@skyhook-io/k8s-ui 1.13.4 → 1.14.1

package/src/components/resources/column-header-width.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from 'vitest'
+import { getColumnMinWidth, type Column } from './ResourcesView'
+
+// The header row is px-4 with a `truncate` label, under table-layout:fixed with
+// explicit <col> widths. A column narrower than its own heading clips to
+// "ADDRESS T…" and — because only the Name column flexes — stays clipped at
+// 1280, 1920 and 2560 alike. These pin the floor that stops that.
+//
+// Reference measurements taken in the browser against the real header font
+// (DM Sans 500, 12px, uppercase, tracking-wide), on kind-radar-kyverno-demo:
+//   RECLAIM       52.7px  ADDRESSES     69.6px
+//   EXPANSION     67.5px  ADDRESS TYPE  87.7px
+const MEASURED = {
+  Reclaim: 52.7,
+  Expansion: 67.5,
+  Addresses: 69.6,
+  'Address Type': 87.7,
+}
+
+const col = (over: Partial<Column> & Pick<Column, 'key' | 'label'>): Column => over
+
+describe('getColumnMinWidth header floor', () => {
+  it.each(Object.entries(MEASURED))(
+    'reserves at least the measured width of %s plus padding',
+    (label, measuredPx) => {
+      const got = getColumnMinWidth(col({ key: 'x', label, width: 'w-16' }))
+      // 32px is the px-4 on both sides; the estimate must never land under the
+      // width the browser actually renders, or the label clips again.
+      expect(got).toBeGreaterThanOrEqual(Math.ceil(measuredPx + 32))
+    },
+  )
+
+  it('leaves a column that already fits its label untouched', () => {
+    // "Age" needs ~25px + 32 padding + 20 for its sort icon = well under w-24.
+    expect(getColumnMinWidth(col({ key: 'age', label: 'Age', width: 'w-24' }))).toBe(96)
+  })
+
+  it('raises a column that is narrower than its label', () => {
+    // w-20 is 80px; "Address Type" cannot fit in 80 - 32 = 48px.
+    expect(getColumnMinWidth(col({ key: 'addressType', label: 'Address Type', width: 'w-20' })))
+      .toBeGreaterThan(80)
+  })
+
+  it('reserves extra room for the sort icon on sortable columns', () => {
+    const sortable = getColumnMinWidth(col({ key: 'status', label: 'Wide Label Here', width: 'w-16' }))
+    const plain = getColumnMinWidth(col({ key: 'notSortable', label: 'Wide Label Here', width: 'w-16' }))
+    expect(sortable).toBeGreaterThan(plain)
+  })
+
+  it('still honours an explicit minWidth override', () => {
+    expect(getColumnMinWidth(col({ key: 'x', label: 'Address Type', width: 'w-20', minWidth: 300 }))).toBe(300)
+  })
+
+  it('keeps the flexible Name column at its wider default', () => {
+    expect(getColumnMinWidth(col({ key: 'name', label: 'Name' }))).toBe(200)
+  })
+
+  // Printer columns (uncurated CRDs) and host-injected custom columns are
+  // sortable via their own getSortValue, not by being in the built-in key list —
+  // the header renders a sort icon for them, so the floor has to reserve it.
+  it('reserves the sort icon for a printer/custom column that carries getSortValue', () => {
+    const c = col({ key: 'printer:Phase', label: 'Reconcile Phase', width: 'w-24' })
+    const extras = new Map([[c.key, { ...c, render: () => null, getSortValue: () => '' }]]) as any
+    expect(getColumnMinWidth(c, extras)).toBeGreaterThan(getColumnMinWidth(c))
+  })
+
+  it('caps the floor so one long vendor label cannot size a column off screen', () => {
+    const monstrous = 'A'.repeat(200)
+    expect(getColumnMinWidth(col({ key: 'printer:x', label: monstrous, width: 'w-24' }))).toBe(320)
+  })
+
+  it('never returns less than the declared width, even past the cap', () => {
+    expect(getColumnMinWidth(col({ key: 'printer:x', label: 'A'.repeat(200), width: 'w-96' }))).toBe(384)
+  })
+})

