@skyhook-io/k8s-ui 1.16.3 → 1.17.1

package/src/index.ts

@@ -55,7 +55,7 @@ export * from './components/checks'
 // queue)
 export * from './components/issues'
 
-// CloudNativePG workspace model (fleet derivation over /api/cnpg/workspace)
+// CloudNativePG workspace model (fleet derivation over /api/cnpg/workspace) and summaries
 export * from './components/cnpg'
 
 // Cluster switcher (shared trigger+dropdown for OSS Radar and Radar Hub)
@@ -82,3 +82,16 @@ export * from './components/compare'
 
 // Perf instrumentation (ELK + structureKey timers, surfaced in diagnostics overlay)
 export * from './perf'
+
+export { CertaintyGlyph, certaintyGlyph, certaintyValueLabel, type Certainty } from './components/facts/certainty'
+
+export * from './components/facts'
+export {
+  WorkspaceProblemCallout,
+  ProblemList,
+  ProblemMeta,
+  OpenIssueContext,
+  problemOriginLabel,
+  type WorkspaceProblem,
+  type ProblemOrigin,
+} from './components/problems'

package/src/monaco-deep.d.ts

@@ -1,15 +1,22 @@
+// @monaco-editor/react and @monaco-editor/loader type monaco through this path,
+// which monaco-editor's exports map does not serve.
 declare module 'monaco-editor/esm/vs/editor/editor.api' {
-  export * from 'monaco-editor'
+  export * from 'monaco-editor/editor/editor.api'
 }
 
-declare module 'monaco-editor/esm/vs/basic-languages/yaml/yaml.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/xml/xml.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/html/html.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/css/css.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/javascript/javascript.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/typescript/typescript.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/python/python.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/shell/shell.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/markdown/markdown.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/ini/ini.contribution'
-declare module 'monaco-editor/esm/vs/basic-languages/dockerfile/dockerfile.contribution'
+declare module 'monaco-editor/languages/definitions/yaml/register'
+declare module 'monaco-editor/languages/definitions/xml/register'
+declare module 'monaco-editor/languages/definitions/html/register'
+declare module 'monaco-editor/languages/definitions/css/register'
+declare module 'monaco-editor/languages/definitions/javascript/register'
+declare module 'monaco-editor/languages/definitions/typescript/register'
+declare module 'monaco-editor/languages/definitions/python/register'
+declare module 'monaco-editor/languages/definitions/shell/register'
+declare module 'monaco-editor/languages/definitions/markdown/register'
+declare module 'monaco-editor/languages/definitions/ini/register'
+declare module 'monaco-editor/languages/definitions/dockerfile/register'
+declare module 'monaco-editor/editor/contrib/*'
+declare module 'monaco-editor/editor/standalone/*'
+declare module 'monaco-editor/editor/browser/*'
+declare module 'monaco-editor/editor/common/*'
+declare module 'monaco-editor/features/*'

package/src/theme/components.css

@@ -35,6 +35,19 @@
     opacity: 0.5;
   }
 
+  .btn-secondary {
+    border: 1px solid var(--border-default);
+    background-color: var(--bg-surface);
+    color: var(--text-primary);
+    border-radius: 0.625rem;
+  }
+  .btn-secondary:hover {
+    background-color: var(--bg-hover);
+  }
+  .btn-secondary:disabled {
+    opacity: 0.5;
+  }
+
   .btn-brand-toggle {
     background-color: color-mix(in srgb, var(--color-brand) 50%, transparent);
     color: var(--text-primary);

package/src/types/capacity.ts

@@ -1,4 +1,6 @@
 import type { Issue } from "../components/issues/types";
+import type { Certainty } from "../components/facts/certainty";
+import type { NodeLifecycleObservation } from "../utils/node-lifecycle";
 
 export const CAPACITY_SCHEMA_VERSION = "v1alpha1" as const;
 
@@ -15,8 +17,7 @@ export interface CapacityResourceIdentity {
   uid?: string;
 }
 
