@skyhook-io/k8s-ui 1.13.4 → 1.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/k8s-ui",
-  "version": "1.13.4",
+  "version": "1.14.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/skyhook-io/radar",
@@ -70,7 +70,7 @@
     "@monaco-editor/react": "^4.7.0",
     "html-to-image": "^1.11.0",
     "monaco-yaml": "5.5.1",
-    "react-virtuoso": "^4.18.11",
+    "react-virtuoso": "^4.18.12",
     "shiki": "^4.4.2"
   },
   "peerDependencies": {
@@ -98,12 +98,12 @@
     "clsx": "^2.1.1",
     "diff": "^9.0.0",
     "elkjs": "^0.11.1",
-    "lucide-react": "^1.33.0",
+    "lucide-react": "^1.37.0",
     "monaco-editor": "0.55.1",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.10",
+    "vitest": "^4.1.11",
     "yaml": "^2.9.0"
   }
 }

package/src/components/resources/ResourcesView.tsx

@@ -1116,14 +1116,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'action', label: 'Action', width: 'w-24', tooltip: 'Validation failure action (Enforce or Audit)' },
+    { key: 'action', label: 'Action', width: 'w-36', tooltip: 'Enforcement at admission — Enforce blocks, Audit reports; Background only or Inactive when admission is disabled' },
     { key: 'rules', label: 'Rules', width: 'w-16' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clusterpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'action', label: 'Action', width: 'w-24', tooltip: 'Validation failure action (Enforce or Audit)' },
+    { key: 'action', label: 'Action', width: 'w-36', tooltip: 'Enforcement at admission — Enforce blocks, Audit reports; Background only or Inactive when admission is disabled' },
     { key: 'rules', label: 'Rules', width: 'w-16' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],

package/src/components/resources/kyverno-legacy-action.test.ts

@@ -1,5 +1,9 @@
 import { describe, it, expect } from 'vitest'
-import { getKyvernoPolicyAction } from './resource-utils-kyverno'
+import {
+  getKyvernoPolicyAction,
+  getKyvernoPolicyAdmission,
+  getKyvernoEnforcement,
+} from './resource-utils-kyverno'
 
