@skyhook-io/k8s-ui 1.18.0 → 1.18.2

package/src/components/resources/resource-utils-crossplane.ts

@@ -7,6 +7,8 @@
 
 import type { StatusBadge } from './resource-utils'
 import { healthColors } from './resource-utils'
+import { getGenericResourceStatus, type GenericStatus } from './generic-status'
+import type { ConditionTone } from '../ui/drawer-components'
 
 interface CrossplaneCondition {
   type: string
@@ -138,15 +140,37 @@ export function getDeletionPolicy(data: any): string | null {
   return data?.spec?.crossplane?.deletionPolicy ?? data?.spec?.deletionPolicy ?? null
 }
 
-/**
- * Crossplane convention: setting `crossplane.io/paused: "true"` on any MR/XR/Claim
- * stops the provider from reconciling it. Universal across every provider, so
- * surfacing it as a chip on every Crossplane resource is high-leverage.
- */
 export function isCrossplanePaused(data: any): boolean {
   return data?.metadata?.annotations?.['crossplane.io/paused'] === 'true'
 }
 
+export function isExpectedCrossplanePauseCondition(data: any, condition: CrossplaneCondition): boolean {
+  return isCrossplanePaused(data) && condition?.type === 'Synced'
+    && condition.status === 'False' && condition.reason === 'ReconcilePaused'
+}
+
+export function getCrossplanePauseState(data: any): 'requested' | 'acknowledged' | null {
+  if (!isCrossplanePaused(data)) return null
+  const conditions = data?.status?.conditions
+  return Array.isArray(conditions) && conditions.some((condition: CrossplaneCondition) => isExpectedCrossplanePauseCondition(data, condition))
+    ? 'acknowledged' : 'requested'
+}
+
+export function getCrossplaneIndependentStatus(data: any): GenericStatus | null {
+  if (getCrossplanePauseState(data) !== 'acknowledged') return getGenericResourceStatus(data)
+  return getGenericResourceStatus({
+    ...data,
+    status: {
+      ...data.status,
+      conditions: data.status.conditions.filter((condition: CrossplaneCondition) => !isExpectedCrossplanePauseCondition(data, condition)),
+    },
+  })
+}
+
+export function getCrossplaneConditionTone(data: any, condition: CrossplaneCondition): ConditionTone | undefined {
+  return isExpectedCrossplanePauseCondition(data, condition) ? 'neutral' : undefined
+}
+
 /**
  * Walk ownerReferences to find the parent Composite for a Managed Resource.
  * Crossplane sets exactly one ownerRef pointing at the composing XR. Returns
@@ -186,16 +210,24 @@ export function getCrossplaneStatus(data: any): StatusBadge {
   }
   const ready = findCondition(data, 'Ready')
   const synced = findCondition(data, 'Synced')
+  const independent = !isManagedResource(data) && !isComposite(data) && getCrossplanePauseState(data) === 'acknowledged'
+    ? getCrossplaneIndependentStatus(data) : null
+  if (independent && (independent.tone === 'unhealthy' || independent.tone === 'alert' || independent.tone === 'degraded')) {
+    return { text: independent.text, color: healthColors[independent.tone], level: independent.tone }
+  }
 
   if (!ready && !synced) {
     return { text: 'Pending', color: healthColors.neutral, level: 'neutral' }
   }
-  if (synced?.status === 'False') {
-    return { text: 'Out of sync', color: healthColors.alert, level: 'alert' }
+  if (synced?.status === 'False' && !isExpectedCrossplanePauseCondition(data, synced)) {
+    return { text: synced.reason === 'ReconcilePaused' ? 'ReconcilePaused' : 'Out of sync', color: healthColors.alert, level: 'alert' }
   }
   if (ready?.status === 'False') {
     return { text: ready.reason || 'Not ready', color: healthColors.unhealthy, level: 'unhealthy' }
   }
+  if (getCrossplanePauseState(data) === 'acknowledged') {
+    return { text: ready?.status === 'True' ? 'Ready (reported)' : 'Readiness unknown', color: healthColors.neutral, level: 'neutral' }
+  }
   if (ready?.status === 'True' && synced?.status === 'True') {
     return { text: 'Ready', color: healthColors.healthy, level: 'healthy' }
   }
@@ -211,8 +243,12 @@ export function getCrossplaneStatus(data: any): StatusBadge {
  * detail views.
  */
 export function getCrossplaneStatusReason(data: any): string | null {
+  const independent = !isManagedResource(data) && !isComposite(data) && getCrossplanePauseState(data) === 'acknowledged'
+    ? getCrossplaneIndependentStatus(data) : null
+  if (independent && (independent.tone === 'unhealthy' || independent.tone === 'alert' || independent.tone === 'degraded')) return independent.reason ?? null
   const ready = findCondition(data, 'Ready')
-  const synced = findCondition(data, 'Synced')
+  const reportedSynced = findCondition(data, 'Synced')
+  const synced = reportedSynced && !isExpectedCrossplanePauseCondition(data, reportedSynced) ? reportedSynced : undefined
   if (synced && synced.status !== 'True' && synced.message) return synced.message
   if (ready && ready.status !== 'True' && ready.message) return ready.message
   if (synced && synced.status !== 'True' && synced.reason) return synced.reason

