@skyhook-io/k8s-ui 1.18.2 → 1.20.0

package/src/components/kueue/AdmissionPath.tsx

@@ -0,0 +1,223 @@
+import type { ReactNode } from 'react'
+import { Route } from 'lucide-react'
+import { ResourceLink, Section, ownerNote } from '../ui/drawer-components'
+import { gapReasonText } from '../../utils/read-actions'
+import { FactSource, FactValue } from '../facts'
+import type { Relationships } from '../../types'
+import { kindToPluralWithGroup } from '../../utils/navigation'
+import { isKueueConditionStale } from '../resources/resource-utils-kueue'
+import { localQueueStatusWithParent } from './queue-status'
+import { isFlavorAssignmentMessage, parseFlavorAttempts, type FlavorAttempt, type FlavorAttemptKind } from './flavors-tried'
+import { ClusterQueueReadSummary, ReadState, StatusPill, namespaceEligibilityFact, type Navigate } from './QueueEvidence'
+import { KUEUE_GROUP } from './constants'
+import type { RelatedRead } from './related-read'
+
+/** Objects on a Workload's admission path that a host read as the viewer. */
+export interface KueueWorkloadReads {
+  localQueue?: RelatedRead
+  /** Keyed by ClusterQueue name: the LocalQueue's target and, when different, the one holding the reservation. */
+  clusterQueues?: Record<string, RelatedRead>
+  namespace?: RelatedRead
+  /** Keyed by ResourceFlavor name: the flavors the reservation assigned. */
+  flavors?: Record<string, RelatedRead>
+}
+
+function Step({ label, children }: { label: string; children: ReactNode }) {
+  return (
+    <li className="relative grid grid-cols-[7.5rem_minmax(0,1fr)] gap-3 py-2.5 text-sm first:pt-0 last:pb-0">
+      <span className="text-theme-text-tertiary">{label}</span>
+      <div className="min-w-0 space-y-1">{children}</div>
+    </li>
+  )
+}
+
+const muted = 'text-xs text-theme-text-secondary'
+
+function OwnerStep({ data, relationships, onNavigate }: { data: any; relationships?: Relationships; onNavigate?: Navigate }) {
+  const coverage = relationships?.ownership
+  // Without the ownership answer (a Radar that predates it), `owner` may come
+  // from display edges that check neither group nor UID, so it isn't linked;
+  // the Workload's own controller reference is named instead.
+  const controllerRef = (data.metadata?.ownerReferences ?? []).find((ref: any) => ref?.controller)
+  const owner = coverage ? relationships?.owner : undefined
+  const clusterName: string | undefined = data.status?.clusterName
+  let body: ReactNode
+  if (owner) {
+    body = <div className="flex flex-wrap items-center gap-2 break-all [&_button]:text-left">
+      <span className="text-xs text-theme-text-tertiary">{owner.kind}</span>
+      <ResourceLink name={owner.name} namespace={owner.namespace} kind={kindToPluralWithGroup(owner.kind, owner.group ?? '')} group={owner.group} onNavigate={onNavigate} />
+    </div>
+  } else if (!relationships) {
+    body = <p className={muted}>Owner not read here.</p>
+  } else if (!coverage && controllerRef) {
+    body = <p className={muted}>Controller reference: {controllerRef.kind} {controllerRef.name} (this Radar doesn't resolve owners).</p>
+  } else if (coverage?.primaryOwnerState === 'several') {
+    body = <p className={muted}>Several owner references; none is the controller.</p>
+  } else {
+    const reason = coverage?.unavailableReason
+    const unanswered = !reason ? undefined
+      : reason === 'user_forbidden' ? "The owner isn't shown: your access lets you open this Workload, but not list its kind here."
+        : `The owner couldn't be read: ${gapReasonText(reason)}.`
+    const note = ownerNote(coverage)
+    body = <p className={muted}>{unanswered ?? note?.text ?? (data.metadata?.ownerReferences?.length ? 'Owner not resolved.' : 'No owner reference: this Workload was created directly.')}</p>
+  }
+  return <Step label="Owner">
+    {body}
+    {clusterName && <p className={muted}>Kueue reports cluster <code>{clusterName}</code> for this Workload (status.clusterName). Radar shows this cluster only and doesn't follow that name elsewhere.</p>}
+  </Step>
+}
+
+export function AdmissionPath({ data, reads, relationships, onNavigate }: { data: any; reads?: KueueWorkloadReads; relationships?: Relationships; onNavigate?: Navigate }) {
+  const namespace: string = data.metadata?.namespace ?? ''
+  const queueName: string | undefined = data.spec?.queueName
+  const localQueue = reads?.localQueue
+  const configured: string | undefined = localQueue?.state === 'found' ? localQueue.object?.spec?.clusterQueue : undefined
+  const reserved: string | undefined = data.status?.admission?.clusterQueue
+  const finished = (data.status?.conditions ?? []).some((condition: any) => condition?.type === 'Finished' && condition.status === 'True')
+  const admitted = (data.status?.conditions ?? []).some((condition: any) => condition?.type === 'Admitted' && condition.status === 'True')
+  const configuredRead = configured ? reads?.clusterQueues?.[configured] : undefined
+  const eligibility = configured && reads ? namespaceEligibilityFact({ clusterQueue: configured, parent: configuredRead, namespaceRead: reads.namespace }) : undefined
+  const assignments: any[] = Array.isArray(data.status?.admission?.podSetAssignments) ? data.status.admission.podSetAssignments : []
+  // Kueue's own word on why quota isn't reserved, verbatim. Flavor-assignment
+  // messages are left to "Reasons reported per flavor".
