@skyhook-io/k8s-ui 1.16.3 → 1.17.1

package/src/components/shared/EditableYamlView.tsx

@@ -552,7 +552,7 @@ export function EditableYamlView({
           {!readOnly && (
             <button
               onClick={handleStartEdit}
-              className="flex items-center gap-1 px-2 py-1 text-xs text-blue-400 hover:text-blue-300 hover:bg-theme-elevated rounded"
+              className="flex items-center gap-1 px-2 py-1 text-xs text-accent-text hover:text-accent-light hover:bg-theme-elevated rounded"
             >
               <Pencil className="w-3.5 h-3.5" />
               Edit

package/src/components/shared/GitOpsWriteWarning.test.tsx

@@ -0,0 +1,86 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it } from 'vitest'
+
+import { evaluateGitOpsWriteGuard, type GitOpsWriteGuardInput } from '../../utils/gitops-write-guard'
+import { GitOpsWriteWarning } from './GitOpsWriteWarning'
+
+const base: GitOpsWriteGuardInput = {
+  target: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' },
+  owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+  writes: [{ scope: 'spec', paths: ['spec.replicas'] }],
+  evidence: {
+    uid: 'u',
+    resourceVersion: '1',
+    owner: null,
+    policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null },
+    paths: [{ path: 'spec.replicas', lastApplied: 'present', ownedBy: [], ownedByGitOps: false }],
+  },
+}
+
+function render(input: GitOpsWriteGuardInput, onOpenOwner?: () => void) {
+  return renderToStaticMarkup(
+    <GitOpsWriteWarning
+      guard={evaluateGitOpsWriteGuard(input)}
+      acknowledged={false}
+      onAcknowledgedChange={() => {}}
+      onOpenOwner={onOpenOwner}
+    />,
+  )
+}
+
+describe('GitOpsWriteWarning', () => {
+  it('renders the revert warning, owner link and required acknowledgment', () => {
+    const html = render(base, () => {})
+    expect(html).toContain('Argo CD Application argocd/api will revert this change.')
+    expect(html).toContain('overwritten at the next sync')
+    expect(html).toContain('change it in the GitOps source')
+    expect(html).toContain('View Argo CD Application')
+    expect(html).toContain('type="checkbox"')
+    expect(html).toContain('I understand Argo CD will revert this.')
+  })
+
+  it('asks the acknowledgment in the verdict’s own terms', () => {
+    const html = render({
+      ...base,
+      evidence: { ...base.evidence!, policy: { tool: 'argocd', auto: false, selfHeal: false, prune: false, suspended: null } },
+    })
+    expect(html).toContain('Argo CD Application argocd/api may revert this change.')
+    expect(html).toContain('I understand Argo CD may revert this.')
+  })
+
+  it('shows a checking state while ownership resolves', () => {
+    const html = render({ ...base, ownerPending: true })
+    expect(html).toContain('Checking GitOps ownership…')
+    expect(html).not.toContain('type="checkbox"')
+  })
+
+  it('renders a quiet note without acknowledgment at info level', () => {
+    const html = render({ ...base, writes: [{ scope: 'create-child' }] })
+    expect(html).toContain('Managed by Argo CD Application argocd/api.')
+    expect(html).not.toContain('type="checkbox"')
+  })
+
+  it('leaves vertical spacing to the parent', () => {
+    for (const input of [base, { ...base, ownerPending: true }, { ...base, writes: [{ scope: 'create-child' as const }] }]) {
+      const root = render(input).match(/^<div class="([^"]*)"/)?.[1] ?? ''
+      expect(root).not.toMatch(/(^|\s)m[bt]-/)
+    }
+  })
+
+  it('renders nothing when unmanaged', () => {
+    expect(render({ ...base, owner: null })).toBe('')
+  })
+
+  it('lists per-write reasons when they differ', () => {
+    const html = render({
+      ...base,
+      writes: [
+        { scope: 'spec', paths: ['spec.replicas'], description: 'Replicas' },
+        { scope: 'delete', description: 'Delete' },
+      ],
+      evidence: { ...base.evidence!, policy: { tool: 'argocd', auto: false, selfHeal: false, prune: false, suspended: null } },
+    })
+    expect(html).toContain('Replicas:')
+    expect(html).toContain('Delete:')
+  })
+})