package/src/components/resources/resource-utils-flagger.test.tsx

@@ -0,0 +1,82 @@
+import { issueTitle } from '../issues/severity'
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { renderToString } from 'react-dom/server'
+import { getFlaggerCanaryStatus, getFlaggerStrategy, getFlaggerTargetRef, getFlaggerAutoscalerRef, getFlaggerMetricTemplateRef } from './resource-utils-flagger'
+import { getGenericResourceStatus } from './generic-status'
+import { getCellFilterValue } from './resource-utils'
+import { ResourceRendererDispatch, getResourceStatus } from '../shared/ResourceRendererDispatch'
+
+const vectors = JSON.parse(readFileSync(new URL('../../../../../pkg/health/testdata/flagger.json', import.meta.url), 'utf8'))
+describe('Flagger recorded rollout state across surfaces', () => {
+  it('names the failed operation in Issues', () => {
+    expect(issueTitle({ category: 'operator_condition_fail', reason: 'FlaggerCanaryFailed' })).toBe('Canary rollout failed')
+  })
+  for (const vector of vectors) it(vector.name, () => {
+    expect(getFlaggerCanaryStatus(vector.object)).toMatchObject({ text: vector.text, level: vector.level })
+    expect(getGenericResourceStatus(vector.object)).toMatchObject({ text: vector.text, tone: vector.level })
+    expect(getResourceStatus('canaries', vector.object)).toMatchObject({ text: vector.text, level: vector.level })
+    expect(getCellFilterValue(vector.object, 'status', 'canaries')).toBe(vector.text)
+  })
+})
+
+describe('Flagger controller reference semantics', () => {
+  const resource = (spec: any) => ({ metadata: { namespace: 'application' }, spec })
+  it('resolves native targets with the controller factory, including the Knative Service collision', () => {
+    expect(getFlaggerTargetRef(resource({ targetRef: { kind: 'Deployment', apiVersion: 'foreign.example/v1', name: 'app' } }))).toMatchObject({ group: 'apps', name: 'app', namespace: 'application' })
+    expect(getFlaggerTargetRef(resource({ targetRef: { kind: 'Service', apiVersion: 'serving.knative.dev/v1', name: 'app' } }))).toMatchObject({ group: 'serving.knative.dev' })
+    expect(getFlaggerTargetRef(resource({ targetRef: { kind: 'Service', apiVersion: 'other.example/v1', name: 'app' } }))).toMatchObject({ group: '' })
+    expect(getFlaggerTargetRef(resource({ targetRef: { kind: 'FutureKind', name: 'app' } }))).toBeNull()
+  })
+  it('links exact supported scalers and always uses the typed MetricTemplate client', () => {
+    expect(getFlaggerAutoscalerRef(resource({ autoscalerRef: { kind: 'HorizontalPodAutoscaler', name: 'app' } }))).toMatchObject({ group: 'autoscaling', namespace: 'application' })
+    expect(getFlaggerAutoscalerRef(resource({ autoscalerRef: { kind: 'ScaledObject', name: 'app' } }))).toMatchObject({ group: 'keda.sh' })
+    expect(getFlaggerMetricTemplateRef(resource({}), { templateRef: { apiVersion: 'ignored.example/v1', kind: 'Ignored', name: 'latency', namespace: 'monitoring' } })).toMatchObject({ group: 'flagger.app', name: 'latency', namespace: 'monitoring' })
+    expect(getFlaggerMetricTemplateRef(resource({}), { templateRef: { name: 'latency' } })).toMatchObject({ namespace: 'application' })
+    expect(getFlaggerMetricTemplateRef(resource({}), { name: 'request-success-rate' })).toBeNull()
+  })
