@skyhook-io/k8s-ui 1.13.3 → 1.13.4

package/src/components/resources/gateway-policy-status.test.ts

@@ -0,0 +1,291 @@
+import { describe, expect, it } from 'vitest'
+import { getGatewayPolicyStatus } from './gateway-policy-status'
+import { getGenericResourceStatus } from './generic-status'
+
+const cond = (type: string, status: string, reason?: string, message?: string) => ({ type, status, reason, message })
+const policy = (...ancestors: any[]) => ({ status: { ancestors } })
+const anc = (...conditions: any[]) => ({ ancestorRef: { kind: 'Gateway', name: 'gw' }, conditions })
+
+describe('Gateway API PolicyStatus', () => {
+  // Taken from a live EnvoyPatchPolicy. The controller accepted the policy and
+  // then could not apply it. Read positives-first — the way the generic ladder
+  // resolves conditions — this object is healthy, which is the whole reason it
+  // gets its own reader.
+  it('reports the failure on a policy that was accepted and then not applied', () => {
+    const p = policy(anc(cond('Accepted', 'True', 'Accepted'), cond('Programmed', 'False', 'ResourceNotFound')))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'ResourceNotFound', tone: 'unhealthy' })
+  })
+
+  it('reports a plain accepted policy as healthy', () => {
+    expect(getGatewayPolicyStatus(policy(anc(cond('Accepted', 'True', 'Accepted')))))
+      .toMatchObject({ text: 'Accepted', tone: 'healthy' })
+  })
+
+  it('reports a rejected policy with the controller reason', () => {
+    expect(getGatewayPolicyStatus(policy(anc(cond('Accepted', 'False', 'Conflicted')))))
+      .toMatchObject({ text: 'Conflicted', tone: 'unhealthy' })
+  })
+
+  it('falls back to the condition type when the controller gave no reason', () => {
+    expect(getGatewayPolicyStatus(policy(anc(cond('Accepted', 'False')))))
+      .toMatchObject({ text: 'Not Accepted', tone: 'unhealthy' })
+  })
+
+  // Envoy Gateway publishes this combination. A positives-first read returns
+  // healthy and the warning never surfaces.
+  it('does not let an accepted policy hide a warning', () => {
+    const p = policy(anc(cond('Accepted', 'True'), cond('Warning', 'True', 'ShadowedRules')))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'ShadowedRules', tone: 'degraded' })
+  })
+
+  // Accepted=False reads as "Not Accepted"; Warning=True means there IS a
+  // warning, so the same construction would invert it.
+  it('names a reason-less warning after the condition, not its negation', () => {
+    const p = policy(anc(cond('Accepted', 'True'), cond('Warning', 'True')))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'Warning', tone: 'degraded' })
+  })
+
+  it('carries the controller message as the tooltip reason', () => {
+    const p = policy(anc(cond('Accepted', 'False', 'Invalid', 'spec.targetRef.kind is not supported')))
+    expect(getGatewayPolicyStatus(p)?.reason).toBe('spec.targetRef.kind is not supported')
+  })
+})
+
+describe('aggregating across ancestors', () => {
+  // A policy may attach to several Gateways with different outcomes. Collapsing
+  // to a bare "Accepted" would hide the one that rejected it.
+  it('reports a failure anywhere, and how widespread it is', () => {
+    const p = policy(
+      anc(cond('Accepted', 'True')),
+      anc(cond('Accepted', 'False', 'NotAllowed')),
+      anc(cond('Accepted', 'True')),
+    )
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'NotAllowed (1/3)', tone: 'unhealthy' })
+  })
+
+  it('does not add a count when the policy attaches to one ancestor', () => {
+    expect(getGatewayPolicyStatus(policy(anc(cond('Accepted', 'False', 'NotAllowed'))))?.text)
+      .toBe('NotAllowed')
+  })
+
+  // Absence is not acceptance: an ancestor the controller has not answered for
+  // must not be counted as healthy just because its sibling was.
