@skyhook-io/k8s-ui 1.13.3 → 1.14.0

package/src/components/resources/renderers/PolicyCoverageSection.tsx

@@ -11,9 +11,17 @@ import {
   getKyvernoEnforcementPosture,
   getKyvernoResourceRules,
   getKyvernoEffectiveFailurePolicy,
+  getKyvernoValidationActions,
+  getKyvernoEvaluationMode,
+  isKyvernoAdmissionEnabled,
   type KyvernoPolicyFamily,
 } from '../resource-utils-kyverno-modern'
-import { getKyvernoPolicyAction } from '../resource-utils-kyverno'
+import {
+  getKyvernoEnforcement,
+  getKyvernoPolicyAction,
+  getKyvernoPolicyAdmission,
+  isKyvernoEnforceAction,
+} from '../resource-utils-kyverno'
 import type {
   PolicyCoverageResponse,
   PolicyCoverageRule,
@@ -160,7 +168,7 @@ function legacyActionsAgree(resource: any): boolean {
           : []),
       ].filter(Boolean)
       const effective = declared.length > 0 ? declared : [spec]
-      return effective.includes('Enforce')
+      return effective.some(isKyvernoEnforceAction)
     })
   return answers.every((a: boolean) => a === answers[0])
 }
@@ -229,17 +237,40 @@ function policyFamilyFor(
 
 /**
  * The families answer from different fields: legacy carries
- * `spec.validationFailureAction` (or a per-rule `validate.failureAction`), while
- * `getKyvernoEnforcementPosture` reads `spec.validationActions`, absent on
- * legacy — which makes an Enforce policy read as audit-only.
+ * `spec.validationFailureAction` (or a per-rule `validate.failureAction`) gated
+ * by `spec.admission`, while `getKyvernoEnforcementPosture` reads
+ * `spec.validationActions` and `spec.evaluation.admission.enabled`, both absent
+ * on legacy — which makes an Enforce policy read as audit-only.
  */
 function blocksAdmission(resource: any, family: KyvernoPolicyFamily | undefined): boolean {
   if (isLegacyKyvernoPolicy(resource)) {
-    return getKyvernoPolicyAction(resource) === 'Enforce'
+    return getKyvernoEnforcement(resource).blocks
   }
   return getKyvernoEnforcementPosture(resource, family).blocks
 }
 
+/**
+ * A policy declares a rejecting action yet does not block, because admission
+ * evaluation is switched off. The distinction changes the remediation the
+ * consequence sentence offers — re-enable admission, not switch the action —
+ * so it must not be conflated with an audit policy that simply never blocks.
+ *
+ * Only the validating families carry `validationActions`, and
+ * `getKyvernoValidationActions` applies Kyverno's absent-means-Deny default,
+ * so asking a mutating or generating policy would read Deny off a field that
+ * kind never has. The same guard `getKyvernoEnforcementPosture` uses.
+ */
+function declaresBlockingButAdmissionOff(
+  resource: any,
+  family: KyvernoPolicyFamily | undefined,
+): boolean {
+  if (isLegacyKyvernoPolicy(resource)) {
+    return getKyvernoPolicyAction(resource) === 'Enforce' && !getKyvernoPolicyAdmission(resource)
+  }
+  if (family !== 'validating' && family !== 'imageValidating') return false
+  return getKyvernoValidationActions(resource).includes('Deny') && !isKyvernoAdmissionEnabled(resource)
+}
+
 /**
  * Whether the consequence sentence can be stated at all.
  *
@@ -250,6 +281,11 @@ function blocksAdmission(resource: any, family: KyvernoPolicyFamily | undefined)
  */
 function canStateConsequence(resource: any, family: KyvernoPolicyFamily | undefined): boolean {
   if (!isLegacyKyvernoPolicy(resource)) {
+    // A JSON-mode policy is evaluated against payloads outside the cluster and
+    // never joins admission, so every phrasing of the sentence is false: it
+    // rejects nothing today, and neither switching the action nor enabling
+    // admission would change that. The posture badge already says "JSON mode".
+    if (getKyvernoEvaluationMode(resource) === 'JSON') return false
     return family === 'validating' || family === 'imageValidating' || family === undefined
   }
   const rules: any[] = resource?.spec?.rules ?? []
@@ -273,6 +309,7 @@ function enforcementConsequence(
   failing: number,
   blocks: boolean,
   matchesUpdate: boolean,
+  admissionOff = false,
 ): string {
   // Deliberately kind-neutral. A policy can match ConfigMaps, Secrets or
   // ClusterRoles as readily as Pods, and none of those "run" — the fact being
@@ -288,11 +325,24 @@ function enforcementConsequence(
       : `${exists} and ${one ? 'stays' : 'stay'} as ${itIs} — this policy only checks creation, so ${itIs} rejected only if recreated.`
   }
 
