@skyhook-io/k8s-ui 1.12.0 → 1.13.0

package/src/components/shared/ResourceRendererDispatch.tsx

@@ -10,6 +10,7 @@ import {
   getNodeStatus,
   getPVCStatus,
   getRolloutStatus,
+  getAnalysisRunStatus,
   getWorkflowStatus,
   getCronWorkflowStatus,
   getCertificateStatus,
@@ -51,6 +52,7 @@ import { getNodePoolStatus, getNodeClaimStatus, getEC2NodeClassStatus } from '..
 import { getScaledObjectStatus, getScaledJobStatus } from '../resources/resource-utils-keda'
 import { getServiceMonitorStatus, getPrometheusRuleStatus, getPodMonitorStatus } from '../resources/resource-utils-prometheus'
 import { getPolicyReportStatus, getKyvernoPolicyStatus } from '../resources/resource-utils-kyverno'
+import { getKyvernoRequestState, getKyvernoReportStatus } from '../resources/resource-utils-kyverno-queue'
 import {
   KYVERNO_MODERN_PLURALS,
   getModernKyvernoPolicyStatus,
@@ -63,7 +65,7 @@ import {
 } from '../resources/resource-utils-kyverno-exceptions'
 import { getResourceClaimStatus, getResourceClaimTemplateStatus, getDeviceClassStatus, getResourceSliceStatus } from '../resources/resource-utils-dra'
 import { getNvidiaClusterPolicyStatus, getNvidiaDriverStatus } from '../resources/resource-utils-nvidia'
-import { getBackupStatus, getRestoreStatus, getScheduleStatus, getBSLStatus, isVeleroResource } from '../resources/resource-utils-velero'
+import { getBackupStatus, getRestoreStatus, getScheduleStatus, getBSLStatus, getBackupRepositoryStatus, isVeleroResource } from '../resources/resource-utils-velero'
 import {
   getVirtualServiceStatus,
   getDestinationRuleStatus,
@@ -72,13 +74,19 @@ import {
   getPeerAuthenticationStatus,
   getAuthorizationPolicyStatus,
 } from '../resources/resource-utils-istio'
-import { getCNPGClusterStatus, getCNPGBackupStatus, getCNPGScheduledBackupStatus, getCNPGPoolerStatus, isApiGroup, CNPG_GROUP } from '../resources/resource-utils-cnpg'
+import { getCNPGClusterStatus, getCNPGBackupStatus, getCNPGScheduledBackupStatus, getCNPGPoolerStatus, getCNPGObjectStoreStatus, getCNPGDeclarativeStatus, isApiGroup, CNPG_GROUP } from '../resources/resource-utils-cnpg'
 import { getExternalSecretStatus, getClusterExternalSecretStatus, getSecretStoreStatus, getClusterSecretStoreStatus } from '../resources/resource-utils-eso'
 import {
   getKnativeConditionStatus,
   getRevisionStatus,
 } from '../resources/resource-utils-knative'
 import { getHTTPProxyStatus } from '../resources/resource-utils-contour'
+import {
+  isCalicoApiVersion,
+  isCalicoPolicyKind,
+  isCalicoStagedKubernetesNetworkPolicyKind,
+  isCoreNetworkPolicyKind,
+} from '../resources/resource-utils-calico'
 import { getClusterStatus as getCAPIClusterStatus, getMachineStatus, getMachineDeploymentStatus, getMachineSetStatus, getMachinePoolStatus, getKCPStatus, getClusterClassStatus, getMachineHealthCheckStatus } from '../resources/resource-utils-capi'
 import { getAWSMCPStatus, getAWSMMPStatus, getAWSMachineStatus, getAWSManagedClusterStatus } from '../resources/resource-utils-aws-capi'
 import { getGCPMCPStatus, getGCPMMPStatus, getGCPMachineStatus, getGCPManagedClusterStatus } from '../resources/resource-utils-gcp-capi'
@@ -98,6 +106,7 @@ import {
   NodeRenderer,
   PVCRenderer,
   RolloutRenderer,
+  AnalysisRunRenderer,
   CertificateRenderer,
   WorkflowRenderer,
   PersistentVolumeRenderer,
@@ -155,12 +164,22 @@ import {
   KyvernoMutatingPolicyRenderer,
   KyvernoGeneratingPolicyRenderer,
   KyvernoDeletingPolicyRenderer,
+  CNPGObjectStoreRenderer,
+  CNPGDatabaseRenderer,
+  CNPGPublicationRenderer,
+  CNPGSubscriptionRenderer,
+  CNPGImageCatalogRenderer,
+  KyvernoGlobalContextRenderer,
+  KyvernoUpdateRequestRenderer,
+  KyvernoEphemeralReportRenderer,
+  getKyvernoGlobalContextStatus,
   KyvernoPolicyExceptionRenderer,
   KyvernoCleanupPolicyRenderer,
   VeleroBackupRenderer,
   VeleroRestoreRenderer,
   VeleroScheduleRenderer,
   VeleroBSLRenderer,
+  VeleroBackupRepositoryRenderer,
   VeleroVSLRenderer,
   CNPGClusterRenderer,
   CNPGBackupRenderer,
@@ -239,6 +258,10 @@ import {
   ResourceSliceRenderer,
   NvidiaClusterPolicyRenderer,
   NvidiaDriverRenderer,
+  CalicoHostEndpointRenderer,
+  CalicoIPPoolRenderer,
+  CalicoNetworkPolicyRenderer,
+  CalicoTierRenderer,
 } from '../resources/renderers'
 import type { ComposedRefStatus } from '../resources/renderers/CompositeRenderer'
 import {
@@ -295,6 +318,48 @@ export interface RendererOverrides {
     onNavigate?: (ref: ResourceRef) => void
     composedRefStatuses?: Map<string, ComposedRefStatus>
   }>
+  // CNPG Publication / Subscription: the host resolves the PostgreSQL-side
+  // names in their spec back to the CRs that declare them. Database and
+  // ImageCatalog get the reverse lookup, which the API only models one way.
+  CNPGImageCatalogRenderer?: React.ComponentType<{ data: any; onNavigate?: (ref: ResourceRef) => void }>
+  CNPGDatabaseRenderer?: React.ComponentType<{ data: any; onNavigate?: (ref: ResourceRef) => void }>
+  CNPGPublicationRenderer?: React.ComponentType<{ data: any; onNavigate?: (ref: ResourceRef) => void }>
+  CNPGSubscriptionRenderer?: React.ComponentType<{ data: any; onNavigate?: (ref: ResourceRef) => void }>
+  // CNPG Cluster: the host wraps it to add the reverse lookup of declarative
+  // objects, which needs three list fetches.
+  CNPGClusterRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  // CNPG ObjectStore: the host wraps the package renderer to add the reverse
+  // lookup (which Clusters back up here), which needs a Cluster list fetch.
+  CNPGObjectStoreRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  /** Host-injected: adds the Backups-stored-here lookup to a storage location. */
+  VeleroBSLRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  /** Host-injected: adds the storage location's health to a backup, and the
+   *  on-demand fetch for the messages behind its error/warning counts. */
+  VeleroBackupRenderer?: React.ComponentType<{ data: any; onNavigate?: (ref: ResourceRef) => void }>
+  /** Host-injected: adds the on-demand fetch for the messages behind a
+   *  restore's error and warning counts. */
+  VeleroRestoreRenderer?: React.ComponentType<{ data: any; onNavigate?: (ref: ResourceRef) => void }>
+  // Kyverno policy coverage: the host fetches /api/policy/policies/... and
+  // renders the section, which the policy renderers accept as a slot. One
+  // override serves all six policy renderers — they differ in what the policy
+  // declares, not in what its results look like.
+  KyvernoPolicyCoverage?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  // Work a generate / mutate-existing policy has queued and not finished. The
+  // requests have their own page; the count belongs here because the failure
+  // this catches is a backlog, and nobody watches a page that is usually empty.
+  KyvernoPolicyQueued?: React.ComponentType<{ data: any }>
   // ServiceAccount reverse-lookup: the host fetches /api/rbac/subject/... and
   // feeds the result into the base renderer via this wrapper.
   ServiceAccountRenderer?: React.ComponentType<{
@@ -334,6 +399,12 @@ export interface RendererOverrides {
     data: any
     onNavigate?: (ref: ResourceRef) => void
   }>
+  // Rollout: host probes /api/rollouts/.../capabilities and wires the
+  // promote / abort / skip-step mutations into the action row.
+  RolloutRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
 }
 
