@skyhook-io/k8s-ui 1.18.1 → 1.19.0

package/src/hooks/useKeepInViewport.ts

@@ -0,0 +1,87 @@
+import { useLayoutEffect, useEffect, type RefObject } from 'react'
+
+/** Keeps an open menu or popover horizontally inside the visible area: the
+ *  viewport, narrowed by any ancestor that clips horizontally (a content
+ *  column beside a nav rail clips what slides under the rail). Anchored menus
+ *  open at their trigger's edge with a fixed minimum width, so on a narrow
+ *  screen a trigger near the edge pushes the menu out of view. After each
+ *  layout, and on resize while open, this shifts the element back with the
+ *  `translate` property (which moves it whichever side it's anchored to), and
+ *  narrows it only if it can't fit. Don't use it on an element whose own
+ *  motion animates `translate`: the inline value would override it.
+ *
+ *  Runs after every render while `active`, so a menu whose content changes
+ *  width (a filter narrowing a list) is re-measured. */
+export function useKeepInViewport(ref: RefObject<HTMLElement | null>, active: boolean, margin = 8): void {
+  useLayoutEffect(() => {
+    if (active) keepInView(ref.current, margin)
+  })
+  useEffect(() => {
+    if (!active) return
+    const onResize = () => keepInView(ref.current, margin)
+    window.addEventListener('resize', onResize)
+    return () => window.removeEventListener('resize', onResize)
+  }, [ref, active, margin])
+}
+
+// Width overrides this hook applied, keyed by element, with the inline values
+// they replaced, so a later measurement can put back exactly what the caller set
+// (React won't re-apply an inline style whose value it thinks is unchanged).
+const sizedBy = new WeakMap<HTMLElement, { minWidth: string; maxWidth: string }>()
+
+function keepInView(el: HTMLElement | null, margin: number): void {
+  if (!el) return
+  // Measure and move with transitions off. Under reduced motion every
+  // element gets a near-zero transition on all properties, and a transitioned
+  // element reports its pre-change box in the same frame: a menu just moved
+  // from left 0 to its trigger still measured at 0, and was pushed off its
+  // trigger by the margin.
+  const transition = el.style.transition
+  el.style.transition = 'none'
+  place(el, margin)
+  el.getBoundingClientRect() // apply the move before transitions return
+  el.style.transition = transition
+}
+
+function place(el: HTMLElement, margin: number): void {
+  el.style.translate = ''
+  const saved = sizedBy.get(el)
+  if (saved) {
+    el.style.minWidth = saved.minWidth
+    el.style.maxWidth = saved.maxWidth
+    sizedBy.delete(el)
+  }
+  const [boundLeft, boundRight] = visibleBounds(el, margin)
+  const room = boundRight - boundLeft
+  // Only a menu that can't fit gets resized; otherwise the caller's own
+  // minimum and maximum widths stand.
+  if (el.offsetWidth > room) {
+    sizedBy.set(el, { minWidth: el.style.minWidth, maxWidth: el.style.maxWidth })
+    el.style.minWidth = '0'
+    el.style.maxWidth = `${room}px`
+  }
+  const { left, right } = el.getBoundingClientRect()
+  const shift = keepInViewportShift(left, right, boundLeft, boundRight)
+  if (shift !== 0) el.style.translate = `${shift}px 0`
+}
+
+function visibleBounds(el: HTMLElement, margin: number): [number, number] {
+  let left = margin
+  let right = document.documentElement.clientWidth - margin
+  for (let p = el.parentElement; p && p !== document.body; p = p.parentElement) {
+    if (getComputedStyle(p).overflowX === 'visible') continue
+    const r = p.getBoundingClientRect()
+    left = Math.max(left, r.left + margin)
+    right = Math.min(right, r.right - margin)
+  }
+  return [left, Math.max(left, right)]
+}
+
+/** Horizontal shift (px) that brings [left, right] inside [boundLeft,
+ *  boundRight], preferring the left edge when the element is wider. */
+export function keepInViewportShift(left: number, right: number, boundLeft: number, boundRight: number): number {
+  let shift = 0
+  if (right > boundRight) shift = boundRight - right
+  if (left + shift < boundLeft) shift = boundLeft - left
+  return shift
+}