+  const target = one ? 'this resource' : `any of these ${failing}`
+
+  // The policy already declares a rejecting action; it does not block only
+  // because admission evaluation is disabled. Telling the operator to change
+  // the action would point at the wrong knob — the fix is to re-enable
+  // admission.
+  if (admissionOff) {
+    return matchesUpdate
+      ? `Nothing is rejected today because admission is disabled for this policy. Enabling admission would reject the next update to ${target}.`
+      : `Nothing is rejected today because admission is disabled for this policy. Enabling admission would leave ${
+          one ? 'this resource as it is' : `these ${failing} as they are`
+        } — only newly created resources would be rejected.`
+  }
+
   // "Set to enforce" is the legacy family's vocabulary; the modern API spells
   // the same thing `validationActions: [Deny]`, and the posture badge above
   // already says "Deny". Describing the behaviour rather than the field keeps
   // one sentence correct for both.
-  const target = one ? 'this resource' : `any of these ${failing}`
   return matchesUpdate
     ? `Nothing is rejected today. Switching this policy to block would reject the next update to ${target}.`
     : `Nothing is rejected today. Switching this policy to block would leave ${
@@ -469,8 +519,14 @@ function Consequence({
   const failing = data.subjectsFailing ?? data.counts.fail
 
   if (failing > 0 && canStateConsequence(resource, family)) {
+    const blocks = blocksAdmission(resource, family)
     lines.push(
-      enforcementConsequence(failing, blocksAdmission(resource, family), matchesUpdates(resource)),
+      enforcementConsequence(
+        failing,
+        blocks,
+        matchesUpdates(resource),
+        !blocks && declaresBlockingButAdmissionOff(resource, family),
+      ),
     )
   }
 

package/src/components/resources/renderers/RolloutRenderer.test.tsx

@@ -102,6 +102,33 @@ describe('rolloutActions state gating', () => {
     expect(blockedReason(settled, 'abort')).toBe('Rollout is fully promoted — roll back instead')
   })
 
+  it('offers the promotion verbs while the controller is still behind the spec', () => {
+    // A rollback bumps the generation; until the controller writes status the phase is
+    // still the pre-rollback one, and this is exactly when Promote full is needed.
+    const settled = canaryRollout({ phase: 'Healthy', currentStepIndex: 4 }, 4)
+    const stale = {
+      ...settled,
+      metadata: { ...settled.metadata, generation: 4 },
+      status: { ...settled.status, observedGeneration: '3' },
+    }
+    expect(blockedReason(stale, 'promote-full')).toBeUndefined()
+    // Abort deliberately keeps its phase-based gate: in this window status.stable still
+    // points at the revision the operator just rolled away from.
+    expect(blockedReason(stale, 'abort')).toBe('Rollout is fully promoted — roll back instead')
+    // Once the controller catches up the settled reading is trustworthy again.
+    const caughtUp = { ...stale, status: { ...settled.status, observedGeneration: '4' } }
+    expect(blockedReason(caughtUp, 'promote-full')).toBe('Nothing left to promote')
+  })
+
+  it('keeps Promote full offered on a workloadRef Rollout, whose template lives elsewhere', () => {
+    const settled = canaryRollout({ phase: 'Healthy', currentStepIndex: 4 }, 4)
+    const workloadRef = {
+      ...settled,
+      spec: { ...settled.spec, workloadRef: { kind: 'Deployment', name: 'web' } },
+    }
+    expect(blockedReason(workloadRef, 'promote-full')).toBeUndefined()
+  })
+
   it('routes an aborted rollout through Retry before it will promote again', () => {
     const aborted = canaryRollout({ phase: 'Degraded', abort: true, currentStepIndex: 1 })
     expect(blockedReason(aborted, 'promote-full')).toBe('Retry the rollout first')
@@ -138,6 +165,14 @@ describe('rolloutActions state gating', () => {
   })
 })
 
