@skyhook-io/k8s-ui 1.14.2 → 1.14.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/k8s-ui",
-  "version": "1.14.2",
+  "version": "1.14.3",
   "repository": {
     "type": "git",
     "url": "https://github.com/skyhook-io/radar",

package/src/components/resources/ResourcesView.tsx

@@ -716,7 +716,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Phase', width: 'w-28' },
     { key: 'duration', label: 'Duration', width: 'w-24' },
-    { key: 'progress', label: 'Progress', width: 'w-24', tooltip: 'Succeeded steps / Total steps' },
+    { key: 'progress', label: 'Progress', width: 'w-24', tooltip: 'Completed tasks / currently known total; the total can grow during execution, and completion does not imply success' },
     { key: 'template', label: 'Template', width: 'w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -835,13 +835,13 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'nodeClass', label: 'Node Class', width: 'w-36' },
-    { key: 'limits', label: 'Limits', width: 'w-36', tooltip: 'CPU and memory limits' },
-    { key: 'disruption', label: 'Disruption', width: 'w-40' },
+    { key: 'limits', label: 'Limits', width: 'w-36', tooltip: 'Configured provisioning ceilings — not what the pool has provisioned. Concurrent provisioning can exceed them during rapid scale-out, and a limit does not remove nodes already running.' },
+    { key: 'disruption', label: 'Disruption', width: 'w-40', tooltip: 'Which nodes Karpenter may consolidate; budgets and timing controls can still prevent removal or replacement' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nodeclaims: [
     { key: 'name', label: 'Name' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: 'Launched means a cloud instance exists; Registered means it has joined Kubernetes; Ready means the node is fully initialized' },
     { key: 'instanceType', label: 'Instance Type', width: 'w-32' },
     { key: 'capacityType', label: 'Capacity', width: 'w-24', tooltip: 'Spot or On-Demand' },
     { key: 'zone', label: 'Zone', width: 'w-28' },
@@ -899,23 +899,23 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   nvidiaclusterpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'components', label: 'Components', width: 'w-64', tooltip: 'Enabled GPU Operator components' },
-    { key: 'mig', label: 'MIG', width: 'w-24' },
+    { key: 'components', label: 'Components', width: 'w-64', tooltip: 'Enabled GPU Operator components" with "GPU Operator components enabled in spec — not whether they are running' },
+    { key: 'mig', label: 'MIG', width: 'w-24', tooltip: 'Multi-Instance GPU exposure: single advertises uniform partitions as nvidia.com/gpu; mixed advertises separate partition profiles; none disables MIG-aware exposure' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nvidiadrivers: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'driverType', label: 'Type', width: 'w-28' },
-    { key: 'version', label: 'Version', width: 'w-32' },
+    { key: 'driverType', label: 'Type', width: 'w-28', tooltip: 'Driver role: gpu for standard GPU workloads, vgpu for virtual GPU guests, or vgpu-host-manager for virtualization hosts' },
+    { key: 'version', label: 'Version', width: 'w-32', tooltip: 'Driver version requested in spec — nodes may still be running the previous one' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clusterqueues: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'cohort', label: 'Cohort', width: 'w-32' },
-    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24', tooltip: 'Pending workloads' },
-    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24', tooltip: 'Admitted workloads' },
+    { key: 'cohort', label: 'Cohort', width: 'w-32', tooltip: 'Queues in this cohort can share unused quota, subject to borrowing and lending limits' },
+    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24', tooltip: 'Workloads in this ClusterQueue waiting for admission, across namespaces; inspect workload status for the blocker' },
+    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24', tooltip: 'Unfinished workloads admitted through this ClusterQueue, across namespaces; admission does not mean their pods are running' },
     { key: 'flavors', label: 'Flavors', width: 'w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -924,8 +924,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'clusterQueue', label: 'Cluster Queue', width: 'w-40' },
-    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24' },
-    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24' },
+    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24', tooltip: 'Workloads submitted to this LocalQueue that are waiting for ClusterQueue admission' },
+    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24', tooltip: 'Unfinished workloads from this LocalQueue admitted to its ClusterQueue; their pods may still be waiting to run' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   workloads: [
@@ -946,14 +946,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   admissionchecks: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'controllerName', label: 'Controller', width: 'w-64' },
+    { key: 'controllerName', label: 'Controller', width: 'w-64', tooltip: 'Controller responsible for this check; workloads requiring it cannot be admitted until the check passes' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   provisioningrequests: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'provisioningClassName', label: 'Class', width: 'w-56' },
+    { key: 'provisioningClassName', label: 'Class', width: 'w-56', tooltip: 'Provisioning mode: check-capacity checks existing capacity without reserving it; best-effort-atomic-scale-up creates capacity atomically' },
     { key: 'podSets', label: 'Pod Sets', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -979,7 +979,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'serviceStatus', label: 'Service Status', width: 'w-28' },
+    { key: 'serviceStatus', label: 'Service Status', width: 'w-28', tooltip: "KubeRay's serving-readiness flag; this does not describe the active rollout phase." },
     { key: 'clusters', label: 'Clusters', width: 'w-56', tooltip: 'Active and pending RayCluster names' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -989,7 +989,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
     { key: 'timeZone', label: 'Time Zone', width: 'w-36', tooltip: 'IANA zone the schedule is read in; unset follows the local zone of the KubeRay operator pod' },
-    { key: 'lastSchedule', label: 'Last Schedule', width: 'w-28' },
+    { key: 'lastSchedule', label: 'Last Schedule', width: 'w-28', tooltip: 'Time since the last recorded schedule; this does not confirm the job started or succeeded.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   leaderworkersets: [
@@ -1010,7 +1010,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'ready', label: 'Ready', width: 'w-20' },
     { key: 'succeeded', label: 'Succeeded', width: 'w-24' },
     { key: 'failed', label: 'Failed', width: 'w-20' },
-    { key: 'restarts', label: 'Restarts', width: 'w-24' },
+    { key: 'restarts', label: 'Restarts', width: 'w-24', tooltip: 'Whole-JobSet restarts by the failure policy — every child Job is recreated' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   inferenceservices: [
@@ -1065,7 +1065,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   inferencepools: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-36', tooltip: 'Gateway acceptance and EPP resolution' },
+    { key: 'status', label: 'Status', width: 'w-36', tooltip: 'Gateway acceptance and reference errors across reported parents; Accepted does not prove backend Pods are ready.' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
     { key: 'targetPorts', label: 'Target Ports', width: 'w-28' },
     { key: 'extensionRef', label: 'Endpoint Picker', width: 'w-40', tooltip: 'EPP extension service' },
@@ -1076,7 +1076,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'poolRef', label: 'Pool', width: 'w-40', tooltip: 'Target InferencePool' },
-    { key: 'priority', label: 'Priority', width: 'w-24' },
