@skyhook-io/k8s-ui 1.12.0 → 1.13.0

package/src/components/resources/resource-utils-cnpg-objectstore.test.ts

@@ -0,0 +1,122 @@
+import { describe, it, expect } from 'vitest'
+import {
+  getCNPGObjectStoreRecoveryWindows,
+  getCNPGObjectStoreStatus,
+  getCNPGObjectStoreProvider,
+  isCNPGObjectStore,
+} from './resource-utils-cnpg'
+
+// Field names verified against the real CRD (plugin-barman-cloud v0.14.0,
+// barmancloud.cnpg.io/v1) on a kind cluster — `lastSuccessfulBackupTime`, not
+// `lastSuccessfulBackup` as the Cluster status uses.
+const store = (status: any, spec: any = {}) => ({
+  apiVersion: 'barmancloud.cnpg.io/v1',
+  kind: 'ObjectStore',
+  metadata: { name: 'pg-store', namespace: 'pg' },
+  spec: { configuration: { destinationPath: 's3://b/pg' }, ...spec },
+  status,
+})
+
+describe('getCNPGObjectStoreRecoveryWindows', () => {
+  it('reads the per-server map and sorts by server', () => {
+    const w = getCNPGObjectStoreRecoveryWindows(
+      store({
+        serverRecoveryWindow: {
+          zeta: { firstRecoverabilityPoint: '2026-08-01T00:00:00Z', lastSuccessfulBackupTime: '2026-08-10T00:00:00Z' },
+          alpha: { firstRecoverabilityPoint: '2026-08-02T00:00:00Z', lastSuccessfulBackupTime: '2026-08-11T00:00:00Z' },
+        },
+      }),
+    )
+    expect(w.map((x) => x.server)).toEqual(['alpha', 'zeta'])
+  })
+
+  it('flags a failure newer than the last success', () => {
+    const [w] = getCNPGObjectStoreRecoveryWindows(
+      store({
+        serverRecoveryWindow: {
+          pg: {
+            lastSuccessfulBackupTime: '2026-08-05T00:00:00Z',
+            lastFailedBackupTime: '2026-08-12T00:00:00Z',
+          },
+        },
+      }),
+    )
+    expect(w.failingSinceLastSuccess).toBe(true)
+  })
+
+  it('does not flag a failure that predates the last success', () => {
+    const [w] = getCNPGObjectStoreRecoveryWindows(
+      store({
+        serverRecoveryWindow: {
+          pg: {
+            lastFailedBackupTime: '2026-08-05T00:00:00Z',
+            lastSuccessfulBackupTime: '2026-08-12T00:00:00Z',
+          },
+        },
+      }),
+    )
+    expect(w.failingSinceLastSuccess).toBe(false)
+  })
+
+  it('treats a failure with no success at all as failing', () => {
+    const [w] = getCNPGObjectStoreRecoveryWindows(
+      store({ serverRecoveryWindow: { pg: { lastFailedBackupTime: '2026-08-12T00:00:00Z' } } }),
+    )
+    expect(w.failingSinceLastSuccess).toBe(true)
+  })
+
+  it('returns nothing for a store that has never reported', () => {
+    expect(getCNPGObjectStoreRecoveryWindows(store({}))).toEqual([])
+    expect(getCNPGObjectStoreRecoveryWindows(store(undefined))).toEqual([])
+  })
+})
+
+describe('getCNPGObjectStoreStatus', () => {
+  // The load-bearing one: an empty status means nothing is restorable, and a
+  // green badge there would assert a recovery point that does not exist.
+  it('is unknown, not healthy, when no server has reported', () => {
+    const s = getCNPGObjectStoreStatus(store({}))
+    expect(s.level).toBe('unknown')
+    expect(s.text).toBe('No backups yet')
+  })
+
+  it('is unhealthy when any server is failing since its last success', () => {
+    const s = getCNPGObjectStoreStatus(
+      store({
+        serverRecoveryWindow: {
+          ok: { lastSuccessfulBackupTime: '2026-08-12T00:00:00Z' },
+          bad: { lastSuccessfulBackupTime: '2026-08-01T00:00:00Z', lastFailedBackupTime: '2026-08-12T00:00:00Z' },
+        },
+      }),
+    )
+    expect(s.level).toBe('unhealthy')
+  })
+
+  it('is healthy when every server has a clean latest backup', () => {
+    const s = getCNPGObjectStoreStatus(
+      store({ serverRecoveryWindow: { pg: { lastSuccessfulBackupTime: '2026-08-12T00:00:00Z' } } }),
+    )
+    expect(s.level).toBe('healthy')
+  })
+})
+
+describe('provider + group guards', () => {
+  it('names the provider without exposing credentials', () => {
+    expect(
+      getCNPGObjectStoreProvider(
+        store({}, { configuration: { destinationPath: 's3://b', s3Credentials: { accessKeyId: { name: 'x' } } } }),
+      ),
+    ).toBe('S3')
+    expect(
+      getCNPGObjectStoreProvider(store({}, { configuration: { azureCredentials: {} } })),
+    ).toBe('Azure Blob Storage')
+    expect(getCNPGObjectStoreProvider(store({}, { configuration: {} }))).toBeUndefined()
+  })
+
+  // `objectstores` is generic enough for another operator to claim.
+  it('does not claim a foreign objectstores CR', () => {
+    expect(isCNPGObjectStore(store({}))).toBe(true)
+    expect(isCNPGObjectStore({ apiVersion: 'minio.example.io/v1', kind: 'ObjectStore' })).toBe(false)
+    expect(isCNPGObjectStore({})).toBe(false)
+  })
+})

