@skyhook-io/k8s-ui 1.13.3 → 1.13.4

package/src/components/issues/issue-timing.ts

@@ -1,4 +1,3 @@
-import { formatRelativeAgeTime } from '../../utils/format';
 import { isDeploymentLikeWorkloadKind } from '../../types';
 import type { Issue } from './types';
 
@@ -11,6 +10,27 @@ export interface IssueTimingDisplay {
   tooltip: string;
 }
 
+export function issueFirstSeenTitle(issue: Issue): string | null {
+  if (!issue.first_seen) return null;
+  const coverage = issue.onset_coverage;
+  const unknown = coverage?.unknown ?? 0;
+  const base = `Active at least since ${new Date(issue.first_seen).toLocaleString()}`;
+  if (unknown === 0) return `${base}.`;
+  const total = (coverage?.known ?? 0) + unknown;
+  return `${base}; timing unknown for ${unknown} of ${total} signals.`;
+}
+
+export function issueResourceCreatedTitle(issue: Issue): string | null {
+  if (!issue.resource_created_at) return null;
+  const affectedCount = Math.max(issue.count ?? 0, issue.members?.length ?? 0);
+  const label = affectedCount > 1
+    ? 'Oldest affected resource created'
+    : affectedCount === 1
+      ? 'Affected resource created'
+      : 'Resource created';
+  return `${label} ${new Date(issue.resource_created_at).toLocaleString()}`;
+}
+
 function isDeploymentLikeCreation(issue: Issue): boolean {
   const group = issue.group ?? '';
   if (issue.kind === 'Pod') {
@@ -20,18 +40,117 @@ function isDeploymentLikeCreation(issue: Issue): boolean {
   return isDeploymentLikeWorkloadKind(issue.kind, group);
 }
 