+    { key: 'priority', label: 'Priority', width: 'w-24', tooltip: 'Higher values are served first when pool resources are scarce; an unset priority is treated as 0.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   volcanojobs: [
@@ -1084,7 +1084,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'queue', label: 'Queue', width: 'w-32' },
-    { key: 'minAvailable', label: 'Min Available', width: 'w-28' },
+    { key: 'minAvailable', label: 'Min Available', width: 'w-28', tooltip: 'Minimum pods that must be schedulable together for gang scheduling to start the job' },
     { key: 'pods', label: 'Pods', width: 'w-44', tooltip: 'Running / succeeded / failed pod counts' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1092,8 +1092,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'weight', label: 'Weight', width: 'w-20' },
-    { key: 'capability', label: 'Capability', width: 'w-48' },
-    { key: 'allocated', label: 'Allocated', width: 'w-48' },
+    { key: 'capability', label: 'Capability', width: 'w-48', tooltip: 'Configured resource limits for this queue; actual allocation also depends on available resources and scheduler policy' },
+    { key: 'allocated', label: 'Allocated', width: 'w-48', tooltip: 'Resources the scheduler reports as allocated to this queue; these are allocations, not measured CPU or memory use' },
     { key: 'podGroups', label: 'PodGroups', width: 'w-44', tooltip: 'PodGroup counts by state' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1109,7 +1109,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'flows', label: 'Flows', width: 'w-20' },
+    { key: 'flows', label: 'Flows', width: 'w-20', tooltip: 'Declared job stages; dependencies control when each stage can start' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   jobtemplates: [
@@ -1121,10 +1121,10 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   kaiqueues: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'parentQueue', label: 'Parent', width: 'w-32' },
-    { key: 'priority', label: 'Priority', width: 'w-20' },
-    { key: 'quota', label: 'Quota', width: 'w-52', tooltip: 'GPU fractions, CPU millicpus, memory MB; -1 = unlimited' },
-    { key: 'allocated', label: 'Allocated', width: 'w-48' },
+    { key: 'parentQueue', label: 'Parent', width: 'w-32', tooltip: 'Parent queue whose resources are shared among its children; ancestor limits constrain allocations' },
+    { key: 'priority', label: 'Priority', width: 'w-20', tooltip: "Higher priority favors allocation of resources above quota and delays reclaim; it does not increase the queue's guaranteed quota" },
+    { key: 'quota', label: 'Quota', width: 'w-52', tooltip: 'Guaranteed resource allocation; the queue may exceed it when spare resources and configured limits allow' },
+    { key: 'allocated', label: 'Allocated', width: 'w-48', tooltip: 'Resources allocated to this queue and its descendants, including scheduled pods still starting; this is not measured utilization' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   kaipodgroups: [
@@ -1139,9 +1139,9 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'instanceType', label: 'Instance Type', width: 'w-40', tooltip: 'GPU node SKU provisioned for the workspace' },
+    { key: 'instanceType', label: 'Instance Type', width: 'w-40', tooltip: 'Requested node instance type; actual node hardware is not checked.' },
     { key: 'preset', label: 'Model', width: 'w-44', tooltip: 'Preset model (inference or tuning)' },
-    { key: 'nodes', label: 'Nodes', width: 'w-20', tooltip: 'Worker nodes ready / target' },
+    { key: 'nodes', label: 'Nodes', width: 'w-20', tooltip: 'Worker nodes listed by KAITO, with the target count when available; listing does not confirm readiness.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   ragengines: [
@@ -1149,7 +1149,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'embedding', label: 'Embedding Model', width: 'w-56', tooltip: 'Local model ID/image or remote endpoint' },
-    { key: 'instanceType', label: 'Instance Type', width: 'w-40' },
+    { key: 'instanceType', label: 'Instance Type', width: 'w-40', tooltip: 'Requested node instance type; actual node hardware is not checked.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nimservices: [
@@ -1212,7 +1212,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'runtime', label: 'Runtime', width: 'w-44', tooltip: 'Training runtime reference' },
+    { key: 'runtime', label: 'Runtime', width: 'w-44', tooltip: 'Runtime template supplying training defaults; TrainJob settings can override its image and node count.' },
     { key: 'suspended', label: 'Suspended', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1271,18 +1271,18 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   policyreports: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'scope', label: 'Subject', width: 'w-56' },
+    { key: 'scope', label: 'Subject', width: 'w-56', tooltip: "The resource this report is about. Kyverno names the report after the resource's UID; use Subject to identify it." },
     { key: 'status', label: 'Status', width: 'w-32' },
     { key: 'pass', label: 'Pass', width: 'w-16' },
     { key: 'fail', label: 'Fail', width: 'w-16' },
     { key: 'warn', label: 'Warn', width: 'w-20' },
-    { key: 'error', label: 'Err', width: 'w-16' },
+    { key: 'error', label: 'Err', width: 'w-16', tooltip: 'Checks that could not be evaluated, for example because of missing context or a broken expression. Errors are not violations, but zero failures does not establish compliance while checks remain unevaluated.' },
     { key: 'skip', label: 'Skip', width: 'w-16' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clusterpolicyreports: [
     { key: 'name', label: 'Name' },
-    { key: 'scope', label: 'Subject', width: 'w-56' },
+    { key: 'scope', label: 'Subject', width: 'w-56', tooltip: "The resource this report is about. Kyverno names the report after the resource's UID; use Subject to identify it." },
     { key: 'status', label: 'Status', width: 'w-32' },
     { key: 'pass', label: 'Pass', width: 'w-16' },
     { key: 'fail', label: 'Fail', width: 'w-16' },
@@ -1296,14 +1296,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'action', label: 'Action', width: 'w-36', tooltip: 'Enforcement at admission — Enforce blocks, Audit reports; Background only or Inactive when admission is disabled' },
-    { key: 'rules', label: 'Rules', width: 'w-20' },
+    { key: 'ruleTypes', label: 'Types', width: 'w-40', tooltip: 'Rule kinds this policy declares. A policy can carry several, and the mix decides what it can do to a request.' },
+    { key: 'rules', label: 'Rules', width: 'w-20', defaultVisible: false },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clusterpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'action', label: 'Action', width: 'w-36', tooltip: 'Enforcement at admission — Enforce blocks, Audit reports; Background only or Inactive when admission is disabled' },
-    { key: 'rules', label: 'Rules', width: 'w-20' },
+    { key: 'ruleTypes', label: 'Types', width: 'w-40', tooltip: 'Rule kinds this policy declares. A policy can carry several, and the mix decides what it can do to a request.' },
+    { key: 'rules', label: 'Rules', width: 'w-20', defaultVisible: false },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // Kyverno modern CEL family (policies.kyverno.io). "Enforcement" is the
@@ -1384,7 +1386,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   // getModernKyvernoPolicyStatus), so a second one would be redundant.
   deletingpolicies: [
     { key: 'name', label: 'Name' },
-    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'When the schedule last fired. A scheduled policy that has never run is the failure worth catching — Kyverno rejects uncompilable policies at admission, so a broken one never exists to flag.' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Last execution time reported by Kyverno. A timestamp does not prove every matching resource was deleted.' },
     { key: 'schedule', label: 'Schedule', width: 'w-32', tooltip: 'Cron schedule on which matched resources are deleted' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'rules', label: 'Conditions', width: 'w-28', tooltip: 'CEL conditions narrowing what is deleted; none means every matched resource' },
