@skyhook-io/k8s-ui 1.17.0 → 1.17.1

package/src/components/resources/renderers/VPARenderer.tsx

@@ -1,11 +1,13 @@
 import { Cpu } from 'lucide-react'
 import { clsx } from 'clsx'
 import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink } from '../../ui/drawer-components'
-import { kindToPlural } from '../../../utils/navigation'
+import { objectReferenceToResourceRef } from '../../../utils/navigation'
+import type { ResourceRef } from '../../../types'
+import { CORE_RESOURCES } from '../../../utils/api-resources'
 
 interface VPARendererProps {
   data: any
-  onNavigate?: (ref: { kind: string; namespace: string; name: string }) => void
+  onNavigate?: (ref: ResourceRef) => void
 }
 
 function formatResource(value: string | undefined): string {
@@ -17,6 +19,16 @@ export function VPARenderer({ data, onNavigate }: VPARendererProps) {
   const spec = data.spec || {}
   const status = data.status || {}
   const targetRef = spec.targetRef || {}
+  const namespace = data.metadata?.namespace
+  const builtin = !targetRef.apiVersion ? CORE_RESOURCES.find(resource => resource.kind === targetRef.kind) : undefined
+  const builtinAPIVersion = builtin
+    ? (builtin.group ? `${builtin.group}/${builtin.version}` : builtin.version)
+    : targetRef.kind === 'ReplicationController' ? 'v1' : undefined
+  const target = objectReferenceToResourceRef({
+    ...targetRef,
+    apiVersion: targetRef.apiVersion || builtinAPIVersion,
+    namespace,
+  })
   const updatePolicy = spec.updatePolicy || {}
   const resourcePolicy = spec.resourcePolicy || {}
   const containerPolicies = resourcePolicy.containerPolicies || []
@@ -63,15 +75,9 @@ export function VPARenderer({ data, onNavigate }: VPARendererProps) {
       <Section title="Configuration" icon={Cpu}>
         <PropertyList>
           <Property label="Target" value={
-            targetRef.name ? (
-              <ResourceLink
-                name={targetRef.name}
-                kind={kindToPlural(targetRef.kind || 'Deployment')}
-                namespace={data.metadata?.namespace || ''}
-                label={`${targetRef.kind}/${targetRef.name}`}
-                onNavigate={onNavigate}
-              />
-            ) : undefined
+            targetRef.name ? (target ? (
+              <ResourceLink {...target} label={`${targetRef.kind}/${targetRef.name}`} onNavigate={onNavigate} />
+            ) : `${targetRef.kind || 'Unknown kind'}/${targetRef.name}`) : undefined
           } />
           <Property label="Update Mode" value={
             <span className={clsx(

package/src/components/resources/resource-utils-capi.ts

@@ -73,7 +73,7 @@ export function getClusterStatus(resource: any): StatusBadge {
 }
 
 export function getClusterClass(resource: any): string {
-  return resource.spec?.topology?.class || '-'
+  return resource.spec?.topology?.classRef?.name || resource.spec?.topology?.class || '-'
 }
 
 export function getClusterVersion(resource: any): string {

package/src/components/resources/resource-utils-cnpg.test.ts

@@ -14,6 +14,7 @@ import {
   getCNPGWALArchivingFailure,
   getCNPGLastBackupFailure,
   classifyCNPGClusterPhase,
+  cnpgBlockedPhaseExplanation,
   classifyCNPGBackupPhase,
   CNPG_CLUSTER_PHASES_HEALTHY,
   CNPG_CLUSTER_PHASES_TRANSIENT,
@@ -115,6 +116,26 @@ describe('getCNPGClusterCertificateExpirations', () => {
 
 const cluster = (status: any = {}, spec: any = {}) => ({ spec, status })
 
+describe('cnpgBlockedPhaseExplanation', () => {
+  it('says the operator retries a plugin phase, and quotes its reason', () => {
+    const e = cnpgBlockedPhaseExplanation(
+      'Cluster cannot proceed to reconciliation due to an unknown plugin being required',
+      "Unknown plugin: 'barman-cloud.cloudnative-pg.io'. Check the operator and plugin logs for errors",
+    )
+    expect(e.title).toBe('Reconciliation is blocked by a plugin')
+    expect(e.body).toMatch(/retries every few seconds/)
+    expect(e.body).not.toMatch(/manual intervention|does not resolve/)
+    expect(e.body).toMatch(/The operator reports: Unknown plugin/)
+    expect(e.body.endsWith('for errors.')).toBe(true)
+    expect(e.message.startsWith('Cluster cannot proceed')).toBe(true)
+  })
+  it('keeps manual intervention for the one phase upstream says needs it', () => {
+    expect(cnpgBlockedPhaseExplanation('Cluster is unrecoverable and needs manual intervention').title).toBe('Cluster is unrecoverable')
+    const objects = cnpgBlockedPhaseExplanation('Unable to create required cluster objects', '  ')
+    expect(objects.body).toBe('The operator keeps retrying, but this does not clear until its cause is fixed.')
+  })
+})
+
 describe('classifyCNPGClusterPhase', () => {
   it('buckets every phase constant shipped by CNPG 1.27', () => {
     for (const p of CNPG_CLUSTER_PHASES_HEALTHY) expect(classifyCNPGClusterPhase(p)).toBe('healthy')
@@ -365,13 +386,17 @@ describe('getCNPGClusterInstancesReportedState', () => {
 // ============================================================================
 
