@skyhook-io/k8s-ui 1.13.4 → 1.14.1

package/src/components/resources/resource-utils-cnpg.test.ts

@@ -27,6 +27,12 @@ import {
   getCNPGClusterDisplayState,
   getCNPGClusterInstances,
   getCNPGPoolerInstances,
+  getCNPGClusterIsReplica,
+  getCNPGClusterReplicaSource,
+  getCNPGClusterAvailability,
+  isCNPGClusterHibernated,
+  isCNPGClusterFencedAll,
+  CNPG_DOWN_GRACE_MS,
 } from './resource-utils-cnpg'
 import { getCellFilterValue } from './resource-utils'
 
@@ -176,8 +182,10 @@ describe('getCNPGClusterStatus', () => {
     expect(getCNPGClusterStatus(cluster({ phase: 'Failing over', readyInstances: 2 }, { instances: 3 })).level).toBe('alert')
   })
 
-  it('treats zero ready instances as down regardless of phase', () => {
-    const s = getCNPGClusterStatus(cluster({ phase: 'Cluster in healthy state', readyInstances: 0 }, { instances: 3 }))
+  it('treats a was-up cluster with zero ready instances as down regardless of phase', () => {
+    // currentPrimary proves it was serving; the omitted-then-zero count is a
+    // regression, not a first bootstrap. Even a "healthy" phase does not rescue it.
+    const s = getCNPGClusterStatus(cluster({ phase: 'Cluster in healthy state', currentPrimary: 'pg-1', readyInstances: 0 }, { instances: 3 }))
     expect(s.level).toBe('unhealthy')
     expect(s.text).toBe('Not Ready')
   })
@@ -193,6 +201,68 @@ describe('getCNPGClusterStatus', () => {
   })
 })
 