@@ -1393,7 +1395,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   namespaceddeletingpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'When the schedule last fired. A scheduled policy that has never run is the failure worth catching — Kyverno rejects uncompilable policies at admission, so a broken one never exists to flag.' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Last execution time reported by Kyverno. A timestamp does not prove every matching resource was deleted.' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'rules', label: 'Conditions', width: 'w-28' },
@@ -1410,12 +1412,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Time since the controller last recorded an execution. A dash means it has not recorded one.' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clustercleanuppolicies: [
     { key: 'name', label: 'Name' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Time since the controller last recorded an execution. A dash means it has not recorded one.' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1459,7 +1463,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   workflowtemplates: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'entrypoint', label: 'Entrypoint', width: 'w-36' },
+    { key: 'entrypoint', label: 'Entrypoint', width: 'w-36', tooltip: 'Default template invoked when submitted as a workflow; submission may override it' },
     { key: 'templates', label: 'Templates', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1481,21 +1485,21 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicoglobalnetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false, tooltip: 'Adds a namespace restriction to the endpoint Selector. Unset adds no namespace restriction; the other selectors still apply.' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1503,57 +1507,57 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32', tooltip: 'Staged policies do not enforce traffic. Set and Learn preview rules; Delete stages removal of the matching enforced policy; Ignore is skipped. Omitted means Set.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicostagedglobalnetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false, tooltip: 'Adds a namespace restriction to the endpoint Selector. Unset adds no namespace restriction; the other selectors still apply.' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32', tooltip: 'Staged policies do not enforce traffic. Set and Learn preview rules; Delete stages removal of the matching enforced policy; Ignore is skipped. Omitted means Set.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicoippools: [
     { key: 'name', label: 'Name' },
     { key: 'cidr', label: 'CIDR', width: 'w-44' },
-    { key: 'blockSize', label: 'Block Size', width: 'w-28' },
-    { key: 'encapsulation', label: 'Encapsulation', width: 'w-36' },
-    { key: 'natOutgoing', label: 'NAT Outgoing', width: 'w-32' },
+    { key: 'blockSize', label: 'Block Size', width: 'w-28', tooltip: 'CIDR prefix of each allocation block. A node can hold several blocks, so this is not a per-node pod cap. Unset means /26 for IPv4, /122 for IPv6.' },
+    { key: 'encapsulation', label: 'Encapsulation', width: 'w-36', tooltip: 'Overlay used for pod traffic between nodes. None routes pod addresses directly; CrossSubnet tunnels only between nodes on different subnets.' },
+    { key: 'natOutgoing', label: 'NAT Outgoing', width: 'w-32', tooltip: 'When enabled, outgoing traffic from this pool is masqueraded for destinations outside all Calico IP pools.' },
     { key: 'disabled', label: 'Disabled', width: 'w-28' },
-    { key: 'allowedUses', label: 'Allowed Uses', width: 'w-40', defaultVisible: false },
+    { key: 'allowedUses', label: 'Allowed Uses', width: 'w-40', defaultVisible: false, tooltip: 'Pools without Workload are skipped for automatic pod IP allocation. Omitted or empty allows Workload and Tunnel; existing allocations are unchanged.' },
     { key: 'nodeSelector', label: 'Node Selector', width: 'w-48', defaultVisible: false },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicohostendpoints: [
     { key: 'name', label: 'Name' },
     { key: 'node', label: 'Node', width: 'w-48' },
-    { key: 'interfaceName', label: 'Interface', width: 'w-32' },
+    { key: 'interfaceName', label: 'Interface', width: 'w-32', tooltip: '* applies policy to all host interfaces. When unset, Calico identifies the interface using Expected IPs.' },
     { key: 'expectedIPs', label: 'Expected IPs', width: 'w-48' },
-    { key: 'profiles', label: 'Profiles', width: 'w-48', defaultVisible: false },
+    { key: 'profiles', label: 'Profiles', width: 'w-48', defaultVisible: false, tooltip: "Profiles apply only if policy evaluation reaches them. A tier's implicit deny stops traffic before profiles, even when no rule matched." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicotiers: [
     { key: 'name', label: 'Name' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'defaultAction', label: 'Default Action', width: 'w-36' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Order this tier is evaluated in — lowest first. Unset runs after every ordered tier.' },
+    { key: 'defaultAction', label: 'Default Action', width: 'w-36', tooltip: 'If this tier selects the endpoint and traffic direction but no rule decides the packet, Deny drops it and Pass continues evaluation. Tiers with no applicable policy are skipped.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicostagedkubernetesnetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Pod Selector', width: 'w-48' },
-    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32', tooltip: 'Staged policies do not enforce traffic. Set and Learn preview rules; Delete stages removal of the matching enforced policy; Ignore is skipped. Omitted means Set.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: 'An explicitly listed direction can have zero rules. When policyTypes is omitted, Ingress is included and Egress is added when egress rules exist.' },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1672,7 +1676,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'url', label: 'URL', width: 'w-64' },
-    { key: 'type', label: 'Type', width: 'w-20', tooltip: 'default (Helm) or oci' },
+    { key: 'type', label: 'Type', width: 'w-20', tooltip: 'default: Flux fetches a Helm repository index. oci: a registry reference with no reconciliation status of its own' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1684,7 +1688,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'revision', label: 'Revision', width: 'w-48', tooltip: 'Applied git revision' },
     { key: 'inventory', label: 'Resources', width: 'w-24', tooltip: 'Number of managed resources' },
-    { key: 'lastUpdated', label: 'Last Updated', width: 'w-28', tooltip: 'Time since last successful reconciliation' },
+    { key: 'lastUpdated', label: 'Last Updated', width: 'w-28', tooltip: 'Time since the last recorded reconciliation attempt; falls back to the last Ready transition. Neither guarantees success.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   helmreleases: [
@@ -1712,8 +1716,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   applications: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'project', label: 'Project', width: 'w-28' },
-    { key: 'sync', label: 'Sync', width: 'w-24' },
+    { key: 'project', label: 'Project', width: 'w-28', tooltip: 'AppProject the app belongs to — bounds which repos and clusters it may deploy to' },
+    { key: 'sync', label: 'Sync', width: 'w-24', tooltip: "Whether live resources match Argo's desired manifests; Synced does not mean Healthy" },
     { key: 'health', label: 'Health', width: 'w-24' },
     { key: 'repo', label: 'Repository', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1740,7 +1744,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'container', label: 'Container', width: 'w-28' },
     { key: 'image', label: 'Image', width: 'w-48' },