+  const quota = (data.status?.conditions ?? []).find((condition: any) => condition?.type === 'QuotaReserved')
+  const pendingMessage: string | undefined = quota?.status === 'False' && quota.message && !isFlavorAssignmentMessage(quota.message) ? quota.message : undefined
+  const pendingStale = isKueueConditionStale(quota, data.metadata?.generation)
+  return (
+    <Section variant="card" title="Admission Path" icon={Route}>
+      <ol className="divide-y divide-theme-border">
+        <OwnerStep data={data} relationships={relationships} onNavigate={onNavigate} />
+        <Step label="LocalQueue">
+          {!queueName ? <p className={muted}>No queue name: spec.queueName is empty, so the Workload names no LocalQueue.</p> : <>
+            <div className="flex flex-wrap items-center gap-2 break-all [&_button]:text-left">
+              <ResourceLink name={queueName} kind="localqueues" namespace={namespace} group={KUEUE_GROUP} onNavigate={onNavigate} />
+              <ReadState read={localQueue} found={localQueue?.state === 'found' ? <StatusPill status={localQueueStatusWithParent(localQueue.object, configuredRead)} /> : undefined} />
+            </div>
+            {localQueue?.state === 'not_found' && <p className={muted}>{reserved
+              ? `No LocalQueue ${queueName} exists in namespace ${namespace} now; the reservation below was made through it earlier.`
+              : finished || data.spec?.active === false
+                ? `No LocalQueue ${queueName} exists in namespace ${namespace}.`
+                : `No LocalQueue ${queueName} exists in namespace ${namespace}. Kueue can't admit this Workload until it does.`}</p>}
+          </>}
+        </Step>
+        {queueName && reads && (
+          <Step label="ClusterQueue">
+            {configured ? <>
+              <ClusterQueueReadSummary name={configured} read={configuredRead} onNavigate={onNavigate} />
+              <p className="text-xs text-theme-text-tertiary">Configured by LocalQueue {queueName}.</p>
+              {eligibility && !reserved && <div className="text-xs"><span className="text-theme-text-tertiary">Namespace {namespace}: </span><FactValue fact={eligibility} /><FactSource fact={eligibility} /></div>}
+            </> : <p className={muted}>
+              {localQueue?.state === 'found' ? 'The LocalQueue names no ClusterQueue.'
+                : localQueue?.state === 'not_found' ? `None: LocalQueue ${queueName} doesn't exist.`
+                  : localQueue?.state === 'unconfirmed' ? `Unknown: this Radar can't confirm LocalQueue ${queueName} exists.`
+                  : localQueue?.state === 'loading' ? 'Checking…' : 'Unknown until the LocalQueue is read.'}
+            </p>}
+          </Step>
+        )}
+        <Step label="Reservation">
+          {reserved ? <>
+            <p className="text-xs text-theme-text-tertiary">{finished ? 'Reservation recorded in (the Workload finished, so its quota was released)' : 'Quota reserved in'}</p>
+            {reads && reserved !== configured
+              ? <ClusterQueueReadSummary name={reserved} read={reads.clusterQueues?.[reserved]} onNavigate={onNavigate} />
+              : <div className="break-all [&_button]:text-left"><ResourceLink name={reserved} kind="clusterqueues" group={KUEUE_GROUP} onNavigate={onNavigate} /></div>}
+            {configured && configured !== reserved && (finished || admitted
+              ? <p className="text-xs text-theme-text-tertiary">Reserved in {reserved}; LocalQueue {queueName}, as it exists now, names {configured}.</p>
+              : <p className="text-xs text-warning-text">Reserved in {reserved}; LocalQueue {queueName}, as it exists now, names {configured}.</p>)}
+          </> : <>
+            <p className={muted}>No reservation reported.</p>
+            {pendingMessage && <p className="whitespace-pre-wrap break-words text-xs text-theme-text-secondary"><span className="text-theme-text-tertiary">{pendingStale ? `Controller-reported on QuotaReserved for generation ${quota.observedGeneration} (now ${data.metadata?.generation}): ` : 'Controller-reported on QuotaReserved: '}</span>{pendingMessage}</p>}
+          </>}
+        </Step>
+        {assignments.length > 0 && (
+          <Step label="Flavors">
+            <div className="space-y-2">
+              {assignments.map((assignment, index) => (
+                <div key={assignment?.name ?? index} className="space-y-0.5">
+                  {assignments.length > 1 && <p className="text-xs font-medium text-theme-text-secondary">{assignment?.name ?? `PodSet ${index + 1}`}</p>}
+                  {Object.entries(assignment?.flavors ?? {}).length === 0
+                    ? <p className={muted}>No flavors reported.</p>
+                    : Object.entries(assignment.flavors).map(([resource, flavor]) => (
+                      <div key={resource} className="flex flex-wrap items-center gap-1.5 break-all text-xs [&_button]:text-left">
+                        <span className="text-theme-text-secondary">{resource}</span>
+                        <span className="text-theme-text-tertiary">→</span>
+                        <ResourceLink name={String(flavor)} kind="resourceflavors" group={KUEUE_GROUP} onNavigate={onNavigate} />
+                        {finished && reads?.flavors?.[String(flavor)]?.state === 'not_found'
+                          ? <span className="text-xs text-theme-text-tertiary">No longer exists</span>