package/src/components/shared/GitOpsWriteWarning.tsx

@@ -0,0 +1,135 @@
+import { ExternalLink, GitBranch, Info, Loader2 } from 'lucide-react'
+import { clsx } from 'clsx'
+
+import { AlertBanner } from '../ui/drawer-components'
+import {
+  canConfirmGitOpsWrite,
+  gitOpsWriteHeadline,
+  guardToolLabel,
+  type GitOpsWriteAssessment,
+  type GitOpsWriteGuard,
+} from '../../utils/gitops-write-guard'
+
+export { canConfirmGitOpsWrite }
+
+export interface GitOpsWriteWarningProps {
+  guard: GitOpsWriteGuard
+  acknowledged: boolean
+  onAcknowledgedChange: (acknowledged: boolean) => void
+  /** Opens the GitOps owner (or Helm release) the guard names. */
+  onOpenOwner?: () => void
+  disabled?: boolean
+  className?: string
+}
+
+const OWNER_LINK_LABEL = {
+  applications: 'View Argo CD Application',
+  kustomizations: 'View Flux Kustomization',
+  helmreleases: 'View Flux HelmRelease',
+} as const
+
+function reasonLines(perWrite: GitOpsWriteAssessment[], levels: GitOpsWriteGuard['level'][]): string[] {
+  const relevant = perWrite.filter((entry) => levels.includes(entry.level) && entry.reason)
+  const distinct = new Set(relevant.map((entry) => entry.reason))
+  if (distinct.size <= 1) return [...distinct]
+  return relevant.map((entry) =>
+    entry.write.description ? `${entry.write.description}: ${entry.reason}` : entry.reason,
+  )
+}
+
+export function GitOpsWriteWarning({
+  guard,
+  acknowledged,
+  onAcknowledgedChange,
+  onOpenOwner,
+  disabled = false,
+  // Not undefined: AlertBanner would add its own mb-4, and a margin utility
+  // overrides the parent's space-y gap.
+  className = '',
+}: GitOpsWriteWarningProps) {
+  if (guard.pending) {
+    return (
+      <div
+        className={clsx(
+          'flex items-center gap-2 rounded-lg border border-theme-border bg-theme-base px-3 py-2 text-xs text-theme-text-secondary',
+          className,
+        )}
+      >
+        <Loader2 className="h-3.5 w-3.5 animate-spin" />
+        Checking GitOps ownership…
+      </div>
+    )
+  }
+  if (guard.level === 'none') return null
+
+  const headline = gitOpsWriteHeadline(guard)
+  const ownerLink = onOpenOwner ? (
+    <button
+      type="button"
+      onClick={onOpenOwner}
+      className="inline-flex items-center gap-1 text-xs font-medium text-skyhook-600 hover:underline dark:text-skyhook-400"
+    >
+      {guard.owner ? OWNER_LINK_LABEL[guard.owner.kind] : 'View Helm release'}
+      <ExternalLink className="h-3 w-3" />
+    </button>
+  ) : null
+
+  if (guard.level === 'info') {
+    const lines = reasonLines(guard.perWrite, ['info'])
+    return (
+      <div
+        className={clsx(
+          'flex items-start gap-2 rounded-lg border border-theme-border bg-theme-base px-3 py-2 text-xs text-theme-text-secondary',
+          className,
+        )}
+      >
+        <Info className="mt-0.5 h-3.5 w-3.5 shrink-0 text-theme-text-tertiary" />
+        <div className="min-w-0 space-y-1">
+          <p>
+            <span className="font-medium text-theme-text-primary">{headline}</span> {lines.join(' ')}
+          </p>
+          {ownerLink}
+        </div>
+      </div>
+    )
+  }
+
+  const tool = guardToolLabel(guard)
+  const lines = reasonLines(guard.perWrite, ['will-revert', 'may-revert'])
+  const durableFix = guard.owner
+    ? 'For a lasting change, change it in the GitOps source.'
+    : guard.helmRelease
+      ? 'For a lasting change, change the release’s chart values.'
+      : null
+  return (
+    <AlertBanner
+      variant="warning"
+      icon={GitBranch}
+      title={headline}
+      className={className}
+      message={
+        lines.length === 1 ? (
+          <>
+            {lines[0]}
+            {durableFix ? ` ${durableFix}` : ''}
+          </>
+        ) : durableFix ?? undefined
+      }
+      items={lines.length > 1 ? lines : undefined}
+    >
+      {ownerLink && <div className="mt-2">{ownerLink}</div>}
+      <label className="mt-2 flex cursor-pointer items-start gap-2 text-xs text-theme-text-primary">
+        <input
+          type="checkbox"
+          checked={acknowledged}
+          onChange={(event) => onAcknowledgedChange(event.target.checked)}
+          disabled={disabled}
+          className="mt-0.5 h-3.5 w-3.5 accent-skyhook-500"
+        />
+        <span>
+          I understand {tool} {guard.level === 'will-revert' ? 'will' : 'may'} revert this.
+        </span>
+      </label>
+    </AlertBanner>
+  )
+}

