@skyhook-io/k8s-ui 1.12.0 → 1.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/k8s-ui",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/skyhook-io/radar",
@@ -71,7 +71,7 @@
     "html-to-image": "^1.11.0",
     "monaco-yaml": "5.5.1",
     "react-virtuoso": "^4.18.11",
-    "shiki": "^4.2.0"
+    "shiki": "^4.4.2"
   },
   "peerDependencies": {
     "@xterm/addon-fit": ">=0.10.0",
@@ -88,7 +88,7 @@
     "yaml": ">=2.0.0"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.3",
     "@xterm/addon-fit": "^0.11.0",
@@ -98,7 +98,7 @@
     "clsx": "^2.1.1",
     "diff": "^9.0.0",
     "elkjs": "^0.11.1",
-    "lucide-react": "^1.28.0",
+    "lucide-react": "^1.30.0",
     "monaco-editor": "0.55.1",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",

package/src/components/issues/severity.ts

@@ -85,6 +85,7 @@ const CATEGORY_LABEL: Record<string, string> = {
   volume_access_mode_conflict: 'Volume access conflict',
   backup_failed: 'Backup failed',
   backup_target_unavailable: 'Backup target unavailable',
+  backup_stalled: 'Backup not progressing',
   job_failed: 'Job failed',
   cronjob_failed: 'CronJob failed',
   rollout_stalled: 'Rollout stalled',

package/src/components/resources/ResourcesView.empty-note.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { emptyKindNote } from './ResourcesView'
+
+describe('emptyKindNote', () => {
+  it('explains that no UpdateRequest is the resting state, and that it looks the same as a rule that never ran', () => {
+    const note = emptyKindNote('UpdateRequest', 'kyverno.io')
+    expect(note).toContain('deleted seconds after')
+    expect(note).toContain('never ran')
+  })
+
+  it('says an absent EphemeralReport means the scan finished, not that nothing was checked', () => {
+    expect(emptyKindNote('EphemeralReport', 'reports.kyverno.io')).toContain('scan has finished')
+    expect(emptyKindNote('ClusterEphemeralReport', 'reports.kyverno.io')).toContain('scan has finished')
+  })
+
+  it('is case-insensitive on the kind, which arrives from a URL as often as from discovery', () => {
+    expect(emptyKindNote('updaterequest', 'kyverno.io')).toBeDefined()
+  })
+
+  // Same plural, different operator: Kyverno's group is what makes the note true.
+  it('says nothing about a kind of the same name from another group', () => {
+    expect(emptyKindNote('UpdateRequest', 'example.com')).toBeUndefined()
+    expect(emptyKindNote('EphemeralReport', '')).toBeUndefined()
+  })
+
+  it('says nothing about kinds with no such story', () => {
+    expect(emptyKindNote('Pod', '')).toBeUndefined()
+  })
+
+  // The table can be empty because the reader emptied it. Telling them none is
+  // normal then answers a question they did not ask, with their term still in
+  // the search box.
+  it('stays silent when the kind has rows and a filter is what emptied the table', () => {
+    expect(emptyKindNote('UpdateRequest', 'kyverno.io', 3)).toBeUndefined()
+    expect(emptyKindNote('EphemeralReport', 'reports.kyverno.io', 192)).toBeUndefined()
+  })
+
+  it('still speaks when the kind is genuinely empty', () => {
+    expect(emptyKindNote('UpdateRequest', 'kyverno.io', 0)).toBeDefined()
+  })
+})

package/src/components/resources/ResourcesView.tsx

@@ -79,6 +79,8 @@ import {
   getPVCCapacity,
   getPVCAccessModes,
   getRolloutStatus,
+  getAnalysisRunStatus,
+  summarizeAnalysisMetrics,
   getRolloutStrategy,
   getRolloutReady,
   getRolloutStep,
@@ -152,14 +154,17 @@ import { ScaledObjectCell, ScaledJobCell, TriggerAuthenticationCell, ClusterTrig
 import { ResourceClaimCell, ResourceClaimTemplateCell, DeviceClassCell, ResourceSliceCell } from './renderers/dra-cells'
