@skyhook-io/k8s-ui 1.14.1 → 1.14.2

package/src/components/resources/resource-utils.ts

@@ -15,7 +15,7 @@ import { getPolicyReportStatus as _getPolicyReportStatus, getKyvernoPolicyStatus
 import { getResourceClaimStatus as _getResourceClaimStatus, getResourceClaimDeviceClasses as _getResourceClaimDeviceClasses, getResourceClaimTemplateDeviceClasses as _getResourceClaimTemplateDeviceClasses, getResourceClaimAllocation as _getResourceClaimAllocation, getResourceClaimReservedFor as _getResourceClaimReservedFor } from './resource-utils-dra'
 import { getNvidiaClusterPolicyStatus as _getNvidiaClusterPolicyStatus, getNvidiaClusterPolicyEnabledComponents as _getNvidiaClusterPolicyEnabledComponents, getNvidiaDriverStatus as _getNvidiaDriverStatus } from './resource-utils-nvidia'
 import { getClusterQueueStatus as _getClusterQueueStatus, getLocalQueueStatus as _getLocalQueueStatus, getKueueWorkloadStatus as _getKueueWorkloadStatus, getResourceFlavorStatus as _getResourceFlavorStatus, getAdmissionCheckStatus as _getAdmissionCheckStatus, getProvisioningRequestStatus as _getProvisioningRequestStatus } from './resource-utils-kueue'
-import { getRayClusterStatus as _getRayClusterStatus, getRayJobStatus as _getRayJobStatus, getRayServiceStatus as _getRayServiceStatus, getRayCronJobStatus as _getRayCronJobStatus } from './resource-utils-ray'
+import { getRayClusterStatus as _getRayClusterStatus, getRayJobStatus as _getRayJobStatus, getRayServiceStatus as _getRayServiceStatus, getRayCronJobStatus as _getRayCronJobStatus, getRayCronJobTimeZone as _getRayCronJobTimeZone } from './resource-utils-ray'
 import { getLeaderWorkerSetStatus as _getLeaderWorkerSetStatus, getJobSetStatus as _getJobSetStatus } from './resource-utils-jobset-lws'
 import { getInferenceServiceStatus as _getInferenceServiceStatus, getServingRuntimeStatus as _getServingRuntimeStatus, getInferenceGraphStatus as _getInferenceGraphStatus, getTrainedModelStatus as _getTrainedModelStatus, getLLMInferenceServiceStatus as _getLLMInferenceServiceStatus } from './resource-utils-kserve'
 import { getInferencePoolStatus as _getInferencePoolStatus, getInferenceObjectiveStatus as _getInferenceObjectiveStatus } from './resource-utils-inference-gateway'
@@ -30,8 +30,8 @@ import { getExternalSecretStatus as _getExternalSecretStatus, getClusterExternal
 import { getHPATableState, hpaStatusFromState } from './resource-utils-hpa'
 import { getCNPGClusterStatus as _getCNPGClusterStatus, getCNPGBackupStatus as _getCNPGBackupStatus, getCNPGScheduledBackupStatus as _getCNPGScheduledBackupStatus, getCNPGPoolerStatus as _getCNPGPoolerStatus, isApiGroup as _isApiGroup, CNPG_GROUP as _CNPG_GROUP } from './resource-utils-cnpg'
 import { getGenericResourceStatus } from './generic-status'
-import { getIstioGatewayStatus as _getIstioGatewayStatus, getIstioGatewayServerCount as _getIstioGatewayServerCount, getIstioGatewaySelectorString as _getIstioGatewaySelectorString } from './resource-utils-istio'
-import { getCalicoIPPoolAllowedUses, getCalicoIPPoolBlockSize, getCalicoIPPoolEncapsulation, getCalicoPolicyNamespaceSelector, getCalicoPolicyServiceAccountSelector, getCalicoPolicyTypes, isCalicoApiVersion, isCalicoPolicyResource } from './resource-utils-calico'
+import { getIstioGatewayStatus as _getIstioGatewayStatus, getIstioGatewayServerCount as _getIstioGatewayServerCount, getIstioGatewaySelectorString as _getIstioGatewaySelectorString, getAuthorizationPolicySelectorString as _getAuthorizationPolicySelectorString, getDestinationRuleTlsMode as _getDestinationRuleTlsMode } from './resource-utils-istio'
+import { formatKubernetesLabelSelector, getCalicoIPPoolAllowedUses, getCalicoIPPoolBlockSize, getCalicoIPPoolEncapsulation, getCalicoPolicyNamespaceSelector, getCalicoPolicyServiceAccountSelector, getCalicoPolicyTypes, isCalicoApiVersion, isCalicoPolicyResource } from './resource-utils-calico'
 
 // ============================================================================
 // STATUS & HEALTH UTILITIES
@@ -1861,21 +1861,145 @@ export function getGatewayClassDescription(gc: any): string {
 // GATEWAY API ROUTE UTILITIES (shared by HTTPRoute, GRPCRoute, TCPRoute, TLSRoute)
 // ============================================================================
 
+const GATEWAY_API_GROUP = 'gateway.networking.k8s.io'
+
+/**
+ * Whether a status report describes a parent the spec still asks for.
