@skyhook-io/k8s-ui 1.14.5 → 1.14.6

package/src/components/shared/ResourceRendererDispatch.tsx

@@ -1,3 +1,4 @@
+import { hasReflectorDetails } from '../resources/renderers/ReflectorSection'
 import { clsx } from 'clsx'
 import { SEVERITY_BADGE, HEALTH_BADGE_COLORS } from '../../utils/badge-colors'
 import { isArgoRolloutResource } from '../../utils/workload-rollout'
@@ -120,6 +121,8 @@ import {
   PVCRenderer,
   RolloutRenderer,
   AnalysisRunRenderer,
+  AnalysisTemplateRenderer,
+  ExperimentRenderer,
   CertificateRenderer,
   WorkflowRenderer,
   PersistentVolumeRenderer,
@@ -231,6 +234,7 @@ import {
   PriorityClassRenderer,
   RuntimeClassRenderer,
   LeaseRenderer,
+  LimitRangeRenderer,
   TraefikIngressRouteRenderer,
   TraefikMiddlewareRenderer,
   TraefikServiceRenderer,
@@ -426,7 +430,7 @@ const KNOWN_KINDS = new Set([
   'pods', 'deployments', 'statefulsets', 'daemonsets', 'replicasets',
   'services', 'endpointslices', 'ingresses', 'configmaps', 'secrets', 'jobs', 'cronjobs', 'cronworkflows',
   'hpas', 'horizontalpodautoscalers', 'nodes', 'persistentvolumeclaims',
-  'rollouts', 'analysisruns', 'certificates', 'workflows', 'persistentvolumes',
+  'rollouts', 'analysisruns', 'analysistemplates', 'clusteranalysistemplates', 'experiments', 'certificates', 'workflows', 'persistentvolumes',
   'storageclasses', 'certificaterequests', 'clusterissuers', 'issuers',
   'orders', 'challenges',
   'gateways', 'gatewayclasses', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes', 'sealedsecrets', 'workflowtemplates', 'clusterworkflowtemplates',
@@ -473,7 +477,7 @@ const KNOWN_KINDS = new Set([
   'virtualservices', 'destinationrules', 'serviceentries',
   'peerauthentications', 'authorizationpolicies',
   'mutatingwebhookconfigurations', 'validatingwebhookconfigurations',
-  'ingressclasses', 'priorityclasses', 'runtimeclasses', 'leases',
+  'ingressclasses', 'priorityclasses', 'runtimeclasses', 'leases', 'limitranges',
   'knativeservices', 'knativeconfigurations', 'knativerevisions', 'knativeroutes',
   'brokers', 'triggers', 'eventtypes', 'pingsources', 'apiserversources', 'containersources', 'sinkbindings',
   'channels', 'inmemorychannels', 'subscriptions', 'sequences', 'parallels',
@@ -678,7 +682,8 @@ export function ResourceRendererDispatch({
     kind === 'clusters' || kind === 'backups' || kind === 'scheduledbackups' || kind === 'poolers'
     || kind === 'objectstores' || kind === 'databases' || kind === 'publications'
     || kind === 'subscriptions' || kind === 'imagecatalogs' || kind === 'clusterimagecatalogs'
-    || kind === 'policies' || kind === 'rollouts' || kind === 'machines' || kind === 'machinesets'
+    || kind === 'policies' || kind === 'rollouts' || kind === 'experiments'
+    || kind === 'machines' || kind === 'machinesets'
   const isCNPGApiVersion = isApiGroup(data?.apiVersion, CNPG_GROUP)
   const groupGatedMatched =
     (kind === 'clusters' && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'cluster.x-k8s.io')))
@@ -691,6 +696,11 @@ export function ResourceRendererDispatch({
       && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'messaging.knative.dev')))
     || (kind === 'policies' && isApiGroup(data?.apiVersion, 'kyverno.io'))
     || (kind === 'rollouts' && isArgoRolloutResource(data))
+    // Katib (kubeflow.org) ships its own, unrelated Experiment CRD sharing
+    // this plural — without this gate it got the Argo Rollouts Experiment
+    // renderer's mostly-empty status view instead of its actual resource
+    // details, the same collision shape as every other check in this block.
+    || (kind === 'experiments' && isApiGroup(data?.apiVersion, 'argoproj.io'))
     || ((kind === 'machines' || kind === 'machinesets')
       && isApiGroup(data?.apiVersion, 'cluster.x-k8s.io'))
   const groupGatedFallthrough = isGroupGatedKind && !groupGatedMatched
@@ -741,11 +751,15 @@ export function ResourceRendererDispatch({
   const HPAComp = rendererOverrides?.HPARenderer ?? HPARenderer
   const PVCComp = rendererOverrides?.PVCRenderer ?? PVCRenderer
   const RolloutComp = rendererOverrides?.RolloutRenderer ?? RolloutRenderer
+  const showsReflection = (kind === 'configmaps' || kind === 'secrets') && hasReflectorDetails(data, relationships?.reflection)
+  const reflectionRefs = showsReflection ? [relationships?.reflection?.source, ...(relationships?.reflection?.mirrors ?? [])].filter((ref): ref is ResourceRef => !!ref) : []
+  const withoutReflection = (refs: ResourceRef[] | undefined) => refs?.filter(ref => !reflectionRefs.some(mirror => mirror.kind === ref.kind && mirror.namespace === ref.namespace && mirror.name === ref.name && (mirror.group ?? '') === (ref.group ?? '')))
+  const sidebarRelationships = showsReflection && relationships ? { ...relationships, configRefs: withoutReflection(relationships.configRefs), consumers: withoutReflection(relationships.consumers) } : relationships
   const scaleBlockedBy = replicaScalers(relationships?.scalers)
 