+                          : reads?.flavors?.[String(flavor)]?.state !== 'found' && <ReadState read={reads?.flavors?.[String(flavor)]} />}
+                      </div>
+                    ))}
+                </div>
+              ))}
+            </div>
+          </Step>
+        )}
+      </ol>
+    </Section>
+  )
+}
+
+/** Reasons grouped under the flavor they name, in the order flavors first appear in the message. */
+function groupByFlavor(attempts: FlavorAttempt[]): [string | undefined, FlavorAttempt[]][] {
+  const groups = new Map<string | undefined, FlavorAttempt[]>()
+  for (const attempt of attempts) groups.set(attempt.flavor, [...(groups.get(attempt.flavor) ?? []), attempt])
+  return [...groups]
+}
+
+const attemptLabel: Record<FlavorAttemptKind, string> = {
+  insufficient_quota: 'Over maximum capacity',
+  insufficient_unused_quota: 'Not enough unused quota',
+  untolerated_taint: 'Untolerated taint',
+  node_affinity: 'Node affinity mismatch',
+  flavor_not_found: 'Flavor not found',
+  resource_unavailable: 'Resource not in ClusterQueue',
+  skipped_by_annotation: 'Skipped by annotation',
+  pinned_by_original: 'Held by original Workload',
+}
+
+/**
+ * The reasons Kueue gave per flavor in the Workload's pending QuotaReserved
+ * message, parsed when every part is recognised and verbatim otherwise. It is
+ * one controller report, not an attempt history.
+ */
+export function FlavorReasons({ data, onNavigate }: { data: any; onNavigate?: Navigate }) {
+  const conditions: any[] = data.status?.conditions ?? []
+  const quota = conditions.find(condition => condition?.type === 'QuotaReserved')
+  if (quota?.status !== 'False' || !isFlavorAssignmentMessage(quota.message)) return null
+  const stale = isKueueConditionStale(quota, data.metadata?.generation)
+  const parsed = parseFlavorAttempts(quota.message)
+  return (
+    <Section variant="card" title="Reasons Reported per Flavor">
+      {stale && <p className="mb-2 text-xs text-warning-text">Reported for generation {quota.observedGeneration} (now {data.metadata?.generation}); the Workload has changed since.</p>}
+      <p className="mb-3 text-xs text-theme-text-tertiary">From the controller-reported message on QuotaReserved. Kueue lists the reasons alphabetically, not in the order it tried flavors, and may not report every flavor.</p>
+      {parsed ? (
+        <div className="space-y-3">
+          {parsed.map(podSet => (
+            <div key={podSet.podSet} className="space-y-2">
+              <p className="text-xs font-medium text-theme-text-secondary">PodSet {podSet.podSet}</p>
+              <ul className="divide-y divide-theme-border">
+                {groupByFlavor(podSet.attempts).map(([flavor, attempts]) => (
+                  <li key={flavor ?? ''} className="space-y-1 py-2 text-sm first:pt-0 last:pb-0">
+                    <div className="break-all [&_button]:text-left">
+                      {flavor ? <ResourceLink name={flavor} kind="resourceflavors" group={KUEUE_GROUP} onNavigate={onNavigate} /> : <span className="text-xs text-theme-text-tertiary">No flavor named</span>}
+                    </div>
+                    {attempts.map((attempt, index) => (
+                      <div key={index} className="space-y-0.5 pl-3">
+                        <div className="flex flex-wrap items-center gap-2 text-xs">
+                          {attempt.resource && <code className="text-theme-text-secondary">{attempt.resource}</code>}
+                          <span className="text-theme-text-tertiary">{attemptLabel[attempt.kind]}</span>
+                        </div>
+                        <p className="whitespace-pre-wrap break-words text-xs text-theme-text-secondary">{attempt.text}</p>
+                      </div>
+                    ))}
+                  </li>
+                ))}
+              </ul>
+            </div>
+          ))}
+        </div>
+      ) : (
+        <p className="whitespace-pre-wrap break-words text-sm text-theme-text-secondary">{quota.message}</p>
+      )}
+    </Section>
+  )
+}

package/src/components/kueue/QueueEvidence.tsx

@@ -0,0 +1,148 @@
+import type { ReactNode } from 'react'
+import { Badge } from '../ui/Badge'
+import { ResourceLink } from '../ui/drawer-components'
+import { TimeValue } from '../ui/ScheduleValue'
+import { FactGrid, FactRow, FactValue, type Fact } from '../facts'
+import type { StatusBadge } from '../resources/resource-utils'
+import { getAdmissionCheckStatus, getClusterQueueStatus, getKueueQueueCondition, isKueueConditionStale } from '../resources/resource-utils-kueue'
+import { describeKueuePolicy } from './policy'
+import { isDenied, unreadReason, type RelatedRead } from './related-read'
+import { namespaceEligibility } from './eligibility'
+import { KUEUE_GROUP } from './constants'
+
+export type Navigate = (ref: { kind: string; namespace: string; name: string; group?: string }) => void
+
+/** One related object's name with what Radar's read of it found. Without a read, the name alone. */
+export function ReadState({ read, found }: { read?: RelatedRead; found?: ReactNode }) {
+  if (!read) return null
+  if (read.state === 'found') return <>{found ?? <Badge severity="neutral" size="sm">Found</Badge>}</>
+  if (read.state === 'not_found') return <Badge severity="error" size="sm">Not found</Badge>