package/src/components/resources/kyverno-legacy-action.test.ts

@@ -1,5 +1,9 @@
 import { describe, it, expect } from 'vitest'
-import { getKyvernoPolicyAction } from './resource-utils-kyverno'
+import {
+  getKyvernoPolicyAction,
+  getKyvernoPolicyAdmission,
+  getKyvernoEnforcement,
+} from './resource-utils-kyverno'
 
 function cpol(spec: any) {
   return { apiVersion: 'kyverno.io/v1', kind: 'ClusterPolicy', metadata: { name: 'p' }, spec }
@@ -95,4 +99,99 @@ describe('getKyvernoPolicyAction', () => {
     expect(getKyvernoPolicyAction(cpol({ rules: [{ name: 'r', validate: {} }] }))).toBe('Audit')
     expect(getKyvernoPolicyAction(cpol({}))).toBe('Audit')
   })
+
+  // Kyverno's ValidationFailureAction enum accepts the deprecated lowercase
+  // `enforce`/`audit` alongside the capitalized spelling, and the admission
+  // controller blocks on lowercase `enforce` exactly as on `Enforce`. A legacy
+  // policy carrying the lowercase value must not read as non-blocking.
+  it('treats a lowercase spec-level enforce as Enforce (no rules)', () => {
+    expect(getKyvernoPolicyAction(cpol({ validationFailureAction: 'enforce' }))).toBe('Enforce')
+  })
+
+  it('treats a lowercase spec-level enforce inherited by a validating rule as Enforce', () => {
+    expect(
+      getKyvernoPolicyAction(
+        cpol({
+          validationFailureAction: 'enforce',
+          rules: [{ name: 'v', validate: { pattern: {} } }],
+        }),
+      ),
+    ).toBe('Enforce')
+  })
+
+  it('canonicalizes a lowercase spec-level audit to Audit', () => {
+    expect(getKyvernoPolicyAction(cpol({ validationFailureAction: 'audit' }))).toBe('Audit')
+    expect(
+      getKyvernoPolicyAction(
+        cpol({
+          validationFailureAction: 'audit',
+          rules: [{ name: 'v', validate: { pattern: {} } }],
+        }),
+      ),
+    ).toBe('Audit')
+  })
+
+  // A per-rule failureAction is capitalized-only per its CRD enum, but matching
+  // case-insensitively there too keeps a single rule for reading the field.
+  it('treats a lowercase per-rule failureAction override as Enforce', () => {
+    expect(
+      getKyvernoPolicyAction(
+        cpol({
+          validationFailureAction: 'Audit',
+          rules: [{ name: 'r', validate: { failureAction: 'enforce' } }],
+        }),
+      ),
+    ).toBe('Enforce')
+  })
+})
+
+/**
+ * `spec.admission: false` leaves a legacy policy out of the admission webhook,
+ * so it rejects nothing whatever its failureAction. Confirmed against Kyverno's
+ * own AdmissionProcessingEnabled(): nil defaults to true.
+ */
+describe('getKyvernoPolicyAdmission', () => {
+  it('defaults to true when the field is absent', () => {
+    expect(getKyvernoPolicyAdmission(cpol({}))).toBe(true)
+    expect(getKyvernoPolicyAdmission(cpol({ admission: true }))).toBe(true)
+  })
+
+  it('is false only when explicitly disabled', () => {
+    expect(getKyvernoPolicyAdmission(cpol({ admission: false }))).toBe(false)
+  })
+})
+
+describe('getKyvernoEnforcement', () => {
+  const enforcing = { validationFailureAction: 'Enforce', rules: [{ name: 'r', validate: { pattern: {} } }] }
+
+  it('blocks when admission is enabled (default) and the policy enforces', () => {
+    expect(getKyvernoEnforcement(cpol(enforcing))).toEqual({
+      label: 'Enforce',
+      blocks: true,
+      discrepancy: false,
+    })
+  })
+
+  it('does not block an Enforce policy whose admission is disabled', () => {
+    const e = getKyvernoEnforcement(cpol({ ...enforcing, admission: false }))
+    expect(e.blocks).toBe(false)
+    expect(e.discrepancy).toBe(true)
+    // Same label the modern CEL family uses for this posture.
+    expect(e.label).toBe('Background only')
+  })
+
+  it('reports a policy inactive when both admission and background are off', () => {
+    const e = getKyvernoEnforcement(cpol({ ...enforcing, admission: false, background: false }))
+    expect(e.blocks).toBe(false)
+    expect(e.label).toBe('Inactive')
+  })
+
+  it('leaves an Audit policy unchanged when admission is disabled', () => {
+    const e = getKyvernoEnforcement(cpol({
+      validationFailureAction: 'Audit',
+      admission: false,
+      rules: [{ name: 'r', validate: { pattern: {} } }],
+    }))
+    expect(e).toEqual({ label: 'Audit', blocks: false, discrepancy: false })
+  })
 })

