@skyhook-io/k8s-ui 1.14.1 → 1.14.3

package/src/components/resources/resource-utils-prometheus.ts

@@ -7,31 +7,59 @@ import { healthColors } from './resource-utils'
 // SHARED HELPERS
 // ============================================================================
 
-function getConditionStatus(resource: any): StatusBadge {
-  const conditions = resource.status?.conditions || []
-
-  const reconciledCond = conditions.find((c: any) => c.type === 'Reconciled')
-  if (reconciledCond?.status === 'True') {
-    return { text: 'Reconciled', color: healthColors.healthy, level: 'healthy' }
-  }
-  if (reconciledCond?.status === 'False') {
-    return { text: reconciledCond.reason || 'Not Reconciled', color: healthColors.unhealthy, level: 'unhealthy' }
+// ServiceMonitor, PodMonitor and PrometheusRule are configuration resources.
+// They have no `status.conditions`: the operator reports per selecting workload
+// under `status.bindings[].conditions`, the only condition type is `Accepted`,
+// and it writes any of it only when the StatusForConfigurationResources feature
+// gate is on. Absence is therefore the ordinary case and is not evidence the
+// configuration works — and `Accepted` means the config was accepted, not that
+// any target is being scraped.
+function getConfigResourceStatus(resource: any): StatusBadge {
+  const generation = resource?.metadata?.generation
+  let reporting = 0
+  let accepted = 0
+  let rejected = 0
+  let rejection = ''
+
+  for (const binding of resource?.status?.bindings || []) {
+    for (const cond of binding?.conditions || []) {
+      if (cond?.type !== 'Accepted') continue
+      // A condition observed against an older spec does not describe the object
+      // as it stands now.
+      if (generation !== undefined && cond.observedGeneration !== undefined
+        && cond.observedGeneration !== generation) continue
+      reporting++
+      if (cond.status === 'True') accepted++
+      else if (cond.status === 'False') {
+        rejected++
+        if (!rejection) rejection = cond.reason || ''
+      }
+    }
   }
 
-  const availableCond = conditions.find((c: any) => c.type === 'Available')
-  if (availableCond?.status === 'True') {
-    return { text: 'Available', color: healthColors.healthy, level: 'healthy' }
+  if (reporting === 0) {
+    return { text: 'Not assessed', color: healthColors.unknown, level: 'unknown' }
   }
-  if (availableCond?.status === 'False') {
-    return { text: availableCond.reason || 'Unavailable', color: healthColors.unhealthy, level: 'unhealthy' }
+  if (rejected === reporting) {
+    return { text: rejection || 'Not Accepted', color: healthColors.unhealthy, level: 'unhealthy' }
   }
-
-  // Fallback: if resource exists but has no conditions, it's likely active
-  if (resource.spec) {
-    return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+  if (rejected > 0) {
+    return {
+      text: `Accepted by ${accepted}/${reporting}`,
+      color: healthColors.degraded,
+      level: 'degraded',
+    }
   }
-
-  return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  // No rejection, but a workload reported Accepted=Unknown: it has not decided,
+  // so the resource is not accepted everywhere that selects it.
+  if (accepted < reporting) {
+    return {
+      text: `Accepted by ${accepted}/${reporting}`,
+      color: healthColors.unknown,
+      level: 'unknown',
+    }
+  }
+  return { text: 'Accepted', color: healthColors.healthy, level: 'healthy' }
 }
 
 function formatMatchLabels(selector: any): string {
@@ -45,7 +73,7 @@ function formatMatchLabels(selector: any): string {
 // ============================================================================
 
 export function getServiceMonitorStatus(resource: any): StatusBadge {
-  return getConditionStatus(resource)
+  return getConfigResourceStatus(resource)
 }
 
 export function getServiceMonitorEndpointCount(resource: any): number {
@@ -87,7 +115,7 @@ export function getServiceMonitorNamespaceSelector(resource: any): string {
 // ============================================================================
 
