@skyhook-io/k8s-ui 1.12.0 → 1.13.3

package/src/utils/clipboard.test.ts

@@ -0,0 +1,86 @@
+import { describe, expect, it, vi } from 'vitest'
+
+import { copyText } from './clipboard'
+
+function fallbackDocument(copied: boolean) {
+  const document = {
+    createElement: vi.fn(() => textarea),
+    body: { appendChild: vi.fn() },
+    execCommand: vi.fn(() => copied),
+    activeElement: null as unknown,
+  }
+  const textarea = {
+    value: '',
+    style: {} as CSSStyleDeclaration,
+    setAttribute: vi.fn(),
+    select: vi.fn(() => { document.activeElement = textarea }),
+    setSelectionRange: vi.fn(),
+    remove: vi.fn(),
+  }
+  return { document, textarea }
+}
+
+describe('copyText', () => {
+  it('uses the synchronous fallback when the Clipboard API is unavailable on HTTP', async () => {
+    const { document } = fallbackDocument(true)
+
+    await expect(copyText('busybox', undefined, document as unknown as Document)).resolves.toBe(true)
+
+    expect(document.execCommand).toHaveBeenCalledWith('copy')
+  })
+
+  it('falls back to a synchronous copy command when the Clipboard API rejects', async () => {
+    const clipboard = { writeText: vi.fn().mockRejectedValue(new DOMException('Blocked', 'NotAllowedError')) }
+    const { document, textarea } = fallbackDocument(true)
+
+    await expect(copyText('busybox', clipboard, document as unknown as Document)).resolves.toBe(true)
+
+    expect(clipboard.writeText).toHaveBeenCalledWith('busybox')
+    expect(document.body.appendChild).toHaveBeenCalledWith(textarea)
+    expect(textarea.value).toBe('busybox')
+    expect(textarea.select).toHaveBeenCalledOnce()
+    expect(document.execCommand).toHaveBeenCalledWith('copy')
+    expect(textarea.remove).toHaveBeenCalledOnce()
+  })
+
+  it('restores focus to the previously active element without scrolling', async () => {
+    const { document } = fallbackDocument(true)
+    const previouslyFocused = { focus: vi.fn(), isConnected: true }
+    document.activeElement = previouslyFocused
+
+    await expect(copyText('busybox', undefined, document as unknown as Document)).resolves.toBe(true)
+
+    expect(previouslyFocused.focus).toHaveBeenCalledWith({ preventScroll: true })
+  })
+
+  it('leaves focus alone when a copy handler focused something else', async () => {
+    const { document, textarea } = fallbackDocument(true)
+    const previouslyFocused = { focus: vi.fn(), isConnected: true }
+    document.activeElement = previouslyFocused
+    const somethingElse = {}
+    textarea.select.mockImplementation(() => { document.activeElement = somethingElse })
+
+    await expect(copyText('busybox', undefined, document as unknown as Document)).resolves.toBe(true)
+
+    expect(previouslyFocused.focus).not.toHaveBeenCalled()
+  })
+
+  it('does not refocus an element that left the DOM during the copy', async () => {
+    const { document } = fallbackDocument(true)
+    const previouslyFocused = { focus: vi.fn(), isConnected: false }
+    document.activeElement = previouslyFocused
+
+    await expect(copyText('busybox', undefined, document as unknown as Document)).resolves.toBe(true)
+
+    expect(previouslyFocused.focus).not.toHaveBeenCalled()
+  })
+
+  it('does not create a fallback element when the Clipboard API succeeds', async () => {
+    const clipboard = { writeText: vi.fn().mockResolvedValue(undefined) }
+    const { document } = fallbackDocument(true)
+
+    await expect(copyText('busybox', clipboard, document as unknown as Document)).resolves.toBe(true)
+
+    expect(document.createElement).not.toHaveBeenCalled()
+  })
+})

