@skyhook-io/k8s-ui 1.5.13 → 1.6.0

package/src/utils/gitops-owner.test.ts

@@ -0,0 +1,136 @@
+import { describe, it, expect } from 'vitest'
+import { detectGitOpsOwner } from './gitops-owner'
+
+const FLUX_HELM_NAME = 'helm.toolkit.fluxcd.io/name'
+const FLUX_HELM_NS = 'helm.toolkit.fluxcd.io/namespace'
+const FLUX_KUSTOMIZE_NAME = 'kustomize.toolkit.fluxcd.io/name'
+const FLUX_KUSTOMIZE_NS = 'kustomize.toolkit.fluxcd.io/namespace'
+const ARGO_TRACKING_ID = 'argocd.argoproj.io/tracking-id'
+const ARGO_INSTANCE = 'argocd.argoproj.io/instance'
+const HELM_INSTANCE = 'app.kubernetes.io/instance'
+
+function resource(labels: Record<string, string> = {}, annotations: Record<string, string> = {}) {
+  return { metadata: { labels, annotations } }
+}
+
+describe('detectGitOpsOwner', () => {
+  it('returns null for non-objects', () => {
+    expect(detectGitOpsOwner(null)).toBeNull()
+    expect(detectGitOpsOwner(undefined)).toBeNull()
+    expect(detectGitOpsOwner('string')).toBeNull()
+  })
+
+  it('returns null when no GitOps labels/annotations present', () => {
+    expect(detectGitOpsOwner(resource({ app: 'foo' }))).toBeNull()
+  })
+
+  describe('Flux HelmRelease labels', () => {
+    it('extracts name + namespace', () => {
+      const got = detectGitOpsOwner(resource({
+        [FLUX_HELM_NAME]: 'podinfo',
+        [FLUX_HELM_NS]: 'flux-system',
+      }))
+      expect(got).toEqual({ tool: 'fluxcd', kind: 'helmreleases', namespace: 'flux-system', name: 'podinfo' })
+    })
+
+    it('wins over Flux Kustomize labels when both are present (most-direct owner)', () => {
+      const got = detectGitOpsOwner(resource({
+        [FLUX_HELM_NAME]: 'podinfo',
+        [FLUX_HELM_NS]: 'flux-system',
+        [FLUX_KUSTOMIZE_NAME]: 'parent',
+        [FLUX_KUSTOMIZE_NS]: 'flux-system',
+      }))
+      expect(got?.kind).toBe('helmreleases')
+      expect(got?.name).toBe('podinfo')
+    })
+
+    it('requires both name and namespace', () => {
+      expect(detectGitOpsOwner(resource({ [FLUX_HELM_NAME]: 'podinfo' }))).toBeNull()
+      expect(detectGitOpsOwner(resource({ [FLUX_HELM_NS]: 'flux-system' }))).toBeNull()
+    })
+  })
+
+  describe('Flux Kustomize labels', () => {
+    it('extracts name + namespace', () => {
+      const got = detectGitOpsOwner(resource({
+        [FLUX_KUSTOMIZE_NAME]: 'infra',
+        [FLUX_KUSTOMIZE_NS]: 'flux-system',
+      }))
+      expect(got).toEqual({ tool: 'fluxcd', kind: 'kustomizations', namespace: 'flux-system', name: 'infra' })
+    })
+  })
+
+  describe('Argo tracking-id annotation', () => {
+    it('parses the namespaced form (<ns>_<name>:...)', () => {
+      const got = detectGitOpsOwner(resource({}, {
+        [ARGO_TRACKING_ID]: 'argocd_my-app:apps/Deployment:default/web',
+      }))
+      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'my-app' })
+    })
+
+    it('parses the legacy single-name form (no underscore)', () => {
+      const got = detectGitOpsOwner(resource({}, {
+        [ARGO_TRACKING_ID]: 'my-app:apps/Deployment:default/web',
+      }))
+      // Empty namespace is the contract — caller defaults / routes accordingly.
+      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: '', name: 'my-app' })
+    })
+
+    it('returns null on a malformed tracking-id (no colon)', () => {
+      const got = detectGitOpsOwner(resource({}, { [ARGO_TRACKING_ID]: 'just-garbage-no-colon' }))
+      // Falls through to label scan; with no labels present, returns null.
+      expect(got).toBeNull()
+    })
+
+    it('returns null on tracking-id with empty name after underscore', () => {
+      const got = detectGitOpsOwner(resource({}, { [ARGO_TRACKING_ID]: 'my-ns_:apps/Deployment:default/web' }))
+      expect(got).toBeNull()
+    })
+
+    it('wins over the bare instance label (most authoritative)', () => {
+      const got = detectGitOpsOwner(resource(
+        { [ARGO_INSTANCE]: 'wrong-app' },
+        { [ARGO_TRACKING_ID]: 'argocd_right-app:apps/Deployment:default/web' },
+      ))
+      expect(got?.name).toBe('right-app')
+      expect(got?.namespace).toBe('argocd')
+    })
+  })
+
+  describe('Argo instance label fallback', () => {
+    it('extracts name from argocd-specific instance label', () => {
+      const got = detectGitOpsOwner(resource({ [ARGO_INSTANCE]: 'guestbook' }))
+      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: '', name: 'guestbook' })
+    })
+
+    it('does NOT fall back to standard k8s instance label', () => {
+      // app.kubernetes.io/instance is stamped by virtually every Helm chart.
+      // Treating it as an Argo signal produced a false "Managed by <release>"
+      // chip on plain Helm-installed resources, so detection now requires an
+      // Argo-specific signal (tracking-id annotation or argocd.argoproj.io/instance).
+      expect(detectGitOpsOwner(resource({ [HELM_INSTANCE]: 'guestbook-healthy' }))).toBeNull()
+    })
+
+    it('argocd-specific label still wins when both labels present', () => {
+      const got = detectGitOpsOwner(resource({
+        [ARGO_INSTANCE]: 'argo-pick',
+        [HELM_INSTANCE]: 'helm-pick',
+      }))
+      expect(got?.name).toBe('argo-pick')
+    })
+  })
+
+  describe('Flux labels beat Argo annotations', () => {
+    it('Flux HelmRelease wins over Argo tracking-id', () => {
+      const got = detectGitOpsOwner(resource(
+        {
+          [FLUX_HELM_NAME]: 'podinfo',
+          [FLUX_HELM_NS]: 'flux-system',
+        },
+        { [ARGO_TRACKING_ID]: 'argocd_some-app:apps/Deployment:default/web' },
+      ))
+      expect(got?.tool).toBe('fluxcd')
+      expect(got?.kind).toBe('helmreleases')
+    })
+  })
+})

