@skyhook-io/k8s-ui 1.14.1 → 1.14.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/k8s-ui",
-  "version": "1.14.1",
+  "version": "1.14.2",
   "repository": {
     "type": "git",
     "url": "https://github.com/skyhook-io/radar",

package/src/components/issues/IssuesView.tsx

@@ -63,7 +63,7 @@ export interface IssuesViewProps {
   /** Empty-state CTA shown when there's no data. */
   emptyAction?: ReactNode;
   /** Per-row trailing action, rendered after the severity badge — e.g. the
-   *  "Diagnose with AI" button in OSS. Omit to render no per-row action. */
+   *  "Investigate with AI" button in OSS. Omit to render no per-row action. */
   renderActions?: (ctx: IssueRowSlotContext) => ReactNode;
 }
 

package/src/components/issues/types.ts

@@ -121,6 +121,8 @@ export interface IssueRecentChangeField {
 export interface IssueRecentChange {
   source?: string;
   kind: string;
+  /** Kubernetes API version for an exact, collision-safe resource identity. */
+  apiVersion?: string;
   namespace?: string;
   name: string;
   changeType: string;

package/src/components/resources/ResourcesView.tsx

@@ -110,6 +110,7 @@ import {
   getGatewayClassController,
   getGatewayClassDescription,
   getRouteStatus,
+  getRouteStatusReason,
   getRouteParents,
   getRouteHostnames,
   getRouteBackends,
@@ -566,7 +567,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-40' },
-    { key: 'desired', label: 'Desired', width: 'w-20', tooltip: 'Number of nodes that should run the daemon pod (based on node selector)' },
+    { key: 'desired', label: 'Desired', width: 'w-20', tooltip: 'Nodes eligible for this daemon after node selectors, required node affinity and taints/tolerations are applied' },
     { key: 'ready', label: 'Ready', width: 'w-20', tooltip: 'Number of pods that are ready (passing readiness probes)' },
     { key: 'upToDate', label: 'Up-to-date', width: 'w-32', tooltip: 'Number of pods running the current pod template spec' },
     { key: 'available', label: 'Available', width: 'w-28', tooltip: 'Number of pods available (ready for minReadySeconds duration)' },
@@ -578,7 +579,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-40' },
     { key: 'ready', label: 'Ready', width: 'w-24', tooltip: 'Ready pods / Desired replicas' },
-    { key: 'upToDate', label: 'Up-to-date', width: 'w-32', tooltip: 'Number of pods running the current pod template' },
+    { key: 'upToDate', label: 'Up-to-date', width: 'w-32', tooltip: 'Pods running the current pod template; a rolling-update partition or OnDelete strategy can intentionally leave pods on an older template' },
     { key: 'images', label: 'Images', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -587,7 +588,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'ready', label: 'Ready', width: 'w-24' },
     { key: 'owner', label: 'Owner', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: 'Active means desired replicas are greater than zero; Old means desired replicas are zero, regardless of Deployment revision' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   services: [
@@ -623,7 +624,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   nodes: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-44' },
-    { key: 'roles', label: 'Roles', width: 'w-28' },
+    { key: 'roles', label: 'Roles', width: 'w-28', tooltip: 'Node roles from node-role.kubernetes.io/* labels. A node with no role label shows as worker.' },
     { key: 'cpu', label: 'CPU', width: 'w-40', tooltip: 'Current CPU usage / allocatable' },
     { key: 'memory', label: 'Memory', width: 'w-40', tooltip: 'Current memory usage / allocatable' },
     { key: 'pods', label: 'Pods', width: 'w-28', tooltip: 'Pods running / allocatable' },
@@ -637,7 +638,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'keys', label: 'Keys', width: 'w-48' },
-    { key: 'size', label: 'Size', width: 'w-24' },
+    { key: 'size', label: 'Size', width: 'w-24', tooltip: 'Estimated size of data values, including decoded binary data. Kubernetes rejects ConfigMaps whose combined data exceeds 1 MiB.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   secrets: [
@@ -645,7 +646,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'type', label: 'Type', width: 'w-28' },
     { key: 'keys', label: 'Keys', width: 'w-20' },
-    { key: 'expires', label: 'Expires', width: 'w-24', tooltip: 'Certificate expiry for TLS secrets' },
+    { key: 'expires', label: 'Expires', width: 'w-24', tooltip: "Days until the certificate in a TLS Secret expires. Blank for Secrets carrying no readable TLS certificate; ! means the expiry lookup itself failed." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   jobs: [
@@ -659,7 +660,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   cronjobs: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'schedule', label: 'Schedule', width: 'w-40' },
+    { key: 'schedule', label: 'Schedule', width: 'w-40', tooltip: "Cron schedule; fires in spec.timeZone when set, otherwise the controller's zone" },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'lastRun', label: 'Last Run', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -685,10 +686,10 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   persistentvolumeclaims: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: 'With WaitForFirstConsumer, Pending can mean no pod has triggered binding yet. If a pod is waiting, check PVC events.' },