package/src/components/resources/resource-utils-cnpg.test.ts

@@ -1,5 +1,7 @@
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
 import {
+  getCNPGScheduledBackupStatus,
+  getCNPGScheduledBackupNextSchedule,
   getCNPGClusterCertificateExpirations,
   getCNPGClusterStatus,
   getCNPGBackupStatus,
@@ -662,3 +664,55 @@ describe('volume health', () => {
     expect(h?.healthy).toEqual(['ok'])
   })
 })
+
+describe('CNPG scheduled backup lateness', () => {
+  const at = (ms: number) => new Date(Date.now() + ms).toISOString()
+  const MIN = 60 * 1000
+
+  const sb = (suspend: boolean, next?: string, lastScheduleTime?: string) => ({
+    spec: { schedule: '0 0 0 * * *', suspend },
+    status: { ...(next ? { nextScheduleTime: next } : {}), ...(lastScheduleTime ? { lastScheduleTime } : {}) },
+  })
+
+  it('reports a schedule that missed its own next-run time', () => {
+    // Ran once, then stopped. Both lastScheduleTime and nextScheduleTime are
+    // present, which is exactly the shape that used to read healthy.
+    const badge = getCNPGScheduledBackupStatus(sb(false, at(-200 * 24 * 60 * MIN), at(-200 * 24 * 60 * MIN)))
+    expect(badge.level).toBe('degraded')
+    expect(badge.text).toBe('Overdue')
+  })
+
+  it('stays healthy inside the operator reconcile window', () => {
+    const badge = getCNPGScheduledBackupStatus(sb(false, at(-1 * MIN), at(-24 * 60 * MIN)))
+    expect(badge.level).toBe('healthy')
+  })
+
+  it('keeps suspended as a deliberate state, not a missed backup', () => {
+    // The operator stops maintaining nextScheduleTime once suspended, so the
+    // stale value must not be read as a missed run.
+    const badge = getCNPGScheduledBackupStatus(sb(true, at(-200 * 24 * 60 * MIN)))
+    expect(badge.text).toBe('Suspended')
+  })
+
+  it('never says overdue while the badge still says healthy', () => {
+    // The two read from one test. Before this they disagreed: the badge said
+    // Active while this field said overdue on the same row.
+    const justPastDue = sb(false, at(-1 * MIN), at(-24 * 60 * MIN))
+    expect(getCNPGScheduledBackupStatus(justPastDue).level).toBe('healthy')
+    expect(getCNPGScheduledBackupNextSchedule(justPastDue)).toBe('due now')
+
+    const longPastDue = sb(false, at(-200 * 24 * 60 * MIN), at(-200 * 24 * 60 * MIN))
+    expect(getCNPGScheduledBackupStatus(longPastDue).level).toBe('degraded')
+    expect(getCNPGScheduledBackupNextSchedule(longPastDue)).toContain('overdue by')
+  })
+
+  it('does not count down to a run that is not coming', () => {
+    expect(getCNPGScheduledBackupNextSchedule(sb(true, at(60 * MIN)))).toBe('suspended')
+    expect(getCNPGScheduledBackupNextSchedule(sb(true, at(-60 * MIN)))).toBe('suspended')
+  })
+
+  it('says nothing when the operator published no next-run time', () => {
+    expect(getCNPGScheduledBackupNextSchedule(sb(false))).toBe('-')
+    expect(getCNPGScheduledBackupStatus(sb(false, undefined, at(-24 * 60 * MIN))).level).toBe('healthy')
+  })
+})