 // Known resource types with specific renderers (module-level to avoid re-allocation)
@@ -341,11 +412,15 @@ const KNOWN_KINDS = new Set([
   'pods', 'deployments', 'statefulsets', 'daemonsets', 'replicasets',
   'services', 'endpointslices', 'ingresses', 'configmaps', 'secrets', 'jobs', 'cronjobs', 'cronworkflows',
   'hpas', 'horizontalpodautoscalers', 'nodes', 'persistentvolumeclaims',
-  'rollouts', 'certificates', 'workflows', 'persistentvolumes',
+  'rollouts', 'analysisruns', 'certificates', 'workflows', 'persistentvolumes',
   'storageclasses', 'certificaterequests', 'clusterissuers', 'issuers',
   'orders', 'challenges',
   'gateways', 'gatewayclasses', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes', 'sealedsecrets', 'workflowtemplates', 'clusterworkflowtemplates',
   'networkpolicies', 'networkpolicy',
+  'globalnetworkpolicies', 'globalnetworkpolicy',
+  'stagednetworkpolicies', 'stagednetworkpolicy',
+  'stagedglobalnetworkpolicies', 'stagedglobalnetworkpolicy',
+  'stagedkubernetesnetworkpolicies', 'stagedkubernetesnetworkpolicy',
   'ciliumnetworkpolicies', 'ciliumnetworkpolicy', 'ciliumclusterwidenetworkpolicies', 'ciliumclusterwidenetworkpolicy',
   'clusternetworkpolicies', 'clusternetworkpolicy',
   'poddisruptionbudgets', 'serviceaccounts', 'namespaces',
@@ -356,6 +431,10 @@ const KNOWN_KINDS = new Set([
   'triggerauthentications', 'clustertriggerauthentications',
   'servicemonitors', 'prometheusrules', 'podmonitors',
   'policyreports', 'clusterpolicyreports', 'kyvernopolicies', 'clusterpolicies',
+  // The API serves the legacy namespaced kind as `policies`. `kyvernopolicies`
+  // is Radar's internal alias for it and is NOT a servable plural, so a URL
+  // built from it 400s — the drawer has to know the real one.
+  'policies',
   // Kyverno modern CEL family (policies.kyverno.io) + its namespaced twins.
   'validatingpolicies', 'namespacedvalidatingpolicies',
   'imagevalidatingpolicies', 'namespacedimagevalidatingpolicies',
@@ -365,14 +444,18 @@ const KNOWN_KINDS = new Set([
   'policyexceptions', 'cleanuppolicies', 'clustercleanuppolicies',
   'resourceclaims', 'resourceclaimtemplates', 'deviceclasses', 'resourceslices',
   'nvidiadrivers',
+  'hostendpoints', 'ippools', 'tiers',
   'vulnerabilityreports', 'configauditreports', 'exposedsecretreports',
   'rbacassessmentreports', 'clusterrbacassessmentreports',
   'clustercompliancereports', 'sbomreports', 'clustersbomreports',
   'infraassessmentreports', 'clusterinfraassessmentreports',
   'verticalpodautoscalers',
   'backups', 'restores', 'schedules', 'backupstoragelocations', 'volumesnapshotlocations',
+  'backuprepositories',
   'externalsecrets', 'clusterexternalsecrets', 'secretstores', 'clustersecretstores',
-  'clusters', 'scheduledbackups', 'poolers',
+  'clusters', 'scheduledbackups', 'poolers', 'objectstores',
+  'globalcontextentries', 'updaterequests', 'ephemeralreports', 'clusterephemeralreports',
+  'databases', 'publications', 'imagecatalogs', 'clusterimagecatalogs',
   'virtualservices', 'destinationrules', 'serviceentries',
   'peerauthentications', 'authorizationpolicies',
   'mutatingwebhookconfigurations', 'validatingwebhookconfigurations',
@@ -544,6 +627,7 @@ export function ResourceRendererDispatch({
   const isVeleroCollisionGatedKind =
     kind === 'restores' || kind === 'schedules'
     || kind === 'backupstoragelocations' || kind === 'volumesnapshotlocations'
+    || kind === 'backuprepositories'
   const veleroCollisionFallthrough = isVeleroCollisionGatedKind && !isVeleroResource(data)
 