 export function getPrometheusRuleStatus(resource: any): StatusBadge {
-  return getConditionStatus(resource)
+  return getConfigResourceStatus(resource)
 }
 
 export function getPrometheusRuleGroupCount(resource: any): number {
@@ -169,7 +197,7 @@ export function getPrometheusRuleGroups(resource: any): PrometheusRuleGroup[] {
 // ============================================================================
 
 export function getPodMonitorStatus(resource: any): StatusBadge {
-  return getConditionStatus(resource)
+  return getConfigResourceStatus(resource)
 }
 
 export function getPodMonitorEndpointCount(resource: any): number {

package/src/components/resources/resource-utils-ray.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest'
+import { getRayCronJobTimeZone, getRayCronJobStatus } from './resource-utils-ray'
+import { getCellFilterValue } from './resource-utils'
+
+describe('getRayCronJobTimeZone', () => {
+  it('shows the declared zone', () => {
+    expect(getRayCronJobTimeZone({ spec: { schedule: '0 2 * * *', timeZone: 'America/New_York' } }))
+      .toBe('America/New_York')
+  })
+
+  it('does not present an undeclared zone as UTC', () => {
+    // KubeRay reads the schedule in the operator pod's local zone when timeZone
+    // is unset, so the object cannot say what the cron expression means.
+    expect(getRayCronJobTimeZone({ spec: { schedule: '0 2 * * *' } })).toBe('Operator local')
+  })
+})
+
+describe('getRayCronJobStatus', () => {
+  it('reports only what spec.suspend says, which is all the CRD carries', () => {
+    // RayCronJobStatus holds lastScheduleTime and nothing else — there is no
+    // controller-reported phase for this badge to reflect.
+    expect(getRayCronJobStatus({ spec: { suspend: true } }).text).toBe('Suspended')
+    expect(getRayCronJobStatus({ spec: {} }).text).toBe('Active')
+  })
+})
+
+describe('getCellFilterValue for raycronjobs timeZone', () => {
+  it('offers the same value the cell renders, so undeclared rows stay filterable', () => {
+    // The generic fallback reads spec.timeZone and yields '' when unset, which
+    // would hide those rows from a filter whose column shows them a value.
+    expect(getCellFilterValue({ spec: { schedule: '0 2 * * *' } }, 'timeZone', 'raycronjobs'))
+      .toBe('Operator local')
+    expect(getCellFilterValue({ spec: { timeZone: 'Europe/Berlin' } }, 'timeZone', 'raycronjobs'))
+      .toBe('Europe/Berlin')
+  })
+})

package/src/components/resources/resource-utils-ray.ts

@@ -203,6 +203,12 @@ export function getRayCronJobSchedule(resource: any): string {
   return resource.spec?.schedule || '-'
 }
 
+// An unset timeZone does not mean UTC: KubeRay reads the schedule in the
+// operator pod's own local zone, which this object cannot report.
+export function getRayCronJobTimeZone(resource: any): string {
+  return resource.spec?.timeZone || 'Operator local'
+}
+
 export function getRayCronJobSuspend(resource: any): boolean {
   return resource.spec?.suspend === true
 }

package/src/components/resources/resource-utils-trivy.ts

@@ -102,6 +102,9 @@ export const getExposedSecretReportSummary = getVulnerabilityReportSummary
 export const getExposedSecretReportContainer = getVulnerabilityReportContainer
 export const getExposedSecretReportImage = getVulnerabilityReportImage
 
+// SBOM reports carry the same report.artifact/registry shape as the scan reports.
+export const getSbomReportImage = getVulnerabilityReportImage
+
 export const getExposedSecretReportStatus = getVulnerabilityReportStatus
 