+function issueTimingIndependentOfOnset(issue: Issue): boolean {
+  return issue.issue_timing_basis === 'owner_condition'
+    || issue.issue_timing_basis === 'pod_creation'
+    || issue.issue_timing_basis === 'spec';
+}
+
+function onsetUncertaintyMeta(issue: Issue): string {
+  const coverage = issue.onset_coverage;
+  const unknown = coverage?.unknown ?? 0;
+  if (issue.first_seen && (coverage?.known ?? 0) > 0 && unknown > 0) {
+    return `exact onset unknown for ${unknown} of ${(coverage?.known ?? 0) + unknown} signals`;
+  }
+  return 'exact onset unknown';
+}
+
+function onsetUncertaintyTooltip(issue: Issue): string {
+  const coverage = issue.onset_coverage;
+  const unknown = coverage?.unknown ?? 0;
+  if (issue.first_seen && (coverage?.known ?? 0) > 0 && unknown > 0) {
+    return `Exact onset is unavailable for ${unknown} of ${(coverage?.known ?? 0) + unknown} signals.`;
+  }
+  return 'Exact onset of this issue is unavailable.';
+}
+
+export function issueTimingForDisplay(issue: Issue): IssueTimingDisplay | null {
+  const partialOnset = Boolean(issue.first_seen && (issue.onset_coverage?.unknown ?? 0) > 0);
+  if (partialOnset && !issueTimingIndependentOfOnset(issue)) return null;
+  return issueTiming(issue);
+}
+
 export function issueTiming(issue: Issue): IssueTimingDisplay | null {
+  const coverage = issue.onset_coverage;
+  const onsetUnknown = issue.onset_unknown || (coverage?.unknown ?? 0) > 0;
+  const mixedOnset = Boolean(issue.first_seen && (coverage?.known ?? 0) > 0 && (coverage?.unknown ?? 0) > 0);
+  const grouped = (coverage?.known ?? 0) + (coverage?.unknown ?? 0) > 1;
+  const uncertaintyMeta = onsetUncertaintyMeta(issue);
+  const uncertaintyTooltip = onsetUncertaintyTooltip(issue);
   switch (issue.issue_timing) {
     case 'started_after_resource_was_healthy': {
-      const started = issue.first_seen ? `started ${formatRelativeAgeTime(issue.first_seen)} after being healthy` : 'started after being healthy';
+      if (issue.issue_timing_basis === 'owner_condition') {
+        if (onsetUnknown) {
+          return {
+            kind: 'regression',
+            chip: mixedOnset ? 'health regressed' : 'workload regressed · onset unknown',
+            meta: `${uncertaintyMeta}; owner workload was healthy before its current health regression`,
+            tooltip: `The owner workload had a healthy period before its current failing condition. ${uncertaintyTooltip}`,
+          };
+        }
+        return {
+          kind: 'regression',
+          chip: 'health regressed',
+          meta: 'workload health regressed',
+          tooltip: 'The owner workload had a healthy period before its current failing condition. This does not date or attribute this specific issue.',
+        };
+      }
+      if (onsetUnknown && issue.issue_timing_basis === 'pod_creation') {
+        if (grouped) {
+          return {
+            kind: 'regression',
+            chip: 'new pods failed after healthy',
+            meta: `${uncertaintyMeta}; failing pods were created after an earlier healthy period`,
+            tooltip: `Failing pods were created after an earlier healthy period. ${uncertaintyTooltip}`,
+          };
+        }
+        return {
+          kind: 'regression',
+          chip: 'later rollout regressed',
+          meta: `${uncertaintyMeta}; affected pod belongs to a later rollout after an earlier healthy period`,
+          tooltip: `The affected pod belongs to a later workload revision after an earlier healthy period. ${uncertaintyTooltip}`,
+        };
+      }
       return {
         kind: 'regression',
         chip: 'after healthy',
-        meta: started,
-        tooltip: 'Previously healthy before this failing signal.',
+        meta: 'failing evidence followed a healthy period',
+        tooltip: 'A healthy period preceded this failing evidence.',
       };
     }
     case 'started_at_resource_creation': {
+      if (onsetUnknown && issue.issue_timing_basis === 'owner_condition') {
+        return {
+          kind: 'creation',
+          chip: 'workload never healthy',
+          meta: `${uncertaintyMeta}; owner workload never became healthy after deployment`,
+          tooltip: `The owner workload never became healthy after deployment. ${uncertaintyTooltip}`,
+        };
+      }
+      if (onsetUnknown && issue.issue_timing_basis === 'pod_creation') {
+        if (grouped) {
+          return {
+            kind: 'creation',
+            chip: 'startup pod failures',
+            meta: `${uncertaintyMeta}; failures occurred in pods created during workload startup`,
+            tooltip: `Failures occurred in pods created during workload startup. ${uncertaintyTooltip}`,
+          };
+        }
+        return {
+          kind: 'creation',
+          chip: 'pod failed at startup',
+          meta: `${uncertaintyMeta}; affected pod failed during workload startup`,
+          tooltip: `The affected pod failed during startup of its workload revision. ${uncertaintyTooltip}`,
+        };
+      }
+      if (onsetUnknown && issue.issue_timing_basis === 'spec') {
+        return {
+          kind: 'creation',
+          chip: 'invalid at first reconcile',
+          meta: `${uncertaintyMeta}; initial spec was failing from first reconciliation`,
+          tooltip: `The initial specification establishes that the resource was failing from its first reconciliation. ${uncertaintyTooltip}`,
+        };
+      }
       if (isDeploymentLikeCreation(issue)) {
         return {
           kind: 'creation',

package/src/components/issues/issues.test.ts

@@ -1,10 +1,10 @@
 import { afterEach, describe, it, expect, vi } from 'vitest'
 import { createElement } from 'react'
 import { renderToString } from 'react-dom/server'
-import { compareIssues, subjectRef, memberRef, normalizeImagePullMessage, issueMessageParts, type Issue } from './types'
+import { compareIssues, issueSortAnchor, subjectRef, memberRef, normalizeImagePullMessage, issueMessageParts, type Issue } from './types'
 import { categoryLabel, groupBadgeClass, groupLabel } from './severity'
 import { IssueRow } from './IssuesView'
-import { issueTiming } from './issue-timing'
+import { issueFirstSeenTitle, issueResourceCreatedTitle, issueTiming } from './issue-timing'
 
 const base: Issue = {
   id: 'id-0',
@@ -36,6 +36,12 @@ describe('compareIssues', () => {
     expect([older, newer].sort(compareIssues).map((i) => i.id)).toEqual(['n', 'o'])
   })
 