-export type CapacityCertainty =
-  "exact" | "lower_bound" | "upper_bound" | "unknown";
+export type CapacityCertainty = Certainty;
 export type CapacityGranularity =
   "aggregate" | "aggregate_not_binpacked" | "per_node";
 export type CapacityResourceVector = Record<string, string>;
@@ -232,6 +233,14 @@ export interface CapacityClaimLifecycleSummary {
 }
 
 export interface CapacityNodeLifecycleSummary {
+  operational?: {
+    total: number;
+    ready: number;
+    notReady: number;
+    cordoned: number;
+    removing: number;
+    removingUnhealthy: number;
+  };
   total: number;
   ready: number;
   notReady: number;
@@ -325,6 +334,7 @@ export type CapacityClaimStage =
   | "unknown";
 
 export interface CapacityNodeMember {
+  lifecycle?: NodeLifecycleObservation;
   ready?: boolean;
   cordoned: boolean;
   conditions: CapacityCondition[];
@@ -408,6 +418,14 @@ export interface CapacityScalingFact {
   summary: string;
 }
 
+/** Published scale-down observations; candidates do not imply a removal ETA. */
+export interface CapacityAutoscalerScaleDown {
+  status?: string;
+  candidates?: number;
+  lastTransitionTime?: string;
+  asOf?: string;
+}
+
 export interface CapacityAutoscalerBackoff {
   errorClass?: string;
   errorCode?: string;
@@ -430,6 +448,7 @@ export interface CapacityAutoscalerChildObservation {
   readyNodes?: number;
   totalNodes?: number;
   backoff?: CapacityAutoscalerBackoff;
+  scaleDown?: CapacityAutoscalerScaleDown;
   asOf?: string;
 }
 

package/src/types/core.ts

@@ -164,9 +164,15 @@ export interface FeatureCapabilities {
   yamlSchemas?: boolean
   workloadImages?: boolean
   resourceIssues?: boolean
+  resourceIssueCoverage?: boolean
   podEnvironment?: boolean
   policyResource?: boolean
   workloadHistory?: boolean
+  cnpgWorkspace?: boolean
+  cnpgProtectionSetup?: boolean
+  gitopsWriteEvidence?: boolean
+  serviceEndpointSlices?: boolean
+  trafficRecords?: boolean
 }
 
 // DeploymentMode is the closed set of topologies Radar can run in.
@@ -198,6 +204,7 @@ export type CoreNodeKind =
   | 'HTTPRoute'
   | 'GRPCRoute'
   | 'TCPRoute'
+  | 'UDPRoute'
   | 'TLSRoute'
   | 'Service'
   | 'Deployment'
@@ -636,6 +643,8 @@ export interface ResourceRef {
 
 // Computed relationships for a resource
 export interface Relationships {
+  /** Istio registry domain supplied by the producer; omitted when unknown. */
+  istioServiceDomain?: string
   reflection?: {
     source?: ResourceRef
     sourceResourceVersion?: string
@@ -653,6 +662,15 @@ export interface Relationships {
   consumers?: ResourceRef[]
   scalers?: ResourceRef[]
   storageRefs?: ResourceRef[]
+  dependencies?: ResourceRef[]
+  dependents?: ResourceRef[]
+  monitors?: ResourceRef[]
+  monitorTargets?: ResourceRef[]
+  backends?: ResourceRef[]
+  routedFrom?: ResourceRef[]
+  protects?: ResourceRef[]
+  healthChecks?: ResourceRef[]
+  stagedPolicies?: ResourceRef[]
   scaleTarget?: ResourceRef
   pdbs?: ResourceRef[]              // PodDisruptionBudgets protecting this workload
   networkPolicies?: ResourceRef[]   // NetworkPolicy / CiliumNetworkPolicy / ClusterNetworkPolicy variants selecting this workload
@@ -723,6 +741,7 @@ export interface HPADiagnosis extends HPADiagnosisView {
     name?: string
   }
   bounds: HPABounds
+  /** Spec order keeps source references paired with values; unmatched status entries follow. */
   metrics?: HPAMetricSummary[]
 }
 
@@ -780,6 +799,8 @@ export interface APIResource {
   name: string // Plural name (e.g., "deployments")
   namespaced: boolean
   isCrd: boolean
+  /** Confirmed, readable cached CRD identity; never inferred from isCrd. */
+  definitionName?: string
   featured?: boolean
   verbs: string[]
   observation?: DynamicResourceObservation
@@ -817,6 +838,7 @@ export interface HelmRevision {
   appVersion: string
   description: string
   updated: string // ISO date string
+  deleted?: string
 }
 
 export type HelmOperationKind = 'release_failed' | 'upgrade_failed' | 'upgrade_rolled_back' | 'rollback' | 'pending'
@@ -1067,12 +1089,23 @@ export interface UpgradeInfo {
   error?: string
   // Machine-readable source-resolution failure, used to make the Helm drawer
   // explain whether tracking an OCI source can help.
-  sourceIssue?: 'untracked' | 'repo_index_error' | 'ambiguous_repository'
+  sourceIssue?: 'untracked' | 'repo_index_error' | 'ambiguous_repository' | 'ambiguous_source' | 'source_unavailable'
   // True only when the error is a genuinely untracked source (registering a
   // chart source could fix it). Kept for compatibility; prefer sourceIssue.
   untracked?: boolean
 }
 