 import { NvidiaClusterPolicyCell, NvidiaDriverCell } from './renderers/nvidia-cells'
 import { ServiceMonitorCell, PrometheusRuleCell, PodMonitorCell } from './renderers/prometheus-cells'
-import { PolicyReportCell, ClusterPolicyReportCell, KyvernoPolicyCell, ClusterPolicyCell } from './renderers/kyverno-cells'
+import { PolicyReportCell, ClusterPolicyReportCell, KyvernoPolicyCell, ClusterPolicyCell,
+  KyvernoUpdateRequestCell,
+  KyvernoEphemeralReportCell,
+} from './renderers/kyverno-cells'
 import { KyvernoModernPolicyCell, KyvernoPolicyExceptionCell, KyvernoCleanupPolicyCell } from './renderers/kyverno-modern-cells'
 import { KYVERNO_MODERN_PLURALS, isModernKyvernoPolicy } from './resource-utils-kyverno-modern'
 import { isAnyKyvernoPolicyException } from './resource-utils-kyverno-exceptions'
 import { ExternalSecretCell, ClusterExternalSecretCell, SecretStoreCell, ClusterSecretStoreCell } from './renderers/eso-cells'
 import { BackupCell, RestoreCell, ScheduleCell, BackupStorageLocationCell, VolumeSnapshotLocationCell, BackupRepositoryCell } from './renderers/velero-cells'
 import { isVeleroResource } from './resource-utils-velero'
-import { CNPGClusterCell, CNPGBackupCell, CNPGScheduledBackupCell, CNPGPoolerCell } from './renderers/cnpg-cells'
+import { CNPGClusterCell, CNPGBackupCell, CNPGScheduledBackupCell, CNPGPoolerCell, CNPGObjectStoreCell, CNPGDeclarativeCell, CNPGImageCatalogCell } from './renderers/cnpg-cells'
 import { isApiGroup, CNPG_GROUP } from './resource-utils-cnpg'
 import { ManagedResourceCell, CompositeResourceCell, CrossplaneProviderCell, CrossplaneProviderConfigCell, CompositionCell, XRDCell } from './renderers/crossplane-cells'
 import { isManagedResource, isComposite } from './resource-utils-crossplane'
@@ -171,6 +176,8 @@ import { CAPIClusterCell, CAPIMachineCell, CAPIMachineDeploymentCell, CAPIMachin
 import { AWSManagedControlPlaneCell, AWSManagedMachinePoolCell, AWSMachineCell, AWSMachineTemplateCell, AWSManagedClusterCell } from './renderers/aws-capi-cells'
 import { GCPManagedControlPlaneCell, GCPManagedMachinePoolCell, GCPMachineCell, GCPMachineTemplateCell, GCPManagedClusterCell } from './renderers/gcp-capi-cells'
 import { AzureManagedControlPlaneCell, AzureManagedMachinePoolCell, AzureMachineCell, AzureMachineTemplateCell, AzureManagedClusterCell } from './renderers/azure-capi-cells'
+import { CalicoInfraCell, CalicoPolicyCell } from './renderers/calico-cells'
+import { isCalicoPolicyResource, isCoreNetworkPolicyKind } from './resource-utils-calico'
 import { useRegisterShortcut, useRegisterShortcuts } from '../../hooks/useKeyboardShortcuts'
 import { ResourcesSidebar } from './ResourcesSidebar'
 import type { SelectedKindInfo } from './ResourcesSidebar'
@@ -274,10 +281,14 @@ function buildCustomColumn(d: CustomColumnDef): ExtraColumn {
 }
 
 // Tailwind width class → pixel minimum mapping for CSS Grid column sizing
+// A width class missing from this map falls back to 80px, and nothing says so —
+// the column just renders narrow enough to truncate its header. Keep the whole
+// Tailwind step range present rather than only the sizes in use today.
 const TAILWIND_WIDTH_TO_PX: Record<string, number> = {
   'w-12': 48, 'w-14': 56, 'w-16': 64, 'w-20': 80, 'w-24': 96,
   'w-28': 112, 'w-32': 128, 'w-36': 144, 'w-40': 160, 'w-44': 176,
-  'w-48': 192, 'w-56': 224, 'w-64': 256,
+  'w-48': 192, 'w-52': 208, 'w-56': 224, 'w-60': 240, 'w-64': 256,
+  'w-72': 288, 'w-80': 320, 'w-96': 384,
 }
 
 const COMPARE_COLUMN_WIDTH = 36
@@ -296,6 +307,30 @@ function getColumnMinWidth(col: Column): number {
 }
 
 // Default columns for unknown resource types (CRDs)
+/**
+ * Why a list of this kind being empty is not the answer it looks like.