package/src/components/resources/kyverno-modern-posture.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from 'vitest'
 import {
   getKyvernoEnforcementPosture,
+  getKyvernoGenerations,
   getKyvernoPolicyFamily,
   getKyvernoValidationActions,
   getKyvernoMatchSummary,
@@ -288,3 +289,38 @@ describe('match summary', () => {
     expect(getKyvernoMatchSummary(vpol({}))).toBe('-')
   })
 })
+
+// A GeneratingPolicy declares each generated target as exactly one of an
+// `expression` (CEL returning the resources) or a `template` (a YAML document,
+// optionally CEL-interpolated). Both are first-class; the "Generates" count and
+// list must see either form.
+describe('generation targets', () => {
+  it('counts expression-form generations', () => {
+    const gen = getKyvernoGenerations(vpol({ generate: [{ expression: 'generator.Apply(ns, [cm])' }] }))
+    expect(gen).toEqual(['generator.Apply(ns, [cm])'])
+  })
+
+  it('counts template-form generations', () => {
+    const value = 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: cfg\n'
+    const gen = getKyvernoGenerations(vpol({ generate: [{ template: { interpolate: 'none', value } }] }))
+    expect(gen).toHaveLength(1)
+    expect(gen[0]).toContain('ConfigMap')
+  })
+
+  it('counts a mix of expression and template forms', () => {
+    const gen = getKyvernoGenerations(
+      vpol({
+        generate: [
+          { expression: 'generator.Apply(ns, [cm])' },
+          { template: { value: 'kind: NetworkPolicy\n' } },
+        ],
+      }),
+    )
+    expect(gen).toHaveLength(2)
+  })
+
+  it('returns nothing for an empty or absent generate block', () => {
+    expect(getKyvernoGenerations(vpol({ generate: [] }))).toEqual([])
+    expect(getKyvernoGenerations(vpol({}))).toEqual([])
+  })
+})

package/src/components/resources/renderers/CNPGBackupRenderer.test.tsx

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { CNPGBackupRenderer } from './CNPGBackupRenderer'
+
+const backup = (extra: any = {}) => ({
+  apiVersion: 'postgresql.cnpg.io/v1',
+  kind: 'Backup',
+  metadata: { name: 'pg-backup', namespace: 'db' },
+  spec: { cluster: { name: 'pg' }, ...extra.spec },
+  status: { phase: 'completed', ...extra.status },
+})
+
+const html = (resource: any) => renderToString(<CNPGBackupRenderer data={resource} />)
+
+describe('CNPGBackupRenderer — spec.target is instance selection, not a restore destination', () => {
+  it('labels spec.target as the instance the backup runs on, not a recovery target', () => {
+    // Backup.spec.target is `primary` | `prefer-standby`: the policy for which
+    // instance role performs the backup. "Recovery Target" would read as a
+    // PITR restore destination, which this field is not.
+    const out = html(backup({ spec: { target: 'prefer-standby' } }))
+    expect(out).toContain('prefer-standby')
+    expect(out).toContain('Backup Target')
+    expect(out).not.toContain('Recovery Target')
+  })
+
+  it('omits the target section entirely when spec.target is unset', () => {
+    expect(html(backup())).not.toContain('Backup Target')
+  })
+})

package/src/components/resources/renderers/CNPGBackupRenderer.tsx

@@ -127,11 +127,12 @@ export function CNPGBackupRenderer({ data, onNavigate }: CNPGBackupRendererProps
         </Section>
       )}
 