 // ============================================================================

package/src/components/resources/resource-utils.ts

@@ -11,11 +11,12 @@ import { getNodePoolStatus, getNodeClaimStatus } from './resource-utils-karpente
 import { getScaledObjectStatus, getScaledJobStatus } from './resource-utils-keda'
 import { getGitRepositoryStatus, getOCIRepositoryStatus, getHelmRepositoryStatus, getHelmRepositoryType, getKustomizationStatus, getFluxHelmReleaseStatus, getFluxAlertStatus } from './resource-utils-flux'
 import { getArgoApplicationStatus, getArgoApplicationSetStatus, getArgoApplicationSync, getArgoApplicationHealth, getArgoApplicationProject } from './resource-utils-argo'
-import { getPolicyReportStatus as _getPolicyReportStatus, getKyvernoPolicyStatus as _getKyvernoPolicyStatus } from './resource-utils-kyverno'
+import { getVulnerabilityReportImage as _getVulnerabilityReportImage } from './resource-utils-trivy'
+import { getKyvernoPolicyRuleTypes as _getKyvernoPolicyRuleTypes, getPolicyReportStatus as _getPolicyReportStatus, getKyvernoPolicyStatus as _getKyvernoPolicyStatus } from './resource-utils-kyverno'
 import { getResourceClaimStatus as _getResourceClaimStatus, getResourceClaimDeviceClasses as _getResourceClaimDeviceClasses, getResourceClaimTemplateDeviceClasses as _getResourceClaimTemplateDeviceClasses, getResourceClaimAllocation as _getResourceClaimAllocation, getResourceClaimReservedFor as _getResourceClaimReservedFor } from './resource-utils-dra'
 import { getNvidiaClusterPolicyStatus as _getNvidiaClusterPolicyStatus, getNvidiaClusterPolicyEnabledComponents as _getNvidiaClusterPolicyEnabledComponents, getNvidiaDriverStatus as _getNvidiaDriverStatus } from './resource-utils-nvidia'
 import { getClusterQueueStatus as _getClusterQueueStatus, getLocalQueueStatus as _getLocalQueueStatus, getKueueWorkloadStatus as _getKueueWorkloadStatus, getResourceFlavorStatus as _getResourceFlavorStatus, getAdmissionCheckStatus as _getAdmissionCheckStatus, getProvisioningRequestStatus as _getProvisioningRequestStatus } from './resource-utils-kueue'
-import { getRayClusterStatus as _getRayClusterStatus, getRayJobStatus as _getRayJobStatus, getRayServiceStatus as _getRayServiceStatus, getRayCronJobStatus as _getRayCronJobStatus } from './resource-utils-ray'
+import { getRayClusterStatus as _getRayClusterStatus, getRayJobStatus as _getRayJobStatus, getRayServiceStatus as _getRayServiceStatus, getRayCronJobStatus as _getRayCronJobStatus, getRayCronJobTimeZone as _getRayCronJobTimeZone } from './resource-utils-ray'
 import { getLeaderWorkerSetStatus as _getLeaderWorkerSetStatus, getJobSetStatus as _getJobSetStatus } from './resource-utils-jobset-lws'
 import { getInferenceServiceStatus as _getInferenceServiceStatus, getServingRuntimeStatus as _getServingRuntimeStatus, getInferenceGraphStatus as _getInferenceGraphStatus, getTrainedModelStatus as _getTrainedModelStatus, getLLMInferenceServiceStatus as _getLLMInferenceServiceStatus } from './resource-utils-kserve'
 import { getInferencePoolStatus as _getInferencePoolStatus, getInferenceObjectiveStatus as _getInferenceObjectiveStatus } from './resource-utils-inference-gateway'
@@ -30,8 +31,8 @@ import { getExternalSecretStatus as _getExternalSecretStatus, getClusterExternal
 import { getHPATableState, hpaStatusFromState } from './resource-utils-hpa'
 import { getCNPGClusterStatus as _getCNPGClusterStatus, getCNPGBackupStatus as _getCNPGBackupStatus, getCNPGScheduledBackupStatus as _getCNPGScheduledBackupStatus, getCNPGPoolerStatus as _getCNPGPoolerStatus, isApiGroup as _isApiGroup, CNPG_GROUP as _CNPG_GROUP } from './resource-utils-cnpg'
 import { getGenericResourceStatus } from './generic-status'
-import { getIstioGatewayStatus as _getIstioGatewayStatus, getIstioGatewayServerCount as _getIstioGatewayServerCount, getIstioGatewaySelectorString as _getIstioGatewaySelectorString } from './resource-utils-istio'
-import { getCalicoIPPoolAllowedUses, getCalicoIPPoolBlockSize, getCalicoIPPoolEncapsulation, getCalicoPolicyNamespaceSelector, getCalicoPolicyServiceAccountSelector, getCalicoPolicyTypes, isCalicoApiVersion, isCalicoPolicyResource } from './resource-utils-calico'
+import { getIstioGatewayStatus as _getIstioGatewayStatus, getIstioGatewayServerCount as _getIstioGatewayServerCount, getIstioGatewaySelectorString as _getIstioGatewaySelectorString, getAuthorizationPolicySelectorString as _getAuthorizationPolicySelectorString, getDestinationRuleTlsMode as _getDestinationRuleTlsMode } from './resource-utils-istio'
+import { formatKubernetesLabelSelector, getCalicoIPPoolAllowedUses, getCalicoIPPoolBlockSize, getCalicoIPPoolEncapsulation, getCalicoPolicyNamespaceSelector, getCalicoPolicyServiceAccountSelector, getCalicoPolicyTypes, isCalicoApiVersion, isCalicoPolicyResource } from './resource-utils-calico'
 