+ *
+ * A controller can leave a report behind after its parentRef is removed, and
+ * the defaults matter: an unset group/kind/namespace on either side means
+ * gateway.networking.k8s.io, Gateway, and the route's own namespace.
+ */
+function isReportForParentRef(ref: any, reported: any, routeNamespace: string): boolean {
+  const norm = (r: any) => ({
+    group: r?.group ?? GATEWAY_API_GROUP,
+    kind: r?.kind ?? 'Gateway',
+    namespace: r?.namespace ?? routeNamespace,
+    name: r?.name,
+    sectionName: r?.sectionName,
+    port: r?.port,
+  })
+  const a = norm(ref)
+  const b = norm(reported)
+  return a.group === b.group && a.kind === b.kind && a.namespace === b.namespace &&
+    a.name === b.name && a.sectionName === b.sectionName && a.port === b.port
+}
+
 // All Gateway API route types share the same status/parents/rules/hostnames structure
+/**
+ * A route's verdict, from BOTH conditions the API guarantees it carries.
+ *
+ * Accepted alone is not health: a backendRef naming a Service that does not
+ * exist is Accepted=True by design, because the gateway still has to answer the
+ * request — with a 5xx. Reading only Accepted therefore reported the "why is my
+ * route 503ing" case as healthy, beside a Backends column naming the Service
+ * that is missing. An ABSENT ResolvedRefs is not healthy either: GEP-1364 has
+ * routes always carry both, so a missing one means nothing has confirmed the
+ * refs yet.
+ */
+/**
+ * The reports that describe parents this route is actually attached to, plus
+ * the readers the verdict uses. Shared with getRouteStatusReason so the badge
+ * and its explanation can never disagree about which parents counted.
+ */
+function routeParentEvidence(route: any) {
+  const refs = route.spec?.parentRefs || []
+  const reports = route.status?.parents || []
+  const routeNamespace = route.metadata?.namespace || ''
+  const generation = route.metadata?.generation
+
+  // Status entries are identified by parentRef AND controllerName, so one
+  // parent can carry reports from two controllers while one replaces the other.
+  // All of them count: reading a single report would make the verdict depend on
+  // their order in the array.
+  const reportsFor = (ref: any) =>
+    reports.filter((p: any) => isReportForParentRef(ref, p?.parentRef, routeNamespace))
+  const perRef = refs.map(reportsFor)
+
+  // A route can also attach to default Gateways without naming them, in which
+  // case the attachment exists only in status. Those reports are real and their
+  // failures must count. Without that opt-in an unmatched report is a leftover
+  // from a parentRef the spec no longer names, and counting it would resurrect
+  // a verdict for a parent the route has left.
+  const useDefaultGateways = route.spec?.useDefaultGateways
+  const attachedByDefault = useDefaultGateways !== undefined && useDefaultGateways !== 'None'
+  const claimed = new Set(perRef.flat())
+  // Only a Gateway can be a default parent. An unmatched report for anything
+  // else — a mesh Service parent the spec has dropped — is obsolete by
+  // definition, and would otherwise keep voting forever if its controller is
+  // gone.