+ *
+ * Kyverno's two working records are garbage-collected within seconds of
+ * finishing, so "none" is the resting state of a healthy cluster — and for
+ * UpdateRequest it is ALSO what you see when a generate rule never fired at
+ * all. Those are opposite conclusions and a bare "No X found" renders them
+ * identically.
+ */
+export function emptyKindNote(kind: string, group?: string, unfilteredTotal = 0): string | undefined {
+  // A search or column filter emptying the table is the reader's own doing.
+  // Explaining that none is the resting state then answers a question they did
+  // not ask, while their own term is still in the box.
+  if (unfilteredTotal > 0) return undefined
+  const g = group ?? ''
+  if (kind.toLowerCase() === 'updaterequest' && g === 'kyverno.io') {
+    return 'These are deleted seconds after the work completes, so none is the normal resting state. It also looks like this if a generate or mutate-existing rule never ran — check the policy itself to tell the two apart.'
+  }
+  if ((kind.toLowerCase() === 'ephemeralreport' || kind.toLowerCase() === 'clusterephemeralreport') && g === 'reports.kyverno.io') {
+    return 'These exist only between a background scan and the PolicyReport it becomes, so none means the scan has finished rather than that nothing was checked.'
+  }
+  return undefined
+}
+
 const DEFAULT_COLUMNS: Column[] = [
   { key: 'name', label: 'Name' },
   { key: 'namespace', label: 'Namespace', width: 'w-48' },
@@ -464,6 +499,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'images', label: 'Images', width: 'w-48', hideOnMobile: true },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
+  analysisruns: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-48' },
+    { key: 'status', label: 'Phase', width: 'w-28' },
+    { key: 'trigger', label: 'Trigger', width: 'w-32', tooltip: 'Which part of the Rollout started this run' },
+    { key: 'metrics', label: 'Metrics', width: 'w-40', hideOnMobile: true, tooltip: 'Per-metric verdicts' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
   workflows: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
@@ -913,6 +956,88 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
+  caliconetworkpolicies: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
+    { key: 'tier', label: 'Tier', width: 'w-28' },
+    { key: 'order', label: 'Order', width: 'w-24' },
+    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  calicoglobalnetworkpolicies: [
+    { key: 'name', label: 'Name' },
+    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
+    { key: 'tier', label: 'Tier', width: 'w-28' },
+    { key: 'order', label: 'Order', width: 'w-24' },
+    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  calicostagednetworkpolicies: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
+    { key: 'tier', label: 'Tier', width: 'w-28' },
+    { key: 'order', label: 'Order', width: 'w-24' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
+    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  calicostagedglobalnetworkpolicies: [
+    { key: 'name', label: 'Name' },
+    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
+    { key: 'tier', label: 'Tier', width: 'w-28' },
+    { key: 'order', label: 'Order', width: 'w-24' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
+    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  calicoippools: [
+    { key: 'name', label: 'Name' },
+    { key: 'cidr', label: 'CIDR', width: 'w-44' },
+    { key: 'blockSize', label: 'Block Size', width: 'w-28' },
+    { key: 'encapsulation', label: 'Encapsulation', width: 'w-36' },
+    { key: 'natOutgoing', label: 'NAT Outgoing', width: 'w-32' },
+    { key: 'disabled', label: 'Disabled', width: 'w-28' },
+    { key: 'allowedUses', label: 'Allowed Uses', width: 'w-40', defaultVisible: false },
+    { key: 'nodeSelector', label: 'Node Selector', width: 'w-48', defaultVisible: false },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  calicohostendpoints: [
+    { key: 'name', label: 'Name' },
+    { key: 'node', label: 'Node', width: 'w-48' },
+    { key: 'interfaceName', label: 'Interface', width: 'w-32' },
+    { key: 'expectedIPs', label: 'Expected IPs', width: 'w-48' },
+    { key: 'profiles', label: 'Profiles', width: 'w-48', defaultVisible: false },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  calicotiers: [
+    { key: 'name', label: 'Name' },
+    { key: 'order', label: 'Order', width: 'w-24' },
+    { key: 'defaultAction', label: 'Default Action', width: 'w-36' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  calicostagedkubernetesnetworkpolicies: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'selector', label: 'Pod Selector', width: 'w-48' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
+    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
   poddisruptionbudgets: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
@@ -1305,6 +1430,92 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     // than an absent one — the reader can't tell which meaning they're getting.