 // ============================================================================
 // STATUS & HEALTH UTILITIES
@@ -1861,21 +1862,145 @@ export function getGatewayClassDescription(gc: any): string {
 // GATEWAY API ROUTE UTILITIES (shared by HTTPRoute, GRPCRoute, TCPRoute, TLSRoute)
 // ============================================================================
 
+const GATEWAY_API_GROUP = 'gateway.networking.k8s.io'
+
+/**
+ * Whether a status report describes a parent the spec still asks for.
+ *
+ * A controller can leave a report behind after its parentRef is removed, and
+ * the defaults matter: an unset group/kind/namespace on either side means
+ * gateway.networking.k8s.io, Gateway, and the route's own namespace.
+ */
+function isReportForParentRef(ref: any, reported: any, routeNamespace: string): boolean {
+  const norm = (r: any) => ({
+    group: r?.group ?? GATEWAY_API_GROUP,
+    kind: r?.kind ?? 'Gateway',
+    namespace: r?.namespace ?? routeNamespace,
+    name: r?.name,
+    sectionName: r?.sectionName,
+    port: r?.port,
+  })
+  const a = norm(ref)
+  const b = norm(reported)
+  return a.group === b.group && a.kind === b.kind && a.namespace === b.namespace &&
+    a.name === b.name && a.sectionName === b.sectionName && a.port === b.port
+}
+
 // All Gateway API route types share the same status/parents/rules/hostnames structure
+/**
+ * A route's verdict, from BOTH conditions the API guarantees it carries.
+ *
+ * Accepted alone is not health: a backendRef naming a Service that does not
+ * exist is Accepted=True by design, because the gateway still has to answer the
+ * request — with a 5xx. Reading only Accepted therefore reported the "why is my
+ * route 503ing" case as healthy, beside a Backends column naming the Service
+ * that is missing. An ABSENT ResolvedRefs is not healthy either: GEP-1364 has
+ * routes always carry both, so a missing one means nothing has confirmed the
+ * refs yet.
+ */
+/**
+ * The reports that describe parents this route is actually attached to, plus
+ * the readers the verdict uses. Shared with getRouteStatusReason so the badge
+ * and its explanation can never disagree about which parents counted.
+ */
+function routeParentEvidence(route: any) {
+  const refs = route.spec?.parentRefs || []
+  const reports = route.status?.parents || []
+  const routeNamespace = route.metadata?.namespace || ''
+  const generation = route.metadata?.generation
+
+  // Status entries are identified by parentRef AND controllerName, so one
+  // parent can carry reports from two controllers while one replaces the other.
+  // All of them count: reading a single report would make the verdict depend on
+  // their order in the array.
+  const reportsFor = (ref: any) =>
+    reports.filter((p: any) => isReportForParentRef(ref, p?.parentRef, routeNamespace))
+  const perRef = refs.map(reportsFor)
+
+  // A route can also attach to default Gateways without naming them, in which
+  // case the attachment exists only in status. Those reports are real and their
+  // failures must count. Without that opt-in an unmatched report is a leftover
+  // from a parentRef the spec no longer names, and counting it would resurrect
+  // a verdict for a parent the route has left.
+  const useDefaultGateways = route.spec?.useDefaultGateways
+  const attachedByDefault = useDefaultGateways !== undefined && useDefaultGateways !== 'None'
+  const claimed = new Set(perRef.flat())
+  // Only a Gateway can be a default parent. An unmatched report for anything