   // Same rule as the Crossplane block above, for the plurals shared by two
@@ -551,15 +635,43 @@ export function ResourceRendererDispatch({
   // and friends in the wild) and `backups` (CNPG / Velero). Both render lines
   // are positively apiVersion-gated, so a third CRD with the plural matches
   // neither and needs an explicit fall-through or the drawer renders blank.
+  //
+  // The CNPG declarative kinds and the barman-cloud ObjectStore extend the same
+  // list: `databases`, `publications` and `subscriptions` are shipped by several
+  // database operators, `objectstores` is a generic enough plural for any of
+  // them, and `subscriptions` is Knative's as well. Adding a kind to KNOWN_KINDS
+  // with a positively-gated render line and forgetting this list is what makes a
+  // foreign CRD render a BLANK drawer rather than the generic one.
   const isGroupGatedKind =
     kind === 'clusters' || kind === 'backups' || kind === 'scheduledbackups' || kind === 'poolers'
+    || kind === 'objectstores' || kind === 'databases' || kind === 'publications'
+    || kind === 'subscriptions' || kind === 'imagecatalogs' || kind === 'clusterimagecatalogs'
+    || kind === 'policies'
   const isCNPGApiVersion = isApiGroup(data?.apiVersion, CNPG_GROUP)
   const groupGatedMatched =
     (kind === 'clusters' && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'cluster.x-k8s.io')))
     || (kind === 'backups' && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'velero.io')))
     || ((kind === 'scheduledbackups' || kind === 'poolers') && isCNPGApiVersion)
+    || (kind === 'objectstores' && isApiGroup(data?.apiVersion, 'barmancloud.cnpg.io'))
+    || ((kind === 'databases' || kind === 'publications' || kind === 'imagecatalogs'
+      || kind === 'clusterimagecatalogs') && isCNPGApiVersion)
+    || (kind === 'subscriptions'
+      && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'messaging.knative.dev')))
+    || (kind === 'policies' && isApiGroup(data?.apiVersion, 'kyverno.io'))
   const groupGatedFallthrough = isGroupGatedKind && !groupGatedMatched
 
+  const calicoApiVersionMatched = isCalicoApiVersion(data?.apiVersion)
+  const isCalicoPolicy = isCalicoPolicyKind(kind) && calicoApiVersionMatched
+  const isCalicoStagedKubernetesPolicy =
+    isCalicoPolicy && isCalicoStagedKubernetesNetworkPolicyKind(kind)
+  const isCoreNetworkPolicy = isCoreNetworkPolicyKind(kind, data?.apiVersion, resource.group)
+  const isCalicoHostEndpoint = kind === 'hostendpoints' && calicoApiVersionMatched
+  const isCalicoIPPool = kind === 'ippools' && calicoApiVersionMatched
+  const isCalicoTier = kind === 'tiers' && calicoApiVersionMatched
+  const calicoCollisionFallthrough = (
+    isCalicoPolicyKind(kind) || kind === 'hostendpoints' || kind === 'ippools' || kind === 'tiers'
+  ) && !isCoreNetworkPolicy && !((isCalicoPolicy || isCalicoHostEndpoint || isCalicoIPPool || isCalicoTier))
+
   const isKnownKind = KNOWN_KINDS.has(kind) || isCrossplaneMR || isCrossplaneClaim || isCrossplaneXR
 
