@skyhook-io/k8s-ui 1.13.4 → 1.14.0

package/src/components/resources/renderers/VeleroBSLRenderer.test.tsx

@@ -176,6 +176,53 @@ describe('what a storage location holds', () => {
   })
 })
 
+/**
+ * Velero writes why a location is unavailable into `status.message`, and the
+ * BSL object carries no conditions, so that field is the only place the reason
+ * exists. A page opened from an unavailable-location problem has to show it -
+ * the same way the sibling BackupRepository renderer leads with its own reason.
+ */
+describe('an unavailable location Velero gave a reason for', () => {
+  const bslMsg = (phase: string, message?: string) => ({
+    metadata: { name: 'dr-replica', namespace: 'velero' },
+    spec: { provider: 'aws', objectStorage: { bucket: 'dr' } },
+    status: { phase, ...(message !== undefined ? { message } : {}) },
+  })
+
+  it('leads with the reason Velero gave', () => {
+    const html = renderToString(
+      <VeleroBSLRenderer
+        data={bslMsg('Unavailable', 'BackupStorageLocation is invalid: rpc error: code = Unknown desc = NoSuchBucket')}
+      />,
+    )
+    expect(html).toContain('NoSuchBucket')
+  })
+
+  // Velero can set Unavailable with no message. Saying nothing would leave a red
+  // badge and no consequence, so the page states what unavailable costs.
+  it('names the consequence when Velero gave no reason', () => {
+    const html = renderToString(<VeleroBSLRenderer data={bslMsg('Unavailable')} />)
+    expect(html).toContain('cannot be written')
+  })
+
+  it('says nothing alarming when the location is available', () => {
+    const html = renderToString(
+      <VeleroBSLRenderer data={bslMsg('Available', 'stale message left on the object')} />,
+    )
+    expect(html).not.toContain('Storage Location Unavailable')
+    expect(html).not.toContain('stale message left on the object')
+    expect(html).not.toContain('cannot be written')
+  })
+
+  // A location Velero has not validated yet has no phase. It is not unavailable,
+  // so it gets no alarm even if a message lingers from a prior state.
+  it('raises no alarm on a location Velero has not reported on', () => {
+    const html = renderToString(<VeleroBSLRenderer data={bslMsg('', 'old message')} />)
+    expect(html).not.toContain('Storage Location Unavailable')
+    expect(html).not.toContain('old message')
+  })
+})
+
 /**
  * The list counts what is stored; the restorable point is derived from what
  * completed. On a healthy location those are the only two numbers on the page,

package/src/components/resources/renderers/VeleroBSLRenderer.tsx

@@ -1,5 +1,5 @@
 import { HardDrive, Clock, Archive } from 'lucide-react'
-import { Section, PropertyList, Property, ConditionsSection, RelationshipGroup } from '../../ui/drawer-components'
+import { Section, PropertyList, Property, ConditionsSection, RelationshipGroup, AlertBanner } from '../../ui/drawer-components'
 import { TimeValue } from '../../ui/ScheduleValue'
 import {
   getBSLStatus,
@@ -11,6 +11,7 @@ import {
   getBSLAccessMode,
   getBSLLastValidation,
   getBSLLastSynced,
+  getBSLMessage,
 } from '../resource-utils-velero'
 import { VeleroPhaseValue } from './velero-cells'
 
@@ -66,6 +67,7 @@ export function VeleroBSLRenderer({ data, storedBackups, storedTotal, restorable
   const status = data.status || {}
   const conditions = status.conditions || []
   const bslStatus = getBSLStatus(data)
+  const message = getBSLMessage(data)
   const config = data.spec?.config || {}
   // Two things falsify "restorable", and the phase sees neither. A backup that
   // did complete is still not something to go back to once its TTL has passed —
@@ -90,6 +92,19 @@ export function VeleroBSLRenderer({ data, storedBackups, storedTotal, restorable
 
   return (
     <>
+      {/* The reason, not just the state. An unavailable location means Velero's
+          last validation of the bucket failed, and status.message is the only
+          place that reason exists — the object carries no conditions. */}
+      {bslStatus.level === 'unhealthy' && (
+        <AlertBanner
+          variant="error"
+          title="Storage Location Unavailable"
+          message={message
+            ? message
+            : 'Velero reported this location as unavailable and gave no reason. New backups cannot be written here, and backups already stored here cannot be restored from, while it stays that way.'}
+        />
+      )}
+
       {/* Status section */}
       <Section title="Status" icon={Clock} defaultExpanded>
         <PropertyList>

package/src/components/resources/renderers/VeleroRestoreRenderer.test.tsx

@@ -8,6 +8,12 @@ const restore = (status: Record<string, unknown>) => ({
   status,
 })
 