+  const isDefaultGatewayReport = (p: any) =>
+    (p?.parentRef?.group ?? GATEWAY_API_GROUP) === GATEWAY_API_GROUP &&
+    (p?.parentRef?.kind ?? 'Gateway') === 'Gateway'
+  const considered = attachedByDefault
+    ? [...perRef.flat(), ...reports.filter((p: any) => !claimed.has(p) && isDefaultGatewayReport(p))]
+    : perRef.flat()
+
+  // A condition observed against a superseded generation describes a spec that
+  // has since changed, so it cannot confirm the current one. A condition with no
+  // observedGeneration at all is taken at face value.
+  const isCurrent = (c: any) =>
+    c?.observedGeneration === undefined || generation === undefined || c.observedGeneration === generation
+  const conditionOf = (report: any, type: string) =>
+    (report?.conditions || []).filter((c: any) => c?.type === type && isCurrent(c)).pop()
+  const statusOf = (report: any, type: string) => conditionOf(report, type)?.status
+
+  // A report whose conditions all describe a superseded spec says nothing about
+  // the current one, either way — so it neither votes nor confirms the parent it
+  // belongs to. Requiring it to agree would let one leftover from a replaced
+  // controller hold a live healthy parent at Pending; counting it as
+  // confirmation would let the other parents speak for one nothing has
+  // confirmed.
+  const speaksToCurrentSpec = (r: any) =>
+    conditionOf(r, 'Accepted') !== undefined || conditionOf(r, 'ResolvedRefs') !== undefined
+  const current = considered.filter(speaksToCurrentSpec)
+  const everyRefConfirmed = perRef.every((list: any[]) => list.some(speaksToCurrentSpec))
+
+  return { considered, current, everyRefConfirmed, conditionOf, statusOf }
+}
+
 export function getRouteStatus(route: any): StatusBadge {
-  const parents = route.status?.parents || []
-  if (parents.length === 0) return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
-  const allAccepted = parents.every((p: any) =>
-    (p.conditions || []).some((c: any) => c.type === 'Accepted' && c.status === 'True')
-  )
-  const anyRejected = parents.some((p: any) =>
-    (p.conditions || []).some((c: any) => c.type === 'Accepted' && c.status === 'False')
-  )
-  if (allAccepted) return { text: 'Accepted', color: healthColors.healthy, level: 'healthy' }
-  if (anyRejected) return { text: 'Not Accepted', color: healthColors.unhealthy, level: 'unhealthy' }
+  const { considered, current, everyRefConfirmed, statusOf } = routeParentEvidence(route)
+
+  if (considered.length === 0) return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  if (current.length === 0) return { text: 'Pending', color: healthColors.degraded, level: 'degraded' }
+  const anyFailure = current.some((r: any) =>
+    statusOf(r, 'Accepted') === 'False' || statusOf(r, 'ResolvedRefs') === 'False')
+
+  if (everyRefConfirmed && current.every((r: any) => statusOf(r, 'Accepted') === 'False')) {
+    return { text: 'Not Accepted', color: healthColors.unhealthy, level: 'unhealthy' }
+  }
+  if (anyFailure) {
+    return { text: 'Degraded', color: healthColors.degraded, level: 'degraded' }
+  }
+  if (everyRefConfirmed && current.every((r: any) =>
+      statusOf(r, 'Accepted') === 'True' && statusOf(r, 'ResolvedRefs') === 'True')) {
+    return { text: 'Accepted', color: healthColors.healthy, level: 'healthy' }
+  }
   return { text: 'Pending', color: healthColors.degraded, level: 'degraded' }
 }
 
+/**
+ * Why the badge says what it says: which parent is unhappy, and the controller's
+ * own reason. Without it "Degraded" tells an operator something is wrong and
+ * nothing about what — and the whole point of reading ResolvedRefs is that the
+ * answer is usually "the backend you named does not exist".
