@skyhook-io/k8s-ui 1.12.0 → 1.13.0

package/src/components/resources/resource-utils-kyverno-queue.test.ts

@@ -0,0 +1,164 @@
+import { describe, it, expect } from 'vitest'
+import {
+  getKyvernoRequestType,
+  getKyvernoRequestTriggers,
+  getKyvernoRequestGenerated,
+  getKyvernoRequestState,
+  getKyvernoReportSubject,
+  getKyvernoReportSummary,
+  getKyvernoReportResults,
+  getKyvernoReportStatus,
+  kyvernoReportTimestamp,
+} from './resource-utils-kyverno-queue'
+
+/**
+ * The fixtures below are trimmed copies of objects captured with a watch on a
+ * live Kyverno 1.18.2 while a generateExisting rule and a mutate-existing rule
+ * ran: 251 UpdateRequests and 3322 EphemeralReports. Every assertion here
+ * exists because the obvious reading of the CRD produces a blank screen.
+ */
+
+const GENERATE_REQUEST = {
+  metadata: { name: 'ur-j8qjv', namespace: 'kyverno', labels: { 'generate.kyverno.io/policy-name': 'probe-generate-existing' } },
+  spec: {
+    policy: 'probe-generate-existing',
+    requestType: 'generate',
+    deleteDownstream: false,
+    // Both empty on every generate request observed.
+    resource: {},
+    rule: '',
+    ruleContext: [
+      { rule: 'companion-for-existing', deleteDownstream: false, trigger: { apiVersion: 'v1', kind: 'ConfigMap', name: 'bulk-001', namespace: 'policy-demo', uid: 'a' } },
+      { rule: 'companion-for-existing', deleteDownstream: false, trigger: { apiVersion: 'v1', kind: 'ConfigMap', name: 'bulk-002', namespace: 'policy-demo', uid: 'b' } },
+    ],
+  },
+  status: {
+    state: 'Completed',
+    generatedResources: [{ apiVersion: 'networking.k8s.io/v1', kind: 'NetworkPolicy', name: 'bulk-250-probe', namespace: 'policy-demo' }],
+  },
+}
+
+const MUTATE_REQUEST = {
+  metadata: { name: 'ur-2mhmq', namespace: 'kyverno' },
+  spec: {
+    policy: 'probe-mutate-existing',
+    requestType: 'mutate',
+    rule: 'label-existing-configmaps',
+    deleteDownstream: false,
+    resource: { apiVersion: 'v1', kind: 'ConfigMap', name: 'bulk-001', namespace: 'policy-demo', uid: 'a' },
+  },
+  status: { state: 'Completed' },
+}
+
+describe('UpdateRequest', () => {
+  it('reads triggers off ruleContext for a generate request', () => {
+    // spec.resource is {} here — reading it alone renders an empty page.
+    const t = getKyvernoRequestTriggers(GENERATE_REQUEST)
+    expect(t).toHaveLength(2)
+    expect(t[0].name).toBe('bulk-001')
+    expect(t[0].kind).toBe('ConfigMap')
+    expect(t[0].rule).toBe('companion-for-existing')
+  })
+
+  it('reads the single trigger off spec.resource for a mutate request', () => {
+    const t = getKyvernoRequestTriggers(MUTATE_REQUEST)
+    expect(t).toHaveLength(1)
+    expect(t[0].name).toBe('bulk-001')
+  })
+
+  it('reports no triggers rather than a blank row when neither is present', () => {
+    expect(getKyvernoRequestTriggers({ spec: { requestType: 'generate', resource: {}, ruleContext: [] } })).toEqual([])
+  })
+
+  it('distinguishes the two request types', () => {
+    expect(getKyvernoRequestType(GENERATE_REQUEST)).toBe('generate')
+    expect(getKyvernoRequestType(MUTATE_REQUEST)).toBe('mutate')
+    expect(getKyvernoRequestType({ spec: {} })).toBe('unknown')
+  })
+
+  it('lists what was created, and only on the request that creates', () => {
+    expect(getKyvernoRequestGenerated(GENERATE_REQUEST)).toHaveLength(1)
+    expect(getKyvernoRequestGenerated(MUTATE_REQUEST)).toEqual([])
+  })
+
+  // Pending is the state worth surfacing: work queued and never done.
+  it('separates queued from done from failed', () => {