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
+  // `databases`, `publications` and `subscriptions` are crowded plurals — other
+  // database operators ship all three, and Knative owns the unqualified
+  // `subscriptions` set. Keyed under cnpg* and reached only through
+  // GROUP_QUALIFIED_COLUMN_KEYS, so a foreign CRD gets the generic columns
+  // instead of a Cluster column it can never fill.
+  // Kyverno's working records. Both are keyed by things the reader has to see
+  // to know whether anything is wrong: which policy queued the work and what it
+  // was queued against, and which resource a scan is about.
+  updaterequests: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-32' },
+    { key: 'status', label: 'State', width: 'w-28' },
+    { key: 'type', label: 'Type', width: 'w-24' },
+    { key: 'policy', label: 'Policy', width: 'w-52' },
+    { key: 'triggers', label: 'Triggered By', width: 'w-56' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  ephemeralreports: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-32' },
+    { key: 'status', label: 'Outcome', width: 'w-28' },
+    { key: 'subject', label: 'About', width: 'w-56' },
+    { key: 'source', label: 'Produced By', width: 'w-36' },
+    { key: 'results', label: 'Results', width: 'w-24' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  clusterephemeralreports: [
+    { key: 'name', label: 'Name' },
+    { key: 'status', label: 'Outcome', width: 'w-28' },
+    { key: 'subject', label: 'About', width: 'w-56' },
+    { key: 'source', label: 'Produced By', width: 'w-36' },
+    { key: 'results', label: 'Results', width: 'w-24' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  cnpgdatabases: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'status', label: 'Applied', width: 'w-32' },
+    { key: 'cluster', label: 'Cluster', width: 'w-36' },
+    { key: 'target', label: 'Database', width: 'w-40' },
+    { key: 'message', label: 'Message', width: 'w-64' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  cnpgpublications: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'status', label: 'Applied', width: 'w-32' },
+    { key: 'cluster', label: 'Cluster', width: 'w-36' },
+    { key: 'dbname', label: 'In Database', width: 'w-40' },
+    { key: 'message', label: 'Message', width: 'w-64' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  cnpgsubscriptions: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'status', label: 'Applied', width: 'w-32' },
+    { key: 'cluster', label: 'Cluster', width: 'w-36' },
+    { key: 'dbname', label: 'In Database', width: 'w-40' },
+    { key: 'message', label: 'Message', width: 'w-64' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  cnpgimagecatalogs: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'majors', label: 'Major Versions', width: 'w-40' },
+    { key: 'images', label: 'Images', width: 'w-24' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  cnpgclusterimagecatalogs: [
+    { key: 'name', label: 'Name' },
+    { key: 'majors', label: 'Major Versions', width: 'w-40' },
+    { key: 'images', label: 'Images', width: 'w-24' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
+  barmanobjectstores: [
+    { key: 'name', label: 'Name' },
+    { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'status', label: 'Status', width: 'w-40' },
+    // Sized rather than flexible: every sibling table gives its long value a
+    // fixed width, and leaving two columns unsized let Name absorb the row at
+    // 1920px — truncating the destination and pushing Retention off-screen.
+    { key: 'destination', label: 'Destination', width: 'w-64' },
+    { key: 'servers', label: 'Servers', width: 'w-32' },
+    { key: 'retention', label: 'Retention', width: 'w-28' },
+    { key: 'age', label: 'Age', width: 'w-24' },
+  ],
   cnpgbackups: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
@@ -1499,7 +1710,10 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'address', label: 'Address', width: 'w-56' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
-  subscriptions: [
+  // Keyed under knative*, reached only through GROUP_QUALIFIED_COLUMN_KEYS, so a
+  // third operator's `subscriptions` gets the generic columns instead of Channel
+  // and Subscriber it can never fill.