+  it('distinguishes strategies, including the actually served deprecated analysis field', () => {
+    expect(getFlaggerStrategy(resource({ analysis: { iterations: 3 } }))).toBe('Blue/green')
+    expect(getFlaggerStrategy(resource({ analysis: { iterations: 3, match: [{}] } }))).toBe('A/B testing')
+    expect(getFlaggerStrategy(resource({ canaryAnalysis: { iterations: 3, mirror: true } }))).toBe('Blue/green with mirroring')
+    expect(getFlaggerStrategy(resource({ analysis: { stepWeight: 10 } }))).toBe('Canary')
+  })
+})
+
+describe('Flagger drawer identity and useful states', () => {
+  function render(apiVersion: string, kind: string, spec = {}, status = {}) {
+    return renderToString(<ResourceRendererDispatch resource={{ kind: kind === 'Canary' ? 'canaries' : 'metrictemplates', namespace: 'test', name: 'test' }} data={{ apiVersion, kind, metadata: { name: 'test', namespace: 'test' }, spec, status }} onCopy={() => {}} copied={null} showCommonSections={false} />)
+  }
+  it('preserves zero reported weight, failure under suspension, and keeps built-in metrics distinct', () => {
+    const html = render('flagger.app/v1beta1', 'Canary', { suspend: true, analysis: { stepWeight: 10, metrics: [{ name: 'request-success-rate' }, { name: 'custom', query: 'sensitive-inline-query' }] } }, { phase: 'Failed', canaryWeight: 0 })
+    expect(html).toContain('0%')
+    expect(html).toContain('Failed')
+    expect(html).toContain('Built-in provider metric')
+    expect(html).toContain('Inline query')
+    expect(html).toContain('sensitive-inline-query')
+  })
+  it('does not show weight for blue/green or provider headers in native details', () => {
+    expect(render('flagger.app/v1beta1', 'Canary', { analysis: { iterations: 2 } }, { canaryWeight: 10 })).not.toContain('Reported canary weight')
+    expect(render('flagger.app/v1beta1', 'MetricTemplate', { provider: { type: 'prometheus', headers: { 'X-Key': 'private-value' } }, query: 'vector(1)' })).not.toContain('private-value')
+  })
+  it('shows the controller-default rollout hook when type is omitted', () => {
+    const html = render('flagger.app/v1beta1', 'Canary', { analysis: { webhooks: [{ name: 'load-test' }, { name: 'approve', type: 'confirm-rollout' }] } }, { phase: 'Waiting' })
+    expect(html).toContain('load-test')
+    expect(html).toContain('rollout')
+    expect(html).toContain('approve')
+    expect(html).toContain('confirm-rollout')
+  })
+  it('describes an active confirmation wait only while not suspended', () => {
+    const analysis = { webhooks: [{ name: 'approve', type: 'confirm-rollout' }] }
+    expect(render('flagger.app/v1beta1', 'Canary', { analysis }, { phase: 'Waiting' })).toContain('Flagger is waiting for a confirmation hook')
+    const suspended = render('flagger.app/v1beta1', 'Canary', { suspend: true, analysis }, { phase: 'Waiting' })
+    expect(suspended).not.toContain('Flagger is waiting for a confirmation hook')
+    expect(suspended).toContain('approve')
+    expect(suspended).toContain('Recorded phase')
+  })
+  for (const kind of ['Canary', 'MetricTemplate']) it(`keeps foreign ${kind} generic`, () => {
+    const html = render('other.example/v1', kind, { custom: 'generic-visible' })
+    expect(html).toContain('generic-visible')
+    expect(html).not.toContain(kind === 'Canary' ? 'Canary Rollout' : 'Metric Provider')
+  })
+})