     { key: 'capacity', label: 'Capacity', width: 'w-24' },
     { key: 'storageClass', label: 'Storage Class', width: 'w-40' },
-    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'Access modes: RWO=ReadWriteOnce, RWX=ReadWriteMany, ROX=ReadOnlyMany' },
+    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'RWO=ReadWriteOnce (one node, possibly several pods), ROX=ReadOnlyMany (read-only on many nodes), RWX=ReadWriteMany (read-write on many nodes), RWOP=ReadWriteOncePod (one pod only)' },
     { key: 'volume', label: 'Volume', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -733,16 +734,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Ready', width: 'w-24' },
     { key: 'domains', label: 'Domains', width: 'w-56' },
-    { key: 'issuer', label: 'Issuer', width: 'w-36' },
+    { key: 'issuer', label: 'Issuer', width: 'w-36', tooltip: "Issuer name alone may be ambiguous. Check the certificate's issuer reference for its kind and API group." },
     { key: 'expires', label: 'Expires', width: 'w-24', tooltip: 'Days until certificate expires' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   persistentvolumes: [
     { key: 'name', label: 'Name' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: "Released means the claim is gone but the volume still holds the previous claimant's data, so it will not be re-bound — check Reclaim before reusing it." },
     { key: 'capacity', label: 'Capacity', width: 'w-24' },
-    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'RWO=ReadWriteOnce, ROX=ReadOnlyMany, RWX=ReadWriteMany' },
-    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20' },
+    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'RWO=ReadWriteOnce (one node, possibly several pods), ROX=ReadOnlyMany (read-only on many nodes), RWX=ReadWriteMany (read-write on many nodes), RWOP=ReadWriteOncePod (one pod only)' },
+    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20', tooltip: 'When the claim is deleted, Delete removes the backing storage and its data; Retain leaves it for manual reclamation.' },
     { key: 'storageClass', label: 'Storage Class', width: 'w-40' },
     { key: 'claim', label: 'Claim', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -750,8 +751,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   storageclasses: [
     { key: 'name', label: 'Name' },
     { key: 'provisioner', label: 'Provisioner', width: 'w-48' },
-    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20' },
-    { key: 'bindingMode', label: 'Binding Mode', width: 'w-36' },
+    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20', tooltip: 'Default policy for volumes this class provisions — Delete removes the backing storage when the claim goes away; Retain leaves it for manual reclamation.' },
+    { key: 'bindingMode', label: 'Binding Mode', width: 'w-36', tooltip: "When the volume is provisioned — WaitForFirstConsumer waits for a pod so the disk lands in the right zone; Immediate provisions before the pod's placement is known, which can leave the pod unschedulable." },
     { key: 'expansion', label: 'Expansion', width: 'w-24', tooltip: 'Whether volumes can be expanded after creation' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -779,7 +780,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   orders: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'state', label: 'State', width: 'w-24' },
+    { key: 'state', label: 'State', width: 'w-24', tooltip: 'Valid means ACME issuance finished; it does not confirm the TLS Secret is ready. If Pending persists, inspect the challenges and the order reason.' },
     { key: 'domains', label: 'Domains', width: 'w-48' },
     { key: 'issuer', label: 'Issuer', width: 'w-36' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -788,25 +789,27 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'challengeType', label: 'Type', width: 'w-20' },
-    { key: 'state', label: 'State', width: 'w-24' },
+    { key: 'state', label: 'State', width: 'w-24', tooltip: 'Valid means domain authorization succeeded. If Pending persists, inspect the reason for scheduling, solver, or propagation problems.' },
     { key: 'domain', label: 'Domain', width: 'w-48' },
-    { key: 'presented', label: 'Presented', width: 'w-24' },
+    { key: 'presented', label: 'Presented', width: 'w-24', tooltip: 'While Pending, Yes means the solver presented the token, not that it is reachable. Check the reason for propagation failures; No can also mean queued.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   gateways: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: "Programmed = the controller reports configuration should take effect soon; traffic has not been tested. Accepted = the controller accepted this Gateway but has not reported Programmed. If it stays Accepted, check the Gateway's conditions and addresses." },
     { key: 'class', label: 'Class', width: 'w-36' },
     { key: 'listeners', label: 'Listeners', width: 'w-40', tooltip: 'Protocol:Port for each listener' },
-    { key: 'routes', label: 'Routes', width: 'w-20', tooltip: 'Total attached routes across all listeners' },
+    // attachedRoutes is reported per listener, so a route attached to several
+    // listeners is counted once for each — the total is not a route count.