+  knativesubscriptions: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
@@ -1869,6 +2083,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
 
 // Map (plural, group) → KNOWN_COLUMNS key for kinds that collide with core K8s
 const GROUP_QUALIFIED_COLUMN_KEYS: Record<string, Record<string, string>> = {
+  networkpolicy: {
+    'networking.k8s.io': 'networkpolicies',
+    'projectcalico.org': 'caliconetworkpolicies',
+    'crd.projectcalico.org': 'caliconetworkpolicies',
+  },
+  networkpolicies: {
+    'networking.k8s.io': 'networkpolicies',
+    'projectcalico.org': 'caliconetworkpolicies',
+    'crd.projectcalico.org': 'caliconetworkpolicies',
+  },
   clusters: { 'postgresql.cnpg.io': 'cnpgclusters', 'cluster.x-k8s.io': 'capiclusters' },
   // Velero owns the unqualified `backups` column set; CNPG Backups carry a
   // completely different shape (cluster + method, no storage location/expiry).
@@ -1882,8 +2106,81 @@ const GROUP_QUALIFIED_COLUMN_KEYS: Record<string, Record<string, string>> = {
   certificates: { 'networking.internal.knative.dev': 'knativecertificates' },
   restores: { 'velero.io': 'velerorestores' },
   schedules: { 'velero.io': 'veleroschedules' },
+  // CNPG's declarative objects. Knative owns the unqualified `subscriptions`
+  // set, and `databases` / `publications` are shipped by several database
+  // operators — none of which have a CNPG Cluster to point at.
+  databases: { 'postgresql.cnpg.io': 'cnpgdatabases' },
+  publications: { 'postgresql.cnpg.io': 'cnpgpublications' },
+  subscriptions: {
+    'postgresql.cnpg.io': 'cnpgsubscriptions',
+    'messaging.knative.dev': 'knativesubscriptions',
+  },
+  imagecatalogs: { 'postgresql.cnpg.io': 'cnpgimagecatalogs' },
+  clusterimagecatalogs: { 'postgresql.cnpg.io': 'cnpgclusterimagecatalogs' },
+  objectstores: { 'barmancloud.cnpg.io': 'barmanobjectstores' },
+  ippools: {
+    'projectcalico.org': 'calicoippools',
+    'crd.projectcalico.org': 'calicoippools',
+  },
+  hostendpoints: {
+    'projectcalico.org': 'calicohostendpoints',
+    'crd.projectcalico.org': 'calicohostendpoints',
+  },
+  tiers: {
+    'projectcalico.org': 'calicotiers',
+    'crd.projectcalico.org': 'calicotiers',
+  },
+  globalnetworkpolicies: {
+    'projectcalico.org': 'calicoglobalnetworkpolicies',
+    'crd.projectcalico.org': 'calicoglobalnetworkpolicies',
+  },
+  globalnetworkpolicy: {
+    'projectcalico.org': 'calicoglobalnetworkpolicies',
+    'crd.projectcalico.org': 'calicoglobalnetworkpolicies',
+  },
+  stagednetworkpolicies: {
+    'projectcalico.org': 'calicostagednetworkpolicies',
+    'crd.projectcalico.org': 'calicostagednetworkpolicies',
+  },
+  stagednetworkpolicy: {
+    'projectcalico.org': 'calicostagednetworkpolicies',
+    'crd.projectcalico.org': 'calicostagednetworkpolicies',
+  },
+  stagedglobalnetworkpolicies: {
+    'projectcalico.org': 'calicostagedglobalnetworkpolicies',
+    'crd.projectcalico.org': 'calicostagedglobalnetworkpolicies',
+  },
+  stagedglobalnetworkpolicy: {
+    'projectcalico.org': 'calicostagedglobalnetworkpolicies',
+    'crd.projectcalico.org': 'calicostagedglobalnetworkpolicies',
+  },
+  stagedkubernetesnetworkpolicies: {
+    'projectcalico.org': 'calicostagedkubernetesnetworkpolicies',
+    'crd.projectcalico.org': 'calicostagedkubernetesnetworkpolicies',
+  },
+  stagedkubernetesnetworkpolicy: {
+    'projectcalico.org': 'calicostagedkubernetesnetworkpolicies',
+    'crd.projectcalico.org': 'calicostagedkubernetesnetworkpolicies',
+  },
 }
 
+const GROUP_QUALIFIED_ONLY_COLUMN_KEYS = new Set([
+  'networkpolicy', 'networkpolicies',
+  // Other projects serve their own IPPool CRD, so only a Calico group earns the
+  // Calico columns.