package/src/components/resources/resource-utils-flagger.ts

@@ -0,0 +1,76 @@
+import { isApiGroup } from './resource-utils-cnpg'
+import type { ResourceRef } from '../../types'
+import { objectReferenceToResourceRef } from '../../utils/navigation'
+import type { StatusBadge } from './resource-utils'
+import { healthColors } from './resource-utils'
+
+export function getFlaggerCanaryStatus(data: any): StatusBadge {
+  const phase = data.status?.phase
+  let text = phase || 'Not reported'
+  let level: StatusBadge['level'] = 'unknown'
+  if (phase === 'Failed') level = 'unhealthy'
+  else if (!phase && data.spec?.suspend === true) { text = 'Suspend requested'; level = 'neutral' }
+  else if (phase === 'Succeeded') level = data.spec?.suspend === true ? 'neutral' : 'healthy'
+  else if (['Initializing', 'Initialized', 'Waiting', 'Progressing', 'WaitingPromotion', 'Promoting', 'Finalising', 'Terminating', 'Terminated'].includes(phase)) level = 'neutral'
+  return { text, level, color: healthColors[level] }
+}
+
+// Both fields exist in the served v1beta1 schema. The controller's GetAnalysis
+// explicitly prefers analysis and still accepts deprecated canaryAnalysis.
+export function getFlaggerAnalysis(data: any): any {
+  return data.spec?.analysis ?? data.spec?.canaryAnalysis ?? {}
+}
+
+export function getFlaggerStrategy(data: any): string {
+  const analysis = getFlaggerAnalysis(data)
+  if (analysis.iterations > 0) {
+    if (analysis.match?.length > 0) return 'A/B testing'
+    return analysis.mirror ? 'Blue/green with mirroring' : 'Blue/green'
+  }
+  return analysis.mirror ? 'Canary with mirroring' : 'Canary'
+}
+
+// Match the pinned controller factory: it chooses its native clients by kind,
+// not arbitrary targetRef.apiVersion (except the exact Knative Service case).
+export function getFlaggerTargetRef(data: any): ResourceRef | null {
+  const target = data.spec?.targetRef
+  if (!target?.name) return null
+  let apiVersion: string
+  if (target.kind === 'Deployment' || target.kind === 'DaemonSet') apiVersion = 'apps/v1'
+  else if (target.kind === 'Service') apiVersion = target.apiVersion === 'serving.knative.dev/v1' ? target.apiVersion : 'v1'
+  else return null
+  return objectReferenceToResourceRef({ ...target, apiVersion, namespace: data.metadata?.namespace })
+}
+
+export function getFlaggerAutoscalerRef(data: any): ResourceRef | null {
+  const scaler = data.spec?.autoscalerRef
+  const apiVersion = scaler?.kind === 'HorizontalPodAutoscaler' ? 'autoscaling/v2' : scaler?.kind === 'ScaledObject' ? 'keda.sh/v1alpha1' : null
+  return apiVersion ? objectReferenceToResourceRef({ ...scaler, apiVersion, namespace: data.metadata?.namespace }) : null
+}
+
+// scheduler_metrics.go reads only templateRef.name/namespace through its typed
+// MetricTemplate client. apiVersion/kind are ignored, so do not link elsewhere.
+export function getFlaggerMetricTemplateRef(data: any, metric: any): ResourceRef | null {
+  return metric.templateRef?.name ? objectReferenceToResourceRef({ apiVersion: 'flagger.app/v1beta1', kind: 'MetricTemplate', name: metric.templateRef.name, namespace: metric.templateRef.namespace || data.metadata?.namespace }) : null
+}
+
+export function getFlaggerColumnValue(data: any, column: string): string | undefined {
+  if (!isApiGroup(data?.apiVersion, 'flagger.app')) return undefined
+  if (data.kind === 'Canary') {
+    switch (column) {
+      case 'status': return getFlaggerCanaryStatus(data).text
+      case 'strategy': return getFlaggerStrategy(data)
+      case 'target': return data.spec?.targetRef?.name ? `${data.spec.targetRef.kind}/${data.spec.targetRef.name}` : ''
+      case 'canaryWeight': return getFlaggerAnalysis(data).iterations > 0 ? 'Not weighted' : data.status?.canaryWeight != null ? `${data.status.canaryWeight}%` : 'Not reported'
+      case 'suspended': return data.spec?.suspend === true ? 'Yes' : 'No'
+    }
+  }
+  if (data.kind === 'MetricTemplate') {
+    switch (column) {
+      case 'status': return 'Configured'
+      case 'provider': return data.spec?.provider?.type ?? ''
+      case 'address': return data.spec?.provider?.address ?? ''
+    }
+  }
+  return undefined
+}

