@skyhook-io/k8s-ui 1.14.1 → 1.14.3

package/src/components/resources/renderers/prometheus-cells.tsx

@@ -19,7 +19,7 @@ export function ServiceMonitorCell({ resource, column }: { resource: any; column
     case 'status': {
       const status = getServiceMonitorStatus(resource)
       return (
-        <span className={clsx('badge', status.color)}>
+        <span className={clsx('badge truncate max-w-full', status.color)} title={status.text}>
           {status.text}
         </span>
       )
@@ -40,7 +40,7 @@ export function PrometheusRuleCell({ resource, column }: { resource: any; column
     case 'status': {
       const status = getPrometheusRuleStatus(resource)
       return (
-        <span className={clsx('badge', status.color)}>
+        <span className={clsx('badge truncate max-w-full', status.color)} title={status.text}>
           {status.text}
         </span>
       )
@@ -59,7 +59,7 @@ export function PodMonitorCell({ resource, column }: { resource: any; column: st
     case 'status': {
       const status = getPodMonitorStatus(resource)
       return (
-        <span className={clsx('badge', status.color)}>
+        <span className={clsx('badge truncate max-w-full', status.color)} title={status.text}>
           {status.text}
         </span>
       )

package/src/components/resources/renderers/ray-cells.tsx

@@ -15,7 +15,7 @@ import {
   getRayServiceClusters,
   getRayCronJobStatus,
   getRayCronJobSchedule,
-  getRayCronJobSuspend,
+  getRayCronJobTimeZone,
   getRayCronJobLastSchedule,
 } from '../resource-utils-ray'
 
@@ -110,9 +110,17 @@ export function RayCronJobCell({ resource, column }: { resource: any; column: st
       const schedule = getRayCronJobSchedule(resource)
       return <span className="text-sm font-mono text-theme-text-secondary">{schedule}</span>
     }
-    case 'suspend': {
-      const suspended = getRayCronJobSuspend(resource)
-      return <span className="text-sm text-theme-text-secondary">{suspended ? 'Yes' : 'No'}</span>
+    case 'timeZone': {
+      const zone = getRayCronJobTimeZone(resource)
+      const declared = Boolean(resource.spec?.timeZone)
+      return (
+        <span
+          className={clsx('text-sm truncate block', declared ? 'text-theme-text-secondary' : 'text-theme-text-tertiary')}
+          title={zone}
+        >
+          {zone}
+        </span>
+      )
     }
     case 'lastSchedule': {
       const lastSchedule = getRayCronJobLastSchedule(resource)

package/src/components/resources/renderers/trivy-cells.tsx

@@ -6,6 +6,7 @@ import {
   getVulnerabilityReportSummary,
   getVulnerabilityReportContainer,
   getVulnerabilityReportImage,
+  getSbomReportImage,
   getConfigAuditReportSummary,
   getConfigAuditReportStatus,
   getExposedSecretReportSummary,
@@ -133,6 +134,12 @@ export function ClusterComplianceReportCell({ resource, column }: { resource: an
 
 export function SbomReportCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
+    case 'image': {
+      const image = getSbomReportImage(resource)
+      return (
+        <span className="text-sm text-theme-text-secondary truncate block" title={image}>{image}</span>
+      )
+    }
     case 'container':
       return <span className="text-sm text-theme-text-secondary">{getSbomReportContainer(resource)}</span>
     case 'components': {

package/src/components/resources/renderers/velero-cells.tsx

@@ -30,6 +30,7 @@ import {
   getVSLConfig,
   getBackupRepositoryStatus,
   getBackupRepositoryType,
+  getBackupRepositoryVolumeNamespace,
 } from '../resource-utils-velero'
 
 // The detail-page Phase value. The badge carries the same label the table
@@ -235,6 +236,8 @@ export function BackupRepositoryCell({ resource, column }: { resource: any; colu
         </span>
       )
     }
+    case 'volumeNamespace':
+      return <span className="text-sm text-theme-text-secondary">{getBackupRepositoryVolumeNamespace(resource)}</span>
     case 'repositoryType': {
       const type = getBackupRepositoryType(resource)
       // restic is on its way out (no new backups since v1.17, restore dropped in

package/src/components/resources/renderers/volcano-cells.tsx

@@ -16,7 +16,6 @@ import {
   getVolcanoPodGroupMinMember,
   getJobFlowStatus,
   getJobFlowFlowCount,
-  getJobTemplateStatus,
   getJobTemplateTaskCount,
 } from '../resource-utils-volcano'
 