package/src/utils/clipboard.ts

@@ -0,0 +1,50 @@
+type ClipboardWriter = Pick<Clipboard, 'writeText'>
+
+/**
+ * Copy text from a user gesture, including pages served from an insecure origin.
+ * The async Clipboard API is unavailable or rejects on plain HTTP, while the
+ * legacy command remains permitted when it runs synchronously from the click.
+ */
+export async function copyText(
+  text: string,
+  clipboard: ClipboardWriter | undefined = typeof navigator === 'undefined' ? undefined : navigator.clipboard,
+  doc: Document | undefined = typeof document === 'undefined' ? undefined : document,
+): Promise<boolean> {
+  if (clipboard?.writeText) {
+    try {
+      await clipboard.writeText(text)
+      return true
+    } catch {
+      // Fall through for insecure origins and denied Clipboard API access.
+    }
+  }
+
+  if (!doc?.body) return false
+
+  const previouslyFocused = doc.activeElement as { focus?: (options?: FocusOptions) => void; isConnected?: boolean } | null
+  const textarea = doc.createElement('textarea')
+  textarea.value = text
+  textarea.readOnly = true
+  textarea.setAttribute('aria-hidden', 'true')
+  textarea.style.position = 'fixed'
+  textarea.style.opacity = '0'
+  textarea.style.pointerEvents = 'none'
+
+  try {
+    doc.body.appendChild(textarea)
+    textarea.select()
+    textarea.setSelectionRange(0, text.length)
+    return doc.execCommand('copy')
+  } catch {
+    return false
+  } finally {
+    // Restore focus only when the textarea still owns it — a copy handler may
+    // have legitimately focused something else — and without scrolling a
+    // now-offscreen element back into view.
+    const textareaOwnsFocus = doc.activeElement === (textarea as unknown as Element)
+    textarea.remove()
+    if (textareaOwnsFocus && previouslyFocused?.isConnected !== false) {
+      previouslyFocused?.focus?.({ preventScroll: true })
+    }
+  }
+}

package/src/utils/extended-resources.ts

@@ -2,7 +2,7 @@
 // the GPU views. Keep all effective-request math here — K8s semantics for
 // extended resources are subtle and must not be reimplemented per call site.
 
-import { parseMemoryToBytes } from './format'
+import { parseQuantityToNumber } from './format'
 
 const STANDARD_NODE_RESOURCES = new Set(['cpu', 'memory', 'pods', 'ephemeral-storage'])
 
@@ -48,14 +48,11 @@ export function getEffectiveResources(resources: any): Record<string, string> {
 }
 
 // K8s quantity → number. Counts are usually plain integers, but quantities may
-// legally carry suffixes: "3000m" is 3, "3k" is 3000.
+// legally carry suffixes: "3000m" is 3, "3k" is 3000. The shared quantity
+// parser is the one place that knows the suffix table.
 function asCount(value: unknown): number {
   if (typeof value === 'number') return Number.isFinite(value) ? value : 0
-  const s = String(value ?? '').trim()
-  if (!s) return 0
-  if (/^\d+(\.\d+)?m$/.test(s)) return Number(s.slice(0, -1)) / 1000
-  const n = parseMemoryToBytes(s)
-  return Number.isFinite(n) ? n : 0
+  return parseQuantityToNumber(String(value ?? ''))
 }
 
 function containerGpuCount(container: any): number {

package/src/utils/format.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from 'vitest'
-import { formatCPUString, formatMemoryString, parseMemoryToBytes } from './format'
+import { formatCPUString, formatMemoryString, parseMemoryToBytes, parseQuantityToNumber } from './format'
 