package/src/components/resources/resource-utils-cnpg.ts

@@ -252,12 +252,19 @@ export function getCNPGClusterPhase(resource: any): string {
   return resource.status?.phase || '-'
 }
 
+// A cluster pinned to an ImageCatalog carries no `spec.imageName` at all — the
+// operator resolves the image from the catalog and records it in `status.image`.
+// Reading spec alone leaves those clusters showing a dash where an image runs.
+function cnpgImage(resource: any): string {
+  return resource.spec?.imageName || resource.status?.image || ''
+}
+
 export function getCNPGClusterImage(resource: any): string {
-  return resource.spec?.imageName || '-'
+  return cnpgImage(resource) || '-'
 }
 
 export function getCNPGClusterImageTag(resource: any): string {
-  const image = resource.spec?.imageName || ''
+  const image = cnpgImage(resource)
   if (!image) return '-'
   const parts = image.split(':')
   if (parts.length > 1) return parts[parts.length - 1]
@@ -293,6 +300,12 @@ export function getCNPGClusterUpdateStrategy(resource: any): string {
 
 export const CNPG_BARMAN_PLUGIN_NAME = 'barman-cloud.cloudnative-pg.io'
 
+/** The API group ObjectStore is served under. `objectstores` is a generic
+ *  plural several operators ship, so every link to one has to be qualified —
+ *  an unqualified link resolves by plural alone and can land on a foreign CRD's
+ *  object of the same name. */
+export const CNPG_BARMAN_OBJECTSTORE_GROUP = 'barmancloud.cnpg.io'
+
 export interface CNPGBarmanPlugin {
   name: string
   /** ObjectStore CR (barmancloud.cnpg.io/v1) holding the real destination + recovery window. */
@@ -354,6 +367,180 @@ export function getCNPGClusterBackupConfig(resource: any): {
   }
 }
 