+  it('does not read an ancestor with no verdict as accepted', () => {
+    const p = policy(anc(cond('Accepted', 'True')), anc())
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'Pending (1/2)', tone: 'degraded' })
+  })
+
+  it('treats Unknown as undecided rather than as failure', () => {
+    const p = policy(anc(cond('Accepted', 'Unknown', 'Pending')))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ tone: 'degraded' })
+  })
+
+  // One slot for both kinds of problem showed the warning's reason next to the
+  // failure's count and tone — the operator reads the warning as the failure.
+  it('reports the failure, not an earlier warning, when both are present', () => {
+    const p = policy(
+      anc(cond('Accepted', 'True'), cond('Warning', 'True', 'ShadowedRules')),
+      anc(cond('Accepted', 'False', 'NotAllowed')),
+    )
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'NotAllowed (1/2)', tone: 'unhealthy' })
+  })
+
+  it('still reports the warning when nothing failed', () => {
+    const p = policy(
+      anc(cond('Accepted', 'True'), cond('Warning', 'True', 'ShadowedRules')),
+      anc(cond('Accepted', 'True')),
+    )
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'ShadowedRules (1/2)', tone: 'degraded' })
+  })
+
+  it('is healthy only when every ancestor accepted', () => {
+    expect(getGatewayPolicyStatus(policy(anc(cond('Accepted', 'True')), anc(cond('Accepted', 'True')))))
+      .toMatchObject({ text: 'Accepted', tone: 'healthy' })
+  })
+})
+
+describe('shapes that are not a verdict', () => {
+  // Yields nothing rather than a verdict, so a policy that also publishes
+  // top-level conditions still gets read from those.
+  it('declines to judge a policy that attaches to nothing', () => {
+    expect(getGatewayPolicyStatus(policy())).toBeNull()
+  })
+
+  it('ignores malformed ancestors rather than throwing', () => {
+    expect(() => getGatewayPolicyStatus({ status: { ancestors: [null, 'nope', 42] } })).not.toThrow()
+    expect(() => getGatewayPolicyStatus({ status: { ancestors: [{ conditions: 'nope' }] } })).not.toThrow()
+  })
+
+  it('yields nothing when ancestors is absent or not an array', () => {
+    expect(getGatewayPolicyStatus({ status: { conditions: [] } })).toBeNull()
+    expect(getGatewayPolicyStatus({ status: { ancestors: {} } })).toBeNull()
+    expect(getGatewayPolicyStatus({ status: {} })).toBeNull()
+  })
+})
+
+describe('wiring into the generic ladder', () => {
+  it('resolves a policy through its own reader', () => {
+    const p = policy(anc(cond('Accepted', 'True', 'Accepted'), cond('Programmed', 'False', 'ResourceNotFound')))
+    expect(getGenericResourceStatus(p)).toMatchObject({ text: 'ResourceNotFound', tone: 'unhealthy' })
+  })
+
+  // The dispatch is on shape, so it must not intercept an ordinary resource.
+  it('leaves a resource with top-level conditions alone', () => {
+    const r = { status: { conditions: [{ type: 'Ready', status: 'True' }] } }
+    expect(getGenericResourceStatus(r)).toMatchObject({ text: 'Ready', tone: 'healthy' })
+  })
+
+  it('leaves a phase-based resource alone', () => {
+    expect(getGenericResourceStatus({ status: { phase: 'Running' } })).toMatchObject({ text: 'Running', tone: 'healthy' })
+  })
+})
+
+describe('condition vocabulary beyond Accepted', () => {
+  // GKE reports attachment with its own condition; Gateway API's
+  // BackendTLSPolicy requires ResolvedRefs as well as Accepted.