+    { key: 'routes', label: 'Routes', width: 'w-20', tooltip: "Sum of route counts reported by listeners; one route can count more than once. If 0 is unexpected, check the routes' Gateway names, listener permissions, and controller status." },
     { key: 'addresses', label: 'Addresses', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   httproutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
     { key: 'hostnames', label: 'Hostnames', width: 'w-48' },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
@@ -818,7 +821,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'servers', label: 'Servers', width: 'w-24' },
-    { key: 'selector', label: 'Selector', width: 'w-56' },
+    { key: 'selector', label: 'Selector', width: 'w-56', tooltip: "Selects gateway workloads that receive this configuration. An omitted selector applies to all workloads in Istio's selection scope; it does not mean none." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   gatewayclasses: [
@@ -838,7 +841,6 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ],
   nodeclaims: [
     { key: 'name', label: 'Name' },
-    { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'instanceType', label: 'Instance Type', width: 'w-32' },
     { key: 'capacityType', label: 'Capacity', width: 'w-24', tooltip: 'Spot or On-Demand' },
@@ -868,7 +870,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Allocated + reserved, allocated-but-unreserved, or pending' },
-    { key: 'deviceClass', label: 'Device Class', width: 'w-44' },
+    { key: 'deviceClass', label: 'Device Class', width: 'w-44', tooltip: 'DeviceClasses whose selectors constrain eligible devices. A request may list alternative classes; this column does not show which alternative was allocated.' },
     { key: 'allocated', label: 'Allocated Driver', width: 'w-44' },
     { key: 'reservedFor', label: 'Reserved For', width: 'w-44' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -881,15 +883,17 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ],
   deviceclasses: [
     { key: 'name', label: 'Name' },
-    { key: 'selectors', label: 'Selectors', width: 'w-28', tooltip: 'CEL device selector count' },
+    // Selectors are ANDed, so an empty list restricts nothing rather than
+    // matching nothing — the reading most people reach for first.
+    { key: 'selectors', label: 'Selectors', width: 'w-28', tooltip: 'Devices must satisfy every selector. Zero selectors means this class imposes no selector restriction; claim selectors and other allocation requirements still apply.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   resourceslices: [
     { key: 'name', label: 'Name' },
     { key: 'driver', label: 'Driver', width: 'w-44' },
-    { key: 'pool', label: 'Pool', width: 'w-36' },
-    { key: 'node', label: 'Node', width: 'w-44' },
-    { key: 'devices', label: 'Devices', width: 'w-24' },
+    { key: 'pool', label: 'Pool', width: 'w-36', tooltip: "Pools are identified by driver and pool name. The scheduler needs a complete set of slices at the pool's highest generation before allocating from it." },
+    { key: 'node', label: 'Node', width: 'w-44', tooltip: "Node providing this slice's devices. A dash means node access is described by a node selector, all-nodes access, or per-device node selection." },
+    { key: 'devices', label: 'Devices', width: 'w-24', tooltip: 'Devices published in this slice, including devices already allocated. This is not a count of free devices or the whole pool.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nvidiaclusterpolicies: [
@@ -935,7 +939,6 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ],
   resourceflavors: [
     { key: 'name', label: 'Name' },
-    { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'nodeLabels', label: 'Node Labels', width: 'w-28', tooltip: 'Node label selector count' },
     { key: 'taints', label: 'Taints', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -985,7 +988,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
-    { key: 'suspend', label: 'Suspend', width: 'w-20' },
+    { key: 'timeZone', label: 'Time Zone', width: 'w-36', tooltip: 'IANA zone the schedule is read in; unset follows the local zone of the KubeRay operator pod' },
     { key: 'lastSchedule', label: 'Last Schedule', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1112,7 +1115,6 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   jobtemplates: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'tasks', label: 'Tasks', width: 'w-20' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1219,7 +1221,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'target', label: 'Job Target', width: 'w-48' },
-    { key: 'strategy', label: 'Strategy', width: 'w-28' },
+    { key: 'strategy', label: 'Strategy', width: 'w-28', tooltip: 'Controls how queue length and running or pending Jobs determine how many new Jobs KEDA creates' },