 describe('formatCPUString', () => {
   it('renders exact zero as zero, not a fabricated near-zero', () => {
@@ -32,4 +32,86 @@ describe('parseMemoryToBytes', () => {
     expect(parseMemoryToBytes('-1Ki')).toBe(-1024)
     expect(parseMemoryToBytes('1Ki')).toBe(1024)
   })
+
+  // Aggregate cluster memory reaches suffixes a single node never carries —
+  // "1Pi" must not fall through to the bare-number fallback and read as 1 byte.
+  it('parses the large suffixes an aggregate capacity can carry', () => {
+    expect(parseMemoryToBytes('1Pi')).toBe(1024 ** 5)
+    expect(parseMemoryToBytes('1Ei')).toBe(1024 ** 6)
+    expect(parseMemoryToBytes('1P')).toBe(1000 ** 5)
+    expect(parseMemoryToBytes('1E')).toBe(1000 ** 6)
+  })
+})
+
+describe('parseQuantityToNumber', () => {
+  // The reported bug. A Quantity's canonical form collapses trailing zeros into
+  // an SI suffix, so a node started with --max-pods=1000 reports "1k". Read as
+  // a raw integer that is 1, and a node running 216 pods rendered as 216 / 1
+  // with the usage bar pegged at 21600%.
+  it('reads a pod capacity of 1000 as 1000, not 1', () => {
+    expect(parseQuantityToNumber('1k')).toBe(1000)
+    expect((216 / parseQuantityToNumber('1k')) * 100).toBeCloseTo(21.6)
+  })
+
+  it('only collapses zeros in groups of three, so nearby counts are unchanged', () => {
+    expect(parseQuantityToNumber('2k')).toBe(2000)
+    expect(parseQuantityToNumber('1020')).toBe(1020)
+    expect(parseQuantityToNumber('990')).toBe(990)
+    expect(parseQuantityToNumber('216')).toBe(216)
+  })
+
+  it('handles the sub-unit decimal suffixes a count can legally carry', () => {
+    expect(parseQuantityToNumber('3000m')).toBe(3)
+    expect(parseQuantityToNumber('1500m')).toBe(1.5)
+    expect(parseQuantityToNumber('1000000u')).toBe(1)
+    expect(parseQuantityToNumber('1000000000n')).toBe(1)
+  })
+
+  it('handles the whole decimal SI range', () => {
+    expect(parseQuantityToNumber('5M')).toBe(5e6)
+    expect(parseQuantityToNumber('5G')).toBe(5e9)
+    expect(parseQuantityToNumber('5T')).toBe(5e12)
+    expect(parseQuantityToNumber('5P')).toBe(5e15)
+    expect(parseQuantityToNumber('5E')).toBe(5e18)
+  })
+
+  it('handles binary suffixes in powers of 1024', () => {
+    expect(parseQuantityToNumber('1Ki')).toBe(1024)
+    expect(parseQuantityToNumber('2Gi')).toBe(2 * 1024 ** 3)
+    expect(parseQuantityToNumber('1Ei')).toBe(1024 ** 6)
+  })
+
+  // "1E3" is the exponent form (1000), while "1E" is exa. Deciding the exponent
+  // first is what keeps the two apart.
+  it('reads the decimal-exponent form without confusing it for exa', () => {
+    expect(parseQuantityToNumber('1e3')).toBe(1000)
+    expect(parseQuantityToNumber('1E3')).toBe(1000)
+    expect(parseQuantityToNumber('1.5e3')).toBe(1500)
+    expect(parseQuantityToNumber('1e-3')).toBe(0.001)
+    expect(parseQuantityToNumber('1E')).toBe(1e18)
+  })
+
+  it('preserves the sign', () => {
+    expect(parseQuantityToNumber('-1k')).toBe(-1000)
+    expect(parseQuantityToNumber('+1k')).toBe(1000)
+  })
+
+  // A number this cannot read is reported as unknown so the caller can fall back,
+  // rather than becoming a plausible-looking wrong number on screen.
+  it('yields zero for input it cannot parse rather than guessing', () => {
+    expect(parseQuantityToNumber('1z')).toBe(0)
+    expect(parseQuantityToNumber('1KB')).toBe(0)
+    expect(parseQuantityToNumber('abc')).toBe(0)
+    expect(parseQuantityToNumber('')).toBe(0)
+    expect(parseQuantityToNumber('   ')).toBe(0)
+    expect(parseQuantityToNumber(null)).toBe(0)
+    expect(parseQuantityToNumber(undefined)).toBe(0)
+  })
+
+  it('passes through numbers the API already decoded, and rejects non-finite ones', () => {
+    expect(parseQuantityToNumber(216)).toBe(216)
+    expect(parseQuantityToNumber(0)).toBe(0)
+    expect(parseQuantityToNumber(Number.NaN)).toBe(0)
+    expect(parseQuantityToNumber(Number.POSITIVE_INFINITY)).toBe(0)
+  })
 })

package/src/utils/format.ts

@@ -126,12 +126,15 @@ export function parseMemoryToBytes(memString: string): number {
   const num = parseFloat(match[1])
   const suffix = match[2]
 