+  it('compares sort anchors as instants across timezone formats', () => {
+    const newerLocal = mk({ id: 'local', first_seen: '2026-08-09T23:00:00-07:00' })
+    const olderUTC = mk({ id: 'utc', onset_unknown: true, resource_created_at: '2026-08-10T01:00:00Z' })
+    expect([olderUTC, newerLocal].sort(compareIssues).map((i) => i.id)).toEqual(['local', 'utc'])
+  })
+
   it('orders direct startup blockers before generic problem rows at same severity', () => {
     const generic = mk({ id: 'generic', source: 'problem', first_seen: '2026-05-01T00:00:00Z' })
     const blocker = mk({ id: 'blocker', source: 'scheduling', first_seen: '2026-01-01T00:00:00Z' })
@@ -56,6 +62,21 @@ describe('compareIssues', () => {
     const after = [aRefetched, b].sort(compareIssues).map((i) => i.id)
     expect(after).toEqual(before)
   })
+
+  it('uses resource creation as the stable fallback only when onset is unknown', () => {
+    const unknownOlder = mk({ id: 'unknown-old', name: 'unknown-old', onset_unknown: true, resource_created_at: '2026-01-01T00:00:00Z' })
+    const unknownNewer = mk({ id: 'unknown-new', name: 'unknown-new', onset_unknown: true, resource_created_at: '2026-05-01T00:00:00Z' })
+    const known = mk({ id: 'known', name: 'known', first_seen: '2026-03-01T00:00:00Z', resource_created_at: '2025-01-01T00:00:00Z' })
+    const noMetadata = mk({ id: 'none', name: 'none', onset_unknown: true })
+
+    expect(issueSortAnchor(known)).toBe('2026-03-01T00:00:00Z')
+    expect([unknownOlder, noMetadata, known, unknownNewer].sort(compareIssues).map((i) => i.id)).toEqual([
+      'unknown-new',
+      'known',
+      'unknown-old',
+      'none',
+    ])
+  })
 })
 
 describe('category/group label fallbacks', () => {
@@ -127,16 +148,148 @@ describe('IssueRow', () => {
     expect(html).toContain(groupBadgeClass('control_plane'))
   })
 
-  it('shows an explicit unknown-onset state instead of inventing an age', () => {
+  it('does not fill collapsed rows with low-information unknown-onset labels', () => {
     const html = renderToString(createElement(IssueRow, {
       issue: mk({ onset_unknown: true }),
       open: false,
       onToggle: () => undefined,
     }))
 