package/src/components/shared/ResourceActionsBar.tsx

@@ -1,3 +1,4 @@
+import { getNodeLifecycle } from '../../utils/node-lifecycle'
 import { useEffect, useState, useRef, useId } from 'react'
 import {
   RefreshCw,
@@ -28,11 +29,12 @@ import type { SelectedResource, WorkloadRevision } from '../../types'
 import type { RadarUpgradeRequirement } from '../../types/fetch-error'
 import { displayKindName } from '../ui/drawer-components'
 import { getDefaultContainerName } from '../resources/resource-utils'
-import { SetImageDialog, type ManagedImageSource } from './SetImageDialog'
+import { SetImageDialog, type SetImageOwnership } from './SetImageDialog'
 import { DrainPlanDialog, DEFAULT_DRAIN_DIALOG_OPTIONS, type DrainDialogOptions, type DrainPlan } from './DrainPlanDialog'
 import type { WorkloadImageInventory, WorkloadImageUpdate } from '../../types/core'
 import { isArgoRolloutResource } from '../../utils/workload-rollout'
 import { isCoreBatchJob } from '../../utils/api-resources'
+import { formatRelativeAgeTime } from '../../utils/format'
 
 // ============================================================================
 // ACTIONS BAR - Interactive buttons that change based on resource kind
@@ -40,6 +42,7 @@ import { isCoreBatchJob } from '../../utils/api-resources'
 
 interface ResourceActionsBarProps {
   resource: SelectedResource
+  leadingActions?: React.ReactNode
   data: any
   onClose?: () => void
   hideLogs?: boolean
@@ -78,6 +81,7 @@ interface ResourceActionsBarProps {
   cascadeDependents?: CascadeDependent[]
   cascadeLoading?: boolean
   cascadeRootResolved?: boolean
+  cascadePreviewFailed?: boolean
 
   // Workload restart
   onRestart?: (params: { kind: string; namespace: string; name: string }, callbacks?: { onSuccess?: () => void; onError?: (err: unknown) => void }) => void
@@ -86,7 +90,7 @@ interface ResourceActionsBarProps {
   onLoadImages?: (params: { kind: string; namespace: string; name: string }) => Promise<WorkloadImageInventory>
   onSetImages?: (params: { kind: string; namespace: string; name: string; updates: WorkloadImageUpdate[] }) => Promise<unknown>
   isSettingImages?: boolean
-  managedImageSources?: ManagedImageSource[]
+  imageOwnership?: SetImageOwnership
 
