@skyhook-io/k8s-ui 1.13.4 → 1.14.1

package/src/components/resources/renderers/PolicyCoverageSection.tsx

@@ -11,9 +11,17 @@ import {
   getKyvernoEnforcementPosture,
   getKyvernoResourceRules,
   getKyvernoEffectiveFailurePolicy,
+  getKyvernoValidationActions,
+  getKyvernoEvaluationMode,
+  isKyvernoAdmissionEnabled,
   type KyvernoPolicyFamily,
 } from '../resource-utils-kyverno-modern'
-import { getKyvernoPolicyAction } from '../resource-utils-kyverno'
+import {
+  getKyvernoEnforcement,
+  getKyvernoPolicyAction,
+  getKyvernoPolicyAdmission,
+  isKyvernoEnforceAction,
+} from '../resource-utils-kyverno'
 import type {
   PolicyCoverageResponse,
   PolicyCoverageRule,
@@ -160,7 +168,7 @@ function legacyActionsAgree(resource: any): boolean {
           : []),
       ].filter(Boolean)
       const effective = declared.length > 0 ? declared : [spec]
-      return effective.includes('Enforce')
+      return effective.some(isKyvernoEnforceAction)
     })
   return answers.every((a: boolean) => a === answers[0])
 }
@@ -229,17 +237,40 @@ function policyFamilyFor(
 
 /**
  * The families answer from different fields: legacy carries
- * `spec.validationFailureAction` (or a per-rule `validate.failureAction`), while
- * `getKyvernoEnforcementPosture` reads `spec.validationActions`, absent on
- * legacy — which makes an Enforce policy read as audit-only.
+ * `spec.validationFailureAction` (or a per-rule `validate.failureAction`) gated
+ * by `spec.admission`, while `getKyvernoEnforcementPosture` reads
+ * `spec.validationActions` and `spec.evaluation.admission.enabled`, both absent
+ * on legacy — which makes an Enforce policy read as audit-only.
  */
 function blocksAdmission(resource: any, family: KyvernoPolicyFamily | undefined): boolean {
   if (isLegacyKyvernoPolicy(resource)) {
-    return getKyvernoPolicyAction(resource) === 'Enforce'
+    return getKyvernoEnforcement(resource).blocks
   }
   return getKyvernoEnforcementPosture(resource, family).blocks
 }
 
+/**
+ * A policy declares a rejecting action yet does not block, because admission
+ * evaluation is switched off. The distinction changes the remediation the
+ * consequence sentence offers — re-enable admission, not switch the action —
+ * so it must not be conflated with an audit policy that simply never blocks.
+ *
+ * Only the validating families carry `validationActions`, and
+ * `getKyvernoValidationActions` applies Kyverno's absent-means-Deny default,
+ * so asking a mutating or generating policy would read Deny off a field that
+ * kind never has. The same guard `getKyvernoEnforcementPosture` uses.
+ */
+function declaresBlockingButAdmissionOff(
+  resource: any,
+  family: KyvernoPolicyFamily | undefined,
+): boolean {
+  if (isLegacyKyvernoPolicy(resource)) {
+    return getKyvernoPolicyAction(resource) === 'Enforce' && !getKyvernoPolicyAdmission(resource)
+  }
+  if (family !== 'validating' && family !== 'imageValidating') return false
+  return getKyvernoValidationActions(resource).includes('Deny') && !isKyvernoAdmissionEnabled(resource)
+}
+
 /**
  * Whether the consequence sentence can be stated at all.
  *
@@ -250,6 +281,11 @@ function blocksAdmission(resource: any, family: KyvernoPolicyFamily | undefined)
  */
 function canStateConsequence(resource: any, family: KyvernoPolicyFamily | undefined): boolean {
   if (!isLegacyKyvernoPolicy(resource)) {
+    // A JSON-mode policy is evaluated against payloads outside the cluster and
+    // never joins admission, so every phrasing of the sentence is false: it
+    // rejects nothing today, and neither switching the action nor enabling
+    // admission would change that. The posture badge already says "JSON mode".
+    if (getKyvernoEvaluationMode(resource) === 'JSON') return false
     return family === 'validating' || family === 'imageValidating' || family === undefined
   }
   const rules: any[] = resource?.spec?.rules ?? []
@@ -273,6 +309,7 @@ function enforcementConsequence(
   failing: number,
   blocks: boolean,
   matchesUpdate: boolean,
+  admissionOff = false,
 ): string {
   // Deliberately kind-neutral. A policy can match ConfigMaps, Secrets or
   // ClusterRoles as readily as Pods, and none of those "run" — the fact being
@@ -288,11 +325,24 @@ function enforcementConsequence(
       : `${exists} and ${one ? 'stays' : 'stay'} as ${itIs} — this policy only checks creation, so ${itIs} rejected only if recreated.`
   }
 