+    expect(getKyvernoRequestState({ status: { state: 'Pending' } }).level).toBe('degraded')
+    expect(getKyvernoRequestState({ status: { state: 'Completed' } }).level).toBe('healthy')
+    expect(getKyvernoRequestState({ status: { state: 'Failed' } }).level).toBe('unhealthy')
+    expect(getKyvernoRequestState({}).level).toBe('unknown')
+  })
+})
+
+const REPORT = {
+  metadata: {
+    name: 'eae46cfc-2733-466c-b20a-f1a354b6f73b-7b47h',
+    namespace: 'kube-system',
+    labels: {
+      'audit.kyverno.io/resource.kind': 'Pod',
+      'audit.kyverno.io/resource.group': '',
+      'audit.kyverno.io/resource.version': 'v1',
+      'audit.kyverno.io/resource.uid': 'eae46cfc-2733-466c-b20a-f1a354b6f73b',
+      'audit.kyverno.io/source': 'background-scan',
+    },
+    ownerReferences: [{ apiVersion: 'v1', kind: 'Pod', name: 'coredns-7d764666f9-dl4p6', uid: 'eae46cfc' }],
+  },
+  spec: {
+    // Present and blank on every report observed.
+    owner: { apiVersion: '', kind: '', name: '', uid: '' },
+    summary: { error: 0, fail: 1, pass: 2, skip: 0, warn: 0 },
+    results: [
+      { message: 'mutation is not applied', policy: 'add-default-labels', result: 'fail', source: 'KyvernoMutatingPolicy', timestamp: { seconds: 1786622539, nanos: 0 } },
+    ],
+  },
+}
+
+describe('EphemeralReport', () => {
+  // spec.owner is the documented field and is useless; the owner reference is
+  // where the subject actually is.
+  it('takes the subject from the owner reference when spec.owner is blank', () => {
+    const s = getKyvernoReportSubject(REPORT)
+    expect(s?.kind).toBe('Pod')
+    expect(s?.name).toBe('coredns-7d764666f9-dl4p6')
+    expect(s?.namespace).toBe('kube-system')
+  })
+
+  it('falls back to the labels when the subject is already gone', () => {
+    const { ownerReferences, ...meta } = REPORT.metadata as any
+    const s = getKyvernoReportSubject({ ...REPORT, metadata: meta })
+    expect(s?.kind).toBe('Pod')
+    expect(s?.name).toBeUndefined()
+    expect(s?.apiVersion).toBe('v1')
+  })
+
+  it('prefers spec.owner when a future version starts filling it in', () => {
+    const s = getKyvernoReportSubject({
+      ...REPORT,
+      spec: { ...REPORT.spec, owner: { apiVersion: 'apps/v1', kind: 'Deployment', name: 'web', uid: 'x' } },
+    })
+    expect(s?.kind).toBe('Deployment')
+  })
+
+  // The findings live in spec, not status, which is the reverse of every other
+  // report-shaped object here.
+  it('reads results and summary out of spec', () => {
+    expect(getKyvernoReportResults(REPORT)).toHaveLength(1)
+    expect(getKyvernoReportResults({ status: { results: [{}] } })).toEqual([])
+    const s = getKyvernoReportSummary(REPORT)
+    expect(s).toMatchObject({ fail: 1, pass: 2, total: 3 })
+  })
+
+  it('reports the worst outcome for the list badge', () => {
+    expect(getKyvernoReportStatus(REPORT).level).toBe('unhealthy')
+    expect(getKyvernoReportStatus({ spec: { summary: { pass: 4 } } }).text).toBe('4 pass')
+    expect(getKyvernoReportStatus({ spec: {} }).text).toBe('No results')
+  })
+
+  // `new Date({seconds, nanos})` is Invalid Date, not an error.
+  it('converts the seconds/nanos timestamp rather than passing it to Date', () => {
+    expect(kyvernoReportTimestamp({ seconds: 1786622539, nanos: 0 })).toBe('2026-08-13T12:02:19.000Z')
+    expect(kyvernoReportTimestamp({ seconds: 0 })).toBeUndefined()
+    expect(kyvernoReportTimestamp(undefined)).toBeUndefined()
+    expect(kyvernoReportTimestamp('2026-08-13T09:22:19Z')).toBe('2026-08-13T09:22:19Z')
+  })
+})