-    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical vulnerabilities' },
+    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical-severity vulnerabilities. C/H/M/L = Critical, High, Medium, Low.' },
     { key: 'high', label: 'H', width: 'w-12', tooltip: 'High vulnerabilities' },
     { key: 'medium', label: 'M', width: 'w-12', tooltip: 'Medium vulnerabilities' },
     { key: 'low', label: 'L', width: 'w-12', tooltip: 'Low vulnerabilities' },
@@ -1750,7 +1754,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical findings' },
+    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical-severity failed checks. C/H/M/L = Critical, High, Medium, Low.' },
     { key: 'high', label: 'H', width: 'w-12', tooltip: 'High findings' },
     { key: 'medium', label: 'M', width: 'w-12', tooltip: 'Medium findings' },
     { key: 'low', label: 'L', width: 'w-12', tooltip: 'Low findings' },
@@ -1761,7 +1765,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'container', label: 'Container', width: 'w-28' },
     { key: 'image', label: 'Image', width: 'w-48' },
-    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical secrets' },
+    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical-severity exposed secrets. C/H/M/L = Critical, High, Medium, Low.' },
     { key: 'high', label: 'H', width: 'w-12', tooltip: 'High secrets' },
     { key: 'medium', label: 'M', width: 'w-12', tooltip: 'Medium secrets' },
     { key: 'low', label: 'L', width: 'w-12', tooltip: 'Low secrets' },
@@ -1797,13 +1801,15 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   sbomreports: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'image', label: 'Image', width: 'w-48', tooltip: 'Image the SBOM describes. The container name alone does not identify what was scanned.' },
     { key: 'container', label: 'Container', width: 'w-28' },
-    { key: 'components', label: 'Components', width: 'w-24' },
+    { key: 'components', label: 'Components', width: 'w-24', tooltip: 'Packages and libraries found in the image' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-16' },
   ],
   clustersbomreports: [
     { key: 'name', label: 'Name' },
+    { key: 'image', label: 'Image', width: 'w-48', tooltip: 'Image the SBOM describes. The container name alone does not identify what was scanned.' },
     { key: 'components', label: 'Components', width: 'w-24' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-16' },
@@ -1864,10 +1870,10 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-36' },
-    { key: 'storageLocation', label: 'Storage', width: 'w-36' },
+    { key: 'storageLocation', label: 'Storage', width: 'w-36', tooltip: "The backup's storage location. A completed backup still needs this location reachable to restore from." },
     { key: 'namespaces', label: 'Scope', width: 'w-24', tooltip: 'Included namespaces (* = all)' },
     { key: 'duration', label: 'Duration', width: 'w-24' },
-    { key: 'expiry', label: 'Expires', width: 'w-24' },
+    { key: 'expiry', label: 'Expires', width: 'w-24', tooltip: "When Velero's retention makes this backup eligible for cleanup. Expired means Velero intends to delete it, not that it is gone — and not that a restore will work." },
     { key: 'errors', label: 'Errors', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1911,7 +1917,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-36' },
-    { key: 'repositoryType', label: 'Type', width: 'w-24' },
+    { key: 'repositoryType', label: 'Type', width: 'w-24', tooltip: 'kopia or restic. Restic is deprecated — Velero 1.17 stopped creating restic backups and 1.19 drops restic restore.' },
+    { key: 'volumeNamespace', label: 'Volume NS', width: 'w-36', tooltip: 'Namespace whose volumes this repository stores. Distinct from the namespace the repository object lives in.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   backupstoragelocations: [
@@ -1920,8 +1927,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'provider', label: 'Provider', width: 'w-24' },
     { key: 'bucket', label: 'Bucket', width: 'w-40' },
-    { key: 'default', label: 'Default', width: 'w-24' },
-    { key: 'lastValidation', label: 'Validated', width: 'w-28' },
+    { key: 'default', label: 'Default', width: 'w-24', tooltip: 'Whether this location is marked default. A backup naming no storage location is written to the default one.' },
+    { key: 'lastValidation', label: 'Validated', width: 'w-28', tooltip: 'Time since Velero last validated this location. An old value means availability has not been checked recently; validation may be disabled or configured to run less often.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // ============================================================================
@@ -1941,7 +1948,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-44' },
     { key: 'instances', label: 'Instances', width: 'w-28', tooltip: 'Ready/Total' },
     { key: 'primary', label: 'Primary', width: 'w-36' },
-    { key: 'image', label: 'Image', width: 'w-28' },
+    { key: 'image', label: 'Image', width: 'w-28', tooltip: 'Configured image tag, or the operator-resolved image for a catalog-backed cluster. This does not confirm that every instance has finished updating.' },
     // No Storage column: it rendered spec.storage.size, the configured REQUEST.
     // The useful number is actual usage (kubectl cnpg status shows "Size: 158M")
     // and that isn't in the CR. A plausible-but-wrong-meaning number is worse
@@ -1959,7 +1966,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   updaterequests: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-32' },
-    { key: 'status', label: 'State', width: 'w-28' },
+    { key: 'status', label: 'State', width: 'w-28', tooltip: 'Pending work Kyverno has queued but not yet applied; Failed is work it tried and could not.' },
     { key: 'type', label: 'Type', width: 'w-24' },
     { key: 'policy', label: 'Policy', width: 'w-52' },
     { key: 'triggers', label: 'Triggered By', width: 'w-56' },
@@ -1970,7 +1977,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-32' },
     { key: 'status', label: 'Outcome', width: 'w-28' },
     { key: 'subject', label: 'About', width: 'w-56' },
-    { key: 'source', label: 'Produced By', width: 'w-36' },
+    { key: 'source', label: 'Produced By', width: 'w-36', tooltip: 'Admission: evaluated during an API admission request. Background scan: evaluated against existing resources.' },
     { key: 'results', label: 'Results', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1985,7 +1992,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   cnpgdatabases: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Applied', width: 'w-32' },
+    { key: 'status', label: 'Applied', width: 'w-32', tooltip: 'Whether the operator has applied this to PostgreSQL. Pending means it has not reconciled it yet — not that it failed.' },
     { key: 'cluster', label: 'Cluster', width: 'w-36' },
     { key: 'target', label: 'Database', width: 'w-40' },
     { key: 'message', label: 'Message', width: 'w-64' },
@@ -2081,8 +2088,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'hosts', label: 'Hosts', width: 'w-48' },
-    { key: 'gateways', label: 'Gateways', width: 'w-40' },
+    { key: 'hosts', label: 'Hosts', width: 'w-48', tooltip: 'Request hostnames this VirtualService matches — not the backends it routes to' },
+    { key: 'gateways', label: 'Gateways', width: 'w-40', tooltip: "Where these routing rules apply. '-' means the default mesh gateway — sidecar traffic; individual route matches can override this." },
     { key: 'routes', label: 'Routes', width: 'w-20', tooltip: 'HTTP + TCP + TLS routes' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -2093,7 +2100,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'host', label: 'Host', width: 'w-48', tooltip: "The service this rule's traffic policy applies to" },
     { key: 'subsets', label: 'Subsets', width: 'w-20', tooltip: 'Named backend groups that routes can select, often for canary releases. Defining subsets does not send traffic to them.' },