+  // else — a mesh Service parent the spec has dropped — is obsolete by
+  // definition, and would otherwise keep voting forever if its controller is
+  // gone.
+  const isDefaultGatewayReport = (p: any) =>
+    (p?.parentRef?.group ?? GATEWAY_API_GROUP) === GATEWAY_API_GROUP &&
+    (p?.parentRef?.kind ?? 'Gateway') === 'Gateway'
+  const considered = attachedByDefault
+    ? [...perRef.flat(), ...reports.filter((p: any) => !claimed.has(p) && isDefaultGatewayReport(p))]
+    : perRef.flat()
+
+  // A condition observed against a superseded generation describes a spec that
+  // has since changed, so it cannot confirm the current one. A condition with no
+  // observedGeneration at all is taken at face value.
+  const isCurrent = (c: any) =>
+    c?.observedGeneration === undefined || generation === undefined || c.observedGeneration === generation
+  const conditionOf = (report: any, type: string) =>
+    (report?.conditions || []).filter((c: any) => c?.type === type && isCurrent(c)).pop()
+  const statusOf = (report: any, type: string) => conditionOf(report, type)?.status
+
+  // A report whose conditions all describe a superseded spec says nothing about
+  // the current one, either way — so it neither votes nor confirms the parent it
+  // belongs to. Requiring it to agree would let one leftover from a replaced
+  // controller hold a live healthy parent at Pending; counting it as
+  // confirmation would let the other parents speak for one nothing has
+  // confirmed.
+  const speaksToCurrentSpec = (r: any) =>
+    conditionOf(r, 'Accepted') !== undefined || conditionOf(r, 'ResolvedRefs') !== undefined
+  const current = considered.filter(speaksToCurrentSpec)
+  const everyRefConfirmed = perRef.every((list: any[]) => list.some(speaksToCurrentSpec))
+
+  return { considered, current, everyRefConfirmed, conditionOf, statusOf }
+}
+
 export function getRouteStatus(route: any): StatusBadge {
-  const parents = route.status?.parents || []
-  if (parents.length === 0) return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
-  const allAccepted = parents.every((p: any) =>
-    (p.conditions || []).some((c: any) => c.type === 'Accepted' && c.status === 'True')
-  )
-  const anyRejected = parents.some((p: any) =>
-    (p.conditions || []).some((c: any) => c.type === 'Accepted' && c.status === 'False')
-  )
-  if (allAccepted) return { text: 'Accepted', color: healthColors.healthy, level: 'healthy' }
-  if (anyRejected) return { text: 'Not Accepted', color: healthColors.unhealthy, level: 'unhealthy' }
+  const { considered, current, everyRefConfirmed, statusOf } = routeParentEvidence(route)
+
+  if (considered.length === 0) return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }
+  if (current.length === 0) return { text: 'Pending', color: healthColors.degraded, level: 'degraded' }
+  const anyFailure = current.some((r: any) =>
+    statusOf(r, 'Accepted') === 'False' || statusOf(r, 'ResolvedRefs') === 'False')
+
+  if (everyRefConfirmed && current.every((r: any) => statusOf(r, 'Accepted') === 'False')) {
+    return { text: 'Not Accepted', color: healthColors.unhealthy, level: 'unhealthy' }
+  }
+  if (anyFailure) {
+    return { text: 'Degraded', color: healthColors.degraded, level: 'degraded' }
+  }
+  if (everyRefConfirmed && current.every((r: any) =>
+      statusOf(r, 'Accepted') === 'True' && statusOf(r, 'ResolvedRefs') === 'True')) {
+    return { text: 'Accepted', color: healthColors.healthy, level: 'healthy' }
+  }
   return { text: 'Pending', color: healthColors.degraded, level: 'degraded' }
 }
 