   const PodComp = rendererOverrides?.PodRenderer ?? PodRenderer
@@ -568,12 +680,28 @@ export function ResourceRendererDispatch({
   const NodeComp = rendererOverrides?.NodeRenderer ?? NodeRenderer
   const ServiceComp = rendererOverrides?.ServiceRenderer ?? ServiceRenderer
   const CompositeComp = rendererOverrides?.CompositeRenderer ?? CompositeRenderer
+  const CNPGClusterComp = rendererOverrides?.CNPGClusterRenderer ?? CNPGClusterRenderer
+  const CNPGImageCatalogComp = rendererOverrides?.CNPGImageCatalogRenderer ?? CNPGImageCatalogRenderer
+  const CNPGDatabaseComp = rendererOverrides?.CNPGDatabaseRenderer ?? CNPGDatabaseRenderer
+  const CNPGPublicationComp = rendererOverrides?.CNPGPublicationRenderer ?? CNPGPublicationRenderer
+  const CNPGSubscriptionComp = rendererOverrides?.CNPGSubscriptionRenderer ?? CNPGSubscriptionRenderer
+  const CNPGObjectStoreComp = rendererOverrides?.CNPGObjectStoreRenderer ?? CNPGObjectStoreRenderer
+  const VeleroBSLComp = rendererOverrides?.VeleroBSLRenderer ?? VeleroBSLRenderer
+  const VeleroBackupComp = rendererOverrides?.VeleroBackupRenderer ?? VeleroBackupRenderer
+  const VeleroRestoreComp = rendererOverrides?.VeleroRestoreRenderer ?? VeleroRestoreRenderer
+  const KyvernoCoverageComp = rendererOverrides?.KyvernoPolicyCoverage
+  const kyvernoCoverage = KyvernoCoverageComp ? (
+    <KyvernoCoverageComp data={data} onNavigate={onNavigate} />
+  ) : undefined
+  const KyvernoQueuedComp = rendererOverrides?.KyvernoPolicyQueued
+  const kyvernoQueued = KyvernoQueuedComp ? <KyvernoQueuedComp data={data} /> : undefined
   const ServiceAccountComp = rendererOverrides?.ServiceAccountRenderer ?? ServiceAccountRenderer
   const RoleComp = rendererOverrides?.RoleRenderer ?? RoleRenderer
   const RoleBindingComp = rendererOverrides?.RoleBindingRenderer ?? RoleBindingRenderer
   const NamespaceComp = rendererOverrides?.NamespaceRenderer ?? NamespaceRenderer
   const HPAComp = rendererOverrides?.HPARenderer ?? HPARenderer
   const PVCComp = rendererOverrides?.PVCRenderer ?? PVCRenderer
+  const RolloutComp = rendererOverrides?.RolloutRenderer ?? RolloutRenderer
   const scaleBlockedBy = replicaScalers(relationships?.scalers)
 