+export type ChartSourceCandidate =
+  | { type: 'repository'; reference: string; url: string }
+  | { type: 'oci'; reference: string; url?: never }
+
+export interface ChartSourceStatus {
+  recorded?: ChartSourceCandidate
+  configured: boolean
+  available: boolean
+  candidates?: ChartSourceCandidate[]
+}
+
 // Batch upgrade info keyed by "storageNamespace/name".
 export interface BatchUpgradeInfo {
   releases: Record<string, UpgradeInfo>
@@ -1284,10 +1317,12 @@ export interface MetricsDataPoint {
 export interface TrafficEndpoint {
   name: string
   namespace: string
-  kind: string // Pod, Service, External, Host, Unknown
+  kind: string // Pod, Workload, Service, External, Host, Unknown
   ip?: string
   labels?: Record<string, string>
   workload?: string
+  /** Deployment, StatefulSet, CronJob, … when resolved from the pod's owners. */
+  workloadKind?: string
   port?: number
 }
 
@@ -1453,6 +1488,12 @@ export interface TrafficFlowsResponse {
    *  nodeFlowLimit, so older traffic in the window did not fit. */
   coveredSince?: string
   nodeFlowLimit?: number
+  /** Set when the source kept only its newest flowLimit flows in total; the
+   *  window is then complete only from coveredSince. */
+  flowLimit?: number
+  /** How many records the aggregation covers. `flows` holds only the newest of
+   *  them; a Radar that predates the cap omits this and sends every record. */
+  flowsTotal?: number
   warning?: string  // Non-fatal warning (e.g., query errors)
   /** 'transient' (or absent) means the condition may clear on its own and a
    *  retry is worthwhile. 'partial' means the flows are correct but some of
@@ -1463,6 +1504,23 @@ export interface TrafficFlowsResponse {
   warningKind?: 'transient' | 'partial' | 'incomplete'
 }
 
+// Response from GET /api/traffic/flows/records — the newest records behind
+// one graph selection.
+export interface TrafficRecordsResponse {
+  source: string
+  timestamp: string
+  /** Newest first, at most the server's records limit. */
+  flows: TrafficFlow[]
+  /** How many records matched; more than flows.length when capped. */
+  matched: number
+  l7ResponsesCallerOriented?: boolean
+  coveredSince?: string
+  nodeFlowLimit?: number
+  flowLimit?: number
+  warning?: string
+  warningKind?: 'transient' | 'partial' | 'incomplete'
+}
+
 // Wizard state for traffic setup
 export type TrafficWizardState = 'detecting' | 'not_found' | 'wizard' | 'checking' | 'ready'
 

package/src/types/gitops-flux-status.test.ts

@@ -29,13 +29,44 @@ describe('fluxConditionsToGitOpsStatus truth table', () => {
   })
 
   it('treats the -1 sentinel as drift', () => {
-    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False'), c('Reconciling', 'True')], false, {
+    // A first reconcile reports Ready=Unknown; a reported failure outranks drift.
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'Unknown'), c('Reconciling', 'True')], false, {
       generation: 1,
       observedGeneration: -1,
     })
     expect(got.sync).toBe('Reconciling')
   })
 
+  it('a failure while retrying and never reconciled is degraded', () => {
+    // Live shape of a GitRepository whose repository doesn't exist.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Reconciling', 'True', { reason: 'ProgressingWithRetry' }), c('Ready', 'False', { reason: 'GitOperationFailed', observedGeneration: 1 })],
+      false,
+      { generation: 1, observedGeneration: -1 },
+    )
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('a failure about an older generation does not outrank a new spec', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False', { reason: 'BuildFailed', observedGeneration: 2 })], false, {
+      generation: 3,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('a retry while reconciling stays progressing', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Reconciling', 'True', { reason: 'Progressing' }), c('Ready', 'False', { reason: 'ProgressingWithRetry' })],
+      false,
+      { generation: 2, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Reconciling')
+    expect(got.health).toBe('Progressing')
+  })
+
   it('does not treat an absent observedGeneration as drift', () => {
     // Kinds and controller versions that never set it must not all read stale.
     expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, { generation: 3 }).sync).toBe('Synced')