-  // Binary suffixes (powers of 1024)
+  // Binary suffixes (powers of 1024). Pi/Ei are real inputs at cluster scale —
+  // an aggregate of a thousand 1TiB nodes serializes as "1Pi".
   const binarySuffixes: Record<string, number> = {
     'Ki': 1024,
     'Mi': 1024 ** 2,
     'Gi': 1024 ** 3,
     'Ti': 1024 ** 4,
+    'Pi': 1024 ** 5,
+    'Ei': 1024 ** 6,
   }
 
   // Decimal suffixes (powers of 1000)
@@ -141,6 +144,8 @@ export function parseMemoryToBytes(memString: string): number {
     'M': 1000 ** 2,
     'G': 1000 ** 3,
     'T': 1000 ** 4,
+    'P': 1000 ** 5,
+    'E': 1000 ** 6,
   }
 
   if (suffix in binarySuffixes) {
@@ -164,6 +169,80 @@ export function formatMemoryString(memString: string): string {
   return formatMemoryBytes(parseMemoryToBytes(memString))
 }
 
+// =============================================================================
+// Quantity Parsing (counts)
+// =============================================================================
+
+/**
+ * Every suffix a `resource.Quantity` can carry, in the API's own groupings:
+ * decimal SI in powers of 1000 (including the sub-unit n/u/m), and binary SI in
+ * powers of 1024. `K` is not canonical Kubernetes — only lowercase `k` is — but
+ * it is accepted here for the same leniency `parseMemoryToBytes` already has.
+ */
+const QUANTITY_SUFFIXES: Record<string, number> = {
+  n: 1e-9,
+  u: 1e-6,
+  m: 1e-3,
+  k: 1e3,
+  K: 1e3,
+  M: 1e6,
+  G: 1e9,
+  T: 1e12,
+  P: 1e15,
+  E: 1e18,
+  Ki: 1024,
+  Mi: 1024 ** 2,
+  Gi: 1024 ** 3,
+  Ti: 1024 ** 4,
+  Pi: 1024 ** 5,
+  Ei: 1024 ** 6,
+}
+
+/**
+ * Parse a Kubernetes `resource.Quantity` into a plain number.
+ *
+ * Counts are the surface that needs this. A Quantity's canonical serialization
+ * collapses trailing zeros into an SI suffix, so a node started with
+ * `--max-pods=1000` reports `"1k"` and not `"1000"` — read as a raw integer
+ * that is 1, so a usage bar divides by 1 instead of 1000. Any count that is
+ * a multiple of 1000 hits it.
+ *
+ * Unlike `parseMemoryToBytes`, an unrecognised suffix yields 0 rather than the
+ * bare number: a Quantity this cannot read is better reported as unknown by the
+ * caller than silently turned into a plausible-looking wrong number.
+ *
+ * @param quantity - K8s quantity like "1k", "216", "3000m", "2Gi", "1e3"
+ * @returns The value as a number, or 0 when it cannot be parsed
+ */
+export function parseQuantityToNumber(quantity: string | number | null | undefined): number {
+  if (typeof quantity === 'number') return Number.isFinite(quantity) ? quantity : 0
+  if (!quantity) return 0
+
+  const str = String(quantity).trim()
+  if (!str) return 0
+
+  // Decimal-exponent form. A Quantity's suffix is either an SI suffix or an
+  // exponent, never both, so this is decided before the suffix table — which
+  // also keeps "1E3" (1000) from being read as exa (1e18).
+  const exponent = str.match(/^([+-]?\d+(?:\.\d+)?)[eE]([+-]?\d+)$/)
+  if (exponent) {
+    const value = Number(`${exponent[1]}e${exponent[2]}`)
+    return Number.isFinite(value) ? value : 0
+  }
+
+  const match = str.match(/^([+-]?\d+(?:\.\d+)?)\s*([A-Za-z]*)$/)
+  if (!match) return 0
+
+  const num = parseFloat(match[1])
+  if (!Number.isFinite(num)) return 0
+
+  const suffix = match[2]
+  if (!suffix) return num
+
+  const multiplier = QUANTITY_SUFFIXES[suffix]
+  return multiplier === undefined ? 0 : num * multiplier
+}
+
 // =============================================================================
 // Dashboard Metrics Formatting (different units from metrics-server)
 // =============================================================================