+ */
+export function getRouteStatusReason(route: any): string {
+  const { current, conditionOf } = routeParentEvidence(route)
+  const parts: string[] = []
+  for (const report of current) {
+    const name = report?.parentRef?.name || 'parent'
+    for (const type of ['Accepted', 'ResolvedRefs']) {
+      const c = conditionOf(report, type)
+      if (c?.status !== 'False') continue
+      const detail = [c.reason, c.message].filter(Boolean).join(': ')
+      parts.push(detail ? `${name}: ${detail}` : `${name}: ${type} is false`)
+    }
+  }
+  return parts.join(' · ')
+}
+
 export function getRouteParents(route: any): string {
   const refs = route.spec?.parentRefs || []
   return refs.map((r: any) => r.name).join(', ') || '-'
@@ -1954,10 +2078,24 @@ export function getNetworkPolicyRuleCount(np: any): { ingress: number; egress: n
   }
 }
 
+/**
+ * Who the policy applies to.
+ *
+ * podSelector is a LabelSelector, so it can target a subset through
+ * matchExpressions alone. Reading only matchLabels reported those policies as
+ * covering the whole namespace — a gap rendered as coverage, on the surface
+ * where that reads as "this namespace is protected, look elsewhere".
+ */
 export function getNetworkPolicySelector(np: any): string {
-  const labels = np.spec?.podSelector?.matchLabels
-  if (!labels || Object.keys(labels).length === 0) return 'All pods'
-  return Object.entries(labels).map(([k, v]) => `${k}=${v}`).join(', ')
+  const selector = np.spec?.podSelector
+  const hasLabels = Object.keys(selector?.matchLabels ?? {}).length > 0
+  // Count only what the formatter will actually render: it skips malformed
+  // entries, and an expression list of nothing but those would otherwise reach
+  // its empty-case string and describe the same state in different words.
+  const hasExpressions = (Array.isArray(selector?.matchExpressions) ? selector.matchExpressions : [])
+    .some((e: any) => e && typeof e === 'object')
+  if (!hasLabels && !hasExpressions) return 'All pods'
+  return formatKubernetesLabelSelector(selector)
 }
 
 // ============================================================================
@@ -2232,7 +2370,6 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'clusterqueues') return _getClusterQueueStatus(resource).text
       if (kindLower === 'localqueues') return _getLocalQueueStatus(resource).text
       if (kindLower === 'workloads') return _getKueueWorkloadStatus(resource).text
-      if (kindLower === 'resourceflavors') return _getResourceFlavorStatus(resource).text
       if (kindLower === 'admissionchecks') return _getAdmissionCheckStatus(resource).text
       if (kindLower === 'provisioningrequests') return _getProvisioningRequestStatus(resource).text
       if (kindLower === 'rayclusters') return _getRayClusterStatus(resource).text
@@ -2252,7 +2389,6 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'volcanoqueues') return _getVolcanoQueueStatus(resource).text
       if (kindLower === 'volcanopodgroups') return _getVolcanoPodGroupStatus(resource).text
       if (kindLower === 'jobflows') return _getJobFlowStatus(resource).text
-      if (kindLower === 'jobtemplates') return _getJobTemplateStatus(resource).text
       if (kindLower === 'kaiqueues') return _getKaiQueueStatus(resource).text
       if (kindLower === 'kaipodgroups') return _getKaiPodGroupStatus(resource).text
       if (kindLower === 'kaitoworkspaces') return _getKaitoWorkspaceStatus(resource).text
@@ -2320,6 +2456,13 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       return ''
     case 'selector':
       if (kindLower === 'istiogateways') return _getIstioGatewaySelectorString(resource)
+      if (kindLower === 'authorizationpolicies') return _getAuthorizationPolicySelectorString(resource)
+      return ''
+    case 'tlsMode':
+      // Distinct from Traefik's boolean 'tls' key, which SKIP_FILTER_COLUMNS
+      // excludes — sharing it would have made this reader unreachable. The
+      // generic fallback cannot reach spec.trafficPolicy.tls.mode.