+describe('RolloutRenderer step display', () => {
+  it('does not render beyond the final declared canary step', () => {
+    const html = renderToString(<RolloutRenderer data={canaryRollout({ phase: 'Healthy', currentStepIndex: 4 }, 4)} />)
+    expect(html).toContain('4/4')
+    expect(html).not.toContain('5/4')
+  })
+})
+
 describe('rolloutProblems', () => {
   it('reports an aborted rollout once, not once per matching branch', () => {
     const problems = rolloutProblems(

package/src/components/resources/renderers/RolloutRenderer.tsx

@@ -4,7 +4,7 @@ import { clsx } from 'clsx'
 import { AlertBanner, Section, PropertyList, Property, ConditionsSection, PodTemplateSection, type ConditionTone } from '../../ui/drawer-components'
 import { Tooltip } from '../../ui/Tooltip'
 import { ConfirmDialog } from '../../ui/ConfirmDialog'
-import { formatAge } from '../resource-utils'
+import { formatAge, getRolloutStep } from '../resource-utils'
 import { BADGE_INACTIVE } from '../../../utils/badge-colors'
 
 export type RolloutAction = 'abort' | 'retry' | 'promote' | 'promote-full' | 'skip-step'
@@ -46,6 +46,22 @@ interface RolloutRendererProps {
   pendingAction?: RolloutAction | null
 }
 
+// Has the controller reconciled the template as it stands? A rollback changes the
+// template before the controller writes status, and until it catches up a Healthy phase
+// still describes the previous revision.
+//
+// A workloadRef Rollout keeps its template on another object, and a rollback patches
+// THAT object — this payload carries neither its generation nor a way to reach it, so
+// the honest answer is "unknown", not "yes".
+function controllerCaughtUp(data: any): boolean {
+  if (data?.spec?.workloadRef) return false
+  const observed = data?.status?.observedGeneration
+  if (observed === undefined || observed === null) return true
+  const seen = Number(observed)
+  if (!Number.isFinite(seen)) return true
+  return seen >= Number(data?.metadata?.generation ?? 0)
+}
+
 // A denied capability omits the verb entirely; `blocked` covers wrong-state only.
 export function rolloutActions(data: any, capabilities?: RolloutCapabilities): RolloutActionSpec[] {
   if (!capabilities) return []
@@ -55,6 +71,9 @@ export function rolloutActions(data: any, capabilities?: RolloutCapabilities): R
   const steps = data?.spec?.strategy?.canary?.steps || []
   const isAborted = status.abort === true
   const isSettled = phase === 'Healthy' && !isAborted
+  // Promote full is the one verb needed DURING the window where status is stale, so it
+  // only claims "nothing to promote" when the controller is known to have caught up.
+  const isFullyPromoted = isSettled && controllerCaughtUp(data)
   const stepsRemaining = steps.length > 0 && (status.currentStepIndex ?? 0) < steps.length
   // Mid-analysis a canary is Progressing with nothing paused, and promote advances
   // the step rather than clearing a pause — so gating on Paused alone hides it.
@@ -87,7 +106,7 @@ export function rolloutActions(data: any, capabilities?: RolloutCapabilities): R
       pendingLabel: 'Promoting…',
       icon: FastForward,
       hint: 'Skip every remaining step, pause, and analysis — emergency hotfix path',
-      blocked: isSettled ? 'Nothing left to promote' : isAborted ? 'Retry the rollout first' : undefined,
+      blocked: isFullyPromoted ? 'Nothing left to promote' : isAborted ? 'Retry the rollout first' : undefined,
       confirm: {
         title: 'Promote fully?',
         message:
@@ -413,7 +432,7 @@ export function RolloutRenderer({ data, onNavigate, capabilities, onAction, pend
             <>
               <Property label="Strategy" value="Canary" />
               {steps.length > 0 && currentStepIndex !== undefined && (
-                <Property label="Current Step" value={`${currentStepIndex}/${steps.length}`} />
+                <Property label="Current Step" value={getRolloutStep(data)} />
               )}
               {status.canary?.weights?.canary?.weight !== undefined && (
                 <Property label="Canary Weight" value={`${status.canary.weights.canary.weight}%`} />