+const scopedRestore = (spec: Record<string, unknown>) => ({
+  metadata: { name: 'live-restore', namespace: 'velero' },
+  spec: { backupName: 'live-completed', ...spec },
+  status: { phase: 'Completed' },
+})
+
 /**
  * The restore side carries the same claims as the backup side and its own
  * wording for them, so pinning one does not pin the other. Both banners below
@@ -53,3 +59,85 @@ describe('what a restore claims about itself', () => {
     expect(html).toContain('Backup live-completed not found')
   })
 })
+
+/**
+ * Scope is where an operator reads what a restore will touch and where it lands.
+ * namespaceMapping remaps source namespaces to different targets on restore, so
+ * omitting it hides where the data actually goes; a labelSelector narrows the
+ * restore to a subset of objects.
+ */
+// react-dom/server inserts <!-- --> markers between adjacent text nodes, which
+// splits a badge like `app=nginx` in the raw markup; strip them so assertions
+// read the visible text.
+const renderScope = (data: unknown) =>
+  renderToString(<VeleroRestoreRenderer data={data} />).replace(/<!-- -->/g, '')
+
+describe('what a restore says it will touch', () => {
+  it('shows namespaceMapping as source to target', () => {
+    const html = renderScope(
+      scopedRestore({ namespaceMapping: { prod: 'prod-clone', staging: 'staging-clone' } }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('Namespace Mapping')
+    expect(html).toContain('prod')
+    expect(html).toContain('prod-clone')
+    expect(html).toContain('staging-clone')
+  })
+
+  it('shows the label selector that narrows the restore', () => {
+    const html = renderScope(
+      scopedRestore({
+        labelSelector: {
+          matchLabels: { app: 'nginx' },
+          matchExpressions: [{ key: 'tier', operator: 'In', values: ['frontend'] }],
+        },
+      }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+    expect(html).toContain('tier In frontend')
+  })
+
+  it('renders a Scope section for a restore filtered only by label selector', () => {
+    const html = renderScope(scopedRestore({ labelSelector: { matchLabels: { app: 'nginx' } } }))
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+  })
+
+  it('shows orLabelSelectors joined by OR', () => {
+    const html = renderScope(
+      scopedRestore({
+        orLabelSelectors: [{ matchLabels: { app: 'nginx' } }, { matchLabels: { app: 'redis' } }],
+      }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+    expect(html).toContain('app=redis')
+  })
+
+  it('shows included and excluded namespaces alongside mapping', () => {
+    const html = renderScope(
+      scopedRestore({
+        includedNamespaces: ['prod'],
+        excludedNamespaces: ['kube-system'],
+        namespaceMapping: { prod: 'prod-clone' },
+      }),
+    )
+    expect(html).toContain('Included Namespaces')
+    expect(html).toContain('Excluded Namespaces')
+    expect(html).toContain('kube-system')
+    expect(html).toContain('prod-clone')
+  })
+
+  it('renders no empty Scope section for an unscoped restore', () => {
+    const html = renderScope(scopedRestore({}))
+    expect(html).not.toContain('Scope')
+  })
+
+  // An empty selector matches everything, so it is not scope. Presenting it as
+  // scope would tell an operator a restore is filtered when it is not.
+  it('treats an empty label selector as unscoped', () => {
+    const html = renderScope(scopedRestore({ labelSelector: {}, orLabelSelectors: [{}] }))
+    expect(html).not.toContain('Scope')
+  })
+})