package/src/types/core.ts

@@ -126,6 +126,7 @@ export interface Capabilities {
   helmWrite: boolean      // Helm write operations (install, upgrade, rollback, uninstall, apply values)
   nodeWrite: boolean      // Node write operations (cordon, uncordon, drain)
   workloadWrites?: WorkloadWritePermissions // Workload patch permissions (restart/scale controls)
+  mcpExecTools?: boolean // Full MCP registration; does not grant the caller exec permission
   mcpReadOnly?: boolean  // Full MCP endpoint is disabled; read-only endpoints remain available
   mcpEnabled: boolean     // MCP server is running
   // Karpenter discovery and NodePool read state. Optional on the wire for the
@@ -175,8 +176,10 @@ export interface FeatureCapabilities {
   cnpgWorkspace?: boolean
   cnpgProtectionSetup?: boolean
   gitopsWriteEvidence?: boolean
+  agentSigninCheck?: boolean
   serviceEndpointSlices?: boolean
   trafficRecords?: boolean
+  clusterScopedPlaceholder?: boolean
 }
 
 // DeploymentMode is the closed set of topologies Radar can run in.
@@ -738,10 +741,60 @@ export interface OwnershipCoverage {
     remote?: number
     notChecked?: OwnershipGap[]
   }
+  /** What manages this resource, from its own evidence or its nearest controller ancestor's. Absent means no answer (a Radar that predates it, or unavailableReason), never "none". */
+  manager?: ManagerAnswer
   /** A readreason code when Radar couldn't answer at all. */
   unavailableReason?: string
 }
 
+/** What manages a resource: the managers whose status lists name it and what its metadata claims. It names no winner the evidence doesn't support. */
+export interface ManagerAnswer {
+  /** none: no evidence in what Radar collects and the viewer may read, never "unmanaged". */
+  state: 'shared' | 'disagree' | 'agree' | 'listed' | 'claimed' | 'unknown' | 'none'
+  /** The manager to show first, never a verdict: the recorder for agree/listed; for shared, the one recorder a claim names, if exactly one; for claimed, the manager every claim names, if they agree. Its namespace is "" when it comes from a claim that names none. */
+  lead?: ResourceRef
+  /** The evidence on the resource itself. */
+  direct: ManagerEvidence
+  /** The nearest controller ancestor's evidence that settles it when the resource's own doesn't, or, when nothing does and the resource makes no claim that isn't copied, the nearest ancestor that makes one; state and lead then come from it. */
+  via?: ManagerEvidence
+  /** Other objects the walk passed that make claims, in chain order. When via is a fallback to the nearest claim, claims farther up stay here. */
+  between?: ManagerEvidence[]
+  /** Why a walk that found no settling evidence stopped short. Absent when evidence settled it first, or the walk reached the chain's top. */
+  chainEnd?: 'unfollowed' | 'cycle' | 'truncated'
+  /** The controller reference the walk couldn't follow, when chainEnd is unfollowed. */
+  stop?: {
+    at: ResourceRef
+    /** As primaryOwnerState: gone, replaced, withheld, unknown, unresolvable or excluded. */
+    state: string
+    /** The owner the reference names when it is gone, replaced or unknown. */
+    owner?: ResourceRef
+    /** A readreason code when the owner is unknown. */
+    reason?: string
+  }
+  /** The viewer's access is restricted, so the evidence is the part it may read. */
+  narrowed?: boolean
+}
+
+export interface ManagerEvidence {
+  object: ResourceRef
+  /** Local managers whose status lists name it. */
+  recorders?: ResourceRef[]
+  /** Managers its own metadata names. */
+  claims?: ManagerClaim[]
+}
+
+/** source, check, and the answer's state and chainEnd may gain values in newer Radars: show an unfamiliar one generically and never treat it as confirming. */
+export interface ManagerClaim {
+  /** Its namespace is "" when the metadata doesn't say. */
+  manager: ResourceRef
+  source: 'flux-helm-labels' | 'flux-kustomize-labels' | 'argo-tracking-id' | 'argo-instance-label' | 'helm-release'
+  check: 'recorded' | 'omitted' | 'unreadable' | 'remote' | 'missing' | 'not-recording' | 'unresolved' | 'withheld' | 'unchecked'
+  /** An Argo CD tracking ID naming another object. */
+  copied?: boolean
+  /** Copied, or an instance label or Helm release annotation on an object a controller owns: it doesn't stop the walk. One that isn't copied can still answer when nothing on the chain settles it. */
+  weak?: boolean
+}
+
 // Parsed X.509 certificate metadata (from backend cert parsing)
 export interface CertificateInfo {
   subject: string
@@ -1515,7 +1568,7 @@ export interface AggregatedFlow {
 