+      if (kindLower === 'destinationrules') return _getDestinationRuleTlsMode(resource)
       return ''
     case 'state':
       if (kindLower === 'orders') return getOrderState(resource).text
@@ -2451,6 +2594,11 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
     case 'mig':
       if (kindLower === 'nvidiaclusterpolicies') return resource.spec?.mig?.strategy || ''
       break
+    // The fallback would read spec.timeZone and yield '' for an undeclared
+    // zone, so those rows would drop out of a filter the cell shows a value for.
+    case 'timeZone':
+      if (kindLower === 'raycronjobs') return _getRayCronJobTimeZone(resource)
+      break
   }
 
   // Fallback: try common paths

package/src/components/resources/status-accessors.test.ts

@@ -0,0 +1,363 @@
+import { describe, expect, it } from 'vitest'
+import { getNetworkPolicySelector, getRouteStatus, getRouteStatusReason } from './resource-utils'
+import { getIstioGatewayStatus } from './resource-utils-istio'
+
+// Each case names the cluster state behind the verdict, so a future change that
+// re-greens one of them fails here with the reason attached.
+
+describe('getNetworkPolicySelector', () => {
+  it('reports a matchExpressions-only policy as targeting a subset, not everything', () => {
+    // podSelector is a LabelSelector: a policy can target a fraction of the
+    // namespace through expressions alone, and must not claim to cover all of it.
+    const np = {
+      spec: { podSelector: { matchExpressions: [{ key: 'tier', operator: 'In', values: ['web', 'api'] }] } },
+    }
+    expect(getNetworkPolicySelector(np)).toBe('tier In (web,api)')
+  })
+
+  it('preserves every value rather than collapsing a multi-value NotIn', () => {
+    const np = {
+      spec: { podSelector: { matchExpressions: [{ key: 'env', operator: 'NotIn', values: ['prod', 'staging'] }] } },
+    }
+    expect(getNetworkPolicySelector(np)).toBe('env NotIn (prod,staging)')
+  })
+
+  it('renders valueless operators', () => {
+    const np = { spec: { podSelector: { matchExpressions: [{ key: 'role', operator: 'Exists' }] } } }
+    expect(getNetworkPolicySelector(np)).toBe('role Exists')
+  })
+
+  it('combines matchLabels with matchExpressions', () => {
+    const np = {
+      spec: {
+        podSelector: {
+          matchLabels: { app: 'api' },
+          matchExpressions: [{ key: 'tier', operator: 'In', values: ['web'] }],
+        },
+      },
+    }
+    expect(getNetworkPolicySelector(np)).toBe('app=api, tier In (web)')
+  })
+
+  it('does not switch vocabulary when every expression entry is malformed', () => {
+    // The shared formatter skips entries it cannot read and has its own
+    // empty-case wording; reaching it would describe one state in two ways.
+    expect(getNetworkPolicySelector({ spec: { podSelector: { matchExpressions: [null] } } })).toBe('All pods')
+  })
+
+  it('still says All pods when the selector is genuinely empty', () => {
+    expect(getNetworkPolicySelector({ spec: { podSelector: {} } })).toBe('All pods')
+    expect(getNetworkPolicySelector({ spec: {} })).toBe('All pods')
+  })
+})
+
+describe('getRouteStatus', () => {
+  const route = (opts: {
+    refs?: any[]
+    parents?: any[]
+    generation?: number
+    namespace?: string
+  }) => ({
+    metadata: { namespace: opts.namespace ?? 'prod', generation: opts.generation },
+    spec: { parentRefs: opts.refs ?? [{ name: 'gw' }] },
+    status: { parents: opts.parents ?? [] },
+  })
+  const cond = (type: string, status: string, observedGeneration?: number) =>
+    ({ type, status, ...(observedGeneration === undefined ? {} : { observedGeneration }) })
+
+  it('is not healthy when a backendRef names a Service that does not exist', () => {
+    // Accepted=True + ResolvedRefs=False is the documented shape for a missing
+    // backend — the gateway still routes, and answers 5xx.