   const sidebarContent = showCommonSections && (
     <>
-      <RelatedResourcesSection relationships={relationships} onNavigate={onNavigate} />
+      <RelatedResourcesSection relationships={sidebarRelationships} onNavigate={onNavigate} />
       {kind !== 'events' && <EventsSection events={events || []} updates={updates || []} isLoading={eventsLoading ?? false} eventsError={eventsError ?? null} updatesError={updatesError ?? null} hint={eventsHint} />}
       <LabelsSection data={data} />
       <AnnotationsSection data={data} />
@@ -773,8 +787,8 @@ export function ResourceRendererDispatch({
         {kind === 'services' && !data?.apiVersion?.includes('serving.knative.dev') && <ServiceComp data={data} onCopy={onCopy} copied={copied} onNavigate={onNavigate} />}
         {kind === 'endpointslices' && <EndpointSliceRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'ingresses' && !data?.apiVersion?.includes('networking.internal.knative.dev') && <IngressRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'configmaps' && <ConfigMapRenderer data={data} />}
-        {kind === 'secrets' && <SecretRenderer data={data} certificateInfo={certificateInfo} resourceData={data} onSaveSecretValue={onSaveSecretValue} isSaving={isSavingSecret} />}
+        {kind === 'configmaps' && <ConfigMapRenderer data={data} relationships={relationships} onNavigate={onNavigate} />}
+        {kind === 'secrets' && <SecretRenderer data={data} relationships={relationships} onNavigate={onNavigate} certificateInfo={certificateInfo} resourceData={data} onSaveSecretValue={onSaveSecretValue} isSaving={isSavingSecret} />}
         {kind === 'jobs' && !nonCoreJobFallthrough && <JobRenderer data={data} />}
         {kind === 'cronjobs' && <CronJobRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'cronworkflows' && <CronWorkflowRenderer data={data} onNavigate={onNavigate} />}
@@ -783,6 +797,8 @@ export function ResourceRendererDispatch({
         {kind === 'persistentvolumeclaims' && <PVCComp data={data} onNavigate={onNavigate} />}
         {kind === 'rollouts' && isArgoRolloutResource(data) && <RolloutComp data={data} onNavigate={onNavigate} />}
         {kind === 'analysisruns' && <AnalysisRunRenderer data={data} onNavigate={onNavigate} />}
+        {(kind === 'analysistemplates' || kind === 'clusteranalysistemplates') && <AnalysisTemplateRenderer data={data} />}
+        {kind === 'experiments' && isApiGroup(data?.apiVersion, 'argoproj.io') && <ExperimentRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'certificates' && !data?.apiVersion?.includes('networking.internal.knative.dev') && <CertificateRenderer data={data} />}
         {kind === 'workflows' && <WorkflowRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'persistentvolumes' && <PersistentVolumeRenderer data={data} onNavigate={onNavigate} />}
@@ -920,6 +936,7 @@ export function ResourceRendererDispatch({
         {kind === 'priorityclasses' && <PriorityClassRenderer data={data} />}
         {kind === 'runtimeclasses' && <RuntimeClassRenderer data={data} />}
         {kind === 'leases' && <LeaseRenderer data={data} />}
+        {kind === 'limitranges' && <LimitRangeRenderer data={data} />}
         {/* Knative Serving */}
         {(kind === 'services' && data?.apiVersion?.includes('serving.knative.dev')) && <KnativeServiceRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'knativeservices' && <KnativeServiceRenderer data={data} onNavigate={onNavigate} />}
@@ -1103,6 +1120,10 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
   if (k === 'nodes') return getNodeStatus(data)
   if (k === 'persistentvolumeclaims') return getPVCStatus(data)
   if (k === 'analysisruns') return getAnalysisRunStatus(data)
+  // Same collision guard as the render branch above — Katib's unrelated
+  // Experiment CRD (kubeflow.org) shares this plural and doesn't report the
+  // AnalysisPhase vocabulary getAnalysisRunStatus expects.
+  if (k === 'experiments' && isApiGroup(data?.apiVersion, 'argoproj.io')) return getAnalysisRunStatus(data)
   if (k === 'workflows') return getWorkflowStatus(data)
   if (k === 'cronworkflows') return getCronWorkflowStatus(data)
   if (k === 'certificates') {

