@skyhook-io/k8s-ui 1.13.4 → 1.14.0

package/src/components/resources/resource-utils-cnpg.ts

@@ -145,6 +145,100 @@ export function classifyCNPGClusterPhase(phase: string): CNPGPhaseBucket {
   return 'unknown'
 }
 
+// Debounce window for calling a was-up cluster "down". A single instance
+// restarting flips Ready=False for a minute or two while the pod comes back;
+// escalating instantly would fire on routine rollouts. Kept in step with
+// cnpgDownGrace in internal/issues/source_cnpg.go — the two must not drift.
+export const CNPG_DOWN_GRACE_MS = 5 * 60 * 1000
+
+/**
+ * Hibernation is a deliberate scale-to-zero: the operator removes the pods and
+ * the cluster reports nothing ready by design. Signalled by an annotation, not
+ * by any status field, so it has to be read before a zero-ready count is called
+ * an outage.
+ */
+export function isCNPGClusterHibernated(resource: any): boolean {
+  return resource?.metadata?.annotations?.['cnpg.io/hibernation'] === 'on'
+}
+
+/**
+ * Fencing stops PostgreSQL on the named instances while leaving the pods up. The
+ * annotation is a JSON array of instance names; `"*"` means every instance is
+ * fenced, so nothing serves — intentionally, not as a fault. A malformed value
+ * is treated as "not fenced" rather than throwing.
+ */
+export function isCNPGClusterFencedAll(resource: any): boolean {
+  const raw = resource?.metadata?.annotations?.['cnpg.io/fencedInstances']
+  if (typeof raw !== 'string' || raw === '') return false
+  try {
+    const parsed = JSON.parse(raw)
+    return Array.isArray(parsed) && parsed.includes('*')
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Whether a zero-ready cluster is actually unavailable, and why.
+ *
+ * The load-bearing distinction the badge and the Go detector both turn on:
+ * CNPG omits `status.readyInstances` when it is 0 (omitempty int), so "no
+ * status yet" and "0 ready" are byte-identical on the wire. The field's
+ * presence therefore cannot distinguish an outage from an unreported cluster;
+ * any other status the operator has written (phase, primary, a condition) is
+ * what marks the count as a real 0 rather than "not reported".
+ *
+ * `status.currentPrimary` is the version-robust "was up" signal: CNPG sets it
+ * the first time a primary is elected and never clears it (present on 1.27 and
+ * 1.28). So a zero-ready cluster that HAS a currentPrimary was serving before —
+ * a regression — while one that never had a primary is still bootstrapping.
+ *
+ *   - null       — not down: still bootstrapping, or a real ready count exists
+ *   - 'hibernated' / 'fenced' — deliberately not serving, no alarm
+ *   - 'down'     — was up, now zero ready past the grace window
+ *
+ * Mirrored by getCNPGClusterAvailability's Go counterpart in
+ * internal/issues/source_cnpg.go (the allDown verdict) — same signals, same
+ * grace, or a badge and its issue disagree.
+ */
+export function getCNPGClusterAvailability(
+  resource: any,
+): 'hibernated' | 'fenced' | 'down' | null {
+  const status = resource.status || {}
+  const desired = resource.spec?.instances ?? 0
+  const ready = typeof status.readyInstances === 'number' ? status.readyInstances : 0
+  // Any status the operator has written proves it has reconciled at least once,
+  // which is what lets an absent readyInstances be read as a real 0 rather than
+  // "not reported". Absent EVERYTHING is the truly-statusless case, still unknown.
+  const reported = !!(status.phase || status.currentPrimary || status.conditions?.length)
+  if (desired <= 0 || ready > 0 || !reported) return null
+  // Deliberate not-serving states outrank the down verdict — checked before the
+  // was-up gate so a hibernated cluster reads neutral even if it kept a primary.
+  if (isCNPGClusterHibernated(resource)) return 'hibernated'
+  if (isCNPGClusterFencedAll(resource)) return 'fenced'
+  // Never elected a primary → first bootstrap, not a regression.
+  if (!status.currentPrimary) return null
+  const conditions = status.conditions || []
+  const readyCond = conditions.find((c: any) => c.type === 'Ready')
+  // A was-up cluster whose Ready only just went False is likely a single
+  // instance bouncing; wait out the grace. No Ready=False at all (or no
+  // timestamp) means nothing is debouncing, so escalate immediately rather than
+  // inventing a start time.
+  if (
+    readyCond?.status === 'False' &&
+    readyCond.lastTransitionTime &&
+    Date.now() - Date.parse(readyCond.lastTransitionTime) < CNPG_DOWN_GRACE_MS
+  ) {
+    return null
+  }
+  // A cluster woken from hibernation or lifted from a full fence transiently
+  // shows this same shape — was-up, zero ready, Ready=False from long before —
+  // until its first instance is Ready. CNPG drops the hibernation marker at that
+  // point, so from the Cluster status alone this is indistinguishable from a real
+  // outage, and it reads down for that short window.
+  return 'down'
+}
+
 export function getCNPGClusterStatus(resource: any): StatusBadge {
   const status = resource.status || {}
   const phase = status.phase || ''
@@ -165,10 +259,19 @@ export function getCNPGClusterStatus(resource: any): StatusBadge {
   if (bucket === 'terminal') {
     return { text: getCNPGClusterDisplayState(phase), color: healthColors.unhealthy, level: 'unhealthy' }
   }
-  // Zero ready instances is a hard down that no phase excuses — including a
-  // failover, where the phase alone would otherwise downgrade a total outage to
-  // orange.
-  if (countsKnown && readyInstances === 0) {
+  // Availability outranks every phase branch except terminal. A zero-ready
+  // cluster CNPG reports by omitting readyInstances would otherwise be invisible
+  // here (countsKnown is false without the field) and fall through to the
+  // transient phase, painting amber on a total outage. Hibernation and all-fenced
+  // are deliberate not-serving states, so they read neutral rather than red.
+  const avail = getCNPGClusterAvailability(resource)
+  if (avail === 'hibernated') {
+    return { text: 'Hibernated', color: healthColors.neutral, level: 'neutral' }
+  }
+  if (avail === 'fenced') {
+    return { text: 'Fenced', color: healthColors.neutral, level: 'neutral' }
+  }
+  if (avail === 'down') {
     return { text: 'Not Ready', color: healthColors.unhealthy, level: 'unhealthy' }
   }
   if (bucket === 'failing') {
@@ -241,7 +344,20 @@ export function getCNPGClusterStatus(resource: any): StatusBadge {
 const countOrDash = (n: unknown): string => (typeof n === 'number' ? String(n) : '-')
 