 describe('getCNPGPoolerStatus', () => {
+  it('uses the requested count during scale-down without claiming readiness', () => {
+    expect(getCNPGPoolerStatus({ spec: { instances: 2 }, status: { instances: 3 } })).toMatchObject({ text: '2 instances requested', level: 'neutral' })
+    expect(getCNPGPoolerStatus({ spec: { instances: 1 }, status: { instances: 1 } })).toMatchObject({ text: '1 instance requested', level: 'neutral' })
+  })
   it('does not claim readiness from status.instances, which counts scheduled pods', () => {
     // Verified live: a Pooler whose 2 PgBouncer pods are both Pending (0/1
     // ready) still reports status.instances=2. Calling that "Ready" renders a
     // broken Pooler green.
     const s = getCNPGPoolerStatus({ spec: { instances: 2 }, status: { instances: 2 } })
-    expect(s.level).toBe('healthy')
-    expect(s.text).toBe('Scheduled')
+    expect(s.level).toBe('neutral')
+    expect(s.text).toBe('2 instances requested')
     expect(s.text).not.toBe('Ready')
   })
 
@@ -595,7 +620,7 @@ describe('status column filter reads the badge, not the raw phase', () => {
     )).toBe('Suspended')
     expect(getCellFilterValue(
       { apiVersion: 'postgresql.cnpg.io/v1', spec: { instances: 2 }, status: { instances: 2 } }, 'status', 'poolers',
-    )).toBe('Scheduled')
+    )).toBe('2 instances requested')
   })
 
   it('leaves a foreign CRD sharing the plural on the generic path', () => {
@@ -670,7 +695,7 @@ describe('an absent count is unknown, never zero', () => {
     expect(getCNPGPoolerStatus({ spec: { instances: 2 }, status: { instances: 0 } }))
       .toMatchObject({ text: 'Not Scheduled', level: 'unhealthy' })
     expect(getCNPGPoolerStatus({ spec: { instances: 2 }, status: { instances: 2 } }))
-      .toMatchObject({ text: 'Scheduled', level: 'healthy' })
+      .toMatchObject({ text: '2 instances requested', level: 'neutral' })
   })
 })
 
@@ -696,9 +721,9 @@ describe('paused Pooler', () => {
 
   it('only an explicit true pauses', () => {
     expect(getCNPGPoolerStatus({ spec: { instances: 2, pgbouncer: {} }, status: { instances: 2 } }))
-      .toMatchObject({ text: 'Scheduled', level: 'healthy' })
+      .toMatchObject({ text: '2 instances requested', level: 'neutral' })
     expect(getCNPGPoolerStatus({ spec: { instances: 2, pgbouncer: { paused: false } }, status: { instances: 2 } }))
-      .toMatchObject({ text: 'Scheduled', level: 'healthy' })
+      .toMatchObject({ text: '2 instances requested', level: 'neutral' })
     expect(isCNPGPoolerPaused({ spec: { pgbouncer: { paused: true } } })).toBe(true)
     expect(isCNPGPoolerPaused({ spec: {} })).toBe(false)
   })
@@ -752,9 +777,9 @@ describe('CNPG scheduled backup lateness', () => {
     expect(badge.text).toBe('Overdue')
   })
 
-  it('stays healthy inside the operator reconcile window', () => {
+  it('stays neutral inside the operator reconcile window', () => {
     const badge = getCNPGScheduledBackupStatus(sb(false, at(-1 * MIN), at(-24 * 60 * MIN)))
-    expect(badge.level).toBe('healthy')
+    expect(badge.level).toBe('neutral')
   })
 
   it('keeps suspended as a deliberate state, not a missed backup', () => {
@@ -768,7 +793,7 @@ describe('CNPG scheduled backup lateness', () => {
     // The two read from one test. Before this they disagreed: the badge said
     // Active while this field said overdue on the same row.
     const justPastDue = sb(false, at(-1 * MIN), at(-24 * 60 * MIN))
-    expect(getCNPGScheduledBackupStatus(justPastDue).level).toBe('healthy')
+    expect(getCNPGScheduledBackupStatus(justPastDue).level).toBe('neutral')
     expect(getCNPGScheduledBackupNextSchedule(justPastDue)).toBe('due now')
 
