@skyhook-io/k8s-ui 1.12.0 → 1.13.3

package/src/components/shared/ResourceActionsBar.tsx

@@ -82,6 +82,9 @@ interface ResourceActionsBarProps {
   revisionsError?: Error | null
   onRollback?: (params: { kind: string; namespace: string; name: string; revision: number }, callbacks?: { onSuccess?: () => void; onError?: (err: unknown) => void }) => void
   isRollingBack?: boolean
+  // A rolled-back Rollout re-enters its strategy: canary replays every step,
+  // blueGreen parks the revision in preview. Absent when promote-full is denied.
+  onRolloutPromoteFull?: (params: { namespace: string; name: string }) => void | Promise<unknown>
 
   // CronJob actions
   onTriggerCronJob?: (params: { namespace: string; name: string }) => void
@@ -134,6 +137,7 @@ export function ResourceActionsBar({
   onDelete, isDeleting, cascadeDependents, cascadeLoading, cascadeRootResolved,
   onRestart, isRestarting,
   revisions: revisionsList, revisionsLoading, revisionsError, onRollback, isRollingBack,
+  onRolloutPromoteFull,
   onTriggerCronJob, isTriggeringCronJob,
   onSuspendCronJob, isSuspendingCronJob,
   onResumeCronJob, isResumingCronJob,
@@ -169,7 +173,7 @@ export function ResourceActionsBar({
 
   // Rollback dialog state
   const [showRevisions, setShowRevisions] = useState(false)
-  const isRollbackKind = ['deployments', 'statefulsets', 'daemonsets'].includes(kind)
+  const isRollbackKind = ['deployments', 'statefulsets', 'daemonsets', 'rollouts'].includes(kind)
   const hasMultipleRevisions = (revisionsList?.length ?? 0) > 1
 
   function handleDeleteConfirm(force: boolean) {
@@ -662,7 +666,7 @@ export function ResourceActionsBar({
         </div>
       </ConfirmDialog>
 
-      {showRevisions && ['deployments', 'statefulsets', 'daemonsets'].includes(kind) && (
+      {showRevisions && isRollbackKind && (
         <RevisionHistoryDialog
           kind={resource.kind}
           namespace={resource.namespace}
@@ -674,6 +678,7 @@ export function ResourceActionsBar({
           error={revisionsError}
           onRollback={onRollback}
           isRollingBack={isRollingBack}
+          onRolloutPromoteFull={onRolloutPromoteFull}
         />
       )}
     </div>
@@ -879,7 +884,54 @@ function RevisionImage({ image, displayImage }: { image: string; displayImage: s
   )
 }
 
-export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, revisions, isLoading, error, onRollback, isRollingBack }: {
+// Accepts both the singular Kind and the plural route segment.
+export function isRolloutKind(kind: string): boolean {
+  return kind.toLowerCase().startsWith('rollout')
+}
+
+// Deliberately not strategy-gated: canary replays its steps and blueGreen parks
+// the revision in preview, so both need promote-full to land a rollback.
+export function offersPromoteAfterRollback(kind: string, hasPromoteFull: boolean): boolean {
+  return isRolloutKind(kind) && hasPromoteFull
+}
+
+export interface RevisionRoleBadge {
+  label: 'Stable' | 'Current' | 'Rolling out'
+  tone: 'status-healthy' | 'status-degraded'
+  tip?: string
+}
+
+// Mid-canary a Rollout's current revision is not yet the stable one; for every
+// other workload kind the two always coincide.
+export function revisionRoleBadges(rev: WorkloadRevision, isRollout: boolean): RevisionRoleBadge[] {
+  const badges: RevisionRoleBadge[] = []
+  if (rev.isStable && !rev.isCurrent) {
+    badges.push({ label: 'Stable', tone: 'status-healthy', tip: 'Serving stable traffic — an abort reverts here' })
+  }
+  if (rev.isCurrent) {
+    const settled = rev.isStable || !isRollout
+    badges.push({ label: settled ? 'Current' : 'Rolling out', tone: settled ? 'status-healthy' : 'status-degraded' })
+  }
+  return badges
+}
+
+// Awaits promote-full so the dialog cannot close on a half-landed rollback. A
+// failure is reported by the mutation's error toast, so it must not block the close.
+export async function completePromoteAfterRollback(
+  promote: () => void | Promise<unknown>,
+  setPending: (pending: boolean) => void,
+): Promise<void> {
+  setPending(true)
+  try {
+    await promote()
+  } catch {
+    // already surfaced to the user
+  } finally {
+    setPending(false)
+  }
+}
+
+export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, revisions, isLoading, error, onRollback, isRollingBack, onRolloutPromoteFull }: {
   kind: string
   namespace: string
   name: string
@@ -890,12 +942,22 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
   error?: Error | null
   onRollback?: (params: { kind: string; namespace: string; name: string; revision: number }, callbacks?: { onSuccess?: () => void; onError?: (err: unknown) => void }) => void
   isRollingBack?: boolean
+  onRolloutPromoteFull?: (params: { namespace: string; name: string }) => void | Promise<unknown>
 }) {
   const [confirmRevision, setConfirmRevision] = useState<number | null>(null)
   const [diffRevision, setDiffRevision] = useState<number | null>(null)
+  const [promoteAfterRollback, setPromoteAfterRollback] = useState(false)
+  const [promotingFull, setPromotingFull] = useState(false)
 