+  it.each([
+    ['Attached', 'InvalidTarget'],
+    ['ResolvedRefs', 'InvalidCACertificateRef'],
+    ['Programmed', 'ResourceNotFound'],
+  ])('treats %s=False as a failure', (type, reason) => {
+    const p = policy(anc(cond('Accepted', 'True'), cond(type, 'False', reason)))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: reason, tone: 'unhealthy' })
+  })
+
+  // GEP-713 lists Reconciling as a legitimate state on the way to being
+  // applied. Painting ordinary convergence red teaches operators to ignore red.
+  it.each(['Reconciling', 'Pending'])('treats %s as in-flight, not failed', reason => {
+    const p = policy(anc(cond('Accepted', 'True'), cond('Programmed', 'False', reason)))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: reason, tone: 'degraded' })
+  })
+
+  // GKE's healthy shape carries no Accepted condition at all. Checking only
+  // Accepted read it as pending, which is a policy that works reported amber.
+  it('accepts a verdict that is not spelled Accepted', () => {
+    expect(getGatewayPolicyStatus(policy(anc(cond('Attached', 'True')))))
+      .toMatchObject({ text: 'Attached', tone: 'healthy' })
+    expect(getGatewayPolicyStatus(policy(anc(cond('Programmed', 'True')))))
+      .toMatchObject({ text: 'Programmed', tone: 'healthy' })
+  })
+
+  // Refs resolving is a precondition, not a statement that the policy applies.
+  it('does not treat ResolvedRefs alone as a verdict', () => {
+    expect(getGatewayPolicyStatus(policy(anc(cond('ResolvedRefs', 'True')))))
+      .toMatchObject({ tone: 'degraded' })
+  })
+
+  it('does not read a partially applied policy as success', () => {
+    const p = policy(anc(cond('Accepted', 'True'), cond('Programmed', 'True', 'PartiallyProgrammed')))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'PartiallyProgrammed', tone: 'degraded' })
+  })
+
+  // Reporting the first reason with a count claims every ancestor failed that
+  // way. When they differ, say how many failed instead of guessing why.
+  it('does not attribute one ancestor\'s reason to another', () => {
+    const p = policy(
+      anc(cond('Accepted', 'False', 'NotAllowed')),
+      anc(cond('Accepted', 'False', 'ResourceNotFound')),
+      anc(cond('Accepted', 'True')),
+    )
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: '2/3 failed', tone: 'unhealthy' })
+  })
+
+  // The badge says "2/3 failed"; the tooltip must say which Gateway failed
+  // how, or the operator digs through raw status for the names.
+  it('names each failed ancestor and its reason in the tooltip', () => {
+    const p = policy(
+      { ancestorRef: { kind: 'Gateway', namespace: 'team-a', name: 'gw-a' }, conditions: [cond('Accepted', 'False', 'NotAllowed')] },
+      { ancestorRef: { kind: 'Gateway', name: 'gw-b' }, conditions: [cond('Accepted', 'False', 'ResourceNotFound')] },
+      anc(cond('Accepted', 'True')),
+    )
+    expect(getGatewayPolicyStatus(p)).toMatchObject({
+      text: '2/3 failed',
+      tone: 'unhealthy',
+      reason: 'team-a/gw-a: NotAllowed; gw-b: ResourceNotFound',
+    })
+  })
+
+  // GEP-713 keys ancestor status on ancestorRef + controllerName: the same
+  // Gateway appears once per controller, and a bare ns/name label would
+  // attribute both verdicts to one indistinguishable thing.
+  it('tells colliding labels apart by controller', () => {
+    const p = policy(
+      { ancestorRef: { namespace: 'team-a', name: 'gw' }, controllerName: 'ctrl-a.example', conditions: [cond('Accepted', 'False', 'NotAllowed')] },
+      { ancestorRef: { namespace: 'team-a', name: 'gw' }, controllerName: 'ctrl-b.example', conditions: [cond('Accepted', 'False', 'ResourceNotFound')] },
+    )
+    expect(getGatewayPolicyStatus(p)?.reason)
+      .toBe('team-a/gw (ctrl-a.example): NotAllowed; team-a/gw (ctrl-b.example): ResourceNotFound')
+  })
+
+  // sectionName and a non-Gateway kind are part of the identity and short
+  // enough to always carry.