package/src/components/resources/resource-utils-kyverno-queue.ts

@@ -0,0 +1,198 @@
+import { healthColors } from './resource-utils'
+import type { StatusBadge } from './resource-utils'
+
+/**
+ * UpdateRequest and EphemeralReport — Kyverno's two working records.
+ *
+ * Both are shaped differently from every other Kyverno object, and in ways the
+ * CRD schema does not warn about. Everything here was read off live objects
+ * captured with a watch on Kyverno 1.18.2 while the rules that produce them
+ * ran, rather than derived from the schema:
+ *
+ *   - A generate UpdateRequest leaves `spec.resource` EMPTY and `spec.rule` an
+ *     empty string. Its triggers live in `spec.ruleContext[].trigger`, and one
+ *     request can carry hundreds of them. A mutate UpdateRequest is the
+ *     opposite: `spec.resource` and `spec.rule` are populated and there is no
+ *     ruleContext at all.
+ *   - An EphemeralReport carries its findings in `spec`, not `status`, and its
+ *     `spec.owner` is present but blank — the subject is only in
+ *     `metadata.ownerReferences` and in the `audit.kyverno.io/resource.*`
+ *     labels.
+ *   - Report timestamps are `{seconds, nanos}` objects, not RFC 3339 strings.
+ */
+
+export type KyvernoRequestType = 'generate' | 'mutate' | 'unknown'
+
+export interface KyvernoTrigger {
+  apiVersion?: string
+  kind?: string
+  name?: string
+  namespace?: string
+  uid?: string
+  /** Whether deleting this trigger also deletes what the rule made for it. */
+  deleteDownstream: boolean
+  rule?: string
+}
+
+export function getKyvernoRequestType(resource: any): KyvernoRequestType {
+  const t = resource?.spec?.requestType
+  return t === 'generate' || t === 'mutate' ? t : 'unknown'
+}
+
+/**
+ * Every resource this request acts on.
+ *
+ * Reading `spec.resource` alone — the obvious field, and the only one the CRD
+ * documents as "the resource" — returns nothing at all for a generate request.
+ */
+export function getKyvernoRequestTriggers(resource: any): KyvernoTrigger[] {
+  const ctx = resource?.spec?.ruleContext
+  if (Array.isArray(ctx) && ctx.length > 0) {
+    return ctx
+      .map((c: any) => ({
+        ...(c?.trigger ?? {}),
+        deleteDownstream: c?.deleteDownstream === true,
+        rule: c?.rule,
+      }))
+      .filter((t: KyvernoTrigger) => !!t.name)
+  }
+  const r = resource?.spec?.resource
+  if (r?.name) {
+    return [{ ...r, deleteDownstream: resource?.spec?.deleteDownstream === true, rule: resource?.spec?.rule }]
+  }
+  return []
+}
+
+/** Resources the request has created so far. Absent on mutate requests. */
+export function getKyvernoRequestGenerated(resource: any): Array<{
+  apiVersion?: string
+  kind?: string
+  name?: string
+  namespace?: string
+}> {
+  const g = resource?.status?.generatedResources
+  return Array.isArray(g) ? g.filter((r: any) => !!r?.name) : []
+}
+
+/**
+ * State of the request.
+ *
+ * `Pending` is the one that matters: a request stuck there is generation that
+ * has silently stopped, which is the reason to look at this object at all.
+ */
+export function getKyvernoRequestState(resource: any): StatusBadge {
+  const state = resource?.status?.state
+  switch (state) {
+    case 'Completed':
+      return { text: 'Completed', color: healthColors.healthy, level: 'healthy' }
+    case 'Failed':
+      return { text: 'Failed', color: healthColors.unhealthy, level: 'unhealthy' }
+    case 'Pending':
+      return { text: 'Pending', color: healthColors.degraded, level: 'degraded' }
+    case 'Skip':
+      return { text: 'Skipped', color: healthColors.neutral, level: 'neutral' }
+    default:
+      return { text: state || 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  }
+}
+