+describe('getCNPGClusterAvailability — three states a bare zero-ready count collapses', () => {
+  // CNPG omits readyInstances when it is 0, so these fixtures OMIT it — the shape
+  // the operator actually emits for a down cluster.
+  const withPrimary = (extra: any = {}, meta: any = {}) => ({
+    metadata: meta,
+    spec: { instances: 3 },
+    status: { currentPrimary: 'pg-1', ...extra },
+  })
+
+  it('is null while still bootstrapping — reported, but no primary ever elected', () => {
+    // The truly-statusless case AND the reported-but-no-primary case both stay
+    // null: nothing was serving to lose.
+    expect(getCNPGClusterAvailability({ spec: { instances: 3 }, status: {} })).toBeNull()
+    expect(getCNPGClusterAvailability({ spec: { instances: 3 }, status: { phase: 'Setting up primary' } })).toBeNull()
+  })
+
+  it('is null when a real ready count exists', () => {
+    expect(getCNPGClusterAvailability({ spec: { instances: 3 }, status: { currentPrimary: 'pg-1', readyInstances: 2 } })).toBeNull()
+  })
+
+  it('is down for a was-up cluster with no Ready condition — escalates immediately', () => {
+    expect(getCNPGClusterAvailability(withPrimary({ phase: 'Waiting for the instances to become active' }))).toBe('down')
+  })
+
+  it('debounces a fresh Ready=False, then escalates once it ages past the grace', () => {
+    const recent = new Date(Date.now() - 60 * 1000).toISOString()
+    const old = new Date(Date.now() - CNPG_DOWN_GRACE_MS - 60 * 1000).toISOString()
+    const cond = (ltt: string) => withPrimary({
+      conditions: [{ type: 'Ready', status: 'False', reason: 'ClusterIsNotReady', lastTransitionTime: ltt }],
+    })
+    expect(getCNPGClusterAvailability(cond(recent))).toBeNull()
+    expect(getCNPGClusterAvailability(cond(old))).toBe('down')
+  })
+
+  it('reads hibernation and all-fencing as neutral, ahead of the down verdict', () => {
+    expect(getCNPGClusterAvailability(withPrimary({}, { annotations: { 'cnpg.io/hibernation': 'on' } }))).toBe('hibernated')
+    expect(getCNPGClusterAvailability(withPrimary({}, { annotations: { 'cnpg.io/fencedInstances': '["*"]' } }))).toBe('fenced')
+  })
+
+  it('a partial fence is not all-fenced — "*" is the only all-down token', () => {
+    expect(isCNPGClusterFencedAll({ metadata: { annotations: { 'cnpg.io/fencedInstances': '["pg-1-2"]' } } })).toBe(false)
+    expect(isCNPGClusterFencedAll({ metadata: { annotations: { 'cnpg.io/fencedInstances': '["*"]' } } })).toBe(true)
+    // A malformed annotation is treated as not-fenced rather than throwing.
+    expect(isCNPGClusterFencedAll({ metadata: { annotations: { 'cnpg.io/fencedInstances': 'not-json' } } })).toBe(false)
+  })
+
+  it('hibernation is an explicit "on", nothing else', () => {
+    expect(isCNPGClusterHibernated({ metadata: { annotations: { 'cnpg.io/hibernation': 'on' } } })).toBe(true)
+    expect(isCNPGClusterHibernated({ metadata: { annotations: { 'cnpg.io/hibernation': 'off' } } })).toBe(false)
+    expect(isCNPGClusterHibernated({ metadata: {} })).toBe(false)
+  })
+
+  it('renders the badge neutral for hibernation and fencing, red only for a real outage', () => {
+    expect(getCNPGClusterStatus(withPrimary({}, { annotations: { 'cnpg.io/hibernation': 'on' } })))
+      .toMatchObject({ text: 'Hibernated', level: 'neutral' })
+    expect(getCNPGClusterStatus(withPrimary({}, { annotations: { 'cnpg.io/fencedInstances': '["*"]' } })))