 // Cluster info for traffic detection
 export interface TrafficClusterInfo {
-  platform: string // rke2, gke, eks, aks, minikube, kind, docker-desktop, openshift, rancher, generic
+  platform: string // nkp, rke2, gke, eks, aks, nutanix, minikube, kind, docker-desktop, openshift, rancher, generic
   cni: string // cilium, canal, calico, flannel, vpc-cni, azure-cni, gke-native, unknown
   dataplaneV2: boolean
   clusterName?: string

package/src/types/gitops-insights.ts

@@ -124,6 +124,14 @@ export interface GitOpsIssue {
   rawMessage?: string
   refs?: GitOpsInsightRef[]
   action?: string
+  /** Optional presentation split; action always retains the complete guidance. */
+  actionPrimary?: string
+  actionSecondaryTitle?: string
+  actionSecondary?: string[]
+  // Set when syncing would prune every managed
+  // resource or take resources over from another Application. Shown as a
+  // warning ahead of a failed operation's cause; resource rows defer sync advice to it.
+  hazard?: string
   // Plain-English root cause when the message matched a recognized error
   // pattern. Empty for unrecognized messages — UI falls back to the raw message.
   cause?: string

package/src/utils/api-resources.ts

@@ -216,6 +216,7 @@ export function formatGroupName(group: string): string {
     'logstash.k8s.elastic.co': 'Elastic',
     'jaegertracing.io': 'Jaeger',
     'opentelemetry.io': 'OpenTelemetry',
+    'flagger.app': 'Flagger',
     'projectcalico.org': 'Calico',
     'crd.projectcalico.org': 'Calico',
     'projectcontour.io': 'Contour',

package/src/utils/gitops-owner.ts

@@ -1,12 +1,8 @@
-// Map a resource's server-side `Relationships.managedBy` to a navigable
-// GitOps owner ref, used by the drawer to render the "Managed by <app>" chip.
-//
-// The detection (label/annotation parsing, Argo tracking-id decoding, Flux
-// label inspection, Helm release annotation, owner-chain walk) lives server-
-// side in pkg/topology.SynthesizeManagedBy. This file is now a thin mapper
-// from the structured ref into the discriminated union the chip + router need.
+// Maps server manager evidence to drawer copy and navigation. Older Radars
+// without the answer retain their managedBy projection.
 
-import type { Relationships, ResourceRef } from '../types/core'
+import type { ManagerAnswer, ManagerClaim, ManagerEvidence, Relationships, ResourceRef } from '../types/core'
+import { dedupeResourceRefs, resourceRefKey } from './resource-refs'
 