-      {/* Target - for PITR backups */}
+      {/* spec.target is the policy for which instance runs the backup
+          (primary / prefer-standby); it is not a restore destination. */}
       {target !== '-' && (
         <Section title="Target" defaultExpanded>
           <PropertyList>
-            <Property label="Recovery Target" value={target} />
+            <Property label="Backup Target" value={target} />
           </PropertyList>
         </Section>
       )}

package/src/components/resources/renderers/CNPGClusterRenderer.test.tsx

@@ -39,9 +39,33 @@ describe('CNPGClusterRenderer — the drawer must not contradict the badge', ()
     expect(html(settled)).toContain('Degraded Cluster')
   })
 
-  it('still raises Cluster Down at zero ready, whatever the phase', () => {
-    // No phase excuses a database with nothing serving.
-    expect(html(cluster('Upgrading cluster', 0))).toContain('Cluster Down')
+  it('still raises Cluster Down for a was-up cluster at zero ready, whatever the phase', () => {
+    // No phase excuses a database that was serving and now has nothing ready.
+    // readyInstances is OMITTED — the shape CNPG actually emits for zero ready —
+    // and currentPrimary is the "was up" signal that tells this apart from a
+    // first bootstrap.
+    const wasUpDown = {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      kind: 'Cluster',
+      metadata: { name: 'pg', namespace: 'db' },
+      spec: { instances: 3 },
+      status: { phase: 'Upgrading cluster', currentPrimary: 'pg-1' },
+    }
+    expect(html(wasUpDown)).toContain('Cluster Down')
+  })
+
+  it('does not raise Cluster Down for a bootstrapping cluster with no primary yet', () => {
+    // Reported (phase) but no primary elected and readyInstances omitted — the
+    // shape a fresh cluster emits. A red banner here is the false alarm the
+    // availability verdict exists to prevent.
+    const bootstrapping = {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      kind: 'Cluster',
+      metadata: { name: 'pg', namespace: 'db' },
+      spec: { instances: 3 },
+      status: { phase: 'Setting up primary' },
+    }
+    expect(html(bootstrapping)).not.toContain('Cluster Down')
   })
 
   it('renders a failed last backup at the same tier as the badge and detector', () => {
@@ -116,3 +140,45 @@ describe('recovery points must be readable as ages, not raw machine timestamps',
     expect(html).toContain('2026-01-30 09:40:37 UTC')
   })
 })
+
+describe('CNPGClusterRenderer — the replica-cluster role tracks live state, not stanza presence', () => {
+  const withReplica = (replica: any, name = 'pg-eu') => ({
+    apiVersion: 'postgresql.cnpg.io/v1',
+    kind: 'Cluster',
+    metadata: { name, namespace: 'db' },
+    spec: { instances: 3, replica },
+    status: { phase: 'Cluster in healthy state', readyInstances: 3 },
+  })
+
+  it('shows the Replica Cluster section for a genuine replica (replica mode enabled)', () => {
+    const out = renderToString(<CNPGClusterRenderer data={withReplica({ source: 'pg-us', enabled: true })} />)
+    expect(out).toContain('Replica Cluster')
+    expect(out).toContain('Role')
+    expect(out).toContain('pg-us')
+  })
+
+  it('shows Replica for a distributed-topology cluster whose primary is elsewhere', () => {
+    const out = renderToString(
+      <CNPGClusterRenderer data={withReplica({ source: 'pg-us', primary: 'pg-us', self: 'pg-eu' })} />,
+    )
+    expect(out).toContain('Replica Cluster')
+  })
+
+  it('drops the Replica label once a distributed replica is promoted, though the stanza remains', () => {
+    // Promotion sets replica.primary to this cluster; the stanza is not removed.
+    const out = renderToString(
+      <CNPGClusterRenderer data={withReplica({ source: 'pg-us', primary: 'pg-eu', self: 'pg-eu' })} />,
+    )
+    expect(out).not.toContain('Replica Cluster')
+  })
+
+  it('drops the Replica label once a standalone replica is promoted (replica.enabled off)', () => {
+    const out = renderToString(<CNPGClusterRenderer data={withReplica({ source: 'pg-us', enabled: false })} />)
+    expect(out).not.toContain('Replica Cluster')
+  })
+
+  it('a normal standalone cluster shows no Replica Cluster section', () => {
+    const out = renderToString(<CNPGClusterRenderer data={cluster('Cluster in healthy state', 3)} />)
+    expect(out).not.toContain('Replica Cluster')
+  })
+})