+    const r = route({
+      parents: [{ parentRef: { name: 'gw' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'False')] }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Degraded', level: 'degraded' })
+  })
+
+  it('is healthy only when both conditions are true', () => {
+    const r = route({
+      parents: [{ parentRef: { name: 'gw' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Accepted', level: 'healthy' })
+  })
+
+  it('does not call an absent ResolvedRefs healthy', () => {
+    const r = route({ parents: [{ parentRef: { name: 'gw' }, conditions: [cond('Accepted', 'True')] }] })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Pending', level: 'degraded' })
+  })
+
+  it('reports rejection when every requested parent rejects', () => {
+    const r = route({
+      parents: [{ parentRef: { name: 'gw' }, conditions: [cond('Accepted', 'False'), cond('ResolvedRefs', 'True')] }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Not Accepted', level: 'unhealthy' })
+  })
+
+  it('degrades rather than rejects when only one of several parents rejects', () => {
+    const r = route({
+      refs: [{ name: 'gw-a' }, { name: 'gw-b' }],
+      parents: [
+        { parentRef: { name: 'gw-a' }, conditions: [cond('Accepted', 'False'), cond('ResolvedRefs', 'True')] },
+        { parentRef: { name: 'gw-b' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] },
+      ],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Degraded', level: 'degraded' })
+  })
+
+  it('is Pending while a requested parent has not reported yet', () => {
+    const r = route({
+      refs: [{ name: 'gw-a' }, { name: 'gw-b' }],
+      parents: [
+        { parentRef: { name: 'gw-a' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] },
+      ],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Pending', level: 'degraded' })
+  })
+
+  it('ignores a report left behind for a parentRef the spec no longer names', () => {
+    const r = route({
+      refs: [{ name: 'gw-new' }],
+      parents: [{ parentRef: { name: 'gw-old' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Unknown', level: 'unknown' })
+  })
+
+  it('does not accept conditions observed against a superseded generation', () => {
+    const r = route({
+      generation: 3,
+      parents: [{
+        parentRef: { name: 'gw' },
+        conditions: [cond('Accepted', 'True', 2), cond('ResolvedRefs', 'True', 2)],
+      }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Pending', level: 'degraded' })
+  })
+
+  it('does not let a stale controller report outvote a live rejection, in either order', () => {
+    // Status entries are keyed by parentRef AND controllerName, so one parent
+    // can carry two controllers' reports while one replaces the other.
+    const old = { parentRef: { name: 'gw' }, controllerName: 'old/ctrl', conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] }
+    const live = { parentRef: { name: 'gw' }, controllerName: 'new/ctrl', conditions: [cond('Accepted', 'False'), cond('ResolvedRefs', 'False')] }
+    // Neither order may be green, and both must agree. Degraded rather than
+    // unhealthy is deliberate: nothing here establishes which controller is
+    // authoritative, so the verdict says "something is wrong" without claiming
+    // the route is rejected outright.
+    const forward = getRouteStatus(route({ parents: [old, live] }))
+    const reversed = getRouteStatus(route({ parents: [live, old] }))
+    expect(forward).toEqual(reversed)
+    expect(forward.level).not.toBe('healthy')
+    expect(forward).toMatchObject({ text: 'Degraded', level: 'degraded' })
+  })
+
+  it('counts a default-Gateway attachment the spec never names', () => {
+    // With useDefaultGateways the attachment exists only in status, so a
+    // failure there is the only evidence there is.
+    const r = {
+      metadata: { namespace: 'prod' },
+      spec: { useDefaultGateways: 'All' },
+      status: { parents: [{ parentRef: { name: 'default-gw' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'False')] }] },
+    }
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Degraded', level: 'degraded' })
+  })
+
+  it('accepts a default-only route whose default parent is healthy', () => {
+    const r = {
+      metadata: { namespace: 'prod' },
+      spec: { useDefaultGateways: 'All' },
+      status: { parents: [{ parentRef: { name: 'default-gw' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] }] },
+    }
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Accepted', level: 'healthy' })
+  })
+
+  it('does not let a healthy explicit parent mask a failing default one', () => {
+    const r = {
+      metadata: { namespace: 'prod' },
+      spec: { parentRefs: [{ name: 'gw' }], useDefaultGateways: 'All' },
+      status: {
+        parents: [
+          { parentRef: { name: 'gw' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] },
+          { parentRef: { name: 'default-gw' }, conditions: [cond('Accepted', 'False'), cond('ResolvedRefs', 'True')] },
+        ],
+      },
+    }
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Degraded', level: 'degraded' })
+  })
+
+  it('ignores a dropped mesh Service parent when weighing default Gateways', () => {
+    // Services cannot be default Gateways, so an unmatched Service report is
+    // obsolete by definition — and would otherwise outvote the live one
+    // indefinitely once its controller is gone.