package/src/utils/inClusterConsent.test.ts

@@ -26,6 +26,15 @@ describe('inClusterConsent', () => {
     expect(inClusterConsentGiven('prod')).toBe(false)
   })
 
+  it('does not trust consent stored under the visible-name key format', () => {
+    const store: Record<string, string> = { 'radar.inClusterConsent.prod': '1' }
+    vi.stubGlobal('localStorage', {
+      getItem: (k: string) => (k in store ? store[k] : null),
+      setItem: (k: string, v: string) => { store[k] = v },
+    })
+    expect(inClusterConsentGiven('prod')).toBe(false)
+  })
+
   it('does not throw when localStorage is unavailable, and reports not-given', () => {
     vi.stubGlobal('localStorage', {
       getItem: () => { throw new Error('denied') },

package/src/utils/inClusterConsent.ts

@@ -1,9 +1,9 @@
 // Consent memory for the mutating in-cluster reachability test (it creates a
-// short-lived Job/pod). Keyed by CLUSTER so a "don't ask again" on one cluster
+// short-lived Job/pod). Keyed by an opaque source identity so a "don't ask again" on one cluster
 // never silently suppresses the confirm on another - the cluster the pod lands
 // in is the whole point of asking. Switching kube-context re-prompts.
 //
-// No cluster identity → no memory of ANY kind: the operator is asked on every
+// No source identity → no memory of ANY kind: the operator is asked on every
 // run. localStorage is per-ORIGIN, and one origin (Radar Hub) can front many
 // clusters, so a shared fallback key would let "don't ask again" on one cluster
 // suppress the pod-creating confirm on all of them - and even an in-memory
@@ -11,22 +11,22 @@
 // The dialog hides its "don't ask again" checkbox in that case, so nothing is
 // promised that doesn't stick.
 
-const key = (cluster: string) => `radar.inClusterConsent.${cluster}`
+const key = (clusterKey: string) => `radar.inClusterConsent.v2.${clusterKey}`
 
-export function inClusterConsentGiven(cluster?: string): boolean {
-  if (!cluster) return false
+export function inClusterConsentGiven(clusterKey?: string): boolean {
+  if (!clusterKey) return false
   try {
-    return localStorage.getItem(key(cluster)) === '1'
+    return localStorage.getItem(key(clusterKey)) === '1'
   } catch {
     // localStorage unavailable (private mode / non-browser) - fail toward asking.
     return false
   }
 }
 
-export function rememberInClusterConsent(cluster?: string): void {
-  if (!cluster) return
+export function rememberInClusterConsent(clusterKey?: string): void {
+  if (!clusterKey) return
   try {
-    localStorage.setItem(key(cluster), '1')
+    localStorage.setItem(key(clusterKey), '1')
   } catch {
     // Non-fatal: if we can't persist, the user is simply asked again next time.
   }

package/src/utils/index.ts

@@ -9,6 +9,7 @@ export * from './animation'
 export * from './resource-hierarchy'
 export * from './log-format'
 export * from './download'
+export * from './clipboard'
 export * from './env-from'
 export * from './extended-resources'
 export * from './api-resources'

