@skyhook-io/k8s-ui 1.12.0 → 1.13.0

package/src/types/core.ts

@@ -202,6 +202,11 @@ export type CoreNodeKind =
   | 'KubeadmControlPlane' // Cluster API KubeadmControlPlane
   | 'ClusterClass'       // Cluster API ClusterClass
   | 'MachineHealthCheck' // Cluster API MachineHealthCheck
+  | 'CalicoNetworkPolicy'
+  | 'CalicoGlobalNetworkPolicy'
+  | 'CalicoStagedNetworkPolicy'
+  | 'CalicoStagedGlobalNetworkPolicy'
+  | 'CalicoStagedKubernetesNetworkPolicy'
 
 // NodeKind can be a core kind or any arbitrary CRD kind string
 export type NodeKind = CoreNodeKind | (string & {})
@@ -236,6 +241,11 @@ export function displayKind(kind: string): string {
     KubeadmControlPlane: 'Control Plane',
     ClusterClass: 'ClusterClass',
     MachineHealthCheck: 'Health Check',
+    CalicoNetworkPolicy: 'Calico NetworkPolicy',
+    CalicoGlobalNetworkPolicy: 'Calico GlobalNetworkPolicy',
+    CalicoStagedNetworkPolicy: 'Calico StagedNetworkPolicy',
+    CalicoStagedGlobalNetworkPolicy: 'Calico StagedGlobalNetworkPolicy',
+    CalicoStagedKubernetesNetworkPolicy: 'Calico StagedKubernetesNetworkPolicy',
   }
   return shortNames[kind] || kind
 }
@@ -258,6 +268,7 @@ export interface TopologyEdge {
   target: string
   type: EdgeType
   label?: string
+  partial?: boolean
   /** Hover tooltip for the edge label. Used by the Reachability view to keep the
    *  DECLARED route path available when the label shows an overridden tested path. */
   labelTitle?: string
@@ -1204,6 +1215,13 @@ export interface TrafficFlow {
   bytesSent: number
   bytesRecv: number
   connections: number
+  /** The conversation's initiator could not be established, so source and
+   *  destination are ordered arbitrarily rather than describing a caller. */
+  directionUnknown?: boolean
+  /** 5xx responses per second. How a rate-based source reports failures: it
+   *  measures a rate rather than observing individual responses, so it has a
+   *  status code for no single flow. */
+  errorRate?: number
   verdict: string // forwarded, dropped, error
   lastSeen: string // ISO date string
 }
@@ -1236,6 +1254,9 @@ export interface AggregatedFlow {
   bytesRecv: number
   connections: number
   lastSeen: string
+  /** The conversation's initiator could not be established, so the endpoints are
+   *  ordered arbitrarily and the edge is drawn without an arrowhead. */
+  directionUnknown?: boolean
   l7Protocol?: string // HTTP, gRPC, DNS
   requestCount?: number
   errorCount?: number
@@ -1307,6 +1328,11 @@ export interface TrafficFlowsResponse {
   flows: TrafficFlow[]
   aggregated: AggregatedFlow[]
   warning?: string  // Non-fatal warning (e.g., query errors)
+  /** 'transient' (or absent) means the condition may clear on its own and a
+   *  retry is worthwhile. 'partial' means the flows are correct but incomplete
+   *  for a reason retrying cannot change, so show the warning next to them and
+   *  do not refetch. */
+  warningKind?: 'transient' | 'partial'
 }
 
 // Wizard state for traffic setup
@@ -1424,6 +1450,9 @@ export interface WorkloadRevision {
   isCurrent: boolean
   replicas: number
   template?: string // Pod template spec as YAML (for revision diff)
+  // Rollouts only: mid-canary isCurrent (rolling out) and isStable (serving traffic) differ.
+  isStable?: boolean
+  podHash?: string
 }
 