package/src/components/shared/index.ts

@@ -1,6 +1,10 @@
 export { ResourceRendererDispatch, getResourceStatus, type RendererOverrides } from './ResourceRendererDispatch'
 export { EditableYamlView, SaveSuccessAnimation } from './EditableYamlView'
 export { ResourceActionsBar, RevisionHistoryDialog, isRolloutKind } from './ResourceActionsBar'
+export {
+  DrainPlanDialog, DrainPlanContent, canConfirmDrain, planMatches, emptyDirPodsAtRisk, DEFAULT_DRAIN_DIALOG_OPTIONS,
+  type DrainPlan, type DrainPlanPod, type DrainOutcome, type DrainDialogOptions,
+} from './DrainPlanDialog'
 export { SetImageDialog, type ManagedImageSource, type SetImageDialogProps } from './SetImageDialog'
 export { CreateResourceDialog, type CreateResourceDialogProps, type ApplyResult } from './CreateResourceDialog'
 export { HelmManagedByChip, ManagedByChip, type HelmOwnerRef } from './ManagedByChip'

package/src/components/ui/FetchResult.test.tsx

@@ -2,8 +2,8 @@ import { describe, expect, it } from 'vitest'
 import { renderToString } from 'react-dom/server'
 import { FetchResult } from './FetchResult'
 
-function shaped(message: string, status: number) {
-  return Object.assign(new Error(message), { status })
+function shaped(message: string, status: number, data?: Record<string, unknown>) {
+  return Object.assign(new Error(message), { status, data })
 }
 
 describe('FetchResult', () => {
@@ -54,6 +54,24 @@ describe('FetchResult', () => {
     expect(html).toContain('Resource cache not available')
   })
 
+  it('does not blame the cluster for a kind_sync_failed 503', () => {
+    const html = renderToString(
+      <FetchResult
+        loading={false}
+        error={shaped('pods failed to load within the sync deadline', 503, { error_code: 'kind_sync_failed' })}
+      />,
+    )
+    expect(html).not.toContain('Cluster unavailable')
+    expect(html).toContain('Couldn')
+    expect(html).toContain('pods failed to load within the sync deadline')
+  })
+
+  it('renders a Retry button only when onRetry is given', () => {
+    const err = shaped('internal server error', 500)
+    expect(renderToString(<FetchResult loading={false} error={err} onRetry={() => {}} />)).toContain('Retry')
+    expect(renderToString(<FetchResult loading={false} error={err} />)).not.toContain('Retry')
+  })
+
   it('renders "Sign-in required" on 401', () => {
     const html = renderToString(
       <FetchResult loading={false} error={shaped('Unauthorized', 401)} />,

package/src/components/ui/FetchResult.tsx

@@ -1,5 +1,5 @@
 import { useState } from 'react'
-import { ShieldOff, AlertTriangle, ServerCrash, LogIn, Copy, Check, type LucideIcon } from 'lucide-react'
+import { ShieldOff, AlertTriangle, ServerCrash, LogIn, Copy, Check, RefreshCw, type LucideIcon } from 'lucide-react'
 import { clsx } from 'clsx'
 import { PaneLoader } from './PaneLoader'
 import { isFetchError } from '../../types/fetch-error'
@@ -14,6 +14,7 @@ import { isFetchError } from '../../types/fetch-error'
 //   loading                  → <PaneLoader/>
 //   error (403)              → "Access denied"            + error.message
 //   error (404)              → notFoundMessage            + error.message
+//   error (503 sync failed)  → "Couldn't load this view"  + error.message
 //   error (503)              → "Cluster unavailable"      + error.message
 //   error (401)              → "Sign-in required"         (apiFetch redirects; fallback)
 //   error (other / no shape) → "Couldn't load this view"  + error.message
@@ -34,6 +35,8 @@ interface FetchResultProps {
   notFoundMessage?: string
   /** Pin to parent height. Existing call sites use "h-32" or "h-full". */
   className?: string
+  /** Renders a Retry button on the error surface. */
+  onRetry?: () => void
 }
 
