@skyhook-io/k8s-ui 1.14.1 → 1.14.2

package/src/components/resources/column-settings-merge.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest'
+import { mergeSavedVisibleColumns, type Column, type ExtraColumn } from './ResourcesView'
+
+// A saved blob records only what is VISIBLE, so a curated key's absence is
+// ambiguous: the user hid it, or it did not exist when they saved. `known` — the
+// key set they were offered at save time — is what separates the two. Without
+// it, every column added to a curated kind is invisible to anyone who has ever
+// touched that kind's column picker.
+
+const col = (key: string, defaultVisible?: boolean): Column =>
+  defaultVisible === undefined ? { key, label: key } : { key, label: key, defaultVisible }
+
+const printer = (key: string, defaultVisible?: boolean): ExtraColumn =>
+  ({ ...col(key, defaultVisible), render: () => null })
+
+describe('mergeSavedVisibleColumns', () => {
+  it('shows a curated column added since the blob was written', () => {
+    const effective = [col('name'), col('status'), col('lastSuccess')]
+    const got = mergeSavedVisibleColumns(['name', 'status'], [], [], effective, ['name', 'status'])
+    expect(got.has('lastSuccess')).toBe(true)
+  })
+
+  it('keeps a column the user actually hid hidden', () => {
+    // 'status' was offered and is absent from visible — a deliberate hide.
+    const effective = [col('name'), col('status')]
+    const got = mergeSavedVisibleColumns(['name'], [], [], effective, ['name', 'status'])
+    expect(got.has('status')).toBe(false)
+  })
+
+  it('respects defaultVisible:false on a newly added column', () => {
+    const effective = [col('name'), col('podIP', false)]
+    const got = mergeSavedVisibleColumns(['name'], [], [], effective, ['name'])
+    expect(got.has('podIP')).toBe(false)
+  })
+
+  it('leaves blobs written before `known` on the old behaviour', () => {
+    // No record of what was offered, so absence stays ambiguous and we don't
+    // guess — the next save adopts the current set as the baseline.
+    const effective = [col('name'), col('status'), col('lastSuccess')]
+    const got = mergeSavedVisibleColumns(['name', 'status'], [], [], effective, undefined)
+    expect(got.has('lastSuccess')).toBe(false)
+    expect(Array.from(got).sort()).toEqual(['name', 'status'])
+  })
+
+  it('does nothing without the effective column set', () => {
+    const got = mergeSavedVisibleColumns(['name'], [], [], undefined, ['name'])
+    expect(Array.from(got)).toEqual(['name'])
+  })
+
+  it('still seeds host extras unconditionally', () => {
+    const got = mergeSavedVisibleColumns(['name'], ['cluster'], [], [col('name')], ['name'])
+    expect(got.has('cluster')).toBe(true)
+  })
+
+  it('still seeds printer columns only when the blob names none', () => {
+    const cols = [printer('printer:Phase'), printer('printer:Ready')]
+    expect(mergeSavedVisibleColumns(['name'], [], cols).has('printer:Phase')).toBe(true)
+    // Once the blob names one, the user has seen the set — absence is a hide.
+    expect(mergeSavedVisibleColumns(['name', 'printer:Ready'], [], cols).has('printer:Phase')).toBe(false)
+  })
+
+  it('does not re-show a hidden printer column when known predates the printer table', () => {
+    // Printer columns are fetched, so `known` can be written during the window
+    // before the table arrives — listing curated keys only. Treating their
+    // absence as "not offered yet" would un-hide one the user had hidden.
+    const cols = [printer('printer:Phase'), printer('printer:Ready')]
+    const effective = [col('name'), ...cols]
+    const got = mergeSavedVisibleColumns(
+      ['name', 'printer:Phase'], [], cols, effective,
+      ['name'], // written before the printer table loaded
+    )
+    expect(got.has('printer:Ready')).toBe(false)
+    expect(got.has('printer:Phase')).toBe(true)
+  })
+
+  it('treats a persisted known that is not an array as no record at all', () => {
+    // The blob is untyped JSON and can be corrupted or hand-edited; a throw
+    // here would abort the load effect and strand the table's column state.
+    const effective = [col('name'), col('status')]
+    const call = () => mergeSavedVisibleColumns(['name'], [], [], effective, {} as unknown as string[])
+    expect(call).not.toThrow()
+    expect(call().has('status')).toBe(false)
+  })
+
+  it('keeps a column hidden after the offered set shrinks and grows again', () => {
+    // Uncurated kinds offer a generic Status until their printer columns arrive,
+    // and stop offering it afterwards. If the record were replaced on each save
+    // rather than accumulated, that second save would forget Status was ever
+    // offered — and a later load without printer data would read the user's
+    // hide as "never shown" and undo it.
+    const known = ['name', 'namespace', 'status', 'age', 'printer:Phase']
+    const effective = [col('name'), col('namespace'), col('status'), col('age')]
+    const got = mergeSavedVisibleColumns(['name', 'namespace', 'age'], [], [], effective, known)
+    expect(got.has('status')).toBe(false)
+  })
+
+  it('seeds a new curated column alongside printer columns without disturbing them', () => {
+    const cols = [printer('printer:Phase')]
+    const effective = [col('name'), col('lastSuccess'), printer('printer:Phase')]
+    const got = mergeSavedVisibleColumns(['name', 'printer:Phase'], [], cols, effective, ['name', 'printer:Phase'])
+    expect(got.has('lastSuccess')).toBe(true)
+    expect(got.has('printer:Phase')).toBe(true)
+  })
+})