     const longPastDue = sb(false, at(-200 * 24 * 60 * MIN), at(-200 * 24 * 60 * MIN))
@@ -783,7 +808,7 @@ describe('CNPG scheduled backup lateness', () => {
 
   it('says nothing when the operator published no next-run time', () => {
     expect(getCNPGScheduledBackupNextSchedule(sb(false))).toBe('-')
-    expect(getCNPGScheduledBackupStatus(sb(false, undefined, at(-24 * 60 * MIN))).level).toBe('healthy')
+    expect(getCNPGScheduledBackupStatus(sb(false, undefined, at(-24 * 60 * MIN))).level).toBe('neutral')
   })
 })
 

package/src/components/resources/resource-utils-cnpg.ts

@@ -2,6 +2,9 @@
 
 import type { StatusBadge } from './resource-utils'
 import { healthColors, formatAge, formatDuration } from './resource-utils'
+import { cnpgBackupDeclaration, cnpgBarmanPlugin } from '../../utils/cnpg-backup'
+export { CNPG_BARMAN_PLUGIN_NAME } from '../../utils/cnpg-backup'
+
 import { parseGoTimeString } from '../../utils/parse-go-time'
 
 // ============================================================================
@@ -10,6 +13,11 @@ import { parseGoTimeString } from '../../utils/parse-go-time'
 
 export const CNPG_GROUP = 'postgresql.cnpg.io'
 
+export function getCNPGPostgresMajor(cluster: any): number | undefined {
+  const major = cluster?.status?.pgDataImageInfo?.majorVersion ?? cluster?.spec?.imageCatalogRef?.major
+  return typeof major === 'number' && Number.isInteger(major) && major > 0 ? major : undefined
+}
+
 /**
  * Exact API-group match for a resource's `apiVersion` ("group/version").
  *
@@ -56,7 +64,11 @@ export const CNPG_CLUSTER_PHASES_TRANSIENT = [
 /** Losing the primary — degraded now, self-resolving only if a replica can take over. */
 export const CNPG_CLUSTER_PHASES_FAILING = ['Failing over'] as const
 
-/** Reconciliation has stopped. These need a human; none of them self-heal. */
+/**
+ * Reconciliation is blocked. The operator keeps retrying every one of these;
+ * only the plugin phases can clear without anyone changing something (a plugin
+ * Pod that comes back). See cnpgBlockedPhaseExplanation.
+ */
 export const CNPG_CLUSTER_PHASES_TERMINAL = [
   'Cluster is unrecoverable and needs manual intervention',
   // Not in 1.27 or 1.28; added upstream after 1.28 (PhaseDefinitionInvalid).
@@ -135,6 +147,34 @@ export function getCNPGClusterDisplayState(phase: string): string {
 
 export type CNPGPhaseBucket = 'healthy' | 'transient' | 'failing' | 'terminal' | 'attention' | 'unknown'
 
+const CNPG_PLUGIN_BLOCKED_PHASES = new Set<string>([
+  'Cluster cannot proceed to reconciliation due to an unknown plugin being required',
+  'Cluster cannot proceed to reconciliation due to an error while interacting with plugins',
+])
+
+/**
+ * What a blocked phase means for whoever is on call, with the operator's own
+ * `status.phaseReason` when it set one. The operator requeues the plugin
+ * phases every 10–15 s, so they clear once the plugin loads and answers;
+ * the others keep failing until their cause is fixed; "unrecoverable" is the
+ * one upstream itself says needs manual intervention.
+ */
+export function cnpgBlockedPhaseExplanation(phase: string, phaseReason?: string): { title: string; message: string; body: string } {
+  const said = typeof phaseReason === 'string' ? phaseReason.trim() : ''
+  const reason = said ? ` The operator reports: ${/[.!?]$/.test(said) ? said : `${said}.`}` : ''
+  const out = (title: string, body: string) => ({ title, body: `${body}${reason}`, message: `${phase}. ${body}${reason}` })
+  if (phase === 'Cluster is unrecoverable and needs manual intervention') {
+    return out('Cluster is unrecoverable', 'The operator cannot bring it back by itself.')
+  }
+  if (CNPG_PLUGIN_BLOCKED_PHASES.has(phase)) {
+    return out(
+      'Reconciliation is blocked by a plugin',
+      'The operator retries every few seconds and continues once the plugin is loaded and answering, so a plugin Pod that is restarting clears on its own; check the operator and plugin logs if it does not.',
+    )
+  }
+  return out('Reconciliation is blocked', 'The operator keeps retrying, but this does not clear until its cause is fixed.')
+}
+
 export function classifyCNPGClusterPhase(phase: string): CNPGPhaseBucket {
   if (!phase) return 'unknown'
   if ((CNPG_CLUSTER_PHASES_HEALTHY as readonly string[]).includes(phase)) return 'healthy'
@@ -414,7 +454,6 @@ export function getCNPGClusterUpdateStrategy(resource: any): string {
   return resource.spec?.primaryUpdateStrategy || 'unsupervised'
 }
 