+  it('carries section and kind in the label', () => {
+    const p = policy(
+      { ancestorRef: { namespace: 'team-a', name: 'gw', sectionName: 'tls' }, conditions: [cond('Accepted', 'False', 'NotAllowed')] },
+      { ancestorRef: { kind: 'Service', namespace: 'team-a', name: 'svc' }, conditions: [cond('Accepted', 'False', 'ResourceNotFound')] },
+    )
+    expect(getGatewayPolicyStatus(p)?.reason)
+      .toBe('team-a/gw:tls: NotAllowed; Service team-a/svc: ResourceNotFound')
+  })
+
+  // The collision that qualifies a controller may be with an ancestor that
+  // SUCCEEDED: two controllers on one Gateway, one failing, must still say
+  // which one failed.
+  it('names the controller when the collision is with a successful ancestor', () => {
+    const p = policy(
+      { ancestorRef: { namespace: 'team-a', name: 'gw' }, controllerName: 'ctrl-a.example', conditions: [cond('Accepted', 'False', 'NotAllowed')] },
+      { ancestorRef: { namespace: 'team-a', name: 'gw' }, controllerName: 'ctrl-b.example', conditions: [cond('Accepted', 'True')] },
+      { ancestorRef: { name: 'gw-b' }, conditions: [cond('Accepted', 'False', 'ResourceNotFound')] },
+    )
+    expect(getGatewayPolicyStatus(p)?.reason)
+      .toBe('team-a/gw (ctrl-a.example): NotAllowed; gw-b: ResourceNotFound')
+  })
+
+  // group and port are part of the composite key too: entries differing only
+  // by them must not render identically.
+  it('carries group and port in the label', () => {
+    const p = policy(
+      { ancestorRef: { group: 'multicluster.x-k8s.io', kind: 'ServiceImport', namespace: 'team-a', name: 'svc' }, conditions: [cond('Accepted', 'False', 'NotAllowed')] },
+      { ancestorRef: { namespace: 'team-a', name: 'gw', port: 443 }, conditions: [cond('Accepted', 'False', 'ResourceNotFound')] },
+    )
+    expect(getGatewayPolicyStatus(p)?.reason)
+      .toBe('ServiceImport.multicluster.x-k8s.io team-a/svc: NotAllowed; team-a/gw:443: ResourceNotFound')
+  })
+
+  // Reasons may be 1024 chars and foreign CRDs need not honor the 16-ancestor
+  // cap, so the list is bounded rather than trusted.
+  it('caps the tooltip detail list', () => {
+    const p = policy(
+      ...[1, 2, 3, 4, 5, 6].map(i => ({
+        ancestorRef: { name: `gw-${i}` },
+        conditions: [cond('Accepted', 'False', `R${i}`)],
+      })),
+    )
+    expect(getGatewayPolicyStatus(p)?.reason).toBe('gw-1: R1; gw-2: R2; gw-3: R3; gw-4: R4; +2 more')
+  })
+
+  it('keeps the reason when every failure agrees', () => {
+    const p = policy(anc(cond('Accepted', 'False', 'NotAllowed')), anc(cond('Accepted', 'False', 'NotAllowed')))
+    expect(getGatewayPolicyStatus(p)).toMatchObject({ text: 'NotAllowed (2/2)', tone: 'unhealthy' })
+  })
+})
+
+describe('policies that also publish top-level conditions', () => {
+  // GCPBackendPolicy declares both status.ancestors and status.conditions.
+  // Dispatching on the shape alone suppressed the conditions entirely.