+    const r = {
+      metadata: { namespace: 'prod', generation: 3 },
+      spec: { useDefaultGateways: 'All' },
+      status: {
+        parents: [
+          { parentRef: { group: '', kind: 'Service', name: 'legacy-mesh' }, conditions: [cond('Accepted', 'True', 2)] },
+          { parentRef: { name: 'default-gw' }, conditions: [cond('Accepted', 'True', 3), cond('ResolvedRefs', 'True', 3)] },
+        ],
+      },
+    }
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Accepted', level: 'healthy' })
+  })
+
+  it('still reports a rejecting default Gateway as rejected despite a dropped Service parent', () => {
+    const r = {
+      metadata: { namespace: 'prod', generation: 3 },
+      spec: { useDefaultGateways: 'All' },
+      status: {
+        parents: [
+          { parentRef: { group: '', kind: 'Service', name: 'legacy-mesh' }, conditions: [cond('Accepted', 'True', 2)] },
+          { parentRef: { name: 'default-gw' }, conditions: [cond('Accepted', 'False', 3)] },
+        ],
+      },
+    }
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Not Accepted', level: 'unhealthy' })
+  })
+
+  it('takes a condition with no observedGeneration at face value', () => {
+    // Missing is not stale: a controller that never sets it must not strand the
+    // route as Pending forever.
+    const r = route({
+      generation: 7,
+      parents: [{ parentRef: { name: 'gw' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Accepted', level: 'healthy' })
+  })
+
+  it('lets a live healthy parent win over a superseded report for the same parent', () => {
+    // A report describing a spec that has since changed says nothing about the
+    // current one, so it must not hold a confirmed parent at Pending.
+    const r = route({
+      generation: 3,
+      parents: [
+        { parentRef: { name: 'gw' }, controllerName: 'old/ctrl', conditions: [cond('Accepted', 'True', 2), cond('ResolvedRefs', 'True', 2)] },
+        { parentRef: { name: 'gw' }, controllerName: 'new/ctrl', conditions: [cond('Accepted', 'True', 3), cond('ResolvedRefs', 'True', 3)] },
+      ],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Accepted', level: 'healthy' })
+  })
+
+  it('does not let confirmed parents speak for one that only has a stale report', () => {
+    // gw-a's sole report describes a superseded spec, so nothing has confirmed
+    // it. A healthy gw-b must not carry the verdict to Accepted on its own.
+    const r = route({
+      generation: 4,
+      refs: [{ name: 'gw-a' }, { name: 'gw-b' }],
+      parents: [
+        { parentRef: { name: 'gw-a' }, conditions: [cond('Accepted', 'True', 2), cond('ResolvedRefs', 'True', 2)] },
+        { parentRef: { name: 'gw-b' }, conditions: [cond('Accepted', 'True', 4), cond('ResolvedRefs', 'True', 4)] },
+      ],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Pending', level: 'degraded' })
+  })
+
+  it('does not claim full rejection while a parent is unconfirmed', () => {
+    const r = route({
+      generation: 4,
+      refs: [{ name: 'gw-a' }, { name: 'gw-b' }],
+      parents: [
+        { parentRef: { name: 'gw-a' }, conditions: [cond('Accepted', 'False', 2)] },
+        { parentRef: { name: 'gw-b' }, conditions: [cond('Accepted', 'False', 4)] },
+      ],
+    })
+    // gw-a is unconfirmed against the current spec, so "every parent rejects"
+    // is not established — the live rejection still shows, as Degraded.