package/src/components/resources/renderers/VeleroBSLRenderer.test.tsx

@@ -176,6 +176,53 @@ describe('what a storage location holds', () => {
   })
 })
 
+/**
+ * Velero writes why a location is unavailable into `status.message`, and the
+ * BSL object carries no conditions, so that field is the only place the reason
+ * exists. A page opened from an unavailable-location problem has to show it -
+ * the same way the sibling BackupRepository renderer leads with its own reason.
+ */
+describe('an unavailable location Velero gave a reason for', () => {
+  const bslMsg = (phase: string, message?: string) => ({
+    metadata: { name: 'dr-replica', namespace: 'velero' },
+    spec: { provider: 'aws', objectStorage: { bucket: 'dr' } },
+    status: { phase, ...(message !== undefined ? { message } : {}) },
+  })
+
+  it('leads with the reason Velero gave', () => {
+    const html = renderToString(
+      <VeleroBSLRenderer
+        data={bslMsg('Unavailable', 'BackupStorageLocation is invalid: rpc error: code = Unknown desc = NoSuchBucket')}
+      />,
+    )
+    expect(html).toContain('NoSuchBucket')
+  })
+
+  // Velero can set Unavailable with no message. Saying nothing would leave a red
+  // badge and no consequence, so the page states what unavailable costs.
+  it('names the consequence when Velero gave no reason', () => {
+    const html = renderToString(<VeleroBSLRenderer data={bslMsg('Unavailable')} />)
+    expect(html).toContain('cannot be written')
+  })
+
+  it('says nothing alarming when the location is available', () => {
+    const html = renderToString(
+      <VeleroBSLRenderer data={bslMsg('Available', 'stale message left on the object')} />,
+    )
+    expect(html).not.toContain('Storage Location Unavailable')
+    expect(html).not.toContain('stale message left on the object')
+    expect(html).not.toContain('cannot be written')
+  })
+
+  // A location Velero has not validated yet has no phase. It is not unavailable,
+  // so it gets no alarm even if a message lingers from a prior state.
+  it('raises no alarm on a location Velero has not reported on', () => {
+    const html = renderToString(<VeleroBSLRenderer data={bslMsg('', 'old message')} />)
+    expect(html).not.toContain('Storage Location Unavailable')
+    expect(html).not.toContain('old message')
+  })
+})
+
 /**
  * The list counts what is stored; the restorable point is derived from what
  * completed. On a healthy location those are the only two numbers on the page,

package/src/components/resources/renderers/VeleroBSLRenderer.tsx

@@ -1,5 +1,5 @@
 import { HardDrive, Clock, Archive } from 'lucide-react'
-import { Section, PropertyList, Property, ConditionsSection, RelationshipGroup } from '../../ui/drawer-components'
+import { Section, PropertyList, Property, ConditionsSection, RelationshipGroup, AlertBanner } from '../../ui/drawer-components'
 import { TimeValue } from '../../ui/ScheduleValue'
 import {
   getBSLStatus,
@@ -11,6 +11,7 @@ import {
   getBSLAccessMode,
   getBSLLastValidation,
   getBSLLastSynced,
+  getBSLMessage,
 } from '../resource-utils-velero'
 import { VeleroPhaseValue } from './velero-cells'
 