   const sidebarContent = showCommonSections && (
@@ -613,7 +741,8 @@ export function ResourceRendererDispatch({
         {(kind === 'hpas' || kind === 'horizontalpodautoscalers') && <HPAComp data={data} onNavigate={onNavigate} hpaDiagnosis={hpaDiagnosis} />}
         {kind === 'nodes' && <NodeComp data={data} relationships={relationships} />}
         {kind === 'persistentvolumeclaims' && <PVCComp data={data} onNavigate={onNavigate} />}
-        {kind === 'rollouts' && <RolloutRenderer data={data} />}
+        {kind === 'rollouts' && <RolloutComp data={data} onNavigate={onNavigate} />}
+        {kind === 'analysisruns' && <AnalysisRunRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'certificates' && !data?.apiVersion?.includes('networking.internal.knative.dev') && <CertificateRenderer data={data} />}
         {kind === 'workflows' && <WorkflowRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'persistentvolumes' && <PersistentVolumeRenderer data={data} onNavigate={onNavigate} />}
@@ -631,7 +760,9 @@ export function ResourceRendererDispatch({
         {kind === 'tlsroutes' && <SimpleRouteRenderer data={data} kind="TLSRoute" onNavigate={onNavigate} />}
         {kind === 'sealedsecrets' && <SealedSecretRenderer data={data} onNavigate={onNavigate} />}
         {(kind === 'workflowtemplates' || kind === 'clusterworkflowtemplates') && <WorkflowTemplateRenderer data={data} />}
-        {(kind === 'networkpolicies' || kind === 'networkpolicy') && <NetworkPolicyRenderer data={data} />}
+        {isCoreNetworkPolicy && <NetworkPolicyRenderer data={data} />}
+        {isCalicoStagedKubernetesPolicy && <NetworkPolicyRenderer data={data} staged />}
+        {isCalicoPolicy && !isCalicoStagedKubernetesPolicy && <CalicoNetworkPolicyRenderer data={data} onNavigate={onNavigate} />}
         {(kind === 'ciliumnetworkpolicies' || kind === 'ciliumnetworkpolicy' || kind === 'ciliumclusterwidenetworkpolicies' || kind === 'ciliumclusterwidenetworkpolicy') && <CiliumNetworkPolicyRenderer data={data} />}
         {(kind === 'clusternetworkpolicies' || kind === 'clusternetworkpolicy') && <ClusterNetworkPolicyRenderer data={data} />}
         {kind === 'poddisruptionbudgets' && <PodDisruptionBudgetRenderer data={data} />}
@@ -664,33 +795,47 @@ export function ResourceRendererDispatch({
         {kind === 'prometheusrules' && <PrometheusRuleRenderer data={data} />}
         {kind === 'podmonitors' && <PodMonitorRenderer data={data} />}
         {(kind === 'policyreports' || kind === 'clusterpolicyreports') && <PolicyReportRenderer data={data} />}
-        {(kind === 'kyvernopolicies' || (kind === 'clusterpolicies' && !data?.apiVersion?.startsWith('nvidia.com/'))) && <KyvernoPolicyRenderer data={data} />}
+        {(kind === 'kyvernopolicies'
+          || (kind === 'policies' && isApiGroup(data?.apiVersion, 'kyverno.io'))
+          || (kind === 'clusterpolicies' && !data?.apiVersion?.startsWith('nvidia.com/'))) && <KyvernoPolicyRenderer data={data} coverage={kyvernoCoverage} queued={kyvernoQueued} />}
         {(kind === 'clusterpolicies' && data?.apiVersion?.startsWith('nvidia.com/')) && <NvidiaClusterPolicyRenderer data={data} />}
         {/* Kyverno modern CEL family. Each Namespaced* twin shares its
             cluster-scoped counterpart's renderer — same spec, narrower scope. */}
-        {kyvernoModernMatched && (kind === 'validatingpolicies' || kind === 'namespacedvalidatingpolicies') && <KyvernoValidatingPolicyRenderer data={data} />}
-        {kyvernoModernMatched && (kind === 'imagevalidatingpolicies' || kind === 'namespacedimagevalidatingpolicies') && <KyvernoImageValidatingPolicyRenderer data={data} />}
-        {kyvernoModernMatched && (kind === 'mutatingpolicies' || kind === 'namespacedmutatingpolicies') && <KyvernoMutatingPolicyRenderer data={data} />}
-        {kyvernoModernMatched && (kind === 'generatingpolicies' || kind === 'namespacedgeneratingpolicies') && <KyvernoGeneratingPolicyRenderer data={data} />}
-        {kyvernoModernMatched && (kind === 'deletingpolicies' || kind === 'namespaceddeletingpolicies') && <KyvernoDeletingPolicyRenderer data={data} />}
+        {kyvernoModernMatched && (kind === 'validatingpolicies' || kind === 'namespacedvalidatingpolicies') && <KyvernoValidatingPolicyRenderer data={data} coverage={kyvernoCoverage} />}
+        {kyvernoModernMatched && (kind === 'imagevalidatingpolicies' || kind === 'namespacedimagevalidatingpolicies') && <KyvernoImageValidatingPolicyRenderer data={data} coverage={kyvernoCoverage} />}
+        {kyvernoModernMatched && (kind === 'mutatingpolicies' || kind === 'namespacedmutatingpolicies') && <KyvernoMutatingPolicyRenderer data={data} coverage={kyvernoCoverage} />}
+        {kyvernoModernMatched && (kind === 'generatingpolicies' || kind === 'namespacedgeneratingpolicies') && <KyvernoGeneratingPolicyRenderer data={data} coverage={kyvernoCoverage} />}
+        {kyvernoModernMatched && (kind === 'deletingpolicies' || kind === 'namespaceddeletingpolicies') && <KyvernoDeletingPolicyRenderer data={data} coverage={kyvernoCoverage} />}
+        {kind === 'globalcontextentries' && <KyvernoGlobalContextRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'updaterequests' && <KyvernoUpdateRequestRenderer data={data} onNavigate={onNavigate} />}
+        {(kind === 'ephemeralreports' || kind === 'clusterephemeralreports') && <KyvernoEphemeralReportRenderer data={data} onNavigate={onNavigate} />}
         {policyExceptionMatched && <KyvernoPolicyExceptionRenderer data={data} />}
         {kyvernoLegacyExtraMatched && <KyvernoCleanupPolicyRenderer data={data} />}
         {kind === 'nvidiadrivers' && <NvidiaDriverRenderer data={data} />}
+        {isCalicoHostEndpoint && <CalicoHostEndpointRenderer data={data} onNavigate={onNavigate} />}
+        {isCalicoIPPool && <CalicoIPPoolRenderer data={data} />}
+        {isCalicoTier && <CalicoTierRenderer data={data} />}
         {/* DRA (resource.k8s.io) */}
         {kind === 'resourceclaims' && <ResourceClaimRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'resourceclaimtemplates' && <ResourceClaimTemplateRenderer data={data} />}
         {kind === 'deviceclasses' && <DeviceClassRenderer data={data} />}
         {kind === 'resourceslices' && <ResourceSliceRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'objectstores' && isApiGroup(data.apiVersion, 'barmancloud.cnpg.io') && <CNPGObjectStoreComp data={data} onNavigate={onNavigate} />}
+        {kind === 'databases' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGDatabaseComp data={data} onNavigate={onNavigate} />}
+        {kind === 'publications' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGPublicationComp data={data} onNavigate={onNavigate} />}
+        {kind === 'subscriptions' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGSubscriptionComp data={data} onNavigate={onNavigate} />}
+        {(kind === 'imagecatalogs' || kind === 'clusterimagecatalogs') && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGImageCatalogComp data={data} onNavigate={onNavigate} />}
         {kind === 'backups' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGBackupRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'backups' && isApiGroup(data.apiVersion, 'velero.io') && <VeleroBackupRenderer data={data} />}
-        {kind === 'restores' && isVeleroResource(data) && <VeleroRestoreRenderer data={data} />}
-        {kind === 'schedules' && isVeleroResource(data) && <VeleroScheduleRenderer data={data} />}
-        {kind === 'backupstoragelocations' && isVeleroResource(data) && <VeleroBSLRenderer data={data} />}
+        {kind === 'backups' && isApiGroup(data.apiVersion, 'velero.io') && <VeleroBackupComp data={data} onNavigate={onNavigate} />}
+        {kind === 'restores' && isVeleroResource(data) && <VeleroRestoreComp data={data} onNavigate={onNavigate} />}
+        {kind === 'schedules' && isVeleroResource(data) && <VeleroScheduleRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'backupstoragelocations' && isVeleroResource(data) && <VeleroBSLComp data={data} onNavigate={onNavigate} />}
+        {kind === 'backuprepositories' && isVeleroResource(data) && <VeleroBackupRepositoryRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'volumesnapshotlocations' && isVeleroResource(data) && <VeleroVSLRenderer data={data} />}
         {kind === 'externalsecrets' && <ExternalSecretRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'clusterexternalsecrets' && <ClusterExternalSecretRenderer data={data} onNavigate={onNavigate} />}
         {(kind === 'secretstores' || kind === 'clustersecretstores') && <SecretStoreRenderer data={data} />}
-        {kind === 'clusters' && isApiGroup(data?.apiVersion, CNPG_GROUP) && <CNPGClusterRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'clusters' && isApiGroup(data?.apiVersion, CNPG_GROUP) && <CNPGClusterComp data={data} onNavigate={onNavigate} />}
         {kind === 'clusters' && isApiGroup(data?.apiVersion, 'cluster.x-k8s.io') && <CAPIClusterRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'scheduledbackups' && isApiGroup(data?.apiVersion, CNPG_GROUP) && <CNPGScheduledBackupRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'poolers' && isApiGroup(data?.apiVersion, CNPG_GROUP) && <CNPGPoolerRenderer data={data} onNavigate={onNavigate} />}
@@ -757,7 +902,9 @@ export function ResourceRendererDispatch({
         {kind === 'eventtypes' && <EventTypeRenderer data={data} />}
         {kind === 'channels' && <ChannelRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'inmemorychannels' && <InMemoryChannelRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'subscriptions' && <SubscriptionRenderer data={data} onNavigate={onNavigate} />}
+        {/* Group-guarded: CNPG serves a `subscriptions` plural too, and without
+            this an unrelated PostgreSQL Subscription rendered Knative's sections. */}
+        {kind === 'subscriptions' && isApiGroup(data.apiVersion, 'messaging.knative.dev') && <SubscriptionRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'sequences' && <SequenceRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'parallels' && <ParallelRenderer data={data} onNavigate={onNavigate} />}
 