package/src/components/resources/resource-utils-opentelemetry.test.tsx

@@ -0,0 +1,74 @@
+import { describe, expect, it } from 'vitest'
+import { readFileSync } from 'node:fs'
+import { renderToString } from 'react-dom/server'
+import { getCollectorPipelines, getOpenTelemetryCollectorStatus, getOpenTelemetryInstrumentationStatus } from './resource-utils-opentelemetry'
+import { getGenericResourceStatus } from './generic-status'
+import { getCellFilterValue } from './resource-utils'
+import { ResourceRendererDispatch, getResourceStatus } from '../shared/ResourceRendererDispatch'
+
+const vectors = JSON.parse(readFileSync(new URL('../../../../../pkg/health/testdata/opentelemetry.json', import.meta.url), 'utf8'))
+
+describe('OpenTelemetry status across surfaces', () => {
+  for (const vector of vectors) it(vector.name, () => {
+    const resource = vector.object
+    const kind = resource.kind === 'Instrumentation' ? 'instrumentations' : 'opentelemetrycollectors'
+    const state = resource.kind === 'Instrumentation' ? getOpenTelemetryInstrumentationStatus(resource) : getOpenTelemetryCollectorStatus(resource)
+    expect(state).toMatchObject({ text: vector.text, level: vector.level })
+    expect(getGenericResourceStatus(resource)).toMatchObject({ text: vector.text, tone: vector.level })
+    expect(getCellFilterValue(resource, 'status', kind)).toBe(vector.text)
+    expect(getResourceStatus(kind, resource)).toMatchObject({ text: vector.text, level: vector.level })
+  })
+})
+
+describe('Collector pipeline declarations', () => {
+  const config = { connectors: { spanmetrics: {} }, service: { pipelines: { traces: { receivers: ['otlp'], processors: ['batch'], exporters: ['spanmetrics'] }, metrics: { receivers: ['spanmetrics'], exporters: ['debug'] } } } }
+  it('reads beta structured and genuinely served alpha YAML configuration', () => {
+    expect(getCollectorPipelines({ apiVersion: 'opentelemetry.io/v1beta1', spec: { config } })).toMatchObject({ connectors: ['spanmetrics'], pipelines: [{ name: 'traces', receivers: ['otlp'], processors: ['batch'], exporters: ['spanmetrics'] }, { name: 'metrics' }] })
+    expect(getCollectorPipelines({ apiVersion: 'opentelemetry.io/v1alpha1', spec: { config: 'service:\n  pipelines:\n    traces:\n      receivers: [otlp]\n      exporters: [debug]\n' } }).pipelines).toHaveLength(1)
+  })
+  it('reports unavailable and malformed previews instead of a false empty configuration', () => {
+    expect(getCollectorPipelines({ apiVersion: 'opentelemetry.io/v1alpha1', spec: { config: '[broken' } }).error).toContain('Inspect YAML')
+    expect(getCollectorPipelines({ apiVersion: 'opentelemetry.io/v1beta1', spec: { config: 'service: {}' } }).error).toBeTruthy()
+    expect(getCollectorPipelines({ spec: { config: { service: { pipelines: [] } } } }).error).toBeTruthy()
+    for (const service of ['invalid', 1, false, null, []]) {
+      expect(getCollectorPipelines({ spec: { config: { service } } }).error).toContain('Inspect YAML')
+    }
+    expect(getCollectorPipelines({ apiVersion: 'opentelemetry.io/v1alpha1', spec: { config: 'service: invalid' } }).error).toContain('Inspect YAML')
+    for (const pipeline of ['invalid', 1, false, null, []]) {
+      expect(getCollectorPipelines({ spec: { config: { service: { pipelines: { traces: pipeline } } } } }).error).toContain('Inspect YAML')
+    }
+    expect(getCollectorPipelines({ spec: { config: {} } }).error).toBeUndefined()
+  })
+  it('bounds alpha YAML size and alias expansion before previewing pipelines', () => {
+    expect(getCollectorPipelines({ apiVersion: 'opentelemetry.io/v1alpha1', spec: { config: ' '.repeat(1_000_001) } }).error).toContain('too large')
+    const aliases = 'base: &a [otlp, otlp, otlp, otlp, otlp, otlp, otlp, otlp, otlp, otlp]\nlevel1: &b [*a, *a, *a, *a, *a, *a, *a, *a, *a, *a]\nlevel2: &c [*b, *b, *b, *b, *b, *b, *b, *b, *b, *b]\nservice:\n  pipelines:\n    traces:\n      receivers: *c\n'
+    expect(getCollectorPipelines({ apiVersion: 'opentelemetry.io/v1alpha1', spec: { config: aliases } }).error).toContain('Inspect YAML')
+  })
+
+})
+
+describe('OpenTelemetry drawer identity and meaning', () => {
+  function render(apiVersion: string, kind: string, spec = {}, status = {}) {
+    return renderToString(<ResourceRendererDispatch resource={{ kind: kind === 'Instrumentation' ? 'instrumentations' : 'opentelemetrycollectors', namespace: 'test', name: 'test' }} data={{ apiVersion, kind, metadata: { name: 'test', namespace: 'test' }, spec, status }} onCopy={() => {}} copied={null} showCommonSections={false} />)
+  }
+  it('renders native reconciliation/pipeline context only for the exact group', () => {
+    expect(render('opentelemetry.io/v1beta1', 'OpenTelemetryCollector')).toContain('Reconciliation')
+    expect(render('other.example/v1', 'OpenTelemetryCollector')).not.toContain('Configured Pipelines')
+    expect(render('other.example/v1', 'OpenTelemetryCollector', { custom: 'generic-visible' })).toContain('generic-visible')
+  })
+  it('retains an unmanaged condition without presenting it as a current failure', () => {
+    const status = { conditions: [{ type: 'Ready', status: 'False', reason: 'ReconcileError' }] }
+    const managed = render('opentelemetry.io/v1beta1', 'OpenTelemetryCollector', { managementState: 'managed' }, status)
+    expect(managed).toContain('1 failing')
+    const unmanaged = render('opentelemetry.io/v1beta1', 'OpenTelemetryCollector', { managementState: 'unmanaged' }, status)
+    expect(unmanaged).toContain('ReconcileError')
+    expect(unmanaged).not.toContain('1 failing')
+  })
+  it('does not claim instrumentation readiness or dump arbitrary env values', () => {
+    const html = render('opentelemetry.io/v1alpha1', 'Instrumentation', { env: [{ name: 'TOKEN', value: 'do-not-surface' }] })
+    expect(html).toContain('Configured')
+    expect(html).toContain('does not report which Pods')
+    expect(html).not.toContain('do-not-surface')
+    expect(render('other.example/v1', 'Instrumentation', { custom: 'generic-visible' })).toContain('generic-visible')
+  })
+})