+  it('falls back to top-level conditions when the ancestors say nothing', () => {
+    const dual = { status: { ancestors: [], conditions: [{ type: 'Ready', status: 'False', reason: 'Invalid' }] } }
+    expect(getGenericResourceStatus(dual)).toMatchObject({ text: 'Invalid', tone: 'unhealthy' })
+  })
+
+  it('still prefers a verdict the ancestors did give', () => {
+    const dual = {
+      status: {
+        ancestors: [{ conditions: [cond('Accepted', 'False', 'NotAllowed')] }],
+        conditions: [{ type: 'Ready', status: 'True' }],
+      },
+    }
+    expect(getGenericResourceStatus(dual)).toMatchObject({ text: 'NotAllowed', tone: 'unhealthy' })
+  })
+})
+

package/src/components/resources/gateway-policy-status.ts

@@ -0,0 +1,237 @@
+import type { GenericStatus } from './generic-status'
+
+/**
+ * Gateway API policy attachment (GEP-713) reports status per *ancestor*, at
+ * `status.ancestors[].conditions`, not at `status.conditions` — so the generic
+ * ladder finds nothing and these kinds render "-".
+ *
+ * The shape is shared by every policy implementation: Gateway API's own
+ * BackendTLSPolicy and BackendLBPolicy, Envoy Gateway's SecurityPolicy /
+ * ClientTrafficPolicy / BackendTrafficPolicy / EnvoyPatchPolicy /
+ * EnvoyExtensionPolicy, and GKE's GCPBackendPolicy family. Dispatching on the
+ * shape rather than on a list of kinds means a policy from an implementation
+ * Radar has never heard of reads correctly too.
+ *
+ * Kept separate from the generic ladder rather than folded into it, because the
+ * ladder resolves positive conditions before negative ones and that order is
+ * wrong here: a policy is routinely `Accepted=True` *and* `Programmed=False`,
+ * which means the controller took ownership and then failed to apply it. Read
+ * positives-first, that object is healthy; it is not.
+ */
+
+/**
+ * Conditions that describe whether the policy took effect. `Accepted` is
+ * GEP-713's own verdict; `Programmed` and `ResolvedRefs` are how Gateway API
+ * and its implementations report that a policy the controller took on could
+ * not actually be applied, and `Attached` is GKE's equivalent.
+ */
+const EFFECT_CONDITIONS = ['Accepted', 'Attached', 'Programmed', 'ResolvedRefs'] as const
+
+/**
+ * The subset that is a verdict in its own right, so True means the policy took
+ * effect. `ResolvedRefs` is deliberately absent: refs resolving is a
+ * precondition, not a statement that the policy applies. Kept separate from
+ * EFFECT_CONDITIONS because a condition can be conclusive when False and say
+ * nothing when True — GKE reports a healthy policy as `Attached=True` with no
+ * `Accepted` at all, so checking only `Accepted` read it as pending.
+ */
+const VERDICT_CONDITIONS = ['Accepted', 'Attached', 'Programmed'] as const
+
+/**
+ * Reasons that mean "not settled yet" rather than "failed". GEP-713 lists
+ * Reconciling as a legitimate state for a policy on its way to being applied,
+ * and rendering ordinary convergence as a red failure would train operators to
+ * ignore the colour.
+ */
+const TRANSIENT_REASONS = new Set(['Reconciling', 'Pending'])
+
+/** A True condition can still be qualified: partial application is not success. */
+const QUALIFIED_SUCCESS_REASONS = new Set(['PartiallyProgrammed'])
+
+/** Conditions that mean trouble when True, mirroring the generic ladder's set. */
+const NEGATIVE_CONDITIONS = new Set(['Degraded', 'Warning'])
+
+/**
+ * GEP-713 keys an ancestor's status on the full ancestorRef plus the
+ * controllerName — the same Gateway can appear once per controller, section,
+ * or kind. The label carries the short parts outright; the controllerName is
+ * long, so it is appended only when two labels would otherwise collide.