     { key: 'tlsMode', label: 'Client TLS', width: 'w-28', tooltip: 'Declared client-side TLS mode for this host at the rule level. Subset and port policies can override it; this does not establish the effective mTLS posture.' },
-    { key: 'loadBalancer', label: 'LB Policy', width: 'w-28', tooltip: "Load balancing algorithm declared by this rule. '-' means none is set, so Istio applies its mesh default (LEAST_REQUEST since 1.14, overridable per mesh). Subset and port policies can differ." },
+    { key: 'loadBalancer', label: 'LB Policy', width: 'w-28', tooltip: "Load balancing algorithm for this host. A dash means Istio's mesh default applies (LEAST_REQUEST since Istio 1.14). Subset and port policies can differ." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   serviceentries: [
@@ -2107,8 +2114,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   peerauthentications: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'mode', label: 'mTLS Mode', width: 'w-28' },
-    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'mode', label: 'mTLS Mode', width: 'w-28', tooltip: 'Incoming connection policy: STRICT requires mTLS; PERMISSIVE also accepts plaintext; DISABLE turns mTLS off (unsupported in ambient). UNSET inherits the broader policy, defaulting to PERMISSIVE. Port-level overrides can differ.' },
+    { key: 'selector', label: 'Selector', width: 'w-48', tooltip: 'Selects workloads in this namespace. No selector defines a namespace default, or a mesh default in the root namespace; more specific policies can override it.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   authorizationpolicies: [
@@ -2126,7 +2133,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'url', label: 'URL', width: 'w-56' },
-    { key: 'latestRevision', label: 'Latest Revision', width: 'w-44' },
+    { key: 'latestRevision', label: 'Latest Revision', width: 'w-44', tooltip: 'Newest revision that has reported Ready. A newer revision may still be starting or may have failed; this revision need not receive traffic.' },
     { key: 'traffic', label: 'Traffic', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -2135,16 +2142,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'latestCreated', label: 'Latest Created', width: 'w-48' },
-    { key: 'latestReady', label: 'Latest Ready', width: 'w-48' },
+    { key: 'latestReady', label: 'Latest Ready', width: 'w-48', tooltip: 'Newest revision that has reported Ready. If it differs from Latest Created, the newer revision may still be starting or may have failed; inspect Status.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   knativerevisions: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'routing', label: 'Traffic', width: 'w-20', tooltip: 'Whether this revision is receiving traffic' },
+    { key: 'routing', label: 'Traffic', width: 'w-20', tooltip: 'Active: marked for Route traffic, even if scaled to zero. Reserve: not currently marked for Route traffic. Neither value measures incoming requests.' },
     { key: 'image', label: 'Image', width: 'w-48' },
-    { key: 'concurrency', label: 'Concurrency', width: 'w-32' },
+    { key: 'concurrency', label: 'Concurrency', width: 'w-32', tooltip: "Hard limit on simultaneous requests handled by each pod; excess requests are buffered. Unlimited removes this cap, not autoscaling's target." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   knativeroutes: [
@@ -2169,7 +2176,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'broker', label: 'Broker', width: 'w-36' },
     { key: 'subscriber', label: 'Subscriber', width: 'w-48' },
-    { key: 'filter', label: 'Filter', width: 'w-48' },
+    { key: 'filter', label: 'Filter', width: 'w-48', tooltip: 'Selects which broker events are eligible for delivery. No filtering admits every event; it does not guarantee successful delivery. Expression filters override attribute filters.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   eventtypes: [
@@ -2186,7 +2193,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'schedule', label: 'Schedule', width: 'w-36' },
-    { key: 'sink', label: 'Sink', width: 'w-48' },
+    { key: 'sink', label: 'Sink', width: 'w-48', tooltip: 'Requested event destination. A displayed reference does not prove it resolved or received events; inspect conditions when delivery fails.' },
     { key: 'data', label: 'Data', width: 'w-36' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -2243,14 +2250,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'steps', label: 'Steps', width: 'w-16' },
+    { key: 'steps', label: 'Steps', width: 'w-16', tooltip: "Stages events pass through in order; each stage's reply feeds the next" },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   parallels: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'branches', label: 'Branches', width: 'w-20' },
+    { key: 'branches', label: 'Branches', width: 'w-20', tooltip: 'Independent filter-and-subscriber pairs; every event is offered to all of them' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // Knative Networking
@@ -2260,7 +2267,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'ingressClass', label: 'Class', width: 'w-24' },
     { key: 'hosts', label: 'Hosts', width: 'w-56' },
-    { key: 'visibility', label: 'Visibility', width: 'w-28' },
+    { key: 'visibility', label: 'Visibility', width: 'w-28', tooltip: 'Requested exposure across all rules. ExternalIP means at least one rule requests external exposure; ClusterLocal means all rules request cluster-only exposure. This does not verify connectivity.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   knativecertificates: [
@@ -2269,13 +2276,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'dnsNames', label: 'DNS Names', width: 'w-56' },
     { key: 'secretName', label: 'Secret', width: 'w-44' },
+    { key: 'expires', label: 'Expires', width: 'w-28', tooltip: 'Expiry of the certificate in the named Secret, as the controller reported it.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   serverlessservices: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'mode', label: 'Mode', width: 'w-20' },
+    { key: 'mode', label: 'Mode', width: 'w-20', tooltip: 'Requested backend mode: Serve selects revision pods; Proxy selects activators. Activators may remain involved with healthy pods for burst handling, so Proxy does not prove a cold start.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   domainmappings: [
@@ -2289,7 +2297,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ingressroutes: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0' },
+    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0', tooltip: 'Entry points this route binds to. When unset, Traefik uses the default entry points from its static configuration.' },
     { key: 'hosts', label: 'Hosts', width: 'min-w-44' },
     { key: 'routes', label: 'Routes', width: 'min-w-48' },
     { key: 'tls', label: 'TLS', width: 'w-14 shrink-0' },
@@ -2299,7 +2307,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ingressroutetcps: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0' },
+    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0', tooltip: 'Entry points this route binds to. When unset, Traefik uses the default entry points from its static configuration.' },
     { key: 'hosts', label: 'Hosts', width: 'min-w-44' },
     { key: 'routes', label: 'Routes', width: 'min-w-48' },
     { key: 'tls', label: 'TLS', width: 'w-14 shrink-0' },
@@ -2309,7 +2317,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ingressrouteudps: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0' },
+    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0', tooltip: 'Entry points this route binds to. When unset it is attached to every available UDP entry point; asDefault has no effect on UDP.' },
     { key: 'routes', label: 'Routes', width: 'min-w-48' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2349,7 +2357,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   tlsoptions: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'minVersion', label: 'Min TLS', width: 'w-24 shrink-0' },