package/src/components/resources/resource-utils-opentelemetry.ts

@@ -0,0 +1,97 @@
+import { isApiGroup } from './resource-utils-cnpg'
+import { parseDocument } from 'yaml'
+import type { StatusBadge } from './resource-utils'
+import { healthColors } from './resource-utils'
+
+// Ready describes reconciliation only. In the operator, Ready=True can coexist
+// with 0/1 ready Pods. Never derive runtime health from this condition or scale.
+export function getOpenTelemetryCollectorStatus(data: any): StatusBadge {
+  const badge = (text: string, level: StatusBadge['level']): StatusBadge => ({ text, level, color: healthColors[level] })
+  if (data.spec?.managementState === 'unmanaged') return badge('Unmanaged', 'neutral')
+  const ready = data.status?.conditions?.find((c: any) => c.type === 'Ready')
+  if (!ready) return badge('Not reported', 'unknown')
+  const observed = data.status?.observedGeneration
+  if (observed > 0 && observed < data.metadata?.generation) return badge('Status stale', 'unknown')
+  if (ready.status === 'False') return badge(ready.reason === 'StatusUpdateFailed' ? 'Status unavailable' : 'Reconcile failed', ready.reason === 'StatusUpdateFailed' ? 'unknown' : 'unhealthy')
+  if (ready.status === 'True') return badge('Reconciled', 'neutral')
+  return badge('Reconciliation unknown', 'unknown')
+}
+
+export function getOpenTelemetryInstrumentationStatus(data: any): StatusBadge {
+  const blocked = Object.keys(data.status?.upgradeBlockedVersions ?? {}).length > 0
+  const level = 'neutral'
+  return { text: blocked ? 'Upgrade blocked' : 'Configured', level, color: healthColors[level] }
+}
+
+export interface CollectorPipeline {
+  name: string
+  receivers: string[]
+  processors: string[]
+  exporters: string[]
+}
+
+export interface CollectorPipelines {
+  pipelines: CollectorPipeline[]
+  connectors: string[]
+  error?: string
+}
+
+export function getCollectorPipelines(data: any): CollectorPipelines {
+  let config = data.spec?.config
+  // These are two genuinely served API versions, not a response-shape fallback.
+  if (data.apiVersion === 'opentelemetry.io/v1alpha1' && typeof config === 'string') {
+    if (config.length > 1_000_000) return { pipelines: [], connectors: [], error: 'Configuration is too large for a pipeline preview. Inspect YAML.' }
+    try {
+      const document = parseDocument(config)
+      if (document.errors.length) throw new Error('Invalid YAML')
+      config = document.toJS({ maxAliasCount: 100 })
+    } catch {
+      return { pipelines: [], connectors: [], error: 'Pipeline configuration could not be read. Inspect YAML.' }
+    }
+  }
+  if (!config || typeof config !== 'object' || Array.isArray(config)) {
+    return { pipelines: [], connectors: [], error: 'No structured pipeline configuration is available. Inspect YAML.' }
+  }
+  const service = config.service
+  if (service !== undefined && (!service || typeof service !== 'object' || Array.isArray(service))) {
+    return { pipelines: [], connectors: [], error: 'Pipeline configuration could not be read. Inspect YAML.' }
+  }
+  const declared = service?.pipelines
+  if (declared != null && (typeof declared !== 'object' || Array.isArray(declared))) {
+    return { pipelines: [], connectors: [], error: 'Pipeline configuration could not be read. Inspect YAML.' }
+  }
+  if (Object.values(declared ?? {}).some(pipeline => !pipeline || typeof pipeline !== 'object' || Array.isArray(pipeline))) {
+    return { pipelines: [], connectors: [], error: 'Pipeline configuration could not be read. Inspect YAML.' }
+  }
+  const names = (value: unknown): string[] => Array.isArray(value) ? value.filter((v): v is string => typeof v === 'string') : []
+  return {
+    pipelines: Object.entries(declared ?? {}).map(([name, pipeline]: [string, any]) => ({
+      name, receivers: names(pipeline?.receivers), processors: names(pipeline?.processors), exporters: names(pipeline?.exporters),
+    })),
+    connectors: Object.keys(config.connectors ?? {}),
+  }
+}
+
+// A single reader backs native cells, their filters and sorting.
+export function getOpenTelemetryColumnValue(data: any, column: string): string | undefined {
+  if (!isApiGroup(data?.apiVersion, 'opentelemetry.io')) return undefined
+  if (data.kind === 'OpenTelemetryCollector') {
+    switch (column) {
+      case 'status': return getOpenTelemetryCollectorStatus(data).text
+      case 'mode': return data.spec?.mode ?? ''
+      case 'reportedPods': return data.status?.scale?.statusReplicas ?? ''
+      case 'version': return data.status?.version ?? ''
+      case 'image': return data.status?.image ?? ''
+      case 'management': return data.spec?.managementState ?? ''
+    }
+  }
+  if (data.kind === 'Instrumentation') {
+    switch (column) {
+      case 'status': return getOpenTelemetryInstrumentationStatus(data).text
+      case 'endpoint': return data.spec?.exporter?.endpoint ?? ''
+      case 'sampler': return data.spec?.sampler?.type ?? ''
+      case 'samplerArgument': return data.spec?.sampler?.argument ?? ''
+    }
+  }
+  return undefined
+}