@@ -122,14 +121,6 @@ export function JobFlowCell({ resource, column }: { resource: any; column: strin
 
 export function JobTemplateCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
-    case 'status': {
-      const status = getJobTemplateStatus(resource)
-      return (
-        <span className={clsx('badge', status.color)}>
-          {status.text}
-        </span>
-      )
-    }
     case 'tasks': {
       const count = getJobTemplateTaskCount(resource)
       return <span className="text-sm text-theme-text-secondary">{count > 0 ? count : '-'}</span>

package/src/components/resources/resource-utils-calico.test.ts

@@ -174,6 +174,12 @@ describe('IPPool derivations', () => {
       getCalicoIPPoolAllowedUses({ spec: { allowedUses: ['Tunnel'] } }),
     ).toBe('Tunnel')
   })
+
+  it('treats an empty allowedUses list as the default, not as no uses', () => {
+    // Calico: "If not specified or empty, defaults to ["Tunnel", "Workload"]".
+    // A dash here would read as a pool that allocates for nothing.
+    expect(getCalicoIPPoolAllowedUses({ spec: { allowedUses: [] } })).toBe('Workload, Tunnel')
+  })
 })
 
 describe('derived policy types', () => {

package/src/components/resources/resource-utils-calico.ts

@@ -256,6 +256,10 @@ export function getCalicoIPPoolEncapsulation(pool: any): string {
 
 export function getCalicoIPPoolAllowedUses(pool: any): string {
   const uses = pool?.spec?.allowedUses
-  if (!Array.isArray(uses)) return 'Workload, Tunnel'
-  return uses.length > 0 ? uses.map(String).join(', ') : '-'
+  // Calico documents an empty list as equivalent to an absent one: "If not
+  // specified or empty, defaults to ["Tunnel", "Workload"] for
+  // back-compatibility." Rendering a dash there would read as a pool that
+  // allocates for nothing.
+  if (!Array.isArray(uses) || uses.length === 0) return 'Workload, Tunnel'
+  return uses.map(String).join(', ')
 }

package/src/components/resources/resource-utils-cnpg.ts

@@ -646,6 +646,11 @@ export function getCNPGObjectStoreStatus(resource: any): StatusBadge {
   if (windows.some((w) => w.failingSinceLastSuccess)) {
     return { text: 'Backups Failing', color: healthColors.unhealthy, level: 'unhealthy' }
   }
+  // Every timestamp on a recovery window is optional, so a server can be listed
+  // with no recovery point at all. The entry existing is not a backup existing.
+  if (!windows.some((w) => w.firstRecoverabilityPoint || w.lastSuccessfulBackupTime)) {
+    return { text: 'No recovery point', color: healthColors.unknown, level: 'unknown' }
+  }
   return { text: 'Recoverable', color: healthColors.healthy, level: 'healthy' }
 }
 

package/src/components/resources/resource-utils-eso.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+import { getSecretStoreProviderType, getSecretStoreProviderKey } from './resource-utils-eso'
+
+// The provider label answers "which backend holds these secrets?", so it has to
+// track the upstream `spec.provider` field names rather than plausible ones.
+
+describe('getSecretStoreProviderType', () => {
+  it('names the AWS product rather than assuming Secrets Manager', () => {
+    // One `aws` key addresses three services; `service` is required and is the
+    // only thing that distinguishes them.
+    const forService = (service: string) =>
+      getSecretStoreProviderType({ spec: { provider: { aws: { service, region: 'us-east-1' } } } })
+
+    expect(forService('SecretsManager')).toBe('AWS Secrets Manager')
+    expect(forService('ParameterStore')).toBe('AWS Parameter Store')
+    expect(forService('CertificateManager')).toBe('AWS Certificate Manager')
+  })
+
+  it('falls back to the vendor when an AWS store declares no service', () => {
+    // Invalid per the CRD, but naming a product we cannot confirm is worse than
+    // naming only the vendor.
+    expect(getSecretStoreProviderType({ spec: { provider: { aws: {} } } })).toBe('AWS')
+  })
+
+  it('recognises Bitwarden under its real field name', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { bitwardensecretsmanager: {} } } }))
+      .toBe('Bitwarden Secrets Manager')
+  })
+
+  it('labels providers added after the map was first written', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { openBao: {} } } })).toBe('OpenBao')
+    expect(getSecretStoreProviderType({ spec: { provider: { conjur: {} } } })).toBe('CyberArk Conjur')
+  })
+
+  it('keeps v1beta1-only providers, which v1 clusters never send', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { device42: {} } } })).toBe('Device42')
+  })
+
+  it('shows the raw key rather than Unknown for an unrecognised provider', () => {
+    expect(getSecretStoreProviderType({ spec: { provider: { somefutureprovider: {} } } }))
+      .toBe('somefutureprovider')
+  })
+
+  it('reports nothing when there is no provider at all', () => {
+    expect(getSecretStoreProviderType({ spec: {} })).toBe('Unknown')
+  })
+})
+
+describe('getSecretStoreProviderKey', () => {
+  it('stays at the vendor level, which is what the badge colours by', () => {
+    const key = (service: string) =>
+      getSecretStoreProviderKey({ spec: { provider: { aws: { service } } } })
+    expect(key('SecretsManager')).toBe('aws')
+    expect(key('ParameterStore')).toBe('aws')
+  })
+})