+export function getKyvernoRequestPolicy(resource: any): string | undefined {
+  return resource?.spec?.policy || undefined
+}
+
+export function getKyvernoRequestMessage(resource: any): string | undefined {
+  const m = resource?.status?.message
+  return typeof m === 'string' && m !== '' ? m : undefined
+}
+
+// ============================================================================
+// EphemeralReport
+// ============================================================================
+
+export interface KyvernoReportSubject {
+  apiVersion?: string
+  kind?: string
+  name?: string
+  namespace?: string
+  uid?: string
+}
+
+/**
+ * The resource an EphemeralReport is about.
+ *
+ * `spec.owner` exists on every one of these and is blank on every one observed,
+ * so the owner reference is the real source and the labels are the fallback for
+ * a report whose owner has already been deleted.
+ */
+export function getKyvernoReportSubject(resource: any): KyvernoReportSubject | undefined {
+  const owner = resource?.spec?.owner
+  if (owner?.name) return owner
+
+  const ref = (resource?.metadata?.ownerReferences ?? [])[0]
+  if (ref?.name) {
+    return {
+      apiVersion: ref.apiVersion,
+      kind: ref.kind,
+      name: ref.name,
+      namespace: resource?.metadata?.namespace,
+      uid: ref.uid,
+    }
+  }
+
+  const labels = resource?.metadata?.labels ?? {}
+  const kind = labels['audit.kyverno.io/resource.kind']
+  if (!kind) return undefined
+  const group = labels['audit.kyverno.io/resource.group']
+  const version = labels['audit.kyverno.io/resource.version']
+  return {
+    apiVersion: group ? `${group}/${version}` : version,
+    kind,
+    namespace: resource?.metadata?.namespace,
+    uid: labels['audit.kyverno.io/resource.uid'],
+  }
+}
+
+/** How the report was produced — background scan or admission. */
+export function getKyvernoReportSource(resource: any): string | undefined {
+  return resource?.metadata?.labels?.['audit.kyverno.io/source'] || undefined
+}
+
+export function getKyvernoReportSummary(resource: any): {
+  pass: number
+  fail: number
+  warn: number
+  error: number
+  skip: number
+  total: number
+} {
+  const s = resource?.spec?.summary ?? {}
+  const n = (v: unknown) => (typeof v === 'number' ? v : 0)
+  const out = { pass: n(s.pass), fail: n(s.fail), warn: n(s.warn), error: n(s.error), skip: n(s.skip) }
+  return { ...out, total: out.pass + out.fail + out.warn + out.error + out.skip }
+}
+
+export function getKyvernoReportResults(resource: any): any[] {
+  const r = resource?.spec?.results
+  return Array.isArray(r) ? r : []
+}
+
+/**
+ * Report timestamps are `{seconds, nanos}`, and `new Date(...)` on that object
+ * yields Invalid Date rather than failing loudly.
+ */
+export function kyvernoReportTimestamp(ts: any): string | undefined {
+  if (typeof ts === 'string') return ts || undefined
+  const seconds = ts?.seconds
+  if (typeof seconds !== 'number' || seconds <= 0) return undefined
+  return new Date(seconds * 1000).toISOString()
+}
+
+/** List badge: worst outcome in the report, matching the PolicyReport columns. */
+export function getKyvernoReportStatus(resource: any): StatusBadge {
+  const s = getKyvernoReportSummary(resource)
+  if (s.total === 0) return { text: 'No results', color: healthColors.neutral, level: 'neutral' }
+  if (s.error > 0) return { text: `${s.error} error`, color: healthColors.alert, level: 'alert' }
+  if (s.fail > 0) return { text: `${s.fail} fail`, color: healthColors.unhealthy, level: 'unhealthy' }
+  if (s.warn > 0) return { text: `${s.warn} warn`, color: healthColors.degraded, level: 'degraded' }
+  return { text: `${s.pass} pass`, color: healthColors.healthy, level: 'healthy' }
+}