 // Workload log stream event data

package/src/types/policy.ts

@@ -26,17 +26,168 @@ export interface PolicyResourceCounts {
   skip: number
 }
 
+/** One resource a policy recorded an outcome for, from
+ *  GET /api/policy/policies/{policy}. */
+export interface PolicyCoverageSubject {
+  group?: string
+  kind: string
+  namespace?: string
+  name: string
+  result: PolicyResult
+  message?: string
+  /** Matched through a rule Kyverno synthesised from an authored Pod rule,
+   *  not through a rule the user wrote. */
+  autogen?: boolean
+}
+
+export interface PolicyCoverageRule {
+  /** Empty for the modern CEL families, which have no named rules. */
+  rule: string
+  counts: PolicyResourceCounts
+  subjects: PolicyCoverageSubject[]
+  total: number
+  truncated?: boolean
+  /** How many of `total` the namespace view filter held back. `counts` still
+   *  describe every outcome, so the two must be read together. */
+  hiddenByFilter?: number
+  /** The non-passing part of `hiddenByFilter`. Only non-passing subjects are
+   *  listed, so this is what separates a row the server cap dropped from one
+   *  the view filter held back. */
+  hiddenNotable?: number
+}
+
+/** What one policy decided about the cluster — the inverse of
+ *  PolicyResourceResponse.
+ *
+ *  Carries one partiality the per-resource view never needed: a resource may be
+ *  missing because the caller cannot read its namespace, so an absent subject is
+ *  not evidence of absence. `withheldNamespaces` is how the UI says so. */
+export interface PolicyCoverageResponse {
+  evaluated: boolean
+  status: string
+  reasonCode?: string
+  deniedGroups?: string[]
+  liveUpdates: boolean
+  /** The report-side name that matched — namespaced policies report as
+   *  "namespace/name". */
+  policy: string
+  counts: PolicyResourceCounts
+  scopeNamespaces: number
+  withheldNamespaces: number
+  clusterScoped?: boolean
+  /** Separate from withheldNamespaces — a cluster-scoped subject has no
+   *  namespace to name. */
+  withheldClusterScoped?: boolean
+  /** Outcomes dropped because they came only from a report family this caller
+   *  cannot read. The server drops them before counting, so the note can state
+   *  how many were left out rather than hedging that some might have been. */
+  withheldByFamily?: number
+  /** Report families the CALLER cannot read. Distinct from deniedGroups, which
+   *  are the ones radar's own probe could not read. */
+  unreadableFamilies?: string[]
+  /** How many distinct resources these outcomes describe, and how many of those
+   *  have at least one non-passing outcome. One resource matched by two rules
+   *  produces two outcomes, so any sentence saying "resources" needs these —
+   *  `counts` and `examined` are checks. Not derivable client-side: the per-rule
+   *  subject lists are capped. */
+  subjects?: number
+  subjectsFailing?: number
+  /** How many outcomes back these counts. */
+  examined: number
+  /** How many subjects the namespace view filter held back, across all rules. */
+  hiddenByFilter?: number
+  engines?: string[]
+  rules: PolicyCoverageRule[]
+}
+
 export interface PolicyResourceResponse {
   /** False whenever the answer is "we could not check". Never treat an empty
    *  findings array as "clean" without consulting this first. */
   evaluated: boolean
   status: string
   reasonCode?: string
-  /** Report families the caller could not read. Present even when evaluated:
-   *  the answer is real but incomplete. */
+  /** Report families RADAR's own probe could not read, so nobody's answer
+   *  carries them — not the same as `withheldByFamily`, which is what THIS
+   *  caller may not see. Present even when evaluated: the answer is real but
+   *  incomplete. */
   deniedGroups?: string[]
   /** False when the index is frozen at its initial contents. */
   liveUpdates: boolean
   counts: PolicyResourceCounts
   findings: PolicyResourceFinding[]
+  /** Findings dropped because they came only from a report family this caller
+   *  cannot read. `counts` excludes them too, so an all-passing count with this
+   *  set is not an all-clear — it is the part of the answer they may see. */
+  withheldByFamily?: number
+}
+
+/** Background work Kyverno currently has in flight for one policy, from
+ *  GET /api/policy/policies/{policy}/queued. Computed server-side: the requests
+ *  live in the engine's namespace, not the policy's. */
+export interface PolicyQueuedResponse {
+  /** Zero is a real answer — Kyverno deletes these seconds after they complete. */
+  requests: number
+  byState?: Record<string, number>
+  /** Separates healthy churn from a stopped controller. */
+  oldestPending?: string
+  /** The only diagnosis these objects carry. */
+  messages?: string[]
+}
+
+/** One Cluster pinned to a CloudNativePG image catalog. */
+export interface CNPGCatalogUser {
+  namespace: string
+  name: string
+  /** Absent when the reference carries no major — the screen must not render
+   *  "asks for PostgreSQL 0". */
+  major?: number
+  /** A catalog-pinned Cluster has no spec.imageName, so this is the only place
+   *  the image it actually resolved appears. */
+  image?: string
+}
+
+/** Clusters referencing one image catalog, from the CNPG catalog-users endpoint. */
+export interface CNPGCatalogUsersResponse {
+  clusters: CNPGCatalogUser[]
+}
+
+/** What one Velero BackupStorageLocation holds, from the stored-backups lookup. */
+export interface VeleroStoredBackupsResponse {
+  backups: Array<{
+    namespace: string
+    name: string
+    phase?: string
+    expiration?: string
+    completed?: string
+  }>
+  /** How many reached Completed and are still inside their retention — the rest
+   *  are stored here but are not something to restore from. Counted over the
+   *  whole location, like `stored`: recomputing it from the capped list above
+   *  undercounts every location big enough to be capped. */
+  restorable: number
+  /** How many reached Completed but have aged out. Same scope as `restorable`. */
+  expired?: number
+  /** How many the location holds in total, counted before the list was capped. */
+  stored?: number
+  /** The list above is a page, not the whole location. */
+  truncated?: boolean
+}
+
+/** One warning or error behind a Velero run's counts, with the scope Velero
+ *  filed it under: "velero", "cluster", or a namespace name. */
+export interface VeleroMessage {
+  scope: string
+  message: string
+}
+
+/** What a Backup or Restore actually reported, fetched on demand.
+ *
+ *  The counts live on the CR; these messages do not — they are in a results
+ *  file in object storage that only Velero's controller can hand out a link to.
+ *  So this is never present until someone asks for it. */
+export interface VeleroRunMessagesResponse {
+  warnings: VeleroMessage[]
+  errors: VeleroMessage[]
+  /** Set when the results file held more than were returned. */
+  truncated?: boolean
 }

