@skyhook-io/k8s-ui 1.14.5 → 1.14.7

package/src/components/shared/DrainPlanDialog.tsx

@@ -0,0 +1,297 @@
+import { Info, Loader2, RefreshCw } from 'lucide-react'
+import { ConfirmDialog } from '../ui/ConfirmDialog'
+import { Badge, type BadgeSeverity } from '../ui/Badge'
+import { AlertBanner } from '../ui/drawer-components'
+import { Tooltip } from '../ui/Tooltip'
+import { pluralize } from '../../utils/pluralize'
+
+// Shapes returned by POST /api/nodes/{name}/drain-plan.
+export type DrainOutcome = 'evict' | 'skip' | 'may-block'
+
+export interface DrainPlanPod {
+  namespace: string
+  name: string
+  outcome: DrainOutcome
+  reason: string
+  emptyDir: boolean
+  pdb?: string
+  pdbChecked: boolean
+}
+
+export interface DrainPlan {
+  node: string
+  generatedAt: string
+  estimate: boolean
+  options: { ignoreDaemonSets: boolean; deleteEmptyDirData: boolean; force: boolean; gracePeriodSeconds?: number }
+  summary: { evict: number; skip: number; mayBlock: number }
+  pods: DrainPlanPod[]
+  pdbsEvaluated: boolean
+  pdbError?: string
+}
+
+// The two options the operator chooses in the dialog. Both are always sent
+// explicitly to the drain endpoint; nothing relies on server-side defaults.
+export interface DrainDialogOptions {
+  force: boolean
+  deleteEmptyDirData: boolean
+}
+
+export const DEFAULT_DRAIN_DIALOG_OPTIONS: DrainDialogOptions = { force: false, deleteEmptyDirData: false }
+
+/** A plan is only usable when it was computed for this node with these options. */
+export function planMatches(plan: DrainPlan | null | undefined, nodeName: string, options: DrainDialogOptions): plan is DrainPlan {
+  return Boolean(
+    plan &&
+      plan.node === nodeName &&
+      plan.options.force === options.force &&
+      plan.options.deleteEmptyDirData === options.deleteEmptyDirData,
+  )
+}
+
+/** Pods whose emptyDir data would be discarded by this drain (evicted, not skipped). */
+export function emptyDirPodsAtRisk(plan: DrainPlan): DrainPlanPod[] {
+  return plan.pods.filter((p) => p.emptyDir && p.outcome !== 'skip')
+}
+
+export interface CanConfirmDrainInput {
+  plan: DrainPlan | null | undefined
+  nodeName: string
+  options: DrainDialogOptions
+  loading: boolean
+  /** the last plan request failed; with plan support the drain stays disabled until a plan is shown again */
+  error?: string | null
+  /** false when the host cannot compute plans (no onPlanDrain); the dialog then confirms without one */
+  planSupported: boolean
+}
+
+/**
+ * Whether the destructive Drain button may be enabled. With plan support the
+ * operator must see a current plan first. Deleting emptyDir data is its own
+ * deliberate choice, off by default and warned about by name, so it does not
+ * gate the button a second time.
+ */
+export function canConfirmDrain({ plan, nodeName, options, loading, error, planSupported }: CanConfirmDrainInput): boolean {
+  if (loading) return false
+  if (planSupported && error) return false
+  const current = planMatches(plan, nodeName, options) ? plan : null
+  if (planSupported && !current) return false
+  return true
+}
+
+const OUTCOME_SEVERITY: Record<DrainOutcome, BadgeSeverity> = {
+  evict: 'warning',
+  'may-block': 'error',
+  skip: 'neutral',
+}
+
+const OUTCOME_LABEL: Record<DrainOutcome, string> = {
+  evict: 'evict',
+  'may-block': 'may block',
+  skip: 'skip',
+}
+
+const ESTIMATE_CAVEAT =
+  'An estimate, not a guarantee: the drain re-lists live state when it runs, and pods, budgets and permissions can change until then. ' +
+  'Evictions a budget refuses are retried until the drain deadline (60 seconds, shared by all evictions); a pod covered by more than one budget is refused outright.'
+
+interface DrainPlanContentProps {
+  nodeName: string
+  plan?: DrainPlan | null
+  loading: boolean
+  error?: string | null
+  options: DrainDialogOptions
+  onOptionsChange: (options: DrainDialogOptions) => void
+  planSupported: boolean
+  /** Recompute the plan with the current options; also the retry after a failed plan. */