+// ============================================================================
+// DECLARATIVE OBJECTS — Database, Publication, Subscription
+// ============================================================================
+
+/**
+ * The three declarative kinds share one status shape: `applied` plus a
+ * `message`. The field has three meanings, not two — true, false, and absent —
+ * and absent is "the operator has not reconciled this yet", which is a
+ * different thing from failed. Collapsing them would report a freshly created
+ * object as broken.
+ */
+export function getCNPGDeclarativeStatus(resource: any): StatusBadge {
+  const applied = resource?.status?.applied
+  if (applied === true) return { text: 'Applied', color: healthColors.healthy, level: 'healthy' }
+  if (applied === false) return { text: 'Not Applied', color: healthColors.unhealthy, level: 'unhealthy' }
+  return { text: 'Pending', color: healthColors.unknown, level: 'unknown' }
+}
+
+/** The operator's own explanation for a failure. Never paraphrased. */
+export function getCNPGDeclarativeMessage(resource: any): string | undefined {
+  const m = resource?.status?.message
+  return typeof m === 'string' && m !== '' ? m : undefined
+}
+
+/**
+ * What happens in PostgreSQL when this CR is deleted.
+ *
+ * `delete` drops the real database, publication or subscription; `retain`
+ * leaves it. This is the difference between removing a manifest and losing
+ * data, so it is surfaced rather than left in the YAML. CNPG defaults to
+ * `retain` when unset.
+ */
+export function getCNPGReclaimPolicy(resource: any): { value: string; destructive: boolean } {
+  const spec = resource?.spec ?? {}
+  const raw =
+    spec.databaseReclaimPolicy ?? spec.publicationReclaimPolicy ?? spec.subscriptionReclaimPolicy ?? 'retain'
+  return { value: raw, destructive: String(raw).toLowerCase() === 'delete' }
+}
+
+/** The Cluster this object is declared against. */
+export function getCNPGDeclarativeCluster(resource: any): string | undefined {
+  const n = resource?.spec?.cluster?.name
+  return typeof n === 'string' && n !== '' ? n : undefined
+}
+
+export interface CNPGImageCatalogEntry {
+  major: number
+  image: string
+}
+
+/** Major-version pins, sorted so the list does not reshuffle between reads. */
+export function getCNPGImageCatalogEntries(resource: any): CNPGImageCatalogEntry[] {
+  const raw = resource?.spec?.images
+  if (!Array.isArray(raw)) return []
+  return raw
+    .filter((e: any) => typeof e?.image === 'string')
+    .map((e: any) => ({ major: Number(e.major), image: e.image as string }))
+    .sort((a, b) => a.major - b.major)
+}
+
+// ============================================================================
+// OBJECTSTORE (barmancloud.cnpg.io/v1) — the plugin-path backup destination
+// ============================================================================
+
+export const CNPG_BARMAN_GROUP = 'barmancloud.cnpg.io'
+
+/**
+ * The plugin that took (or will take) a Backup / ScheduledBackup, from
+ * `spec.pluginConfiguration`. Present only when `spec.method` is `plugin`; the
+ * in-tree path leaves it unset, so absence is meaningful rather than missing.
+ */
+export function getCNPGBackupPlugin(resource: any): { name: string; parameters?: Record<string, any> } | null {
+  if (resource?.spec?.method !== 'plugin') return null
+  const cfg = resource?.spec?.pluginConfiguration
+  if (!cfg?.name) return null
+  return { name: cfg.name, parameters: cfg.parameters }
+}
+
+/** True for a barman-cloud ObjectStore. The `objectstores` plural is generic
+ *  enough to belong to another operator, so kind alone is not enough. */
+export function isCNPGObjectStore(resource: any): boolean {
+  return typeof resource?.apiVersion === 'string' && resource.apiVersion.startsWith(`${CNPG_BARMAN_GROUP}/`)
+}
+
+/** Which cloud the credentials point at. Only the provider is reported — the
+ *  values are Secret references and never belong on screen. */
+export function getCNPGObjectStoreProvider(resource: any): string | undefined {
+  const c = resource?.spec?.configuration
+  if (!c) return undefined
+  if (c.s3Credentials) return 'S3'
+  if (c.azureCredentials) return 'Azure Blob Storage'
+  if (c.googleCredentials) return 'Google Cloud Storage'
+  return undefined
+}
+
+/**
+ * The Secret holding the destination's credentials, by name only.
+ *
+ * Named rather than read: the values never belong on screen, but "which Secret"
+ * is the first question when a backup fails on authentication, and a page that
+ * says only "S3" leaves nowhere to go.
+ */
+export function getCNPGObjectStoreCredentialSecret(resource: any): string | undefined {
+  const c = resource?.spec?.configuration
+  const ref =
+    c?.s3Credentials?.accessKeyId ??
+    c?.azureCredentials?.storageAccount ??
+    c?.azureCredentials?.connectionString ??
+    c?.googleCredentials?.applicationCredentials
+  return typeof ref?.name === 'string' && ref.name !== '' ? ref.name : undefined
+}
+
+export interface CNPGObjectStoreRecoveryWindow {
+  server: string
+  firstRecoverabilityPoint?: string
+  lastSuccessfulBackupTime?: string
+  lastFailedBackupTime?: string
+  /** A failure newer than the last success — the window has stopped advancing. */
+  failingSinceLastSuccess: boolean
+}
+
+/**
+ * The recovery window per PostgreSQL server, from
+ * `status.serverRecoveryWindow` — a map keyed by server name.
+ *
+ * This is the payload the Cluster page promises and cannot show: a
+ * plugin-backed Cluster publishes no recovery-point fields of its own, so this
+ * is the only place the restorable range exists.
+ */
+export function getCNPGObjectStoreRecoveryWindows(resource: any): CNPGObjectStoreRecoveryWindow[] {
+  const raw = resource?.status?.serverRecoveryWindow
+  if (!raw || typeof raw !== 'object') return []
+  return Object.entries(raw)
+    .map(([server, w]: [string, any]) => {
+      const lastSuccess = w?.lastSuccessfulBackupTime
+      const lastFailed = w?.lastFailedBackupTime
+      return {
+        server,
+        firstRecoverabilityPoint: w?.firstRecoverabilityPoint,
+        lastSuccessfulBackupTime: lastSuccess,
+        lastFailedBackupTime: lastFailed,
+        failingSinceLastSuccess:
+          !!lastFailed && (!lastSuccess || new Date(lastFailed) > new Date(lastSuccess)),
+      }
+    })
+    .sort((a, b) => a.server.localeCompare(b.server))
+}
+
+/**
+ * Health for the list badge.
+ *
+ * `unknown` rather than healthy when no server has reported: an ObjectStore
+ * with an empty status is configured but holds nothing restorable, and green
+ * there would assert a recovery point that does not exist.
+ */
+export function getCNPGObjectStoreStatus(resource: any): StatusBadge {
+  const windows = getCNPGObjectStoreRecoveryWindows(resource)
+  if (windows.length === 0) {
+    return { text: 'No backups yet', color: healthColors.unknown, level: 'unknown' }
+  }
+  if (windows.some((w) => w.failingSinceLastSuccess)) {
+    return { text: 'Backups Failing', color: healthColors.unhealthy, level: 'unhealthy' }
+  }
+  return { text: 'Recoverable', color: healthColors.healthy, level: 'healthy' }
+}
+
+export function getCNPGObjectStoreDestination(resource: any): string {
+  return resource?.spec?.configuration?.destinationPath || '-'
+}
+
+export function getCNPGObjectStoreRetention(resource: any): string | undefined {
+  return resource?.spec?.retentionPolicy
+}
+
 export function getCNPGClusterMonitoring(resource: any): {
   podMonitorEnabled: boolean
   customQueriesConfigMap?: string[]
@@ -576,6 +763,33 @@ export function getCNPGBackupTarget(resource: any): string {
 // CNPG SCHEDULED BACKUP UTILITIES
 // ============================================================================
 