-    expect(html).toContain('Onset unknown')
+    expect(html).not.toMatch(/onset unknown/i)
     expect(html).not.toContain('0s')
   })
+
+  it('shows independent timing alongside an unknown onset', () => {
+    const html = renderToString(createElement(IssueRow, {
+      issue: mk({
+        onset_unknown: true,
+        issue_timing: 'started_at_resource_creation',
+        issue_timing_basis: 'owner_condition',
+      }),
+      open: true,
+      onToggle: () => undefined,
+    }))
+
+    expect(html).toContain('workload never healthy')
+    expect(html).toContain('exact onset unknown; owner workload never became healthy after deployment')
+    expect(html).not.toContain('since deploy')
+  })
+
+  it('qualifies a workload regression when the issue onset is unknown', () => {
+    const html = renderToString(createElement(IssueRow, {
+      issue: mk({
+        onset_unknown: true,
+        issue_timing: 'started_after_resource_was_healthy',
+        issue_timing_basis: 'owner_condition',
+      }),
+      open: true,
+      onToggle: () => undefined,
+    }))
+
+    expect(html).toContain('workload regressed')
+    expect(html).toContain('onset unknown')
+    expect(html).toContain('exact onset unknown; owner workload was healthy before its current health regression')
+    expect(html).not.toContain('workload health regressed')
+  })
+
+  it('renders mixed groups as a lower-bound age and suppresses a group-wide timing claim', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-06-30T12:00:00Z'))
+
+    const html = renderToString(createElement(IssueRow, {
+      issue: mk({
+        first_seen: '2026-06-30T10:00:00Z',
+        onset_coverage: { known: 2, unknown: 1 },
+        issue_timing: 'started_after_resource_was_healthy',
+      }),
+      open: true,
+      onToggle: () => undefined,
+    }))
+
+    expect(html).toContain('≥')
+    expect(html).toContain('timing unknown for 1 of 3 signals')
+    expect(html).not.toContain('after healthy')
+  })
+
+  it('keeps onset-independent workload evidence visible on mixed groups', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-06-30T12:00:00Z'))
+
+    const html = renderToString(createElement(IssueRow, {
+      issue: mk({
+        first_seen: '2026-06-30T10:00:00Z',
+        onset_coverage: { known: 1, unknown: 1 },
+        issue_timing: 'started_after_resource_was_healthy',
+        issue_timing_basis: 'owner_condition',
+      }),
+      open: true,
+      onToggle: () => undefined,
+    }))
+
+    expect(html).toContain('≥')
+    expect(html).toContain('health regressed')
+    expect(html).not.toContain('workload regressed')
+    expect(html).not.toContain('workload regressed · onset unknown')
+    expect(html).toContain('exact onset unknown for 1 of 2 signals')
+    expect(html).toContain('some signals active at least 2h ago')
+    expect(html).not.toContain('exact onset unknown;')
+  })
+
+  it('keeps lower-bound age, unknown count, and freshness for mixed creation groups', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-06-30T12:00:00Z'))
+
+    const html = renderToString(createElement(IssueRow, {
+      issue: mk({
+        first_seen: '2026-06-30T10:00:00Z',
+        last_seen: '2026-06-30T11:30:00Z',
+        onset_coverage: { known: 1, unknown: 1 },
+        issue_timing: 'started_at_resource_creation',
+        issue_timing_basis: 'owner_condition',
+      }),
+      open: true,
+      onToggle: () => undefined,
+    }))
+
+    expect(html).toContain('workload never healthy')
+    expect(html).toContain('exact onset unknown for 1 of 2 signals')
+    expect(html).toContain('some signals active at least 2h ago')
+    expect(html).toContain('last seen 30m ago')
+  })
+
+  it('presents ordinary first-seen time as a conservative active lower bound', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(new Date('2026-06-30T12:00:00Z'))
+
+    const html = renderToString(createElement(IssueRow, {
+      issue: mk({ first_seen: '2026-06-30T10:00:00Z' }),
+      open: true,
+      onToggle: () => undefined,
+    }))
+
+    expect(html).toContain('active at least 2h ago')
+    expect(html).not.toContain('started 2h ago')
+  })
+})
+
+describe('onset provenance copy', () => {
+  it('describes a known first-seen value as an active lower bound', () => {
+    const title = issueFirstSeenTitle(mk({ first_seen: '2026-06-30T10:00:00Z' }))
+
+    expect(title).toContain('Active at least since')
+    expect(title).not.toContain('started')
+  })
+
+  it('labels a one-member workload rollup as affected-resource context', () => {
+    const title = issueResourceCreatedTitle(mk({
+      kind: 'Deployment',
+      count: 1,
+      members: [{ kind: 'Pod', namespace: 'prod', name: 'web-abc' }],
+      resource_created_at: '2026-06-30T10:00:00Z',
+    }))
+
+    expect(title).toContain('Affected resource created')
+  })
 })
 
 describe('issueTiming', () => {
@@ -184,6 +337,51 @@ describe('issueTiming', () => {
     })
   })
 