package/src/components/resources/renderers/CNPGClusterRenderer.tsx

@@ -23,6 +23,7 @@ import {
   getCNPGWALArchivingFailure,
   getCNPGLastBackupFailure,
   classifyCNPGClusterPhase,
+  getCNPGClusterAvailability,
   CNPG_BARMAN_OBJECTSTORE_GROUP,
 } from '../resource-utils-cnpg'
 import { formatAge } from '../resource-utils'
@@ -79,8 +80,11 @@ export function CNPGClusterRenderer({ data, onNavigate, declared}: CNPGClusterRe
   const lastBackupFailure = getCNPGLastBackupFailure(data)
   const phaseBucket = classifyCNPGClusterPhase(phase)
 
-  // Problem detection
-  const isDown = countsKnown && readyInstances === 0
+  // Problem detection. isDown reuses the badge's availability verdict so the
+  // three surfaces agree: a fully-down cluster CNPG reports by omitting
+  // readyInstances (countsKnown false) is unreachable through the raw counts,
+  // and hibernation / all-fenced are deliberate not-serving states, not outages.
+  const isDown = getCNPGClusterAvailability(data) === 'down'
   // A shortfall the PHASE already explains is not a separate problem. Mirrors
   // source_cnpg.go's phaseExplained gate and the badge's ordering, both of
   // which check the phase before the instance counts: mid-switchover or waiting

package/src/components/resources/renderers/KyvernoPolicyReportRenderer.tsx

@@ -8,7 +8,8 @@ import {
   getPolicyReportResults,
   getPolicyReportScope,
   getPolicyReportSource,
-  getKyvernoPolicyAction,
+  getKyvernoEnforcement,
+  getKyvernoPolicyAdmission,
   getKyvernoPolicyRuleCount,
   getKyvernoPolicyBackground,
   getKyvernoPolicyRules,
@@ -246,15 +247,14 @@ export function KyvernoPolicyRenderer({ data, coverage, queued }: KyvernoPolicyR
   const spec = data.spec || {}
   const status = data.status || {}
   const conditions = status.conditions || []
-  const action = getKyvernoPolicyAction(data)
+  const enforcement = getKyvernoEnforcement(data)
+  const admission = getKyvernoPolicyAdmission(data)
   const ruleCount = getKyvernoPolicyRuleCount(data)
   const background = getKyvernoPolicyBackground(data)
   const rules = getKyvernoPolicyRules(data)
   const ruleCountByType = getKyvernoPolicyRuleCountByType(data)
   const autogenRules = getKyvernoPolicyAutogenRules(data)
 
-  const isEnforce = action === 'Enforce'
-
   return (
     <>
       {coverage}
@@ -269,15 +269,20 @@ export function KyvernoPolicyRenderer({ data, coverage, queued }: KyvernoPolicyR
               writing to the cluster. status.rulecount is Kyverno's own count,
               so this is checkable rather than guessed. */}
           {(ruleCountByType.validate > 0 || ruleCountByType.verifyImages > 0) && (
-          <Property label="Failure Action" value={
+          <Property label="Enforcement" value={
             <span className={clsx(
               'badge',
-              isEnforce ? 'bg-red-500/20 text-red-400' : 'bg-yellow-500/20 text-yellow-400',
+              enforcement.blocks
+                ? 'bg-red-500/20 text-red-400'
+                : enforcement.discrepancy
+                  ? 'bg-orange-500/20 text-orange-400'
+                  : 'bg-yellow-500/20 text-yellow-400',
             )}>
-              {action}
+              {enforcement.label}
             </span>
           } />
           )}
+          <Property label="Admission" value={admission ? 'Enabled' : 'Disabled'} />
           <Property label="Background" value={background ? 'Enabled' : 'Disabled'} />
           {spec.webhookTimeoutSeconds && (
             <Property label="Webhook Timeout" value={`${spec.webhookTimeoutSeconds}s`} />

package/src/components/resources/renderers/PolicyCoverageSection.test.tsx

@@ -4,7 +4,7 @@ import { PolicyCoverageSection } from './PolicyCoverageSection'
 import type { PolicyCoverageResponse, PolicyCoverageRule, PolicyCoverageSubject } from '../../../types/policy'
 