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Degraded', level: 'degraded' })
+  })
+
+  it('matches a parent whose namespace and kind are defaulted on one side only', () => {
+    const r = route({
+      namespace: 'prod',
+      refs: [{ name: 'gw' }],
+      parents: [{
+        parentRef: { name: 'gw', kind: 'Gateway', namespace: 'prod', group: 'gateway.networking.k8s.io' },
+        conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')],
+      }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Accepted', level: 'healthy' })
+  })
+
+  it('does not match a report for a different sectionName', () => {
+    const r = route({
+      refs: [{ name: 'gw', sectionName: 'https' }],
+      parents: [{ parentRef: { name: 'gw', sectionName: 'http' }, conditions: [cond('Accepted', 'True')] }],
+    })
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Unknown', level: 'unknown' })
+  })
+})
+
+describe('getRouteStatusReason', () => {
+  const cond = (type: string, status: string, extra: any = {}) => ({ type, status, ...extra })
+
+  it('names the parent and the controller reason behind a Degraded badge', () => {
+    const r = {
+      metadata: { namespace: 'prod' },
+      spec: { parentRefs: [{ name: 'gw' }] },
+      status: {
+        parents: [{
+          parentRef: { name: 'gw' },
+          conditions: [
+            cond('Accepted', 'True'),
+            cond('ResolvedRefs', 'False', { reason: 'BackendNotFound', message: 'Service prod/api not found' }),
+          ],
+        }],
+      },
+    }
+    expect(getRouteStatusReason(r)).toBe('gw: BackendNotFound: Service prod/api not found')
+  })
+
+  it('is empty when nothing is failing, so a healthy badge carries no hover', () => {
+    const r = {
+      metadata: { namespace: 'prod' },
+      spec: { parentRefs: [{ name: 'gw' }] },
+      status: { parents: [{ parentRef: { name: 'gw' }, conditions: [cond('Accepted', 'True'), cond('ResolvedRefs', 'True')] }] },
+    }
+    expect(getRouteStatusReason(r)).toBe('')
+  })
+
+  it('reports every failing parent, not just the first', () => {
+    const r = {
+      metadata: { namespace: 'prod' },
+      spec: { parentRefs: [{ name: 'gw-a' }, { name: 'gw-b' }] },
+      status: {
+        parents: [
+          { parentRef: { name: 'gw-a' }, conditions: [cond('Accepted', 'False', { reason: 'NotAllowedByListeners' })] },
+          { parentRef: { name: 'gw-b' }, conditions: [cond('ResolvedRefs', 'False', { reason: 'BackendNotFound' })] },
+        ],
+      },
+    }
+    expect(getRouteStatusReason(r)).toBe('gw-a: NotAllowedByListeners · gw-b: BackendNotFound')
+  })
+
+  it('describes the same parents the verdict counted', () => {
+    // A leftover report for a dropped parentRef must not explain a badge that
+    // never considered it.
+    const r = {
+      metadata: { namespace: 'prod' },
+      spec: { parentRefs: [{ name: 'gw-new' }] },
+      status: { parents: [{ parentRef: { name: 'gw-old' }, conditions: [cond('ResolvedRefs', 'False', { reason: 'BackendNotFound' })] }] },
+    }
+    expect(getRouteStatus(r)).toMatchObject({ text: 'Unknown' })
+    expect(getRouteStatusReason(r)).toBe('')
+  })
+})
+
+describe('getIstioGatewayStatus', () => {
+  it('does not claim health it cannot observe from spec alone', () => {
+    // A Gateway whose selector matches no running ingressgateway pod has
+    // servers like any other, so servers alone cannot assert liveness.
+    const gw = { spec: { servers: [{ port: { number: 80 } }] } }
+    expect(getIstioGatewayStatus(gw)).toMatchObject({ text: 'Defined', level: 'neutral' })
+  })
+
+  it('does not treat TLS as a verdict', () => {
+    const gw = { spec: { servers: [{ tls: { mode: 'SIMPLE' } }] } }
+    expect(getIstioGatewayStatus(gw)).toMatchObject({ text: 'Defined', level: 'neutral' })
+  })
+
+  it('still flags a gateway with no servers', () => {
+    expect(getIstioGatewayStatus({ spec: { servers: [] } })).toMatchObject({
+      text: 'No Servers', level: 'unhealthy',
+    })
+  })
+})