package/src/components/resources/resource-utils-kyverno.ts

@@ -115,14 +115,47 @@ export function getKyvernoPolicyStatus(resource: any): StatusBadge {
   return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
 }
 
+/** The rule blocks whose failure an admission request can be rejected for. */
+function rejectingActions(rule: any): string[] {
+  if (!rule) return []
+  const actions: string[] = []
+  if (rule.validate) actions.push(rule.validate.failureAction)
+  if (Array.isArray(rule.verifyImages)) {
+    for (const v of rule.verifyImages) actions.push(v?.failureAction)
+  }
+  return actions.filter(Boolean)
+}
+
+/**
+ * Whether this policy can REJECT an admission request, as Audit or Enforce.
+ *
+ * Three things make the obvious reading wrong. A rule-level failureAction
+ * OVERRIDES `spec.validationFailureAction` rather than deferring to it, so
+ * consulting the spec field first answers Audit for a policy whose rule
+ * enforces. Image verification carries its own failureAction on
+ * `verifyImages[]` rather than under `validate`, so a signing policy blocks
+ * without either of the fields the name suggests. And the spec field is
+ * defaulted to Audit when absent, so its presence proves nothing.
+ *
+ * Only validate and verifyImages rules can reject at all, so only they inherit
+ * the spec-level action — a mutate or generate rule sitting in the same policy
+ * would otherwise carry Enforce into a policy where nothing enforces.
+ *
+ * Rules can disagree, and one value has to stand for the whole policy. The
+ * question worth answering is whether anything here can reject, so any Enforce
+ * wins; the Rules section is where a mixed policy is read rule by rule.
+ */
 export function getKyvernoPolicyAction(resource: any): string {
-  // Check spec-level validationFailureAction (deprecated but still widely used)
-  const action = resource.spec?.validationFailureAction
-  if (action) return action
-  // Fallback: check first rule's validate.failureAction
+  const specAction = resource.spec?.validationFailureAction
   const rules = resource.spec?.rules || []
-  for (const rule of rules) {
-    if (rule.validate?.failureAction) return rule.validate.failureAction
+  if (rules.length === 0) return specAction || 'Audit'
+  const rejecting = rules.filter((rule: any) => rule?.validate || rule?.verifyImages)
+  // Rules, but none that can reject: the spec-level action governs nothing here.
+  if (rejecting.length === 0) return 'Audit'
+  for (const rule of rejecting) {
+    const overrides = rejectingActions(rule)
+    const effective = overrides.length > 0 ? overrides : [specAction]
+    if (effective.includes('Enforce')) return 'Enforce'
   }
   return 'Audit'
 }
@@ -184,7 +217,10 @@ export function getKyvernoPolicyRuleCountByType(resource: any): {
       validate: statusCount.validate ?? 0,
       mutate: statusCount.mutate ?? 0,
       generate: statusCount.generate ?? 0,
-      verifyImages: statusCount.verifyImages ?? 0,
+      // Kyverno writes this key all-lowercase (`verifyimages`), verified on
+      // 1.18.2. Reading the camelCase spelling alone returns 0 for every
+      // image-verification policy in existence.
+      verifyImages: statusCount.verifyImages ?? statusCount.verifyimages ?? 0,
     }
   }
 

package/src/components/resources/resource-utils-velero.test.ts

@@ -9,6 +9,7 @@ import {
   isVeleroResource,
   getScheduleCronInfo,
   getBackupRepositoryStatus,
+  resolveBackupStorageLocation,
 } from './resource-utils-velero'
 