   const handleClose = () => { setDiffRevision(null); onClose() }
 
+  // The dialog must not close while promote-full is still in flight, or a rollback
+  // that only half-landed reads as complete.
+  const busy = Boolean(isRollingBack) || promotingFull
+
+  const isRollout = isRolloutKind(kind)
+  const canPromoteAfterRollback = offersPromoteAfterRollback(kind, Boolean(onRolloutPromoteFull))
+
   const currentRevision = revisions?.find(r => r.isCurrent)
   const selectedRevision = revisions?.find(r => r.number === diffRevision)
   const hasDiffData = currentRevision?.template && selectedRevision?.template
@@ -904,7 +966,13 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
     onRollback?.(
       { kind, namespace, name, revision },
       {
-        onSuccess: () => {
+        onSuccess: async () => {
+          if (canPromoteAfterRollback && promoteAfterRollback && onRolloutPromoteFull) {
+            await completePromoteAfterRollback(
+              () => onRolloutPromoteFull({ namespace, name }),
+              setPromotingFull,
+            )
+          }
           setConfirmRevision(null)
           setDiffRevision(null)
           onClose()
@@ -938,7 +1006,7 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
     <DialogPortal
       open={open}
       onClose={handleClose}
-      closable={!isRollingBack}
+      closable={!busy}
       className="flex max-h-[85vh] w-[calc(100vw-2rem)] max-w-5xl flex-col"
     >
       <div className="flex items-center justify-between p-4 border-b border-theme-border shrink-0">
@@ -955,7 +1023,7 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
         <Tooltip content="Close" delay={150}>
           <button
             onClick={handleClose}
-            disabled={isRollingBack}
+            disabled={busy}
             aria-label="Close revision history"
             className="p-1 text-theme-text-secondary hover:text-theme-text-primary hover:bg-theme-elevated rounded disabled:opacity-50"
           >
@@ -1036,22 +1104,27 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
                             </button>
                           </Tooltip>
                         )}
-                        {rev.isCurrent ? (
-                          <span className="badge status-healthy">
-                            Current
-                          </span>
-                        ) : confirmRevision === rev.number ? (
+                        {revisionRoleBadges(rev, isRollout).map(({ label, tone, tip }) =>
+                          tip ? (
+                            <Tooltip key={label} content={tip} delay={150}>
+                              <span className={clsx('badge', tone)}>{label}</span>
+                            </Tooltip>
+                          ) : (
+                            <span key={label} className={clsx('badge', tone)}>{label}</span>
+                          )
+                        )}
+                        {rev.isCurrent ? null : confirmRevision === rev.number ? (
                           <>
                             <button
                               onClick={() => handleRollback(rev.number)}
-                              disabled={isRollingBack}
+                              disabled={busy}
                               className="px-2 py-0.5 text-xs font-medium text-white bg-amber-600 hover:bg-amber-700 rounded transition-colors disabled:opacity-50"
                             >
-                              {isRollingBack ? 'Rolling back...' : 'Confirm'}
+                              {promotingFull ? 'Promoting...' : isRollingBack ? 'Rolling back...' : 'Confirm'}
                             </button>
                             <button
                               onClick={() => setConfirmRevision(null)}
-                              disabled={isRollingBack}
+                              disabled={busy}
                               className="px-2 py-0.5 text-xs font-medium text-theme-text-secondary hover:text-theme-text-primary rounded transition-colors disabled:opacity-50"
                             >
                               Cancel
@@ -1084,10 +1157,22 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
         )}
       </div>
 