+  const target = one ? 'this resource' : `any of these ${failing}`
+
+  // The policy already declares a rejecting action; it does not block only
+  // because admission evaluation is disabled. Telling the operator to change
+  // the action would point at the wrong knob — the fix is to re-enable
+  // admission.
+  if (admissionOff) {
+    return matchesUpdate
+      ? `Nothing is rejected today because admission is disabled for this policy. Enabling admission would reject the next update to ${target}.`
+      : `Nothing is rejected today because admission is disabled for this policy. Enabling admission would leave ${
+          one ? 'this resource as it is' : `these ${failing} as they are`
+        } — only newly created resources would be rejected.`
+  }
+
   // "Set to enforce" is the legacy family's vocabulary; the modern API spells
   // the same thing `validationActions: [Deny]`, and the posture badge above
   // already says "Deny". Describing the behaviour rather than the field keeps
   // one sentence correct for both.
-  const target = one ? 'this resource' : `any of these ${failing}`
   return matchesUpdate
     ? `Nothing is rejected today. Switching this policy to block would reject the next update to ${target}.`
     : `Nothing is rejected today. Switching this policy to block would leave ${
@@ -469,8 +519,14 @@ function Consequence({
   const failing = data.subjectsFailing ?? data.counts.fail
 
   if (failing > 0 && canStateConsequence(resource, family)) {
+    const blocks = blocksAdmission(resource, family)
     lines.push(
-      enforcementConsequence(failing, blocksAdmission(resource, family), matchesUpdates(resource)),
+      enforcementConsequence(
+        failing,
+        blocks,
+        matchesUpdates(resource),
+        !blocks && declaresBlockingButAdmissionOff(resource, family),
+      ),
     )
   }
 

package/src/components/resources/renderers/VeleroBSLRenderer.test.tsx

@@ -176,6 +176,53 @@ describe('what a storage location holds', () => {
   })
 })
 
+/**
+ * Velero writes why a location is unavailable into `status.message`, and the
+ * BSL object carries no conditions, so that field is the only place the reason
+ * exists. A page opened from an unavailable-location problem has to show it -
+ * the same way the sibling BackupRepository renderer leads with its own reason.
+ */
+describe('an unavailable location Velero gave a reason for', () => {
+  const bslMsg = (phase: string, message?: string) => ({
+    metadata: { name: 'dr-replica', namespace: 'velero' },
+    spec: { provider: 'aws', objectStorage: { bucket: 'dr' } },
+    status: { phase, ...(message !== undefined ? { message } : {}) },
+  })
+
+  it('leads with the reason Velero gave', () => {
+    const html = renderToString(
+      <VeleroBSLRenderer
+        data={bslMsg('Unavailable', 'BackupStorageLocation is invalid: rpc error: code = Unknown desc = NoSuchBucket')}
+      />,
+    )
+    expect(html).toContain('NoSuchBucket')
+  })
+
+  // Velero can set Unavailable with no message. Saying nothing would leave a red
+  // badge and no consequence, so the page states what unavailable costs.
+  it('names the consequence when Velero gave no reason', () => {
+    const html = renderToString(<VeleroBSLRenderer data={bslMsg('Unavailable')} />)
+    expect(html).toContain('cannot be written')
+  })
+
+  it('says nothing alarming when the location is available', () => {
+    const html = renderToString(
+      <VeleroBSLRenderer data={bslMsg('Available', 'stale message left on the object')} />,
+    )
+    expect(html).not.toContain('Storage Location Unavailable')
+    expect(html).not.toContain('stale message left on the object')
+    expect(html).not.toContain('cannot be written')
+  })
+
+  // A location Velero has not validated yet has no phase. It is not unavailable,
+  // so it gets no alarm even if a message lingers from a prior state.
+  it('raises no alarm on a location Velero has not reported on', () => {
+    const html = renderToString(<VeleroBSLRenderer data={bslMsg('', 'old message')} />)
+    expect(html).not.toContain('Storage Location Unavailable')
+    expect(html).not.toContain('old message')
+  })
+})
+
 /**
  * The list counts what is stored; the restorable point is derived from what
  * completed. On a healthy location those are the only two numbers on the page,