 const backup = (phase: string, extra: Record<string, unknown> = {}) => ({
@@ -235,3 +236,28 @@ describe('getScheduleCronInfo', () => {
     expect(getScheduleCronInfo({ spec: {} })).toEqual({ cron: '-', readable: '', malformed: false })
   })
 })
+
+describe('which location holds a backup', () => {
+  const locations = [
+    { metadata: { name: 'primary' }, spec: { default: true } },
+    { metadata: { name: 'dr-replica' }, spec: { default: false } },
+  ]
+
+  it('uses the location the backup names', () => {
+    expect(resolveBackupStorageLocation({ spec: { storageLocation: 'dr-replica' } }, locations)).toBe('dr-replica')
+  })
+
+  // The rule Velero actually applies: the flag, not the name.
+  it('resolves an unset location through spec.default', () => {
+    expect(resolveBackupStorageLocation({ spec: {} }, locations)).toBe('primary')
+  })
+
+  // Velero's own fallback when nothing claims the flag.
+  it('falls back to the conventional name when no location is marked default', () => {
+    expect(resolveBackupStorageLocation({ spec: {} }, [{ metadata: { name: 'only' }, spec: {} }])).toBe('default')
+  })
+
+  it('falls back when the list has not been read', () => {
+    expect(resolveBackupStorageLocation({ spec: {} }, undefined)).toBe('default')
+  })
+})

package/src/components/resources/resource-utils-velero.ts

@@ -131,10 +131,34 @@ export function getBackupQueuePosition(resource: any): number | null {
   return typeof pos === 'number' ? pos : null
 }
 
+// The name a Backup carries, applying Velero's fallback by name only. Callers
+// that hold the location list should prefer resolveBackupStorageLocation, which
+// applies Velero's actual rule.
 export function getBackupStorageLocation(resource: any): string {
   return resource.spec?.storageLocation || 'default'
 }
 
+// Velero resolves an unset spec.storageLocation to whichever location carries
+// spec.default — a flag, not a name. The literal name "default" is only the
+// fallback when nothing claims the flag, and an install that renamed its
+// default location has no such object at all: the health lookup finds nothing
+// and the link points at a name that does not exist.
+//
+// Mirrors the server-side resolution behind the stored-backups endpoint so the
+// two cannot disagree about which location holds a backup.
+export function getVeleroDefaultLocationName(locations: any[] | undefined): string {
+  for (const l of locations ?? []) {
+    if (l?.spec?.default === true && l?.metadata?.name) return l.metadata.name
+  }
+  return ''
+}
+
+export function resolveBackupStorageLocation(resource: any, locations: any[] | undefined): string {
+  const declared = resource?.spec?.storageLocation
+  if (declared) return declared
+  return getVeleroDefaultLocationName(locations) || 'default'
+}
+
 export function getBackupIncludedNamespaces(resource: any): string[] {
   return resource.spec?.includedNamespaces || []
 }
@@ -196,6 +220,22 @@ export function getBackupTTL(resource: any): string {
   return resource.spec?.ttl || '-'
 }
 