+  'ippool', 'ippools',
+  'globalnetworkpolicy', 'globalnetworkpolicies',
+  'stagednetworkpolicy', 'stagednetworkpolicies',
+  'stagedglobalnetworkpolicy', 'stagedglobalnetworkpolicies',
+  'stagedkubernetesnetworkpolicy', 'stagedkubernetesnetworkpolicies',
+])
+const CALICO_ONLY_COLUMN_KEYS = new Set([
+  'globalnetworkpolicy', 'globalnetworkpolicies',
+  'stagednetworkpolicy', 'stagednetworkpolicies',
+  'stagedglobalnetworkpolicy', 'stagedglobalnetworkpolicies',
+  'stagedkubernetesnetworkpolicy', 'stagedkubernetesnetworkpolicies',
+])
+
 // Normalize a kind name to its plural API form used in KNOWN_COLUMNS keys.
 // Handles CRD singular names from URLs: 'ScaledObject' → 'scaledobjects', 'NodePool' → 'nodepools'
 // When group is provided, resolves collisions (e.g., 'services' + 'serving.knative.dev' → 'knativeservices')
@@ -1893,6 +2190,8 @@ function normalizeKindToPlural(kind: string, group?: string): string {
   if (group && GROUP_QUALIFIED_COLUMN_KEYS[lower]?.[group]) {
     return GROUP_QUALIFIED_COLUMN_KEYS[lower][group]
   }
+  if (group && GROUP_QUALIFIED_ONLY_COLUMN_KEYS.has(lower)) return `__generic_${lower}`
+  if (CALICO_ONLY_COLUMN_KEYS.has(lower)) return `__generic_${lower}`
   if (KNOWN_COLUMNS[lower]) return lower
   // Try adding 's' but avoid double-s (e.g., "ingress" → "ingresss")
   if (!lower.endsWith('s') && KNOWN_COLUMNS[lower + 's']) return lower + 's'
@@ -4928,6 +5227,11 @@ export function ResourcesView({
           ) : filteredResources.length === 0 ? (
             <div className="absolute inset-0 flex flex-col items-center justify-center text-theme-text-tertiary">
               <p>No {selectedKind.kind} found</p>
+              {emptyKindNote(selectedKind.kind, selectedKind.group, resources?.length ?? 0) && (
+                <p className="text-xs mt-2 max-w-md text-center text-theme-text-disabled">
+                  {emptyKindNote(selectedKind.kind, selectedKind.group, resources?.length ?? 0)}
+                </p>
+              )}
               {searchTerm && (
                 <button
                   onClick={() => {
@@ -5692,6 +5996,8 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
       return <PVCCell resource={resource} column={column} />
     case 'rollouts':
       return <RolloutCell resource={resource} column={column} />
+    case 'analysisruns':
+      return <AnalysisRunCell resource={resource} column={column} />
     case 'workflows':
       return <WorkflowCell resource={resource} column={column} />
     case 'cronworkflows':
@@ -5731,7 +6037,21 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
     case 'clusterworkflowtemplates':
       return <WorkflowTemplateCell resource={resource} column={column} />
     case 'networkpolicies':
+      if (!isCoreNetworkPolicyKind(resource.kind ?? kind, resource.apiVersion, group)) {
+        return <GenericCell resource={resource} column={column} />
+      }
       return <NetworkPolicyCell resource={resource} column={column} />
+    case 'calicoippools':
+    case 'calicohostendpoints':
+    case 'calicotiers':
+      return <CalicoInfraCell resource={resource} column={column} />
+    case 'caliconetworkpolicies':
+    case 'calicoglobalnetworkpolicies':
+    case 'calicostagednetworkpolicies':
+    case 'calicostagedglobalnetworkpolicies':
+    case 'calicostagedkubernetesnetworkpolicies':
+      if (!isCalicoPolicyResource(resource)) return <GenericCell resource={resource} column={column} />
+      return <CalicoPolicyCell resource={resource} column={column} />
     case 'poddisruptionbudgets':
       return <PDBCell resource={resource} column={column} />
     case 'serviceaccounts':
@@ -5848,6 +6168,42 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
     case 'clustersecretstores':
       return <ClusterSecretStoreCell resource={resource} column={column} />
     // Velero
+    // The cnpg* keys come from GROUP_QUALIFIED_COLUMN_KEYS; the unqualified
+    // plurals below are reached when the caller had no group to resolve with,
+    // and stay group-guarded so a foreign CRD is not read as CNPG.