 function cpol(spec: any) {
   return { apiVersion: 'kyverno.io/v1', kind: 'ClusterPolicy', metadata: { name: 'p' }, spec }
@@ -95,4 +99,99 @@ describe('getKyvernoPolicyAction', () => {
     expect(getKyvernoPolicyAction(cpol({ rules: [{ name: 'r', validate: {} }] }))).toBe('Audit')
     expect(getKyvernoPolicyAction(cpol({}))).toBe('Audit')
   })
+
+  // Kyverno's ValidationFailureAction enum accepts the deprecated lowercase
+  // `enforce`/`audit` alongside the capitalized spelling, and the admission
+  // controller blocks on lowercase `enforce` exactly as on `Enforce`. A legacy
+  // policy carrying the lowercase value must not read as non-blocking.
+  it('treats a lowercase spec-level enforce as Enforce (no rules)', () => {
+    expect(getKyvernoPolicyAction(cpol({ validationFailureAction: 'enforce' }))).toBe('Enforce')
+  })
+
+  it('treats a lowercase spec-level enforce inherited by a validating rule as Enforce', () => {
+    expect(
+      getKyvernoPolicyAction(
+        cpol({
+          validationFailureAction: 'enforce',
+          rules: [{ name: 'v', validate: { pattern: {} } }],
+        }),
+      ),
+    ).toBe('Enforce')
+  })
+
+  it('canonicalizes a lowercase spec-level audit to Audit', () => {
+    expect(getKyvernoPolicyAction(cpol({ validationFailureAction: 'audit' }))).toBe('Audit')
+    expect(
+      getKyvernoPolicyAction(
+        cpol({
+          validationFailureAction: 'audit',
+          rules: [{ name: 'v', validate: { pattern: {} } }],
+        }),
+      ),
+    ).toBe('Audit')
+  })
+
+  // A per-rule failureAction is capitalized-only per its CRD enum, but matching
+  // case-insensitively there too keeps a single rule for reading the field.
+  it('treats a lowercase per-rule failureAction override as Enforce', () => {
+    expect(
+      getKyvernoPolicyAction(
+        cpol({
+          validationFailureAction: 'Audit',
+          rules: [{ name: 'r', validate: { failureAction: 'enforce' } }],
+        }),
+      ),
+    ).toBe('Enforce')
+  })
+})
+
+/**
+ * `spec.admission: false` leaves a legacy policy out of the admission webhook,
+ * so it rejects nothing whatever its failureAction. Confirmed against Kyverno's
+ * own AdmissionProcessingEnabled(): nil defaults to true.
+ */
+describe('getKyvernoPolicyAdmission', () => {
+  it('defaults to true when the field is absent', () => {
+    expect(getKyvernoPolicyAdmission(cpol({}))).toBe(true)
+    expect(getKyvernoPolicyAdmission(cpol({ admission: true }))).toBe(true)
+  })
+
+  it('is false only when explicitly disabled', () => {
+    expect(getKyvernoPolicyAdmission(cpol({ admission: false }))).toBe(false)
+  })
+})
+
+describe('getKyvernoEnforcement', () => {
+  const enforcing = { validationFailureAction: 'Enforce', rules: [{ name: 'r', validate: { pattern: {} } }] }
+
+  it('blocks when admission is enabled (default) and the policy enforces', () => {
+    expect(getKyvernoEnforcement(cpol(enforcing))).toEqual({
+      label: 'Enforce',
+      blocks: true,
+      discrepancy: false,
+    })
+  })
+
+  it('does not block an Enforce policy whose admission is disabled', () => {
+    const e = getKyvernoEnforcement(cpol({ ...enforcing, admission: false }))
+    expect(e.blocks).toBe(false)
+    expect(e.discrepancy).toBe(true)
+    // Same label the modern CEL family uses for this posture.
+    expect(e.label).toBe('Background only')
+  })
+
+  it('reports a policy inactive when both admission and background are off', () => {
+    const e = getKyvernoEnforcement(cpol({ ...enforcing, admission: false, background: false }))
+    expect(e.blocks).toBe(false)
+    expect(e.label).toBe('Inactive')
+  })
+
+  it('leaves an Audit policy unchanged when admission is disabled', () => {
+    const e = getKyvernoEnforcement(cpol({
+      validationFailureAction: 'Audit',
+      admission: false,
+      rules: [{ name: 'r', validate: { pattern: {} } }],
+    }))
+    expect(e).toEqual({ label: 'Audit', blocks: false, discrepancy: false })
+  })
 })

package/src/components/resources/kyverno-modern-posture.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest'
 import {
   getKyvernoEnforcementPosture,
+  getKyvernoGenerations,
   getKyvernoPolicyFamily,
   getKyvernoValidationActions,
   getKyvernoMatchSummary,
@@ -288,3 +289,38 @@ describe('match summary', () => {
     expect(getKyvernoMatchSummary(vpol({}))).toBe('-')
   })
 })
+
+// A GeneratingPolicy declares each generated target as exactly one of an
+// `expression` (CEL returning the resources) or a `template` (a YAML document,
+// optionally CEL-interpolated). Both are first-class; the "Generates" count and
+// list must see either form.
+describe('generation targets', () => {
+  it('counts expression-form generations', () => {
+    const gen = getKyvernoGenerations(vpol({ generate: [{ expression: 'generator.Apply(ns, [cm])' }] }))
+    expect(gen).toEqual(['generator.Apply(ns, [cm])'])
+  })
+
+  it('counts template-form generations', () => {
+    const value = 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cfg\n'
+    const gen = getKyvernoGenerations(vpol({ generate: [{ template: { interpolate: 'none', value } }] }))
+    expect(gen).toHaveLength(1)
+    expect(gen[0]).toContain('ConfigMap')
+  })
+
+  it('counts a mix of expression and template forms', () => {
+    const gen = getKyvernoGenerations(
+      vpol({
+        generate: [
+          { expression: 'generator.Apply(ns, [cm])' },
+          { template: { value: 'kind: NetworkPolicy\n' } },
+        ],
+      }),
+    )
+    expect(gen).toHaveLength(2)
+  })
+
+  it('returns nothing for an empty or absent generate block', () => {
+    expect(getKyvernoGenerations(vpol({ generate: [] }))).toEqual([])
+    expect(getKyvernoGenerations(vpol({}))).toEqual([])
+  })
+})