package/src/components/resources/renderers/VeleroRestoreRenderer.tsx

@@ -1,5 +1,5 @@
 import { ArchiveRestore, Filter } from 'lucide-react'
-import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink } from '../../ui/drawer-components'
+import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink, LabelSelectorDisplay } from '../../ui/drawer-components'
 import {
   getRestoreStatus,
   getRestoreBackupName,
@@ -7,6 +7,10 @@ import {
   getRestoreExcludedNamespaces,
   getRestoreIncludedResources,
   getRestoreExcludedResources,
+  getRestoreNamespaceMapping,
+  getRestoreLabelSelector,
+  getRestoreOrLabelSelectors,
+  hasLabelSelectorTerms,
   getRestoreDuration,
   getRestoreErrors,
   getRestoreWarnings,
@@ -41,6 +45,19 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
   const excludedNamespaces = getRestoreExcludedNamespaces(data)
   const includedResources = getRestoreIncludedResources(data)
   const excludedResources = getRestoreExcludedResources(data)
+  const namespaceMapping = getRestoreNamespaceMapping(data)
+  const rawLabelSelector = getRestoreLabelSelector(data)
+  const labelSelector = hasLabelSelectorTerms(rawLabelSelector) ? rawLabelSelector : null
+  const orLabelSelectors = getRestoreOrLabelSelectors(data).filter(hasLabelSelectorTerms)
+  const namespaceMappingEntries = Object.entries(namespaceMapping)
+  const hasScope =
+    includedNamespaces.length > 0 ||
+    excludedNamespaces.length > 0 ||
+    includedResources.length > 0 ||
+    excludedResources.length > 0 ||
+    namespaceMappingEntries.length > 0 ||
+    Boolean(labelSelector) ||
+    orLabelSelectors.length > 0
 
   const phase = status.phase || ''
   const validationErrors = getRestoreValidationErrors(data)
@@ -148,7 +165,7 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
       )}
 
       {/* Scope section */}
-      {(includedNamespaces.length > 0 || excludedNamespaces.length > 0 || includedResources.length > 0 || excludedResources.length > 0) && (
+      {hasScope && (
         <Section title="Scope" icon={Filter} defaultExpanded>
           <PropertyList>
             {includedNamespaces.length > 0 && (
@@ -172,6 +189,19 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
                 </div>
               } />
             )}
+            {namespaceMappingEntries.length > 0 && (
+              <Property label="Namespace Mapping" value={
+                <div className="flex flex-col gap-1">
+                  {namespaceMappingEntries.map(([source, target]) => (
+                    <div key={source} className="flex items-center gap-1.5">
+                      <span className="badge-sm bg-theme-hover text-theme-text-secondary">{source}</span>
+                      <span className="text-theme-text-tertiary" aria-hidden="true">&rarr;</span>
+                      <span className="badge-sm bg-theme-hover text-theme-text-secondary">{String(target)}</span>
+                    </div>
+                  ))}
+                </div>
+              } />
+            )}
             {includedResources.length > 0 && (
               <Property label="Included Resources" value={
                 <div className="flex flex-wrap gap-1">
@@ -190,6 +220,18 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
                 </div>
               } />
             )}
+            {labelSelector && (
+              <Property label="Label Selector" value={<LabelSelectorDisplay selector={labelSelector} />} />
+            )}
+            {orLabelSelectors.length > 0 && (
+              <Property label="Label Selectors (match any)" value={
+                <div className="flex flex-col gap-1">
+                  {orLabelSelectors.map((sel: any, i: number) => (
+                    <LabelSelectorDisplay key={i} selector={sel} />
+                  ))}
+                </div>
+              } />
+            )}
           </PropertyList>
         </Section>
       )}

package/src/components/resources/renderers/cnpg-cells.tsx

@@ -4,6 +4,7 @@ import { clsx } from 'clsx'
 import { Tooltip } from '../../ui/Tooltip'
 import {
   getCNPGClusterStatus,
+  getCNPGClusterAvailability,
   classifyCNPGClusterPhase,
   getCNPGClusterInstances,
   getCNPGClusterPrimary,
@@ -66,8 +67,18 @@ export function CNPGClusterCell({ resource, column }: { resource: any; column: s
           </Tooltip>
         )
       }
+      // Colour tracks the badge: a was-up total outage (readyInstances omitted,
+      // so readyKnown is false) reads red like its "Not Ready" badge rather than
+      // muted grey, and a partial shortfall stays yellow. Without the
+      // availability check the most severe count was the least emphasised.
+      const down = getCNPGClusterAvailability(resource) === 'down'
       return (
-        <span className={clsx('text-sm', readyKnown && ready < desired ? 'text-yellow-400' : 'text-theme-text-secondary')}>
+        <span
+          className={clsx(
+            'text-sm',
+            down ? 'text-red-400' : readyKnown && ready < desired ? 'text-yellow-400' : 'text-theme-text-secondary',
+          )}
+        >
           {instances}
         </span>
       )