-      <div className="flex items-center justify-end p-4 border-t border-theme-border shrink-0">
+      <div className="flex items-center justify-between gap-4 p-4 border-t border-theme-border shrink-0">
+        {canPromoteAfterRollback ? (
+          <label className="flex items-center gap-2 text-sm text-theme-text-secondary">
+            <input
+              type="checkbox"
+              checked={promoteAfterRollback}
+              onChange={(e) => setPromoteAfterRollback(e.target.checked)}
+              disabled={busy}
+              className="rounded border-theme-border"
+            />
+            Promote fully after rollback — skip pauses, steps, and analysis (emergency hotfix)
+          </label>
+        ) : <span />}
         <button
           onClick={handleClose}
-          disabled={isRollingBack}
+          disabled={busy}
           className="px-4 py-2 text-sm font-medium text-theme-text-secondary hover:text-theme-text-primary hover:bg-theme-elevated rounded-lg transition-colors disabled:opacity-50"
         >
           Close

package/src/components/shared/ResourceRendererDispatch.test.tsx

@@ -44,13 +44,14 @@ describe('ResourceRendererDispatch', () => {
   })
 })
 
-function renderKind(kind: string, data: any, namespace = ''): string {
+function renderKind(kind: string, data: any, namespace = '', onNavigate?: (ref: ResourceRef) => void): string {
   return renderToString(
     <ResourceRendererDispatch
       resource={{ kind, namespace, name: data?.metadata?.name || 'x' }}
       data={data}
       onCopy={() => {}}
       copied={null}
+      onNavigate={onNavigate}
       showCommonSections={false}
     />,
   )
@@ -153,11 +154,24 @@ describe('DRA renderers dispatch', () => {
 // so any third operator's CRD inherited whichever branch was the fallback.
 // ============================================================================
 
+// The spec field is a probe: GenericRenderer renders spec into a Specification
+// section, so its value appearing in the output is proof the fall-through
+// reached a renderer. A blank drawer is not an empty string — the surrounding
+// wrapper still emits ~50 characters of markup — so asserting non-emptiness
+// passes even when the drawer shows the user nothing.
+const COLLISION_PROBE = 'collision-probe-value'
+
 function renderCollidingKind(kind: string, apiVersion: string): string {
   return renderToString(
     <ResourceRendererDispatch
       resource={{ kind, namespace: 'default', name: 'thing' }}
-      data={{ apiVersion, kind: 'Cluster', metadata: { name: 'thing', namespace: 'default' }, spec: {}, status: {} }}
+      data={{
+        apiVersion,
+        kind: 'Cluster',
+        metadata: { name: 'thing', namespace: 'default' },
+        spec: { collisionProbe: COLLISION_PROBE },
+        status: {},
+      }}
       onCopy={() => {}}
       copied={null}
       showCommonSections={false}
@@ -225,8 +239,40 @@ describe('ResourceRendererDispatch — colliding plurals fall through', () => {
     ['backups', 'kubevirt.io/v1'],
     ['scheduledbackups', 'other.io/v1'],
     ['poolers', 'other.io/v1'],
+    // The CNPG declarative kinds and the barman-cloud store extend the same
+    // list. `databases` and `publications` ship with several database
+    // operators, `objectstores` is a generic plural, and `subscriptions` is
+    // Knative's as well — every one of them was blank until this fall-through
+    // covered it.
+    ['objectstores', 'other.io/v1'],
+    ['databases', 'mysql.oracle.com/v2'],
+    ['publications', 'other.io/v1'],
+    ['subscriptions', 'operators.coreos.com/v1alpha1'],
+    ['imagecatalogs', 'other.io/v1'],
+    ['clusterimagecatalogs', 'other.io/v1'],
+    ['policies', 'operators.coreos.com/v1'],
+    // Velero's BackupRepository joined KNOWN_KINDS when it got a renderer, so
+    // it needs the same fall-through as its siblings.
+    ['backuprepositories', 'other.io/v1'],
   ])('renders something for a foreign %s CRD', (kind, apiVersion) => {
-    expect(renderCollidingKind(kind, apiVersion).trim()).not.toBe('')
+    expect(renderCollidingKind(kind, apiVersion)).toContain(COLLISION_PROBE)
+  })
+
+  // A Velero BackupRepository must reach its own renderer, not the generic one.
+  // It raises BackupRepositoryNotReady, and the reason Velero recorded is only
+  // on the dedicated page.
+  it('renders the Velero repository page for a velero.io backuprepositories', () => {
+    const html = renderCollidingKind('backuprepositories', 'velero.io/v1')
+    expect(html).toContain('Volume Namespace')
+    expect(html).not.toContain(COLLISION_PROBE)
+  })
+
+  // Both owners of `subscriptions` still get their own renderer.
+  it.each([
+    ['messaging.knative.dev/v1', 'Subscriber'],
+    ['postgresql.cnpg.io/v1', 'Applied'],
+  ])('still renders the owning engine for subscriptions/%s', (apiVersion, marker) => {
+    expect(renderCollidingKind('subscriptions', apiVersion)).toContain(marker)
   })
 