+    { key: 'minVersion', label: 'Min TLS', width: 'w-24 shrink-0', tooltip: "Lowest TLS version accepted; connections below it are rejected. A dash means the resource sets no minimum, so Traefik's own default applies." },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   tlsstores: [
@@ -2365,7 +2373,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'class', label: 'Class', width: 'w-32 shrink-0' },
     { key: 'cpReplicas', label: 'CP Ready', width: 'w-24 shrink-0', tooltip: 'Control plane replicas (ready/desired)' },
     { key: 'workerReplicas', label: 'Workers', width: 'w-20 shrink-0', tooltip: 'Worker replicas (ready/desired)' },
-    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0' },
+    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0', tooltip: 'Lifecycle phase while the cluster is still provisioning or deleting; the Available/Ready condition once it has landed.' },
     { key: 'version', label: 'Version', width: 'w-24 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2374,6 +2382,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'cluster', label: 'Cluster', width: 'w-32 shrink-0' },
     { key: 'ready', label: 'Ready', width: 'w-20 shrink-0', tooltip: 'Ready replicas / desired' },
+    { key: 'upToDate', label: 'Up-to-date', width: 'w-24', tooltip: 'Machines already running the current spec. Fewer than Ready means a rollout is still in progress.' },
     { key: 'phase', label: 'Phase', width: 'w-28 shrink-0' },
     { key: 'version', label: 'Version', width: 'w-24 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
@@ -2383,7 +2392,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'cluster', label: 'Cluster', width: 'w-32 shrink-0' },
     { key: 'role', label: 'Role', width: 'w-28 shrink-0' },
-    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0' },
+    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0', tooltip: 'Lifecycle milestone; Running does not guarantee that the node is currently Ready.' },
     { key: 'node', label: 'Node', width: 'w-32 shrink-0' },
     { key: 'version', label: 'Version', width: 'w-24 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
@@ -2441,7 +2450,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'instanceType', label: 'Instance', width: 'w-28 shrink-0' },
-    { key: 'replicas', label: 'Ready', width: 'w-20 shrink-0', tooltip: 'Ready replicas' },
+    { key: 'replicas', label: 'Ready', width: 'w-20 shrink-0', tooltip: "Replicas the provider reports, over the autoscaling maximum when one is set. The second number is a ceiling, not a target, so this is not a ready/desired ratio." },
     { key: 'capacityType', label: 'Capacity', width: 'w-28 shrink-0' },
     { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
@@ -2459,7 +2468,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'instanceType', label: 'Instance', width: 'w-28 shrink-0' },
-    { key: 'capacity', label: 'Capacity', width: 'w-32 shrink-0', tooltip: 'Computed CPU/memory' },
+    { key: 'capacity', label: 'Capacity', width: 'w-32 shrink-0', tooltip: 'Per-node CPU and memory reported by the provider for scale-from-zero estimation.' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   awsmanagedclusters: [
@@ -2484,7 +2493,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'machineType', label: 'Machine Type', width: 'w-32 shrink-0' },
-    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0' },
+    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0', tooltip: "Replicas the provider reports as observed. Not a ready/desired ratio, and the pool's autoscaling bounds are not shown here." },
     { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2523,9 +2532,9 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'sku', label: 'VM Size', width: 'w-32 shrink-0' },
-    { key: 'mode', label: 'Mode', width: 'w-20 shrink-0' },
-    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0' },
-    { key: 'priority', label: 'Priority', width: 'w-24 shrink-0' },
+    { key: 'mode', label: 'Mode', width: 'w-20 shrink-0', tooltip: 'System pools are preferred for critical AKS system pods; User pools are intended for applications. Mode does not enforce workload isolation.' },
+    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0', tooltip: "Replicas the provider reports as observed. Not a ready/desired ratio, and the pool's autoscaling bounds are not shown here." },
+    { key: 'priority', label: 'Priority', width: 'w-24 shrink-0', tooltip: 'Spot VMs may be evicted for capacity or price; Regular VMs are not Spot. This is unrelated to Kubernetes scheduling priority.' },
     { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2552,11 +2561,11 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   httpproxies: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'fqdn', label: 'FQDN', width: 'min-w-44' },
+    { key: 'fqdn', label: 'FQDN', width: 'min-w-44', tooltip: 'Virtual-host hostname this proxy declares. A dash means it declares none, which is normal for an included proxy — its routes are served under the roots that include it.' },
     { key: 'routes', label: 'Routes', width: 'w-20 shrink-0' },
-    { key: 'includes', label: 'Includes', width: 'w-24 shrink-0' },
+    { key: 'includes', label: 'Includes', width: 'w-24 shrink-0', tooltip: "Child HTTPProxies this one directly includes. They contribute routing configuration, so a proxy can serve traffic even when its own Routes count is zero." },
     { key: 'tls', label: 'TLS', width: 'w-14 shrink-0' },
-    { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
+    { key: 'status', label: 'Status', width: 'w-28 shrink-0', tooltip: "Contour's verdict on this proxy. Orphaned means no root proxy includes it, so it serves no traffic." },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   // Crossplane — Managed Resources are unbounded (one kind per provider CRD);
@@ -2566,7 +2575,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-32 shrink-0' },
     { key: 'kind', label: 'Kind', width: 'w-32 shrink-0' },
     { key: 'external', label: 'External Name', width: 'min-w-48' },
-    { key: 'provider', label: 'Provider Config', width: 'w-40 shrink-0' },
+    { key: 'provider', label: 'Provider Config', width: 'w-40 shrink-0', tooltip: 'Provider configuration selecting the credentials and connection settings used to manage this external resource.' },
     { key: 'status', label: 'Status', width: 'w-32 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2586,14 +2595,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   compositions: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'composite', label: 'Composite Kind', width: 'w-44 shrink-0' },
-    { key: 'mode', label: 'Mode', width: 'w-24 shrink-0' },
+    { key: 'mode', label: 'Mode', width: 'w-24 shrink-0', tooltip: 'Pipeline runs composition functions. Resources uses native patch-and-transform composition and must be migrated before upgrading to Crossplane v2.' },
     { key: 'functions', label: 'Functions', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   compositeresourcedefinitions: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'kind', label: 'Kind', width: 'w-40 shrink-0' },
-    { key: 'claim', label: 'Claim Kind', width: 'w-40 shrink-0' },
+    { key: 'claim', label: 'Claim Kind', width: 'w-40 shrink-0', tooltip: 'Optional namespaced claim kind. Crossplane v2 supports claims only for XRDs using LegacyCluster scope.' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
 }
@@ -5078,8 +5087,10 @@ export function ResourcesView({
         // DaemonSet: numberAvailable, others: availableReplicas
         return status.numberAvailable ?? status.availableReplicas ?? 0
       case 'upToDate':
-        // DaemonSet: updatedNumberScheduled, others: updatedReplicas
-        return status.updatedNumberScheduled ?? status.updatedReplicas ?? 0
+        // DaemonSet: updatedNumberScheduled; CAPI v1beta2: upToDateReplicas;
+        // others: updatedReplicas. Same precedence the cells display, or a row
+        // sorts as zero while showing a real count.
+        return status.updatedNumberScheduled ?? status.upToDateReplicas ?? status.updatedReplicas ?? 0
       case 'restarts':
         if (kindLower === 'jobsets') return getJobSetRestarts(resource)
         return getPodRestarts(resource)