-export const CNPG_BARMAN_PLUGIN_NAME = 'barman-cloud.cloudnative-pg.io'
 
 /** The API group ObjectStore is served under. `objectstores` is a generic
  *  plural several operators ship, so every link to one has to be qualified —
@@ -438,20 +477,10 @@ export interface CNPGBarmanPlugin {
  * status.lastSuccessfulBackup / firstRecoverabilityPoint entirely.
  */
 export function getCNPGClusterBarmanPlugin(resource: any): CNPGBarmanPlugin | null {
-  const plugins = resource.spec?.plugins
-  if (!Array.isArray(plugins)) return null
-  const plugin = plugins.find(
-    (p: any) => p?.name === CNPG_BARMAN_PLUGIN_NAME && p?.enabled !== false
-  )
+  const plugin = cnpgBarmanPlugin(cnpgBackupDeclaration(resource))
   if (!plugin) return null
-  return {
-    name: plugin.name,
-    barmanObjectName: plugin.parameters?.barmanObjectName,
-    // ObjectStore keys the recovery window by the plugin's serverName when set,
-    // otherwise by the cluster name.
-    serverName: plugin.parameters?.serverName || resource.metadata?.name,
-    isWALArchiver: plugin.isWALArchiver === true,
-  }
+  const { name, barmanObjectName, serverName, isWALArchiver } = plugin
+  return { name, barmanObjectName, serverName, isWALArchiver }
 }
 
 export function getCNPGClusterBackupConfig(resource: any): {
@@ -518,7 +547,7 @@ export function getCNPGDeclarativeMessage(resource: any): string | undefined {
 export function getCNPGReclaimPolicy(resource: any): { value: string; destructive: boolean } {
   const spec = resource?.spec ?? {}
   const raw =
-    spec.databaseReclaimPolicy ?? spec.publicationReclaimPolicy ?? spec.subscriptionReclaimPolicy ?? 'retain'
+    spec.databaseReclaimPolicy ?? spec.publicationReclaimPolicy ?? spec.subscriptionReclaimPolicy ?? spec.databaseRoleReclaimPolicy ?? 'retain'
   return { value: raw, destructive: String(raw).toLowerCase() === 'delete' }
 }
 
@@ -933,15 +962,15 @@ export function getCNPGScheduledBackupStatus(resource: any): StatusBadge {
 
   // If we have a last schedule time, it's active
   if (resource.status?.lastScheduleTime) {
-    return { text: 'Active', color: healthColors.healthy, level: 'healthy' }
+    return { text: 'Enabled', color: healthColors.neutral, level: 'neutral' }
   }
 
   // Check if immediate flag is set and no schedule has run yet
   if (resource.spec?.immediate) {
-    return { text: 'Immediate', color: healthColors.healthy, level: 'healthy' }
+    return { text: 'Immediate run requested', color: healthColors.neutral, level: 'neutral' }
   }
 
-  return { text: 'Scheduled', color: healthColors.healthy, level: 'healthy' }
+  return { text: 'Enabled · not run yet', color: healthColors.neutral, level: 'neutral' }
 }
 
 export function getCNPGScheduledBackupCluster(resource: any): string {
@@ -1030,8 +1059,10 @@ export function getCNPGPoolerStatus(resource: any): StatusBadge {
     return { text: 'Paused', color: healthColors.degraded, level: 'degraded' }
   }
 
+  // status.instances counts scheduled Pods only; readiness lives on the
+  // Pooler's Deployment, so this badge must not read as healthy.
   if (desired > 0 && scheduled >= desired) {
-    return { text: 'Scheduled', color: healthColors.healthy, level: 'healthy' }
+    return { text: `${desired} instance${desired === 1 ? '' : 's'} requested`, color: healthColors.neutral, level: 'neutral' }
   }
 