package/src/components/resources/resource-utils-eso.ts

@@ -7,33 +7,63 @@ import { healthColors, formatAge } from './resource-utils'
 // PROVIDER DETECTION
 // ============================================================================
 
+// Keys are the SecretStore `spec.provider` field names. v1 and v1beta1 do not
+// carry the same set, so entries dropped upstream (device42, alibaba) stay for
+// clusters still serving v1beta1.
 const PROVIDER_MAP: Record<string, string> = {
-  aws: 'AWS Secrets Manager',
+  aws: 'AWS',
   azurekv: 'Azure Key Vault',
   gcpsm: 'GCP Secret Manager',
   vault: 'HashiCorp Vault',
+  openBao: 'OpenBao',
   kubernetes: 'Kubernetes',
+  crd: 'Kubernetes Resource',
   oracle: 'Oracle Vault',
   ibm: 'IBM Secrets Manager',
+  alibaba: 'Alibaba Cloud KMS',
+  ovh: 'OVHcloud Secret Manager',
+  volcengine: 'Volcengine',
+  cloudrusm: 'Cloud.ru Secret Manager',
+  nebiusmysterybox: 'Nebius Mysterybox',
+  barbican: 'OpenStack Barbican',
+  yandexlockbox: 'Yandex Lockbox',
+  yandexcertificatemanager: 'Yandex Certificate Manager',
   doppler: 'Doppler',
   onepassword: '1Password',
+  onepasswordSDK: '1Password',
+  bitwardensecretsmanager: 'Bitwarden Secrets Manager',
   senhasegura: 'senhasegura',
+  github: 'GitHub',
   gitlab: 'GitLab',
   webhook: 'Webhook',
   fake: 'Fake',
   keepersecurity: 'Keeper Security',
   scaleway: 'Scaleway',
-  delinea: 'Delinea',
+  conjur: 'CyberArk Conjur',
+  delinea: 'Delinea DevOps Secrets Vault',
+  secretserver: 'Delinea Secret Server',
+  beyondtrust: 'BeyondTrust',
+  beyondtrustworkloadcredentials: 'BeyondTrust Workload Credentials',
   chef: 'Chef',
   pulumi: 'Pulumi ESC',
   fortanix: 'Fortanix',
   passworddepot: 'Password Depot',
+  passbolt: 'Passbolt',
+  previder: 'Previder',
+  onboardbase: 'Onboardbase',
+  dvls: 'Devolutions Server',
   device42: 'Device42',
   akeyless: 'Akeyless',
-  beyondtrust: 'BeyondTrust',
   infisical: 'Infisical',
-  passbolt: 'Passbolt',
-  bitwarden: 'Bitwarden',
+  ngrok: 'ngrok',
+}
+
+// A single `aws` key addresses three unrelated AWS products; `service` is a
+// required enum and is the only thing that says which one holds the secrets.
+const AWS_SERVICE_LABELS: Record<string, string> = {
+  SecretsManager: 'AWS Secrets Manager',
+  ParameterStore: 'AWS Parameter Store',
+  CertificateManager: 'AWS Certificate Manager',
 }
 
 /**
@@ -44,6 +74,8 @@ export function getSecretStoreProviderType(resource: any): string {
   const provider = resource.spec?.provider
   if (!provider) return 'Unknown'
 