     { key: 'triggerTypes', label: 'Trigger Types', width: 'w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1241,7 +1243,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   servicemonitors: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'endpoints', label: 'Endpoints', width: 'w-20', tooltip: 'Number of scrape endpoints' },
     { key: 'jobLabel', label: 'Job Label', width: 'w-32' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
@@ -1250,7 +1252,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   prometheusrules: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'groups', label: 'Groups', width: 'w-20' },
     { key: 'rules', label: 'Rules', width: 'w-20', tooltip: 'Total alert + recording rules' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1258,7 +1260,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   podmonitors: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'endpoints', label: 'Endpoints', width: 'w-20', tooltip: 'Number of pod metrics endpoints' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1420,8 +1422,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   grpcroutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'hostnames', label: 'Hostnames', width: 'w-48' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
+    { key: 'hostnames', label: 'Hostnames', width: 'w-48', tooltip: "gRPC hostnames this route matches. Any means the route adds no hostname restriction; the Gateway listener and the route's other matching rules still apply." },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
     { key: 'rules', label: 'Rules', width: 'w-20' },
@@ -1430,7 +1432,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   tcproutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
     { key: 'rules', label: 'Rules', width: 'w-20' },
@@ -1439,8 +1441,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   tlsroutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'hostnames', label: 'Hostnames', width: 'w-48', tooltip: 'SNI hostnames for TLS routing' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
+    { key: 'hostnames', label: 'Hostnames', width: 'w-48', tooltip: 'TLS SNI names requested by this route. Any means no route-level hostname restriction; the Gateway listener still applies.' },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
     { key: 'rules', label: 'Rules', width: 'w-20' },
@@ -1472,14 +1474,13 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'policyTypes', label: 'Types', width: 'w-28' },
     { key: 'selector', label: 'Pod Selector', width: 'w-48' },
-    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
+    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress allow-rule counts. For a direction listed in Types, 0 means this policy allows none; other policies can still allow traffic.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   caliconetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
     { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
     { key: 'tier', label: 'Tier', width: 'w-28' },
     { key: 'order', label: 'Order', width: 'w-24' },
@@ -1502,7 +1503,6 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
     { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
     { key: 'tier', label: 'Tier', width: 'w-28' },
     { key: 'order', label: 'Order', width: 'w-24' },
@@ -1561,7 +1561,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'budget', label: 'Budget', width: 'w-36' },
+    { key: 'budget', label: 'Budget', width: 'w-36', tooltip: 'min keeps at least this many pods available; max unavail permits at most this many unavailable during voluntary evictions; percentages use the expected pod count' },
     { key: 'healthy', label: 'Healthy', width: 'w-24' },
     { key: 'allowed', label: 'Allowed', width: 'w-24', tooltip: 'Number of disruptions currently allowed' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1569,7 +1569,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   serviceaccounts: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'automount', label: 'Automount', width: 'w-32', tooltip: 'Whether token is automatically mounted in pods' },
+    { key: 'automount', label: 'Automount', width: 'w-32', tooltip: 'Default automatic API-token mounting for pods using this ServiceAccount. A pod can override this setting. Disable it for workloads that do not need Kubernetes API credentials.' },
     { key: 'secrets', label: 'Secrets', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1607,12 +1607,12 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'holder', label: 'Holder', width: 'w-48' },
-    { key: 'renewTime', label: 'Last Renewed', width: 'w-32' },
+    { key: 'renewTime', label: 'Last Renewed', width: 'w-32', tooltip: 'Time since the recorded renewal; red means it exceeds leaseDurationSeconds. Check holder health and API connectivity' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   priorityclasses: [
     { key: 'name', label: 'Name' },
-    { key: 'value', label: 'Value', width: 'w-24' },
+    { key: 'value', label: 'Value', width: 'w-24', tooltip: 'Higher values receive scheduling preference; Pods can still be preempted by Pods with higher priority' },