+ */
+function ancestorLabel(ancestor: any): string {
+  const ref = ancestor?.ancestorRef
+  const name = typeof ref?.name === 'string' ? ref.name : ''
+  if (!name) return ''
+  const ns = typeof ref?.namespace === 'string' ? ref.namespace : ''
+  const kind = typeof ref?.kind === 'string' ? ref.kind : ''
+  const group = typeof ref?.group === 'string' ? ref.group : ''
+  const section = typeof ref?.sectionName === 'string' ? ref.sectionName : ''
+  const port = typeof ref?.port === 'number' ? ref.port : null
+  let label = ns ? `${ns}/${name}` : name
+  let prefix = kind && kind !== 'Gateway' ? kind : ''
+  if (group && group !== 'gateway.networking.k8s.io') prefix = prefix ? `${prefix}.${group}` : group
+  if (prefix) label = `${prefix} ${label}`
+  if (section) label += `:${section}`
+  if (port !== null) label += `:${port}`
+  return label
+}
+
+/**
+ * Reasons are usually short CamelCase tokens, but the API allows 1024 chars
+ * and this reader accepts any CRD with an ancestors array, so the list is
+ * capped rather than trusted to stay small.
+ */
+const MAX_FAILURE_DETAILS = 4
+
+function renderFailureDetails(
+  failures: { label: string; controller: string; problem: string }[],
+  // Collisions are counted across every ancestor, not just the failed ones: a
+  // failure and a success for the same Gateway under different controllers
+  // must still say which controller failed.
+  labelCounts: Map<string, number>,
+): string {
+  const entries = failures.map(f => {
+    let label = f.label
+    if (label && (labelCounts.get(label) ?? 0) > 1 && f.controller) label += ` (${f.controller})`
+    return label ? `${label}: ${f.problem}` : f.problem
+  })
+  const shown = entries.slice(0, MAX_FAILURE_DETAILS)
+  const hidden = entries.length - shown.length
+  return hidden > 0 ? `${shown.join('; ')}; +${hidden} more` : shown.join('; ')
+}
+
+function conditionsOf(ancestor: any): any[] {
+  return Array.isArray(ancestor?.conditions) ? ancestor.conditions : []
+}
+
+/**
+ * The controller's reason where it gave one — it names the actual failure
+ * (ResourceNotFound, Conflicted, NotAllowed) where the type does not.
+ *
+ * The fallback has to follow the condition's polarity. `Accepted=False` reads
+ * as "Not Accepted", but `Warning=True` means there *is* a warning, so the same
+ * construction would render "Not Warning" and inverts the meaning.
+ *
+ * Spelled with a space where the Go reader behind MCP writes "NotAccepted",
+ * matching each side's existing convention. Whenever a controller supplies a
+ * reason the two sides are identical; they part ways only here and on mixed
+ * failures, where the per-ancestor detail goes to the tooltip while MCP,
+ * having no tooltip, carries it in the text.
+ */
+function problemText(cond: any, trueMeansTrouble = false): string {
+  const reason = typeof cond?.reason === 'string' ? cond.reason.trim() : ''
+  if (reason) return reason
+  const type = typeof cond?.type === 'string' ? cond.type.trim() : ''
+  if (!type) return 'Failed'
+  return trueMeansTrouble ? type : `Not ${type}`
+}
+
+/**
+ * Status for one policy, aggregated across the Gateways it attaches to.
+ *
+ * A policy may attach to several ancestors with different outcomes, so a
+ * failure anywhere wins and the count says how widespread it is — collapsing to
+ * a bare "Accepted" would hide the Gateway that rejected it.
+ */
+export function getGatewayPolicyStatus(resource: any): GenericStatus | null {
+  const ancestors = resource?.status?.ancestors
+  if (!Array.isArray(ancestors)) return null
+
+  // Null rather than a verdict, so the caller can fall back to any top-level
+  // conditions the object also carries. A policy that attaches to nothing and
+  // says nothing else is left to render as absent, because "not attached" and
+  // "not reconciled yet" are indistinguishable from here.
+  if (ancestors.length === 0) return null
+
+  let failed = 0
+  let degraded = 0
+  let accepted = 0
+  // Tracked apart, not in one slot: a warning on the first ancestor and a
+  // failure on the second would otherwise show the warning's text alongside
+  // the failure's count and tone, reading as though the warning was the
+  // failure.