+  if (provider.aws) return AWS_SERVICE_LABELS[provider.aws.service] ?? 'AWS'
+
   for (const [key, label] of Object.entries(PROVIDER_MAP)) {
     if (provider[key]) return label
   }

package/src/components/resources/resource-utils-istio.ts

@@ -28,15 +28,19 @@ export function getVirtualServiceStatus(resource: any): StatusBadge {
   const tlsRoutes = spec.tls || []
   const hosts = spec.hosts || []
 
-  if (hosts.length === 0) {
-    return { text: 'No Hosts', color: healthColors.unhealthy, level: 'unhealthy' }
-  }
-
+  // Routes are what a VirtualService exists to provide, delegate or not.
   const totalRoutes = httpRoutes.length + tcpRoutes.length + tlsRoutes.length
   if (totalRoutes === 0) {
     return { text: 'No Routes', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
+  // A delegate VirtualService is required to declare no hosts, and this object
+  // cannot tell us whether a parent delegates to it, so an empty list is not
+  // evidence of a fault.
+  if (hosts.length === 0) {
+    return { text: 'No Hosts', color: healthColors.unknown, level: 'unknown' }
+  }
+
   // Check for fault injection on any route
   const hasFaultInjection = httpRoutes.some((r: any) => r.fault)
   if (hasFaultInjection) {
@@ -49,7 +53,7 @@ export function getVirtualServiceStatus(resource: any): StatusBadge {
     return { text: 'Mirroring', color: healthColors.degraded, level: 'degraded' }
   }
 
-  return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Defined', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getVirtualServiceHosts(resource: any): string {
@@ -123,26 +127,18 @@ export function getVirtualServiceDestinations(resource: any): Array<{ host: stri
 // DESTINATIONRULE UTILITIES
 // ============================================================================
 
+/**
+ * The only failure this object can show on its own.
+ *
+ * A rule without a host applies to nothing. Everything else it declares —
+ * subsets, a traffic policy — is configuration, and says nothing about whether
+ * the host is reachable or the policy is in effect.
+ */
 export function getDestinationRuleStatus(resource: any): StatusBadge {
-  const spec = resource.spec || {}
-  const host = spec.host
-
-  if (!host) {
+  if (!resource.spec?.host) {
     return { text: 'No Host', color: healthColors.unhealthy, level: 'unhealthy' }
   }
-
-  const subsets = spec.subsets || []
-  const trafficPolicy = spec.trafficPolicy
-
-  if (subsets.length > 0) {
-    return { text: pluralize(subsets.length, 'Subset'), color: healthColors.healthy, level: 'healthy' }
-  }
-
-  if (trafficPolicy) {
-    return { text: 'Configured', color: healthColors.healthy, level: 'healthy' }
-  }
-
-  return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Not assessed', color: healthColors.unknown, level: 'unknown' }
 }
 
 export function getDestinationRuleHost(resource: any): string {
@@ -161,6 +157,22 @@ export function getDestinationRuleSubsets(resource: any): Array<{ name: string;
   }))
 }
 
+/**
+ * The client-side TLS mode this rule declares for its host.
+ *
+ * What it means depends on a different object. DISABLE is defined as "do not
+ * setup a TLS connection to the upstream endpoint", so the client sends
+ * plaintext; a PeerAuthentication STRICT is "an mTLS tunnel (TLS with client
+ * cert must be presented)" and PERMISSIVE is "either plaintext or mTLS tunnel".
+ * The pairing therefore lands as unencrypted traffic or as rejected requests —
+ * deduced from those two definitions, since neither API documents the mismatch
+ * directly. Nothing in this row shows which, and subset and port policies can
+ * override the mode besides, so it reports the declaration and not the posture.
+ */
+export function getDestinationRuleTlsMode(resource: any): string {
+  return getDestinationRuleTrafficPolicy(resource)?.tls?.mode || '-'
+}
+
 export function getDestinationRuleTrafficPolicy(resource: any): {
   connectionPool?: { tcp?: any; http?: any }
   loadBalancer?: { simple?: string; consistentHash?: any }
@@ -182,6 +194,15 @@ export function getDestinationRuleLoadBalancer(resource: any): string {
 // ISTIO GATEWAY UTILITIES
 // ============================================================================
 