package/src/components/resources/renderers/kyverno-cells.tsx

@@ -6,7 +6,7 @@ import {
   getPolicyReportStatus,
   getPolicyReportSummary,
   getKyvernoPolicyStatus,
-  getKyvernoPolicyAction,
+  getKyvernoEnforcement,
   getKyvernoPolicyRuleCount,
 } from '../resource-utils-kyverno'
 import {
@@ -79,13 +79,17 @@ export function KyvernoPolicyCell({ resource, column }: { resource: any; column:
       )
     }
     case 'action': {
-      const action = getKyvernoPolicyAction(resource)
+      const { label, blocks, discrepancy } = getKyvernoEnforcement(resource)
       return (
         <span className={clsx(
           'badge',
-          action === 'Enforce' ? 'bg-red-500/20 text-red-400' : 'bg-yellow-500/20 text-yellow-400',
+          blocks
+            ? 'bg-red-500/20 text-red-400'
+            : discrepancy
+              ? 'bg-orange-500/20 text-orange-400'
+              : 'bg-yellow-500/20 text-yellow-400',
         )}>
-          {action}
+          {label}
         </span>
       )
     }

package/src/components/resources/resource-utils-cnpg.golden.test.ts

@@ -27,6 +27,7 @@ interface GoldenCase {
   name: string
   spec: Record<string, unknown>
   status: Record<string, unknown>
+  metadata?: Record<string, unknown>
   badge: { text: string; level: string }
   issues: string[]
   worst: string
@@ -40,7 +41,7 @@ describe('CNPG golden matrix — badge side', () => {
   })
 
   it.each(cases.map((c) => [c.name, c] as const))('%s', (_name, tc) => {
-    const badge = getCNPGClusterStatus({ spec: tc.spec, status: tc.status })
+    const badge = getCNPGClusterStatus({ metadata: tc.metadata, spec: tc.spec, status: tc.status })
     expect({ text: badge.text, level: badge.level }).toEqual(tc.badge)
   })
 
@@ -50,7 +51,7 @@ describe('CNPG golden matrix — badge side', () => {
   it.each(cases.map((c) => [c.name, c] as const))(
     'badge and issues do not contradict — %s',
     (_name, tc) => {
-      const badge = getCNPGClusterStatus({ spec: tc.spec, status: tc.status })
+      const badge = getCNPGClusterStatus({ metadata: tc.metadata, spec: tc.spec, status: tc.status })
       if (badge.level === 'healthy') {
         expect(tc.issues, 'a healthy badge must not sit next to an issue').toEqual([])
       }
@@ -69,16 +70,23 @@ describe('CNPG golden matrix — badge side', () => {
   // This is the gap that let the bug through: the matrix already pinned
   // "readyInstances absent — unknown, not zero; must not fabricate an outage"
   // for the badge, and the cell rendered 0/N on that very case.
+  //
+  // The cell reads '-' exactly when the ready count is genuinely unknown: no
+  // explicit readyInstances AND no currentPrimary. Once a primary has been
+  // elected, an omitted readyInstances is a real 0 and the cell says so — which
+  // is what keeps "0/3" agreeing with the "Not Ready" badge on a was-up outage,
+  // while a still-bootstrapping cluster (no primary) keeps its dash.
   it.each(cases.map((c) => [c.name, c] as const))(
     'instances cell does not claim an outage the badge denies — %s',
     (_name, tc) => {
       const cell = getCNPGClusterInstances({ spec: tc.spec, status: tc.status })
       const ready = cell.split('/')[0]
-      const readyReported = typeof tc.status.readyInstances === 'number'
+      const readyResolvable =
+        typeof tc.status.readyInstances === 'number' || !!tc.status.currentPrimary
       expect(
         ready === '-',
-        `readyInstances ${readyReported ? 'is reported' : 'is absent'} but the cell reads ${cell}`,
-      ).toBe(!readyReported)
+        `ready is ${readyResolvable ? 'resolvable' : 'unknown'} but the cell reads ${cell}`,
+      ).toBe(!readyResolvable)
     },
   )
 })

package/src/components/resources/resource-utils-cnpg.test.ts

@@ -27,6 +27,12 @@ import {
   getCNPGClusterDisplayState,
   getCNPGClusterInstances,
   getCNPGPoolerInstances,
+  getCNPGClusterIsReplica,
+  getCNPGClusterReplicaSource,
+  getCNPGClusterAvailability,
+  isCNPGClusterHibernated,
+  isCNPGClusterFencedAll,
+  CNPG_DOWN_GRACE_MS,
 } from './resource-utils-cnpg'
 import { getCellFilterValue } from './resource-utils'
 