 export function FetchResult({
@@ -41,6 +44,7 @@ export function FetchResult({
   error,
   notFoundMessage = 'Resource not found',
   className = 'h-32',
+  onRetry,
 }: FetchResultProps) {
   if (loading) {
     return <PaneLoader className={className} />
@@ -55,16 +59,17 @@ export function FetchResult({
       </div>
     )
   }
-  return <ErrorSurface error={error} notFoundMessage={notFoundMessage} className={className} />
+  return <ErrorSurface error={error} notFoundMessage={notFoundMessage} className={className} onRetry={onRetry} />
 }
 
 interface ErrorSurfaceProps {
   error: unknown
   notFoundMessage: string
   className: string
+  onRetry?: () => void
 }
 
-function ErrorSurface({ error, notFoundMessage, className }: ErrorSurfaceProps) {
+function ErrorSurface({ error, notFoundMessage, className, onRetry }: ErrorSurfaceProps) {
   const classified = classify(error, notFoundMessage)
   const Icon = classified.icon
 
@@ -81,6 +86,16 @@ function ErrorSurface({ error, notFoundMessage, className }: ErrorSurfaceProps)
           <CopyErrorButton text={classified.detail} />
         </div>
       )}
+      {onRetry && (
+        <button
+          type="button"
+          onClick={onRetry}
+          className="mt-1 flex items-center gap-1.5 rounded-md border border-theme-border bg-theme-elevated px-3 py-1.5 text-xs text-theme-text-secondary hover:bg-theme-hover hover:text-theme-text-primary"
+        >
+          <RefreshCw className="h-3.5 w-3.5" aria-hidden />
+          Retry
+        </button>
+      )}
     </div>
   )
 }
@@ -101,6 +116,17 @@ function classify(error: unknown, notFoundMessage: string): Classified {
       case 401:
         return { headline: 'Sign-in required', detail: error.message, icon: LogIn }
       case 503:
+        // The cluster is connected; one kind's informer missed its sync
+        // deadline, so "Cluster unavailable" would send the reader the wrong way.
+        if (errorCodeOf(error) === 'kind_sync_failed') {
+          return { headline: "Couldn't load this view", detail: error.message, icon: AlertTriangle }
+        }
+        // The cluster is healthy and still loading — the retry policies keep
+        // these surfaces polling, but a caller without one must not tell the
+        // user a connecting cluster is down.
+        if (errorCodeOf(error) === 'cluster_connecting' || errorCodeOf(error) === 'kind_sync_pending') {
+          return { headline: 'Cluster is still loading', detail: error.message, icon: AlertTriangle }
+        }
         return { headline: 'Cluster unavailable', detail: error.message, icon: ServerCrash }
       default:
         return { headline: "Couldn't load this view", detail: error.message, icon: AlertTriangle }
@@ -110,6 +136,10 @@ function classify(error: unknown, notFoundMessage: string): Classified {
   return { headline: "Couldn't load this view", detail: errorMessageOf(error), icon: AlertTriangle }
 }
 
+function errorCodeOf(error: unknown): unknown {
+  return (error as { data?: { error_code?: unknown } }).data?.error_code
+}
+
 function errorMessageOf(error: unknown): string | null {
   if (error instanceof Error && error.message) return error.message
   if (typeof error === 'string') return error

package/src/components/ui/FreshnessControl.tsx

@@ -6,7 +6,10 @@ import { useRefreshAnimation } from '../../hooks/useRefreshAnimation'
 import { formatUpdatedAgo, msToNextBucket } from '../../utils/format'
 
 export type FreshnessMode = 'auto' | 'snapshot'
-export type FreshnessConnection = 'connected' | 'disconnected' | 'connecting'
+// 'syncing' is the progressive first-load shell: the app has a live link to
+// the cluster and serves kinds as their initial sync completes — nothing was
+// ever connected before, so 'Reconnecting…' would be untrue there.
+export type FreshnessConnection = 'connected' | 'disconnected' | 'connecting' | 'syncing'
 
 interface FreshnessControlProps {
   // 'auto'     — the view keeps itself current (polls or streams). Reads
@@ -85,7 +88,10 @@ export function FreshnessControl({
   let label: string | null
   let tooltip: string | null
   let live = false
-  if (degraded) {
+  if (connectionState === 'syncing') {
+    label = 'Loading cluster data…'
+    tooltip = 'Initial sync in progress — rows shown are live for the kinds that have finished loading.'
+  } else if (degraded) {
     label = 'Reconnecting…'
     tooltip = 'Not connected to the cluster — data may be stale until the connection is restored.'
   } else if (mode === 'auto' && paused) {