package/src/types/gitops-insights.ts

@@ -93,6 +93,12 @@ export interface GitOpsInsightSummary {
   // The controller's API server was asked and didn't answer usefully — why,
   // in the user's words. Only set when the integration is configured.
   resourceHealthApiError?: string
+  // The host is still connecting to the controller's API server; ask again
+  // shortly.
+  resourceHealthApiPending?: boolean
+  // The host couldn't reach the controller's API server and is retrying;
+  // ask again now and then.
+  resourceHealthApiRetrying?: boolean
 }
 
 export interface GitOpsIgnoredDifferences {
@@ -177,6 +183,8 @@ export interface GitOpsChange {
   recentEvents?: GitOpsEventSummary[]
   partial: boolean
   partialNote?: string
+  // A Flux source or dependsOn target the root consumes but doesn't manage.
+  dependency?: boolean
 }
 
 export interface GitOpsDrift {
@@ -247,6 +255,12 @@ export interface GitOpsCapabilities {
   // tell "not set up" (offer Connect) from "set up but disconnected" (offer
   // Reconnect) — instead of advertising a diff that would fail.
   argoConfigured?: boolean
+  // Configured, and the host is still making the first connection; ask
+  // again shortly instead of reporting the diff as down.
+  argoConnecting?: boolean
+  // Configured, the connection failed in a way that may pass on its own, and
+  // the host is retrying; ask again now and then.
+  argoRetrying?: boolean
   // True on an Argo CD Application detail when the integration is connected,
   // meaning the revision-metadata endpoint can resolve Git commit details
   // (author, message, signature) for this app's deployed revisions.
@@ -269,13 +283,16 @@ export interface ArgoRevisionMetadata {
 // Response of GET /api/argo/applications/{ns}/{name}/resource-diff. `desired`
 // is the Git-rendered manifest, `live` the normalized cluster state — both YAML
 // for the line-by-line view. `fieldEntries` is the same diff structured per
-// path for a compact summary. `redacted` is set when Secret values were masked
+// path for a compact summary; Radars before the list was made non-null send
+// null when it is empty. `fieldEntriesTruncated` is set when the list was cut
+// at the server's entry cap. `redacted` is set when Secret values were masked
 // server-side; `hook` marks Argo sync-hook resources.
 export interface GitOpsResourceDiff {
   source: string
   desired: string
   live: string
-  fieldEntries: GitOpsResourceDiffFieldEntry[]
+  fieldEntries: GitOpsResourceDiffFieldEntry[] | null
+  fieldEntriesTruncated?: boolean
   redacted: boolean
   hook: boolean
 }

package/src/types/gitops-tree.ts

@@ -43,6 +43,9 @@ export interface GitOpsTreeNode {
   // Lives on the destination cluster of a remote tree. This cluster's API
   // would answer for a different, same-named object.
   remote?: boolean
+  // Reached only through a Flux source, chart or dependsOn declaration: the
+  // root consumes it but does not manage it. Not counted as a managed resource.
+  dependency?: boolean
 }
 
 // 'controllerApi' is the controller's own verdict read from its API server
@@ -69,6 +72,7 @@ export interface GitOpsTreeSummary {
   grouped: number
   degraded: number
   outOfSync: number
+  dependencies?: number
 }
 
 export interface GitOpsResourceTree {
@@ -83,6 +87,12 @@ export interface GitOpsResourceTree {
   healthFromApi?: boolean
   // The controller's API server was asked and didn't answer usefully.
   healthApiError?: string
+  // The host is still connecting to the controller's API server; ask again
+  // shortly.
+  healthApiPending?: boolean
+  // The host couldn't reach the controller's API server and is retrying;
+  // ask again now and then.
+  healthApiRetrying?: boolean
   // The Application (or Flux object with spec.kubeConfig) deploys to another
   // cluster; Radar derives nothing about its resources from here.
   remoteDestination?: boolean

package/src/types/gitops.ts

@@ -99,6 +99,7 @@ export interface FluxCondition {
   reason?: string
   message?: string
   lastTransitionTime?: string
+  observedGeneration?: number
 }
 