package/src/components/resources/istio-gateway-filter.test.ts

@@ -13,13 +13,15 @@ describe('Istio Gateway filter values', () => {
     const tls = gateway({ servers: [{ port: { number: 443 }, tls: { mode: 'SIMPLE' } }] })
     const plain = gateway({ servers: [{ port: { number: 80 } }] })
     const none = gateway({ servers: [] })
-    expect(getCellFilterValue(tls, 'status', 'istiogateways')).toBe('TLS')
-    expect(getCellFilterValue(plain, 'status', 'istiogateways')).toBe('Active')
+    // TLS and plain share a verdict: neither says whether the gateway's
+    // selector resolves to a running pod, which is what a status column claims.
+    expect(getCellFilterValue(tls, 'status', 'istiogateways')).toBe('Defined')
+    expect(getCellFilterValue(plain, 'status', 'istiogateways')).toBe('Defined')
     expect(getCellFilterValue(none, 'status', 'istiogateways')).toBe('No Servers')
   })
 
   // Read as a Gateway API Gateway instead, the same object filters as
-  // "Unknown" — a value that appears on no row, since the cell shows Active.
+  // "Unknown" — a value that appears on no row, since the cell shows Defined.
   // That divergence is what routing the normalized key fixes.
   it('diverges from the row when read under the Gateway API key', () => {
     const g = gateway({ servers: [{ port: { number: 80 } }] })