package/src/components/workload/WorkloadView.tsx

@@ -36,7 +36,7 @@ import {
 import type { TimelineEvent, ResourceRef, Relationships, SelectedResource, ResolvedEnvFrom, Topology, TopologyNode, HPADiagnosis, WorkloadPodInfo } from '../../types'
 import type { GitOpsStatus } from '../../types/gitops'
 import type { NavigateToResource } from '../../utils/navigation'
-import { refToSelectedResource, pluralToKind, kindToPlural, kindToPluralWithGroup, apiVersionToGroup } from '../../utils/navigation'
+import { refToSelectedResource, pluralToKind, knownKindForPluralWithGroup, kindToPlural, kindToPluralWithGroup, apiVersionToGroup } from '../../utils/navigation'
 import { neighborhoodFor, seedNodeIds } from '../../utils/topology-neighborhood'
 import { TopologyGraph } from '../topology/TopologyGraph'
 import { gitOpsOwnerFromRelationships, type GitOpsOwnerRef } from '../../utils/gitops-owner'
@@ -731,7 +731,7 @@ export function WorkloadView({
     | ((ctx: { kind: string; group?: string; namespace: string; name: string; health?: DiagnoseHealthHint }) => ReactNode)
     | undefined
   const diagnoseAction = renderDiagnose?.({
-    kind: apiKind,
+    kind: resource?.kind ?? knownKindForPluralWithGroup(apiKind, group ?? '') ?? apiKind,
     group,
     namespace,
     name,

package/src/theme/components.css

@@ -95,6 +95,11 @@
     border-style: solid;
     border-color: transparent;
     line-height: 1.25rem;
+    /* A badge sits in table cells the reader can drag narrower than the label.
+       Without a ceiling it keeps its intrinsic width and draws straight over
+       the next column, so two cells become unreadable instead of one. */
+    max-width: 100%;
+    overflow: hidden;
   }
 
   .badge-sm {
@@ -108,6 +113,17 @@
     border-style: solid;
     border-color: transparent;
     line-height: 1.25rem;
+    max-width: 100%;
+    overflow: hidden;
+  }
+
+  /* The icon is the one part of a badge that must never be traded for text:
+     a 12px glyph squeezed to 5px reads as a rendering fault, and a severity
+     icon that shrinks is worse than one that is cropped away cleanly. Flex
+     would otherwise shrink it first, because it is the item with slack. */
+  .badge > svg,
+  .badge-sm > svg {
+    flex-shrink: 0;
   }
 
   /* ── INNER CARDS ── */

package/src/types/core.ts

@@ -631,6 +631,11 @@ export interface ResourceRef {
 
 // Computed relationships for a resource
 export interface Relationships {
+  reflection?: {
+    source?: ResourceRef
+    sourceResourceVersion?: string
+    mirrors?: ResourceRef[]
+  }
   owner?: ResourceRef
   deployment?: ResourceRef   // Grandparent Deployment (for Pods owned by ReplicaSets)
   managedBy?: ResourceRef[]  // Topmost meaningful manager(s): GitOps controller (ArgoCD Application / Flux Kustomization / Flux HelmRelease), Helm release, or the topmost K8s owner. Synthesized server-side; replaces client-side detectGitOpsOwner.
@@ -1251,7 +1256,7 @@ export interface MetricsDataPoint {
 export interface TrafficEndpoint {
   name: string
   namespace: string
-  kind: string // Pod, Service, External
+  kind: string // Pod, Service, External, Host, Unknown
   ip?: string
   labels?: Record<string, string>
   workload?: string
@@ -1292,6 +1297,15 @@ export interface TrafficFlow {
    *  status code for no single flow. */
   errorRate?: number
   verdict: string // forwarded, dropped, error
+  /** The network plugin's own account of which policies decided this flow
+   *  (Hubble reports it). Absent when the plugin said nothing. */
+  policyVerdict?: {
+    allowedBy?: { kind: string; namespace?: string; name: string }[]
+    deniedBy?: { kind: string; namespace?: string; name: string }[]
+    /** Denying references removed before delivery because the viewer may not
+     *  read policies of that kind there; the plugin still named a policy. */
+    withheld?: number
+  }
   lastSeen: string // ISO date string
 }
 

package/src/types/gitops-insights.ts

@@ -13,6 +13,7 @@ export interface GitOpsInsight {
 }
 
 import type { GitOpsTool } from './gitops'
+import type { GitOpsHealthMode, GitOpsHealthSource } from './gitops-tree'
 