+/**
+ * Reconcile latency between a backup coming due and the operator starting it.
+ * Not a backup policy — nothing here decides how often backups should run.
+ * Kept in step with the detector that raises the matching issue.
+ */
+const CNPG_SCHEDULED_BACKUP_GRACE_MS = 10 * 60 * 1000
+
+/**
+ * How far past its own next-run time this schedule is, or null when it is not
+ * meaningfully overdue.
+ *
+ * The expectation belongs to the operator: CNPG publishes `nextScheduleTime`
+ * and updates it whenever it runs a backup. A value still in the past therefore
+ * means no backup happened. Suspended schedules are excluded because the
+ * operator stops maintaining the field, so the stale value would read as missed
+ * on every deliberately paused schedule.
+ */
+export function getCNPGScheduledBackupOverdueMs(resource: any): number | null {
+  if (resource?.spec?.suspend === true) return null
+  const next = resource?.status?.nextScheduleTime
+  if (!next) return null
+  const dueAt = new Date(next).getTime()
+  if (Number.isNaN(dueAt)) return null
+  const overdue = Date.now() - dueAt
+  return overdue > CNPG_SCHEDULED_BACKUP_GRACE_MS ? overdue : null
+}
+
 export function getCNPGScheduledBackupStatus(resource: any): StatusBadge {
   const isSuspended = resource.spec?.suspend === true
 
@@ -583,6 +797,14 @@ export function getCNPGScheduledBackupStatus(resource: any): StatusBadge {
     return { text: 'Suspended', color: healthColors.neutral, level: 'neutral' }
   }
 