     { key: 'globalDefault', label: 'Global Default', width: 'w-36' },
     { key: 'preemptionPolicy', label: 'Preemption', width: 'w-32' },
     { key: 'description', label: 'Description', width: 'w-64' },
@@ -1626,7 +1626,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   mutatingwebhookconfigurations: [
     { key: 'name', label: 'Name' },
     { key: 'webhooks', label: 'Webhooks', width: 'w-28' },
-    { key: 'failurePolicy', label: 'Failure Policy', width: 'w-36' },
+    { key: 'failurePolicy', label: 'Failure Policy', width: 'w-36', tooltip: 'If a matching webhook call errors or times out, Fail rejects the API request; Ignore continues without that webhook. This describes failure handling, not current webhook health.' },
     { key: 'target', label: 'Target', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1833,8 +1833,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'store', label: 'Store', width: 'w-36' },
-    { key: 'provider', label: 'Provider', width: 'w-28' },
-    { key: 'refreshInterval', label: 'Refresh', width: 'w-24' },
+    { key: 'refreshInterval', label: 'Refresh', width: 'w-24', tooltip: 'How often the value is re-pulled from the provider. A zero interval means it is fetched once and not updated afterward.' },
     { key: 'lastSync', label: 'Last Sync', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -2090,16 +2089,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   destinationrules: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'host', label: 'Host', width: 'w-48' },
-    { key: 'subsets', label: 'Subsets', width: 'w-20' },
-    { key: 'loadBalancer', label: 'LB Policy', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-24', defaultVisible: false },
+    { key: 'host', label: 'Host', width: 'w-48', tooltip: "The service this rule's traffic policy applies to" },
+    { key: 'subsets', label: 'Subsets', width: 'w-20', tooltip: 'Named backend groups that routes can select, often for canary releases. Defining subsets does not send traffic to them.' },
+    { key: 'tlsMode', label: 'Client TLS', width: 'w-28', tooltip: 'Declared client-side TLS mode for this host at the rule level. Subset and port policies can override it; this does not establish the effective mTLS posture.' },
+    { key: 'loadBalancer', label: 'LB Policy', width: 'w-28', tooltip: "Load balancing algorithm declared by this rule. '-' means none is set, so Istio applies its mesh default (LEAST_REQUEST since 1.14, overridable per mesh). Subset and port policies can differ." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   serviceentries: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'hosts', label: 'Hosts', width: 'w-48' },
     { key: 'location', label: 'Location', width: 'w-28' },
     { key: 'ports', label: 'Ports', width: 'w-32' },
@@ -2108,7 +2107,6 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   peerauthentications: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'mode', label: 'mTLS Mode', width: 'w-28' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -2116,10 +2114,10 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   authorizationpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'action', label: 'Action', width: 'w-24' },
-    { key: 'rules', label: 'Rules', width: 'w-20' },
-    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'status', label: 'Status', width: 'w-24', defaultVisible: false },
+    { key: 'action', label: 'Action', width: 'w-24', tooltip: 'ALLOW contributes permitted matches; DENY blocks matches; AUDIT marks matches for a configured audit plugin; CUSTOM adds an external check. Other policies also affect the decision.' },
+    { key: 'rules', label: 'Rules', width: 'w-20', tooltip: 'Rules are alternatives — zero rules match nothing, an empty rule matches everything. An ALLOW policy with zero rules permits nothing on its own.' },
+    { key: 'selector', label: 'Applies to', width: 'w-48', tooltip: 'Declared workload labels or resource attachments. With neither, scope is inherited — the namespace, or the whole mesh when the policy sits in the mesh root namespace.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // Knative Serving
@@ -3138,6 +3136,8 @@ export function mergeSavedVisibleColumns(
   savedVisible: string[],
   extraKeys: string[],
   printerColumns: ExtraColumn[],
+  effective?: Column[],
+  known?: string[],
 ): Set<string> {
   const merged = new Set(savedVisible)
   for (const k of extraKeys) merged.add(k)
@@ -3146,6 +3146,24 @@ export function mergeSavedVisibleColumns(
       if (c.defaultVisible !== false) merged.add(c.key)
     }
   }
+  // Curated columns the blob predates. Same principle as the two above, but it
+  // needs a record of what the user was actually offered: the blob stores only
+  // what is visible, so a curated key's absence is ambiguous between "hidden on
+  // purpose" and "not offered yet". `known` is that record. Without one the two
+  // cases are indistinguishable, so nothing is inferred and visibility is left
+  // to the saved set alone.