package/src/components/resources/renderers/capi-cells.tsx

@@ -12,6 +12,7 @@ import {
   getClusterClassStatus,
   getMachineHealthCheckStatus, getMachineHealthCheckHealthy, getMachineHealthCheckClusterName,
   getClusterProvider,
+  getMachineDeploymentUpToDate,
 } from '../resource-utils-capi'
 
 function StatusBadge({ resource, getStatus }: { resource: any; getStatus: (r: any) => { text: string; color: string } }) {
@@ -78,6 +79,8 @@ export function CAPIMachineDeploymentCell({ resource, column }: { resource: any;
       return <TextCell value={getMachineClusterName(resource)} />
     case 'ready':
       return <TextCell value={getMachineDeploymentReplicas(resource)} />
+    case 'upToDate':
+      return <TextCell value={getMachineDeploymentUpToDate(resource)} />
     case 'version':
       return <TextCell value={getMachineDeploymentVersion(resource)} />
     default:

package/src/components/resources/renderers/certmanager-cells.tsx

@@ -48,8 +48,8 @@ export function CertificateCell({ resource, column }: { resource: any; column: s
     case 'expires': {
       const expiry = getCertificateExpiry(resource)
       return (
-        <span className={clsx(
-          'text-sm font-medium',
+        <span title={expiry.text} className={clsx(
+          'text-sm font-medium truncate block',
           expiry.level === 'unhealthy' ? 'text-red-400' :
           expiry.level === 'degraded' ? 'text-yellow-400' :
           expiry.level === 'healthy' ? 'text-green-400' :

package/src/components/resources/renderers/knative-cells.tsx

@@ -28,6 +28,9 @@ import {
   getDomainMappingUrl,
   getServerlessServiceMode,
 } from '../resource-utils-knative'
+// Knative's Certificate reports status.notAfter like any other TLS certificate,
+// so it shares the expiry formatter rather than re-deriving the thresholds.
+import { getCertificateExpiry, healthColors } from '../resource-utils'
 
 function StatusCell({ resource, getStatus }: { resource: any; getStatus: (r: any) => { text: string; color: string } }) {
   const status = getStatus(resource)
@@ -366,6 +369,16 @@ export function KnativeCertificateCell({ resource, column }: { resource: any; co
     }
     case 'secretName':
       return <TextCell value={resource?.spec?.secretName || '-'} />
+    case 'expires': {
+      const expiry = getCertificateExpiry(resource)
+      // "Expired 365d ago" is far wider than the column; bound it like the
+      // other status badges that carry arbitrary-length text.
+      return (
+        <span className={clsx('badge truncate max-w-full', healthColors[expiry.level])} title={expiry.text}>
+          {expiry.text}
+        </span>
+      )
+    }
     default:
       return <DefaultCell />
   }

package/src/components/resources/renderers/kyverno-cells.tsx

@@ -8,6 +8,7 @@ import {
   getKyvernoPolicyStatus,
   getKyvernoEnforcement,
   getKyvernoPolicyRuleCount,
+  getKyvernoPolicyRuleTypes,
 } from '../resource-utils-kyverno'
 import {
   getKyvernoRequestState,
@@ -93,6 +94,12 @@ export function KyvernoPolicyCell({ resource, column }: { resource: any; column:
         </span>
       )
     }
+    case 'ruleTypes': {
+      const types = getKyvernoPolicyRuleTypes(resource)
+      return (
+        <span className="text-sm text-theme-text-secondary truncate block" title={types}>{types}</span>
+      )
+    }
     case 'rules': {
       const count = getKyvernoPolicyRuleCount(resource)
       return <span className="text-sm text-theme-text-secondary">{count}</span>

package/src/components/resources/renderers/kyverno-modern-cells.tsx

@@ -129,6 +129,12 @@ export function KyvernoCleanupPolicyCell({ resource, column }: { resource: any;
       const status = getKyvernoCleanupPolicyStatus(resource)
       return <span className={clsx('badge', status.color)}>{status.text}</span>
     }
+    case 'lastRun': {
+      const last = getKyvernoLastExecutionTime(resource)
+      return last
+        ? <span className="text-sm text-theme-text-secondary">{formatAge(last)}</span>
+        : <span className="text-sm text-theme-text-tertiary">-</span>
+    }
     case 'schedule': {
       const schedule = getKyvernoCleanupSchedule(resource)
       return schedule ? (

package/src/components/resources/renderers/trivy-cells.tsx

@@ -6,6 +6,7 @@ import {
   getVulnerabilityReportSummary,
   getVulnerabilityReportContainer,
   getVulnerabilityReportImage,
+  getSbomReportImage,
   getConfigAuditReportSummary,
   getConfigAuditReportStatus,
   getExposedSecretReportSummary,
@@ -133,6 +134,12 @@ export function ClusterComplianceReportCell({ resource, column }: { resource: an
 
 export function SbomReportCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
+    case 'image': {
+      const image = getSbomReportImage(resource)
+      return (
+        <span className="text-sm text-theme-text-secondary truncate block" title={image}>{image}</span>
+      )
+    }
     case 'container':
       return <span className="text-sm text-theme-text-secondary">{getSbomReportContainer(resource)}</span>
     case 'components': {

package/src/components/resources/renderers/velero-cells.tsx

@@ -30,6 +30,7 @@ import {
   getVSLConfig,
   getBackupRepositoryStatus,
   getBackupRepositoryType,
+  getBackupRepositoryVolumeNamespace,
 } from '../resource-utils-velero'
 