+  if (read.state === 'unconfirmed') return <span className="text-xs text-theme-text-tertiary">This Radar can’t confirm whether it exists</span>
+  return <span className={isDenied(read) ? 'text-xs text-theme-text-secondary' : 'text-xs text-theme-text-tertiary'}>{read.state === 'loading' ? 'Checking…' : `Not read: ${unreadReason(read)}`}</span>
+}
+
+export function StatusPill({ status }: { status: StatusBadge }) {
+  return <Badge colorClass={status.color} size="sm">{status.text}</Badge>
+}
+
+export function ReportedActive({ data, status, children }: { data: any; status: StatusBadge; children?: ReactNode }) {
+  const condition = getKueueQueueCondition(data)
+  const generation = data?.metadata?.generation
+  if (!condition) {
+    return <div className="space-y-2 text-sm">
+      <div className="flex flex-wrap items-center gap-2"><StatusPill status={status} /></div>
+      <p className="text-theme-text-secondary">No Active condition reported.</p>
+      {children}
+    </div>
+  }
+  return <div className="space-y-2 text-sm">
+    <div className="flex flex-wrap items-center gap-2">
+      <StatusPill status={status} />
+      {condition.reason && !status.text.startsWith(condition.reason) && <code className="break-all text-xs text-theme-text-secondary">{condition.reason}</code>}
+    </div>
+    {condition.message && <p className="whitespace-pre-wrap break-words text-theme-text-primary">{condition.message}</p>}
+    <p className="text-xs text-theme-text-tertiary">
+      Active={condition.status}
+      {condition.lastTransitionTime && <> since <TimeValue timestamp={condition.lastTransitionTime} /></>}
+      {' · '}
+      {condition.observedGeneration ? `observed generation ${condition.observedGeneration} of ${generation ?? '?'}` : 'observed generation not reported'}
+    </p>
+    {children}
+  </div>
+}
+
+function count(value: unknown, source: string): Fact {
+  return typeof value === 'number'
+    ? { text: String(value), tone: 'neutral', source }
+    : { text: 'Not reported', tone: 'unknown', source }
+}
+
+/** Controller-reported Workload counts. Reserving includes admitted, so they never add up. */
+export function QueueCounts({ data, kind }: { data: any; kind: 'ClusterQueue' | 'LocalQueue' }) {
+  const source = `Reported in the ${kind}'s status`
+  return <div className="space-y-2">
+    <FactGrid>
+      <FactRow label="Pending"><FactValue fact={count(data?.status?.pendingWorkloads, source)} /></FactRow>
+      <FactRow label="Reserving quota"><FactValue fact={count(data?.status?.reservingWorkloads, source)} /></FactRow>
+      <FactRow label="Admitted"><FactValue fact={count(data?.status?.admittedWorkloads, source)} /></FactRow>
+    </FactGrid>
+    <p className="text-xs text-theme-text-tertiary">Reserving includes admitted Workloads, so these counts are not additive. Admission does not establish that Pods are running.</p>
+  </div>
+}
+
+export function ConfiguredStop({ data }: { data: any }) {
+  const raw = data?.spec?.stopPolicy
+  const policy = describeKueuePolicy(data?.apiVersion, 'stopPolicy', raw ?? 'None')
+  return <div className="space-y-1 text-sm">
+    <div className="flex flex-wrap items-baseline gap-2">
+      <span className="text-theme-text-tertiary">Stop policy</span>
+      <code className="text-theme-text-primary">{policy.raw}</code>
+      {raw == null && <span className="text-xs text-theme-text-tertiary">(not set)</span>}
+    </div>
+    <p className="text-theme-text-secondary">{policy.meaning ?? `Radar has no description of this value for ${data?.apiVersion ?? 'this API version'}.`}</p>
+  </div>
+}
+
+function ReportedMessage({ condition, generation }: { condition: any; generation?: number }) {
+  return <p className="whitespace-pre-wrap break-words text-xs text-theme-text-secondary">
+    {isKueueConditionStale(condition, generation) && <span className="text-theme-text-tertiary">Reported for generation {condition.observedGeneration} (now {generation}): </span>}
+    {condition.message}
+  </p>
+}
+
+export function ClusterQueueReadSummary({ name, read, onNavigate }: { name: string; read?: RelatedRead; onNavigate?: Navigate }) {
+  const parent = read?.state === 'found' ? read.object : undefined
+  const condition = parent ? getKueueQueueCondition(parent) : undefined
+  return <div className="min-w-0 space-y-1 text-sm">
+    <div className="flex flex-wrap items-center gap-2 break-all [&_button]:text-left">
+      <ResourceLink name={name} kind="clusterqueues" group={KUEUE_GROUP} onNavigate={onNavigate} />
+      <ReadState read={read} found={parent ? <StatusPill status={getClusterQueueStatus(parent)} /> : undefined} />
+    </div>
+    {parent && <p className="text-xs text-theme-text-secondary">
+      Read from the ClusterQueue{condition?.reason && condition.status !== 'True' ? `: ${condition.reason}${isKueueConditionStale(condition, parent.metadata?.generation) ? ' (stale)' : ''}` : ''}{parent.spec?.stopPolicy && parent.spec.stopPolicy !== 'None' ? ` · stop policy ${parent.spec.stopPolicy}` : ''}
+    </p>}
+    {parent && condition?.message && condition.status !== 'True' && <ReportedMessage condition={condition} generation={parent.metadata?.generation} />}
+  </div>
+}
+
+/**
+ * Whether a namespace matches a ClusterQueue's namespaceSelector. The
+ * selector is only known from a ClusterQueue that was read; the namespace's
+ * labels are needed only when the selector has terms.