+  //
+  // Printer columns are excluded even when `known` lists none of them. They are
+  // fetched, so `known` can be written during the window before the printer
+  // table arrives; treating their absence as "new" would re-show ones the user
+  // hid. Their own rule above already covers them.
+  if (effective && Array.isArray(known)) {
+    const seen = new Set(known)
+    for (const c of effective) {
+      if (c.key.startsWith(PRINTER_COLUMN_PREFIX)) continue
+      if (!seen.has(c.key) && c.defaultVisible !== false) merged.add(c.key)
+    }
+  }
   return merged
 }
 
@@ -3201,6 +3219,10 @@ interface ColumnSettings {
   visible: string[]
   widths: Record<string, number>
   custom?: CustomColumnDef[]
+  /** Every column key the user was offered when this was written. Lets a later
+   *  load tell a column they hid from one that did not exist yet. Absent on
+   *  blobs written before this field. */
+  known?: string[]
 }
 
 function loadColumnSettings(kind: string, group?: string): ColumnSettings | null {
@@ -3778,6 +3800,12 @@ export function ResourcesView({
     return [...filteredExtras, ...kindColumns, ...builtCustomColumns]
   }, [selectedKind.name, selectedKind.group, extraLeadingColumns, builtCustomColumns, builtPrinterColumns])
 
+  // The offered key set, and a stable signature for it. allColumns is a new
+  // identity on every printer-column refetch; depending on the array itself
+  // would rewrite the settings blob on each poll.
+  const allColumnKeys = useMemo(() => allColumns.map(c => c.key), [allColumns])
+  const allColumnKeysSig = allColumnKeys.join('\u0000')
+
   // Map of extra column keys for fast O(1) lookup on each render path
   // (cell render, sort, column-filter unique-values).
   // Recompute header-derived widths once the web font swaps in (see watchHeaderFont).
@@ -3794,6 +3822,13 @@ export function ResourcesView({
   // Guards the save effect from persisting on the initial load of each kind
   // (set false by the load effect, flipped true on its first skipped save).
   const isColumnSettingsLoaded = useRef(false)
+  // Every column key this kind has ever offered, accumulated. A single save
+  // cannot stand in for it: the offered set shrinks as well as grows — an
+  // uncurated kind's generic Status disappears once its printer columns arrive
+  // — and a shrunk snapshot would forget that a column absent from `visible`
+  // was one the user hid rather than one never shown.
+  const knownColumnKeys = useRef<Set<string>>(new Set())
+  const knownColumnKeysKind = useRef('')
   // Whether the user has a persisted column blob for this kind — data-driven
   // column defaults (GPU auto-show) must never override explicit user choices.
   const hadSavedColumnSettings = useRef(false)
@@ -3819,6 +3854,15 @@ export function ResourcesView({
     // (non-array, blank path, bad source) must not crash the later .map or add dead columns.
     const savedCustom = sanitizeCustomColumnDefs(saved?.custom)
     setCustomColumns(savedCustom)
+    // Reset on a kind change only. This effect also re-runs when the printer
+    // columns arrive, and that is the moment the offered set shrinks — clearing
+    // here would drop the evidence for the column they replaced just before the
+    // next save persists the record without it.