 // The detail-page Phase value. The badge carries the same label the table
@@ -235,6 +236,8 @@ export function BackupRepositoryCell({ resource, column }: { resource: any; colu
         </span>
       )
     }
+    case 'volumeNamespace':
+      return <span className="text-sm text-theme-text-secondary">{getBackupRepositoryVolumeNamespace(resource)}</span>
     case 'repositoryType': {
       const type = getBackupRepositoryType(resource)
       // restic is on its way out (no new backups since v1.17, restore dropped in

package/src/components/resources/resource-utils-calico.test.ts

@@ -174,6 +174,12 @@ describe('IPPool derivations', () => {
       getCalicoIPPoolAllowedUses({ spec: { allowedUses: ['Tunnel'] } }),
     ).toBe('Tunnel')
   })
+
+  it('treats an empty allowedUses list as the default, not as no uses', () => {
+    // Calico: "If not specified or empty, defaults to ["Tunnel", "Workload"]".
+    // A dash here would read as a pool that allocates for nothing.
+    expect(getCalicoIPPoolAllowedUses({ spec: { allowedUses: [] } })).toBe('Workload, Tunnel')
+  })
 })
 
 describe('derived policy types', () => {

package/src/components/resources/resource-utils-calico.ts

@@ -256,6 +256,10 @@ export function getCalicoIPPoolEncapsulation(pool: any): string {
 
 export function getCalicoIPPoolAllowedUses(pool: any): string {
   const uses = pool?.spec?.allowedUses
-  if (!Array.isArray(uses)) return 'Workload, Tunnel'
-  return uses.length > 0 ? uses.map(String).join(', ') : '-'
+  // Calico documents an empty list as equivalent to an absent one: "If not
+  // specified or empty, defaults to ["Tunnel", "Workload"] for
+  // back-compatibility." Rendering a dash there would read as a pool that
+  // allocates for nothing.
+  if (!Array.isArray(uses) || uses.length === 0) return 'Workload, Tunnel'
+  return uses.map(String).join(', ')
 }

package/src/components/resources/resource-utils-trivy.ts

@@ -102,6 +102,9 @@ export const getExposedSecretReportSummary = getVulnerabilityReportSummary
 export const getExposedSecretReportContainer = getVulnerabilityReportContainer
 export const getExposedSecretReportImage = getVulnerabilityReportImage
 
+// SBOM reports carry the same report.artifact/registry shape as the scan reports.
+export const getSbomReportImage = getVulnerabilityReportImage
+
 export const getExposedSecretReportStatus = getVulnerabilityReportStatus
 
 // ============================================================================

package/src/components/resources/resource-utils.ts

@@ -11,7 +11,8 @@ import { getNodePoolStatus, getNodeClaimStatus } from './resource-utils-karpente
 import { getScaledObjectStatus, getScaledJobStatus } from './resource-utils-keda'
 import { getGitRepositoryStatus, getOCIRepositoryStatus, getHelmRepositoryStatus, getHelmRepositoryType, getKustomizationStatus, getFluxHelmReleaseStatus, getFluxAlertStatus } from './resource-utils-flux'
 import { getArgoApplicationStatus, getArgoApplicationSetStatus, getArgoApplicationSync, getArgoApplicationHealth, getArgoApplicationProject } from './resource-utils-argo'
-import { getPolicyReportStatus as _getPolicyReportStatus, getKyvernoPolicyStatus as _getKyvernoPolicyStatus } from './resource-utils-kyverno'
+import { getVulnerabilityReportImage as _getVulnerabilityReportImage } from './resource-utils-trivy'
+import { getKyvernoPolicyRuleTypes as _getKyvernoPolicyRuleTypes, getPolicyReportStatus as _getPolicyReportStatus, getKyvernoPolicyStatus as _getKyvernoPolicyStatus } from './resource-utils-kyverno'
 import { getResourceClaimStatus as _getResourceClaimStatus, getResourceClaimDeviceClasses as _getResourceClaimDeviceClasses, getResourceClaimTemplateDeviceClasses as _getResourceClaimTemplateDeviceClasses, getResourceClaimAllocation as _getResourceClaimAllocation, getResourceClaimReservedFor as _getResourceClaimReservedFor } from './resource-utils-dra'
 import { getNvidiaClusterPolicyStatus as _getNvidiaClusterPolicyStatus, getNvidiaClusterPolicyEnabledComponents as _getNvidiaClusterPolicyEnabledComponents, getNvidiaDriverStatus as _getNvidiaDriverStatus } from './resource-utils-nvidia'
 import { getClusterQueueStatus as _getClusterQueueStatus, getLocalQueueStatus as _getLocalQueueStatus, getKueueWorkloadStatus as _getKueueWorkloadStatus, getResourceFlavorStatus as _getResourceFlavorStatus, getAdmissionCheckStatus as _getAdmissionCheckStatus, getProvisioningRequestStatus as _getProvisioningRequestStatus } from './resource-utils-kueue'
@@ -2594,6 +2595,20 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
     case 'mig':
       if (kindLower === 'nvidiaclusterpolicies') return resource.spec?.mig?.strategy || ''
       break
+    // Trivy keeps the scanned image under report.artifact, so the generic
+    // spec/status probe finds nothing and the header would offer a filter
+    // button that never populates.
+    case 'image':
+      if (kindLower === 'vulnerabilityreports' || kindLower === 'sbomreports'
+        || kindLower === 'clustersbomreports' || kindLower === 'exposedsecretreports') {
+        return _getVulnerabilityReportImage(resource)
+      }
+      break
+    case 'ruleTypes':
+      if (kindLower === 'kyvernopolicies' || kindLower === 'clusterpolicies') {
+        return _getKyvernoPolicyRuleTypes(resource)
+      }
+      break
     // The fallback would read spec.timeZone and yield '' for an undeclared
     // zone, so those rows would drop out of a filter the cell shows a value for.
     case 'timeZone':
@@ -2622,6 +2637,7 @@ export {
   getVulnerabilityReportSummary,
   getVulnerabilityReportStatus,
   getVulnerabilityReportImage,
+  getSbomReportImage,
   getVulnerabilityReportContainer,
   getConfigAuditReportSummary,
   getConfigAuditReportStatus,

package/src/components/resources/resources-column-filter.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from 'vitest'
+import { getCellFilterValue } from './resource-utils'
 import { getCellFilterKind, hasCuratedColumns, isColumnFilterableByDistinctCount, normalizeKindToPlural, SKIP_FILTER_COLUMNS } from './ResourcesView'
 
 describe('isColumnFilterableByDistinctCount', () => {
@@ -98,3 +99,22 @@ describe('GPU ecosystem column routing', () => {
     expect(hasCuratedColumns('inferenceobjectives', 'example.io')).toBe(false)
   })
 })
+
+describe('filter values for columns whose data sits outside spec/status', () => {
+  // getCellFilterValue's fallback probes status[key]/spec[key]. A column whose
+  // value lives elsewhere needs an explicit case, or the header reserves a
+  // filter button that can never populate.
+  it('reads the scanned image out of the Trivy report', () => {
+    const report = {
+      report: { registry: { server: 'ghcr.io' }, artifact: { repository: 'acme/api', tag: 'v2' } },
+    }
+    for (const kind of ['vulnerabilityreports', 'sbomreports', 'clustersbomreports']) {
+      expect(getCellFilterValue(report, 'image', kind)).toContain('acme/api')
+    }
+  })
+
+  it('reads Kyverno rule types out of the rules array', () => {
+    const policy = { spec: { rules: [{ validate: {} }, { mutate: {} }] } }
+    expect(getCellFilterValue(policy, 'ruleTypes', 'clusterpolicies')).toBe('validate, mutate')
+  })
+})