package/src/components/resources/istio-policy-accessors.test.ts

@@ -0,0 +1,193 @@
+import { describe, expect, it } from 'vitest'
+import {
+  getAuthorizationPolicySelectorString,
+  getAuthorizationPolicyStatus,
+  getDestinationRuleStatus,
+  getAuthorizationPolicyRuleNotice,
+  getDestinationRuleTlsMode,
+} from './resource-utils-istio'
+
+// A request decision is made across every policy selecting a workload, so no
+// single object can establish it. These pin the line between what one policy
+// declares and what the mesh actually does.
+
+describe('getAuthorizationPolicyStatus', () => {
+  it('marks the deny-all idiom rather than presenting it as permitted', () => {
+    // `spec: {}` is Istio's documented deny-all: action defaults to ALLOW, and
+    // rules are alternatives, so zero of them match nothing.
+    expect(getAuthorizationPolicyStatus({ spec: {} })).toMatchObject({
+      text: 'No allow rules', level: 'degraded',
+    })
+  })
+
+  it('treats an explicit rule-less ALLOW the same as the defaulted one', () => {
+    expect(getAuthorizationPolicyStatus({ spec: { action: 'ALLOW', rules: [] } })).toMatchObject({
+      text: 'No allow rules', level: 'degraded',
+    })
+  })
+
+  it('does not call a DENY doing its job unhealthy', () => {
+    expect(getAuthorizationPolicyStatus({ spec: { action: 'DENY', rules: [{}] } })).toMatchObject({
+      text: 'Deny (1 rule)', level: 'neutral',
+    })
+  })
+
+  it('does not present an ALLOW with rules as proof anything is permitted', () => {
+    expect(getAuthorizationPolicyStatus({ spec: { action: 'ALLOW', rules: [{}, {}] } })).toMatchObject({
+      text: 'Allow (2 rules)', level: 'neutral',
+    })
+  })
+
+  it('keeps AUDIT and CUSTOM neutral — neither blocks nor permits on its own', () => {
+    expect(getAuthorizationPolicyStatus({ spec: { action: 'AUDIT', rules: [{}] } }).level).toBe('neutral')
+    expect(getAuthorizationPolicyStatus({ spec: { action: 'CUSTOM', rules: [{}] } }).level).toBe('neutral')
+  })
+
+  it('does not claim to recognise an unknown action', () => {
+    expect(getAuthorizationPolicyStatus({ spec: { action: 'FUTURE' } })).toMatchObject({
+      text: 'FUTURE', level: 'unknown',
+    })
+  })
+})
+
+describe('getAuthorizationPolicySelectorString', () => {
+  it('reports a targetRef attachment instead of claiming namespace scope', () => {
+    // Waypoint and Gateway attachment in ambient mode uses targetRefs, not
+    // labels; reading only the selector called these namespace-wide.
+    const p = {
+      metadata: { namespace: 'prod' },
+      spec: { targetRefs: [{ kind: 'Gateway', name: 'waypoint' }] },
+    }
+    expect(getAuthorizationPolicySelectorString(p)).toBe('Gateway/waypoint')
+  })
+
+  it('qualifies a target naming another namespace', () => {
+    // Rendering only — supported attachments are same-namespace, so this
+    // records what the cell shows, not that the attachment would be enforced.
+    const p = {
+      metadata: { namespace: 'prod' },
+      spec: { targetRef: { kind: 'Gateway', name: 'shared', namespace: 'infra' } },
+    }
+    expect(getAuthorizationPolicySelectorString(p)).toBe('infra/Gateway/shared')
+  })
+
+  it('lists every target', () => {
+    const p = {
+      metadata: { namespace: 'prod' },
+      spec: { targetRefs: [{ kind: 'Gateway', name: 'a' }, { kind: 'Service', name: 'b' }] },
+    }
+    expect(getAuthorizationPolicySelectorString(p)).toBe('Gateway/a, Service/b')
+  })
+
+  it('falls back to selector labels', () => {
+    const p = { metadata: { namespace: 'prod' }, spec: { selector: { matchLabels: { app: 'api' } } } }
+    expect(getAuthorizationPolicySelectorString(p)).toBe('app=api')
+  })
+
+  it('names both possible scopes when neither is declared', () => {
+    // Which one applies depends on MeshConfig.rootNamespace, which this object
+    // cannot see — and the root namespace is configurable, so the conventional
+    // name is not evidence.
+    expect(getAuthorizationPolicySelectorString({ metadata: { namespace: 'istio-system' }, spec: {} }))
+      .toBe('Namespace / mesh scope')
+  })
+})
+
+describe('getDestinationRuleStatus', () => {
+  it('flags a rule that applies to nothing', () => {
+    expect(getDestinationRuleStatus({ spec: {} })).toMatchObject({ text: 'No Host', level: 'unhealthy' })
+  })
+
+  it('does not restate the subset count as a health verdict', () => {
+    expect(getDestinationRuleStatus({ spec: { host: 'api', subsets: [{ name: 'v1' }, { name: 'v2' }] } }))