package/src/components/resources/renderers/VeleroBSLRenderer.tsx

@@ -1,5 +1,5 @@
 import { HardDrive, Clock, Archive } from 'lucide-react'
-import { Section, PropertyList, Property, ConditionsSection, RelationshipGroup } from '../../ui/drawer-components'
+import { Section, PropertyList, Property, ConditionsSection, RelationshipGroup, AlertBanner } from '../../ui/drawer-components'
 import { TimeValue } from '../../ui/ScheduleValue'
 import {
   getBSLStatus,
@@ -11,6 +11,7 @@ import {
   getBSLAccessMode,
   getBSLLastValidation,
   getBSLLastSynced,
+  getBSLMessage,
 } from '../resource-utils-velero'
 import { VeleroPhaseValue } from './velero-cells'
 
@@ -66,6 +67,7 @@ export function VeleroBSLRenderer({ data, storedBackups, storedTotal, restorable
   const status = data.status || {}
   const conditions = status.conditions || []
   const bslStatus = getBSLStatus(data)
+  const message = getBSLMessage(data)
   const config = data.spec?.config || {}
   // Two things falsify "restorable", and the phase sees neither. A backup that
   // did complete is still not something to go back to once its TTL has passed —
@@ -90,6 +92,19 @@ export function VeleroBSLRenderer({ data, storedBackups, storedTotal, restorable
 
   return (
     <>
+      {/* The reason, not just the state. An unavailable location means Velero's
+          last validation of the bucket failed, and status.message is the only
+          place that reason exists — the object carries no conditions. */}
+      {bslStatus.level === 'unhealthy' && (
+        <AlertBanner
+          variant="error"
+          title="Storage Location Unavailable"
+          message={message
+            ? message
+            : 'Velero reported this location as unavailable and gave no reason. New backups cannot be written here, and backups already stored here cannot be restored from, while it stays that way.'}
+        />
+      )}
+
       {/* Status section */}
       <Section title="Status" icon={Clock} defaultExpanded>
         <PropertyList>

package/src/components/resources/renderers/VeleroRestoreRenderer.test.tsx

@@ -8,6 +8,12 @@ const restore = (status: Record<string, unknown>) => ({
   status,
 })
 