+ */
+export function namespaceEligibilityFact({ clusterQueue, parent, namespaceRead }: { clusterQueue: string; parent?: RelatedRead; namespaceRead?: RelatedRead }): Fact {
+  const source = `ClusterQueue ${clusterQueue} namespaceSelector`
+  if (parent?.state !== 'found') {
+    const why = !parent ? 'Unknown: the ClusterQueue was not read'
+      : parent.state === 'loading' ? 'Checking the ClusterQueue…'
+        : parent.state === 'not_found' ? 'Unknown: the ClusterQueue was not found'
+          : `Unknown: ClusterQueue not read (${unreadReason(parent)})`
+    return { text: why, tone: 'unknown', source }
+  }
+  const selector = parent.object?.spec?.namespaceSelector
+  const labels = namespaceRead?.state === 'found' ? (namespaceRead.object?.metadata?.labels ?? {}) : undefined
+  const result = namespaceEligibility(selector, labels)
+  switch (result.state) {
+    case 'eligible':
+      return { text: result.basis === 'all' ? 'Eligible: the selector is empty ({}), so every namespace matches' : 'Eligible: its labels match the selector', tone: 'healthy', source }
+    case 'not_eligible':
+      return { text: result.basis === 'none' ? 'Not eligible: the ClusterQueue sets no namespaceSelector, so no namespace matches' : 'Not eligible: its labels don’t match the selector', tone: 'unhealthy', source }
+    default:
+      if (result.why === 'unsupported_operator') return { text: `Unknown: the selector uses operator ${result.operator || '(none)'}, which Radar doesn't evaluate`, tone: 'unknown', source }
+      if (namespaceRead?.state === 'loading') return { text: 'Checking the namespace…', tone: 'unknown', source }
+      return { text: namespaceRead?.state === 'not_found' ? 'Unknown: the Namespace was not found' : `Unknown: its labels weren’t read (${unreadReason(namespaceRead)})`, tone: 'unknown', source }
+  }
+}
+
+export function AdmissionCheckRow({ name, onFlavors, read, onNavigate }: { name: string; onFlavors?: string[]; read?: RelatedRead; onNavigate?: Navigate }) {
+  const check = read?.state === 'found' ? read.object : undefined
+  const condition = check ? getKueueQueueCondition(check) : undefined
+  return <div className="min-w-0 space-y-1 text-sm">
+    <div className="flex flex-wrap items-center gap-2 break-all [&_button]:text-left">
+      <ResourceLink name={name} kind="admissionchecks" group={KUEUE_GROUP} onNavigate={onNavigate} />
+      <ReadState read={read} found={check ? <StatusPill status={getAdmissionCheckStatus(check)} /> : undefined} />
+    </div>
+    <p className="break-words text-xs text-theme-text-secondary">{onFlavors?.length ? `Applies to flavors: ${onFlavors.join(', ')}` : 'Applies to all flavors'}</p>
+    {condition?.message && condition.status !== 'True' && <ReportedMessage condition={condition} generation={check.metadata?.generation} />}
+  </div>
+}

package/src/components/kueue/constants.ts

@@ -0,0 +1 @@
+export const KUEUE_GROUP = 'kueue.x-k8s.io'

package/src/components/kueue/eligibility.ts

@@ -0,0 +1,43 @@
+// Whether a namespace may submit Workloads to a ClusterQueue, from the
+// ClusterQueue's namespaceSelector. Kueue reads a null selector as "no
+// namespace" and an empty one ({}) as "every namespace", so only a selector
+// with terms needs the namespace's labels.