   it('does not double-render when a known engine matches', () => {
@@ -237,6 +283,273 @@ describe('ResourceRendererDispatch — colliding plurals fall through', () => {
   })
 })
 
+describe('Calico IPPool collision handling', () => {
+  it.each(['crd.projectcalico.org/v1', 'projectcalico.org/v3'])('renders IPPool details for %s', (apiVersion) => {
+    const html = renderKind('ippools', {
+      apiVersion,
+      kind: 'IPPool',
+      metadata: { name: 'workloads' },
+      spec: {
+        allowedUses: ['Workload', 'Tunnel'],
+        assignmentMode: 'Automatic',
+        blockSize: 26,
+        cidr: '172.16.0.0/16',
+        ipipMode: 'CrossSubnet',
+        vxlanMode: 'Never',
+        natOutgoing: true,
+        disabled: false,
+        disableBGPExport: true,
+        nodeSelector: 'all()',
+        namespaceSelector: "environment == 'production'",
+      },
+    })
+
+    expect(html).toContain('IP Pool')
+    expect(html).toContain('Allowed Uses')
+    expect(html).toContain('Workload, Tunnel')
+    expect(html).toContain('Assignment Mode')
+    expect(html).toContain('Automatic')
+    expect(html).toContain('Block Size')
+    expect(html).toContain('26')
+    expect(html).toContain('CIDR')
+    expect(html).toContain('172.16.0.0/16')
+    expect(html).toContain('IP-in-IP Mode')
+    expect(html).toContain('CrossSubnet')
+    expect(html).toContain('VXLAN Mode')
+    expect(html).toContain('Never')
+    expect(html).toContain('NAT Outgoing')
+    expect(html).toContain('Yes')
+    expect(html).toContain('Disabled')
+    expect(html).toContain('No')
+    expect(html).toContain('BGP Export Disabled')
+    expect(html).toContain('Node Selector')
+    expect(html).toContain('all()')
+    expect(html).toContain('Namespace Selector')
+    expect(html).toContain('environment == &#x27;production&#x27;')
+  })
+
+  it('renders documented defaults when fields are omitted', () => {
+    const html = renderKind('ippools', {
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'IPPool',
+      metadata: { name: 'default-ipv6' },
+      spec: { cidr: 'fd00::/48' },
+    })
+
+    expect(html).toContain('Workload, Tunnel')
+    expect(html).toContain('Automatic')
+    expect(html).toContain('122')
+    expect(html.match(/Never/g)).toHaveLength(2)
+    expect(html.match(/>No</g)).toHaveLength(3)
+    expect(html).toContain('all()')
+  })
+
+  it.each(['networking.example.io/v1', 'extension.projectcalico.org/v1'])('uses the generic renderer for %s', (apiVersion) => {
+    const html = renderKind('ippools', {
+      apiVersion,
+      kind: 'IPPool',
+      metadata: { name: 'foreign-pool' },
+      spec: { providerSpecificField: 'preserved' },
+    })
+
+    expect(html).toContain('Specification')
+    expect(html).toContain('Provider Specific Field')
+    expect(html).not.toContain('IP Pool')
+  })
+})
+
+describe('Calico HostEndpoint collision handling', () => {
+  it.each(['crd.projectcalico.org/v1', 'projectcalico.org/v3'])('renders HostEndpoint details for %s', (apiVersion) => {
+    const html = renderKind('hostendpoints', {
+      apiVersion,
+      kind: 'HostEndpoint',
+      metadata: { name: 'infra-1' },
+      spec: {
+        expectedIPs: ['172.20.16.133', '172.16.199.199'],
+        interfaceName: '*',
+        node: 'gdn-test-k8s-infra-1',
+        profiles: ['projectcalico-default-allow'],