   return { text: 'Unknown', color: healthColors.unknown, level: 'unknown' }

package/src/components/resources/resource-utils-contour.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { getContourSecretReference, getHTTPProxyTLSSecret } from './resource-utils-contour'
+
+const proxy = (secretName?: string) => ({
+  metadata: { namespace: 'shop' },
+  spec: { virtualhost: { fqdn: 'shop.example.com', tls: secretName === undefined ? {} : { secretName } } },
+})
+
+describe('getHTTPProxyTLSSecret', () => {
+  it('resolves a bare name in the proxy namespace', () => {
+    expect(getHTTPProxyTLSSecret(proxy('cert'))).toEqual({ namespace: 'shop', name: 'cert' })
+  })
+  it('resolves a delegated namespace/name', () => {
+    expect(getHTTPProxyTLSSecret(proxy('certs/wildcard'))).toEqual({ namespace: 'certs', name: 'wildcard' })
+  })
+  it('defaults an empty namespace to the proxy namespace', () => {
+    expect(getHTTPProxyTLSSecret(proxy('/cert'))).toEqual({ namespace: 'shop', name: 'cert' })
+  })
+  it('rejects names that cannot identify a Kubernetes Secret', () => {
+    expect(getHTTPProxyTLSSecret(proxy('certs/a/b'))).toBeNull()
+  })
+  it('returns null without a secret', () => {
+    expect(getHTTPProxyTLSSecret(proxy())).toBeNull()
+  })
+})
+
+interface ReferenceCase {
+  case: string
+  raw: string
+  defaultNamespace: string
+  valid: boolean
+  namespace?: string
+  name?: string
+}
+const referenceCases: ReferenceCase[] = JSON.parse(readFileSync(new URL('../../../../../pkg/configrefs/testdata/contour_secret_refs.json', import.meta.url), 'utf8'))
+
+describe('shared Go/TS Contour reference contract', () => {
+  it.each(referenceCases)('$case', (tc) => {
+    const expected = tc.valid ? { namespace: tc.namespace, name: tc.name } : undefined
+    expect(getContourSecretReference(tc.raw, tc.defaultNamespace)).toEqual(expected)
+    expect(getHTTPProxyTLSSecret({ ...proxy(tc.raw), metadata: { namespace: tc.defaultNamespace } })).toEqual(expected ?? null)
+  })
+})

package/src/components/resources/resource-utils-contour.ts

@@ -1,3 +1,5 @@
+import { validateRFC1123Label, validateRFC1123Subdomain } from '../../utils/validators'
+
 // Contour HTTPProxy CRD utility functions for resource list cells and detail renderers
 
 export function getHTTPProxyFQDN(resource: any): string {
@@ -32,3 +34,17 @@ export function getHTTPProxyIncludeCount(resource: any): number {
 export function hasHTTPProxyTLS(resource: any): boolean {
   return !!resource.spec?.virtualhost?.tls
 }
+
+export function getHTTPProxyTLSSecret(resource: any): { namespace: string; name: string } | null {
+  const raw: string | undefined = resource.spec?.virtualhost?.tls?.secretName
+  return raw ? getContourSecretReference(raw, resource.metadata?.namespace ?? '') ?? null : null
+}
+
+/** Contour's delegated TLS secret form is namespace/name. */
+export function getContourSecretReference(raw: string, defaultNamespace: string): { name: string; namespace: string } | undefined {
+  const parts = raw.split('/')
+  const namespace = parts.length === 1 ? defaultNamespace : parts[0] || defaultNamespace
+  const name = parts.length === 1 ? parts[0] : parts[1]
+  if (parts.length > 2 || !validateRFC1123Label(namespace).valid || !validateRFC1123Subdomain(name).valid) return undefined
+  return { name, namespace }
+}

package/src/components/resources/resource-utils-istio.ts

@@ -8,13 +8,17 @@ import { pluralize } from '../../utils/pluralize'
 // SHARED HELPERS
 // ============================================================================
 
-function parseIstioHost(host: string): { name: string; namespace: string } {
-  // Istio hosts can be: "reviews", "reviews.default", "reviews.default.svc.cluster.local"
+// FQDNs require the registry domain supplied by the producer. Undotted
+// names use Istio's documented namespace-relative expansion.
+export function resolveIstioServiceHost(host: string, defaultNamespace: string, serviceDomain = ''): { name: string; namespace: string } | undefined {
+  const label = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/
   const parts = host.split('.')
-  return {
-    name: parts[0] || host,
-    namespace: parts.length >= 2 ? parts[1] : '',
+  if (parts.length === 1 && host.length <= 63 && label.test(host)) return { name: host, namespace: defaultNamespace }
+  if (serviceDomain && host.endsWith(`.svc.${serviceDomain}`)) {
+    const service = host.slice(0, -(`.svc.${serviceDomain}`.length)).split('.')
+    if (service.length === 2 && service.every(part => part.length <= 63 && label.test(part))) return { name: service[0], namespace: service[1] }
   }
+  return undefined
 }
 
 // ============================================================================
@@ -103,16 +107,16 @@ export function getVirtualServiceTlsRoutes(resource: any): any[] {
   return resource.spec?.tls || []
 }
 