@@ -787,7 +934,7 @@ export function ResourceRendererDispatch({
             for known-plural collisions where no apiVersion-gated renderer
             matched (e.g. a Knative Configuration sharing the `configurations`
             plural with Crossplane Configuration). */}
-        {(!isKnownKind || crossplaneCollisionFallthrough || kyvernoCollisionFallthrough || veleroCollisionFallthrough || groupGatedFallthrough) && <GenericRenderer data={data} />}
+        {(!isKnownKind || crossplaneCollisionFallthrough || kyvernoCollisionFallthrough || veleroCollisionFallthrough || groupGatedFallthrough || calicoCollisionFallthrough) && <GenericRenderer data={data} />}
 
         {/* Common sections - can be disabled when parent handles them separately */}
         {showCommonSections && (
@@ -865,6 +1012,7 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
   if (k === 'nodes') return getNodeStatus(data)
   if (k === 'persistentvolumeclaims') return getPVCStatus(data)
   if (k === 'rollouts') return getRolloutStatus(data)
+  if (k === 'analysisruns') return getAnalysisRunStatus(data)
   if (k === 'workflows') return getWorkflowStatus(data)
   if (k === 'cronworkflows') return getCronWorkflowStatus(data)
   if (k === 'certificates') {
@@ -910,7 +1058,8 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
   if (k === 'clustercompliancereports') return getClusterComplianceReportStatus(data)
   if (k === 'sbomreports' || k === 'clustersbomreports') return getSbomReportStatus(data)
   if (k === 'policyreports' || k === 'clusterpolicyreports') return getPolicyReportStatus(data)
-  if (k === 'kyvernopolicies' || k === 'clusterpolicies') {
+  if (k === 'kyvernopolicies' || k === 'clusterpolicies'
+    || (k === 'policies' && isApiGroup(data.apiVersion, 'kyverno.io'))) {
     if (data?.apiVersion?.startsWith('nvidia.com/')) return getNvidiaClusterPolicyStatus(data)
     return getKyvernoPolicyStatus(data)
   }
@@ -934,9 +1083,28 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
     if (isApiGroup(data.apiVersion, CNPG_GROUP)) return getCNPGBackupStatus(data)
     if (isApiGroup(data.apiVersion, 'velero.io')) return getBackupStatus(data)
   }
+  // Group-guarded: `objectstores` is a generic plural another operator could
+  // claim, and a foreign CR must not borrow CNPG's recovery-window semantics.
+  if (k === 'objectstores' && isApiGroup(data.apiVersion, 'barmancloud.cnpg.io')) {
+    return getCNPGObjectStoreStatus(data)
+  }
+  // Group-guarded for the same reason as the renderers: these plurals are
+  // generic enough that another operator can serve them.
+  if ((k === 'databases' || k === 'publications' || k === 'subscriptions') && isApiGroup(data.apiVersion, CNPG_GROUP)) {
+    return getCNPGDeclarativeStatus(data)
+  }
+  if (k === 'globalcontextentries') return getKyvernoGlobalContextStatus(data)
+  if (k === 'updaterequests') return getKyvernoRequestState(data)
+  if (k === 'ephemeralreports' || k === 'clusterephemeralreports') return getKyvernoReportStatus(data)
   if (k === 'restores' && isVeleroResource(data)) return getRestoreStatus(data)
   if (k === 'schedules' && isVeleroResource(data)) return getScheduleStatus(data)
   if (k === 'backupstoragelocations' && isVeleroResource(data)) return getBSLStatus(data)
+  // Repositories have table columns and raise their own issue, but had no branch
+  // here — so the drawer header fell through to the raw phase and showed
+  // "NotReady" beside a table cell reading "Not ready". Same object, two
+  // spellings. Deliberately NOT added to KNOWN_KINDS: there is no detail
+  // renderer for this kind, and listing it there suppresses GenericRenderer.
+  if (k === 'backuprepositories' && isVeleroResource(data)) return getBackupRepositoryStatus(data)
   if (k === 'externalsecrets') return getExternalSecretStatus(data)
   if (k === 'clusterexternalsecrets') return getClusterExternalSecretStatus(data)
   if (k === 'secretstores') return getSecretStoreStatus(data)
@@ -1007,11 +1175,20 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
     'knativeservices', 'knativeconfigurations', 'knativeroutes',
     'brokers', 'triggers',
     'pingsources', 'apiserversources', 'containersources', 'sinkbindings',
-    'channels', 'inmemorychannels', 'subscriptions',
+    'channels', 'inmemorychannels',
     'sequences', 'parallels',
     'domainmappings', 'knativeingresses', 'knativecertificates', 'serverlessservices',
   ]
-  if (knativeConditionKinds.includes(k) || (k === 'ingresses' && data.apiVersion?.includes('networking.internal.knative.dev'))) {
+  // `subscriptions` is shared with CNPG (handled above) and with any number of
+  // other operators, so it is matched by group rather than by name — reading a
+  // foreign CRD's conditions as Knative's is the status half of the same
+  // collision the renderers guard.
+  const isKnativeSubscription = k === 'subscriptions' && isApiGroup(data.apiVersion, 'messaging.knative.dev')
+  if (
+    knativeConditionKinds.includes(k)
+    || isKnativeSubscription
+    || (k === 'ingresses' && data.apiVersion?.includes('networking.internal.knative.dev'))
+  ) {
     const status = getKnativeConditionStatus(data)
     return { text: status.text, color: status.color }
   }