package/src/components/resources/resource-utils-trivy.test.ts

@@ -0,0 +1,87 @@
+import { describe, expect, it } from 'vitest'
+import { searchTrivyFindings, trivyReportImageRef } from './resource-utils-trivy'
+
+const vuln = {
+  metadata: { name: 'replicaset-billing-5cfccf7776-php-nginx', namespace: 'legacy' },
+  report: {
+    registry: { server: 'index.docker.io' },
+    artifact: { repository: 'trafex/php-nginx', tag: '3.6.0', digest: 'sha256:abc' },
+    vulnerabilities: [
+      { vulnerabilityID: 'CVE-2025-0001', resource: 'libssl3', installedVersion: '3.3.2-r0', fixedVersion: '3.3.3-r0' },
+      { vulnerabilityID: 'CVE-2026-109618', resource: 'php83', installedVersion: '8.3.20-r0', fixedVersion: '8.3.36-r0' },
+      { vulnerabilityID: 'CVE-2026-0002', resource: 'busybox', installedVersion: '1.36.1-r29' },
+    ],
+  },
+}
+const secrets = {
+  metadata: { name: 'replicaset-billing-secrets', namespace: 'legacy' },
+  report: { secrets: [{ ruleID: 'aws-access-key-id', target: '/var/www/html/.env', match: 'AWS_ACCESS_KEY_ID=AKIAREVIEWFIXTURE01' }] },
+}
+const audit = {
+  metadata: { name: 'replicaset-api-8467889d75', namespace: 'team-b' },
+  report: { checks: [{ checkID: 'KSV012', success: false }, { checkID: 'KSV001', success: true }] },
+}
+const sbom = {
+  metadata: { name: 'replicaset-web-sbom', namespace: 'shop' },
+  report: { components: { components: [{ name: 'guzzlehttp/guzzle', version: '7.8.1' }] } },
+}
+
+describe('searchTrivyFindings', () => {
+  it('matches a CVE and names the finding with its versions', () => {
+    const { matches, truncated } = searchTrivyFindings([vuln, secrets], 'cve-2026-109618')
+    expect(truncated).toBe(false)
+    expect([...matches.keys()]).toEqual([vuln])
+    expect(matches.get(vuln)).toEqual({ site: 'finding', text: 'CVE-2026-109618 php83 8.3.20-r0 → 8.3.36-r0' })
+  })
+
+  it('matches packages, unfixed findings, SBOM components and failed checks', () => {
+    const text = (r: any, term: string) => searchTrivyFindings([r], term).matches.get(r)?.text
+    expect(text(vuln, 'php83')).toContain('php83')
+    expect(text(vuln, 'busybox')).toBe('CVE-2026-0002 busybox 1.36.1-r29 → unfixed')
+    expect(text(sbom, 'guzzle')).toBe('guzzlehttp/guzzle 7.8.1')
+    expect(text(audit, 'ksv012')).toBe('KSV012')
+  })
+
+  it('tells an image match apart from a finding', () => {
+    expect(searchTrivyFindings([vuln], 'sha256:abc').matches.get(vuln)).toEqual({ site: 'image', text: 'index.docker.io/trafex/php-nginx:3.6.0@sha256:abc' })
+  })
+
+  it('treats the term as text, not a pattern', () => {
+    expect(searchTrivyFindings([vuln], '8.3.20-r0 →').matches.has(vuln)).toBe(true)
+    expect(searchTrivyFindings([vuln], 'php8.').matches.size).toBe(0)
+  })
+
+  it('caps a finding at 256 UTF-8 bytes for phrases, like server search', () => {
+    const wide = { metadata: { name: 'r', namespace: 'n' }, report: { components: { components: [{ name: 'é'.repeat(128), version: 'needle' }] } } }
+    expect(searchTrivyFindings([wide], 'é needle').matches.size).toBe(0)
+    expect(searchTrivyFindings([wide], 'needle').matches.size).toBe(1)
+  })
+
+  it('matches a phrase across one finding, never across findings', () => {
+    expect(searchTrivyFindings([vuln], 'php83 8.3.20').matches.has(vuln)).toBe(true)
+    expect(searchTrivyFindings([vuln], 'libssl3 8.3.20').matches.has(vuln)).toBe(false)
+  })
+
+  it('never searches a passing check or a secret finding\'s matched text', () => {
+    expect(searchTrivyFindings([audit], 'ksv001').matches.size).toBe(0)
+    expect(searchTrivyFindings([secrets], 'akiareview').matches.size).toBe(0)
+    expect(searchTrivyFindings([secrets], 'aws-access-key-id').matches.get(secrets)?.text).toBe('aws-access-key-id /var/www/html/.env')
+  })
+
+  it('skips rows whose name or namespace already match', () => {
+    expect(searchTrivyFindings([vuln], 'legacy').matches.size).toBe(0)
+  })
+
+  it('stops at the findings limit and says the search was cut short', () => {
+    const { matches, truncated } = searchTrivyFindings([vuln, vuln], 'cve-2026-0002', 4)
+    expect(truncated).toBe(true)
+    expect(matches.size).toBe(1)
+  })
+})
+
+describe('trivyReportImageRef', () => {
+  it('renders registry/repository:tag@digest like server search', () => {
+    expect(trivyReportImageRef(vuln)).toBe('index.docker.io/trafex/php-nginx:3.6.0@sha256:abc')
+    expect(trivyReportImageRef({ report: {} })).toBe('')
+  })
+})

package/src/components/resources/resource-utils-trivy.ts

@@ -55,6 +55,128 @@ export function getVulnerabilityReportContainer(report: any): string {
   return report.metadata?.labels?.['trivy-operator.container.name'] || '-'
 }
 