 export function getCNPGClusterInstances(resource: any): string {
-  return `${countOrDash(resource.status?.readyInstances)}/${countOrDash(resource.spec?.instances)}`
+  const status = resource.status || {}
+  // Absent readyInstances resolves to 0 only for a was-up cluster (one that
+  // elected a primary): there the omitted field genuinely means zero ready, and
+  // "0/3" agrees with the "Not Ready" badge. Before a primary exists the count
+  // is truly unknown, so it stays a dash — the guard against fabricating an
+  // outage the badge denies. currentPrimary is the same was-up signal the badge
+  // gates its down verdict on, so the cell can never read 0 beside a green badge.
+  const ready =
+    typeof status.readyInstances === 'number'
+      ? status.readyInstances
+      : status.currentPrimary
+        ? 0
+        : undefined
+  return `${countOrDash(ready)}/${countOrDash(resource.spec?.instances)}`
 }
 
 export function getCNPGClusterPrimary(resource: any): string {
@@ -554,12 +670,21 @@ export function getCNPGClusterMonitoring(resource: any): {
   }
 }
 
+// CNPG carries replica-cluster state in `spec.replica`. Presence is not the
+// signal: promoting a replica to primary mutates the stanza's fields but leaves
+// it in place. This mirrors the operator's own Cluster.IsReplica() — `enabled`
+// decides when set; otherwise the cluster is a replica only while it is not the
+// designated primary of the distributed topology ((self || name) != primary).
 export function getCNPGClusterIsReplica(resource: any): boolean {
-  return !!resource.spec?.replicaCluster
+  const replica = resource.spec?.replica
+  if (!replica) return false
+  if (replica.enabled != null) return replica.enabled === true
+  const self = replica.self || resource.metadata?.name
+  return self !== replica.primary
 }
 
 export function getCNPGClusterReplicaSource(resource: any): string {
-  const replica = resource.spec?.replicaCluster
+  const replica = resource.spec?.replica
   if (!replica) return '-'
   return replica.source || replica.primary || '-'
 }

package/src/components/resources/resource-utils-gpu-ecosystem.test.ts

@@ -37,6 +37,20 @@ describe('GPU ecosystem API contracts', () => {
     expect(getKueueWorkloadStatus(workload).text).toBe('Evicted')
   })
 