+      .toMatchObject({ text: 'Not assessed', level: 'unknown' })
+  })
+
+  it('does not read a declared traffic policy as working', () => {
+    expect(getDestinationRuleStatus({ spec: { host: 'api', trafficPolicy: { tls: { mode: 'ISTIO_MUTUAL' } } } }))
+      .toMatchObject({ text: 'Not assessed', level: 'unknown' })
+  })
+})
+
+describe('getDestinationRuleTlsMode', () => {
+  it('surfaces a declared DISABLE, whose outcome depends on the server policy', () => {
+    // Against a PERMISSIVE PeerAuthentication this sends unencrypted traffic;
+    // against a STRICT one the requests fail. The row shows neither.
+    expect(getDestinationRuleTlsMode({ spec: { host: 'api', trafficPolicy: { tls: { mode: 'DISABLE' } } } }))
+      .toBe('DISABLE')
+  })
+
+  it('shows the declared mode when one is set', () => {
+    expect(getDestinationRuleTlsMode({ spec: { trafficPolicy: { tls: { mode: 'ISTIO_MUTUAL' } } } }))
+      .toBe('ISTIO_MUTUAL')
+  })
+
+  it('reports nothing declared rather than inventing a default', () => {
+    expect(getDestinationRuleTlsMode({ spec: { host: 'api' } })).toBe('-')
+    expect(getDestinationRuleTlsMode({ spec: { host: 'api', trafficPolicy: {} } })).toBe('-')
+  })
+})
+
+describe('getAuthorizationPolicyRuleNotice', () => {
+  it('does not claim an empty DENY blocks anything', () => {
+    // "If not set, the match will never occur" — a DENY with no rules matches
+    // nothing and denies nothing. Calling it Deny All is the dangerous
+    // direction: it tells an operator an ineffective policy protects them.
+    for (const spec of [{ action: 'DENY' }, { action: 'DENY', rules: [] }]) {
+      const notice = getAuthorizationPolicyRuleNotice({ spec })
+      expect(notice).toMatchObject({ level: 'info', title: 'No deny rules' })
+      expect(notice!.message).not.toMatch(/denies all/i)
+    }
+  })
+
+  it('explains an unconditional DENY, which no ALLOW can carve an exception from', () => {
+    // rules: [{}] matches every request. DENY is evaluated before ALLOW, so
+    // this is not a baseline with exceptions — it blocks everything it selects.
+    const notice = getAuthorizationPolicyRuleNotice({ spec: { action: 'DENY', rules: [{}] } })
+    expect(notice).toMatchObject({ level: 'info', title: 'Matches all requests' })
+  })
+
+  it('recognises a blanket DENY written with empty condition lists', () => {
+    // from: [] / to: [] / when: [] serialize as present but impose nothing, so
+    // the rule still matches every request the policy selects.
+    for (const rule of [{ from: [] }, { to: [] }, { when: [] }, { from: [], to: [], when: [] }]) {
+      expect(getAuthorizationPolicyRuleNotice({ spec: { action: 'DENY', rules: [rule] } }))
+        .toMatchObject({ title: 'Matches all requests' })
+    }
+  })
+
+  it('does not read an unrecognised rule field as unconditional', () => {
+    // A future condition type must not be mistaken for the absence of one.
+    expect(getAuthorizationPolicyRuleNotice({ spec: { action: 'DENY', rules: [{ someFutureMatcher: [{}] }] } }))
+      .toBeNull()
+  })
+
+  it('stays quiet on a DENY whose rules have conditions', () => {
+    expect(getAuthorizationPolicyRuleNotice({
+      spec: { action: 'DENY', rules: [{ from: [{ source: { namespaces: ['dev'] } }] }] },
+    })).toBeNull()
+  })
+
+  it('does not flag an unconditional ALLOW the same way', () => {
+    // An ALLOW matching everything is permissive, not a blanket block.
+    expect(getAuthorizationPolicyRuleNotice({ spec: { action: 'ALLOW', rules: [{}] } })).toBeNull()
+  })
+
+  it('warns on a rule-less ALLOW without asserting an outage', () => {
+    for (const spec of [{}, { action: 'ALLOW', rules: [] }]) {
+      const notice = getAuthorizationPolicyRuleNotice({ spec })
+      expect(notice).toMatchObject({ level: 'warning', title: 'No allow rules' })
+      expect(notice!.message).toMatch(/may still permit/i)
+      expect(notice!.message).not.toMatch(/no traffic is allowed/i)
+    }
+  })
+
+  it('stays quiet when the policy has rules', () => {
+    expect(getAuthorizationPolicyRuleNotice({ spec: { action: 'ALLOW', rules: [{}] } })).toBeNull()
+  })
+
+  it('does not editorialise about AUDIT or CUSTOM', () => {
+    expect(getAuthorizationPolicyRuleNotice({ spec: { action: 'AUDIT' } })).toBeNull()
+    expect(getAuthorizationPolicyRuleNotice({ spec: { action: 'CUSTOM' } })).toBeNull()
+  })
+})