+  onRefreshPlan?: () => void
+}
+
+/**
+ * The body of the drain dialog: options, the plan table and the emptyDir
+ * warning. Presentational, so it renders without a DOM (tests use
+ * react-dom/server); the enclosing dialog owns the confirm gating.
+ */
+export function DrainPlanContent({
+  nodeName, plan, loading, error, options, onOptionsChange, planSupported, onRefreshPlan,
+}: DrainPlanContentProps) {
+  const current = planMatches(plan, nodeName, options) ? plan : null
+  const atRisk = current ? emptyDirPodsAtRisk(current) : []
+
+  return (
+    <div className="flex flex-col gap-3 text-sm text-theme-text-secondary">
+      <div className="flex flex-wrap gap-x-6 gap-y-2">
+        <label className="flex items-center gap-2 cursor-pointer">
+          <input
+            type="checkbox"
+            checked={options.force}
+            onChange={(e) => onOptionsChange({ ...options, force: e.target.checked })}
+            className="rounded border-theme-border"
+          />
+          Force: evict pods not managed by a controller (they are not recreated)
+        </label>
+        <label className="flex items-center gap-2 cursor-pointer">
+          <input
+            type="checkbox"
+            checked={options.deleteEmptyDirData}
+            onChange={(e) => onOptionsChange({ ...options, deleteEmptyDirData: e.target.checked })}
+            className="rounded border-theme-border"
+          />
+          Delete emptyDir data: evict pods that use emptyDir volumes (their data is lost)
+        </label>
+      </div>
+
+      {planSupported && loading && (
+        <div className="flex items-center gap-2 text-theme-text-secondary">
+          <Loader2 className="w-4 h-4 animate-spin" /> Computing the plan…
+        </div>
+      )}
+
+      {planSupported && !loading && error && (
+        <AlertBanner variant="error" title="Could not compute the drain plan" message={error}>
+          {onRefreshPlan && (
+            <button
+              type="button"
+              onClick={onRefreshPlan}
+              className="mt-2 rounded border border-theme-border bg-theme-surface px-2 py-1 text-xs text-theme-text-primary transition-colors hover:bg-theme-hover"
+            >
+              Try again
+            </button>
+          )}
+        </AlertBanner>
+      )}
+
+      {planSupported && !loading && !error && current && (
+        <>
+          <div className="flex items-start justify-between gap-2">
+            <div className="text-theme-text-primary">
+              {pluralize(current.summary.evict, 'pod')} to evict,{' '}
+              {current.pdbsEvaluated
+                ? `${current.summary.mayBlock} may block on a PodDisruptionBudget`
+                : 'PodDisruptionBudgets not evaluated'}
+              , {current.summary.skip} skipped.
+            </div>
+            <div className="flex items-center gap-1 shrink-0 text-xs text-theme-text-tertiary">
+              <span>Estimated at {new Date(current.generatedAt).toLocaleTimeString()}</span>
+              <Tooltip content={ESTIMATE_CAVEAT} className="max-w-xs">
+                <button
+                  type="button"
+                  aria-label="About this estimate"
+                  className="p-0.5 rounded text-theme-text-tertiary transition-colors hover:text-theme-text-secondary"
+                >
+                  <Info className="w-3.5 h-3.5" />
+                </button>
+              </Tooltip>
+              {onRefreshPlan && (
+                <Tooltip content="Recompute the plan">
+                  <button
+                    type="button"
+                    aria-label="Recompute the plan"
+                    onClick={onRefreshPlan}
+                    className="p-1 rounded text-theme-text-secondary transition-colors hover:bg-theme-hover hover:text-theme-text-primary"
+                  >
+                    <RefreshCw className="w-3.5 h-3.5" />
+                  </button>
+                </Tooltip>