+        ports: [{ name: 'ssh', protocol: 'TCP', port: 22 }],
+      },
+    }, '', () => {})
+
+    expect(html).toContain('Host Endpoint')
+    expect(html).toContain('Expected IPs')
+    expect(html).toContain('172.20.16.133')
+    expect(html).toContain('172.16.199.199')
+    expect(html).toContain('Interface Name')
+    expect(html).toContain('Node')
+    expect(html).toContain('<button')
+    expect(html).toContain('gdn-test-k8s-infra-1')
+    expect(html).toContain('Profiles')
+    expect(html).toContain('projectcalico-default-allow')
+    expect(html).toContain('Named Ports')
+    expect(html).toContain('ssh: TCP/22')
+  })
+
+  it.each(['networking.example.io/v1', 'extension.projectcalico.org/v1'])('uses the generic renderer for %s', (apiVersion) => {
+    const html = renderKind('hostendpoints', {
+      apiVersion,
+      kind: 'HostEndpoint',
+      metadata: { name: 'foreign-endpoint' },
+      spec: { providerSpecificField: 'preserved' },
+    })
+
+    expect(html).toContain('Specification')
+    expect(html).toContain('Provider Specific Field')
+    expect(html).not.toContain('Host Endpoint')
+  })
+})
+
+describe('Calico Tier collision handling', () => {
+  it.each(['crd.projectcalico.org/v1', 'projectcalico.org/v3'])('renders Tier details for %s', (apiVersion) => {
+    const html = renderKind('tiers', {
+      apiVersion,
+      kind: 'Tier',
+      metadata: { name: 'default' },
+      spec: { defaultAction: 'Deny', order: 1000000 },
+    })
+
+    expect(html).toContain('Tier')
+    expect(html).toContain('Default Action')
+    expect(html).toContain('Deny')
+    expect(html).toContain('Order')
+    expect(html).toContain('1000000')
+  })
+
+  it('renders documented defaults when fields are omitted', () => {
+    const html = renderKind('tiers', {
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'Tier',
+      metadata: { name: 'default' },
+      spec: {},
+    })
+
+    expect(html).toContain('Deny')
+    expect(html).toContain('Last (lowest precedence)')
+  })
+
+  it.each(['networking.example.io/v1', 'extension.projectcalico.org/v1'])('uses the generic renderer for %s', (apiVersion) => {
+    const html = renderKind('tiers', {
+      apiVersion,
+      kind: 'Tier',
+      metadata: { name: 'foreign-tier' },
+      spec: { providerSpecificField: 'preserved' },
+    })
+
+    expect(html).toContain('Specification')
+    expect(html).toContain('Provider Specific Field')
+    expect(html).not.toContain('Default Action')
+  })
+})
+
+describe('Calico network policy collision handling', () => {
+  const calicoPolicies = [
+    ['NetworkPolicy', 'networkpolicies', 'CalicoNetworkPolicy'],
+    ['GlobalNetworkPolicy', 'globalnetworkpolicies', 'CalicoGlobalNetworkPolicy'],
+    ['StagedNetworkPolicy', 'stagednetworkpolicies', 'CalicoStagedNetworkPolicy'],
+    ['StagedGlobalNetworkPolicy', 'stagedglobalnetworkpolicies', 'CalicoStagedGlobalNetworkPolicy'],
+    ['StagedKubernetesNetworkPolicy', 'stagedkubernetesnetworkpolicies', 'CalicoStagedKubernetesNetworkPolicy'],
+  ] as const
+
+  it.each(calicoPolicies)('renders %s for both supported Calico groups', (kind, plural, label) => {
+    for (const apiVersion of ['crd.projectcalico.org/v1', 'projectcalico.org/v3']) {
+      const spec = kind === 'StagedKubernetesNetworkPolicy'
+        ? {
+            podSelector: { matchLabels: { app: 'api' } },