package/src/components/resources/renderers/IstioAuthorizationPolicyRenderer.tsx

@@ -1,19 +1,13 @@
 import { Shield } from 'lucide-react'
 import { Section, PropertyList, Property, ConditionsSection, AlertBanner, KeyValueBadgeList } from '../../ui/drawer-components'
-import { Badge, type BadgeSeverity } from '../../ui/Badge'
+import { Badge } from '../../ui/Badge'
 import {
   getAuthorizationPolicyAction,
   getAuthorizationPolicyRules,
+  getAuthorizationPolicyRuleNotice,
   getAuthorizationPolicySelector,
 } from '../resource-utils-istio'
 
-const actionSeverity: Record<string, BadgeSeverity> = {
-  ALLOW: 'success',
-  DENY: 'error',
-  CUSTOM: 'info',
-  AUDIT: 'warning',
-}
-
 interface IstioAuthorizationPolicyRendererProps {
   data: any
 }
@@ -24,25 +18,18 @@ export function IstioAuthorizationPolicyRenderer({ data }: IstioAuthorizationPol
   const selector = getAuthorizationPolicySelector(data)
   const hasSelector = Object.keys(selector).length > 0
 
-  // Special case: DENY with no rules = deny all
-  const isDenyAll = action === 'DENY' && rules.length === 0
-  // Special case: ALLOW with no rules = allow nothing (deny all)
-  const isAllowNothing = action === 'ALLOW' && rules.length === 0 && !data.spec?.rules
+  const ruleNotice = getAuthorizationPolicyRuleNotice(data)
+  // The action badge is uniformly neutral: an action is a declaration, not a
+  // verdict. A green ALLOW would make a deny-all policy look healthiest, and a
+  // red DENY would make a control doing its job look failed.
 
   return (
     <>
-      {isDenyAll && (
-        <AlertBanner
-          variant="error"
-          title="Deny All"
-          message="This policy denies all traffic to the target workload (DENY action with no rules)."
-        />
-      )}
-      {isAllowNothing && (
+      {ruleNotice && (
         <AlertBanner
-          variant="warning"
-          title="Allow Nothing"
-          message="This policy has ALLOW action but no rules, which means no traffic is allowed."
+          variant={ruleNotice.level}
+          title={ruleNotice.title}
+          message={ruleNotice.message}
         />
       )}
 
@@ -50,7 +37,7 @@ export function IstioAuthorizationPolicyRenderer({ data }: IstioAuthorizationPol
       <Section title="Authorization Policy" icon={Shield} defaultExpanded>
         <PropertyList>
           <Property label="Action" value={
-            <Badge severity={actionSeverity[action] ?? 'neutral'}>
+            <Badge severity="neutral">
               {action}
             </Badge>
           } />

package/src/components/resources/renderers/eso-cells.tsx

@@ -6,7 +6,6 @@ import {
   getExternalSecretStore,
   getExternalSecretRefreshInterval,
   getExternalSecretLastSync,
-  getExternalSecretProvider,
   getClusterExternalSecretStatus,
   getClusterExternalSecretNamespaceCount,
   getClusterExternalSecretFailedCount,
@@ -33,10 +32,6 @@ export function ExternalSecretCell({ resource, column }: { resource: any; column
         </span>
       )
     }
-    case 'provider': {
-      const provider = getExternalSecretProvider(resource)
-      return <span className="text-sm text-theme-text-secondary truncate block">{provider}</span>
-    }
     case 'refreshInterval': {
       const interval = getExternalSecretRefreshInterval(resource)
       return <span className="text-sm text-theme-text-secondary">{interval}</span>

package/src/components/resources/renderers/istio-cells.tsx

@@ -2,6 +2,7 @@
 
 import { clsx } from 'clsx'
 import { Badge, type BadgeSeverity } from '../../ui/Badge'
+import { Tooltip } from '../../ui/Tooltip'
 import {
   getVirtualServiceStatus,
   getVirtualServiceHosts,
@@ -11,19 +12,19 @@ import {
   getDestinationRuleHost,
   getDestinationRuleSubsetCount,
   getDestinationRuleLoadBalancer,
+  getDestinationRuleTlsMode,
   getIstioGatewayStatus,
   getIstioGatewayServerCount,
   getIstioGatewaySelectorString,
-  getServiceEntryStatus,
   getServiceEntryHosts,
   getServiceEntryLocation,
   getServiceEntryPortsString,
-  getPeerAuthenticationStatus,
   getPeerAuthenticationMode,
   getPeerAuthenticationSelectorString,
   getAuthorizationPolicyStatus,
   getAuthorizationPolicyAction,
   getAuthorizationPolicyRuleCount,
+  getAuthorizationPolicySelectorString,
 } from '../resource-utils-istio'
 
 const modeSeverity: Record<string, BadgeSeverity> = {
@@ -32,13 +33,6 @@ const modeSeverity: Record<string, BadgeSeverity> = {
   DISABLE: 'error',
 }
 
-const actionSeverity: Record<string, BadgeSeverity> = {
-  ALLOW: 'success',
-  DENY: 'error',
-  CUSTOM: 'info',
-  AUDIT: 'warning',
-}
-
 export function VirtualServiceCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
     case 'status': {
@@ -88,6 +82,13 @@ export function DestinationRuleCell({ resource, column }: { resource: any; colum
       const lb = getDestinationRuleLoadBalancer(resource)
       return <span className="text-sm text-theme-text-secondary">{lb}</span>
     }
+    case 'tlsMode': {
+      // Every mode reads neutral: this is the rule's declaration, not the
+      // posture in force. What a DISABLE produces depends on the server's
+      // PeerAuthentication — unencrypted traffic, or failed requests.
+      const mode = getDestinationRuleTlsMode(resource)
+      return <span className="text-sm text-theme-text-secondary">{mode}</span>
+    }
     default:
       return <span className="text-sm text-theme-text-tertiary">-</span>
   }
@@ -118,14 +119,6 @@ export function IstioGatewayCell({ resource, column }: { resource: any; column:
 
 export function ServiceEntryCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
-    case 'status': {
-      const status = getServiceEntryStatus(resource)
-      return (
-        <span className={clsx('badge', status.color)}>
-          {status.text}
-        </span>
-      )
-    }
     case 'hosts': {
       const hosts = getServiceEntryHosts(resource)
       return <span className="text-sm text-theme-text-secondary truncate block">{hosts}</span>
@@ -149,14 +142,6 @@ export function ServiceEntryCell({ resource, column }: { resource: any; column:
 