package/src/components/shared/index.ts

@@ -1,6 +1,6 @@
 export { ResourceRendererDispatch, getResourceStatus, type RendererOverrides } from './ResourceRendererDispatch'
 export { EditableYamlView, SaveSuccessAnimation } from './EditableYamlView'
-export { ResourceActionsBar, RevisionHistoryDialog } from './ResourceActionsBar'
+export { ResourceActionsBar, RevisionHistoryDialog, isRolloutKind } from './ResourceActionsBar'
 export { CreateResourceDialog, type CreateResourceDialogProps, type ApplyResult } from './CreateResourceDialog'
 export { HelmManagedByChip, ManagedByChip, type HelmOwnerRef } from './ManagedByChip'
 export { DetailShell, type DetailShellProps, type DetailShellTab } from './DetailShell'

package/src/components/shared/revision-role-badges.test.ts

@@ -0,0 +1,120 @@
+import { describe, expect, it } from 'vitest'
+import {
+  completePromoteAfterRollback,
+  offersPromoteAfterRollback,
+  revisionRoleBadges,
+} from './ResourceActionsBar'
+import type { WorkloadRevision } from '../../types/core'
+
+describe('offersPromoteAfterRollback', () => {
+  it('offers the option for both promotion styles — rollback alone lands neither', () => {
+    expect(offersPromoteAfterRollback('rollouts', true)).toBe(true)
+    expect(offersPromoteAfterRollback('Rollout', true)).toBe(true)
+  })
+
+  it('withholds it when the host reports promote-full is denied', () => {
+    expect(offersPromoteAfterRollback('rollouts', false)).toBe(false)
+  })
+
+  it('never offers it for plain workloads, whose rollback lands immediately', () => {
+    for (const kind of ['deployments', 'statefulsets', 'daemonsets']) {
+      expect(offersPromoteAfterRollback(kind, true)).toBe(false)
+    }
+  })
+})
+
+function revision(overrides: Partial<WorkloadRevision>): WorkloadRevision {
+  return { number: 1, image: 'web:v1', createdAt: '2026-08-07T00:00:00Z', ...overrides }
+}
+
+describe('revisionRoleBadges', () => {
+  it('labels a Deployment revision Current in the healthy tone', () => {
+    expect(revisionRoleBadges(revision({ isCurrent: true }), false)).toEqual([
+      { label: 'Current', tone: 'status-healthy' },
+    ])
+  })
+
+  it('gives a non-current revision no badge', () => {
+    expect(revisionRoleBadges(revision({}), false)).toEqual([])
+    expect(revisionRoleBadges(revision({}), true)).toEqual([])
+  })
+
+  it('splits Rolling out from Stable while a canary is mid-flight', () => {
+    const rolling = revisionRoleBadges(revision({ number: 5, isCurrent: true, isStable: false }), true)
+    expect(rolling).toEqual([{ label: 'Rolling out', tone: 'status-degraded' }])
+
+    const stable = revisionRoleBadges(revision({ number: 4, isStable: true }), true)
+    expect(stable).toEqual([
+      { label: 'Stable', tone: 'status-healthy', tip: 'Serving stable traffic — an abort reverts here' },
+    ])
+  })
+
+  it('collapses to a single Current badge once the canary stabilizes', () => {
+    expect(revisionRoleBadges(revision({ isCurrent: true, isStable: true }), true)).toEqual([
+      { label: 'Current', tone: 'status-healthy' },
+    ])
+  })
+
+  // A Rollout paused at step 0 reports current and stable as the same revision.
+  it('never emits both Stable and Rolling out for one revision', () => {
+    for (const isStable of [true, false, undefined]) {
+      const labels = revisionRoleBadges(revision({ isCurrent: true, isStable }), true).map((b) => b.label)
+      expect(labels).not.toContain('Stable')
+      expect(labels).toHaveLength(1)
+    }
+  })
+})
+
+describe('completePromoteAfterRollback', () => {
+  it('does not resolve until promote-full settles', async () => {
+    let release: () => void = () => {}
+    const gate = new Promise<void>((resolve) => {
+      release = resolve
+    })
+    const pending: boolean[] = []
+
+    let done = false
+    const run = completePromoteAfterRollback(
+      () => gate,
+      (p) => pending.push(p),
+    ).then(() => {
+      done = true
+    })
+
+    // Yield the microtask queue: if it did not await, done would already be true.
+    await Promise.resolve()
+    expect(done).toBe(false)
+    expect(pending).toEqual([true])
+
+    release()
+    await run
+    expect(done).toBe(true)
+    expect(pending).toEqual([true, false])
+  })
+
+  // A rejected promote must not stop the dialog from closing — the rollback itself
+  // already succeeded, and the failure is reported by the mutation's toast.
+  it('swallows a promote-full rejection and clears the pending flag', async () => {
+    const pending: boolean[] = []
+    await expect(
+      completePromoteAfterRollback(
+        () => Promise.reject(new Error('403 forbidden')),
+        (p) => pending.push(p),
+      ),
+    ).resolves.toBeUndefined()
+    expect(pending).toEqual([true, false])
+  })
+
+  it('supports a void-returning callback', async () => {
+    const pending: boolean[] = []
+    let called = false
+    await completePromoteAfterRollback(
+      () => {
+        called = true
+      },
+      (p) => pending.push(p),
+    )
+    expect(called).toBe(true)
+    expect(pending).toEqual([true, false])
+  })
+})