+
+export type NamespaceEligibility =
+  | { state: 'eligible'; basis: 'all' | 'labels' }
+  | { state: 'not_eligible'; basis: 'none' | 'labels' }
+  /** The labels are needed and weren't read, or the selector can't be evaluated. */
+  | { state: 'unknown'; why: 'labels_unread' | 'unsupported_operator'; operator?: string }
+
+interface Requirement { key?: string; operator?: string; values?: string[] }
+export interface LabelSelector { matchLabels?: Record<string, string>; matchExpressions?: Requirement[] }
+
+function selectorHasTerms(selector: LabelSelector | null | undefined): boolean {
+  return !!selector && (Object.keys(selector.matchLabels ?? {}).length > 0 || (selector.matchExpressions?.length ?? 0) > 0)
+}
+
+/** Evaluating the selector would use the namespace's labels (it has terms, all with supported operators). */
+export function needsNamespaceLabels(selector: LabelSelector | null | undefined): boolean {
+  const result = namespaceEligibility(selector, undefined)
+  return result.state === 'unknown' && result.why === 'labels_unread'
+}
+
+/** labels is undefined when the namespace's labels weren't read. */
+export function namespaceEligibility(selector: LabelSelector | null | undefined, labels: Record<string, string> | undefined): NamespaceEligibility {
+  if (selector == null) return { state: 'not_eligible', basis: 'none' }
+  if (!selectorHasTerms(selector)) return { state: 'eligible', basis: 'all' }
+  const unsupported = (selector.matchExpressions ?? []).find(term => !['In', 'NotIn', 'Exists', 'DoesNotExist'].includes(term?.operator ?? ''))
+  if (unsupported) return { state: 'unknown', why: 'unsupported_operator', operator: String(unsupported?.operator ?? '') }
+  if (!labels) return { state: 'unknown', why: 'labels_unread' }
+  const has = (key: string) => Object.prototype.hasOwnProperty.call(labels, key)
+  const matches = Object.entries(selector.matchLabels ?? {}).every(([key, value]) => has(key) && labels[key] === value)
+    && (selector.matchExpressions ?? []).every(({ key = '', operator, values = [] }) => {
+      switch (operator) {
+        case 'In': return has(key) && values.includes(labels[key])
+        case 'NotIn': return !has(key) || !values.includes(labels[key])
+        case 'Exists': return has(key)
+        default: return !has(key)
+      }
+    })
+  return matches ? { state: 'eligible', basis: 'labels' } : { state: 'not_eligible', basis: 'labels' }
+}

package/src/components/kueue/flavors-tried.ts

@@ -0,0 +1,79 @@
+// Parses the flavor attempts out of a pending Workload's QuotaReserved
+// message. Kueue builds it as "couldn't assign flavors to pod set <ps>: <reasons>"
+// per failing pod set, joined by "; ", with each pod set's reasons sorted
+// alphabetically and joined by ", " — so the order of the reasons is not the
+// order flavors were tried. A message with any part this parser doesn't
+// recognise yields null and is shown verbatim instead.
+
+export type FlavorAttemptKind =
+  | 'insufficient_quota'
+  | 'insufficient_unused_quota'
+  | 'untolerated_taint'
+  | 'node_affinity'
+  | 'flavor_not_found'
+  | 'resource_unavailable'
+  | 'skipped_by_annotation'
+  | 'pinned_by_original'
+
+export interface FlavorAttempt {
+  kind: FlavorAttemptKind
+  flavor?: string
+  resource?: string
+  /** The controller's own words for this reason. */
+  text: string
+}
+
+export interface PodSetAttempts {
+  podSet: string
+  attempts: FlavorAttempt[]
+}
+
+const podSetPrefix = "couldn't assign flavors to pod set "
+
+/** The message is Kueue's per-flavor account of why quota wasn't assigned (parsed or not). Its error form isn't. */
+export function isFlavorAssignmentMessage(message: string | undefined): boolean {
+  return !!message && message.startsWith(podSetPrefix)
+}
+
+const patterns: { kind: FlavorAttemptKind; re: RegExp; flavor?: number; resource?: number }[] = [
+  { kind: 'insufficient_unused_quota', re: /^insufficient unused quota for (\S+) in flavor (\S+), \S+ more needed$/, resource: 1, flavor: 2 },
+  { kind: 'insufficient_quota', re: /^insufficient quota for (\S+) in flavor (\S+), (?:previously considered podsets requests \(\S+\) \+ current podset request \(\S+\) > maximum capacity \(\S+\)|request > maximum capacity \(\S+ > \S+\))$/, resource: 1, flavor: 2 },
+  { kind: 'untolerated_taint', re: /^untolerated taint .+ in flavor (\S+)$/, flavor: 1 },
+  { kind: 'node_affinity', re: /^flavor (\S+) doesn't match node affinity$/, flavor: 1 },
+  { kind: 'flavor_not_found', re: /^flavor (\S+) not found$/, flavor: 1 },
+  { kind: 'resource_unavailable', re: /^resource (\S+) unavailable in ClusterQueue$/, resource: 1 },
+  { kind: 'skipped_by_annotation', re: /^skipping flavor (\S+) due to WorkloadAllowedResourceFlavorAnnotation annotation$/, flavor: 1 },
+  // Names the candidate flavor, then the flavor the original Workload holds.