package/src/components/resources/renderers/CNPGBackupRenderer.test.tsx

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { CNPGBackupRenderer } from './CNPGBackupRenderer'
+
+const backup = (extra: any = {}) => ({
+  apiVersion: 'postgresql.cnpg.io/v1',
+  kind: 'Backup',
+  metadata: { name: 'pg-backup', namespace: 'db' },
+  spec: { cluster: { name: 'pg' }, ...extra.spec },
+  status: { phase: 'completed', ...extra.status },
+})
+
+const html = (resource: any) => renderToString(<CNPGBackupRenderer data={resource} />)
+
+describe('CNPGBackupRenderer — spec.target is instance selection, not a restore destination', () => {
+  it('labels spec.target as the instance the backup runs on, not a recovery target', () => {
+    // Backup.spec.target is `primary` | `prefer-standby`: the policy for which
+    // instance role performs the backup. "Recovery Target" would read as a
+    // PITR restore destination, which this field is not.
+    const out = html(backup({ spec: { target: 'prefer-standby' } }))
+    expect(out).toContain('prefer-standby')
+    expect(out).toContain('Backup Target')
+    expect(out).not.toContain('Recovery Target')
+  })
+
+  it('omits the target section entirely when spec.target is unset', () => {
+    expect(html(backup())).not.toContain('Backup Target')
+  })
+})

package/src/components/resources/renderers/CNPGBackupRenderer.tsx

@@ -127,11 +127,12 @@ export function CNPGBackupRenderer({ data, onNavigate }: CNPGBackupRendererProps
         </Section>
       )}
 
-      {/* Target - for PITR backups */}
+      {/* spec.target is the policy for which instance runs the backup
+          (primary / prefer-standby); it is not a restore destination. */}
       {target !== '-' && (
         <Section title="Target" defaultExpanded>
           <PropertyList>
-            <Property label="Recovery Target" value={target} />
+            <Property label="Backup Target" value={target} />
           </PropertyList>
         </Section>
       )}

package/src/components/resources/renderers/CNPGClusterRenderer.test.tsx

@@ -39,9 +39,33 @@ describe('CNPGClusterRenderer — the drawer must not contradict the badge', ()
     expect(html(settled)).toContain('Degraded Cluster')
   })
 
-  it('still raises Cluster Down at zero ready, whatever the phase', () => {
-    // No phase excuses a database with nothing serving.
-    expect(html(cluster('Upgrading cluster', 0))).toContain('Cluster Down')
+  it('still raises Cluster Down for a was-up cluster at zero ready, whatever the phase', () => {
+    // No phase excuses a database that was serving and now has nothing ready.
+    // readyInstances is OMITTED — the shape CNPG actually emits for zero ready —
+    // and currentPrimary is the "was up" signal that tells this apart from a
+    // first bootstrap.
+    const wasUpDown = {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      kind: 'Cluster',
+      metadata: { name: 'pg', namespace: 'db' },
+      spec: { instances: 3 },
+      status: { phase: 'Upgrading cluster', currentPrimary: 'pg-1' },
+    }
+    expect(html(wasUpDown)).toContain('Cluster Down')
+  })
+
+  it('does not raise Cluster Down for a bootstrapping cluster with no primary yet', () => {
+    // Reported (phase) but no primary elected and readyInstances omitted — the
+    // shape a fresh cluster emits. A red banner here is the false alarm the
+    // availability verdict exists to prevent.
+    const bootstrapping = {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      kind: 'Cluster',
+      metadata: { name: 'pg', namespace: 'db' },
+      spec: { instances: 3 },
+      status: { phase: 'Setting up primary' },
+    }
+    expect(html(bootstrapping)).not.toContain('Cluster Down')
   })
 