+const scopedRestore = (spec: Record<string, unknown>) => ({
+  metadata: { name: 'live-restore', namespace: 'velero' },
+  spec: { backupName: 'live-completed', ...spec },
+  status: { phase: 'Completed' },
+})
+
 /**
  * The restore side carries the same claims as the backup side and its own
  * wording for them, so pinning one does not pin the other. Both banners below
@@ -53,3 +59,85 @@ describe('what a restore claims about itself', () => {
     expect(html).toContain('Backup live-completed not found')
   })
 })
+
+/**
+ * Scope is where an operator reads what a restore will touch and where it lands.
+ * namespaceMapping remaps source namespaces to different targets on restore, so
+ * omitting it hides where the data actually goes; a labelSelector narrows the
+ * restore to a subset of objects.
+ */
+// react-dom/server inserts <!-- --> markers between adjacent text nodes, which
+// splits a badge like `app=nginx` in the raw markup; strip them so assertions
+// read the visible text.
+const renderScope = (data: unknown) =>
+  renderToString(<VeleroRestoreRenderer data={data} />).replace(/<!-- -->/g, '')
+
+describe('what a restore says it will touch', () => {
+  it('shows namespaceMapping as source to target', () => {
+    const html = renderScope(
+      scopedRestore({ namespaceMapping: { prod: 'prod-clone', staging: 'staging-clone' } }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('Namespace Mapping')
+    expect(html).toContain('prod')
+    expect(html).toContain('prod-clone')
+    expect(html).toContain('staging-clone')
+  })
+
+  it('shows the label selector that narrows the restore', () => {
+    const html = renderScope(
+      scopedRestore({
+        labelSelector: {
+          matchLabels: { app: 'nginx' },
+          matchExpressions: [{ key: 'tier', operator: 'In', values: ['frontend'] }],
+        },
+      }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+    expect(html).toContain('tier In frontend')
+  })
+
+  it('renders a Scope section for a restore filtered only by label selector', () => {
+    const html = renderScope(scopedRestore({ labelSelector: { matchLabels: { app: 'nginx' } } }))
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+  })
+
+  it('shows orLabelSelectors joined by OR', () => {
+    const html = renderScope(
+      scopedRestore({
+        orLabelSelectors: [{ matchLabels: { app: 'nginx' } }, { matchLabels: { app: 'redis' } }],
+      }),
+    )
+    expect(html).toContain('Scope')
+    expect(html).toContain('app=nginx')
+    expect(html).toContain('app=redis')
+  })
+
+  it('shows included and excluded namespaces alongside mapping', () => {
+    const html = renderScope(
+      scopedRestore({
+        includedNamespaces: ['prod'],
+        excludedNamespaces: ['kube-system'],
+        namespaceMapping: { prod: 'prod-clone' },
+      }),
+    )
+    expect(html).toContain('Included Namespaces')
+    expect(html).toContain('Excluded Namespaces')
+    expect(html).toContain('kube-system')
+    expect(html).toContain('prod-clone')
+  })
+
+  it('renders no empty Scope section for an unscoped restore', () => {
+    const html = renderScope(scopedRestore({}))
+    expect(html).not.toContain('Scope')
+  })
+
+  // An empty selector matches everything, so it is not scope. Presenting it as
+  // scope would tell an operator a restore is filtered when it is not.
+  it('treats an empty label selector as unscoped', () => {
+    const html = renderScope(scopedRestore({ labelSelector: {}, orLabelSelectors: [{}] }))
+    expect(html).not.toContain('Scope')
+  })
+})

package/src/components/resources/renderers/VeleroRestoreRenderer.tsx

@@ -1,5 +1,5 @@
 import { ArchiveRestore, Filter } from 'lucide-react'
-import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink } from '../../ui/drawer-components'
+import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink, LabelSelectorDisplay } from '../../ui/drawer-components'
 import {
   getRestoreStatus,
   getRestoreBackupName,
@@ -7,6 +7,10 @@ import {
   getRestoreExcludedNamespaces,
   getRestoreIncludedResources,
   getRestoreExcludedResources,
+  getRestoreNamespaceMapping,
+  getRestoreLabelSelector,
+  getRestoreOrLabelSelectors,
+  hasLabelSelectorTerms,
   getRestoreDuration,
   getRestoreErrors,
   getRestoreWarnings,
@@ -41,6 +45,19 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
   const excludedNamespaces = getRestoreExcludedNamespaces(data)
   const includedResources = getRestoreIncludedResources(data)
   const excludedResources = getRestoreExcludedResources(data)
+  const namespaceMapping = getRestoreNamespaceMapping(data)
+  const rawLabelSelector = getRestoreLabelSelector(data)
+  const labelSelector = hasLabelSelectorTerms(rawLabelSelector) ? rawLabelSelector : null
+  const orLabelSelectors = getRestoreOrLabelSelectors(data).filter(hasLabelSelectorTerms)
+  const namespaceMappingEntries = Object.entries(namespaceMapping)
+  const hasScope =
+    includedNamespaces.length > 0 ||
+    excludedNamespaces.length > 0 ||
+    includedResources.length > 0 ||
+    excludedResources.length > 0 ||
+    namespaceMappingEntries.length > 0 ||
+    Boolean(labelSelector) ||
+    orLabelSelectors.length > 0
 