package/src/utils/navigation.test.ts

@@ -24,6 +24,11 @@ describe('kindToPlural', () => {
 
   test('handles kinds ending in consonant+y (changes to -ies)', () => {
     expect(kindToPlural('NetworkPolicy')).toBe('networkpolicies')
+    expect(kindToPlural('CalicoNetworkPolicy')).toBe('networkpolicies')
+    expect(kindToPlural('CalicoGlobalNetworkPolicy')).toBe('globalnetworkpolicies')
+    expect(kindToPlural('CalicoStagedNetworkPolicy')).toBe('stagednetworkpolicies')
+    expect(kindToPlural('CalicoStagedGlobalNetworkPolicy')).toBe('stagedglobalnetworkpolicies')
+    expect(kindToPlural('CalicoStagedKubernetesNetworkPolicy')).toBe('stagedkubernetesnetworkpolicies')
   })
 
   test('handles already-plural kind names (Endpoints)', () => {

package/src/utils/navigation.ts

@@ -100,6 +100,11 @@ export function kindToPlural(kind: string): string {
     horizontalpodautoscaler: 'horizontalpodautoscalers',
     pvc: 'persistentvolumeclaims',
     podgroup: 'pods',
+    caliconetworkpolicy: 'networkpolicies',
+    calicoglobalnetworkpolicy: 'globalnetworkpolicies',
+    calicostagednetworkpolicy: 'stagednetworkpolicies',
+    calicostagedglobalnetworkpolicy: 'stagedglobalnetworkpolicies',
+    calicostagedkubernetesnetworkpolicy: 'stagedkubernetesnetworkpolicies',
   }
   if (aliases[kindLower]) return aliases[kindLower]
 

package/src/utils/resource-icons.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest'
-import { Database, Server, Puzzle } from 'lucide-react'
-import { getResourceIcon, DEFAULT_RESOURCE_ICON } from './resource-icons'
+import { Database, Network, Server, ShieldCheck, Puzzle } from 'lucide-react'
+import { getResourceIcon, getTopologyIcon, DEFAULT_RESOURCE_ICON } from './resource-icons'
 