 // Closed enums mirroring `pkg/gitops/insights/vocab.go`. Keeping the FE
 // vocabulary in lockstep with the Go side means switches over these fields
@@ -79,6 +80,19 @@ export interface GitOpsInsightSummary {
   // (jqPathExpressions / managedFieldsManagers rules) — the
   // drift panel may surface fields Argo's own UI suppresses.
   ignoredDifferences?: GitOpsIgnoredDifferences
+  // Argo roots: where Argo keeps per-resource health. 'appTree' means the
+  // controller's verdicts are not in the Application object and any
+  // per-resource health shown is Radar's own read.
+  resourceHealthMode?: GitOpsHealthMode
+  // The Application deploys to another cluster; Radar derives nothing about
+  // its resources from here.
+  remoteDestination?: boolean
+  // Per-resource health came from Argo CD's API server: the verdicts shown
+  // are Argo's even though the Application object doesn't carry them.
+  resourceHealthFromApi?: boolean
+  // The controller's API server was asked and didn't answer usefully — why,
+  // in the user's words. Only set when the integration is configured.
+  resourceHealthApiError?: string
 }
 
 export interface GitOpsIgnoredDifferences {
@@ -116,6 +130,10 @@ export interface GitOpsIssue {
   // a contextual action button. Nil when no automated remedy applies — the
   // `action` string still describes the manual path in that case.
   remediation?: GitOpsRemediation
+  // Set on resource-scoped issues: 'controller' when the GitOps controller's
+  // own per-resource health produced it, 'radar' when Radar's issues engine
+  // did because the controller's verdict wasn't available.
+  source?: GitOpsHealthSource
 }
 
 export type GitOpsRemediationKind = 'create-namespace'
@@ -131,6 +149,11 @@ export interface GitOpsChange {
   category: GitOpsCategory
   sync?: string
   health?: string
+  // Provenance of `health`; see GitOpsTreeNode.healthSource. `message` holds
+  // the health message from whichever source produced `health`.
+  healthSource?: GitOpsHealthSource
+  healthReason?: string
+  healthSeverity?: string
   message?: string
   // Per-resource sync failure message (Argo's status.resources[].syncResult).
   // Distinct from `message` (live health). Empty when sync succeeded.

package/src/types/gitops-tree.ts

@@ -24,6 +24,16 @@ export interface GitOpsTreeNode {
   tool: GitOpsTreeTool
   sync?: SyncStatus
   health?: GitOpsHealthStatus
+  // Who assessed `health`. 'controller' is the GitOps controller's own
+  // verdict; 'radar' is Radar's read of the live object (topology status, or
+  // the issues engine's finding when the controller's verdict isn't
+  // available). The UI labels 'radar' values so they never pass as the
+  // controller's. Absent when `health` is absent. Kept open for sources a
+  // newer backend may add — unknown values render without a label.
+  healthSource?: GitOpsHealthSource
+  healthReason?: string
+  healthMessage?: string
+  healthSeverity?: 'critical' | 'warning' | (string & {})
   topologyStatus?: HealthStatus
   info?: GitOpsTreeInfoItem[]
   resource?: unknown
@@ -32,6 +42,16 @@ export interface GitOpsTreeNode {
   data?: Record<string, unknown>
 }
 
+// 'controllerApi' is the controller's own verdict read from its API server
+// (argocd-server) because the CR doesn't carry it; same authority as
+// 'controller'.
+export type GitOpsHealthSource = 'controller' | 'controllerApi' | 'radar' | (string & {})
+
+// Where an Argo CD Application keeps per-resource health. 'appTree' is the
+// Argo CD 3 default: the controller's per-resource verdicts are not in the
+// Application object, so any node health present came from Radar.
+export type GitOpsHealthMode = 'inline' | 'appTree' | (string & {})
+
 export type GitOpsTreeEdgeType = 'owns' | 'source' | 'dependsOn'
 
 export interface GitOpsTreeEdge {
@@ -54,4 +74,13 @@ export interface GitOpsResourceTree {
   edges: GitOpsTreeEdge[]
   warnings?: string[]
   summary?: GitOpsTreeSummary
+  healthMode?: GitOpsHealthMode
+  // Per-resource health came from the controller's API server, so in
+  // appTree mode the verdicts are still the controller's.
+  healthFromApi?: boolean
+  // The controller's API server was asked and didn't answer usefully.
+  healthApiError?: string
+  // The Application deploys to another cluster; Radar derives nothing about
+  // its resources from here.
+  remoteDestination?: boolean
 }

package/src/utils/index.ts

@@ -30,3 +30,4 @@ export * from './application-history'
 export * from './bulk-workload-actions'
 export * from './inClusterConsent'
 export * from './workflow-execution'
+export * from './network-policy'