+/**
+ * How long this backup allows a single operation before it has outlived its own
+ * budget. Shown because the stalled-run issue measures against this field and
+ * quotes it — without it on the page, the message cites a number from a spec
+ * option the page lists every sibling of.
+ *
+ * Unset renders as "default", the same word getBackupSnapshotVolumes uses for
+ * the same situation — not as a number. Velero's built-in is four hours, but the
+ * controller takes `--default-item-operation-timeout` and distributions ship
+ * their own, so printing 4h here would state an install setting nothing on this
+ * page can read.
+ */
+export function getBackupItemOperationTimeout(resource: any): string {
+  return resource.spec?.itemOperationTimeout || 'default'
+}
+
 export function getBackupSnapshotVolumes(resource: any): string {
   const val = resource.spec?.snapshotVolumes
   if (val === undefined || val === null) return 'default'
@@ -483,3 +523,31 @@ export function getBackupRepositoryStatus(resource: any): StatusBadge {
 export function getBackupRepositoryType(resource: any): string {
   return resource.spec?.repositoryType || '-'
 }
+
+// The namespace whose volumes this repository holds. One repository per
+// (namespace, location, type) is how Velero partitions them, so this is what
+// the repository is *for* rather than where the object lives.
+export function getBackupRepositoryVolumeNamespace(resource: any): string {
+  return resource.spec?.volumeNamespace || '-'
+}
+
+export function getBackupRepositoryLocation(resource: any): string {
+  return resource.spec?.backupStorageLocation || '-'
+}
+
+export function getBackupRepositoryMaintenanceFrequency(resource: any): string {
+  return resource.spec?.maintenanceFrequency || '-'
+}
+
+export function getBackupRepositoryLastMaintenance(resource: any): string {
+  const at = resource.status?.lastMaintenanceTime
+  if (!at) return '-'
+  return formatAge(at)
+}
+
+// Why the repository is not ready, in the controller's own words. Velero writes
+// it on the object and nowhere else, so without it the phase is the whole story
+// a reader gets.
+export function getBackupRepositoryMessage(resource: any): string {
+  return resource.status?.message || ''
+}

package/src/components/resources/resource-utils.ts

@@ -16,6 +16,7 @@ import { getBackupStatus as _getBackupStatus, getRestoreStatus as _getRestoreSta
 import { getExternalSecretStatus as _getExternalSecretStatus, getClusterExternalSecretStatus as _getClusterExternalSecretStatus, getSecretStoreStatus as _getSecretStoreStatus, getClusterSecretStoreStatus as _getClusterSecretStoreStatus, getSecretStoreProviderType as _getSecretStoreProviderType } from './resource-utils-eso'
 import { getHPATableState, hpaStatusFromState } from './resource-utils-hpa'
 import { getCNPGClusterStatus as _getCNPGClusterStatus, getCNPGBackupStatus as _getCNPGBackupStatus, getCNPGScheduledBackupStatus as _getCNPGScheduledBackupStatus, getCNPGPoolerStatus as _getCNPGPoolerStatus, isApiGroup as _isApiGroup, CNPG_GROUP as _CNPG_GROUP } from './resource-utils-cnpg'
+import { getCalicoIPPoolAllowedUses, getCalicoIPPoolBlockSize, getCalicoIPPoolEncapsulation, getCalicoPolicyNamespaceSelector, getCalicoPolicyServiceAccountSelector, getCalicoPolicyTypes, isCalicoApiVersion, isCalicoPolicyResource } from './resource-utils-calico'
 
 // ============================================================================
 // STATUS & HEALTH UTILITIES
@@ -1492,6 +1493,42 @@ export function getRolloutStatus(rollout: any): StatusBadge {
   }
 }
 