+// ============================================================================
+// TRIVY OPERATOR — TABLE SEARCH OVER FINDINGS
+// ============================================================================
+
+export const TRIVY_GROUP = 'aquasecurity.github.io'
+
+// Bounds one table search over findings. The filter runs on the main thread,
+// and a cluster can hold thousands of reports with hundreds of findings each.
+const MAX_TABLE_FINDINGS = 200_000
+
+// Server search caps one indexed finding at 256 bytes (internal/search/trivy.go).
+const MAX_FINDING_LABEL = 256
+
+export interface TrivyFindingMatch {
+  site: 'finding' | 'image'
+  text: string
+}
+
+export interface TrivyFindingsSearch {
+  // Rows that matched only through a finding or the scanned image.
+  matches: Map<object, TrivyFindingMatch>
+  truncated: boolean
+}
+
+function str(v: unknown): string {
+  return typeof v === 'string' ? v : ''
+}
+
+function asArray(v: unknown): any[] {
+  return Array.isArray(v) ? v : []
+}
+
+// findingLabel joins a finding's parts and caps it at MAX_FINDING_LABEL
+// UTF-8 bytes on a character boundary, as server search does, so a phrase
+// that falls past the cap matches in neither place.
+function findingLabel(...parts: string[]): string {
+  const label = parts.filter(Boolean).join(' ')
+  // A UTF-16 unit is at most 3 UTF-8 bytes, so short labels need no count.
+  if (label.length * 3 <= MAX_FINDING_LABEL) return label
+  let bytes = 0
+  let end = 0
+  for (const ch of label) {
+    const cp = ch.codePointAt(0) ?? 0
+    const size = cp < 0x80 ? 1 : cp < 0x800 ? 2 : cp < 0x10000 ? 3 : 4
+    if (bytes + size > MAX_FINDING_LABEL) break
+    bytes += size
+    end += ch.length
+  }
+  return label.slice(0, end)
+}
+
+// trivyReportImageRef renders a report's scanned image the way search
+// indexes it: registry/repository:tag@digest.
+export function trivyReportImageRef(resource: any): string {
+  const report = resource?.report
+  const repo = str(report?.artifact?.repository)
+  if (!repo) return ''
+  const registry = str(report?.registry?.server)
+  let ref = registry ? `${registry}/${repo}` : repo
+  const tag = str(report?.artifact?.tag)
+  if (tag) ref += `:${tag}`
+  const digest = str(report?.artifact?.digest)
+  if (digest) ref += `@${digest}`
+  return ref
+}
+
+// searchTrivyFindings finds reports whose findings contain term, over the
+// entries server search indexes (internal/search/trivy.go): CVE IDs with
+// package and versions, SBOM components, failed check IDs, secret rule IDs
+// and targets, plus the scanned image. A secret finding's `match` is the
+// matched line itself and is never searched. A term with a space matches
+// within one finding, never across two. Rows whose name or namespace already
+// contain term are skipped, since they match without a finding.
+export function searchTrivyFindings(resources: readonly any[], term: string, limit = MAX_TABLE_FINDINGS): TrivyFindingsSearch {
+  const matches = new Map<object, TrivyFindingMatch>()
+  const re = new RegExp(term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i')
+  const spaced = term.includes(' ')
+  const hit = (...parts: string[]): boolean =>
+    spaced ? re.test(findingLabel(...parts)) : parts.some((p) => p !== '' && re.test(p))
+  let left = limit
+  for (const r of resources) {
+    const meta = r?.metadata
+    if (re.test(str(meta?.name)) || re.test(str(meta?.namespace))) continue
+    const report = r?.report
+    if (!report || typeof report !== 'object') continue
+    const image = trivyReportImageRef(r)
+    if (image && re.test(image)) {
+      matches.set(r, { site: 'image', text: image })
+      continue
+    }
+    let found = ''
+    let truncated = false
+    scan: {
+      for (const v of asArray(report.vulnerabilities)) {
+        if (--left < 0) { truncated = true; break scan }
+        const id = str(v?.vulnerabilityID)
+        if (!id) continue
+        const parts = [id, str(v.resource), str(v.installedVersion), '→', str(v.fixedVersion) || 'unfixed']
+        if (hit(...parts)) { found = findingLabel(...parts); break scan }
+      }
+      for (const c of asArray(report.components?.components)) {
+        if (--left < 0) { truncated = true; break scan }
+        const parts = [str(c?.name), str(c?.version)]
+        if (hit(...parts)) { found = findingLabel(...parts); break scan }
+      }
+      for (const c of asArray(report.checks)) {
+        if (--left < 0) { truncated = true; break scan }
+        if (c?.success !== false) continue
+        if (hit(str(c.checkID))) { found = findingLabel(str(c.checkID)); break scan }
+      }
+      for (const sec of asArray(report.secrets)) {
+        if (--left < 0) { truncated = true; break scan }
+        const parts = [str(sec?.ruleID), str(sec?.target)]
+        if (hit(...parts)) { found = findingLabel(...parts); break scan }
+      }
+    }
+    if (found) matches.set(r, { site: 'finding', text: found })
+    if (truncated) return { matches, truncated: true }
+  }
+  return { matches, truncated: false }
+}
+
 // ============================================================================
 // TRIVY OPERATOR — CONFIG AUDIT REPORT UTILITIES
 // ============================================================================