+/**
+ * Why the badge says what it says: which parent is unhappy, and the controller's
+ * own reason. Without it "Degraded" tells an operator something is wrong and
+ * nothing about what — and the whole point of reading ResolvedRefs is that the
+ * answer is usually "the backend you named does not exist".
+ */
+export function getRouteStatusReason(route: any): string {
+  const { current, conditionOf } = routeParentEvidence(route)
+  const parts: string[] = []
+  for (const report of current) {
+    const name = report?.parentRef?.name || 'parent'
+    for (const type of ['Accepted', 'ResolvedRefs']) {
+      const c = conditionOf(report, type)
+      if (c?.status !== 'False') continue
+      const detail = [c.reason, c.message].filter(Boolean).join(': ')
+      parts.push(detail ? `${name}: ${detail}` : `${name}: ${type} is false`)
+    }
+  }
+  return parts.join(' · ')
+}
+
 export function getRouteParents(route: any): string {
   const refs = route.spec?.parentRefs || []
   return refs.map((r: any) => r.name).join(', ') || '-'
@@ -1954,10 +2079,24 @@ export function getNetworkPolicyRuleCount(np: any): { ingress: number; egress: n
   }
 }
 
+/**
+ * Who the policy applies to.
+ *
+ * podSelector is a LabelSelector, so it can target a subset through
+ * matchExpressions alone. Reading only matchLabels reported those policies as
+ * covering the whole namespace — a gap rendered as coverage, on the surface
+ * where that reads as "this namespace is protected, look elsewhere".
+ */
 export function getNetworkPolicySelector(np: any): string {
-  const labels = np.spec?.podSelector?.matchLabels
-  if (!labels || Object.keys(labels).length === 0) return 'All pods'
-  return Object.entries(labels).map(([k, v]) => `${k}=${v}`).join(', ')
+  const selector = np.spec?.podSelector
+  const hasLabels = Object.keys(selector?.matchLabels ?? {}).length > 0
+  // Count only what the formatter will actually render: it skips malformed
+  // entries, and an expression list of nothing but those would otherwise reach
+  // its empty-case string and describe the same state in different words.
+  const hasExpressions = (Array.isArray(selector?.matchExpressions) ? selector.matchExpressions : [])
+    .some((e: any) => e && typeof e === 'object')
+  if (!hasLabels && !hasExpressions) return 'All pods'
+  return formatKubernetesLabelSelector(selector)
 }
 