@@ -176,8 +182,10 @@ describe('getCNPGClusterStatus', () => {
     expect(getCNPGClusterStatus(cluster({ phase: 'Failing over', readyInstances: 2 }, { instances: 3 })).level).toBe('alert')
   })
 
-  it('treats zero ready instances as down regardless of phase', () => {
-    const s = getCNPGClusterStatus(cluster({ phase: 'Cluster in healthy state', readyInstances: 0 }, { instances: 3 }))
+  it('treats a was-up cluster with zero ready instances as down regardless of phase', () => {
+    // currentPrimary proves it was serving; the omitted-then-zero count is a
+    // regression, not a first bootstrap. Even a "healthy" phase does not rescue it.
+    const s = getCNPGClusterStatus(cluster({ phase: 'Cluster in healthy state', currentPrimary: 'pg-1', readyInstances: 0 }, { instances: 3 }))
     expect(s.level).toBe('unhealthy')
     expect(s.text).toBe('Not Ready')
   })
@@ -193,6 +201,68 @@ describe('getCNPGClusterStatus', () => {
   })
 })
 
+describe('getCNPGClusterAvailability — three states a bare zero-ready count collapses', () => {
+  // CNPG omits readyInstances when it is 0, so these fixtures OMIT it — the shape
+  // the operator actually emits for a down cluster.
+  const withPrimary = (extra: any = {}, meta: any = {}) => ({
+    metadata: meta,
+    spec: { instances: 3 },
+    status: { currentPrimary: 'pg-1', ...extra },
+  })
+
+  it('is null while still bootstrapping — reported, but no primary ever elected', () => {
+    // The truly-statusless case AND the reported-but-no-primary case both stay
+    // null: nothing was serving to lose.
+    expect(getCNPGClusterAvailability({ spec: { instances: 3 }, status: {} })).toBeNull()
+    expect(getCNPGClusterAvailability({ spec: { instances: 3 }, status: { phase: 'Setting up primary' } })).toBeNull()
+  })
+
+  it('is null when a real ready count exists', () => {
+    expect(getCNPGClusterAvailability({ spec: { instances: 3 }, status: { currentPrimary: 'pg-1', readyInstances: 2 } })).toBeNull()
+  })
+
+  it('is down for a was-up cluster with no Ready condition — escalates immediately', () => {
+    expect(getCNPGClusterAvailability(withPrimary({ phase: 'Waiting for the instances to become active' }))).toBe('down')
+  })
+
+  it('debounces a fresh Ready=False, then escalates once it ages past the grace', () => {
+    const recent = new Date(Date.now() - 60 * 1000).toISOString()
+    const old = new Date(Date.now() - CNPG_DOWN_GRACE_MS - 60 * 1000).toISOString()
+    const cond = (ltt: string) => withPrimary({
+      conditions: [{ type: 'Ready', status: 'False', reason: 'ClusterIsNotReady', lastTransitionTime: ltt }],
+    })
+    expect(getCNPGClusterAvailability(cond(recent))).toBeNull()
+    expect(getCNPGClusterAvailability(cond(old))).toBe('down')
+  })
+
+  it('reads hibernation and all-fencing as neutral, ahead of the down verdict', () => {
+    expect(getCNPGClusterAvailability(withPrimary({}, { annotations: { 'cnpg.io/hibernation': 'on' } }))).toBe('hibernated')
+    expect(getCNPGClusterAvailability(withPrimary({}, { annotations: { 'cnpg.io/fencedInstances': '["*"]' } }))).toBe('fenced')
+  })
+
+  it('a partial fence is not all-fenced — "*" is the only all-down token', () => {
+    expect(isCNPGClusterFencedAll({ metadata: { annotations: { 'cnpg.io/fencedInstances': '["pg-1-2"]' } } })).toBe(false)
+    expect(isCNPGClusterFencedAll({ metadata: { annotations: { 'cnpg.io/fencedInstances': '["*"]' } } })).toBe(true)
+    // A malformed annotation is treated as not-fenced rather than throwing.
+    expect(isCNPGClusterFencedAll({ metadata: { annotations: { 'cnpg.io/fencedInstances': 'not-json' } } })).toBe(false)
+  })
+
+  it('hibernation is an explicit "on", nothing else', () => {
+    expect(isCNPGClusterHibernated({ metadata: { annotations: { 'cnpg.io/hibernation': 'on' } } })).toBe(true)