+  it('uses self-explanatory copy when exact onset and independent timing have different scopes', () => {
+    expect(issueTiming(mk({
+      kind: 'Pod',
+      onset_unknown: true,
+      issue_timing: 'started_at_resource_creation',
+      issue_timing_basis: 'pod_creation',
+    }))).toMatchObject({
+      chip: 'pod failed at startup',
+      meta: 'exact onset unknown; affected pod failed during workload startup',
+    })
+
+    expect(issueTiming(mk({
+      kind: 'Rollout',
+      group: 'argoproj.io',
+      onset_unknown: true,
+      issue_timing: 'started_at_resource_creation',
+      issue_timing_basis: 'spec',
+    }))).toMatchObject({
+      chip: 'invalid at first reconcile',
+      meta: 'exact onset unknown; initial spec was failing from first reconciliation',
+    })
+  })
+
+  it('uses group-safe pod timing copy for multiple contributing signals', () => {
+    expect(issueTiming(mk({
+      kind: 'Deployment',
+      onset_coverage: { known: 0, unknown: 3 },
+      issue_timing: 'started_at_resource_creation',
+      issue_timing_basis: 'pod_creation',
+    }))).toMatchObject({
+      chip: 'startup pod failures',
+      meta: 'exact onset unknown; failures occurred in pods created during workload startup',
+    })
+
+    expect(issueTiming(mk({
+      kind: 'Deployment',
+      onset_coverage: { known: 0, unknown: 3 },
+      issue_timing: 'started_after_resource_was_healthy',
+      issue_timing_basis: 'pod_creation',
+    }))).toMatchObject({
+      chip: 'new pods failed after healthy',
+      meta: 'exact onset unknown; failing pods were created after an earlier healthy period',
+    })
+  })
+
   it('uses resource creation wording for non-deployment creation failures', () => {
     expect(issueTiming(mk({
       kind: 'PersistentVolumeClaim',
@@ -196,10 +394,7 @@ describe('issueTiming', () => {
     })
   })
 
-  it('describes after-healthy timing without implying root cause or safety', () => {
-    vi.useFakeTimers()
-    vi.setSystemTime(new Date('2026-06-30T12:00:00Z'))
-
+  it('describes direct after-healthy timing without coupling it to first_seen', () => {
     const display = issueTiming(mk({
       first_seen: '2026-06-30T10:00:00Z',
       issue_timing: 'started_after_resource_was_healthy',
@@ -209,12 +404,28 @@ describe('issueTiming', () => {
     expect(display).toMatchObject({
       kind: 'regression',
       chip: 'after healthy',
-      meta: 'started 2h ago after being healthy',
-      tooltip: 'Previously healthy before this failing signal.',
+      meta: 'failing evidence followed a healthy period',
     })
+    expect(`${display?.chip} ${display?.meta} ${display?.tooltip}`).not.toContain('2h')
     expect(`${display?.chip} ${display?.meta} ${display?.tooltip}`).not.toMatch(/baseline|safe|ignore/i)
   })
 
+  it('presents owner-condition timing as workload-level rather than cause-specific', () => {
+    const display = issueTiming(mk({
+      first_seen: '2026-06-30T10:00:00Z',
+      issue_timing: 'started_after_resource_was_healthy',
+      issue_timing_basis: 'owner_condition',
+    }))
+
+    expect(display).toMatchObject({
+      kind: 'regression',
+      chip: 'health regressed',
+      meta: 'workload health regressed',
+    })
+    expect(display?.tooltip).toContain('does not date or attribute this specific issue')
+    expect(`${display?.chip} ${display?.meta} ${display?.tooltip}`).not.toContain('2h')
+  })
+
   it('returns null when there is no confident timing signal', () => {
     expect(issueTiming(mk({ issue_timing: undefined, issue_timing_basis: undefined }))).toBeNull()
   })