   // Rollback
   revisions?: WorkloadRevision[]
@@ -153,15 +157,15 @@ interface ResourceActionsBarProps {
 }
 
 export function ResourceActionsBar({
-  resource, data, onClose, hideLogs, showYaml, onToggleYaml,
+  resource, data, leadingActions, onClose, hideLogs, showYaml, onToggleYaml,
   onCompareTo,
   onCompareAcrossClusters,
   canExec, canViewLogs, canPortForward,
   onOpenTerminal, onOpenLogs: openLogs, onOpenWorkloadLogs: openWorkloadLogs, onCopyCommand,
   renderPortForward,
-  onDelete, isDeleting, cascadeDependents, cascadeLoading, cascadeRootResolved,
+  onDelete, isDeleting, cascadeDependents, cascadeLoading, cascadeRootResolved, cascadePreviewFailed,
   onRestart, isRestarting,
-  onLoadImages, onSetImages, isSettingImages, managedImageSources,
+  onLoadImages, onSetImages, isSettingImages, imageOwnership,
   revisions: revisionsList, revisionsLoading, revisionsError, onRollback, isRollingBack,
   onRolloutPromoteFull,
   onTriggerCronJob, isTriggeringCronJob,
@@ -289,6 +293,8 @@ export function ResourceActionsBar({
 
   return (
     <div className="flex items-center gap-1.5 px-4 py-2 flex-wrap">
+      <div className="flex min-w-0 flex-wrap items-center gap-1.5 empty:hidden" data-action-group="object">
+      {leadingActions}
       {/* Kind-specific actions (left) */}
       {kind === 'pods' && (
         <>
@@ -358,7 +364,7 @@ export function ResourceActionsBar({
             </button>
           )}
 
-          {canNodeWrite && (
+          {canNodeWrite && !getNodeLifecycle(data).removing && (
             <>
               {data?.spec?.unschedulable ? (
                 onUncordonNode && (
@@ -584,8 +590,8 @@ export function ResourceActionsBar({
         </button>
       )}
 
-      {/* Spacer pushes universal actions to the right */}
-      <div className="flex-1" />
+      </div>
+      <div className="ml-auto flex flex-wrap items-center gap-1.5" data-action-group="utility">
 
       {/* Universal actions (right-aligned). The AI/Diagnose action is NOT here — it
           lives in the detail header chrome (see WorkloadView), set apart from these
@@ -660,7 +666,7 @@ export function ResourceActionsBar({
         </div>
       )}
 
-      {onDelete && (
+      {onDelete && !((kind === 'node' || kind === 'nodes') && data?.metadata?.deletionTimestamp) && (
         <Tooltip content="Delete resource">
           <button
             onClick={() => setShowDeleteConfirm(true)}
@@ -671,6 +677,8 @@ export function ResourceActionsBar({
         </Tooltip>
       )}
 
+      </div>
+
       <ForceDeleteConfirmDialog
         open={showDeleteConfirm}
         onClose={() => setShowDeleteConfirm(false)}
@@ -682,6 +690,7 @@ export function ResourceActionsBar({
         cascadeDependents={cascadeDependents}
         cascadeLoading={cascadeLoading}
         cascadeRootResolved={cascadeRootResolved}
+        cascadePreviewFailed={cascadePreviewFailed}
       />
 
       {onLoadImages && onSetImages && (
@@ -690,7 +699,7 @@ export function ResourceActionsBar({
           workloadLabel={`${displayKindName(resource.kind, data?.kind)} ${resource.namespace}/${resource.name}`}
           workloadName={resource.name}
           workloadResource={resource.kind}
-          managedSources={managedImageSources}
+          ownership={imageOwnership}
           pending={isSettingImages}
           onClose={() => setShowSetImage(false)}
           onLoad={() => onLoadImages({ kind: resource.kind, namespace: resource.namespace, name: resource.name })}
@@ -1127,19 +1136,6 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
     setPromoteError(outcome.error ?? { message: 'The promotion did not go through.', controllerLagging: false })
   }
 