package/src/utils/navigation.test.ts

@@ -24,6 +24,11 @@ describe('kindToPlural', () => {
 
   test('handles kinds ending in consonant+y (changes to -ies)', () => {
     expect(kindToPlural('NetworkPolicy')).toBe('networkpolicies')
+    expect(kindToPlural('CalicoNetworkPolicy')).toBe('networkpolicies')
+    expect(kindToPlural('CalicoGlobalNetworkPolicy')).toBe('globalnetworkpolicies')
+    expect(kindToPlural('CalicoStagedNetworkPolicy')).toBe('stagednetworkpolicies')
+    expect(kindToPlural('CalicoStagedGlobalNetworkPolicy')).toBe('stagedglobalnetworkpolicies')
+    expect(kindToPlural('CalicoStagedKubernetesNetworkPolicy')).toBe('stagedkubernetesnetworkpolicies')
   })
 
   test('handles already-plural kind names (Endpoints)', () => {

package/src/utils/navigation.ts

@@ -100,6 +100,11 @@ export function kindToPlural(kind: string): string {
     horizontalpodautoscaler: 'horizontalpodautoscalers',
     pvc: 'persistentvolumeclaims',
     podgroup: 'pods',
+    caliconetworkpolicy: 'networkpolicies',
+    calicoglobalnetworkpolicy: 'globalnetworkpolicies',
+    calicostagednetworkpolicy: 'stagednetworkpolicies',
+    calicostagedglobalnetworkpolicy: 'stagedglobalnetworkpolicies',
+    calicostagedkubernetesnetworkpolicy: 'stagedkubernetesnetworkpolicies',
   }
   if (aliases[kindLower]) return aliases[kindLower]
 

package/src/utils/resource-icons.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest'
-import { Database, Server, Puzzle } from 'lucide-react'
-import { getResourceIcon, DEFAULT_RESOURCE_ICON } from './resource-icons'
+import { Database, Network, Server, ShieldCheck, Puzzle } from 'lucide-react'
+import { getResourceIcon, getTopologyIcon, DEFAULT_RESOURCE_ICON } from './resource-icons'
 
 describe('getResourceIcon', () => {
   it('disambiguates colliding kinds by API group', () => {
@@ -14,6 +14,53 @@ describe('getResourceIcon', () => {
     // A third operator's `clusters` CRD must not inherit a Postgres icon.
     expect(getResourceIcon('Cluster', 'apps.kubeblocks.io')).toBe(DEFAULT_RESOURCE_ICON)
     expect(getResourceIcon('Backup', 'kubevirt.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('HostEndpoint', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('IPPool', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('IPPool', 'extension.projectcalico.org')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('Tier', 'extension.projectcalico.org')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('resolves Calico IPPool only for Calico API groups', () => {
+    expect(getResourceIcon('IPPool', 'crd.projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('IPPool', 'projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('IPPool')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('resolves Calico HostEndpoint only for Calico API groups', () => {
+    expect(getResourceIcon('HostEndpoint', 'crd.projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('HostEndpoint', 'projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('HostEndpoint')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('resolves Calico Tier only for Calico API groups', () => {
+    expect(getResourceIcon('Tier', 'crd.projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('Tier', 'projectcalico.org')).toBe(Network)
+    expect(getResourceIcon('Tier')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('disambiguates NetworkPolicy and Calico policy kinds by API group', () => {
+    expect(getResourceIcon('NetworkPolicy', 'networking.k8s.io')).toBe(ShieldCheck)
+    expect(getResourceIcon('NetworkPolicy', 'projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('NetworkPolicy', 'crd.projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('NetworkPolicy', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+    expect(getResourceIcon('GlobalNetworkPolicy', 'projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('StagedNetworkPolicy', 'crd.projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('StagedGlobalNetworkPolicy', 'projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('StagedKubernetesNetworkPolicy', 'crd.projectcalico.org')).toBe(ShieldCheck)
+    expect(getResourceIcon('GlobalNetworkPolicy', 'networking.example.io')).toBe(DEFAULT_RESOURCE_ICON)
+  })
+
+  it('uses ShieldCheck for all Calico policy topology nodes', () => {
+    for (const kind of [
+      'CalicoNetworkPolicy',
+      'CalicoGlobalNetworkPolicy',
+      'CalicoStagedNetworkPolicy',
+      'CalicoStagedGlobalNetworkPolicy',
+      'CalicoStagedKubernetesNetworkPolicy',
+    ]) {
+      expect(getTopologyIcon(kind)).toBe(ShieldCheck)
+      expect(getResourceIcon(kind)).toBe(ShieldCheck)
+    }
   })
 