 // ============================================================================
@@ -141,8 +142,11 @@ function hasGenerationDrift(gen?: FluxGeneration): boolean {
  * - suspend                                   → Suspended (sync from Ready, unless drifted)
  * - Stalled=True                              → OutOfSync / Degraded
  * - Ready=True and no generation drift        → Synced, health from Healthy
+ * - Ready=False with a failure reason about
+ *   the current generation                    → OutOfSync / Degraded
  * - drift, or Reconciling with Ready not True → Reconciling / Progressing
- * - Ready=False                               → OutOfSync
+ * - Ready=False                               → OutOfSync / Degraded, or
+ *   Progressing for a retry/wait reason
  */
 export function fluxConditionsToGitOpsStatus(
   conditions: FluxCondition[],
@@ -203,6 +207,25 @@ export function fluxConditionsToGitOpsStatus(
     }
   }
 
+  // A failure the controller reported outranks activity too: a source that
+  // can't clone keeps Reconciling=True and never records observedGeneration
+  // while it retries, and reading that as "in progress" hid it.
+  const readyReason = readyCondition?.reason || ''
+  const transientReason = readyReason.includes('Progress') || readyReason.includes('Retry') || readyReason.includes('Wait')
+  // Only a failure about the current spec counts: after a fix, the old
+  // Ready=False describes an older generation until the controller looks again.
+  const currentFailure = readyCondition?.observedGeneration !== undefined && readyCondition.observedGeneration === generation?.generation
+  if (readyCondition?.status === 'False' && !transientReason && currentFailure) {
+    return {
+      sync: 'OutOfSync',
+      health: 'Degraded',
+      message: readyCondition.message,
+      lastSyncTime: readyCondition.lastTransitionTime,
+      suspended: false,
+      ...activity,
+    }
+  }
+
   // Genuinely not applied: the controller has not observed the current spec, or
   // it is working and has not reached Ready.
   if (drifted || isReconciling) {
@@ -216,14 +239,11 @@ export function fluxConditionsToGitOpsStatus(
     }
   }
 
-  // Handle not ready state
+  // A retry or remediation in flight is out of sync, but not a settled failure.
   if (readyCondition?.status === 'False') {
-    const reason = readyCondition.reason || ''
-    const isTransient = reason.includes('Progress') || reason.includes('Retry') || reason.includes('Wait')
-
     return {
       sync: 'OutOfSync',
-      health: isTransient ? 'Progressing' : 'Degraded',
+      health: transientReason ? 'Progressing' : 'Degraded',
       message: readyCondition.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,

package/src/utils/api-resources.ts

@@ -63,6 +63,13 @@ const ADDITIONAL_BUILTIN_IDENTITIES: Record<string, string> = {
   deviceclass: 'resource.k8s.io', deviceclasses: 'resource.k8s.io',
 };
 
+// Kind spellings only: a resource name such as `services` is not a Kind.
+const ADDITIONAL_CORE_KINDS: ReadonlySet<string> = new Set(['Endpoints'])
+
+export function isBuiltinCoreKind(kind: string): boolean {
+  return ADDITIONAL_CORE_KINDS.has(kind) || CORE_RESOURCES.some(r => r.group === '' && r.kind === kind)
+}
+
 export function builtinGroupForKind(kindOrResource: string): string | undefined {
   const value = kindOrResource.toLowerCase()
   return CORE_RESOURCES.find(resource =>

package/src/utils/application-history.ts

@@ -38,6 +38,7 @@ const RELATED_RUNTIME_KINDS = new Set([
   'HTTPRoute',
   'GRPCRoute',
   'TCPRoute',
+  'UDPRoute',
   'TLSRoute',
   'ConfigMap',
   'Secret',

package/src/utils/cnpg-backup.test.ts

@@ -0,0 +1,26 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { cnpgBackupDeclaration, cnpgBackupDestinationBlocker, cnpgBarmanPlugin, cnpgDestinationPlugin, cnpgHasBackupDestination } from './cnpg-backup'
+
+const cases: Array<{
+  name: string
+  cluster: Parameters<typeof cnpgBackupDeclaration>[0]
+  method: string
+  plugin: string
+  hasDestination: boolean
+  destinationPlugin: string
+  blockerCode: string
+  barman: { objectStore: string; serverName: string } | null
+}> = JSON.parse(readFileSync(new URL('../../../../pkg/cnpg/testdata/backup-declarations.json', import.meta.url), 'utf8'))
+
+describe('CNPG backup declarations shared with Go', () => {
+  it.each(cases)('$name', (test) => {
+    const declaration = cnpgBackupDeclaration(test.cluster)
+    expect(cnpgHasBackupDestination(declaration)).toBe(test.hasDestination)
+    expect(cnpgDestinationPlugin(declaration)?.name ?? '').toBe(test.destinationPlugin)
+    expect(cnpgBackupDestinationBlocker(declaration, test.method || undefined, test.plugin)?.code ?? '').toBe(test.blockerCode)
+    const barman = cnpgBarmanPlugin(declaration)
+    if (test.barman) expect(barman).toMatchObject({ barmanObjectName: test.barman.objectStore || undefined, serverName: test.barman.serverName })
+    else expect(barman).toBeUndefined()
+  })
+})