-  function formatTimeAgo(dateStr: string): string {
-    const date = new Date(dateStr)
-    const now = new Date()
-    const seconds = Math.floor((now.getTime() - date.getTime()) / 1000)
-    if (seconds < 60) return `${seconds}s ago`
-    const minutes = Math.floor(seconds / 60)
-    if (minutes < 60) return `${minutes}m ago`
-    const hours = Math.floor(minutes / 60)
-    if (hours < 24) return `${hours}h ago`
-    const days = Math.floor(hours / 24)
-    return `${days}d ago`
-  }
-
   function getImageTag(image: string): string {
     if (!image) return '-'
     const parts = image.split(':')
@@ -1231,7 +1227,7 @@ export function RevisionHistoryDialog({ kind, namespace, name, open, onClose, re
                       <RevisionImage image={rev.image} displayImage={getImageTag(rev.image)} />
                     </td>
                     <td className="py-2 pr-3 text-theme-text-secondary whitespace-nowrap">
-                      {formatTimeAgo(rev.createdAt)}
+                      {formatRelativeAgeTime(rev.createdAt)}
                     </td>
                     <td className="py-2 text-right">
                       <div className="flex items-center gap-1 justify-end">

package/src/components/shared/ResourceRendererDispatch.tsx

@@ -193,6 +193,7 @@ import {
   CNPGDatabaseRenderer,
   CNPGPublicationRenderer,
   CNPGSubscriptionRenderer,
+  CNPGDatabaseRoleRenderer,
   CNPGImageCatalogRenderer,
   KyvernoGlobalContextRenderer,
   KyvernoUpdateRequestRenderer,
@@ -454,7 +455,7 @@ const KNOWN_KINDS = new Set([
   'rollouts', 'analysisruns', 'analysistemplates', 'clusteranalysistemplates', 'experiments', 'certificates', 'workflows', 'persistentvolumes',
   'storageclasses', 'certificaterequests', 'clusterissuers', 'issuers',
   'orders', 'challenges',
-  'gateways', 'gatewayclasses', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes', 'sealedsecrets', 'workflowtemplates', 'clusterworkflowtemplates',
+  'gateways', 'gatewayclasses', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes', 'udproutes', 'sealedsecrets', 'workflowtemplates', 'clusterworkflowtemplates',
   'networkpolicies', 'networkpolicy',
   'globalnetworkpolicies', 'globalnetworkpolicy',
   'stagednetworkpolicies', 'stagednetworkpolicy',
@@ -494,7 +495,7 @@ const KNOWN_KINDS = new Set([
   'externalsecrets', 'clusterexternalsecrets', 'secretstores', 'clustersecretstores',
   'clusters', 'scheduledbackups', 'poolers', 'objectstores',
   'globalcontextentries', 'updaterequests', 'ephemeralreports', 'clusterephemeralreports',
-  'databases', 'publications', 'imagecatalogs', 'clusterimagecatalogs',
+  'databases', 'publications', 'imagecatalogs', 'clusterimagecatalogs', 'databaseroles',
   'virtualservices', 'destinationrules', 'serviceentries',
   'peerauthentications', 'authorizationpolicies',
   'mutatingwebhookconfigurations', 'validatingwebhookconfigurations',
@@ -702,7 +703,7 @@ export function ResourceRendererDispatch({
   const isGroupGatedKind =
     kind === 'clusters' || kind === 'backups' || kind === 'scheduledbackups' || kind === 'poolers'
     || kind === 'objectstores' || kind === 'databases' || kind === 'publications'
-    || kind === 'subscriptions' || kind === 'imagecatalogs' || kind === 'clusterimagecatalogs' || kind === 'jobsets'
+    || kind === 'subscriptions' || kind === 'imagecatalogs' || kind === 'clusterimagecatalogs' || kind === 'databaseroles' || kind === 'jobsets'
     || kind === 'policies' || kind === 'rollouts' || kind === 'experiments'
     || kind === 'rayjobs' || kind === 'rayclusters' || kind === 'rayservices' || kind === 'admissionchecks' || kind === 'provisioningrequests'
     || kind === 'machines' || kind === 'machinesets' || kind === 'workloads' || kind === 'localqueues' || kind === 'clusterqueues'
@@ -713,7 +714,7 @@ export function ResourceRendererDispatch({
     || ((kind === 'scheduledbackups' || kind === 'poolers') && isCNPGApiVersion)
     || (kind === 'objectstores' && isApiGroup(data?.apiVersion, 'barmancloud.cnpg.io'))
     || ((kind === 'databases' || kind === 'publications' || kind === 'imagecatalogs'
-      || kind === 'clusterimagecatalogs') && isCNPGApiVersion)
+      || kind === 'clusterimagecatalogs' || kind === 'databaseroles') && isCNPGApiVersion)
     || (kind === 'subscriptions'
       && (isCNPGApiVersion || isApiGroup(data?.apiVersion, 'messaging.knative.dev')))
     || (kind === 'policies' && isApiGroup(data?.apiVersion, 'kyverno.io'))
@@ -800,7 +801,7 @@ export function ResourceRendererDispatch({
       {kind !== 'events' && <EventsSection fullscreen={!!renderSidebar} events={events || []} updates={updates || []} isLoading={eventsLoading ?? false} eventsError={eventsError ?? null} updatesError={updatesError ?? null} hint={eventsHint} />}
       <LabelsSection data={data} />
       <AnnotationsSection data={data} />
-      <MetadataSection data={data} />
+      <MetadataSection data={data} onNavigate={onNavigate} />
     </>
   )
 