+    case 'updaterequests':
+      return <KyvernoUpdateRequestCell resource={resource} column={column} />
+    case 'ephemeralreports':
+    case 'clusterephemeralreports':
+      return <KyvernoEphemeralReportCell resource={resource} column={column} />
+    case 'cnpgdatabases':
+    case 'cnpgpublications':
+    case 'cnpgsubscriptions':
+      return <CNPGDeclarativeCell resource={resource} column={column} />
+    case 'databases':
+    case 'publications':
+      if (isApiGroup(resource.apiVersion, CNPG_GROUP)) {
+        return <CNPGDeclarativeCell resource={resource} column={column} />
+      }
+      return <GenericCell resource={resource} column={column} />
+    case 'cnpgimagecatalogs':
+    case 'cnpgclusterimagecatalogs':
+      return <CNPGImageCatalogCell resource={resource} column={column} />
+    case 'imagecatalogs':
+    case 'clusterimagecatalogs':
+      if (isApiGroup(resource.apiVersion, CNPG_GROUP)) {
+        return <CNPGImageCatalogCell resource={resource} column={column} />
+      }
+      return <GenericCell resource={resource} column={column} />
+    case 'barmanobjectstores':
+      return <CNPGObjectStoreCell resource={resource} column={column} />
+    case 'objectstores':
+      // Group-guarded: another operator could serve an `objectstores` plural,
+      // and it would have no recovery window to report.
+      if (isApiGroup(resource.apiVersion, 'barmancloud.cnpg.io')) {
+        return <CNPGObjectStoreCell resource={resource} column={column} />
+      }
+      return <GenericCell resource={resource} column={column} />
     case 'cnpgbackups':
       return <CNPGBackupCell resource={resource} column={column} />
     case 'backups':
@@ -5936,8 +6292,19 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
       return <ChannelCell resource={resource} column={column} />
     case 'inmemorychannels':
       return <InMemoryChannelCell resource={resource} column={column} />
-    case 'subscriptions':
+    case 'knativesubscriptions':
       return <SubscriptionCell resource={resource} column={column} />
+    case 'subscriptions':
+      // Shared plural, and not only by two: CNPG declares one, Knative declares
+      // one, and a third operator's would be read as Knative's — Channel and
+      // Subscriber blank on every row — unless both are matched positively.
+      if (isApiGroup(resource.apiVersion, CNPG_GROUP)) {
+        return <CNPGDeclarativeCell resource={resource} column={column} />
+      }
+      if (isApiGroup(resource.apiVersion, 'messaging.knative.dev')) {
+        return <SubscriptionCell resource={resource} column={column} />
+      }
+      return <GenericCell resource={resource} column={column} />
     // Knative Flows
     case 'sequences':
       return <SequenceCell resource={resource} column={column} />
@@ -7240,6 +7607,44 @@ function RolloutCell({ resource, column }: { resource: any; column: string }) {
   }
 }
 
+function AnalysisRunCell({ resource, column }: { resource: any; column: string }) {
+  switch (column) {
+    case 'status': {
+      const status = getAnalysisRunStatus(resource)
+      return <span className={clsx('badge', status.color)}>{status.text}</span>
+    }
+    case 'trigger': {
+      const trigger = resource.metadata?.labels?.['rollout-type']
+      const step = resource.metadata?.labels?.['step-index']
+      if (!trigger) return <span className="text-sm text-theme-text-tertiary">-</span>
+      return (
+        <span className="text-sm text-theme-text-secondary">
+          {trigger}
+          {step ? ` (step ${step})` : ''}
+        </span>
+      )
+    }
+    case 'metrics': {
+      const results: any[] = resource.status?.metricResults || []
+      if (results.length === 0) return <span className="text-sm text-theme-text-tertiary">-</span>
+      const { total, passing, notPassing } = summarizeAnalysisMetrics(resource)
+      return (
+        <Tooltip
+          content={results
+            .map((m) => `${m.name}: ${m.phase || 'Unknown'}${m.dryRun ? ' (dry-run)' : ''}`)
+            .join('\n')}
+        >
+          <span className={clsx('text-sm', notPassing > 0 ? 'text-amber-400' : 'text-theme-text-secondary')}>
+            {notPassing > 0 ? `${notPassing}/${total} not passing` : `${passing}/${total} passing`}
+          </span>
+        </Tooltip>
+      )
+    }
+    default:
+      return <span className="text-sm text-theme-text-tertiary">-</span>
+  }
+}
+
 function WorkflowCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
     case 'status': {