+              )}
+            </div>
+          </div>
+
+          {!current.pdbsEvaluated && (
+            <AlertBanner
+              variant="warning"
+              title="PodDisruptionBudgets were not evaluated"
+              message={current.pdbError ?? 'Budgets could not be listed; evictions may still be refused.'}
+            />
+          )}
+
+          <div className="max-h-72 overflow-auto rounded border border-theme-border">
+            <table className="w-full text-xs">
+              <tbody>
+                {current.pods.map((p) => (
+                  <tr key={`${p.namespace}/${p.name}`} className="border-b border-theme-border last:border-b-0 align-top">
+                    <td className="px-2 py-1.5 whitespace-nowrap">
+                      <Badge severity={OUTCOME_SEVERITY[p.outcome]} size="sm">{OUTCOME_LABEL[p.outcome]}</Badge>
+                    </td>
+                    <td className="px-2 py-1.5 font-mono whitespace-nowrap text-theme-text-primary">
+                      {p.namespace}/{p.name}
+                    </td>
+                    <td className="px-2 py-1.5 text-theme-text-secondary">{p.reason}</td>
+                  </tr>
+                ))}
+                {current.pods.length === 0 && (
+                  <tr>
+                    <td className="px-2 py-3 text-theme-text-secondary" colSpan={3}>No pods are scheduled on this node.</td>
+                  </tr>
+                )}
+              </tbody>
+            </table>
+          </div>
+        </>
+      )}
+
+      {options.deleteEmptyDirData && (
+        <AlertBanner
+          variant="warning"
+          title="emptyDir data will be discarded"
+          message={
+            current && atRisk.length > 0
+              ? `${pluralize(atRisk.length, 'pod')} that would be evicted ${atRisk.length === 1 ? 'uses' : 'use'} emptyDir: ${atRisk.map((p) => `${p.namespace}/${p.name}`).join(', ')}. That data cannot be recovered.`
+              : current
+                ? 'No pod that would be evicted uses emptyDir right now. Any that does when the drain runs loses that data, which cannot be recovered.'
+                : 'Every evicted pod that uses emptyDir volumes loses that data, which cannot be recovered.'
+          }
+        />
+      )}
+    </div>
+  )
+}
+
+interface DrainPlanDialogProps {
+  open: boolean
+  nodeName: string
+  plan?: DrainPlan | null
+  loading: boolean
+  error?: string | null
+  options: DrainDialogOptions
+  onOptionsChange: (options: DrainDialogOptions) => void
+  onConfirm: (options: DrainDialogOptions) => void
+  onClose: () => void
+  isDraining: boolean
+  /** Whether the host can compute plans. Without it the dialog confirms without one. */
+  planSupported: boolean
+  /** Recompute the plan with the current options; also the retry after a failed plan. */
+  onRefreshPlan?: () => void
+}
+
+export function DrainPlanDialog({
+  open, nodeName, plan, loading, error, options, onOptionsChange, onConfirm, onClose, isDraining, planSupported, onRefreshPlan,
+}: DrainPlanDialogProps) {
+  const confirmEnabled = canConfirmDrain({ plan, nodeName, options, loading, error, planSupported })
+
+  return (
+    <ConfirmDialog
+      open={open}
+      onClose={onClose}
+      onConfirm={() => onConfirm(options)}
+      title="Drain Node"
+      message={`Cordon "${nodeName}" and evict the pods listed below. The list is an estimate: the drain re-lists live state when it runs.`}
+      confirmLabel={isDraining ? 'Draining...' : 'Drain'}
+      variant="danger"
+      isLoading={isDraining}
+      isClosable
+      confirmDisabled={!confirmEnabled}
+      className="max-w-3xl"
+    >
+      <DrainPlanContent
+        nodeName={nodeName}
+        plan={plan}
+        loading={loading}
+        error={error}
+        options={options}
+        onOptionsChange={onOptionsChange}
+        planSupported={planSupported}
+        onRefreshPlan={onRefreshPlan}
+      />
+    </ConfirmDialog>
+  )
+}