   it('renders a failed last backup at the same tier as the badge and detector', () => {
@@ -116,3 +140,45 @@ describe('recovery points must be readable as ages, not raw machine timestamps',
     expect(html).toContain('2026-01-30 09:40:37 UTC')
   })
 })
+
+describe('CNPGClusterRenderer — the replica-cluster role tracks live state, not stanza presence', () => {
+  const withReplica = (replica: any, name = 'pg-eu') => ({
+    apiVersion: 'postgresql.cnpg.io/v1',
+    kind: 'Cluster',
+    metadata: { name, namespace: 'db' },
+    spec: { instances: 3, replica },
+    status: { phase: 'Cluster in healthy state', readyInstances: 3 },
+  })
+
+  it('shows the Replica Cluster section for a genuine replica (replica mode enabled)', () => {
+    const out = renderToString(<CNPGClusterRenderer data={withReplica({ source: 'pg-us', enabled: true })} />)
+    expect(out).toContain('Replica Cluster')
+    expect(out).toContain('Role')
+    expect(out).toContain('pg-us')
+  })
+
+  it('shows Replica for a distributed-topology cluster whose primary is elsewhere', () => {
+    const out = renderToString(
+      <CNPGClusterRenderer data={withReplica({ source: 'pg-us', primary: 'pg-us', self: 'pg-eu' })} />,
+    )
+    expect(out).toContain('Replica Cluster')
+  })
+
+  it('drops the Replica label once a distributed replica is promoted, though the stanza remains', () => {
+    // Promotion sets replica.primary to this cluster; the stanza is not removed.
+    const out = renderToString(
+      <CNPGClusterRenderer data={withReplica({ source: 'pg-us', primary: 'pg-eu', self: 'pg-eu' })} />,
+    )
+    expect(out).not.toContain('Replica Cluster')
+  })
+
+  it('drops the Replica label once a standalone replica is promoted (replica.enabled off)', () => {
+    const out = renderToString(<CNPGClusterRenderer data={withReplica({ source: 'pg-us', enabled: false })} />)
+    expect(out).not.toContain('Replica Cluster')
+  })
+
+  it('a normal standalone cluster shows no Replica Cluster section', () => {
+    const out = renderToString(<CNPGClusterRenderer data={cluster('Cluster in healthy state', 3)} />)
+    expect(out).not.toContain('Replica Cluster')
+  })
+})

package/src/components/resources/renderers/CNPGClusterRenderer.tsx

@@ -23,6 +23,7 @@ import {
   getCNPGWALArchivingFailure,
   getCNPGLastBackupFailure,
   classifyCNPGClusterPhase,
+  getCNPGClusterAvailability,
   CNPG_BARMAN_OBJECTSTORE_GROUP,
 } from '../resource-utils-cnpg'
 import { formatAge } from '../resource-utils'
@@ -79,8 +80,11 @@ export function CNPGClusterRenderer({ data, onNavigate, declared}: CNPGClusterRe
   const lastBackupFailure = getCNPGLastBackupFailure(data)
   const phaseBucket = classifyCNPGClusterPhase(phase)
 
-  // Problem detection
-  const isDown = countsKnown && readyInstances === 0
+  // Problem detection. isDown reuses the badge's availability verdict so the
+  // three surfaces agree: a fully-down cluster CNPG reports by omitting
+  // readyInstances (countsKnown false) is unreachable through the raw counts,
+  // and hibernation / all-fenced are deliberate not-serving states, not outages.
+  const isDown = getCNPGClusterAvailability(data) === 'down'
   // A shortfall the PHASE already explains is not a separate problem. Mirrors
   // source_cnpg.go's phaseExplained gate and the badge's ordering, both of
   // which check the phase before the instance counts: mid-switchover or waiting

package/src/components/resources/renderers/KyvernoPolicyReportRenderer.tsx

@@ -8,7 +8,8 @@ import {
   getPolicyReportResults,
   getPolicyReportScope,
   getPolicyReportSource,
-  getKyvernoPolicyAction,
+  getKyvernoEnforcement,
+  getKyvernoPolicyAdmission,
   getKyvernoPolicyRuleCount,
   getKyvernoPolicyBackground,
   getKyvernoPolicyRules,
@@ -246,15 +247,14 @@ export function KyvernoPolicyRenderer({ data, coverage, queued }: KyvernoPolicyR
   const spec = data.spec || {}
   const status = data.status || {}
   const conditions = status.conditions || []
-  const action = getKyvernoPolicyAction(data)
+  const enforcement = getKyvernoEnforcement(data)
+  const admission = getKyvernoPolicyAdmission(data)
   const ruleCount = getKyvernoPolicyRuleCount(data)
   const background = getKyvernoPolicyBackground(data)
   const rules = getKyvernoPolicyRules(data)
   const ruleCountByType = getKyvernoPolicyRuleCountByType(data)
   const autogenRules = getKyvernoPolicyAutogenRules(data)
 
