networkpolicies')
+    expect(kindToPlural('CalicoNetworkPolicy')).toBe('networkpolicies')
+    expect(kindToPlural('CalicoGlobalNetworkPolicy')).toBe('globalnetworkpolicies')
+    expect(kindToPlural('CalicoStagedNetworkPolicy')).toBe('stagednetworkpolicies')
+    expect(kindToPlural('CalicoStagedGlobalNetworkPolicy')).toBe('stagedglobalnetworkpolicies')
+    expect(kindToPlural('CalicoStagedKubernetesNetworkPolicy')).toBe('stagedkubernetesnetworkpolicies')
   })
 
   test('handles already-plural kind names (Endpoints)', () => {

package/src/utils/navigation.ts

@@ -100,6 +100,11 @@ export function kindToPlural(kind: string): string {
     horizontalpodautoscaler: 'horizontalpodautoscalers',
     pvc: 'persistentvolumeclaims',
     podgroup: 'pods',
+    caliconetworkpolicy: 'networkpolicies',
+    calicoglobalnetworkpolicy: 'globalnetworkpolicies',
+    calicostagednetworkpolicy: 'stagednetworkpolicies',
+    calicostagedglobalnetworkpolicy: 'stagedglobalnetworkpolicies',
+    calicostagedkubernetesnetworkpolicy: 'stagedkubernetesnetworkpolicies',
   }
   if (aliases[kindLower]) return aliases[kindLower]