package/src/utils/cnpg-backup.ts

@@ -0,0 +1,70 @@
+export const CNPG_BARMAN_PLUGIN_NAME = 'barman-cloud.cloudnative-pg.io'
+
+interface BackupCluster {
+  metadata?: { name?: string }
+  spec?: {
+    backup?: { barmanObjectStore?: { destinationPath?: string }; volumeSnapshot?: unknown }
+    plugins?: { name: string; enabled?: boolean; isWALArchiver?: boolean; parameters?: { barmanObjectName?: string; serverName?: string } }[]
+  }
+}
+
+export interface CNPGBackupPlugin {
+  name: string
+  enabled: boolean
+  isWALArchiver: boolean
+  barmanObjectName?: string
+  serverName?: string
+}
+
+export interface CNPGBackupDeclaration {
+  plugins: CNPGBackupPlugin[]
+  inTreeConfigured: boolean
+  inTreeDestination?: string
+  snapshotsConfigured: boolean
+}
+
+export function cnpgBackupDeclaration(cluster: BackupCluster): CNPGBackupDeclaration {
+  const backup = cluster.spec?.backup
+  return {
+    inTreeConfigured: !!backup?.barmanObjectStore,
+    inTreeDestination: backup?.barmanObjectStore?.destinationPath,
+    snapshotsConfigured: backup?.volumeSnapshot != null,
+    plugins: (cluster.spec?.plugins ?? []).filter((p) => p?.name).map((p) => ({
+      name: p.name,
+      enabled: p.enabled !== false,
+      isWALArchiver: p.isWALArchiver === true,
+      barmanObjectName: p.parameters?.barmanObjectName,
+      serverName: p.parameters?.serverName || cluster.metadata?.name,
+    })),
+  }
+}
+
+export function cnpgBarmanPlugin(declaration: CNPGBackupDeclaration): CNPGBackupPlugin | undefined {
+  return declaration.plugins.find((p) => p.enabled && p.name === CNPG_BARMAN_PLUGIN_NAME)
+}
+
+export function cnpgDestinationPlugin(declaration: CNPGBackupDeclaration): CNPGBackupPlugin | undefined {
+  return declaration.plugins.find((p) => p.enabled && (p.name !== CNPG_BARMAN_PLUGIN_NAME || !!p.barmanObjectName))
+}
+
+export function cnpgHasBackupDestination(declaration: CNPGBackupDeclaration): boolean {
+  return !!declaration.inTreeDestination || declaration.snapshotsConfigured || !!cnpgDestinationPlugin(declaration)
+}
+
+export interface CNPGBackupBlocker {
+  code: 'no_destination' | 'method_destination_missing'
+  method: string
+  plugin?: string
+}
+
+export function cnpgBackupDestinationBlocker(declaration: CNPGBackupDeclaration, method = 'barmanObjectStore', plugin?: string): CNPGBackupBlocker | null {
+  const blocked = method === 'barmanObjectStore' ? !declaration.inTreeDestination
+    : method === 'volumeSnapshot' ? !declaration.snapshotsConfigured
+    : method === 'plugin' ? !declaration.plugins.some((p) => p.name === plugin && p.enabled && (p.name !== CNPG_BARMAN_PLUGIN_NAME || !!p.barmanObjectName))
+    : false
+  return blocked ? { code: cnpgHasBackupDestination(declaration) ? 'method_destination_missing' : 'no_destination', method, plugin: cnpgDestinationPlugin(declaration)?.name } : null
+}
+
+export function cnpgBackupBlockerText(blocker: CNPGBackupBlocker): string {
+  return blocker.code === 'no_destination' ? 'No backup destination' : `No ${blocker.method} destination`
+}