+/**
+ * What spec.servers alone can honestly claim.
+ *
+ * Not liveness: an Istio Gateway whose spec.selector matches no running
+ * ingressgateway pod is how these actually fail, and it has servers like any
+ * other, so a green badge there would say the opposite of the truth. TLS is a
+ * property of a server rather than a verdict, and this slot is the one every
+ * other kind here uses for a verdict.
+ */
 export function getIstioGatewayStatus(resource: any): StatusBadge {
   const servers = resource.spec?.servers || []
 
@@ -189,12 +210,7 @@ export function getIstioGatewayStatus(resource: any): StatusBadge {
     return { text: 'No Servers', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
-  const hasTLS = servers.some((s: any) => s.tls)
-  if (hasTLS) {
-    return { text: 'TLS', color: healthColors.healthy, level: 'healthy' }
-  }
-
-  return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Defined', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getIstioGatewayServers(resource: any): Array<{
@@ -236,12 +252,14 @@ export function getServiceEntryStatus(resource: any): StatusBadge {
     return { text: 'No Hosts', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
+  // Location is a mesh-membership classification, not reachability: nothing here
+  // establishes the hosts resolve or answer.
   const location = spec.location || 'MESH_EXTERNAL'
   if (location === 'MESH_EXTERNAL') {
-    return { text: 'External', color: healthColors.healthy, level: 'healthy' }
+    return { text: 'External', color: healthColors.neutral, level: 'neutral' }
   }
 
-  return { text: 'Internal', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Internal', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getServiceEntryHosts(resource: any): string {
@@ -327,21 +345,33 @@ export function getPeerAuthenticationPortLevelMtls(resource: any): Record<string
 // AUTHORIZATIONPOLICY UTILITIES
 // ============================================================================
 
+/**
+ * What one AuthorizationPolicy declares — never a health verdict.
+ *
+ * An action is not a state of wellness: a DENY doing its job is not unhealthy,
+ * and an ALLOW is not proof anything is permitted. The request decision is made
+ * across every policy selecting the workload, so no single object can establish
+ * it, and a green or red tone would assert an answer this object does not have.
+ *
+ * The one shape worth marking is an ALLOW — the default action — carrying no
+ * rules. Rules are alternatives, so zero of them match nothing, and Istio
+ * documents `spec: {}` as the deny-all idiom. Amber says look closer; it stops
+ * short of claiming the outage, because other policies may permit the traffic.
+ */
 export function getAuthorizationPolicyStatus(resource: any): StatusBadge {
   const action = resource.spec?.action || 'ALLOW'
   const rules = resource.spec?.rules || []
 
-  switch (action) {
-    case 'ALLOW':
-      return { text: `Allow (${pluralize(rules.length, 'rule')})`, color: healthColors.healthy, level: 'healthy' }
-    case 'DENY':
-      return { text: `Deny (${pluralize(rules.length, 'rule')})`, color: healthColors.unhealthy, level: 'unhealthy' }
-    case 'CUSTOM':
-      return { text: 'Custom', color: healthColors.degraded, level: 'degraded' }
-    case 'AUDIT':
-      return { text: 'Audit', color: healthColors.degraded, level: 'degraded' }
-    default:
-      return { text: action, color: healthColors.unknown, level: 'unknown' }
+  if (action === 'ALLOW' && rules.length === 0) {
+    return { text: 'No allow rules', color: healthColors.degraded, level: 'degraded' }
+  }
+  const known: Record<string, string> = { ALLOW: 'Allow', DENY: 'Deny', CUSTOM: 'Custom', AUDIT: 'Audit' }
+  const label = known[action]
+  if (!label) return { text: action, color: healthColors.unknown, level: 'unknown' }
+  return {
+    text: `${label} (${pluralize(rules.length, 'rule')})`,
+    color: healthColors.neutral,
+    level: 'neutral',
   }
 }
 
@@ -365,9 +395,87 @@ export function getAuthorizationPolicySelector(resource: any): Record<string, st
   return resource.spec?.selector?.matchLabels || {}
 }
 