 describe('getResourceIcon', () => {
   it('disambiguates colliding kinds by API group', () => {
@@ -14,6 +14,53 @@ describe('getResourceIcon', () => {
     // A third operator's `clusters` CRD must not inherit a Postgres icon.
     expect(getResourceIcon('Cluster', 'apps.kubeblocks.io')).toBe(DEFAULT_RESOURCE_ICON)
     expect(getResourceIcon('Backup', 'kubevirt.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('HostEndpoint', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('IPPool', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('IPPool', 'extension.projectcalico.org')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('Tier', 'extension.projectcalico.org')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('resolves Calico IPPool only for Calico API groups', () => {
+    expect(getResourceIcon('IPPool', 'crd.projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('IPPool', 'projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('IPPool')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('resolves Calico HostEndpoint only for Calico API groups', () => {
+    expect(getResourceIcon('HostEndpoint', 'crd.projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('HostEndpoint', 'projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('HostEndpoint')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('resolves Calico Tier only for Calico API groups', () => {
+    expect(getResourceIcon('Tier', 'crd.projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('Tier', 'projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('Tier')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('disambiguates NetworkPolicy and Calico policy kinds by API group', () => {
+    expect(getResourceIcon('NetworkPolicy', 'networking.k8s.io')).toBe(ShieldCheck)
+    expect(getResourceIcon('NetworkPolicy', 'projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('NetworkPolicy', 'crd.projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('NetworkPolicy', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('GlobalNetworkPolicy', 'projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('StagedNetworkPolicy', 'crd.projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('StagedGlobalNetworkPolicy', 'projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('StagedKubernetesNetworkPolicy', 'crd.projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('GlobalNetworkPolicy', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('uses ShieldCheck for all Calico policy topology nodes', () => {
+    for (const kind of [
+      'CalicoNetworkPolicy',
+      'CalicoGlobalNetworkPolicy',
+      'CalicoStagedNetworkPolicy',
+      'CalicoStagedGlobalNetworkPolicy',
+      'CalicoStagedKubernetesNetworkPolicy',
+    ]) {
+      expect(getTopologyIcon(kind)).toBe(ShieldCheck)
+      expect(getResourceIcon(kind)).toBe(ShieldCheck)
+    }
   })
 
   it('ignores the group for kinds that do not collide', () => {

package/src/utils/resource-icons.ts

@@ -20,6 +20,7 @@ import {
   ShieldAlert,
   Radio,
   Globe,
+  Network,
 
   // Config
   FileSliders,
@@ -96,6 +97,11 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   service: Plug,
   ingress: DoorOpen,
   networkpolicy: ShieldCheck,
+  caliconetworkpolicy: ShieldCheck,
+  calicoglobalnetworkpolicy: ShieldCheck,
+  calicostagednetworkpolicy: ShieldCheck,
+  calicostagedglobalnetworkpolicy: ShieldCheck,
+  calicostagedkubernetesnetworkpolicy: ShieldCheck,
   ciliumnetworkpolicy: ShieldCheck,
   ciliumclusterwidenetworkpolicy: ShieldCheck,
   clusternetworkpolicy: ShieldCheck,
@@ -291,13 +297,33 @@ const GROUP_QUALIFIED_KIND_ICONS: Record<string, Record<string, LucideIcon>> = {
   backup: { 'postgresql.cnpg.io': DatabaseBackup },
   scheduledbackup: { 'postgresql.cnpg.io': DatabaseBackup },
   pooler: { 'postgresql.cnpg.io': Waypoints },
+  networkpolicy: {
+    'networking.k8s.io': ShieldCheck,
+    'crd.projectcalico.org': ShieldCheck,
+    'projectcalico.org': ShieldCheck,
+  },
+  hostendpoint: { 'crd.projectcalico.org': Network, 'projectcalico.org': Network },
+  ippool: { 'crd.projectcalico.org': Network, 'projectcalico.org': Network },
+  tier: { 'crd.projectcalico.org': Network, 'projectcalico.org': Network },
+  globalnetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+  stagednetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+  stagedglobalnetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+  stagedkubernetesnetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+}
+
+const TOPOLOGY_KIND_ICONS: Record<string, LucideIcon> = {
+  CalicoNetworkPolicy: ShieldCheck,
+  CalicoGlobalNetworkPolicy: ShieldCheck,
+  CalicoStagedNetworkPolicy: ShieldCheck,
+  CalicoStagedGlobalNetworkPolicy: ShieldCheck,
+  CalicoStagedKubernetesNetworkPolicy: ShieldCheck,
 }
 
 export function getResourceIcon(kind: string, group?: string): LucideIcon {
   const k = kind.toLowerCase()
   if (group) {
-    const byGroup = GROUP_QUALIFIED_KIND_ICONS[k]?.[group]
-    if (byGroup) return byGroup
+    const groupMap = GROUP_QUALIFIED_KIND_ICONS[k]
+    if (groupMap) return groupMap[group] ?? DEFAULT_RESOURCE_ICON
   }
   return KIND_ICON_MAP[k] ?? Puzzle
 }
@@ -306,6 +332,7 @@ export function getResourceIcon(kind: string, group?: string): LucideIcon {
 export function getTopologyIcon(kind: string): LucideIcon {
   if (kind === 'Internet') return Globe
   if (kind === 'PodGroup') return Boxes
+  if (TOPOLOGY_KIND_ICONS[kind]) return TOPOLOGY_KIND_ICONS[kind]
   return getResourceIcon(kind)
 }