+  it('distinguishes Kueue terminal failures from successful workloads', () => {
+    for (const reason of ['Failed', 'FailedToStart', 'OutOfSync', 'OwnerNotFound']) {
+      expect(getKueueWorkloadStatus({
+        status: { conditions: [{ type: 'Finished', status: 'True', reason }] },
+      })).toMatchObject({ text: reason, level: 'unhealthy' })
+    }
+
+    for (const reason of ['Succeeded', 'WorkloadSliceReplaced']) {
+      expect(getKueueWorkloadStatus({
+        status: { conditions: [{ type: 'Finished', status: 'True', reason }] },
+      })).toMatchObject({ text: 'Finished', level: 'neutral' })
+    }
+  })
+
   it('lets KubeRay conditions outrank deprecated state fields', () => {
     expect(getRayClusterStatus({
       status: {

package/src/components/resources/resource-utils-kueue.ts

@@ -3,6 +3,8 @@
 import type { StatusBadge } from './resource-utils'
 import { healthColors } from './resource-utils'
 
+const failedFinishedReasons = new Set(['Failed', 'FailedToStart', 'OutOfSync', 'OwnerNotFound'])
+
 // ============================================================================
 // SHARED HELPERS
 // ============================================================================
@@ -84,8 +86,8 @@ export function getLocalQueueAdmittedWorkloads(resource: any): string {
 export function getKueueWorkloadStatus(resource: any): StatusBadge {
   const finished = findCondition(resource, 'Finished')
   if (finished?.status === 'True') {
-    if (finished.reason === 'Failed') {
-      return { text: 'Failed', color: healthColors.unhealthy, level: 'unhealthy' }
+    if (failedFinishedReasons.has(finished.reason)) {
+      return { text: finished.reason, color: healthColors.unhealthy, level: 'unhealthy' }
     }
     return { text: 'Finished', color: healthColors.neutral, level: 'neutral' }
   }

package/src/components/resources/resource-utils-kyverno-modern.ts

@@ -472,7 +472,9 @@ export function getKyvernoMutations(resource: any): KyvernoMutation[] {
 export function getKyvernoGenerations(resource: any): string[] {
   const generate = resource?.spec?.generate
   if (!Array.isArray(generate)) return []
-  return generate.map((g: any) => g?.expression || '').filter(Boolean)
+  // Each entry declares its target as exactly one of a CEL `expression` or a
+  // YAML `template.value`; both are first-class ways to say what gets generated.
+  return generate.map((g: any) => g?.expression || g?.template?.value || '').filter(Boolean)
 }
 
 /**

package/src/components/resources/resource-utils-kyverno.ts

@@ -115,6 +115,16 @@ export function getKyvernoPolicyStatus(resource: any): StatusBadge {
   return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
 }
 
+/**
+ * Kyverno's ValidationFailureAction enum accepts the deprecated lowercase
+ * `enforce` alongside `Enforce`, and the admission controller blocks on the
+ * lowercase spelling exactly as on the capitalized one. Match case-insensitively
+ * so a legacy policy carrying the lowercase value is not read as non-blocking.
+ */
+export function isKyvernoEnforceAction(action: unknown): boolean {
+  return String(action ?? '').toLowerCase() === 'enforce'
+}
+
 /** The rule blocks whose failure an admission request can be rejected for. */
 function rejectingActions(rule: any): string[] {
   if (!rule) return []
@@ -148,14 +158,14 @@ function rejectingActions(rule: any): string[] {
 export function getKyvernoPolicyAction(resource: any): string {
   const specAction = resource.spec?.validationFailureAction
   const rules = resource.spec?.rules || []
-  if (rules.length === 0) return specAction || 'Audit'
+  if (rules.length === 0) return isKyvernoEnforceAction(specAction) ? 'Enforce' : 'Audit'
   const rejecting = rules.filter((rule: any) => rule?.validate || rule?.verifyImages)
   // Rules, but none that can reject: the spec-level action governs nothing here.
   if (rejecting.length === 0) return 'Audit'
   for (const rule of rejecting) {
     const overrides = rejectingActions(rule)
     const effective = overrides.length > 0 ? overrides : [specAction]
-    if (effective.includes('Enforce')) return 'Enforce'
+    if (effective.some(isKyvernoEnforceAction)) return 'Enforce'
   }
   return 'Audit'
 }
@@ -204,6 +214,45 @@ export function getKyvernoPolicyBackground(resource: any): boolean {
   return resource.spec?.background !== false
 }
 