-export function getVirtualServiceDestinations(resource: any): Array<{ host: string; namespace: string; port?: number; subset?: string; weight?: number }> {
+export function getVirtualServiceDestinations(resource: any, serviceDomain = ''): Array<{ host: string; namespace: string; port?: number; subset?: string; weight?: number }> {
   const destinations: Array<{ host: string; namespace: string; port?: number; subset?: string; weight?: number }> = []
   const httpRoutes = resource.spec?.http || []
   for (const route of httpRoutes) {
     for (const dest of (route.route || [])) {
       if (dest.destination?.host) {
-        const parsed = parseIstioHost(dest.destination.host)
+        const parsed = resolveIstioServiceHost(dest.destination.host, resource.metadata?.namespace || '', serviceDomain)
         destinations.push({
           host: dest.destination.host,
-          namespace: parsed.namespace || resource.metadata?.namespace || '',
+          namespace: parsed?.namespace || '',
           port: dest.destination.port?.number,
           subset: dest.destination.subset,
           weight: dest.weight,

package/src/components/resources/resource-utils-knative.ts

@@ -1,3 +1,21 @@
+import { apiVersionToGroup, kindToPluralWithGroup } from '../../utils/navigation'
+import type { ResourceRef } from '../../types/core'
+
+/** KReference records apiVersion or an explicit nonempty group. */
+export function getKnativeReference(reference: any, defaultNamespace: string): ResourceRef | undefined {
+  const version = reference?.apiVersion
+  let group = reference?.group
+  if (typeof version === 'string' && version) {
+    const parts = version.split('/')
+    if (parts.length > 2 || parts.some(part => !part)) return undefined
+    const observed = apiVersionToGroup(version)
+    if (group && group !== observed) return undefined
+    group = observed
+  } else if (typeof group !== 'string' || !group) return undefined
+  if (typeof reference?.kind !== 'string' || !reference.kind || typeof reference?.name !== 'string' || !reference.name) return undefined
+  return { group, kind: kindToPluralWithGroup(reference.kind, group), name: reference.name, namespace: reference.namespace || defaultNamespace }
+}
+
 // KNative CRD utility functions
 
 import type { StatusBadge } from './resource-utils'

package/src/components/resources/resource-utils.ts

@@ -86,12 +86,57 @@ export interface PodProblem {
  * misses. Presentation-only; the backend `scheduling` issue source does the
  * structured decomposition + node-label resolution (e.g. naming arm64).
  */
-export function summarizeSchedulerMessage(message?: string): string {
+export function summarizeSchedulerMessage(message?: string, options: { plain?: boolean } = {}): string {
   if (!message) return ''
   let m = message.split('. preemption:')[0].split(' preemption:')[0].trim()
-  const colon = m.indexOf(':')
-  if (colon >= 0) m = m.slice(colon + 1).trim()
-  return m.replace(/\.\s*$/, '').trim()
+  if (options.plain) {
+    m = m.replace(/^(?:Pod cannot be scheduled:\s*)?(?:Unschedulable:\s*)?(?:0\/\d+ nodes are available:\s*)?/i, '')
+    // Schedulers with dynamic resource allocation append this after the node reasons.
+    m = m.replace(/no new claims to deallocate,?/i, '').trim()
+  } else {
+    const colon = m.indexOf(':')
+    if (colon >= 0) m = m.slice(colon + 1).trim()
+  }
+  m = m.replace(/\.\s*$/, '').trim()
+  if (!options.plain) return m
+  const total = /0\/(\d+) nodes (?:are )?available/.exec(message)?.[1]
+  const causes: [RegExp, string][] = [
+    [/^(\d+) (?:Too many pods|(?:node\(s\) )?insufficient pods)(?: \(0\/\d+ nodes available\))?$/i, 'have reached their Pod limit'],
+    [/^(\d+) (?:node\(s\) )?Insufficient cpu(?: \(0\/\d+ nodes available\))?$/i, 'do not have enough CPU'],
+    [/^(\d+) (?:node\(s\) )?Insufficient memory(?: \(0\/\d+ nodes available\))?$/i, 'do not have enough memory'],
+    [/^(\d+) node\(s\) (?:didn.t match Pod.s node affinity\/selector|node affinity\/selector mismatch)(?: \(0\/\d+ nodes available\))?$/i, 'do not match the Pod’s node affinity or selector'],
+    [/^(\d+) node\(s\) (?:had )?untolerated taint(?:\(s\))?(?: \{[^}]*\}| [^\s]+)?(?: \(0\/\d+ nodes available\))?$/i, 'have taints the Pod does not tolerate'],
+    [/^(\d+) node\(s\) (?:had )?volume node[- ]affinity conflict(?: \(0\/\d+ nodes available\))?$/i, 'do not match the volume’s node affinity'],
+  ]
+  return splitSchedulerClauses(m).filter((part) => part.trim()).map((part) => {
+    const clause = part.trim()
+    for (const [pattern, cause] of causes) {
+      const count = pattern.exec(clause)?.[1]
+      if (count) return `${count === '1' ? '1 node' : count === total && count === '2' ? 'both nodes' : count === total ? 'all nodes' : `${count} nodes`} ${count === '1' ? cause.replace(/^have /, 'has ').replace(/^do /, 'does ') : cause}`
+    }
+    if (/^(?:pod has )?unbound (?:immediate )?PersistentVolumeClaims?(?:\s*\(0\/\d+ nodes available\))?$/i.test(clause)) return 'a required volume claim is not bound'
+    return clause
+  }).join('; ')
+}
+
+// Splits on commas and semicolons, except where the next bracket ahead closes:
+// scheduler taints and resolved node labels can contain comma-separated values.
+// One pass from the end keeps long messages linear.
+function splitSchedulerClauses(m: string): string[] {
+  const parts: string[] = []
+  let end = m.length
+  let insideBrackets = false
+  for (let i = m.length - 1; i >= 0; i--) {
+    const c = m[i]
+    if (c === ']' || c === '}') insideBrackets = true
+    else if (c === '[' || c === '{') insideBrackets = false
+    else if ((c === ',' || c === ';') && !insideBrackets) {
+      parts.push(m.slice(i + 1, end))
+      end = i
+    }
+  }
+  parts.push(m.slice(0, end))
+  return parts.reverse()
 }
 