package/src/components/shared/ResourceActionsBar.tsx

@@ -28,6 +28,7 @@ import type { SelectedResource, WorkloadRevision } from '../../types'
 import { displayKindName } from '../ui/drawer-components'
 import { getDefaultContainerName } from '../resources/resource-utils'
 import { SetImageDialog, type ManagedImageSource } from './SetImageDialog'
+import { DrainPlanDialog, DEFAULT_DRAIN_DIALOG_OPTIONS, type DrainDialogOptions, type DrainPlan } from './DrainPlanDialog'
 import type { WorkloadImageInventory, WorkloadImageUpdate } from '../../types/core'
 import { isArgoRolloutResource } from '../../utils/workload-rollout'
 import { isCoreBatchJob } from '../../utils/api-resources'
@@ -135,6 +136,17 @@ interface ResourceActionsBarProps {
   isUncordoningNode?: boolean
   onDrainNode?: (params: { name: string; options?: { deleteEmptyDirData?: boolean; force?: boolean } }) => void
   isDrainingNode?: boolean
+  // Read-only drain plan (POST /nodes/{name}/drain-plan). When the host provides
+  // onPlanDrain, the drain dialog shows the plan before enabling the destructive action.
+  onPlanDrain?: (params: { name: string; options: DrainDialogOptions }) => void
+  onPlanDrainReset?: () => void   // forget the last plan when the dialog closes, so a re-open never shows a stale one
+  drainPlan?: DrainPlan | null
+  isPlanningDrain?: boolean
+  drainPlanError?: string | null
+  // The connected backend has no drain-plan endpoint (version skew, e.g. a newer
+  // frontend against an older radar). The dialog falls back to the plan-less
+  // acknowledgement-only mode instead of keeping Drain disabled on a dead request.
+  drainPlanUnsupported?: boolean
 }
 
 export function ResourceActionsBar({
@@ -165,6 +177,7 @@ export function ResourceActionsBar({
   onCordonNode, isCordoningNode,
   onUncordonNode, isUncordoningNode,
   onDrainNode, isDrainingNode,
+  onPlanDrain, onPlanDrainReset, drainPlan, isPlanningDrain, drainPlanError, drainPlanUnsupported,
 }: ResourceActionsBarProps) {
   const kind = resource.kind.toLowerCase()
   const coreBatchJob = isCoreBatchJob(kind, resource.group)
@@ -183,7 +196,28 @@ export function ResourceActionsBar({
   // Node operation confirmation state
   const [showCordonConfirm, setShowCordonConfirm] = useState(false)
   const [showDrainConfirm, setShowDrainConfirm] = useState(false)
-  const [drainForce, setDrainForce] = useState(false)
+  const [drainOptions, setDrainOptions] = useState<DrainDialogOptions>(DEFAULT_DRAIN_DIALOG_OPTIONS)
+
+  // A backend without the plan endpoint stays unsupported for as long as the dialog is
+  // open: the host reports it through a mutation error, which the next request clears,
+  // so without latching every option change would refire a request known to 404 and
+  // bounce the dialog out of its fallback mode.
+  const [planUnsupported, setPlanUnsupported] = useState(false)
+  useEffect(() => {
+    if (drainPlanUnsupported) setPlanUnsupported(true)
+  }, [drainPlanUnsupported])
+  useEffect(() => {
+    if (!showDrainConfirm) setPlanUnsupported(false)
+  }, [showDrainConfirm])
+  const planSupported = Boolean(onPlanDrain) && !planUnsupported
+
+  // Fetch (and refetch on option changes) the read-only plan while the drain dialog is open.
+  useEffect(() => {
+    if (showDrainConfirm && onPlanDrain && !planUnsupported) {
+      onPlanDrain({ name: resource.name, options: drainOptions })
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [showDrainConfirm, drainOptions.force, drainOptions.deleteEmptyDirData, resource.name, planUnsupported])
 