 // ============================================================================
@@ -2232,7 +2371,6 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'clusterqueues') return _getClusterQueueStatus(resource).text
       if (kindLower === 'localqueues') return _getLocalQueueStatus(resource).text
       if (kindLower === 'workloads') return _getKueueWorkloadStatus(resource).text
-      if (kindLower === 'resourceflavors') return _getResourceFlavorStatus(resource).text
       if (kindLower === 'admissionchecks') return _getAdmissionCheckStatus(resource).text
       if (kindLower === 'provisioningrequests') return _getProvisioningRequestStatus(resource).text
       if (kindLower === 'rayclusters') return _getRayClusterStatus(resource).text
@@ -2252,7 +2390,6 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'volcanoqueues') return _getVolcanoQueueStatus(resource).text
       if (kindLower === 'volcanopodgroups') return _getVolcanoPodGroupStatus(resource).text
       if (kindLower === 'jobflows') return _getJobFlowStatus(resource).text
-      if (kindLower === 'jobtemplates') return _getJobTemplateStatus(resource).text
       if (kindLower === 'kaiqueues') return _getKaiQueueStatus(resource).text
       if (kindLower === 'kaipodgroups') return _getKaiPodGroupStatus(resource).text
       if (kindLower === 'kaitoworkspaces') return _getKaitoWorkspaceStatus(resource).text
@@ -2320,6 +2457,13 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       return ''
     case 'selector':
       if (kindLower === 'istiogateways') return _getIstioGatewaySelectorString(resource)
+      if (kindLower === 'authorizationpolicies') return _getAuthorizationPolicySelectorString(resource)
+      return ''
+    case 'tlsMode':
+      // Distinct from Traefik's boolean 'tls' key, which SKIP_FILTER_COLUMNS
+      // excludes — sharing it would have made this reader unreachable. The
+      // generic fallback cannot reach spec.trafficPolicy.tls.mode.
+      if (kindLower === 'destinationrules') return _getDestinationRuleTlsMode(resource)
       return ''
     case 'state':
       if (kindLower === 'orders') return getOrderState(resource).text
@@ -2451,6 +2595,25 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
     case 'mig':
       if (kindLower === 'nvidiaclusterpolicies') return resource.spec?.mig?.strategy || ''
       break
+    // Trivy keeps the scanned image under report.artifact, so the generic
+    // spec/status probe finds nothing and the header would offer a filter
+    // button that never populates.
+    case 'image':
+      if (kindLower === 'vulnerabilityreports' || kindLower === 'sbomreports'
+        || kindLower === 'clustersbomreports' || kindLower === 'exposedsecretreports') {
+        return _getVulnerabilityReportImage(resource)
+      }
+      break
+    case 'ruleTypes':
+      if (kindLower === 'kyvernopolicies' || kindLower === 'clusterpolicies') {
+        return _getKyvernoPolicyRuleTypes(resource)
+      }
+      break
+    // The fallback would read spec.timeZone and yield '' for an undeclared
+    // zone, so those rows would drop out of a filter the cell shows a value for.
+    case 'timeZone':
+      if (kindLower === 'raycronjobs') return _getRayCronJobTimeZone(resource)
+      break
   }
 
   // Fallback: try common paths
@@ -2474,6 +2637,7 @@ export {
   getVulnerabilityReportSummary,
   getVulnerabilityReportStatus,
   getVulnerabilityReportImage,
+  getSbomReportImage,
   getVulnerabilityReportContainer,
   getConfigAuditReportSummary,
   getConfigAuditReportStatus,

package/src/components/resources/resources-column-filter.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest'
+import { getCellFilterValue } from './resource-utils'
 import { getCellFilterKind, hasCuratedColumns, isColumnFilterableByDistinctCount, normalizeKindToPlural, SKIP_FILTER_COLUMNS } from './ResourcesView'
 
 describe('isColumnFilterableByDistinctCount', () => {
@@ -98,3 +99,22 @@ describe('GPU ecosystem column routing', () => {
     expect(hasCuratedColumns('inferenceobjectives', 'example.io')).toBe(false)
   })
 })
+
+describe('filter values for columns whose data sits outside spec/status', () => {
+  // getCellFilterValue's fallback probes status[key]/spec[key]. A column whose
+  // value lives elsewhere needs an explicit case, or the header reserves a
+  // filter button that can never populate.
+  it('reads the scanned image out of the Trivy report', () => {
+    const report = {
+      report: { registry: { server: 'ghcr.io' }, artifact: { repository: 'acme/api', tag: 'v2' } },
+    }
+    for (const kind of ['vulnerabilityreports', 'sbomreports', 'clustersbomreports']) {
+      expect(getCellFilterValue(report, 'image', kind)).toContain('acme/api')
+    }
+  })
+
+  it('reads Kyverno rule types out of the rules array', () => {
+    const policy = { spec: { rules: [{ validate: {} }, { mutate: {} }] } }
+    expect(getCellFilterValue(policy, 'ruleTypes', 'clusterpolicies')).toBe('validate, mutate')
+  })
+})