@@ -66,6 +67,7 @@ export function VeleroBSLRenderer({ data, storedBackups, storedTotal, restorable
   const status = data.status || {}
   const conditions = status.conditions || []
   const bslStatus = getBSLStatus(data)
+  const message = getBSLMessage(data)
   const config = data.spec?.config || {}
   // Two things falsify "restorable", and the phase sees neither. A backup that
   // did complete is still not something to go back to once its TTL has passed —
@@ -90,6 +92,19 @@ export function VeleroBSLRenderer({ data, storedBackups, storedTotal, restorable
 
   return (
     <>
+      {/* The reason, not just the state. An unavailable location means Velero's
+          last validation of the bucket failed, and status.message is the only
+          place that reason exists — the object carries no conditions. */}
+      {bslStatus.level === 'unhealthy' && (
+        <AlertBanner
+          variant="error"
+          title="Storage Location Unavailable"
+          message={message
+            ? message
+            : 'Velero reported this location as unavailable and gave no reason. New backups cannot be written here, and backups already stored here cannot be restored from, while it stays that way.'}
+        />
+      )}
+
       {/* Status section */}
       <Section title="Status" icon={Clock} defaultExpanded>
         <PropertyList>

package/src/components/resources/renderers/VeleroRestoreRenderer.test.tsx

@@ -8,6 +8,12 @@ const restore = (status: Record<string, unknown>) => ({
   status,
 })
 
+const scopedRestore = (spec: Record<string, unknown>) => ({
+  metadata: { name: 'live-restore', namespace: 'velero' },
+  spec: { backupName: 'live-completed', ...spec },
+  status: { phase: 'Completed' },
+})
+
 /**
  * The restore side carries the same claims as the backup side and its own
  * wording for them, so pinning one does not pin the other. Both banners below
@@ -53,3 +59,85 @@ describe('what a restore claims about itself', () => {
     expect(html).toContain('Backup live-completed not found')
   })
 })
+
+/**
+ * Scope is where an operator reads what a restore will touch and where it lands.
+ * namespaceMapping remaps source namespaces to different targets on restore, so
+ * omitting it hides where the data actually goes; a labelSelector narrows the
+ * restore to a subset of objects.
+ */
+// react-dom/server inserts <!-- --> markers between adjacent text nodes, which
+// splits a badge like `app=nginx` in the raw markup; strip them so assertions
+// read the visible text.
+const renderScope = (data: unknown) =>
+  renderToString(<VeleroRestoreRenderer data={data} />).replace(/<!-- -->/g, '')
+
+describe('what a restore says it will touch', () => {
+  it('shows namespaceMapping as source to target', () => {
+    const html = renderScope(
+      scopedRestore({ namespaceMapping: { prod: 'prod-clone', staging: 'staging-clone' } }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('Namespace Mapping')
+    expect(html).toContain('prod')
+    expect(html).toContain('prod-clone')
+    expect(html).toContain('staging-clone')
+  })
+
+  it('shows the label selector that narrows the restore', () => {
+    const html = renderScope(
+      scopedRestore({
+        labelSelector: {
+          matchLabels: { app: 'nginx' },
+          matchExpressions: [{ key: 'tier', operator: 'In', values: ['frontend'] }],
+        },
+      }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+    expect(html).toContain('tier In frontend')
+  })
+
+  it('renders a Scope section for a restore filtered only by label selector', () => {
+    const html = renderScope(scopedRestore({ labelSelector: { matchLabels: { app: 'nginx' } } }))
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+  })
+
+  it('shows orLabelSelectors joined by OR', () => {
+    const html = renderScope(
+      scopedRestore({
+        orLabelSelectors: [{ matchLabels: { app: 'nginx' } }, { matchLabels: { app: 'redis' } }],
+      }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+    expect(html).toContain('app=redis')
+  })
+
+  it('shows included and excluded namespaces alongside mapping', () => {
+    const html = renderScope(
+      scopedRestore({
+        includedNamespaces: ['prod'],
+        excludedNamespaces: ['kube-system'],
+        namespaceMapping: { prod: 'prod-clone' },
+      }),
+    )
+    expect(html).toContain('Included Namespaces')
+    expect(html).toContain('Excluded Namespaces')
+    expect(html).toContain('kube-system')
+    expect(html).toContain('prod-clone')
+  })
+
+  it('renders no empty Scope section for an unscoped restore', () => {
+    const html = renderScope(scopedRestore({}))
+    expect(html).not.toContain('Scope')
+  })
+
+  // An empty selector matches everything, so it is not scope. Presenting it as
+  // scope would tell an operator a restore is filtered when it is not.
+  it('treats an empty label selector as unscoped', () => {
+    const html = renderScope(scopedRestore({ labelSelector: {}, orLabelSelectors: [{}] }))
+    expect(html).not.toContain('Scope')
+  })
+})