 /** Tailwind classes for severity dot indicators (used in tooltips and alert banners) */
@@ -1854,7 +1899,7 @@ export function getGatewayClassDescription(gc: any): string {
 }
 
 // ============================================================================
-// GATEWAY API ROUTE UTILITIES (shared by HTTPRoute, GRPCRoute, TCPRoute, TLSRoute)
+// GATEWAY API ROUTE UTILITIES (shared by HTTPRoute, GRPCRoute, TCPRoute, TLSRoute, UDPRoute)
 // ============================================================================
 
 const GATEWAY_API_GROUP = 'gateway.networking.k8s.io'
@@ -2264,6 +2309,37 @@ export function parseColumnFilterExcludes(filtersParam: string | null): Record<s
   return excludes
 }
 
+/** The Resources list's own filter params in the URL (the kind is in the path, `apiGroup` beside it). */
+export const RESOURCE_LIST_FILTER_PARAMS = ['search', 'regex', 'filters', 'problems', 'labels', 'ownerKind', 'ownerName', 'showInactive'] as const
+
+/** The per-kind filters in a query string: what a kind switch resets or restores. */
+export function kindFiltersFromSearch(search: string | undefined) {
+  const params = new URLSearchParams(search ?? '')
+  const filtersParam = params.get('filters')
+  return {
+    columnFilters: parseColumnFilters(filtersParam),
+    columnFilterExcludes: parseColumnFilterExcludes(filtersParam),
+    problemFilters: params.get('problems')?.split(',').filter(Boolean) || [],
+  }
+}
+
+/** The `filters` param value. Drops an exclude flag on a column with no active values. */
+export function columnFiltersParam(colFilters: Record<string, string[]>, colExcludes: Record<string, boolean>): string {
+  const activeExcludes = Object.fromEntries(
+    Object.entries(colExcludes).filter(([k, on]) => on && (colFilters[k]?.length ?? 0) > 0)
+  )
+  return serializeColumnFilters(colFilters, activeExcludes)
+}
+
+/** Inverse of kindFiltersFromSearch: the `filters` + `problems` query, '' when none. */
+export function kindFiltersToSearch(f: ReturnType<typeof kindFiltersFromSearch>): string {
+  const params = new URLSearchParams()
+  const filters = columnFiltersParam(f.columnFilters, f.columnFilterExcludes)
+  if (filters) params.set('filters', filters)
+  if (f.problemFilters.length > 0) params.set('problems', f.problemFilters.join(','))
+  return params.toString()
+}
+
 // Split a single "col[:operator]:values" pair into its decoded key, values, and
 // whether the explicit exclude operator was present. The first literal colon
 // delimits key from the rest (keys are encoded, so their own colons don't
@@ -2342,7 +2418,7 @@ export function getCellFilterValue(resource: any, column: string, kind: string):
       if (kindLower === 'hpas' || kindLower === 'horizontalpodautoscalers') return getHPAStatus(resource).text
       if (kindLower === 'gateways') return getGatewayStatus(resource).text
       if (kindLower === 'gatewayclasses') return getGatewayClassStatus(resource).text
-      if (['httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes'].includes(kindLower)) return getRouteStatus(resource).text
+      if (['httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes', 'udproutes'].includes(kindLower)) return getRouteStatus(resource).text
       if (kindLower === 'sealedsecrets') return getSealedSecretStatus(resource).text
       if (kindLower === 'poddisruptionbudgets') return getPDBStatus(resource).text
       if (kindLower === 'applications') return getArgoApplicationStatus(resource).text