@@ -860,6 +861,7 @@ export function ResourceRendererDispatch({
         {kind === 'grpcroutes' && <GRPCRouteRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'tcproutes' && <SimpleRouteRenderer data={data} kind="TCPRoute" onNavigate={onNavigate} />}
         {kind === 'tlsroutes' && <SimpleRouteRenderer data={data} kind="TLSRoute" onNavigate={onNavigate} />}
+        {kind === 'udproutes' && <SimpleRouteRenderer data={data} kind="UDPRoute" onNavigate={onNavigate} />}
         {kind === 'sealedsecrets' && <SealedSecretRenderer data={data} onNavigate={onNavigate} />}
         {(kind === 'workflowtemplates' || kind === 'clusterworkflowtemplates') && <WorkflowTemplateRenderer data={data} />}
         {isCoreNetworkPolicy && <NetworkPolicyRenderer data={data} />}
@@ -926,6 +928,7 @@ export function ResourceRendererDispatch({
         {kind === 'databases' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGDatabaseComp data={data} onNavigate={onNavigate} />}
         {kind === 'publications' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGPublicationComp data={data} onNavigate={onNavigate} />}
         {kind === 'subscriptions' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGSubscriptionComp data={data} onNavigate={onNavigate} />}
+        {kind === 'databaseroles' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGDatabaseRoleRenderer data={data} onNavigate={onNavigate} />}
         {(kind === 'imagecatalogs' || kind === 'clusterimagecatalogs') && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGImageCatalogComp data={data} onNavigate={onNavigate} />}
         {kind === 'backups' && isApiGroup(data.apiVersion, CNPG_GROUP) && <CNPGBackupRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'backups' && isApiGroup(data.apiVersion, 'velero.io') && <VeleroBackupComp data={data} onNavigate={onNavigate} />}
@@ -971,14 +974,14 @@ export function ResourceRendererDispatch({
         {kind === 'azuremanagedcontrolplanes' && <AzureManagedControlPlaneRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'azuremanagedmachinepools' && <AzureManagedMachinePoolRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'azuremachines' && <AzureMachineRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'virtualservices' && <IstioVirtualServiceRenderer data={data} onNavigate={onNavigate} />}
-        {kind === 'destinationrules' && <IstioDestinationRuleRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'virtualservices' && <IstioVirtualServiceRenderer data={data} onNavigate={onNavigate} serviceDomain={relationships?.istioServiceDomain} />}
+        {kind === 'destinationrules' && <IstioDestinationRuleRenderer data={data} onNavigate={onNavigate} serviceDomain={relationships?.istioServiceDomain} />}
         {kind === 'serviceentries' && <IstioServiceEntryRenderer data={data} />}
         {kind === 'peerauthentications' && <IstioPeerAuthenticationRenderer data={data} />}
         {kind === 'authorizationpolicies' && <IstioAuthorizationPolicyRenderer data={data} />}
         {kind === 'mutatingwebhookconfigurations' && <WebhookConfigRenderer data={data} isMutating />}
         {kind === 'validatingwebhookconfigurations' && <WebhookConfigRenderer data={data} />}
-        {kind === 'ingressclasses' && <IngressClassRenderer data={data} />}
+        {kind === 'ingressclasses' && <IngressClassRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'priorityclasses' && <PriorityClassRenderer data={data} />}
         {kind === 'runtimeclasses' && <RuntimeClassRenderer data={data} />}
         {kind === 'leases' && <LeaseRenderer data={data} />}
@@ -1190,7 +1193,7 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
     return getGatewayStatus(data)
   }
   if (k === 'gatewayclasses') return getGatewayClassStatus(data)
-  if (k === 'httproutes' || k === 'grpcroutes' || k === 'tcproutes' || k === 'tlsroutes') return getRouteStatus(data)
+  if (k === 'httproutes' || k === 'grpcroutes' || k === 'tcproutes' || k === 'tlsroutes' || k === 'udproutes') return getRouteStatus(data)
   if (k === 'sealedsecrets') return getSealedSecretStatus(data)
   if (k === 'poddisruptionbudgets') return getPDBStatus(data)
   if (k === 'gitrepositories') return getGitRepositoryStatus(data)
@@ -1247,7 +1250,7 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
   }
   // Group-guarded for the same reason as the renderers: these plurals are
   // generic enough that another operator can serve them.
-  if ((k === 'databases' || k === 'publications' || k === 'subscriptions') && isApiGroup(data.apiVersion, CNPG_GROUP)) {
+  if ((k === 'databases' || k === 'publications' || k === 'subscriptions' || k === 'databaseroles') && isApiGroup(data.apiVersion, CNPG_GROUP)) {
     return getCNPGDeclarativeStatus(data)
   }
   if (k === 'globalcontextentries') return getKyvernoGlobalContextStatus(data)