+      .toMatchObject({ text: 'Fenced', level: 'neutral' })
+    expect(getCNPGClusterStatus(withPrimary({ phase: 'Switchover in progress' })))
+      .toMatchObject({ text: 'Not Ready', level: 'unhealthy' })
+  })
+})
+
 describe('getCNPGBackupStatus', () => {
   it('escalates walArchivingFailing instead of rendering it neutral', () => {
     // The shipped bug: this phase hit the default branch and rendered grey,
@@ -716,3 +786,73 @@ describe('CNPG scheduled backup lateness', () => {
     expect(getCNPGScheduledBackupStatus(sb(false, undefined, at(-24 * 60 * MIN))).level).toBe('healthy')
   })
 })
+
+describe('getCNPGClusterIsReplica — the live replica-cluster role, per CNPG semantics', () => {
+  // CNPG carries replica-cluster state in `spec.replica` (enabled/primary/self/source),
+  // and its own Cluster.IsReplica() reads: enabled wins when set; otherwise the
+  // cluster is a replica only while (self || name) != primary. Promotion mutates
+  // those fields but leaves the stanza in place, so presence alone cannot be the
+  // signal.
+
+  it('standalone replica cluster (replica mode enabled) reads as a replica', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', enabled: true } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(true)
+  })
+
+  it('a promoted standalone cluster (replica.enabled turned off) is no longer a replica', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', enabled: false } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(false)
+  })
+
+  it('distributed topology: a designated replica (primary names another cluster) reads as a replica', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-us', self: 'pg-eu' } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(true)
+  })
+
+  it('distributed topology: after promotion (primary now names this cluster) it is the primary, stanza still present', () => {
+    const resource = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-eu', self: 'pg-eu' } },
+    }
+    expect(getCNPGClusterIsReplica(resource)).toBe(false)
+  })
+
+  it('distributed topology without self falls back to the resource name', () => {
+    const promoted = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-eu' } },
+    }
+    expect(getCNPGClusterIsReplica(promoted)).toBe(false)
+
+    const stillReplica = {
+      metadata: { name: 'pg-eu' },
+      spec: { replica: { source: 'pg-us', primary: 'pg-us' } },
+    }
+    expect(getCNPGClusterIsReplica(stillReplica)).toBe(true)
+  })
+
+  it('a bootstrapping standalone replica with only a source (no enabled, no primary) is a replica', () => {
+    // The stanza's source is required; before the operator writes enabled, the
+    // cluster is still a replica — (self || name) never equals an unset primary.
+    const resource = { metadata: { name: 'pg-eu' }, spec: { replica: { source: 'pg-us' } } }
+    expect(getCNPGClusterIsReplica(resource)).toBe(true)
+  })
+
+  it('an ordinary standalone cluster with no replica stanza is not a replica', () => {
+    expect(getCNPGClusterIsReplica({ metadata: { name: 'pg' }, spec: { instances: 3 } })).toBe(false)
+  })
+
+  it('getCNPGClusterReplicaSource reads the source from the replica stanza', () => {
+    const resource = { metadata: { name: 'pg-eu' }, spec: { replica: { source: 'pg-us', enabled: true } } }
+    expect(getCNPGClusterReplicaSource(resource)).toBe('pg-us')
+  })
+})