package/src/components/issues/types.ts

@@ -197,10 +197,20 @@ export interface Issue {
    *  message. The Issues view uses it to link these — and only these — to the
    *  Capacity / Demand view, so a generic scheduling failure never links. */
   capacity_relevant?: boolean;
+  /** Earliest evidence-backed time the issue was active. This may be when Radar
+   *  first observed the state rather than exact onset: read as "active at least
+   *  since", never as proof of a healthy-duration boundary. */
   first_seen?: string;
   /** Radar can confirm the issue is active, but current cluster evidence does
    *  not establish when the failing state began. */
   onset_unknown?: boolean;
+  onset_coverage?: {
+    known: number;
+    unknown: number;
+  };
+  /** Kubernetes object creation time. Context and a stable sort fallback only;
+   *  it is not evidence that the issue began then. */
+  resource_created_at?: string;
   last_seen?: string;
   /** Affected-resource fan-out, EXCLUDING the subject (the row header).
    *  0/omitted for a single-resource issue; e.g. 50 for one Deployment's
@@ -226,11 +236,15 @@ export interface Issue {
    * "started_at_resource_creation"        — failing state began during resource
    *                                        creation or first reconciliation.
    * "started_after_resource_was_healthy"  — a meaningful healthy window preceded
-   *                                        the failing state.
+   *                                        the failing state. Owner-condition
+   *                                        evidence is workload-level, not timing
+   *                                        or attribution for this specific reason.
    */
   issue_timing?: 'started_at_resource_creation' | 'started_after_resource_was_healthy';
   /** The evidence that determined issue_timing (for auditability). */
   issue_timing_basis?: 'condition' | 'owner_condition' | 'pod_creation' | 'deletion' | 'phase' | 'spec';
+  /** Plain-language explanation when timing fields describe different scopes. */
+  timing_summary?: string;
 
   /** Recent non-status changes (spec/config and lifecycle) on this issue's
    *  subject (and, for workload subjects, its referenced ConfigMaps) —
@@ -273,20 +287,32 @@ export function memberRef(issue: Issue, member: IssueResourceRef): IssueResource
 /**
  * compareIssues is the queue's stable sort order (extracted from IssuesView so
  * it can be unit-tested). Severity first (critical before warning), then
- * direct-blocker source priority, then ONSET — first_seen DESC, deliberately
+ * direct-blocker source priority, then the evidence-backed active-time anchor —
+ * first_seen DESC, deliberately
  * NOT last_seen: last_seen bumps to compose-time on every poll, so sorting by
  * it would reshuffle same-severity rows on each refetch. The remaining keys
  * (cluster → namespace → name → id) are a fully deterministic tiebreak so the
  * order never churns under auto-refresh.
+ * JavaScript timestamp comparison is millisecond-precision; sub-millisecond
+ * ties fall through to the stable keys below.
  */
+export function issueSortAnchor(issue: Issue): string {
+  return issue.first_seen ?? issue.resource_created_at ?? '';
+}
+
+export function compareIssueSortAnchors(a: Issue, b: Issue): number {
+  const ta = Date.parse(issueSortAnchor(a)) || 0;
+  const tb = Date.parse(issueSortAnchor(b)) || 0;
+  return tb - ta;
+}
+
 export function compareIssues(a: Issue, b: Issue): number {
   const r = ISSUE_SEVERITY_RANK[b.severity] - ISSUE_SEVERITY_RANK[a.severity];
   if (r !== 0) return r;
   const sr = (ISSUE_SOURCE_RANK[b.source] ?? 0) - (ISSUE_SOURCE_RANK[a.source] ?? 0);
   if (sr !== 0) return sr;
-  const fa = a.first_seen ?? '';
-  const fb = b.first_seen ?? '';
-  if (fa !== fb) return fb.localeCompare(fa);
+  const onset = compareIssueSortAnchors(a, b);
+  if (onset !== 0) return onset;
   const c = (a.cluster_name ?? '').localeCompare(b.cluster_name ?? '');
   if (c !== 0) return c;
   const ns = (a.namespace ?? '').localeCompare(b.namespace ?? '');

package/src/components/namespace-switcher/NamespacePicker.tsx

@@ -1,6 +1,7 @@
 import { forwardRef, useCallback, useEffect, useImperativeHandle, useMemo, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
 import { ChevronDown, Globe, Search, AlertTriangle } from 'lucide-react'
+import { Badge } from '../ui/Badge'
 import { Tooltip } from '../ui/Tooltip'
 import { MultiSelectPicker } from '../ui/MultiSelectPicker'
 