+  // The operator said when the next backup was due and it has not happened.
+  // Checked before lastScheduleTime: a schedule that ran once and then stopped
+  // has both, and reporting it healthy contradicted the next-run figure sitting
+  // on the same row.
+  if (getCNPGScheduledBackupOverdueMs(resource) !== null) {
+    return { text: 'Overdue', color: healthColors.degraded, level: 'degraded' }
+  }
+
   // If we have a last schedule time, it's active
   if (resource.status?.lastScheduleTime) {
     return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
@@ -615,10 +837,20 @@ export function getCNPGScheduledBackupLastSchedule(resource: any): string {
 export function getCNPGScheduledBackupNextSchedule(resource: any): string {
   const next = resource.status?.nextScheduleTime
   if (!next) return '-'
+  // A suspended schedule keeps whatever next-run time it had when it was
+  // paused, and the operator stops maintaining it. Counting down to it, or
+  // calling it due, would both describe a run that is not coming.
+  if (resource.spec?.suspend === true) return 'suspended'
   const nextDate = new Date(next)
   const now = new Date()
   const diffMs = nextDate.getTime() - now.getTime()
-  if (diffMs <= 0) return 'overdue'
+  // Past due, but inside the window where the operator has simply not picked it
+  // up yet. Calling that "overdue" while the badge still reads healthy is the
+  // contradiction this pair is meant to avoid.
+  if (diffMs <= 0) {
+    const overdue = getCNPGScheduledBackupOverdueMs(resource)
+    return overdue === null ? 'due now' : `overdue by ${formatDuration(overdue)}`
+  }
   return `in ${formatDuration(diffMs)}`
 }
 
@@ -767,3 +999,32 @@ export function getCNPGVolumeHealth(resource: any): CNPGVolumeHealth | null {
     health.initializing.length > 0
   return reportedAnything ? health : null
 }
+
+/**
+ * Splits declarative objects by what the operator has actually said about them.
+ *
+ * Three buckets, not two. `applied: true` is live. `applied: false` is a failure
+ * the operator can explain. ABSENT is not yet reconciled — and folding that in
+ * with the failures tells the reader an object "exists in Kubernetes and not in
+ * PostgreSQL" during the seconds before anything has looked at it.
+ */
+export function splitCNPGDeclarativeByApplied<T>(objects: T[]): {
+  applied: T[]
+  notApplied: T[]
+  pending: T[]
+} {
+  const out = { applied: [] as T[], notApplied: [] as T[], pending: [] as T[] }
+  for (const o of objects) {
+    switch (getCNPGDeclarativeStatus(o).level) {
+      case 'healthy':
+        out.applied.push(o)
+        break
+      case 'unhealthy':
+        out.notApplied.push(o)
+        break
+      default:
+        out.pending.push(o)
+    }
+  }
+  return out
+}

package/src/components/resources/resource-utils-kyverno-modern.ts

@@ -143,6 +143,30 @@ export function getKyvernoFailurePolicy(resource: any): string {
   return resource?.spec?.failurePolicy || ''
 }
 
+/**
+ * `spec.failurePolicy` with the CRD's own default applied.
+ *
+ * An ABSENT failurePolicy means Fail — "Allowed values are Ignore or Fail.
+ * Defaults to Fail", per the published schema, and most policies never set it.
+ * Reading absent as anything else inverts the consequence of an engine error:
+ * the screen would say those admissions are "allowed through unchecked" when the
+ * cluster is in fact rejecting them. Same defaulting trap as validationActions
+ * above, in the other direction.
+ *
+ * Kept separate from the raw reader so the Evaluation section can still show
+ * only what the policy actually declares.
+ */
+export function getKyvernoEffectiveFailurePolicy(resource: any): string {
+  return (
+    resource?.spec?.failurePolicy ||
+    // Where the legacy family keeps it since 1.13. Reading only the modern
+    // location would default a policy that explicitly set Ignore to Fail, and
+    // announce a rejection the cluster is not making.
+    resource?.spec?.webhookConfiguration?.failurePolicy ||
+    'Fail'
+  )
+}
+
 /**
  * Computes what the policy actually does, rather than echoing a single field.
  *