package/src/components/resources/resource-utils-cnpg.ts

@@ -145,6 +145,100 @@ export function classifyCNPGClusterPhase(phase: string): CNPGPhaseBucket {
   return 'unknown'
 }
 
+// Debounce window for calling a was-up cluster "down". A single instance
+// restarting flips Ready=False for a minute or two while the pod comes back;
+// escalating instantly would fire on routine rollouts. Kept in step with
+// cnpgDownGrace in internal/issues/source_cnpg.go — the two must not drift.
+export const CNPG_DOWN_GRACE_MS = 5 * 60 * 1000
+
+/**
+ * Hibernation is a deliberate scale-to-zero: the operator removes the pods and
+ * the cluster reports nothing ready by design. Signalled by an annotation, not
+ * by any status field, so it has to be read before a zero-ready count is called
+ * an outage.
+ */
+export function isCNPGClusterHibernated(resource: any): boolean {
+  return resource?.metadata?.annotations?.['cnpg.io/hibernation'] === 'on'
+}
+
+/**
+ * Fencing stops PostgreSQL on the named instances while leaving the pods up. The
+ * annotation is a JSON array of instance names; `"*"` means every instance is
+ * fenced, so nothing serves — intentionally, not as a fault. A malformed value
+ * is treated as "not fenced" rather than throwing.
+ */
+export function isCNPGClusterFencedAll(resource: any): boolean {
+  const raw = resource?.metadata?.annotations?.['cnpg.io/fencedInstances']
+  if (typeof raw !== 'string' || raw === '') return false
+  try {
+    const parsed = JSON.parse(raw)
+    return Array.isArray(parsed) && parsed.includes('*')
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Whether a zero-ready cluster is actually unavailable, and why.
+ *
+ * The load-bearing distinction the badge and the Go detector both turn on:
+ * CNPG omits `status.readyInstances` when it is 0 (omitempty int), so "no
+ * status yet" and "0 ready" are byte-identical on the wire. The field's
+ * presence therefore cannot distinguish an outage from an unreported cluster;
+ * any other status the operator has written (phase, primary, a condition) is
+ * what marks the count as a real 0 rather than "not reported".
+ *
+ * `status.currentPrimary` is the version-robust "was up" signal: CNPG sets it
+ * the first time a primary is elected and never clears it (present on 1.27 and
+ * 1.28). So a zero-ready cluster that HAS a currentPrimary was serving before —
+ * a regression — while one that never had a primary is still bootstrapping.
+ *
+ *   - null       — not down: still bootstrapping, or a real ready count exists
+ *   - 'hibernated' / 'fenced' — deliberately not serving, no alarm
+ *   - 'down'     — was up, now zero ready past the grace window
+ *
+ * Mirrored by getCNPGClusterAvailability's Go counterpart in
+ * internal/issues/source_cnpg.go (the allDown verdict) — same signals, same
+ * grace, or a badge and its issue disagree.
+ */
+export function getCNPGClusterAvailability(
+  resource: any,
+): 'hibernated' | 'fenced' | 'down' | null {
+  const status = resource.status || {}
+  const desired = resource.spec?.instances ?? 0
+  const ready = typeof status.readyInstances === 'number' ? status.readyInstances : 0
+  // Any status the operator has written proves it has reconciled at least once,
+  // which is what lets an absent readyInstances be read as a real 0 rather than
+  // "not reported". Absent EVERYTHING is the truly-statusless case, still unknown.
+  const reported = !!(status.phase || status.currentPrimary || status.conditions?.length)
+  if (desired <= 0 || ready > 0 || !reported) return null
+  // Deliberate not-serving states outrank the down verdict — checked before the
+  // was-up gate so a hibernated cluster reads neutral even if it kept a primary.
+  if (isCNPGClusterHibernated(resource)) return 'hibernated'
+  if (isCNPGClusterFencedAll(resource)) return 'fenced'
+  // Never elected a primary → first bootstrap, not a regression.
+  if (!status.currentPrimary) return null
+  const conditions = status.conditions || []
+  const readyCond = conditions.find((c: any) => c.type === 'Ready')
+  // A was-up cluster whose Ready only just went False is likely a single
+  // instance bouncing; wait out the grace. No Ready=False at all (or no
+  // timestamp) means nothing is debouncing, so escalate immediately rather than
+  // inventing a start time.
+  if (
+    readyCond?.status === 'False' &&
+    readyCond.lastTransitionTime &&
+    Date.now() - Date.parse(readyCond.lastTransitionTime) < CNPG_DOWN_GRACE_MS
+  ) {
+    return null
+  }
+  // A cluster woken from hibernation or lifted from a full fence transiently
+  // shows this same shape — was-up, zero ready, Ready=False from long before —
+  // until its first instance is Ready. CNPG drops the hibernation marker at that
+  // point, so from the Cluster status alone this is indistinguishable from a real
+  // outage, and it reads down for that short window.
+  return 'down'
+}
+
 export function getCNPGClusterStatus(resource: any): StatusBadge {
   const status = resource.status || {}
   const phase = status.phase || ''
@@ -165,10 +259,19 @@ export function getCNPGClusterStatus(resource: any): StatusBadge {
   if (bucket === 'terminal') {
     return { text: getCNPGClusterDisplayState(phase), color: healthColors.unhealthy, level: 'unhealthy' }
   }
-  // Zero ready instances is a hard down that no phase excuses — including a
-  // failover, where the phase alone would otherwise downgrade a total outage to
-  // orange.
-  if (countsKnown && readyInstances === 0) {
+  // Availability outranks every phase branch except terminal. A zero-ready
+  // cluster CNPG reports by omitting readyInstances would otherwise be invisible
+  // here (countsKnown is false without the field) and fall through to the
+  // transient phase, painting amber on a total outage. Hibernation and all-fenced
+  // are deliberate not-serving states, so they read neutral rather than red.
+  const avail = getCNPGClusterAvailability(resource)
+  if (avail === 'hibernated') {
+    return { text: 'Hibernated', color: healthColors.neutral, level: 'neutral' }
+  }
+  if (avail === 'fenced') {
+    return { text: 'Fenced', color: healthColors.neutral, level: 'neutral' }
+  }
+  if (avail === 'down') {
     return { text: 'Not Ready', color: healthColors.unhealthy, level: 'unhealthy' }
   }
   if (bucket === 'failing') {
@@ -241,7 +344,20 @@ export function getCNPGClusterStatus(resource: any): StatusBadge {
 const countOrDash = (n: unknown): string => (typeof n === 'number' ? String(n) : '-')
 