+  { kind: 'pinned_by_original', re: /^could not assign (\S+) flavor since the original workload is assigned: \S+$/, flavor: 1 },
+]
+
+// A reason begins only at one of these; ", " inside a reason ("…, 2 more needed")
+// is not a boundary.
+const reasonStart = /, (?=insufficient (?:unused )?quota for |untolerated taint |flavor \S+ (?:doesn't match node affinity|not found)|resource \S+ unavailable in ClusterQueue|skipping flavor |could not assign )/
+
+function parseReason(text: string): FlavorAttempt | null {
+  for (const { kind, re, flavor, resource } of patterns) {
+    const match = re.exec(text)
+    if (match) return { kind, text, ...(flavor ? { flavor: match[flavor] } : {}), ...(resource ? { resource: match[resource] } : {}) }
+  }
+  return null
+}
+
+export function parseFlavorAttempts(message: string | undefined): PodSetAttempts[] | null {
+  if (!message?.startsWith(podSetPrefix)) return null
+  const result: PodSetAttempts[] = []
+  for (const part of message.slice(podSetPrefix.length).split(`; ${podSetPrefix}`)) {
+    const separator = part.indexOf(': ')
+    if (separator <= 0) return null
+    const podSet = part.slice(0, separator)
+    const reasons = part.slice(separator + 2).split(reasonStart)
+    const attempts: FlavorAttempt[] = []
+    for (const reason of reasons) {
+      const attempt = parseReason(reason)
+      if (!attempt) return null
+      attempts.push(attempt)
+    }
+    result.push({ podSet, attempts })
+  }
+  return result
+}

package/src/components/kueue/helpers.test.ts

@@ -0,0 +1,105 @@
+import { describe, expect, it } from 'vitest'
+import { parseFlavorAttempts } from './flavors-tried'
+import { namespaceEligibility } from './eligibility'
+import { describeKueuePolicy } from './policy'
+import { isDenied, unreadReason } from './related-read'
+
+describe('parseFlavorAttempts', () => {
+  it('parses the Kueue v0.18 message seen on a live 3-CPU Workload into both attempts', () => {
+    const message = "couldn't assign flavors to pod set main: insufficient quota for cpu in flavor gpu-night-813-small, previously considered podsets requests (0) + current podset request (3) > maximum capacity (1), insufficient quota for cpu in flavor gpu-night-813-spot, previously considered podsets requests (0) + current podset request (3) > maximum capacity (1)"
+    expect(parseFlavorAttempts(message)).toEqual([{ podSet: 'main', attempts: [
+      { kind: 'insufficient_quota', resource: 'cpu', flavor: 'gpu-night-813-small', text: 'insufficient quota for cpu in flavor gpu-night-813-small, previously considered podsets requests (0) + current podset request (3) > maximum capacity (1)' },
+      { kind: 'insufficient_quota', resource: 'cpu', flavor: 'gpu-night-813-spot', text: 'insufficient quota for cpu in flavor gpu-night-813-spot, previously considered podsets requests (0) + current podset request (3) > maximum capacity (1)' },
+    ] }])
+  })
+
+  it('splits pod sets and every reason format, keeping commas inside a reason', () => {
+    const message = "couldn't assign flavors to pod set driver: flavor a doesn't match node affinity, insufficient unused quota for nvidia.com/gpu in flavor b, 2 more needed, untolerated taint gpu=true:NoSchedule in flavor c; couldn't assign flavors to pod set workers: flavor z not found, resource example.com/fpga unavailable in ClusterQueue, skipping flavor y due to WorkloadAllowedResourceFlavorAnnotation annotation, could not assign x flavor since the original workload is assigned: w"
+    const parsed = parseFlavorAttempts(message)
+    expect(parsed?.map(p => p.podSet)).toEqual(['driver', 'workers'])
+    expect(parsed?.[0].attempts.map(a => [a.kind, a.flavor, a.resource])).toEqual([
+      ['node_affinity', 'a', undefined], ['insufficient_unused_quota', 'b', 'nvidia.com/gpu'], ['untolerated_taint', 'c', undefined],
+    ])
+    expect(parsed?.[1].attempts.map(a => [a.kind, a.flavor, a.resource])).toEqual([
+      ['flavor_not_found', 'z', undefined], ['resource_unavailable', undefined, 'example.com/fpga'], ['skipped_by_annotation', 'y', undefined], ['pinned_by_original', 'x', undefined],
+    ])
+  })
+
+  it('returns null for anything it cannot account for, so the caller shows the message verbatim', () => {
+    for (const message of [
+      undefined,
+      '',
+      "LocalQueue no-such-localqueue doesn't exist",
+      "Workload namespace doesn't match ClusterQueue selector",
+      'failed to assign flavors to pod set main: boom',
+      "couldn't assign flavors to pod set main: topology \"rack\" doesn't allow to fit any of 3 pod(s)",
+      "couldn't assign flavors to pod set main: insufficient quota for cpu in flavor a, request > maximum capacity (24 > 8), something new",