   // Rollback dialog state
   const [showRevisions, setShowRevisions] = useState(false)
@@ -675,40 +709,33 @@ export function ResourceActionsBar({
         isLoading={isCordoningNode}
       />
 
-      {/* Node drain confirmation */}
-      <ConfirmDialog
+      {/* Node drain: read-only plan first, then the destructive action with explicit options */}
+      <DrainPlanDialog
         open={showDrainConfirm}
+        nodeName={resource.name}
+        plan={drainPlan}
+        loading={Boolean(isPlanningDrain)}
+        error={planSupported ? drainPlanError : null}
+        options={drainOptions}
+        onOptionsChange={setDrainOptions}
+        planSupported={planSupported}
+        onRefreshPlan={planSupported ? () => onPlanDrain?.({ name: resource.name, options: drainOptions }) : undefined}
+        isDraining={Boolean(isDrainingNode)}
         onClose={() => {
           setShowDrainConfirm(false)
-          setDrainForce(false)
+          setDrainOptions(DEFAULT_DRAIN_DIALOG_OPTIONS)
+          onPlanDrainReset?.()
         }}
-        onConfirm={() => {
+        onConfirm={(opts) => {
           onDrainNode?.({
             name: resource.name,
-            options: { deleteEmptyDirData: true, force: drainForce || undefined },
+            options: { deleteEmptyDirData: opts.deleteEmptyDirData, force: opts.force },
           })
           setShowDrainConfirm(false)
-          setDrainForce(false)
+          setDrainOptions(DEFAULT_DRAIN_DIALOG_OPTIONS)
+          onPlanDrainReset?.()
         }}
-        title="Drain Node"
-        message={`Cordon and evict all pods from node "${resource.name}"? DaemonSet pods will be skipped.`}
-        confirmLabel={isDrainingNode ? 'Draining...' : 'Drain'}
-        variant="danger"
-        isLoading={isDrainingNode}
-        isClosable
-      >
-        <div className="flex flex-col gap-2 text-sm text-theme-text-secondary">
-          <label className="flex items-center gap-2 cursor-pointer">
-            <input
-              type="checkbox"
-              checked={drainForce}
-              onChange={(e) => setDrainForce(e.target.checked)}
-              className="rounded border-theme-border"
-            />
-            Force (evict pods not managed by a controller)
-          </label>
-        </div>
-      </ConfirmDialog>
+      />
 
       {showRevisions && isRollbackKind && (
         <RevisionHistoryDialog

package/src/components/shared/ResourceRendererDispatch.test.tsx

@@ -180,6 +180,27 @@ function renderCollidingKind(kind: string, apiVersion: string): string {
   )
 }
 
+describe('LimitRange dispatch', () => {
+  const limitRange = {
+    apiVersion: 'v1',
+    kind: 'LimitRange',
+    metadata: { name: 'team-limits', namespace: 'dev' },
+    spec: { limits: [{ type: 'Container', defaultRequest: { cpu: '100m' }, default: { cpu: '500m' } }] },
+  }
+
+  it('renders the declared rules instead of the generic fallback', () => {
+    const html = renderKind('limitranges', limitRange, 'dev')
+    expect(html).toContain('Defaults & Constraints')
+    expect(html).toContain('100m')
+  })
+
+  // A LimitRange has no status. Reporting one would be an invention, and the
+  // drawer header would disagree with the object.
+  it('reports no health for a kind that has none', () => {
+    expect(getResourceStatus('limitranges', limitRange)).toBeNull()
+  })
+})
+
 describe('getResourceStatus — workload rollout activity', () => {
   const steadyDegraded = {
     metadata: { generation: 4 },
@@ -277,6 +298,30 @@ describe('getResourceStatus — colliding plurals', () => {
     })).not.toBeNull()
   })
 