+    const knownKeysIdentity = selectedKindIdentityOf(selectedKind)
+    if (knownColumnKeysKind.current !== knownKeysIdentity) {
+      knownColumnKeys.current = new Set()
+      knownColumnKeysKind.current = knownKeysIdentity
+    }
     const kindColumns = columnsForKindWithPrinter(selectedKind.name, selectedKind.group, builtPrinterColumns)
     const builtinKeys = new Set(kindColumns.map(c => c.key))
     const extras = filterHostExtras(extraLeadingColumns, builtinKeys, selectedKind.name)
@@ -3835,18 +3879,32 @@ export function ResourcesView({
       // discard the stale save and use the specialized columns instead. User-added
       // custom columns mean the blob isn't a stale pure-defaults save — keep it, or
       // the migration would clear them from storage (and un-hide hidden ones).
+      // Persisted JSON: only an array of keys is usable, anything else reads as
+      // no record at all.
+      const savedKnown = Array.isArray(saved.known)
+        ? saved.known.filter((k): k is string => typeof k === 'string')
+        : undefined
+      for (const k of savedKnown ?? []) knownColumnKeys.current.add(k)
+
       const defaultKeys = DEFAULT_COLUMNS.map(c => c.key)
+      // A blob carrying an offered-key record is not a pre-curation leftover:
+      // its visible set matching the generic defaults means the user hid their
+      // way down to them, and clearing it would undo exactly that.
       const isStaleDefaults = kindColumns !== DEFAULT_COLUMNS &&
+        !savedKnown &&
         !savedCustom.length &&
         saved.visible.length === defaultKeys.length &&
         saved.visible.every(v => defaultKeys.includes(v))
       if (isStaleDefaults) {
         clearColumnSettings(selectedKind.name, selectedKind.group)
+        knownColumnKeys.current = new Set()
         hadSavedColumnSettings.current = false
         setVisibleColumns(getDefaultVisibleColumns(effective))
         setColumnWidths({})
       } else {
-        setVisibleColumns(mergeSavedVisibleColumns(saved.visible, extraKeys, builtPrinterColumns))
+        setVisibleColumns(mergeSavedVisibleColumns(
+          saved.visible, extraKeys, builtPrinterColumns, effective, savedKnown,
+        ))
         setColumnWidths(saved.widths || {})
       }
     } else {
@@ -3862,6 +3920,7 @@ export function ResourcesView({
   // Save column settings when they change (skip the initial load of each kind)
   useEffect(() => {
     if (visibleColumns.size === 0) return // not loaded yet
+    for (const k of allColumnKeys) knownColumnKeys.current.add(k)
     if (!isColumnSettingsLoaded.current) {
       isColumnSettingsLoaded.current = true
       return
@@ -3870,11 +3929,13 @@ export function ResourcesView({
       visible: Array.from(visibleColumns),
       widths: columnWidths,
       custom: customColumns,
+      known: Array.from(knownColumnKeys.current),
     })
     // A persisted blob blocks GPU auto-show from here on — same rule in-session
     // as across sessions, so a later data refresh can't override user choices.
     hadSavedColumnSettings.current = true
-  }, [visibleColumns, columnWidths, customColumns, selectedKind.name, selectedKind.group])
+    // allColumnKeysSig, not allColumnKeys: see the memo above.
+  }, [visibleColumns, columnWidths, customColumns, selectedKind.name, selectedKind.group, allColumnKeysSig])
 
   // Close column picker on outside click or Escape
   useEffect(() => {
@@ -3977,6 +4038,7 @@ export function ResourcesView({
   // Reset column settings to defaults (also drops user-added custom columns)
   const resetColumnSettings = useCallback(() => {
     clearColumnSettings(selectedKind.name, selectedKind.group)
+    knownColumnKeys.current = new Set()
     setCustomColumns([])
     const customKeys = new Set(builtCustomColumns.map(c => c.key))
     setVisibleColumns(getDefaultVisibleColumns(allColumns.filter(c => !customKeys.has(c.key))))
@@ -8899,11 +8961,11 @@ function RouteCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
     case 'status': {
       const status = getRouteStatus(resource)
-      return (
-        <span className={clsx('badge', status.color)}>
-          {status.text}
-        </span>
-      )
+      const reason = getRouteStatusReason(resource)
+      const badge = <span className={clsx('badge', status.color)}>{status.text}</span>
+      // "Degraded" on its own says something is wrong and not what. The
+      // controller's own reason is usually "the backend you named is missing".
+      return reason ? <Tooltip content={reason}>{badge}</Tooltip> : badge
     }
     case 'hostnames': {
       const hostnames = getRouteHostnames(resource)