+            policyTypes: ['Ingress'],
+            stagedAction: 'Deny',
+            ingress: [{ from: [{ ipBlock: { cidr: '10.0.0.0/8' } }] }],
+          }
+        : {
+            selector: "app == 'api'",
+            tier: 'security',
+            order: 100,
+            types: ['Ingress'],
+            stagedAction: 'Deny',
+            ingress: [{ action: 'Log', protocol: 'TCP', source: { nets: ['10.0.0.0/8'] } }],
+          }
+      const html = renderKind(plural, {
+        apiVersion,
+        kind,
+        metadata: { name: 'policy', namespace: 'default' },
+        spec,
+      }, 'default')
+
+      if (kind === 'StagedKubernetesNetworkPolicy') {
+        expect(html).toContain('Target')
+        expect(html).toContain('Ingress Rules')
+        expect(html).toContain('Pod Selector')
+        expect(html).toContain('Staged preview')
+        expect(html).toContain('Dashed paths are evaluated but not enforced')
+        expect(html).toContain('stroke-dasharray="4 3"')
+        expect(html).not.toContain('CalicoStagedKubernetesNetworkPolicy')
+        expect(html).not.toContain('Allow')
+      } else {
+        expect(html).toContain(label)
+        expect(html).toContain('security')
+        expect(html).toContain('Log')
+      }
+      expect(html).toContain('10.0.0.0/8')
+      if (kind.startsWith('Staged') && kind !== 'StagedKubernetesNetworkPolicy') expect(html).toContain('Deny')
+    }
+  })
+
+  it('keeps core networking.k8s.io NetworkPolicy on the core renderer', () => {
+    const html = renderKind('networkpolicies', {
+      apiVersion: 'networking.k8s.io/v1',
+      kind: 'NetworkPolicy',
+      metadata: { name: 'core', namespace: 'default' },
+      spec: { podSelector: {}, policyTypes: ['Ingress'], ingress: [] },
+    }, 'default')
+
+    expect(html).toContain('Pod Selector')
+    expect(html).toContain('Deny all ingress')
+    expect(html).not.toContain('Calico NetworkPolicy')
+  })
+
+  it('uses the native staged Kubernetes presentation without an Allow action', () => {
+    const html = renderKind('stagedkubernetesnetworkpolicies', {
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'StagedKubernetesNetworkPolicy',
+      metadata: { name: 'staged', namespace: 'default' },
+      spec: {
+        podSelector: { matchLabels: { app: 'api' } },
+        policyTypes: ['Ingress'],
+        ingress: [{}],
+      },
+    }, 'default')
+
+    expect(html).toContain('Target')
+    expect(html).toContain('Ingress Rules')
+    expect(html).toContain('All sources')
+    expect(html).toContain('Staged preview')
+    expect(html).toContain('Dashed paths are evaluated but not enforced')
+    expect(html).toContain('stroke-dasharray="4 3"')
+    expect(html).not.toContain('Allow')
+  })
+
+  it.each([
+    ['networkpolicies', 'other.example.io/v1', 'NetworkPolicy'],
+    ['networkpolicies', 'extension.projectcalico.org/v1', 'NetworkPolicy'],
+    ['globalnetworkpolicies', 'other.example.io/v1', 'GlobalNetworkPolicy'],
+    ['stagednetworkpolicies', 'other.example.io/v1', 'StagedNetworkPolicy'],
+    ['stagedglobalnetworkpolicies', 'other.example.io/v1', 'StagedGlobalNetworkPolicy'],
+    ['stagedkubernetesnetworkpolicies', 'other.example.io/v1', 'StagedKubernetesNetworkPolicy'],
+  ])('uses GenericRenderer for foreign %s/%s', (plural, apiVersion, kind) => {
+    const html = renderKind(plural, {