package/src/utils/navigation.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect, afterEach } from 'vitest'
 import { englishPlural } from './pluralize'
-import { kindToPlural, kindToPluralWithGroup, pluralToKind, refToSelectedResource, initNavigationMap, resetNavigationMap, laneId, laneResourceKey, groupQualifiesLaneId, parseLaneId } from './navigation'
+import { kindToPlural, kindToPluralWithGroup, pluralToKind, knownKindForPluralWithGroup, refToSelectedResource, initNavigationMap, resetNavigationMap, laneId, laneResourceKey, groupQualifiesLaneId, parseLaneId } from './navigation'
 
 afterEach(() => {
   resetNavigationMap()
@@ -223,6 +223,25 @@ describe('initNavigationMap', () => {
       { group: 'metrics.k8s.io', version: 'v1beta1', kind: 'PodMetrics', name: 'pods', namespaced: true, isCrd: false, verbs: ['get'] },
     ])
     expect(pluralToKind('pods')).toBe('Pod')
+    expect(knownKindForPluralWithGroup('pods', '')).toBe('Pod')
+    expect(knownKindForPluralWithGroup('pods', 'metrics.k8s.io')).toBe('PodMetrics')
+    expect(kindToPluralWithGroup('PodMetrics', 'metrics.k8s.io')).toBe('pods')
+  })
+
+  test('resolves discovered plural collisions by API group', () => {
+    initNavigationMap([
+      { group: 'a.example.io', version: 'v1', kind: 'Widget', name: 'widgets', namespaced: true, isCrd: true, verbs: ['get'] },
+      { group: 'b.example.io', version: 'v1', kind: 'OtherWidget', name: 'widgets', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(knownKindForPluralWithGroup('widgets', 'a.example.io')).toBe('Widget')
+    expect(knownKindForPluralWithGroup('widgets', 'b.example.io')).toBe('OtherWidget')
+    expect(knownKindForPluralWithGroup('OtherWidget', 'b.example.io')).toBe('OtherWidget')
+  })
+
+  test('does not invent a Kind for an undiscovered irregular CRD', () => {
+    expect(knownKindForPluralWithGroup('databases', 'postgresql.cnpg.io')).toBeUndefined()
+    expect(kindToPluralWithGroup('Database', 'postgresql.cnpg.io')).toBe('databases')
+    expect(kindToPluralWithGroup('databases', 'postgresql.cnpg.io')).toBe('databases')
   })
 
   test('keeps the virtual PodGroup alias distinct from scheduling PodGroup', () => {

package/src/utils/navigation.ts

@@ -1,5 +1,6 @@
 import type { SelectedResource, ResourceRef, APIResource } from '../types/core'
 import { englishPlural, englishSingular, isEnglishPlural } from './pluralize'
+import { CORE_RESOURCES } from './api-resources'
 
 /**
  * Canonical callback type for navigating to a resource.
@@ -44,6 +45,15 @@ const BUILTIN_PLURAL_TO_KIND: Record<string, string> = {
 
 const BUILTIN_GROUP_KIND_TO_PLURAL: Record<string, string> = {
   'scheduling.k8s.io/podgroup': 'podgroups',
+  'metrics.k8s.io/podmetrics': 'pods',
+  'metrics.k8s.io/nodemetrics': 'nodes',
+}
+
+const BUILTIN_GROUP_PLURAL_TO_KIND: Record<string, string> = {
+  ...Object.fromEntries(CORE_RESOURCES.map(r => [`${r.group}/${r.name}`, r.kind])),
+  'metrics.k8s.io/pods': 'PodMetrics',
+  'metrics.k8s.io/nodes': 'NodeMetrics',
+  'scheduling.k8s.io/podgroups': 'PodGroup',
 }
 
 // Dynamic map built from API discovery — populated by initNavigationMap().
@@ -51,6 +61,7 @@ const BUILTIN_GROUP_KIND_TO_PLURAL: Record<string, string> = {
 let discoveredPluralToKind: Record<string, string> | null = null
 let discoveredKindToPlural: Record<string, string> | null = null
 let discoveredGroupKindToPlural: Record<string, string> | null = null
+let discoveredGroupPluralToKind: Record<string, string> | null = null
 
 /**
  * Initialize navigation maps from discovered API resources.
@@ -61,6 +72,7 @@ export function initNavigationMap(resources: APIResource[]) {
   const p2k: Record<string, string> = { ...BUILTIN_PLURAL_TO_KIND }
   const k2p: Record<string, string> = {}
   const gk2p: Record<string, string> = {}
+  const gp2k: Record<string, string> = { ...BUILTIN_GROUP_PLURAL_TO_KIND }
   for (const r of resources) {
     const plural = r.name.toLowerCase()
     // First-wins on plurals: BUILTIN_PLURAL_TO_KIND seeds canonical core mappings
@@ -69,10 +81,13 @@ export function initNavigationMap(resources: APIResource[]) {
     if (!(plural in p2k)) p2k[plural] = r.kind
     k2p[r.kind.toLowerCase()] = plural
     gk2p[`${r.group}/${r.kind.toLowerCase()}`] = plural
+    const groupPlural = `${r.group}/${plural}`
+    if (!(groupPlural in gp2k)) gp2k[groupPlural] = r.kind
   }
   discoveredPluralToKind = p2k
   discoveredKindToPlural = k2p
   discoveredGroupKindToPlural = gk2p
+  discoveredGroupPluralToKind = gp2k
 }
 