+/**
+ * What the policy declares it applies to.
+ *
+ * A policy can attach by targetRef instead of by labels — waypoints and
+ * Gateways in ambient mode do — so the selector alone does not describe scope.
+ * With neither, scope is inherited: the namespace, or the whole mesh when the policy
+ * sits in the mesh root namespace. Which of those applies depends on
+ * MeshConfig.rootNamespace, which is not readable from this object, so the cell
+ * names both rather than guessing from the conventional namespace name.
+ */
 export function getAuthorizationPolicySelectorString(resource: any): string {
-  const labels = resource.spec?.selector?.matchLabels || {}
-  const entries = Object.entries(labels)
-  if (entries.length === 0) return 'Namespace-wide'
+  const spec = resource.spec || {}
+  const targets = [
+    ...(Array.isArray(spec.targetRefs) ? spec.targetRefs : []),
+    ...(spec.targetRef ? [spec.targetRef] : []),
+  ].filter(Boolean)
+  if (targets.length > 0) {
+    return targets
+      .map((t: any) => {
+        const name = [t?.kind, t?.name].filter(Boolean).join('/') || 'target'
+        return t?.namespace && t.namespace !== resource.metadata?.namespace
+          ? `${t.namespace}/${name}`
+          : name
+      })
+      .join(', ')
+  }
+  const entries = Object.entries(spec.selector?.matchLabels || {})
+  if (entries.length === 0) return 'Namespace / mesh scope'
   return entries.map(([k, v]) => `${k}=${v}`).join(', ')
 }
+
+/**
+ * What an AuthorizationPolicy's rule list means for the traffic it governs.
+ *
+ * Rules are alternatives and an unset list never matches, so BOTH actions with
+ * no rules are inert in the same way — a DENY with none denies nothing, an
+ * ALLOW with none permits nothing. Only the ALLOW case has a consequence worth
+ * raising, because a workload with any ALLOW policy admits only what one of
+ * them matches. Neither can be stated as an outcome for the workload: every
+ * policy selecting it takes part in the decision.
+ */
+export function getAuthorizationPolicyRuleNotice(
+  resource: any,
+): { level: 'warning' | 'info'; title: string; message: string } | null {
+  const action = resource?.spec?.action || 'ALLOW'
+  const rules = resource?.spec?.rules
+  if (Array.isArray(rules) && rules.length > 0) {
+    // A rule matches every request when it carries no conditions — which
+    // includes serialized empty lists, not just an empty object. On a DENY that
+    // is not a baseline other policies carve exceptions out of: DENY is
+    // evaluated first, so no ALLOW can re-permit what it matches. Unknown keys
+    // are treated as conditions, so a future field cannot be read as blanket.
+    const CONDITION_KEYS = ['from', 'to', 'when']
+    const matchesEverything = rules.some((r: any) => {
+      if (!r || typeof r !== 'object') return false
+      const keys = Object.keys(r)
+      if (keys.some(k => !CONDITION_KEYS.includes(k))) return false
+      return CONDITION_KEYS.every(k => !Array.isArray(r[k]) || r[k].length === 0)
+    })
+    if (action === 'DENY' && matchesEverything) {
+      return {
+        level: 'info',
+        title: 'Matches all requests',
+        message: 'A rule with no conditions matches every request, so this policy denies all traffic to the workloads it selects. DENY is evaluated before ALLOW, so no ALLOW policy can permit an exception.',
+      }
+    }
+    return null
+  }
+  if (action === 'ALLOW') {
+    return {
+      level: 'warning',
+      title: 'No allow rules',
+      message: 'Rules are alternatives, so an ALLOW policy with none of them matches nothing and contributes no permitted traffic. Other ALLOW policies selecting the same workload may still permit requests — a default-deny-plus-exceptions setup looks exactly like this.',
+    }
+  }
+  if (action === 'DENY') {
+    return {
+      level: 'info',
+      title: 'No deny rules',
+      message: 'This DENY policy has no rules, so it matches no requests and denies no traffic. Other policies may still deny requests.',
+    }
+  }
+  return null
+}

package/src/components/resources/resource-utils-kyverno.ts

@@ -107,12 +107,9 @@ export function getKyvernoPolicyStatus(resource: any): StatusBadge {
     return { text: readyCond.reason || 'Not Ready', color: healthColors.unhealthy, level: 'unhealthy' }
   }
 
-  // Fallback: if spec exists, likely active
-  if (resource.spec?.rules?.length > 0) {
-    return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
-  }
-
-  return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  // Reached when the controller has not written Ready, or wrote it as Unknown.
+  // Declaring rules is not the controller accepting them.
+  return { text: 'Not assessed', color: healthColors.unknown, level: 'unknown' }
 }
 
 /**