+      "couldn't assign flavors to pod set main",
+    ]) expect(parseFlavorAttempts(message)).toBeNull()
+  })
+
+  it('accepts an older quota detail shape as long as the reason prefix is known', () => {
+    expect(parseFlavorAttempts("couldn't assign flavors to pod set main: insufficient quota for cpu in flavor default, request > maximum capacity (24 > 8)")?.[0].attempts[0].flavor).toBe('default')
+  })
+})
+
+describe('namespaceEligibility', () => {
+  it('reads null as no namespace and {} as every namespace without needing labels', () => {
+    expect(namespaceEligibility(null, undefined)).toEqual({ state: 'not_eligible', basis: 'none' })
+    expect(namespaceEligibility(undefined, undefined)).toEqual({ state: 'not_eligible', basis: 'none' })
+    expect(namespaceEligibility({}, undefined)).toEqual({ state: 'eligible', basis: 'all' })
+    expect(namespaceEligibility({ matchLabels: {}, matchExpressions: [] }, undefined)).toEqual({ state: 'eligible', basis: 'all' })
+  })
+
+  it('needs labels for a selector with terms, and says so when they were not read', () => {
+    expect(namespaceEligibility({ matchLabels: { team: 'a' } }, undefined)).toEqual({ state: 'unknown', why: 'labels_unread' })
+    expect(namespaceEligibility({ matchLabels: { team: 'a' } }, { team: 'a' }).state).toBe('eligible')
+    expect(namespaceEligibility({ matchLabels: { team: 'a' } }, { team: 'b' }).state).toBe('not_eligible')
+    expect(namespaceEligibility({ matchLabels: { team: 'a' } }, {}).state).toBe('not_eligible')
+  })
+
+  it('evaluates every selector operator as Kubernetes does', () => {
+    const sel = (operator: string, values?: string[]) => ({ matchExpressions: [{ key: 'tier', operator, values }] })
+    expect(namespaceEligibility(sel('In', ['gpu']), { tier: 'gpu' }).state).toBe('eligible')
+    expect(namespaceEligibility(sel('In', ['gpu']), {}).state).toBe('not_eligible')
+    expect(namespaceEligibility(sel('NotIn', ['gpu']), {}).state).toBe('eligible')
+    expect(namespaceEligibility(sel('NotIn', ['gpu']), { tier: 'gpu' }).state).toBe('not_eligible')
+    expect(namespaceEligibility(sel('Exists'), { tier: '' }).state).toBe('eligible')
+    expect(namespaceEligibility(sel('DoesNotExist'), { tier: '' }).state).toBe('not_eligible')
+    expect(namespaceEligibility(sel('Gt', ['1']), { tier: '2' })).toEqual({ state: 'unknown', why: 'unsupported_operator', operator: 'Gt' })
+  })
+})
+
+describe('describeKueuePolicy', () => {
+  it('keeps a dictionary per API version and shows unknown values raw', () => {
+    expect(describeKueuePolicy('kueue.x-k8s.io/v1beta1', 'flavorFungibility.whenCanBorrow', 'Borrow').meaning).toContain('Equivalent to MayStopSearch in newer Kueue')
+    expect(describeKueuePolicy('kueue.x-k8s.io/v1beta2', 'flavorFungibility.whenCanBorrow', 'Borrow')).toEqual({ raw: 'Borrow' })
+    expect(describeKueuePolicy('kueue.x-k8s.io/v1beta2', 'admissionScope.admissionMode', 'NoAdmissionFairSharing').meaning).toBeTruthy()
+    expect(describeKueuePolicy('kueue.x-k8s.io/v1', 'stopPolicy', 'Hold')).toEqual({ raw: 'Hold' })
+    expect(describeKueuePolicy('kueue.x-k8s.io/v1beta2', 'stopPolicy', 'Hold').meaning).toContain('admitted Workloads run to completion')
+  })
+})
+
+describe('related reads', () => {
+  it('tells a denial apart from a read that failed for another reason', () => {
+    expect(isDenied({ state: 'unavailable', code: 'user_forbidden' })).toBe(true)
+    expect(isDenied({ state: 'unavailable', code: 'kind_sync_timed_out' })).toBe(false)
+    expect(isDenied({ state: 'not_found' })).toBe(false)
+    expect(unreadReason({ state: 'unavailable', code: 'user_forbidden' })).toBe('you can’t read it')
+    expect(unreadReason({ state: 'unavailable', code: 'radar_forbidden' })).toBe('Radar can’t read it')
+    expect(unreadReason({ state: 'unavailable', code: 'rbac_denied' })).toBe('you can’t read it')
+    expect(unreadReason({ state: 'loading' })).toBe('checking…')
+    expect(unreadReason({ state: 'unavailable' })).toBe('the read failed')
+  })
+})
+
+describe('policy dictionaries against the served CRDs', () => {
+  it('describe every enum value Kueue v0.18 serves, per version', async () => {
+    const { enums } = (await import('./testdata/kueue-v0.18-policy-enums.json')).default as { enums: Record<string, Record<string, string[]>> }
+    for (const [version, fields] of Object.entries(enums)) {
+      for (const [field, values] of Object.entries(fields)) {
+        for (const value of values) expect(describeKueuePolicy(version, field as any, value).meaning, `${version} ${field}=${value}`).toBeTruthy()
+      }
+    }
+  })
+})