+  it('reads an Argo Rollouts Experiment with the AnalysisPhase vocabulary', () => {
+    expect(getResourceStatus('experiments', {
+      apiVersion: 'argoproj.io/v1alpha1',
+      status: { phase: 'Successful' },
+    })).toMatchObject({ text: 'Successful', level: 'healthy' })
+
+    expect(getResourceStatus('experiments', {
+      apiVersion: 'argoproj.io/v1alpha1',
+      status: { phase: 'Running' },
+    })).toMatchObject({ level: 'degraded' })
+  })
+
+  // Katib ships its own Experiment at kubeflow.org sharing this plural, and it
+  // does not report AnalysisPhase. Falling through to the generic reader is
+  // fine; being scored with Argo's vocabulary is not, because that attaches a
+  // HealthLevel derived from a phase Katib never reports.
+  it('does not score a Katib Experiment with the Argo vocabulary', () => {
+    const katib = getResourceStatus('experiments', {
+      apiVersion: 'kubeflow.org/v1beta1',
+      status: { conditions: [{ type: 'Running', status: 'True' }] },
+    })
+    expect(katib?.level).toBeUndefined()
+  })
+
   it('fabricates no engine status for a third-party backups CRD', () => {
     expect(getResourceStatus('backups', { apiVersion: 'kubevirt.io/v1', status: {} })).toBeNull()
     expect(getResourceStatus('backups', { apiVersion: 'kubevirt.io/v1', status: { phase: 'Running' } }))

package/src/components/shared/ResourceRendererDispatch.tsx

@@ -1,3 +1,4 @@
+import { hasReflectorDetails } from '../resources/renderers/ReflectorSection'
 import { clsx } from 'clsx'
 import { SEVERITY_BADGE, HEALTH_BADGE_COLORS } from '../../utils/badge-colors'
 import { isArgoRolloutResource } from '../../utils/workload-rollout'
@@ -120,6 +121,8 @@ import {
   PVCRenderer,
   RolloutRenderer,
   AnalysisRunRenderer,
+  AnalysisTemplateRenderer,
+  ExperimentRenderer,
   CertificateRenderer,
   WorkflowRenderer,
   PersistentVolumeRenderer,
@@ -231,6 +234,7 @@ import {
   PriorityClassRenderer,
   RuntimeClassRenderer,
   LeaseRenderer,
+  LimitRangeRenderer,
   TraefikIngressRouteRenderer,
   TraefikMiddlewareRenderer,
   TraefikServiceRenderer,
@@ -426,7 +430,7 @@ const KNOWN_KINDS = new Set([
   'pods', 'deployments', 'statefulsets', 'daemonsets', 'replicasets',
   'services', 'endpointslices', 'ingresses', 'configmaps', 'secrets', 'jobs', 'cronjobs', 'cronworkflows',
   'hpas', 'horizontalpodautoscalers', 'nodes', 'persistentvolumeclaims',
-  'rollouts', 'analysisruns', 'certificates', 'workflows', 'persistentvolumes',
+  'rollouts', 'analysisruns', 'analysistemplates', 'clusteranalysistemplates', 'experiments', 'certificates', 'workflows', 'persistentvolumes',
   'storageclasses', 'certificaterequests', 'clusterissuers', 'issuers',
   'orders', 'challenges',
   'gateways', 'gatewayclasses', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes', 'sealedsecrets', 'workflowtemplates', 'clusterworkflowtemplates',
@@ -473,7 +477,7 @@ const KNOWN_KINDS = new Set([
   'virtualservices', 'destinationrules', 'serviceentries',
   'peerauthentications', 'authorizationpolicies',
   'mutatingwebhookconfigurations', 'validatingwebhookconfigurations',