package/src/components/shared/SetImageDialog.test.ts

@@ -1,11 +1,14 @@
 import { describe, expect, it } from 'vitest'
 
 import type { WorkloadContainerImage } from '../../types/core'
+import { canConfirmGitOpsWrite, evaluateGitOpsWriteGuard, gitOpsWriteGuardKey } from '../../utils/gitops-write-guard'
 import {
+  SET_IMAGE_WRITES,
   canSubmitImageUpdates,
   changedImageUpdates,
   describeImageUpdateBehavior,
   reconcileRefreshedImageDrafts,
+  setImageWrites,
 } from './SetImageDialog'
 
 const containers: WorkloadContainerImage[] = [
@@ -104,26 +107,92 @@ describe('reconcileRefreshedImageDrafts', () => {
 })
 
 describe('canSubmitImageUpdates', () => {
+  const target = { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' }
+  const managedGuard = evaluateGitOpsWriteGuard({
+    target,
+    owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+    writes: SET_IMAGE_WRITES,
+  })
+  const unmanagedGuard = evaluateGitOpsWriteGuard({ target, owner: null, writes: SET_IMAGE_WRITES })
+  const pendingGuard = evaluateGitOpsWriteGuard({ target, owner: null, ownerPending: true, writes: SET_IMAGE_WRITES })
   const ready = {
     updateCount: 1,
     hasEmptyImage: false,
-    managed: false,
-    ownershipResolved: true,
-    acknowledged: false,
+    ownershipConfirmable: canConfirmGitOpsWrite(unmanagedGuard, false),
     busy: false,
   }
 