package/src/components/resources/renderers/VeleroRestoreRenderer.tsx

@@ -1,5 +1,5 @@
 import { ArchiveRestore, Filter } from 'lucide-react'
-import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink } from '../../ui/drawer-components'
+import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink, LabelSelectorDisplay } from '../../ui/drawer-components'
 import {
   getRestoreStatus,
   getRestoreBackupName,
@@ -7,6 +7,10 @@ import {
   getRestoreExcludedNamespaces,
   getRestoreIncludedResources,
   getRestoreExcludedResources,
+  getRestoreNamespaceMapping,
+  getRestoreLabelSelector,
+  getRestoreOrLabelSelectors,
+  hasLabelSelectorTerms,
   getRestoreDuration,
   getRestoreErrors,
   getRestoreWarnings,
@@ -41,6 +45,19 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
   const excludedNamespaces = getRestoreExcludedNamespaces(data)
   const includedResources = getRestoreIncludedResources(data)
   const excludedResources = getRestoreExcludedResources(data)
+  const namespaceMapping = getRestoreNamespaceMapping(data)
+  const rawLabelSelector = getRestoreLabelSelector(data)
+  const labelSelector = hasLabelSelectorTerms(rawLabelSelector) ? rawLabelSelector : null
+  const orLabelSelectors = getRestoreOrLabelSelectors(data).filter(hasLabelSelectorTerms)
+  const namespaceMappingEntries = Object.entries(namespaceMapping)
+  const hasScope =
+    includedNamespaces.length > 0 ||
+    excludedNamespaces.length > 0 ||
+    includedResources.length > 0 ||
+    excludedResources.length > 0 ||
+    namespaceMappingEntries.length > 0 ||
+    Boolean(labelSelector) ||
+    orLabelSelectors.length > 0
 
   const phase = status.phase || ''
   const validationErrors = getRestoreValidationErrors(data)
@@ -148,7 +165,7 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
       )}
 
       {/* Scope section */}
-      {(includedNamespaces.length > 0 || excludedNamespaces.length > 0 || includedResources.length > 0 || excludedResources.length > 0) && (
+      {hasScope && (
         <Section title="Scope" icon={Filter} defaultExpanded>
           <PropertyList>
             {includedNamespaces.length > 0 && (
@@ -172,6 +189,19 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
                 </div>
               } />
             )}
+            {namespaceMappingEntries.length > 0 && (
+              <Property label="Namespace Mapping" value={
+                <div className="flex flex-col gap-1">
+                  {namespaceMappingEntries.map(([source, target]) => (
+                    <div key={source} className="flex items-center gap-1.5">
+                      <span className="badge-sm bg-theme-hover text-theme-text-secondary">{source}</span>
+                      <span className="text-theme-text-tertiary" aria-hidden="true">&rarr;</span>
+                      <span className="badge-sm bg-theme-hover text-theme-text-secondary">{String(target)}</span>
+                    </div>
+                  ))}
+                </div>
+              } />
+            )}
             {includedResources.length > 0 && (
               <Property label="Included Resources" value={
                 <div className="flex flex-wrap gap-1">
@@ -190,6 +220,18 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
                 </div>
               } />
             )}
+            {labelSelector && (
+              <Property label="Label Selector" value={<LabelSelectorDisplay selector={labelSelector} />} />
+            )}
+            {orLabelSelectors.length > 0 && (
+              <Property label="Label Selectors (match any)" value={
+                <div className="flex flex-col gap-1">
+                  {orLabelSelectors.map((sel: any, i: number) => (
+                    <LabelSelectorDisplay key={i} selector={sel} />
+                  ))}
+                </div>
+              } />
+            )}
           </PropertyList>
         </Section>
       )}