 export function getCNPGClusterInstances(resource: any): string {
-  return `${countOrDash(resource.status?.readyInstances)}/${countOrDash(resource.spec?.instances)}`
+  const status = resource.status || {}
+  // Absent readyInstances resolves to 0 only for a was-up cluster (one that
+  // elected a primary): there the omitted field genuinely means zero ready, and
+  // "0/3" agrees with the "Not Ready" badge. Before a primary exists the count
+  // is truly unknown, so it stays a dash — the guard against fabricating an
+  // outage the badge denies. currentPrimary is the same was-up signal the badge
+  // gates its down verdict on, so the cell can never read 0 beside a green badge.
+  const ready =
+    typeof status.readyInstances === 'number'
+      ? status.readyInstances
+      : status.currentPrimary
+        ? 0
+        : undefined
+  return `${countOrDash(ready)}/${countOrDash(resource.spec?.instances)}`
 }
 
 export function getCNPGClusterPrimary(resource: any): string {
@@ -554,12 +670,21 @@ export function getCNPGClusterMonitoring(resource: any): {
   }
 }
 
+// CNPG carries replica-cluster state in `spec.replica`. Presence is not the
+// signal: promoting a replica to primary mutates the stanza's fields but leaves
+// it in place. This mirrors the operator's own Cluster.IsReplica() — `enabled`
+// decides when set; otherwise the cluster is a replica only while it is not the
+// designated primary of the distributed topology ((self || name) != primary).
 export function getCNPGClusterIsReplica(resource: any): boolean {
-  return !!resource.spec?.replicaCluster
+  const replica = resource.spec?.replica
+  if (!replica) return false
+  if (replica.enabled != null) return replica.enabled === true
+  const self = replica.self || resource.metadata?.name
+  return self !== replica.primary
 }
 
 export function getCNPGClusterReplicaSource(resource: any): string {
-  const replica = resource.spec?.replicaCluster
+  const replica = resource.spec?.replica
   if (!replica) return '-'
   return replica.source || replica.primary || '-'
 }

package/src/components/resources/resource-utils-gpu-ecosystem.test.ts

@@ -37,6 +37,20 @@ describe('GPU ecosystem API contracts', () => {
     expect(getKueueWorkloadStatus(workload).text).toBe('Evicted')
   })
 
+  it('distinguishes Kueue terminal failures from successful workloads', () => {
+    for (const reason of ['Failed', 'FailedToStart', 'OutOfSync', 'OwnerNotFound']) {
+      expect(getKueueWorkloadStatus({
+        status: { conditions: [{ type: 'Finished', status: 'True', reason }] },
+      })).toMatchObject({ text: reason, level: 'unhealthy' })
+    }
+
+    for (const reason of ['Succeeded', 'WorkloadSliceReplaced']) {
+      expect(getKueueWorkloadStatus({
+        status: { conditions: [{ type: 'Finished', status: 'True', reason }] },
+      })).toMatchObject({ text: 'Finished', level: 'neutral' })
+    }
+  })
+
   it('lets KubeRay conditions outrank deprecated state fields', () => {
     expect(getRayClusterStatus({
       status: {

package/src/components/resources/resource-utils-kueue.ts

@@ -3,6 +3,8 @@
 import type { StatusBadge } from './resource-utils'
 import { healthColors } from './resource-utils'
 
+const failedFinishedReasons = new Set(['Failed', 'FailedToStart', 'OutOfSync', 'OwnerNotFound'])
+
 // ============================================================================
 // SHARED HELPERS
 // ============================================================================
@@ -84,8 +86,8 @@ export function getLocalQueueAdmittedWorkloads(resource: any): string {
 export function getKueueWorkloadStatus(resource: any): StatusBadge {
   const finished = findCondition(resource, 'Finished')
   if (finished?.status === 'True') {
-    if (finished.reason === 'Failed') {
-      return { text: 'Failed', color: healthColors.unhealthy, level: 'unhealthy' }
+    if (failedFinishedReasons.has(finished.reason)) {
+      return { text: finished.reason, color: healthColors.unhealthy, level: 'unhealthy' }
     }
     return { text: 'Finished', color: healthColors.neutral, level: 'neutral' }
   }