 // GitOpsOwnerRef is a discriminated union — the tool determines which kind is
 // valid. Modeling it this way prevents callers (and consumers of the returned
@@ -36,6 +32,8 @@ const FLUX_HELM_GROUP = 'helm.toolkit.fluxcd.io'
 export function gitOpsOwnerFromRelationships(
   rel: Relationships | undefined | null,
 ): GitOpsOwnerRef | null {
+  const answer = rel?.ownership?.manager
+  if (answer) return answer.lead ? gitOpsOwnerFromRef(answer.lead) : null
   const refs = rel?.managedBy
   if (!refs || refs.length === 0) return null
   return gitOpsOwnerFromRef(refs[0])
@@ -76,3 +74,133 @@ export function managerListing(owner: GitOpsOwnerRef | null | undefined, manager
   if (!listed.some(isOwner)) return { state: 'conflict', listedBy: listed }
   return listed.length === 1 && managers.length === 1 ? { state: 'confirmed' } : undefined
 }
+
+
+export function activeManagerClaims(evidence: ManagerEvidence): ManagerClaim[] {
+  const claims = (evidence.claims ?? []).filter(c => !c.copied)
+  const hasGitOps = Boolean(evidence.recorders?.length) || claims.some(c => c.source !== 'helm-release')
+  return hasGitOps ? claims.filter(c => c.source !== 'helm-release') : claims
+}
+
+export function managerCandidates(answer: ManagerAnswer): ResourceRef[] {
+  const evidence = answer.via ?? answer.direct
+  const recorders = evidence.recorders ?? []
+  const qualified = [...recorders, ...(answer.lead ? [answer.lead] : []), ...activeManagerClaims(evidence).map(c => c.manager).filter(r => r.namespace)]
+  // A claim without a namespace names the qualified manager of its kind and
+  // name the answer already holds, when there is exactly one.
+  const claims = activeManagerClaims(evidence).map(c => {
+    const ref = c.manager
+    if (ref.namespace) return ref
+    const matches = dedupeResourceRefs(qualified.filter(r => r.kind === ref.kind && r.group === ref.group && r.name === ref.name))
+    return matches.length === 1 ? matches[0] : ref
+  })
+  return dedupeResourceRefs([...(answer.lead ? [answer.lead] : []), ...claims, ...recorders])
+}
+
+export function managerRefLabel(ref: ResourceRef): string {
+  return `${ref.kind} ${ref.namespace ? `${ref.namespace}/` : ''}${ref.name}`
+}
+
+export function managerChipPresentation(answer: ManagerAnswer): { prefix: string; label: string; via?: string; tooltip: string; warning: boolean } | null {
+  if (answer.state === 'unknown' || answer.state === 'none') return null
+  const evidence = answer.via ?? answer.direct
+  const candidates = managerCandidates(answer)
+  const names = (refs: ResourceRef[]) => refs.map(managerRefLabel).join(' and ')
+  const claims = activeManagerClaims(evidence)
+  const claimed = dedupeResourceRefs(claims.map(c => c.manager))
+  const recorders = evidence.recorders ?? []
+  // A list alone records what a manager compared or applied, which can be an
+  // object it doesn't sync (a copy carrying another's tracking ID, a CRD a
+  // HelmRelease skips): only a list and the object's metadata agreeing says
+  // it manages the object.
+  const prefix = answer.state === 'agree' ? 'Managed by' : answer.state === 'shared' || answer.state === 'listed' ? 'Listed by' : 'Tracked by'
+  const listed = answer.lead && recorders.some(r => resourceRefKey(r) === resourceRefKey(answer.lead!))
+    ? dedupeResourceRefs([answer.lead, ...recorders]) : recorders
+  const displayed = answer.state === 'disagree' ? claimed : answer.state === 'shared' ? listed : candidates
+  const label = displayed.map(r => r.namespace ? `${r.namespace}/${r.name}` : r.name).join(' and ')
+  const reasons: Record<ManagerClaim['check'], string> = {
+    recorded: 'its status lists this resource',
+    omitted: "its status doesn't list this resource",
+    unreadable: "Radar can't read its status",
+    remote: "Radar can't confirm it deploys to this cluster",
+    missing: 'no such manager here',
+    'not-recording': 'Helm records an installation, rather than continuously reconciling it',
+    unresolved: 'Radar found no manager of that name listing this resource; it may be managed from another cluster',
+    withheld: "you can't view it",
+    unchecked: "Radar couldn't check its status",
+  }
+  const subject = answer.via ? managerRefLabel(evidence.object) : 'this resource'
+  const details: string[] = []