package/src/components/resources/rules-column-width.test.ts

@@ -27,7 +27,7 @@ function columnSetBody(key: string): string {
 // in the sortable-key list, so neither affordance ever renders on it. w-20
 // (80px) leaves 47px.
 describe('Rules column width', () => {
-  const kinds = ['kyvernopolicies', 'clusterpolicies', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes']
+  const kinds = ['kyvernopolicies', 'clusterpolicies', 'httproutes', 'grpcroutes', 'tcproutes', 'tlsroutes', 'udproutes']
 
   it.each(kinds)('%s Rules column is at least w-20', (kind) => {
     const rules = columnSetBody(kind).match(/\{ key: 'rules'.*\}/)

package/src/components/resources/summarize-scheduler-message.test.ts

@@ -28,3 +28,33 @@ describe('summarizeSchedulerMessage', () => {
     expect(summarizeSchedulerMessage(undefined)).toBe('')
   })
 })
+
+it.each([
+  ['0/2 nodes are available: 2 Too many pods.', 'both nodes have reached their Pod limit'],
+  ['Unschedulable: 0/2 nodes are available: 2 Too many pods.', 'both nodes have reached their Pod limit'],
+  ['2 node(s) insufficient pods (0/2 nodes available)', 'both nodes have reached their Pod limit'],
+  ['0/1 nodes are available: 1 Insufficient cpu.', '1 node does not have enough CPU'],
+  ['0/3 nodes are available: 3 Insufficient cpu.', 'all nodes do not have enough CPU'],
+  ['0/2 nodes are available: 2 Insufficient memory, 2 Too many pods.', 'both nodes do not have enough memory; both nodes have reached their Pod limit'],
+  ["0/2 nodes are available: 2 node(s) didn’t match Pod’s node affinity/selector.", 'both nodes do not match the Pod’s node affinity or selector'],
+  ['1 node(s) had untolerated taint {dedicated: db}.', '1 node has taints the Pod does not tolerate'],
+  ['0/2 nodes are available: 1 node(s) had untolerated taint {dedicated: db}.', '1 node has taints the Pod does not tolerate'],
+  ['0/2 nodes are available: pod has unbound immediate PersistentVolumeClaims.', 'a required volume claim is not bound'],
+  ['1 node(s) untolerated taint dedicated=db, 1 node(s) insufficient cpu (0/2 nodes available)', '1 node has taints the Pod does not tolerate; 1 node does not have enough CPU'],
+  ['2 node(s) node affinity/selector mismatch (0/2 nodes available)', 'both nodes do not match the Pod’s node affinity or selector'],
+  ['unbound PersistentVolumeClaim, 1 node(s) volume node-affinity conflict (0/2 nodes available)', 'a required volume claim is not bound; 1 node does not match the volume’s node affinity'],
+  ['0/2 nodes are available: 1 node(s) had volume node affinity conflict, 1 Insufficient memory.', '1 node does not match the volume’s node affinity; 1 node does not have enough memory'],
+  ['no node has kubernetes.io/arch=arm64 — 2 node(s) carry kubernetes.io/arch: [amd64]; 1 node(s) insufficient cpu (0/3 nodes available)', 'no node has kubernetes.io/arch=arm64 — 2 node(s) carry kubernetes.io/arch: [amd64]; 1 node does not have enough CPU'],
+  ['custom scheduler says 2 Insufficient cpu, 1 Insufficient memory', 'custom scheduler says 2 Insufficient cpu; 1 node does not have enough memory'],
+  ['1 node(s) pod anti-affinity conflict, 1 node(s) insufficient memory, no node has zone=west — 2 node(s) carry zone: [east, north]', '1 node(s) pod anti-affinity conflict; 1 node does not have enough memory; no node has zone=west — 2 node(s) carry zone: [east, north]'],
+  ["0/14 nodes are available: 6 node(s) had untolerated taint(s), 8 node(s) didn't match Pod's node affinity/selector. no new claims to deallocate, preemption: 0/14 nodes are available: 14 Preemption is not helpful for scheduling.", '6 nodes have taints the Pod does not tolerate; 8 nodes do not match the Pod’s node affinity or selector'],
+])('offers a plain summary additively for %s', (raw, expected) => {
+  expect(summarizeSchedulerMessage(raw, { plain: true })).toBe(expected)
+})
+
+it('summarizes a very long, separator-heavy message in linear time', () => {
+  const message = '0/2 nodes are available: ' + '1 node(s) custom reason, '.repeat(10_000) + '2 Insufficient cpu.'
+  const summary = summarizeSchedulerMessage(message, { plain: true })
+  expect(summary.split('; ')).toHaveLength(10_001)
+  expect(summary.endsWith('both nodes do not have enough CPU')).toBe(true)
+})