@@ -14,6 +15,8 @@ export interface NamespaceScopeView {
   actives: string[]
   /** Namespaces the user may pick from. */
   accessibleNamespaces: string[]
+  /** Namespaces where Radar cannot list pods or deployments. */
+  deniedNamespaces?: string[]
   mode?: 'cluster-wide' | 'namespace' | 'restricted' | string
   /** Single-namespace cache-scope control instead of a multi-select filter. */
   cacheScoped?: boolean
@@ -115,6 +118,7 @@ export const NamespacePicker = forwardRef<NamespacePickerHandle, NamespacePicker
     if (!scope) return [] as string[]
     return [...(scope.accessibleNamespaces ?? [])].sort((a, b) => a.localeCompare(b))
   }, [scope])
+  const deniedNamespaces = useMemo(() => new Set(scope?.deniedNamespaces ?? []), [scope?.deniedNamespaces])
 
   const filteredItems = useMemo(() => {
     const q = search.trim().toLowerCase()
@@ -215,6 +219,21 @@ export const NamespacePicker = forwardRef<NamespacePickerHandle, NamespacePicker
           ? `View is filtered to namespace ${scopeActives[0]}. Click to switch or reset.`
           : `View is filtered to ${activeCount} namespaces. Click to adjust or reset.`
 
+  const renderNamespaceMeta = (ns: string) => (
+    <>
+      {deniedNamespaces.has(ns) && (
+        <Badge severity="error" size="sm" title="Radar cannot list pods or deployments in this namespace.">
+          No access
+        </Badge>
+      )}
+      {ns === scope.kubeconfigNamespace && ns !== '' && (
+        <span className="text-[10px] uppercase tracking-wide text-theme-text-tertiary shrink-0">
+          kubeconfig
+        </span>
+      )}
+    </>
+  )
+
   return (
     <>
       <Tooltip
@@ -286,7 +305,6 @@ export const NamespacePicker = forwardRef<NamespacePickerHandle, NamespacePicker
 
                   {filteredItems.map(ns => {
                     const isChecked = draft.has(ns)
-                    const isContextDefault = ns === scope.kubeconfigNamespace && ns !== ''
                     return (
                       <li key={ns}>
                         <label className="w-full flex items-center justify-between px-3 py-1.5 text-sm hover:bg-theme-hover text-left text-theme-text-primary cursor-pointer">
@@ -299,11 +317,7 @@ export const NamespacePicker = forwardRef<NamespacePickerHandle, NamespacePicker
                               className="shrink-0 accent-current"
                             />
                             <span className="truncate">{ns}</span>
-                            {isContextDefault && (
-                              <span className="text-[10px] uppercase tracking-wide text-theme-text-tertiary shrink-0">
-                                kubeconfig
-                              </span>
-                            )}
+                            {renderNamespaceMeta(ns)}
                           </span>
                         </label>
                       </li>
@@ -335,13 +349,7 @@ export const NamespacePicker = forwardRef<NamespacePickerHandle, NamespacePicker
                 noItemsLabel="No namespaces available."
                 clearAllDisabled={!canClearAll || activeCount === 0}
                 clearAllAriaLabel="Clear namespace selection"
-                renderItemMeta={ns =>
-                  ns === scope.kubeconfigNamespace && ns !== '' ? (
-                    <span className="text-[10px] uppercase tracking-wide text-theme-text-tertiary shrink-0">
-                      kubeconfig
-                    </span>
-                  ) : null
-                }
+                renderItemMeta={renderNamespaceMeta}
               />
             )}