+  const whose = answer.via ? `${managerRefLabel(evidence.object)}'s` : "This resource's"
+  // A newer Radar may send a check this UI doesn't know.
+  const why = (c: ManagerClaim, object: string) => c.check === 'missing'
+    ? `there's no such ${c.manager.kind} here`
+    : (reasons[c.check] ?? "Radar couldn't confirm its status lists this resource").replace('manager of', `${c.manager.kind} of`).replace('this resource', object)
+  // Tracked by names what metadata says, which Radar hasn't confirmed: one
+  // claim says why in the same sentence.
+  const single = answer.state === 'claimed' && claims.length === 1 && claims[0].check !== 'recorded' ? claims[0] : null
+  if (single) {
+    details.push(`${whose} ${single.source.includes('label') ? 'label' : 'annotation'} names ${managerRefLabel(single.manager)}, but ${why(single, answer.via ? subject : 'it')}.`)
+  } else if (answer.state === 'claimed') {
+    details.push(`${whose} labels or annotations name ${names(claimed)}; Radar hasn't confirmed ${claimed.length === 1 ? 'it manages' : 'they manage'} it.`)
+  }
+  for (const c of claims) {
+    if (c.check === 'recorded' || c === single) continue
+    details.push(`${managerRefLabel(c.manager)}: ${why(c, subject)}.`)
+  }
+  if (recorders.length) {
+    // A claim its list confirms adds nothing but the agreement.
+    const confirmed = claims.some(c => c.check === 'recorded')
+    details.push(`${names(recorders)} ${recorders.length === 1 ? 'lists' : 'list'} ${subject} in ${recorders.length === 1 ? 'its status' : 'their statuses'}${confirmed ? `, and ${answer.via ? 'its' : 'this resource\'s'} tracking metadata names ${recorders.length === 1 ? 'it' : 'one of them'}` : ''}.`)
+  }
+  if (answer.via) details.push(`Through ${managerRefLabel(answer.via.object)}.`)
+  // Claims the answer passed on the way stay visible, with or without Via.
+  {
+    for (const e of [...(answer.via ? [answer.direct] : []), ...(answer.between ?? [])]) {
+      for (const c of e.claims ?? []) {
+        if (c.copied) continue
+        details.push(`${managerRefLabel(e.object)}: its own ${c.source.includes('label') ? 'label' : 'annotation'} names ${managerRefLabel(c.manager)}.`)
+      }
+    }
+  }
+  if (answer.narrowed) details.push('This answer covers what you can view.')
+  return { prefix, label, via: answer.via?.object.kind, tooltip: details.join(' '), warning: answer.state === 'disagree' }
+}
+
+/**
+ * A candidate manager of an answer, with what names it: its list, its
+ * metadata, or both. found: Radar read the manager, so a link to it opens it;
+ * a claim of a manager that is missing, withheld or unresolved isn't.
+ */
+export type ManagerChoice = { ref: ResourceRef; listed: boolean; claimed: boolean; found: boolean }
+
+/** Every candidate manager of an answer, lead first, each with what names it. */
+export function managerChoices(answer: ManagerAnswer): ManagerChoice[] {
+  const evidence = answer.via ?? answer.direct
+  const recorders = new Set((evidence.recorders ?? []).map(resourceRefKey))
+  const candidates = managerCandidates(answer)
+  // A manager is found when any claim naming it read it; a check this UI
+  // doesn't know never counts as one.
+  const read: Array<string> = ['recorded', 'omitted', 'unreadable', 'remote']
+  const claimed = new Set<string>()
+  const found = new Set<string>()
+  for (const c of activeManagerClaims(evidence)) {
+    const ref = c.manager
+    const key = resourceRefKey(ref.namespace ? ref : candidates.find(r => r.kind === ref.kind && r.group === ref.group && r.name === ref.name) ?? ref)
+    claimed.add(key)
+    if (read.includes(c.check)) found.add(key)
+  }
+  return candidates.map(ref => {
+    const key = resourceRefKey(ref)
+    const listed = recorders.has(key)
+    return { ref, listed, claimed: claimed.has(key), found: listed || found.has(key) }
+  })
+}
+
+export function managerChipCoversGroup(relationships: Relationships): boolean {
+  const answer = relationships.ownership?.manager
+  if (!answer || !['agree', 'listed'].includes(answer.state) || answer.via || relationships.ownership?.managers) return false
+  const recorders = answer.direct.recorders ?? []
+  const managers = relationships.managers ?? []
+  return recorders.length === 1 && managers.length === 1 && resourceRefKey(recorders[0]) === resourceRefKey(managers[0])
+}