   it('ignores the group for kinds that do not collide', () => {

package/src/utils/resource-icons.ts

@@ -20,6 +20,7 @@ import {
   ShieldAlert,
   Radio,
   Globe,
+  Network,
 
   // Config
   FileSliders,
@@ -96,6 +97,11 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   service: Plug,
   ingress: DoorOpen,
   networkpolicy: ShieldCheck,
+  caliconetworkpolicy: ShieldCheck,
+  calicoglobalnetworkpolicy: ShieldCheck,
+  calicostagednetworkpolicy: ShieldCheck,
+  calicostagedglobalnetworkpolicy: ShieldCheck,
+  calicostagedkubernetesnetworkpolicy: ShieldCheck,
   ciliumnetworkpolicy: ShieldCheck,
   ciliumclusterwidenetworkpolicy: ShieldCheck,
   clusternetworkpolicy: ShieldCheck,
@@ -291,13 +297,33 @@ const GROUP_QUALIFIED_KIND_ICONS: Record<string, Record<string, LucideIcon>> = {
   backup: { 'postgresql.cnpg.io': DatabaseBackup },
   scheduledbackup: { 'postgresql.cnpg.io': DatabaseBackup },
   pooler: { 'postgresql.cnpg.io': Waypoints },
+  networkpolicy: {
+    'networking.k8s.io': ShieldCheck,
+    'crd.projectcalico.org': ShieldCheck,
+    'projectcalico.org': ShieldCheck,
+  },
+  hostendpoint: { 'crd.projectcalico.org': Network, 'projectcalico.org': Network },
+  ippool: { 'crd.projectcalico.org': Network, 'projectcalico.org': Network },
+  tier: { 'crd.projectcalico.org': Network, 'projectcalico.org': Network },
+  globalnetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+  stagednetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+  stagedglobalnetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+  stagedkubernetesnetworkpolicy: { 'crd.projectcalico.org': ShieldCheck, 'projectcalico.org': ShieldCheck },
+}
+
+const TOPOLOGY_KIND_ICONS: Record<string, LucideIcon> = {
+  CalicoNetworkPolicy: ShieldCheck,
+  CalicoGlobalNetworkPolicy: ShieldCheck,
+  CalicoStagedNetworkPolicy: ShieldCheck,
+  CalicoStagedGlobalNetworkPolicy: ShieldCheck,
+  CalicoStagedKubernetesNetworkPolicy: ShieldCheck,
 }
 
 export function getResourceIcon(kind: string, group?: string): LucideIcon {
   const k = kind.toLowerCase()
   if (group) {
-    const byGroup = GROUP_QUALIFIED_KIND_ICONS[k]?.[group]
-    if (byGroup) return byGroup
+    const groupMap = GROUP_QUALIFIED_KIND_ICONS[k]
+    if (groupMap) return groupMap[group] ?? DEFAULT_RESOURCE_ICON
   }
   return KIND_ICON_MAP[k] ?? Puzzle
 }
@@ -306,6 +332,7 @@ export function getResourceIcon(kind: string, group?: string): LucideIcon {
 export function getTopologyIcon(kind: string): LucideIcon {
   if (kind === 'Internet') return Globe
   if (kind === 'PodGroup') return Boxes
+  if (TOPOLOGY_KIND_ICONS[kind]) return TOPOLOGY_KIND_ICONS[kind]
   return getResourceIcon(kind)
 }