+  let failure: { text: string; reason?: string } | null = null
+  let warning: { text: string; reason?: string } | null = null
+  // Ancestors can fail for different reasons. Reporting the first one with a
+  // count claims they all failed that way.
+  const failureReasons = new Set<string>()
+  // Which Gateway failed with what, for the tooltip: "2/3 failed" without it
+  // sends the operator digging through raw status for the names.
+  const failureDetails: { label: string; controller: string; problem: string }[] = []
+  const ancestorLabelCounts = new Map<string, number>()
+  let acceptedAs: string | null = null
+
+  for (const ancestor of ancestors) {
+    const label = ancestorLabel(ancestor)
+    if (label) ancestorLabelCounts.set(label, (ancestorLabelCounts.get(label) ?? 0) + 1)
+    const conditions = conditionsOf(ancestor)
+
+    const broken = conditions.find(
+      (c: any) => EFFECT_CONDITIONS.includes(c?.type) && c?.status === 'False',
+    )
+    if (broken) {
+      const reason = typeof broken?.reason === 'string' ? broken.reason.trim() : ''
+      // A controller still working towards the desired state is not a failure.
+      if (TRANSIENT_REASONS.has(reason)) {
+        degraded++
+        warning ??= { text: reason, reason: broken?.message }
+        continue
+      }
+      failed++
+      failure ??= { text: problemText(broken), reason: broken?.message }
+      failureReasons.add(problemText(broken))
+      failureDetails.push({
+        label,
+        controller: typeof ancestor?.controllerName === 'string' ? ancestor.controllerName : '',
+        problem: problemText(broken),
+      })
+      continue
+    }
+
+    const warned = conditions.find((c: any) => NEGATIVE_CONDITIONS.has(c?.type) && c?.status === 'True')
+    if (warned) {
+      degraded++
+      warning ??= { text: problemText(warned, true), reason: warned?.message }
+      continue
+    }
+
+    // A qualified success is not success: PartiallyProgrammed means some of the
+    // policy landed and some did not.
+    const qualified = conditions.find(
+      (c: any) => EFFECT_CONDITIONS.includes(c?.type) && c?.status === 'True' &&
+        QUALIFIED_SUCCESS_REASONS.has(typeof c?.reason === 'string' ? c.reason.trim() : ''),
+    )
+    if (qualified) {
+      degraded++
+      warning ??= { text: qualified.reason.trim(), reason: qualified?.message }
+      continue
+    }
+
+    const verdict = conditions.find(
+      (c: any) => VERDICT_CONDITIONS.includes(c?.type) && c?.status === 'True',
+    )
+    if (verdict) {
+      accepted++
+      // Named after the condition that granted it, so a GKE policy reads
+      // "Attached" where an Envoy one reads "Accepted".
+      acceptedAs ??= verdict.type
+    }
+  }
+
+  const total = ancestors.length
+  const scope = (n: number) => (total > 1 ? ` (${n}/${total})` : '')
+
+  if (failed > 0 && failure) {
+    if (failureReasons.size > 1) {
+      return { text: `${failed}/${total} failed`, tone: 'unhealthy', reason: renderFailureDetails(failureDetails, ancestorLabelCounts) }
+    }
+    return { text: `${failure.text}${scope(failed)}`, tone: 'unhealthy', reason: failure.reason }
+  }
+  if (degraded > 0 && warning) {
+    return { text: `${warning.text}${scope(degraded)}`, tone: 'degraded', reason: warning.reason }
+  }
+  if (accepted === total) return { text: acceptedAs ?? 'Accepted', tone: 'healthy' }
+
+  // Some ancestor published neither an outcome nor a failure — the controller
+  // has seen the policy but not finished with it.
+  return { text: `Pending${scope(total - accepted)}`, tone: 'degraded' }
+}