-  'ingressclasses', 'priorityclasses', 'runtimeclasses', 'leases',
+  'ingressclasses', 'priorityclasses', 'runtimeclasses', 'leases', 'limitranges',
   'knativeservices', 'knativeconfigurations', 'knativerevisions', 'knativeroutes',
   'brokers', 'triggers', 'eventtypes', 'pingsources', 'apiserversources', 'containersources', 'sinkbindings',
   'channels', 'inmemorychannels', 'subscriptions', 'sequences', 'parallels',
@@ -678,7 +682,8 @@ export function ResourceRendererDispatch({
     kind === 'clusters' || kind === 'backups' || kind === 'scheduledbackups' || kind === 'poolers'
     || kind === 'objectstores' || kind === 'databases' || kind === 'publications'
     || kind === 'subscriptions' || kind === 'imagecatalogs' || kind === 'clusterimagecatalogs'
-    || kind === 'policies' || kind === 'rollouts' || kind === 'machines' || kind === 'machinesets'
+    || kind === 'policies' || kind === 'rollouts' || kind === 'experiments'
+    || kind === 'machines' || kind === 'machinesets'
   const isCNPGApiVersion = isApiGroup(data?.apiVersion, CNPG_GROUP)
   const groupGatedMatched =
     (kind === 'clusters' && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'cluster.x-k8s.io')))
@@ -691,6 +696,11 @@ export function ResourceRendererDispatch({
       && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'messaging.knative.dev')))
     || (kind === 'policies' && isApiGroup(data?.apiVersion, 'kyverno.io'))
     || (kind === 'rollouts' && isArgoRolloutResource(data))
+    // Katib (kubeflow.org) ships its own, unrelated Experiment CRD sharing
+    // this plural — without this gate it got the Argo Rollouts Experiment
+    // renderer's mostly-empty status view instead of its actual resource
+    // details, the same collision shape as every other check in this block.
+    || (kind === 'experiments' && isApiGroup(data?.apiVersion, 'argoproj.io'))
     || ((kind === 'machines' || kind === 'machinesets')
       && isApiGroup(data?.apiVersion, 'cluster.x-k8s.io'))
   const groupGatedFallthrough = isGroupGatedKind && !groupGatedMatched
@@ -741,11 +751,15 @@ export function ResourceRendererDispatch({
   const HPAComp = rendererOverrides?.HPARenderer ?? HPARenderer
   const PVCComp = rendererOverrides?.PVCRenderer ?? PVCRenderer
   const RolloutComp = rendererOverrides?.RolloutRenderer ?? RolloutRenderer
+  const showsReflection = (kind === 'configmaps' || kind === 'secrets') && hasReflectorDetails(data, relationships?.reflection)
+  const reflectionRefs = showsReflection ? [relationships?.reflection?.source, ...(relationships?.reflection?.mirrors ?? [])].filter((ref): ref is ResourceRef => !!ref) : []
+  const withoutReflection = (refs: ResourceRef[] | undefined) => refs?.filter(ref => !reflectionRefs.some(mirror => mirror.kind === ref.kind && mirror.namespace === ref.namespace && mirror.name === ref.name && (mirror.group ?? '') === (ref.group ?? '')))
+  const sidebarRelationships = showsReflection && relationships ? { ...relationships, configRefs: withoutReflection(relationships.configRefs), consumers: withoutReflection(relationships.consumers) } : relationships
   const scaleBlockedBy = replicaScalers(relationships?.scalers)
 