 const vpol = (spec: any = {}) => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'ValidatingPolicy', spec })
-const mpol = () => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'MutatingPolicy', spec: {} })
+const mpol = (spec: any = {}) => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'MutatingPolicy', spec })
 const legacy = (spec: any) => ({ apiVersion: 'kyverno.io/v1', kind: 'ClusterPolicy', spec })
 
 const counts = (c: Partial<PolicyCoverageResponse['counts']> = {}) =>
@@ -82,6 +82,97 @@ describe('what the section says a policy did', () => {
     expect(html).not.toContain('Generated')
   })
 
+  // A legacy Enforce policy with `spec.admission: false` is left out of the
+  // admission webhook, so it rejects nothing — the consequence sentence must not
+  // promise a rejection it cannot make.
+  it('does not promise rejection when admission evaluation is disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      legacy({ validationFailureAction: 'Enforce', admission: false,
+        rules: [{ name: 'r', validate: { pattern: {} } }] }),
+    )
+    expect(html).toContain('Nothing is rejected today')
+    expect(html).not.toContain('will be rejected')
+  })
+
+  // The policy already declares Enforce, so the remediation is to re-enable
+  // admission — not to "switch this policy to block", which would point at the
+  // wrong knob.
+  it('names admission, not the action, as the reason nothing is rejected', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      legacy({ validationFailureAction: 'Enforce', admission: false,
+        rules: [{ name: 'r', validate: { pattern: {} } }] }),
+    )
+    expect(html).toContain('admission is disabled for this policy')
+    expect(html).toContain('Enabling admission would reject the next update')
+    expect(html).not.toContain('Switching this policy to block')
+  })
+
+  // The modern CEL family reaches the same non-blocking state via
+  // `spec.evaluation.admission.enabled: false`, and the shared sentence must be
+  // honest there too.
+  it('names admission for a modern Deny policy with admission disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      vpol({ validationActions: ['Deny'], evaluation: { admission: { enabled: false } } }),
+    )
+    expect(html).toContain('admission is disabled for this policy')
+    expect(html).not.toContain('Switching this policy to block')
+  })
+
+  // A JSON-mode policy is evaluated against payloads outside the cluster and
+  // never joins admission. Both phrasings would be false: it rejects nothing
+  // today, and neither switching the action nor enabling admission changes
+  // that. The sentence is withheld rather than guessed at.
+  it('states no admission consequence for a JSON-mode policy', () => {
+    const failing = coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+      rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] })
+
+    const admissionOff = render(failing, vpol({
+      validationActions: ['Deny'],
+      evaluation: { mode: 'JSON', admission: { enabled: false } },
+    }))
+    expect(admissionOff).not.toContain('admission is disabled for this policy')
+    expect(admissionOff).not.toContain('Switching this policy to block')
+
+    // Same for JSON mode with admission left at its default.
+    const admissionDefault = render(failing, vpol({
+      validationActions: ['Deny'],
+      evaluation: { mode: 'JSON' },
+    }))
+    expect(admissionDefault).not.toContain('Switching this policy to block')
+    expect(admissionDefault).not.toContain('will be rejected')
+  })
+
+  // `getKyvernoValidationActions` applies Kyverno's absent-means-Deny default,
+  // which is right for the validating families and wrong for every other kind.
+  // A mutating policy with admission off must not be described as a policy that
+  // would reject once admission is re-enabled.
+  it('does not read a Deny default off a mutating policy with admission disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      mpol({ evaluation: { admission: { enabled: false } } }),
+    )
+    expect(html).not.toContain('admission is disabled for this policy')
+  })
+
+  // An Audit policy genuinely never blocks, so its remediation IS to switch the
+  // action — the admission-off wording must not leak onto it.
+  it('still offers to switch the action for an audit policy', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      vpol({ validationActions: ['Audit'] }),
+    )
+    expect(html).toContain('Switching this policy to block')
+    expect(html).not.toContain('admission is disabled')
+  })
+
   it('withholds the consequence when the policy’s rules disagree on blocking', () => {
     const html = render(
       coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),