 /** Reset navigation maps to builtin-only state. For testing. */
@@ -80,6 +95,7 @@ export function resetNavigationMap() {
   discoveredPluralToKind = null
   discoveredKindToPlural = null
   discoveredGroupKindToPlural = null
+  discoveredGroupPluralToKind = null
 }
 
 function getPluralToKind(): Record<string, string> {
@@ -166,6 +182,15 @@ export function pluralToKind(plural: string): string {
   return singular.charAt(0).toUpperCase() + singular.slice(1)
 }
 
+/** Return an exact Kind only when the input or group-qualified discovery proves it. */
+export function knownKindForPluralWithGroup(plural: string, group: string): string | undefined {
+  if (!plural) return undefined
+  if (plural[0] !== plural[0].toLowerCase()) return plural
+  const groupPlural = `${group}/${plural.toLowerCase()}`
+  return discoveredGroupPluralToKind?.[groupPlural]
+    ?? BUILTIN_GROUP_PLURAL_TO_KIND[groupPlural]
+}
+
 /**
  * Convert a ResourceRef (from backend relationships) to a SelectedResource (for navigation).
  * Handles kind singular→plural conversion.

package/src/utils/network-policy.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import { effectivePolicyTypeNames, effectivePolicyTypes, formatNetworkPolicyPort } from './network-policy'
+
+describe('effectivePolicyTypes', () => {
+  it('reads an explicit list as authoritative', () => {
+    expect(effectivePolicyTypes({ policyTypes: ['Egress'] })).toEqual({ ingress: false, egress: true, explicit: true })
+    expect(effectivePolicyTypes({ policyTypes: ['Ingress', 'Egress'], egress: [] })).toEqual({ ingress: true, egress: true, explicit: true })
+  })
+
+  it('defaults an omitted list to Ingress — the classic default-deny', () => {
+    expect(effectivePolicyTypes({ podSelector: {} })).toEqual({ ingress: true, egress: false, explicit: false })
+    expect(effectivePolicyTypes({ policyTypes: [] })).toEqual({ ingress: true, egress: false, explicit: false })
+    expect(effectivePolicyTypes(undefined)).toEqual({ ingress: true, egress: false, explicit: false })
+  })
+
+  it('adds Egress to the default only when egress rules are declared', () => {
+    expect(effectivePolicyTypes({ egress: [{}] })).toEqual({ ingress: true, egress: true, explicit: false })
+    expect(effectivePolicyTypes({ egress: [] })).toEqual({ ingress: true, egress: false, explicit: false })
+  })
+
+  it('names the effective types as Ingress then Egress', () => {
+    expect(effectivePolicyTypeNames({})).toEqual(['Ingress'])
+    expect(effectivePolicyTypeNames({ egress: [{}] })).toEqual(['Ingress', 'Egress'])
+    expect(effectivePolicyTypeNames({ policyTypes: ['Egress'] })).toEqual(['Egress'])
+    expect(effectivePolicyTypeNames({ policyTypes: ['Egress', 'Ingress'] })).toEqual(['Ingress', 'Egress'])
+  })
+})
+
+describe('formatNetworkPolicyPort', () => {
+  it('renders single ports, ranges, named ports and protocol-only entries', () => {
+    expect(formatNetworkPolicyPort({ port: 80 })).toBe('TCP/80')
+    expect(formatNetworkPolicyPort({ protocol: 'UDP', port: 53 })).toBe('UDP/53')
+    expect(formatNetworkPolicyPort({ port: 9000, endPort: 9100 })).toBe('TCP/9000-9100')
+    expect(formatNetworkPolicyPort({ port: 'metrics' })).toBe('TCP/metrics')
+    expect(formatNetworkPolicyPort({ protocol: 'SCTP' })).toBe('SCTP/*')
+  })
+
+  it('never shows a range off a named port or off no port', () => {
+    expect(formatNetworkPolicyPort({ port: 'metrics', endPort: 9100 })).toBe('TCP/metrics')
+    expect(formatNetworkPolicyPort({ endPort: 9100 })).toBe('TCP/*')
+  })
+})