package/src/components/topology/K8sResourceNode.test.ts

@@ -8,4 +8,14 @@ describe('baseSubtitle', () => {
     expect(baseSubtitle('ServiceAccount', {})).toBe('Workload identity')
     expect(baseSubtitle('ServiceMonitor', { endpointCount: 1 })).toBe('1 scrape endpoint')
   })
+
+  it('describes a Calico staged deletion as a removal, not as selecting everything', () => {
+    // A staged deletion carries no selector, because the Calico API forbids one.
+    // Falling through to the empty-selector default would label the broadest
+    // possible protection onto a policy that is being taken away.
+    expect(baseSubtitle('CalicoStagedNetworkPolicy', { stagedAction: 'Delete' })).toBe('staged deletion')
+    expect(baseSubtitle('CalicoStagedGlobalNetworkPolicy', { stagedAction: 'Delete' })).toBe('staged deletion')
+    expect(baseSubtitle('CalicoStagedNetworkPolicy', { stagedAction: 'Set', selector: "app == 'web'" })).toBe("app == 'web'")
+    expect(baseSubtitle('CalicoNetworkPolicy', {})).toBe('all workloads')
+  })
 })

package/src/components/topology/K8sResourceNode.tsx

@@ -249,6 +249,11 @@ export const NODE_DIMENSIONS: Record<
   KubeadmControlPlane: { width: 300, height: 84 },
   ClusterClass: { width: 280, height: 84 },
   MachineHealthCheck: { width: 300, height: 84 },
+  CalicoNetworkPolicy: { width: 300, height: 84 },
+  CalicoGlobalNetworkPolicy: { width: 300, height: 84 },
+  CalicoStagedNetworkPolicy: { width: 300, height: 84 },
+  CalicoStagedGlobalNetworkPolicy: { width: 300, height: 84 },
+  CalicoStagedKubernetesNetworkPolicy: { width: 300, height: 84 },
 };
 
 // Status indicator color (for dot and left bar) - uses centralized severity colors
@@ -367,6 +372,18 @@ export function baseSubtitle(kind: NodeKind, nodeData: Record<string, unknown>):
       const port = nodeData.port;
       return port ? `${svcType} :${port}` : svcType;
     }
+    case "CalicoNetworkPolicy":
+    case "CalicoGlobalNetworkPolicy":
+    case "CalicoStagedNetworkPolicy":
+    case "CalicoStagedGlobalNetworkPolicy":
+    case "CalicoStagedKubernetesNetworkPolicy": {
+      // A staged deletion carries no selector; reading that as "all workloads"
+      // would show a removal as the broadest possible protection.
+      if (String(nodeData.stagedAction ?? "").toLowerCase() === "delete") {
+        return "staged deletion";
+      }
+      return (nodeData.selector as string) || "all workloads";
+    }
     case "Ingress":
       return (nodeData.hostname as string) || "No host";
     case "Gateway": {
@@ -443,6 +460,11 @@ export function baseSubtitle(kind: NodeKind, nodeData: Record<string, unknown>):
       const instanceType = nodeData.instanceType as string;
       return instanceType || "";
     }
+    case "AnalysisRun": {
+      const phase = (nodeData.phase as string) || "Unknown";
+      const trigger = nodeData.trigger as string;
+      return trigger ? `${trigger} • ${phase}` : phase;
+    }
     case "Internet":
       return "";
     default: