@skyhook-io/k8s-ui 1.14.1 → 1.14.2

package/src/components/resources/resource-utils-eso.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+import { getSecretStoreProviderType, getSecretStoreProviderKey } from './resource-utils-eso'
+
+// The provider label answers "which backend holds these secrets?", so it has to
+// track the upstream `spec.provider` field names rather than plausible ones.
+
+describe('getSecretStoreProviderType', () => {
+  it('names the AWS product rather than assuming Secrets Manager', () => {
+    // One `aws` key addresses three services; `service` is required and is the
+    // only thing that distinguishes them.
+    const forService = (service: string) =>
+      getSecretStoreProviderType({ spec: { provider: { aws: { service, region: 'us-east-1' } } } })
+
+    expect(forService('SecretsManager')).toBe('AWS Secrets Manager')
+    expect(forService('ParameterStore')).toBe('AWS Parameter Store')
+    expect(forService('CertificateManager')).toBe('AWS Certificate Manager')
+  })
+
+  it('falls back to the vendor when an AWS store declares no service', () => {
+    // Invalid per the CRD, but naming a product we cannot confirm is worse than
+    // naming only the vendor.
+    expect(getSecretStoreProviderType({ spec: { provider: { aws: {} } } })).toBe('AWS')
+  })
+
+  it('recognises Bitwarden under its real field name', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { bitwardensecretsmanager: {} } } }))
+      .toBe('Bitwarden Secrets Manager')
+  })
+
+  it('labels providers added after the map was first written', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { openBao: {} } } })).toBe('OpenBao')
+    expect(getSecretStoreProviderType({ spec: { provider: { conjur: {} } } })).toBe('CyberArk Conjur')
+  })
+
+  it('keeps v1beta1-only providers, which v1 clusters never send', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { device42: {} } } })).toBe('Device42')
+  })
+
+  it('shows the raw key rather than Unknown for an unrecognised provider', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { somefutureprovider: {} } } }))
+      .toBe('somefutureprovider')
+  })
+
+  it('reports nothing when there is no provider at all', () => {
+    expect(getSecretStoreProviderType({ spec: {} })).toBe('Unknown')
+  })
+})
+
+describe('getSecretStoreProviderKey', () => {
+  it('stays at the vendor level, which is what the badge colours by', () => {
+    const key = (service: string) =>
+      getSecretStoreProviderKey({ spec: { provider: { aws: { service } } } })
+    expect(key('SecretsManager')).toBe('aws')
+    expect(key('ParameterStore')).toBe('aws')
+  })
+})

package/src/components/resources/resource-utils-eso.ts

@@ -7,33 +7,63 @@ import { healthColors, formatAge } from './resource-utils'
 // PROVIDER DETECTION
 // ============================================================================
 
+// Keys are the SecretStore `spec.provider` field names. v1 and v1beta1 do not
+// carry the same set, so entries dropped upstream (device42, alibaba) stay for
+// clusters still serving v1beta1.
 const PROVIDER_MAP: Record<string, string> = {
-  aws: 'AWS Secrets Manager',
+  aws: 'AWS',
   azurekv: 'Azure Key Vault',
   gcpsm: 'GCP Secret Manager',
   vault: 'HashiCorp Vault',
+  openBao: 'OpenBao',
   kubernetes: 'Kubernetes',
+  crd: 'Kubernetes Resource',
   oracle: 'Oracle Vault',
   ibm: 'IBM Secrets Manager',
+  alibaba: 'Alibaba Cloud KMS',
+  ovh: 'OVHcloud Secret Manager',
+  volcengine: 'Volcengine',
+  cloudrusm: 'Cloud.ru Secret Manager',
+  nebiusmysterybox: 'Nebius Mysterybox',
+  barbican: 'OpenStack Barbican',
+  yandexlockbox: 'Yandex Lockbox',
+  yandexcertificatemanager: 'Yandex Certificate Manager',
   doppler: 'Doppler',
   onepassword: '1Password',
+  onepasswordSDK: '1Password',
+  bitwardensecretsmanager: 'Bitwarden Secrets Manager',
   senhasegura: 'senhasegura',
+  github: 'GitHub',
   gitlab: 'GitLab',
   webhook: 'Webhook',
   fake: 'Fake',
   keepersecurity: 'Keeper Security',
   scaleway: 'Scaleway',
-  delinea: 'Delinea',
+  conjur: 'CyberArk Conjur',
+  delinea: 'Delinea DevOps Secrets Vault',
+  secretserver: 'Delinea Secret Server',
+  beyondtrust: 'BeyondTrust',
+  beyondtrustworkloadcredentials: 'BeyondTrust Workload Credentials',
   chef: 'Chef',
   pulumi: 'Pulumi ESC',
   fortanix: 'Fortanix',
   passworddepot: 'Password Depot',
+  passbolt: 'Passbolt',
+  previder: 'Previder',
+  onboardbase: 'Onboardbase',
+  dvls: 'Devolutions Server',
   device42: 'Device42',
   akeyless: 'Akeyless',
-  beyondtrust: 'BeyondTrust',
   infisical: 'Infisical',
-  passbolt: 'Passbolt',
-  bitwarden: 'Bitwarden',
+  ngrok: 'ngrok',
+}
+
+// A single `aws` key addresses three unrelated AWS products; `service` is a
+// required enum and is the only thing that says which one holds the secrets.
+const AWS_SERVICE_LABELS: Record<string, string> = {
+  SecretsManager: 'AWS Secrets Manager',
+  ParameterStore: 'AWS Parameter Store',
+  CertificateManager: 'AWS Certificate Manager',
 }
 
 /**
@@ -44,6 +74,8 @@ export function getSecretStoreProviderType(resource: any): string {
   const provider = resource.spec?.provider
   if (!provider) return 'Unknown'
 
+  if (provider.aws) return AWS_SERVICE_LABELS[provider.aws.service] ?? 'AWS'
+
   for (const [key, label] of Object.entries(PROVIDER_MAP)) {
     if (provider[key]) return label
   }

package/src/components/resources/resource-utils-istio.ts

@@ -28,15 +28,19 @@ export function getVirtualServiceStatus(resource: any): StatusBadge {
   const tlsRoutes = spec.tls || []
   const hosts = spec.hosts || []
 
-  if (hosts.length === 0) {
-    return { text: 'No Hosts', color: healthColors.unhealthy, level: 'unhealthy' }
-  }
-
+  // Routes are what a VirtualService exists to provide, delegate or not.
   const totalRoutes = httpRoutes.length + tcpRoutes.length + tlsRoutes.length
   if (totalRoutes === 0) {
     return { text: 'No Routes', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
+  // A delegate VirtualService is required to declare no hosts, and this object
+  // cannot tell us whether a parent delegates to it, so an empty list is not
+  // evidence of a fault.
+  if (hosts.length === 0) {
+    return { text: 'No Hosts', color: healthColors.unknown, level: 'unknown' }
+  }
+
   // Check for fault injection on any route
   const hasFaultInjection = httpRoutes.some((r: any) => r.fault)
   if (hasFaultInjection) {
@@ -49,7 +53,7 @@ export function getVirtualServiceStatus(resource: any): StatusBadge {
     return { text: 'Mirroring', color: healthColors.degraded, level: 'degraded' }
   }
 
-  return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Defined', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getVirtualServiceHosts(resource: any): string {
@@ -123,26 +127,18 @@ export function getVirtualServiceDestinations(resource: any): Array<{ host: stri
 // DESTINATIONRULE UTILITIES
 // ============================================================================
 
+/**
+ * The only failure this object can show on its own.
+ *
+ * A rule without a host applies to nothing. Everything else it declares —
+ * subsets, a traffic policy — is configuration, and says nothing about whether
+ * the host is reachable or the policy is in effect.
+ */
 export function getDestinationRuleStatus(resource: any): StatusBadge {
-  const spec = resource.spec || {}
-  const host = spec.host
-
-  if (!host) {
+  if (!resource.spec?.host) {
     return { text: 'No Host', color: healthColors.unhealthy, level: 'unhealthy' }
   }
-
-  const subsets = spec.subsets || []
-  const trafficPolicy = spec.trafficPolicy
-
-  if (subsets.length > 0) {
-    return { text: pluralize(subsets.length, 'Subset'), color: healthColors.healthy, level: 'healthy' }
-  }
-
-  if (trafficPolicy) {
-    return { text: 'Configured', color: healthColors.healthy, level: 'healthy' }
-  }
-
-  return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Not assessed', color: healthColors.unknown, level: 'unknown' }
 }
 
 export function getDestinationRuleHost(resource: any): string {
@@ -161,6 +157,22 @@ export function getDestinationRuleSubsets(resource: any): Array<{ name: string;
   }))
 }
 
+/**
+ * The client-side TLS mode this rule declares for its host.
+ *
+ * What it means depends on a different object. DISABLE is defined as "do not
+ * setup a TLS connection to the upstream endpoint", so the client sends
+ * plaintext; a PeerAuthentication STRICT is "an mTLS tunnel (TLS with client
+ * cert must be presented)" and PERMISSIVE is "either plaintext or mTLS tunnel".
+ * The pairing therefore lands as unencrypted traffic or as rejected requests —
+ * deduced from those two definitions, since neither API documents the mismatch
+ * directly. Nothing in this row shows which, and subset and port policies can
+ * override the mode besides, so it reports the declaration and not the posture.
+ */
+export function getDestinationRuleTlsMode(resource: any): string {
+  return getDestinationRuleTrafficPolicy(resource)?.tls?.mode || '-'
+}
+
 export function getDestinationRuleTrafficPolicy(resource: any): {
   connectionPool?: { tcp?: any; http?: any }
   loadBalancer?: { simple?: string; consistentHash?: any }
@@ -182,6 +194,15 @@ export function getDestinationRuleLoadBalancer(resource: any): string {
 // ISTIO GATEWAY UTILITIES
 // ============================================================================
 
+/**
+ * What spec.servers alone can honestly claim.
+ *
+ * Not liveness: an Istio Gateway whose spec.selector matches no running
+ * ingressgateway pod is how these actually fail, and it has servers like any
+ * other, so a green badge there would say the opposite of the truth. TLS is a
+ * property of a server rather than a verdict, and this slot is the one every
+ * other kind here uses for a verdict.
+ */
 export function getIstioGatewayStatus(resource: any): StatusBadge {
   const servers = resource.spec?.servers || []
 
@@ -189,12 +210,7 @@ export function getIstioGatewayStatus(resource: any): StatusBadge {
     return { text: 'No Servers', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
-  const hasTLS = servers.some((s: any) => s.tls)
-  if (hasTLS) {
-    return { text: 'TLS', color: healthColors.healthy, level: 'healthy' }
-  }
-
-  return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Defined', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getIstioGatewayServers(resource: any): Array<{
@@ -236,12 +252,14 @@ export function getServiceEntryStatus(resource: any): StatusBadge {
     return { text: 'No Hosts', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
+  // Location is a mesh-membership classification, not reachability: nothing here
+  // establishes the hosts resolve or answer.
   const location = spec.location || 'MESH_EXTERNAL'
   if (location === 'MESH_EXTERNAL') {
-    return { text: 'External', color: healthColors.healthy, level: 'healthy' }
+    return { text: 'External', color: healthColors.neutral, level: 'neutral' }
   }
 
-  return { text: 'Internal', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Internal', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getServiceEntryHosts(resource: any): string {
@@ -327,21 +345,33 @@ export function getPeerAuthenticationPortLevelMtls(resource: any): Record<string
 // AUTHORIZATIONPOLICY UTILITIES
 // ============================================================================
 
+/**
+ * What one AuthorizationPolicy declares — never a health verdict.
+ *
+ * An action is not a state of wellness: a DENY doing its job is not unhealthy,
+ * and an ALLOW is not proof anything is permitted. The request decision is made
+ * across every policy selecting the workload, so no single object can establish
+ * it, and a green or red tone would assert an answer this object does not have.
+ *
+ * The one shape worth marking is an ALLOW — the default action — carrying no
+ * rules. Rules are alternatives, so zero of them match nothing, and Istio
+ * documents `spec: {}` as the deny-all idiom. Amber says look closer; it stops
+ * short of claiming the outage, because other policies may permit the traffic.
+ */
 export function getAuthorizationPolicyStatus(resource: any): StatusBadge {
   const action = resource.spec?.action || 'ALLOW'
   const rules = resource.spec?.rules || []
 
-  switch (action) {
-    case 'ALLOW':
-      return { text: `Allow (${pluralize(rules.length, 'rule')})`, color: healthColors.healthy, level: 'healthy' }
-    case 'DENY':
-      return { text: `Deny (${pluralize(rules.length, 'rule')})`, color: healthColors.unhealthy, level: 'unhealthy' }
-    case 'CUSTOM':
-      return { text: 'Custom', color: healthColors.degraded, level: 'degraded' }
-    case 'AUDIT':
-      return { text: 'Audit', color: healthColors.degraded, level: 'degraded' }
-    default:
-      return { text: action, color: healthColors.unknown, level: 'unknown' }
+  if (action === 'ALLOW' && rules.length === 0) {
+    return { text: 'No allow rules', color: healthColors.degraded, level: 'degraded' }
+  }
+  const known: Record<string, string> = { ALLOW: 'Allow', DENY: 'Deny', CUSTOM: 'Custom', AUDIT: 'Audit' }
+  const label = known[action]
+  if (!label) return { text: action, color: healthColors.unknown, level: 'unknown' }
+  return {
+    text: `${label} (${pluralize(rules.length, 'rule')})`,
+    color: healthColors.neutral,
+    level: 'neutral',
   }
 }
 
@@ -365,9 +395,87 @@ export function getAuthorizationPolicySelector(resource: any): Record<string, st
   return resource.spec?.selector?.matchLabels || {}
 }
 
+/**
+ * What the policy declares it applies to.
+ *
+ * A policy can attach by targetRef instead of by labels — waypoints and
+ * Gateways in ambient mode do — so the selector alone does not describe scope.
+ * With neither, scope is inherited: the namespace, or the whole mesh when the policy
+ * sits in the mesh root namespace. Which of those applies depends on
+ * MeshConfig.rootNamespace, which is not readable from this object, so the cell
+ * names both rather than guessing from the conventional namespace name.
+ */
 export function getAuthorizationPolicySelectorString(resource: any): string {
-  const labels = resource.spec?.selector?.matchLabels || {}
-  const entries = Object.entries(labels)
-  if (entries.length === 0) return 'Namespace-wide'
+  const spec = resource.spec || {}
+  const targets = [
+    ...(Array.isArray(spec.targetRefs) ? spec.targetRefs : []),
+    ...(spec.targetRef ? [spec.targetRef] : []),
+  ].filter(Boolean)
+  if (targets.length > 0) {
+    return targets
+      .map((t: any) => {
+        const name = [t?.kind, t?.name].filter(Boolean).join('/') || 'target'
+        return t?.namespace && t.namespace !== resource.metadata?.namespace
+          ? `${t.namespace}/${name}`
+          : name
+      })
+      .join(', ')
+  }
+  const entries = Object.entries(spec.selector?.matchLabels || {})
+  if (entries.length === 0) return 'Namespace / mesh scope'
   return entries.map(([k, v]) => `${k}=${v}`).join(', ')
 }
+
+/**
+ * What an AuthorizationPolicy's rule list means for the traffic it governs.
+ *
+ * Rules are alternatives and an unset list never matches, so BOTH actions with
+ * no rules are inert in the same way — a DENY with none denies nothing, an
+ * ALLOW with none permits nothing. Only the ALLOW case has a consequence worth
+ * raising, because a workload with any ALLOW policy admits only what one of
+ * them matches. Neither can be stated as an outcome for the workload: every
+ * policy selecting it takes part in the decision.
+ */
+export function getAuthorizationPolicyRuleNotice(
+  resource: any,
+): { level: 'warning' | 'info'; title: string; message: string } | null {
+  const action = resource?.spec?.action || 'ALLOW'
+  const rules = resource?.spec?.rules
+  if (Array.isArray(rules) && rules.length > 0) {
+    // A rule matches every request when it carries no conditions — which
+    // includes serialized empty lists, not just an empty object. On a DENY that
+    // is not a baseline other policies carve exceptions out of: DENY is
+    // evaluated first, so no ALLOW can re-permit what it matches. Unknown keys
+    // are treated as conditions, so a future field cannot be read as blanket.
+    const CONDITION_KEYS = ['from', 'to', 'when']
+    const matchesEverything = rules.some((r: any) => {
+      if (!r || typeof r !== 'object') return false
+      const keys = Object.keys(r)
+      if (keys.some(k => !CONDITION_KEYS.includes(k))) return false
+      return CONDITION_KEYS.every(k => !Array.isArray(r[k]) || r[k].length === 0)
+    })
+    if (action === 'DENY' && matchesEverything) {
+      return {
+        level: 'info',
+        title: 'Matches all requests',
+        message: 'A rule with no conditions matches every request, so this policy denies all traffic to the workloads it selects. DENY is evaluated before ALLOW, so no ALLOW policy can permit an exception.',
+      }
+    }
+    return null
+  }
+  if (action === 'ALLOW') {
+    return {
+      level: 'warning',
+      title: 'No allow rules',
+      message: 'Rules are alternatives, so an ALLOW policy with none of them matches nothing and contributes no permitted traffic. Other ALLOW policies selecting the same workload may still permit requests — a default-deny-plus-exceptions setup looks exactly like this.',
+    }
+  }
+  if (action === 'DENY') {
+    return {
+      level: 'info',
+      title: 'No deny rules',
+      message: 'This DENY policy has no rules, so it matches no requests and denies no traffic. Other policies may still deny requests.',
+    }
+  }
+  return null
+}

package/src/components/resources/resource-utils-kyverno.ts

@@ -107,12 +107,9 @@ export function getKyvernoPolicyStatus(resource: any): StatusBadge {
     return { text: readyCond.reason || 'Not Ready', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
-  // Fallback: if spec exists, likely active
-  if (resource.spec?.rules?.length > 0) {
-    return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
-  }
-
-  return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  // Reached when the controller has not written Ready, or wrote it as Unknown.
+  // Declaring rules is not the controller accepting them.
+  return { text: 'Not assessed', color: healthColors.unknown, level: 'unknown' }
 }
 
 /**

package/src/components/resources/resource-utils-prometheus.ts

@@ -7,31 +7,59 @@ import { healthColors } from './resource-utils'
 // SHARED HELPERS
 // ============================================================================
 
-function getConditionStatus(resource: any): StatusBadge {
-  const conditions = resource.status?.conditions || []
-
-  const reconciledCond = conditions.find((c: any) => c.type === 'Reconciled')
-  if (reconciledCond?.status === 'True') {
-    return { text: 'Reconciled', color: healthColors.healthy, level: 'healthy' }
-  }
-  if (reconciledCond?.status === 'False') {
-    return { text: reconciledCond.reason || 'Not Reconciled', color: healthColors.unhealthy, level: 'unhealthy' }
+// ServiceMonitor, PodMonitor and PrometheusRule are configuration resources.
+// They have no `status.conditions`: the operator reports per selecting workload
+// under `status.bindings[].conditions`, the only condition type is `Accepted`,
+// and it writes any of it only when the StatusForConfigurationResources feature
+// gate is on. Absence is therefore the ordinary case and is not evidence the
+// configuration works — and `Accepted` means the config was accepted, not that
+// any target is being scraped.
+function getConfigResourceStatus(resource: any): StatusBadge {
+  const generation = resource?.metadata?.generation
+  let reporting = 0
+  let accepted = 0
+  let rejected = 0
+  let rejection = ''
+
+  for (const binding of resource?.status?.bindings || []) {
+    for (const cond of binding?.conditions || []) {
+      if (cond?.type !== 'Accepted') continue
+      // A condition observed against an older spec does not describe the object
+      // as it stands now.
+      if (generation !== undefined && cond.observedGeneration !== undefined
+        && cond.observedGeneration !== generation) continue
+      reporting++
+      if (cond.status === 'True') accepted++
+      else if (cond.status === 'False') {
+        rejected++
+        if (!rejection) rejection = cond.reason || ''
+      }
+    }
   }
 
-  const availableCond = conditions.find((c: any) => c.type === 'Available')
-  if (availableCond?.status === 'True') {
-    return { text: 'Available', color: healthColors.healthy, level: 'healthy' }
+  if (reporting === 0) {
+    return { text: 'Not assessed', color: healthColors.unknown, level: 'unknown' }
   }
-  if (availableCond?.status === 'False') {
-    return { text: availableCond.reason || 'Unavailable', color: healthColors.unhealthy, level: 'unhealthy' }
+  if (rejected === reporting) {
+    return { text: rejection || 'Not Accepted', color: healthColors.unhealthy, level: 'unhealthy' }
   }
-
-  // Fallback: if resource exists but has no conditions, it's likely active
-  if (resource.spec) {
-    return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  if (rejected > 0) {
+    return {
+      text: `Accepted by ${accepted}/${reporting}`,
+      color: healthColors.degraded,
+      level: 'degraded',
+    }
   }
-
-  return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  // No rejection, but a workload reported Accepted=Unknown: it has not decided,
+  // so the resource is not accepted everywhere that selects it.
+  if (accepted < reporting) {
+    return {
+      text: `Accepted by ${accepted}/${reporting}`,
+      color: healthColors.unknown,
+      level: 'unknown',
+    }
+  }
+  return { text: 'Accepted', color: healthColors.healthy, level: 'healthy' }
 }
 
 function formatMatchLabels(selector: any): string {
@@ -45,7 +73,7 @@ function formatMatchLabels(selector: any): string {
 // ============================================================================
 
 export function getServiceMonitorStatus(resource: any): StatusBadge {
-  return getConditionStatus(resource)
+  return getConfigResourceStatus(resource)
 }
 
 export function getServiceMonitorEndpointCount(resource: any): number {
@@ -87,7 +115,7 @@ export function getServiceMonitorNamespaceSelector(resource: any): string {
 // ============================================================================
 
 export function getPrometheusRuleStatus(resource: any): StatusBadge {
-  return getConditionStatus(resource)
+  return getConfigResourceStatus(resource)
 }
 
 export function getPrometheusRuleGroupCount(resource: any): number {
@@ -169,7 +197,7 @@ export function getPrometheusRuleGroups(resource: any): PrometheusRuleGroup[] {
 // ============================================================================
 
 export function getPodMonitorStatus(resource: any): StatusBadge {
-  return getConditionStatus(resource)
+  return getConfigResourceStatus(resource)
 }
 
 export function getPodMonitorEndpointCount(resource: any): number {

package/src/components/resources/resource-utils-ray.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest'
+import { getRayCronJobTimeZone, getRayCronJobStatus } from './resource-utils-ray'
+import { getCellFilterValue } from './resource-utils'
+
+describe('getRayCronJobTimeZone', () => {
+  it('shows the declared zone', () => {
+    expect(getRayCronJobTimeZone({ spec: { schedule: '0 2 * * *', timeZone: 'America/New_York' } }))
+      .toBe('America/New_York')
+  })
+
+  it('does not present an undeclared zone as UTC', () => {
+    // KubeRay reads the schedule in the operator pod's local zone when timeZone
+    // is unset, so the object cannot say what the cron expression means.
+    expect(getRayCronJobTimeZone({ spec: { schedule: '0 2 * * *' } })).toBe('Operator local')
+  })
+})
+
+describe('getRayCronJobStatus', () => {
+  it('reports only what spec.suspend says, which is all the CRD carries', () => {
+    // RayCronJobStatus holds lastScheduleTime and nothing else — there is no
+    // controller-reported phase for this badge to reflect.
+    expect(getRayCronJobStatus({ spec: { suspend: true } }).text).toBe('Suspended')
+    expect(getRayCronJobStatus({ spec: {} }).text).toBe('Active')
+  })
+})
+
+describe('getCellFilterValue for raycronjobs timeZone', () => {
+  it('offers the same value the cell renders, so undeclared rows stay filterable', () => {
+    // The generic fallback reads spec.timeZone and yields '' when unset, which
+    // would hide those rows from a filter whose column shows them a value.
+    expect(getCellFilterValue({ spec: { schedule: '0 2 * * *' } }, 'timeZone', 'raycronjobs'))
+      .toBe('Operator local')
+    expect(getCellFilterValue({ spec: { timeZone: 'Europe/Berlin' } }, 'timeZone', 'raycronjobs'))
+      .toBe('Europe/Berlin')
+  })
+})

package/src/components/resources/resource-utils-ray.ts

@@ -203,6 +203,12 @@ export function getRayCronJobSchedule(resource: any): string {
   return resource.spec?.schedule || '-'
 }
 
+// An unset timeZone does not mean UTC: KubeRay reads the schedule in the
+// operator pod's own local zone, which this object cannot report.
+export function getRayCronJobTimeZone(resource: any): string {
+  return resource.spec?.timeZone || 'Operator local'
+}
+
 export function getRayCronJobSuspend(resource: any): boolean {
   return resource.spec?.suspend === true
 }