+/**
+ * `spec.admission`, defaulting to true — the same reading as Kyverno's own
+ * AdmissionProcessingEnabled(). When false the policy is never registered with
+ * the admission webhook, so it rejects nothing at admission whatever its
+ * failureAction says; it can only be seen by background scans.
+ */
+export function getKyvernoPolicyAdmission(resource: any): boolean {
+  return resource.spec?.admission !== false
+}
+
+export interface KyvernoEnforcement {
+  /** Badge label. */
+  label: string
+  /** True only when a violating request is actually rejected at admission. */
+  blocks: boolean
+  /** Declared to reject, but admission is off — it enforces nothing at admission. */
+  discrepancy: boolean
+}
+
+/**
+ * What a legacy policy does at admission, not just what its failureAction field
+ * reads. An Enforce policy with admission disabled blocks nothing — presenting
+ * it as a blocking "Enforce" would tell an operator the cluster is guarded when
+ * it is not. Labels match the modern CEL family's vocabulary for the same
+ * posture: "Background only" when background scans still report violations,
+ * "Inactive" when background is disabled too and the policy does nothing.
+ */
+export function getKyvernoEnforcement(resource: any): KyvernoEnforcement {
+  const action = getKyvernoPolicyAction(resource)
+  if (action !== 'Enforce' || getKyvernoPolicyAdmission(resource)) {
+    return { label: action, blocks: action === 'Enforce', discrepancy: false }
+  }
+  return {
+    label: getKyvernoPolicyBackground(resource) ? 'Background only' : 'Inactive',
+    blocks: false,
+    discrepancy: true,
+  }
+}
+
 export function getKyvernoPolicyRuleCountByType(resource: any): {
   validate: number
   mutate: number

package/src/components/resources/resource-utils-velero.ts

@@ -306,6 +306,30 @@ export function getRestoreExcludedResources(resource: any): string[] {
   return resource.spec?.excludedResources || []
 }
 
+export function getRestoreNamespaceMapping(resource: any): Record<string, string> {
+  return resource.spec?.namespaceMapping || {}
+}
+
+export function getRestoreLabelSelector(resource: any): any {
+  return resource.spec?.labelSelector
+}
+
+export function getRestoreOrLabelSelectors(resource: any): any[] {
+  return resource.spec?.orLabelSelectors || []
+}
+
+/**
+ * A label selector only narrows a restore when it carries at least one term. An
+ * empty selector matches everything, so it must not be presented as scope: doing
+ * so would tell an operator a restore is filtered when it is not.
+ */
+export function hasLabelSelectorTerms(selector: any): boolean {
+  if (!selector || typeof selector !== 'object') return false
+  const hasLabels = selector.matchLabels && Object.keys(selector.matchLabels).length > 0
+  const hasExpressions = Array.isArray(selector.matchExpressions) && selector.matchExpressions.length > 0
+  return Boolean(hasLabels || hasExpressions)
+}
+
 export function getRestoreDuration(resource: any): string {
   const start = resource.status?.startTimestamp
   const end = resource.status?.completionTimestamp
@@ -486,6 +510,14 @@ export function getBSLLastSynced(resource: any): string {
   return formatAge(lastSynced)
 }
 
+// Why the location is unavailable, in the validation controller's own words.
+// A BackupStorageLocation carries no conditions, so status.message is the only
+// place the reason exists — without it the phase is the whole story a reader
+// gets.
+export function getBSLMessage(resource: any): string {
+  return resource.status?.message || ''
+}
+
 // ============================================================================
 // VOLUME SNAPSHOT LOCATION UTILITIES
 // ============================================================================

package/src/components/ui/SelectMenu.tsx

@@ -12,15 +12,21 @@ export function SelectMenu({
   options,
   onChange,
   ariaLabel,
+  ariaDescribedBy,
   className,
   searchPlaceholder,
+  disabled = false,
+  id,
 }: {
   value: string
   options: SelectMenuOption[]
   onChange: (value: string) => void
   ariaLabel: string
+  ariaDescribedBy?: string
   className?: string
   searchPlaceholder?: string
+  disabled?: boolean
+  id?: string
 }) {
   const [open, setOpen] = useState(false)
   const [query, setQuery] = useState('')
@@ -109,8 +115,10 @@ export function SelectMenu({
     >
       <button
         ref={triggerRef}
+        id={id}
         type="button"
         aria-label={ariaLabel}
+        aria-describedby={ariaDescribedBy}
         aria-haspopup="listbox"
         aria-expanded={open}
         aria-controls={open ? listboxId : undefined}
@@ -125,7 +133,8 @@ export function SelectMenu({
           }
           setOpen(!open)
         }}
-        className="flex h-8 w-full items-center justify-between gap-2 rounded-md border border-theme-border bg-theme-elevated px-2.5 text-xs text-theme-text-primary transition-colors hover:bg-theme-hover"
+        disabled={disabled}
+        className="flex h-8 w-full items-center justify-between gap-2 rounded-md border border-theme-border bg-theme-elevated px-2.5 text-xs text-theme-text-primary transition-colors hover:bg-theme-hover disabled:cursor-not-allowed disabled:opacity-60 disabled:hover:bg-theme-elevated"
       >
         <span className="truncate">{selected?.label}</span>
         <ChevronDown className={clsx('h-3.5 w-3.5 shrink-0 text-theme-text-tertiary transition-transform', open && 'rotate-180')} />