+export function getAnalysisRunStatus(run: any): StatusBadge {
+  const phase = run.status?.phase || 'Unknown'
+  switch (phase) {
+    case 'Successful':
+      return { text: 'Successful', color: healthColors.healthy, level: 'healthy' }
+    case 'Running':
+    case 'Pending':
+      return { text: phase, color: healthColors.degraded, level: 'degraded' }
+    case 'Inconclusive':
+      return { text: 'Inconclusive', color: healthColors.alert, level: 'alert' }
+    case 'Failed':
+    case 'Error':
+      return { text: phase, color: healthColors.unhealthy, level: 'unhealthy' }
+    default:
+      return { text: phase, color: healthColors.unknown, level: 'unknown' }
+  }
+}
+
+// Counts only verdict-bearing metrics: Argo excludes dryRun results from the run's
+// phase, and Running/Pending have not passed yet.
+export function summarizeAnalysisMetrics(run: any): {
+  total: number
+  passing: number
+  notPassing: number
+  dryRun: number
+} {
+  const results: any[] = run?.status?.metricResults || []
+  const scored = results.filter((m) => !m.dryRun)
+  return {
+    total: scored.length,
+    passing: scored.filter((m) => m.phase === 'Successful').length,
+    notPassing: scored.filter((m) => ['Failed', 'Error', 'Inconclusive'].includes(m.phase)).length,
+    dryRun: results.length - scored.length,
+  }
+}
+
 export function getRolloutStrategy(rollout: any): string {
   if (rollout.spec?.strategy?.canary) return 'Canary'
   if (rollout.spec?.strategy?.blueGreen) return 'BlueGreen'
@@ -2114,6 +2151,7 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'persistentvolumeclaims') return getPVCStatus(resource).text
       if (kindLower === 'persistentvolumes') return getPVStatus(resource).text
       if (kindLower === 'rollouts') return getRolloutStatus(resource).text
+      if (kindLower === 'analysisruns') return getAnalysisRunStatus(resource).text
       if (kindLower === 'workflows') return getWorkflowStatus(resource).text
       if (kindLower === 'cronworkflows') return getCronWorkflowStatus(resource).text
       if (kindLower === 'hpas' || kindLower === 'horizontalpodautoscalers') return getHPAStatus(resource).text
@@ -2200,7 +2238,67 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       return getServiceAccountAutomount(resource)
     case 'policyTypes':
       return getNetworkPolicyTypes(resource)
+    case 'types':
+      if (isCalicoPolicyResource(resource)) return getCalicoPolicyTypes(resource).join(', ')
+      break
+    case 'namespaceSelector':
+      if (isCalicoPolicyResource(resource)) return getCalicoPolicyNamespaceSelector(resource)
+      break
+    case 'serviceAccountSelector':
+      if (isCalicoPolicyResource(resource)) return getCalicoPolicyServiceAccountSelector(resource)
+      break
+    case 'tier':
+      if (isCalicoPolicyResource(resource)) return String(resource.spec?.tier ?? 'default')
+      break
+    case 'cidr':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.cidr ?? '')
+      break
+    case 'blockSize':
+      if (isCalicoApiVersion(resource?.apiVersion)) {
+        const size = getCalicoIPPoolBlockSize(resource)
+        return size === undefined ? '' : String(size)
+      }
+      break
+    case 'natOutgoing':
+      if (isCalicoApiVersion(resource?.apiVersion)) return resource.spec?.natOutgoing ? 'Yes' : 'No'
+      break
+    case 'nodeSelector':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.nodeSelector ?? 'all()')
+      break
+    case 'allowedUses':
+      if (isCalicoApiVersion(resource?.apiVersion)) return getCalicoIPPoolAllowedUses(resource)
+      break
+    case 'expectedIPs':
+      if (isCalicoApiVersion(resource?.apiVersion)) {
+        return Array.isArray(resource.spec?.expectedIPs) ? resource.spec.expectedIPs.map(String).join(', ') : ''
+      }
+      break
+    case 'profiles':
+      if (isCalicoApiVersion(resource?.apiVersion)) {
+        return Array.isArray(resource.spec?.profiles) ? resource.spec.profiles.map(String).join(', ') : ''
+      }
+      break
+    case 'encapsulation':
+      if (isCalicoApiVersion(resource?.apiVersion)) return getCalicoIPPoolEncapsulation(resource)
+      break
+    case 'disabled':
+      if (isCalicoApiVersion(resource?.apiVersion)) return resource.spec?.disabled === true ? 'Disabled' : 'No'
+      break
+    case 'interfaceName':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.interfaceName ?? '')
+      break
+    case 'defaultAction':
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.defaultAction ?? 'Deny')
+      break
+    case 'order':
+      if (isCalicoPolicyResource(resource) && resource.spec?.order !== undefined) return String(resource.spec.order)
+      break
+    case 'stagedAction':
+      if (isCalicoPolicyResource(resource)) return String(resource.spec?.stagedAction ?? '')
+      break
     case 'node':
+      // A Calico HostEndpoint names its node in spec.node; a Pod uses spec.nodeName.
+      if (isCalicoApiVersion(resource?.apiVersion)) return String(resource.spec?.node ?? '')
       return resource.spec?.nodeName || ''
     case 'version':
       if (kindLower === 'nodes') return getNodeVersion(resource)