   const phase = status.phase || ''
   const validationErrors = getRestoreValidationErrors(data)
@@ -148,7 +165,7 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
       )}
 
       {/* Scope section */}
-      {(includedNamespaces.length > 0 || excludedNamespaces.length > 0 || includedResources.length > 0 || excludedResources.length > 0) && (
+      {hasScope && (
         <Section title="Scope" icon={Filter} defaultExpanded>
           <PropertyList>
             {includedNamespaces.length > 0 && (
@@ -172,6 +189,19 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
                 </div>
               } />
             )}
+            {namespaceMappingEntries.length > 0 && (
+              <Property label="Namespace Mapping" value={
+                <div className="flex flex-col gap-1">
+                  {namespaceMappingEntries.map(([source, target]) => (
+                    <div key={source} className="flex items-center gap-1.5">
+                      <span className="badge-sm bg-theme-hover text-theme-text-secondary">{source}</span>
+                      <span className="text-theme-text-tertiary" aria-hidden="true">&rarr;</span>
+                      <span className="badge-sm bg-theme-hover text-theme-text-secondary">{String(target)}</span>
+                    </div>
+                  ))}
+                </div>
+              } />
+            )}
             {includedResources.length > 0 && (
               <Property label="Included Resources" value={
                 <div className="flex flex-wrap gap-1">
@@ -190,6 +220,18 @@ export function VeleroRestoreRenderer({ data, messages, onNavigate }: VeleroRest
                 </div>
               } />
             )}
+            {labelSelector && (
+              <Property label="Label Selector" value={<LabelSelectorDisplay selector={labelSelector} />} />
+            )}
+            {orLabelSelectors.length > 0 && (
+              <Property label="Label Selectors (match any)" value={
+                <div className="flex flex-col gap-1">
+                  {orLabelSelectors.map((sel: any, i: number) => (
+                    <LabelSelectorDisplay key={i} selector={sel} />
+                  ))}
+                </div>
+              } />
+            )}
           </PropertyList>
         </Section>
       )}

package/src/components/resources/renderers/cnpg-cells.tsx

@@ -4,6 +4,7 @@ import { clsx } from 'clsx'
 import { Tooltip } from '../../ui/Tooltip'
 import {
   getCNPGClusterStatus,
+  getCNPGClusterAvailability,
   classifyCNPGClusterPhase,
   getCNPGClusterInstances,
   getCNPGClusterPrimary,
@@ -66,8 +67,18 @@ export function CNPGClusterCell({ resource, column }: { resource: any; column: s
           </Tooltip>
         )
       }
+      // Colour tracks the badge: a was-up total outage (readyInstances omitted,
+      // so readyKnown is false) reads red like its "Not Ready" badge rather than
+      // muted grey, and a partial shortfall stays yellow. Without the
+      // availability check the most severe count was the least emphasised.
+      const down = getCNPGClusterAvailability(resource) === 'down'
       return (
-        <span className={clsx('text-sm', readyKnown && ready < desired ? 'text-yellow-400' : 'text-theme-text-secondary')}>
+        <span
+          className={clsx(
+            'text-sm',
+            down ? 'text-red-400' : readyKnown && ready < desired ? 'text-yellow-400' : 'text-theme-text-secondary',
+          )}
+        >
           {instances}
         </span>
       )