package/src/components/resources/renderers/WorkloadRenderer.test.tsx

@@ -9,6 +9,89 @@ const deployment = {
 }
 
 describe('WorkloadRenderer', () => {
+  it('shows a calm rollout notice even when every desired replica remains ready', () => {
+    const html = renderToString(
+      <WorkloadRenderer
+        kind="deployments"
+        data={{
+          ...deployment,
+          metadata: { ...deployment.metadata, generation: 2 },
+          status: { observedGeneration: 2, replicas: 4, readyReplicas: 4, availableReplicas: 4, updatedReplicas: 2 },
+        }}
+      />,
+    )
+
+    expect(html).toContain('Rolling out')
+    expect(html).toContain('2/3 updated · 4 available')
+    expect(html).not.toContain('Issues Detected')
+  })
+
+  it('uses new-revision Pod failure evidence in the rollout notice', () => {
+    const html = renderToString(
+      <WorkloadRenderer
+        kind="deployments"
+        data={{
+          ...deployment,
+          metadata: { ...deployment.metadata, generation: 2 },
+          status: {
+            observedGeneration: 2,
+            replicas: 4,
+            readyReplicas: 2,
+            availableReplicas: 2,
+            unavailableReplicas: 1,
+            updatedReplicas: 1,
+            conditions: [{ type: 'Progressing', status: 'False', message: 'Progress deadline exceeded' }],
+          },
+        }}
+        workloadPods={[{
+          name: 'api-new-revision',
+          containers: ['api'],
+          ready: false,
+          healthLevel: 'unhealthy',
+          reason: 'ImagePullBackOff',
+          updatedRevision: true,
+        }]}
+      />,
+    )
+
+    expect(html).toContain('New revision cannot start')
+    expect(html).toContain('ImagePullBackOff · Pod api-new-revision')
+    expect(html).toContain('Issues Detected')
+    expect(html).toContain('Progressing: Progress deadline exceeded')
+    expect(html).not.toContain('Rolling out')
+  })
+
+  it('explains that OnDelete needs a manual Pod restart', () => {
+    const html = renderToString(
+      <WorkloadRenderer
+        kind="statefulsets"
+        data={{
+          metadata: { name: 'db', namespace: 'prod', generation: 3 },
+          spec: { replicas: 3, updateStrategy: { type: 'OnDelete' } },
+          status: { observedGeneration: 3, replicas: 3, readyReplicas: 3, updatedReplicas: 0 },
+        }}
+      />,
+    )
+
+    expect(html).toContain('Waiting for Pod restart')
+    expect(html).toContain('OnDelete strategy · 0/3 updated')
+  })
+
+  it('keeps outage problems visible when an OnDelete workload has no update pending', () => {
+    const html = renderToString(
+      <WorkloadRenderer
+        kind="statefulsets"
+        data={{
+          metadata: { name: 'db', namespace: 'prod', generation: 3 },
+          spec: { replicas: 3, updateStrategy: { type: 'OnDelete' } },
+          status: { observedGeneration: 3, replicas: 3, readyReplicas: 0, updatedReplicas: 3 },
+        }}
+      />,
+    )
+
+    expect(html).toContain('3 of 3 replicas are not ready')
+  })
+
   it('enables manual scaling when no replica controller targets the workload', () => {
     const html = renderToString(
       <WorkloadRenderer kind="deployments" data={deployment} onScale={async () => {}} />,