+      apiVersion,
+      kind,
+      metadata: { name: 'foreign', namespace: 'default' },
+      spec: { providerSpecificField: 'preserved' },
+    }, 'default')
+
+    expect(html).toContain('Specification')
+    expect(html).toContain('Provider Specific Field')
+    expect(html).not.toContain('Calico')
+  })
+})
+
 describe('colliding plurals — near-match API groups', () => {
   // A substring guard would hand these to CNPG/Velero. They are different groups.
   it.each([
@@ -264,3 +577,66 @@ describe('colliding plurals — near-match API groups', () => {
     expect(html).not.toContain('Cluster Overview')
   })
 })
+
+describe('shared plurals — the status path collides too', () => {
+  // The renderer and the status badge are two separate switches over the same
+  // plural, and fixing one leaves the other reading a foreign CRD's conditions
+  // as if they were Knative's.
+  it('does not give a foreign subscriptions CRD a Knative status', () => {
+    const s = getResourceStatus('subscriptions', {
+      apiVersion: 'operators.coreos.com/v1alpha1',
+      status: { conditions: [{ type: 'Ready', status: 'False' }], phase: 'AtLatestKnown' },
+    })
+    expect(s?.text).toBe('AtLatestKnown')
+  })
+
+  it('still gives Knative its own status', () => {
+    const s = getResourceStatus('subscriptions', {
+      apiVersion: 'messaging.knative.dev/v1',
+      status: { conditions: [{ type: 'Ready', status: 'True' }] },
+    })
+    expect(s?.text).toBe('Ready')
+  })
+
+  // The legacy namespaced Kyverno kind is served as `policies`, which several
+  // operators also use.
+  it('gives a Kyverno Policy its policy status and a foreign one the generic', () => {
+    const kyverno = getResourceStatus('policies', {
+      apiVersion: 'kyverno.io/v1',
+      spec: { validationFailureAction: 'Audit' },
+      status: { conditions: [{ type: 'Ready', status: 'True', reason: 'Succeeded' }] },
+    })
+    expect(kyverno?.text).toBeTruthy()
+    const foreign = getResourceStatus('policies', {
+      apiVersion: 'operators.coreos.com/v1',
+      status: { phase: 'Installed' },
+    })
+    expect(foreign?.text).toBe('Installed')
+  })
+})
+
+// A BackupRepository has custom table columns and raises its own issue, but no
+// detail renderer — so it renders generically. Its status still has to resolve
+// through the Velero mapping, or the drawer header prints the raw phase next to
+// a table cell showing the human label for the same object.
+describe('Velero BackupRepository status', () => {
+  const repo = (phase: string) => ({
+    apiVersion: 'velero.io/v1',
+    kind: 'BackupRepository',
+    metadata: { name: 'r', namespace: 'velero' },
+    spec: { repositoryType: 'kopia' },
+    status: { phase },
+  })
+
+  it('resolves through the Velero mapping, not the raw phase', () => {
+    expect(getResourceStatus('backuprepositories', repo('NotReady'))?.text).toBe('Not ready')
+    expect(getResourceStatus('backuprepositories', repo('Ready'))?.text).toBe('Ready')
+  })
+
+  // The plural is not Velero's alone; another group's repository must not pick
+  // up Velero's mapping.
+  it('leaves a foreign backuprepositories kind alone', () => {
+    const foreign = { ...repo('NotReady'), apiVersion: 'example.com/v1' }
+    expect(getResourceStatus('backuprepositories', foreign)?.text).not.toBe('Not ready')
+  })
+})