package/src/components/resources/resource-utils-kyverno-modern.ts

@@ -472,7 +472,9 @@ export function getKyvernoMutations(resource: any): KyvernoMutation[] {
 export function getKyvernoGenerations(resource: any): string[] {
   const generate = resource?.spec?.generate
   if (!Array.isArray(generate)) return []
-  return generate.map((g: any) => g?.expression || '').filter(Boolean)
+  // Each entry declares its target as exactly one of a CEL `expression` or a
+  // YAML `template.value`; both are first-class ways to say what gets generated.
+  return generate.map((g: any) => g?.expression || g?.template?.value || '').filter(Boolean)
 }
 
 /**

package/src/components/resources/resource-utils-kyverno.ts

@@ -115,6 +115,16 @@ export function getKyvernoPolicyStatus(resource: any): StatusBadge {
   return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
 }
 
+/**
+ * Kyverno's ValidationFailureAction enum accepts the deprecated lowercase
+ * `enforce` alongside `Enforce`, and the admission controller blocks on the
+ * lowercase spelling exactly as on the capitalized one. Match case-insensitively
+ * so a legacy policy carrying the lowercase value is not read as non-blocking.
+ */
+export function isKyvernoEnforceAction(action: unknown): boolean {
+  return String(action ?? '').toLowerCase() === 'enforce'
+}
+
 /** The rule blocks whose failure an admission request can be rejected for. */
 function rejectingActions(rule: any): string[] {
   if (!rule) return []
@@ -148,14 +158,14 @@ function rejectingActions(rule: any): string[] {
 export function getKyvernoPolicyAction(resource: any): string {
   const specAction = resource.spec?.validationFailureAction
   const rules = resource.spec?.rules || []
-  if (rules.length === 0) return specAction || 'Audit'
+  if (rules.length === 0) return isKyvernoEnforceAction(specAction) ? 'Enforce' : 'Audit'
   const rejecting = rules.filter((rule: any) => rule?.validate || rule?.verifyImages)
   // Rules, but none that can reject: the spec-level action governs nothing here.
   if (rejecting.length === 0) return 'Audit'
   for (const rule of rejecting) {
     const overrides = rejectingActions(rule)
     const effective = overrides.length > 0 ? overrides : [specAction]
-    if (effective.includes('Enforce')) return 'Enforce'
+    if (effective.some(isKyvernoEnforceAction)) return 'Enforce'
   }
   return 'Audit'
 }
@@ -204,6 +214,45 @@ export function getKyvernoPolicyBackground(resource: any): boolean {
   return resource.spec?.background !== false
 }
 
+/**
+ * `spec.admission`, defaulting to true — the same reading as Kyverno's own
+ * AdmissionProcessingEnabled(). When false the policy is never registered with
+ * the admission webhook, so it rejects nothing at admission whatever its
+ * failureAction says; it can only be seen by background scans.
+ */
+export function getKyvernoPolicyAdmission(resource: any): boolean {
+  return resource.spec?.admission !== false
+}
+
+export interface KyvernoEnforcement {
+  /** Badge label. */
+  label: string
+  /** True only when a violating request is actually rejected at admission. */
+  blocks: boolean
+  /** Declared to reject, but admission is off — it enforces nothing at admission. */
+  discrepancy: boolean
+}
+
+/**
+ * What a legacy policy does at admission, not just what its failureAction field
+ * reads. An Enforce policy with admission disabled blocks nothing — presenting
+ * it as a blocking "Enforce" would tell an operator the cluster is guarded when
+ * it is not. Labels match the modern CEL family's vocabulary for the same
+ * posture: "Background only" when background scans still report violations,
+ * "Inactive" when background is disabled too and the policy does nothing.
+ */
+export function getKyvernoEnforcement(resource: any): KyvernoEnforcement {
+  const action = getKyvernoPolicyAction(resource)
+  if (action !== 'Enforce' || getKyvernoPolicyAdmission(resource)) {
+    return { label: action, blocks: action === 'Enforce', discrepancy: false }
+  }
+  return {
+    label: getKyvernoPolicyBackground(resource) ? 'Background only' : 'Inactive',
+    blocks: false,
+    discrepancy: true,
+  }
+}
+
 export function getKyvernoPolicyRuleCountByType(resource: any): {
   validate: number
   mutate: number