-  const isEnforce = action === 'Enforce'
-
   return (
     <>
       {coverage}
@@ -269,15 +269,20 @@ export function KyvernoPolicyRenderer({ data, coverage, queued }: KyvernoPolicyR
               writing to the cluster. status.rulecount is Kyverno's own count,
               so this is checkable rather than guessed. */}
           {(ruleCountByType.validate > 0 || ruleCountByType.verifyImages > 0) && (
-          <Property label="Failure Action" value={
+          <Property label="Enforcement" value={
             <span className={clsx(
               'badge',
-              isEnforce ? 'bg-red-500/20 text-red-400' : 'bg-yellow-500/20 text-yellow-400',
+              enforcement.blocks
+                ? 'bg-red-500/20 text-red-400'
+                : enforcement.discrepancy
+                  ? 'bg-orange-500/20 text-orange-400'
+                  : 'bg-yellow-500/20 text-yellow-400',
             )}>
-              {action}
+              {enforcement.label}
             </span>
           } />
           )}
+          <Property label="Admission" value={admission ? 'Enabled' : 'Disabled'} />
           <Property label="Background" value={background ? 'Enabled' : 'Disabled'} />
           {spec.webhookTimeoutSeconds && (
             <Property label="Webhook Timeout" value={`${spec.webhookTimeoutSeconds}s`} />

package/src/components/resources/renderers/PolicyCoverageSection.test.tsx

@@ -4,7 +4,7 @@ import { PolicyCoverageSection } from './PolicyCoverageSection'
 import type { PolicyCoverageResponse, PolicyCoverageRule, PolicyCoverageSubject } from '../../../types/policy'
 
 const vpol = (spec: any = {}) => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'ValidatingPolicy', spec })
-const mpol = () => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'MutatingPolicy', spec: {} })
+const mpol = (spec: any = {}) => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'MutatingPolicy', spec })
 const legacy = (spec: any) => ({ apiVersion: 'kyverno.io/v1', kind: 'ClusterPolicy', spec })
 
 const counts = (c: Partial<PolicyCoverageResponse['counts']> = {}) =>
@@ -82,6 +82,97 @@ describe('what the section says a policy did', () => {
     expect(html).not.toContain('Generated')
   })
 