 export function PeerAuthenticationCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
-    case 'status': {
-      const status = getPeerAuthenticationStatus(resource)
-      return (
-        <span className={clsx('badge', status.color)}>
-          {status.text}
-        </span>
-      )
-    }
     case 'mode': {
       const mode = getPeerAuthenticationMode(resource)
       return (
@@ -186,16 +171,41 @@ export function AuthorizationPolicyCell({ resource, column }: { resource: any; c
     }
     case 'action': {
       const action = getAuthorizationPolicyAction(resource)
+      // Uniformly neutral: an action is a declaration, not a verdict. A green
+      // ALLOW would make a deny-all policy look healthiest, and a red DENY
+      // would make a control doing its job look failed.
       return (
-        <Badge severity={actionSeverity[action] ?? 'neutral'}>
+        <Badge severity="neutral">
           {action}
         </Badge>
       )
     }
     case 'rules': {
       const count = getAuthorizationPolicyRuleCount(resource)
+      // Rules are alternatives, so an ALLOW with none of them matches nothing —
+      // Istio's deny-all idiom. This is the default-visible cell that carries
+      // the warning; the Status column is off by default.
+      const allowsNothing = count === 0 && (resource.spec?.action || 'ALLOW') === 'ALLOW'
+      // Amber on the count itself: it fits the column and reads at a glance
+      // against grey neighbours. The explanation rides on the badge so it does
+      // not depend on finding the column header's tooltip.
+      if (allowsNothing) {
+        return (
+          <Tooltip content="Rules are alternatives, so this ALLOW policy matches nothing and permits no traffic on its own. Other ALLOW policies selecting the same workload may still permit requests.">
+            <Badge severity="warning">0</Badge>
+          </Tooltip>
+        )
+      }
       return <span className="text-sm text-theme-text-secondary">{count}</span>
     }
+    case 'selector': {
+      const scope = getAuthorizationPolicySelectorString(resource)
+      return (
+        <Tooltip content={scope}>
+          <span className="text-sm text-theme-text-secondary truncate block">{scope}</span>
+        </Tooltip>
+      )
+    }
     default:
       return <span className="text-sm text-theme-text-tertiary">-</span>
   }

package/src/components/resources/renderers/kueue-cells.tsx

@@ -15,7 +15,6 @@ import {
   getKueueWorkloadQueueName,
   getKueueWorkloadAdmittedBy,
   getKueueWorkloadPriority,
-  getResourceFlavorStatus,
   getResourceFlavorNodeLabelCount,
   getResourceFlavorTaintCount,
   getAdmissionCheckStatus,
@@ -112,14 +111,6 @@ export function KueueWorkloadCell({ resource, column }: { resource: any; column:
 
 export function ResourceFlavorCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
-    case 'status': {
-      const status = getResourceFlavorStatus(resource)
-      return (
-        <span className={clsx('badge', status.color)}>
-          {status.text}
-        </span>
-      )
-    }
     case 'nodeLabels': {
       const count = getResourceFlavorNodeLabelCount(resource)
       return <span className="text-sm text-theme-text-secondary">{count > 0 ? count : '-'}</span>

package/src/components/resources/renderers/kyverno-cells.tsx

@@ -73,7 +73,7 @@ export function KyvernoPolicyCell({ resource, column }: { resource: any; column:
     case 'status': {
       const status = getKyvernoPolicyStatus(resource)
       return (
-        <span className={clsx('badge', status.color)}>
+        <span className={clsx('badge truncate max-w-full', status.color)} title={status.text}>
           {status.text}
         </span>
       )