package/src/components/resources/resource-utils-velero.ts

@@ -306,6 +306,30 @@ export function getRestoreExcludedResources(resource: any): string[] {
   return resource.spec?.excludedResources || []
 }
 
+export function getRestoreNamespaceMapping(resource: any): Record<string, string> {
+  return resource.spec?.namespaceMapping || {}
+}
+
+export function getRestoreLabelSelector(resource: any): any {
+  return resource.spec?.labelSelector
+}
+
+export function getRestoreOrLabelSelectors(resource: any): any[] {
+  return resource.spec?.orLabelSelectors || []
+}
+
+/**
+ * A label selector only narrows a restore when it carries at least one term. An
+ * empty selector matches everything, so it must not be presented as scope: doing
+ * so would tell an operator a restore is filtered when it is not.
+ */
+export function hasLabelSelectorTerms(selector: any): boolean {
+  if (!selector || typeof selector !== 'object') return false
+  const hasLabels = selector.matchLabels && Object.keys(selector.matchLabels).length > 0
+  const hasExpressions = Array.isArray(selector.matchExpressions) && selector.matchExpressions.length > 0
+  return Boolean(hasLabels || hasExpressions)
+}
+
 export function getRestoreDuration(resource: any): string {
   const start = resource.status?.startTimestamp
   const end = resource.status?.completionTimestamp
@@ -486,6 +510,14 @@ export function getBSLLastSynced(resource: any): string {
   return formatAge(lastSynced)
 }
 
+// Why the location is unavailable, in the validation controller's own words.
+// A BackupStorageLocation carries no conditions, so status.message is the only
+// place the reason exists — without it the phase is the whole story a reader
+// gets.
+export function getBSLMessage(resource: any): string {
+  return resource.status?.message || ''
+}
+
 // ============================================================================
 // VOLUME SNAPSHOT LOCATION UTILITIES
 // ============================================================================

package/src/components/resources/rules-column-width.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'fs'
+import { join } from 'path'
+
+// Parsed from the source rather than exported, matching
+// curated-column-ownership.test.ts: this asserts a property of the data as it
+// is written, and an export would let the two drift.
+const SRC = readFileSync(join(__dirname, 'ResourcesView.tsx'), 'utf8')
+
+function columnSetBody(key: string): string {
+  const start = SRC.match(new RegExp(`^  ${key}: \\[`, 'm'))
+  if (!start || start.index === undefined) throw new Error(`${key} not found in KNOWN_COLUMNS`)
+  const open = SRC.indexOf('[', start.index)
+  let depth = 1
+  let i = open + 1
+  while (depth > 0) {
+    if (SRC[i] === '[') depth++
+    else if (SRC[i] === ']') depth--
+    i++
+  }
+  return SRC.slice(open + 1, i)
+}
+
+// The header cell is px-4, so w-16 (64px) leaves 31px for the label while
+// uppercase "RULES" needs ~37px — it clips to "RUL…" unconditionally, with no
+// sort or filter button involved: 'rules' is in SKIP_FILTER_COLUMNS and is not
+// in the sortable-key list, so neither affordance ever renders on it. w-20
+// (80px) leaves 47px.
+describe('Rules column width', () => {
+  const kinds = ['kyvernopolicies', 'clusterpolicies', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes']
+
+  it.each(kinds)('%s Rules column is at least w-20', (kind) => {
+    const rules = columnSetBody(kind).match(/\{ key: 'rules'.*\}/)
+    expect(rules, `${kind} has no rules column`).not.toBeNull()
+    const width = rules![0].match(/width: 'w-(\d+)'/)
+    expect(width, `${kind} rules column has no fixed w-* width`).not.toBeNull()
+    // Compared numerically, not pinned to w-20, so the wider table-width pass
+    // tracked in #1583 can widen these without tripping a test that only
+    // claims a floor.
+    expect(Number(width![1])).toBeGreaterThanOrEqual(20)
+  })
+})

package/src/components/shared/ResourceRendererDispatch.test.tsx

@@ -651,6 +651,81 @@ describe('colliding plurals — near-match API groups', () => {
   })
 })
 