+  // A legacy Enforce policy with `spec.admission: false` is left out of the
+  // admission webhook, so it rejects nothing — the consequence sentence must not
+  // promise a rejection it cannot make.
+  it('does not promise rejection when admission evaluation is disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      legacy({ validationFailureAction: 'Enforce', admission: false,
+        rules: [{ name: 'r', validate: { pattern: {} } }] }),
+    )
+    expect(html).toContain('Nothing is rejected today')
+    expect(html).not.toContain('will be rejected')
+  })
+
+  // The policy already declares Enforce, so the remediation is to re-enable
+  // admission — not to "switch this policy to block", which would point at the
+  // wrong knob.
+  it('names admission, not the action, as the reason nothing is rejected', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      legacy({ validationFailureAction: 'Enforce', admission: false,
+        rules: [{ name: 'r', validate: { pattern: {} } }] }),
+    )
+    expect(html).toContain('admission is disabled for this policy')
+    expect(html).toContain('Enabling admission would reject the next update')
+    expect(html).not.toContain('Switching this policy to block')
+  })
+
+  // The modern CEL family reaches the same non-blocking state via
+  // `spec.evaluation.admission.enabled: false`, and the shared sentence must be
+  // honest there too.
+  it('names admission for a modern Deny policy with admission disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      vpol({ validationActions: ['Deny'], evaluation: { admission: { enabled: false } } }),
+    )
+    expect(html).toContain('admission is disabled for this policy')
+    expect(html).not.toContain('Switching this policy to block')
+  })
+
+  // A JSON-mode policy is evaluated against payloads outside the cluster and
+  // never joins admission. Both phrasings would be false: it rejects nothing
+  // today, and neither switching the action nor enabling admission changes
+  // that. The sentence is withheld rather than guessed at.
+  it('states no admission consequence for a JSON-mode policy', () => {
+    const failing = coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+      rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] })
+
+    const admissionOff = render(failing, vpol({
+      validationActions: ['Deny'],
+      evaluation: { mode: 'JSON', admission: { enabled: false } },
+    }))
+    expect(admissionOff).not.toContain('admission is disabled for this policy')
+    expect(admissionOff).not.toContain('Switching this policy to block')
+
+    // Same for JSON mode with admission left at its default.
+    const admissionDefault = render(failing, vpol({
+      validationActions: ['Deny'],
+      evaluation: { mode: 'JSON' },
+    }))
+    expect(admissionDefault).not.toContain('Switching this policy to block')
+    expect(admissionDefault).not.toContain('will be rejected')
+  })
+
+  // `getKyvernoValidationActions` applies Kyverno's absent-means-Deny default,
+  // which is right for the validating families and wrong for every other kind.
+  // A mutating policy with admission off must not be described as a policy that
+  // would reject once admission is re-enabled.
+  it('does not read a Deny default off a mutating policy with admission disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      mpol({ evaluation: { admission: { enabled: false } } }),
+    )
+    expect(html).not.toContain('admission is disabled for this policy')
+  })
+
+  // An Audit policy genuinely never blocks, so its remediation IS to switch the
+  // action — the admission-off wording must not leak onto it.
+  it('still offers to switch the action for an audit policy', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      vpol({ validationActions: ['Audit'] }),
+    )
+    expect(html).toContain('Switching this policy to block')
+    expect(html).not.toContain('admission is disabled')
+  })
+
   it('withholds the consequence when the policy’s rules disagree on blocking', () => {
     const html = render(
       coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),

package/src/components/resources/renderers/PolicyCoverageSection.tsx

@@ -11,9 +11,17 @@ import {
   getKyvernoEnforcementPosture,
   getKyvernoResourceRules,
   getKyvernoEffectiveFailurePolicy,
+  getKyvernoValidationActions,
+  getKyvernoEvaluationMode,
+  isKyvernoAdmissionEnabled,
   type KyvernoPolicyFamily,
 } from '../resource-utils-kyverno-modern'
-import { getKyvernoPolicyAction } from '../resource-utils-kyverno'
+import {
+  getKyvernoEnforcement,
+  getKyvernoPolicyAction,
+  getKyvernoPolicyAdmission,
+  isKyvernoEnforceAction,
+} from '../resource-utils-kyverno'
 import type {
   PolicyCoverageResponse,
   PolicyCoverageRule,
@@ -160,7 +168,7 @@ function legacyActionsAgree(resource: any): boolean {
           : []),
       ].filter(Boolean)
       const effective = declared.length > 0 ? declared : [spec]
-      return effective.includes('Enforce')
+      return effective.some(isKyvernoEnforceAction)
     })
   return answers.every((a: boolean) => a === answers[0])
 }
@@ -229,17 +237,40 @@ function policyFamilyFor(
 
 /**
  * The families answer from different fields: legacy carries
- * `spec.validationFailureAction` (or a per-rule `validate.failureAction`), while
- * `getKyvernoEnforcementPosture` reads `spec.validationActions`, absent on
- * legacy — which makes an Enforce policy read as audit-only.
+ * `spec.validationFailureAction` (or a per-rule `validate.failureAction`) gated
+ * by `spec.admission`, while `getKyvernoEnforcementPosture` reads
+ * `spec.validationActions` and `spec.evaluation.admission.enabled`, both absent
+ * on legacy — which makes an Enforce policy read as audit-only.
  */
 function blocksAdmission(resource: any, family: KyvernoPolicyFamily | undefined): boolean {
   if (isLegacyKyvernoPolicy(resource)) {
-    return getKyvernoPolicyAction(resource) === 'Enforce'
+    return getKyvernoEnforcement(resource).blocks
   }
   return getKyvernoEnforcementPosture(resource, family).blocks
 }
 