   it('requires break-glass acknowledgement for managed resources', () => {
-    expect(canSubmitImageUpdates({ ...ready, managed: true })).toBe(false)
+    expect(managedGuard.requiresAck).toBe(true)
+    expect(
+      canSubmitImageUpdates({ ...ready, ownershipConfirmable: canConfirmGitOpsWrite(managedGuard, false) }),
+    ).toBe(false)
     expect(
-      canSubmitImageUpdates({ ...ready, managed: true, acknowledged: true }),
+      canSubmitImageUpdates({ ...ready, ownershipConfirmable: canConfirmGitOpsWrite(managedGuard, true) }),
     ).toBe(true)
   })
 
+  it('gates until ownership resolves', () => {
+    expect(canConfirmGitOpsWrite(undefined, true)).toBe(false)
+    expect(canConfirmGitOpsWrite(pendingGuard, true)).toBe(false)
+    expect(canSubmitImageUpdates(ready)).toBe(true)
+  })
+
   it('blocks empty images and concurrent submissions', () => {
     expect(canSubmitImageUpdates({ ...ready, hasEmptyImage: true })).toBe(false)
     expect(canSubmitImageUpdates({ ...ready, busy: true })).toBe(false)
     expect(canSubmitImageUpdates({ ...ready, loadFailed: true })).toBe(false)
-    expect(canSubmitImageUpdates({ ...ready, ownershipResolved: false })).toBe(false)
+    expect(canSubmitImageUpdates({ ...ready, ownershipConfirmable: false })).toBe(false)
+  })
+})
+
+describe('setImageWrites', () => {
+  it('names each container, so the verdict is for exactly the images being changed', () => {
+    expect(setImageWrites(containers).map((w) => w.paths)).toEqual([
+      ['spec.template.spec.containers[name=app].image'],
+      ['spec.template.spec.containers[name=sidecar].image'],
+      ['spec.template.spec.initContainers[name=migrate].image'],
+    ])
+  })
+
+  it("asks again when the evidence doesn't cover a changed container", () => {
+    // Evidence read before the dialog listed the init container covers only
+    // the app image, which the owner ignores.
+    const guard = evaluateGitOpsWriteGuard({
+      target: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' },
+      owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+      writes: setImageWrites([{ type: 'initContainer', name: 'migrate' }]),
+      evidence: {
+        uid: 'u',
+        resourceVersion: '1',
+        owner: null,
+        policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null, respectIgnoreDifferences: true },
+        paths: [{ path: 'spec.template.spec.containers[name=app].image', lastApplied: 'present', ownedBy: [], ownedByGitOps: false, ignored: 'effective', ignoredBy: 'spec.ignoreDifferences' }],
+      },
+    })
+    expect(guard.level).toBe('may-revert')
+    expect(canConfirmGitOpsWrite(guard, false)).toBe(false)
+  })
+})
+
+describe('acknowledgment scope', () => {
+  it("an acknowledgment for one container's image doesn't cover another's with the same verdict", () => {
+    const guardFor = (name: string) =>
+      evaluateGitOpsWriteGuard({
+        target: { kind: 'Deployment', group: 'apps', namespace: 'prod', name: 'api' },
+        owner: { tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'api' },
+        writes: setImageWrites([{ type: 'container', name }]),
+        evidence: {
+          uid: 'u',
+          resourceVersion: '1',
+          owner: null,
+          policy: { tool: 'argocd', auto: true, selfHeal: true, prune: false, suspended: null },
+          paths: ['app', 'sidecar'].map((n) => ({ path: `spec.template.spec.containers[name=${n}].image`, lastApplied: 'present' as const, ownedBy: [], ownedByGitOps: false })),
+        },
+      })
+    const sidecar = guardFor('sidecar')
+    const app = guardFor('app')
+    expect(app.level).toBe(sidecar.level)
+    expect(gitOpsWriteGuardKey(app)).not.toBe(gitOpsWriteGuardKey(sidecar))
   })
 })