+    expect(isCNPGClusterHibernated({ metadata: { annotations: { 'cnpg.io/hibernation': 'off' } } })).toBe(false)
+    expect(isCNPGClusterHibernated({ metadata: {} })).toBe(false)
+  })
+
+  it('renders the badge neutral for hibernation and fencing, red only for a real outage', () => {
+    expect(getCNPGClusterStatus(withPrimary({}, { annotations: { 'cnpg.io/hibernation': 'on' } })))
+      .toMatchObject({ text: 'Hibernated', level: 'neutral' })
+    expect(getCNPGClusterStatus(withPrimary({}, { annotations: { 'cnpg.io/fencedInstances': '["*"]' } })))
+      .toMatchObject({ text: 'Fenced', level: 'neutral' })
+    expect(getCNPGClusterStatus(withPrimary({ phase: 'Switchover in progress' })))
+      .toMatchObject({ text: 'Not Ready', level: 'unhealthy' })
+  })
+})
+
 describe('getCNPGBackupStatus', () => {
   it('escalates walArchivingFailing instead of rendering it neutral', () => {
     // The shipped bug: this phase hit the default branch and rendered grey,
@@ -716,3 +786,73 @@ describe('CNPG scheduled backup lateness', () => {
     expect(getCNPGScheduledBackupStatus(sb(false, undefined, at(-24 * 60 * MIN))).level).toBe('healthy')
   })
 })
+
+describe('getCNPGClusterIsReplica — the live replica-cluster role, per CNPG semantics', () => {
+  // CNPG carries replica-cluster state in `spec.replica` (enabled/primary/self/source),
+  // and its own Cluster.IsReplica() reads: enabled wins when set; otherwise the
+  // cluster is a replica only while (self || name) != primary. Promotion mutates
+  // those fields but leaves the stanza in place, so presence alone cannot be the
+  // signal.
+
+  it('standalone replica cluster (replica mode enabled) reads as a replica', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', enabled: true } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(true)
+  })
+
+  it('a promoted standalone cluster (replica.enabled turned off) is no longer a replica', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', enabled: false } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(false)
+  })
+
+  it('distributed topology: a designated replica (primary names another cluster) reads as a replica', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-us', self: 'pg-eu' } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(true)
+  })
+
+  it('distributed topology: after promotion (primary now names this cluster) it is the primary, stanza still present', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-eu', self: 'pg-eu' } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(false)
+  })
+
+  it('distributed topology without self falls back to the resource name', () => {
+    const promoted = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-eu' } },
+    }
+    expect(getCNPGClusterIsReplica(promoted)).toBe(false)
+
+    const stillReplica = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-us' } },
+    }
+    expect(getCNPGClusterIsReplica(stillReplica)).toBe(true)
+  })
+
+  it('a bootstrapping standalone replica with only a source (no enabled, no primary) is a replica', () => {
+    // The stanza's source is required; before the operator writes enabled, the
+    // cluster is still a replica — (self || name) never equals an unset primary.
+    const resource = { metadata: { name: 'pg-eu' }, spec: { replica: { source: 'pg-us' } } }
+    expect(getCNPGClusterIsReplica(resource)).toBe(true)
+  })
+
+  it('an ordinary standalone cluster with no replica stanza is not a replica', () => {
+    expect(getCNPGClusterIsReplica({ metadata: { name: 'pg' }, spec: { instances: 3 } })).toBe(false)
+  })
+
+  it('getCNPGClusterReplicaSource reads the source from the replica stanza', () => {
+    const resource = { metadata: { name: 'pg-eu' }, spec: { replica: { source: 'pg-us', enabled: true } } }
+    expect(getCNPGClusterReplicaSource(resource)).toBe('pg-us')
+  })
+})