package/src/components/resources/renderers/prometheus-cells.tsx

@@ -19,7 +19,7 @@ export function ServiceMonitorCell({ resource, column }: { resource: any; column
     case 'status': {
       const status = getServiceMonitorStatus(resource)
       return (
-        <span className={clsx('badge', status.color)}>
+        <span className={clsx('badge truncate max-w-full', status.color)} title={status.text}>
           {status.text}
         </span>
       )
@@ -40,7 +40,7 @@ export function PrometheusRuleCell({ resource, column }: { resource: any; column
     case 'status': {
       const status = getPrometheusRuleStatus(resource)
       return (
-        <span className={clsx('badge', status.color)}>
+        <span className={clsx('badge truncate max-w-full', status.color)} title={status.text}>
           {status.text}
         </span>
       )
@@ -59,7 +59,7 @@ export function PodMonitorCell({ resource, column }: { resource: any; column: st
     case 'status': {
       const status = getPodMonitorStatus(resource)
       return (
-        <span className={clsx('badge', status.color)}>
+        <span className={clsx('badge truncate max-w-full', status.color)} title={status.text}>
           {status.text}
         </span>
       )

package/src/components/resources/renderers/ray-cells.tsx

@@ -15,7 +15,7 @@ import {
   getRayServiceClusters,
   getRayCronJobStatus,
   getRayCronJobSchedule,
-  getRayCronJobSuspend,
+  getRayCronJobTimeZone,
   getRayCronJobLastSchedule,
 } from '../resource-utils-ray'
 
@@ -110,9 +110,17 @@ export function RayCronJobCell({ resource, column }: { resource: any; column: st
       const schedule = getRayCronJobSchedule(resource)
       return <span className="text-sm font-mono text-theme-text-secondary">{schedule}</span>
     }
-    case 'suspend': {
-      const suspended = getRayCronJobSuspend(resource)
-      return <span className="text-sm text-theme-text-secondary">{suspended ? 'Yes' : 'No'}</span>
+    case 'timeZone': {
+      const zone = getRayCronJobTimeZone(resource)
+      const declared = Boolean(resource.spec?.timeZone)
+      return (
+        <span
+          className={clsx('text-sm truncate block', declared ? 'text-theme-text-secondary' : 'text-theme-text-tertiary')}
+          title={zone}
+        >
+          {zone}
+        </span>
+      )
     }
     case 'lastSchedule': {
       const lastSchedule = getRayCronJobLastSchedule(resource)

package/src/components/resources/renderers/volcano-cells.tsx

@@ -16,7 +16,6 @@ import {
   getVolcanoPodGroupMinMember,
   getJobFlowStatus,
   getJobFlowFlowCount,
-  getJobTemplateStatus,
   getJobTemplateTaskCount,
 } from '../resource-utils-volcano'
 
@@ -122,14 +121,6 @@ export function JobFlowCell({ resource, column }: { resource: any; column: strin
 
 export function JobTemplateCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
-    case 'status': {
-      const status = getJobTemplateStatus(resource)
-      return (
-        <span className={clsx('badge', status.color)}>
-          {status.text}
-        </span>
-      )
-    }
     case 'tasks': {
       const count = getJobTemplateTaskCount(resource)
       return <span className="text-sm text-theme-text-secondary">{count > 0 ? count : '-'}</span>

package/src/components/resources/resource-utils-cnpg.ts

@@ -646,6 +646,11 @@ export function getCNPGObjectStoreStatus(resource: any): StatusBadge {
   if (windows.some((w) => w.failingSinceLastSuccess)) {
     return { text: 'Backups Failing', color: healthColors.unhealthy, level: 'unhealthy' }
   }
+  // Every timestamp on a recovery window is optional, so a server can be listed
+  // with no recovery point at all. The entry existing is not a backup existing.
+  if (!windows.some((w) => w.firstRecoverabilityPoint || w.lastSuccessfulBackupTime)) {
+    return { text: 'No recovery point', color: healthColors.unknown, level: 'unknown' }
+  }
   return { text: 'Recoverable', color: healthColors.healthy, level: 'healthy' }
 }