+describe('CAPI Machine kind collisions', () => {
+  const foreignApiVersion = 'extension.cluster.x-k8s.io/v1'
+
+  it.each([
+    ['machines', 'Machine', 'Role'],
+    ['machinesets', 'MachineSet', 'Delete Policy'],
+  ])('routes a foreign %s CRD through the generic renderer only', (plural, kind, capiMarker) => {
+    const html = renderKind(plural, {
+      apiVersion: foreignApiVersion,
+      kind,
+      metadata: {
+        name: 'foreign',
+        namespace: 'default',
+        labels: { 'topology.cluster.x-k8s.io/owned': '' },
+      },
+      spec: { collisionProbe: COLLISION_PROBE },
+      status: { phase: 'provisioned' },
+    }, 'default')
+
+    expect(html).toContain(COLLISION_PROBE)
+    expect(html).not.toContain(capiMarker)
+    expect(html).not.toContain('Topology-controlled')
+    expect(getResourceStatus(plural, {
+      apiVersion: foreignApiVersion,
+      status: { phase: 'provisioned' },
+    })?.text).toBe('provisioned')
+  })
+
+  it.each([
+    ['machines', 'Machine', 'Role'],
+    ['machinesets', 'MachineSet', 'Delete Policy'],
+  ])('keeps exact-group CAPI %s resources on the dedicated path', (plural, kind, capiMarker) => {
+    const html = renderKind(plural, {
+      apiVersion: 'cluster.x-k8s.io/v1beta1',
+      kind,
+      metadata: {
+        name: 'capi',
+        namespace: 'default',
+        labels: { 'topology.cluster.x-k8s.io/owned': '' },
+      },
+      spec: { collisionProbe: COLLISION_PROBE },
+      status: { phase: 'provisioned' },
+    }, 'default')
+
+    expect(html).toContain(capiMarker)
+    expect(html).toContain('Topology-controlled')
+    expect(html).not.toContain(COLLISION_PROBE)
+    expect(getResourceStatus(plural, {
+      apiVersion: 'cluster.x-k8s.io/v1beta1',
+      status: { phase: 'provisioned' },
+    })?.text).toBe('Provisioned')
+  })
+
+  it.each([
+    ['kubeadmcontrolplanes', 'KubeadmControlPlane', 'controlplane.cluster.x-k8s.io/v1beta1'],
+    ['awsmanagedcontrolplanes', 'AWSManagedControlPlane', 'controlplane.cluster.x-k8s.io/v1beta2'],
+    ['awsmanagedmachinepools', 'AWSManagedMachinePool', 'infrastructure.cluster.x-k8s.io/v1beta2'],
+    ['awsmachines', 'AWSMachine', 'infrastructure.cluster.x-k8s.io/v1beta2'],
+  ])('keeps the topology-owned warning for %s', (plural, kind, apiVersion) => {
+    const html = renderKind(plural, {
+      apiVersion,
+      kind,
+      metadata: {
+        name: 'topology-owned',
+        namespace: 'default',
+        labels: { 'topology.cluster.x-k8s.io/owned': '' },
+      },
+      spec: {},
+      status: {},
+    }, 'default')
+
+    expect(html).toContain('Topology-controlled')
+  })
+})
+
 describe('shared plurals — the status path collides too', () => {
   // The renderer and the status badge are two separate switches over the same
   // plural, and fixing one leaves the other reading a foreign CRD's conditions