package/src/components/resources/renderers/kyverno-cells.tsx

@@ -6,7 +6,7 @@ import {
   getPolicyReportStatus,
   getPolicyReportSummary,
   getKyvernoPolicyStatus,
-  getKyvernoPolicyAction,
+  getKyvernoEnforcement,
   getKyvernoPolicyRuleCount,
 } from '../resource-utils-kyverno'
 import {
@@ -79,13 +79,17 @@ export function KyvernoPolicyCell({ resource, column }: { resource: any; column:
       )
     }
     case 'action': {
-      const action = getKyvernoPolicyAction(resource)
+      const { label, blocks, discrepancy } = getKyvernoEnforcement(resource)
       return (
         <span className={clsx(
           'badge',
-          action === 'Enforce' ? 'bg-red-500/20 text-red-400' : 'bg-yellow-500/20 text-yellow-400',
+          blocks
+            ? 'bg-red-500/20 text-red-400'
+            : discrepancy
+              ? 'bg-orange-500/20 text-orange-400'
+              : 'bg-yellow-500/20 text-yellow-400',
         )}>
-          {action}
+          {label}
         </span>
       )
     }

package/src/components/resources/resource-utils-cnpg.golden.test.ts

@@ -27,6 +27,7 @@ interface GoldenCase {
   name: string
   spec: Record<string, unknown>
   status: Record<string, unknown>
+  metadata?: Record<string, unknown>
   badge: { text: string; level: string }
   issues: string[]
   worst: string
@@ -40,7 +41,7 @@ describe('CNPG golden matrix — badge side', () => {
   })
 
   it.each(cases.map((c) => [c.name, c] as const))('%s', (_name, tc) => {
-    const badge = getCNPGClusterStatus({ spec: tc.spec, status: tc.status })
+    const badge = getCNPGClusterStatus({ metadata: tc.metadata, spec: tc.spec, status: tc.status })
     expect({ text: badge.text, level: badge.level }).toEqual(tc.badge)
   })
 
@@ -50,7 +51,7 @@ describe('CNPG golden matrix — badge side', () => {
   it.each(cases.map((c) => [c.name, c] as const))(
     'badge and issues do not contradict — %s',
     (_name, tc) => {
-      const badge = getCNPGClusterStatus({ spec: tc.spec, status: tc.status })
+      const badge = getCNPGClusterStatus({ metadata: tc.metadata, spec: tc.spec, status: tc.status })
       if (badge.level === 'healthy') {
         expect(tc.issues, 'a healthy badge must not sit next to an issue').toEqual([])
       }
@@ -69,16 +70,23 @@ describe('CNPG golden matrix — badge side', () => {
   // This is the gap that let the bug through: the matrix already pinned
   // "readyInstances absent — unknown, not zero; must not fabricate an outage"
   // for the badge, and the cell rendered 0/N on that very case.
+  //
+  // The cell reads '-' exactly when the ready count is genuinely unknown: no
+  // explicit readyInstances AND no currentPrimary. Once a primary has been
+  // elected, an omitted readyInstances is a real 0 and the cell says so — which
+  // is what keeps "0/3" agreeing with the "Not Ready" badge on a was-up outage,
+  // while a still-bootstrapping cluster (no primary) keeps its dash.
   it.each(cases.map((c) => [c.name, c] as const))(
     'instances cell does not claim an outage the badge denies — %s',
     (_name, tc) => {
       const cell = getCNPGClusterInstances({ spec: tc.spec, status: tc.status })
       const ready = cell.split('/')[0]
-      const readyReported = typeof tc.status.readyInstances === 'number'
+      const readyResolvable =
+        typeof tc.status.readyInstances === 'number' || !!tc.status.currentPrimary
       expect(
         ready === '-',
-        `readyInstances ${readyReported ? 'is reported' : 'is absent'} but the cell reads ${cell}`,
-      ).toBe(!readyReported)
+        `ready is ${readyResolvable ? 'resolvable' : 'unknown'} but the cell reads ${cell}`,
+      ).toBe(!readyResolvable)
     },
   )
 })