+/**
+ * A policy declares a rejecting action yet does not block, because admission
+ * evaluation is switched off. The distinction changes the remediation the
+ * consequence sentence offers — re-enable admission, not switch the action —
+ * so it must not be conflated with an audit policy that simply never blocks.
+ *
+ * Only the validating families carry `validationActions`, and
+ * `getKyvernoValidationActions` applies Kyverno's absent-means-Deny default,
+ * so asking a mutating or generating policy would read Deny off a field that
+ * kind never has. The same guard `getKyvernoEnforcementPosture` uses.
+ */
+function declaresBlockingButAdmissionOff(
+  resource: any,
+  family: KyvernoPolicyFamily | undefined,
+): boolean {
+  if (isLegacyKyvernoPolicy(resource)) {
+    return getKyvernoPolicyAction(resource) === 'Enforce' && !getKyvernoPolicyAdmission(resource)
+  }
+  if (family !== 'validating' && family !== 'imageValidating') return false
+  return getKyvernoValidationActions(resource).includes('Deny') && !isKyvernoAdmissionEnabled(resource)
+}
+
 /**
  * Whether the consequence sentence can be stated at all.
  *
@@ -250,6 +281,11 @@ function blocksAdmission(resource: any, family: KyvernoPolicyFamily | undefined)
  */
 function canStateConsequence(resource: any, family: KyvernoPolicyFamily | undefined): boolean {
   if (!isLegacyKyvernoPolicy(resource)) {
+    // A JSON-mode policy is evaluated against payloads outside the cluster and
+    // never joins admission, so every phrasing of the sentence is false: it
+    // rejects nothing today, and neither switching the action nor enabling
+    // admission would change that. The posture badge already says "JSON mode".
+    if (getKyvernoEvaluationMode(resource) === 'JSON') return false
     return family === 'validating' || family === 'imageValidating' || family === undefined
   }
   const rules: any[] = resource?.spec?.rules ?? []
@@ -273,6 +309,7 @@ function enforcementConsequence(
   failing: number,
   blocks: boolean,
   matchesUpdate: boolean,
+  admissionOff = false,
 ): string {
   // Deliberately kind-neutral. A policy can match ConfigMaps, Secrets or
   // ClusterRoles as readily as Pods, and none of those "run" — the fact being
@@ -288,11 +325,24 @@ function enforcementConsequence(
       : `${exists} and ${one ? 'stays' : 'stay'} as ${itIs} — this policy only checks creation, so ${itIs} rejected only if recreated.`
   }
 
+  const target = one ? 'this resource' : `any of these ${failing}`
+
+  // The policy already declares a rejecting action; it does not block only
+  // because admission evaluation is disabled. Telling the operator to change
+  // the action would point at the wrong knob — the fix is to re-enable
+  // admission.
+  if (admissionOff) {
+    return matchesUpdate
+      ? `Nothing is rejected today because admission is disabled for this policy. Enabling admission would reject the next update to ${target}.`
+      : `Nothing is rejected today because admission is disabled for this policy. Enabling admission would leave ${
+          one ? 'this resource as it is' : `these ${failing} as they are`
+        } — only newly created resources would be rejected.`
+  }
+
   // "Set to enforce" is the legacy family's vocabulary; the modern API spells
   // the same thing `validationActions: [Deny]`, and the posture badge above
   // already says "Deny". Describing the behaviour rather than the field keeps
   // one sentence correct for both.
-  const target = one ? 'this resource' : `any of these ${failing}`
   return matchesUpdate
     ? `Nothing is rejected today. Switching this policy to block would reject the next update to ${target}.`
     : `Nothing is rejected today. Switching this policy to block would leave ${
@@ -469,8 +519,14 @@ function Consequence({
   const failing = data.subjectsFailing ?? data.counts.fail
 
   if (failing > 0 && canStateConsequence(resource, family)) {
+    const blocks = blocksAdmission(resource, family)
     lines.push(
-      enforcementConsequence(failing, blocksAdmission(resource, family), matchesUpdates(resource)),
+      enforcementConsequence(
+        failing,
+        blocks,
+        matchesUpdates(resource),
+        !blocks && declaresBlockingButAdmissionOff(resource, family),
+      ),
     )
   }