   const sidebarContent = showCommonSections && (
     <>
-      <RelatedResourcesSection relationships={relationships} onNavigate={onNavigate} />
+      <RelatedResourcesSection relationships={sidebarRelationships} onNavigate={onNavigate} />
       {kind !== 'events' && <EventsSection events={events || []} updates={updates || []} isLoading={eventsLoading ?? false} eventsError={eventsError ?? null} updatesError={updatesError ?? null} hint={eventsHint} />}
       <LabelsSection data={data} />
       <AnnotationsSection data={data} />
@@ -773,8 +787,8 @@ export function ResourceRendererDispatch({
         {kind === 'services' && !data?.apiVersion?.includes('serving.knative.dev') && <ServiceComp data={data} onCopy={onCopy} copied={copied} onNavigate={onNavigate} />}
         {kind === 'endpointslices' && <EndpointSliceRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'ingresses' && !data?.apiVersion?.includes('networking.internal.knative.dev') && <IngressRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'configmaps' && <ConfigMapRenderer data={data} />}
-        {kind === 'secrets' && <SecretRenderer data={data} certificateInfo={certificateInfo} resourceData={data} onSaveSecretValue={onSaveSecretValue} isSaving={isSavingSecret} />}
+        {kind === 'configmaps' && <ConfigMapRenderer data={data} relationships={relationships} onNavigate={onNavigate} />}
+        {kind === 'secrets' && <SecretRenderer data={data} relationships={relationships} onNavigate={onNavigate} certificateInfo={certificateInfo} resourceData={data} onSaveSecretValue={onSaveSecretValue} isSaving={isSavingSecret} />}
         {kind === 'jobs' && !nonCoreJobFallthrough && <JobRenderer data={data} />}
         {kind === 'cronjobs' && <CronJobRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'cronworkflows' && <CronWorkflowRenderer data={data} onNavigate={onNavigate} />}
@@ -783,6 +797,8 @@ export function ResourceRendererDispatch({
         {kind === 'persistentvolumeclaims' && <PVCComp data={data} onNavigate={onNavigate} />}
         {kind === 'rollouts' && isArgoRolloutResource(data) && <RolloutComp data={data} onNavigate={onNavigate} />}
         {kind === 'analysisruns' && <AnalysisRunRenderer data={data} onNavigate={onNavigate} />}
+        {(kind === 'analysistemplates' || kind === 'clusteranalysistemplates') && <AnalysisTemplateRenderer data={data} />}
+        {kind === 'experiments' && isApiGroup(data?.apiVersion, 'argoproj.io') && <ExperimentRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'certificates' && !data?.apiVersion?.includes('networking.internal.knative.dev') && <CertificateRenderer data={data} />}
         {kind === 'workflows' && <WorkflowRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'persistentvolumes' && <PersistentVolumeRenderer data={data} onNavigate={onNavigate} />}
@@ -920,6 +936,7 @@ export function ResourceRendererDispatch({
         {kind === 'priorityclasses' && <PriorityClassRenderer data={data} />}
         {kind === 'runtimeclasses' && <RuntimeClassRenderer data={data} />}
         {kind === 'leases' && <LeaseRenderer data={data} />}
+        {kind === 'limitranges' && <LimitRangeRenderer data={data} />}
         {/* Knative Serving */}
         {(kind === 'services' && data?.apiVersion?.includes('serving.knative.dev')) && <KnativeServiceRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'knativeservices' && <KnativeServiceRenderer data={data} onNavigate={onNavigate} />}
@@ -1103,6 +1120,10 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
   if (k === 'nodes') return getNodeStatus(data)
   if (k === 'persistentvolumeclaims') return getPVCStatus(data)
   if (k === 'analysisruns') return getAnalysisRunStatus(data)
+  // Same collision guard as the render branch above — Katib's unrelated
+  // Experiment CRD (kubeflow.org) shares this plural and doesn't report the
+  // AnalysisPhase vocabulary getAnalysisRunStatus expects.
+  if (k === 'experiments' && isApiGroup(data?.apiVersion, 'argoproj.io')) return getAnalysisRunStatus(data)
   if (k === 'workflows') return getWorkflowStatus(data)
   if (k === 'cronworkflows') return getCronWorkflowStatus(data)
   if (k === 'certificates') {

package/src/components/shared/index.ts

@@ -1,6 +1,10 @@
 export { ResourceRendererDispatch, getResourceStatus, type RendererOverrides } from './ResourceRendererDispatch'
 export { EditableYamlView, SaveSuccessAnimation } from './EditableYamlView'
 export { ResourceActionsBar, RevisionHistoryDialog, isRolloutKind } from './ResourceActionsBar'
+export {
+  DrainPlanDialog, DrainPlanContent, canConfirmDrain, planMatches, emptyDirPodsAtRisk, DEFAULT_DRAIN_DIALOG_OPTIONS,
+  type DrainPlan, type DrainPlanPod, type DrainOutcome, type DrainDialogOptions,
+} from './DrainPlanDialog'
 export { SetImageDialog, type ManagedImageSource, type SetImageDialogProps } from './SetImageDialog'
 export { CreateResourceDialog, type CreateResourceDialogProps, type ApplyResult } from './CreateResourceDialog'
 export { HelmManagedByChip, ManagedByChip, type HelmOwnerRef } from './ManagedByChip'