package/src/utils/gitops-owner.ts

@@ -0,0 +1,92 @@
+// Detect whether a Kubernetes resource is managed by a GitOps controller
+// (ArgoCD or FluxCD) and return a navigable ref to its owning GitOps CR so the
+// drawer can render a "Managed by <app>" affordance.
+//
+// Precedence (most-specific wins):
+//   1. Flux HelmRelease labels
+//   2. Flux Kustomize labels
+//   3. Argo tracking-id annotation
+//   4. Argo-specific instance label
+//   5. Standard k8s instance label (best-effort; false positives possible)
+
+// GitOpsOwnerRef is a discriminated union — the tool determines which kind is
+// valid. Modeling it this way prevents callers (and consumers of the returned
+// type) from constructing `{ tool: 'argo', kind: 'helmreleases' }` which would
+// route to a non-existent page.
+export type GitOpsOwnerRef =
+  | { tool: 'argocd'; kind: 'applications'; namespace: string; name: string }
+  | { tool: 'fluxcd'; kind: 'kustomizations' | 'helmreleases'; namespace: string; name: string }
+
+// Vocabulary mirrors `pkg/gitops/tree.Tool` so the wire labels match end-to-end.
+export type GitOpsOwnerTool = GitOpsOwnerRef['tool']
+
+const ARGO_TRACKING_ID_ANNOTATION = 'argocd.argoproj.io/tracking-id'
+const ARGO_INSTANCE_LABEL = 'argocd.argoproj.io/instance'
+// app.kubernetes.io/instance is intentionally NOT a fallback signal here.
+// It's the standard k8s recommended label and stamped by virtually every
+// Helm chart in existence, not just Argo. Treating it as an Argo ownership
+// hint produced false positives on plain Helm-installed resources, which
+// surfaced as a misleading "Managed by <release>" chip on ordinary workload
+// drawers. Argo installs that rely on this default can still be detected
+// via the tracking-id annotation; the `argocd.argoproj.io/instance` label
+// (above) covers Argo deployments that explicitly set their own label key.
+
+const FLUX_KUSTOMIZE_NAME = 'kustomize.toolkit.fluxcd.io/name'
+const FLUX_KUSTOMIZE_NS = 'kustomize.toolkit.fluxcd.io/namespace'
+const FLUX_HELM_NAME = 'helm.toolkit.fluxcd.io/name'
+const FLUX_HELM_NS = 'helm.toolkit.fluxcd.io/namespace'
+
+export function detectGitOpsOwner(resource: unknown): GitOpsOwnerRef | null {
+  if (!resource || typeof resource !== 'object') return null
+  const meta = (resource as { metadata?: { labels?: Record<string, string>; annotations?: Record<string, string> } }).metadata
+  const labels = meta?.labels ?? {}
+  const annotations = meta?.annotations ?? {}
+
+  const helmName = labels[FLUX_HELM_NAME]
+  const helmNs = labels[FLUX_HELM_NS]
+  if (helmName && helmNs) {
+    return { tool: 'fluxcd', kind: 'helmreleases', namespace: helmNs, name: helmName }
+  }
+  const kustName = labels[FLUX_KUSTOMIZE_NAME]
+  const kustNs = labels[FLUX_KUSTOMIZE_NS]
+  if (kustName && kustNs) {
+    return { tool: 'fluxcd', kind: 'kustomizations', namespace: kustNs, name: kustName }
+  }
+
+  const trackingID = annotations[ARGO_TRACKING_ID_ANNOTATION]
+  if (trackingID) {
+    const parsed = parseArgoTrackingID(trackingID)
+    if (parsed) {
+      return { tool: 'argocd', kind: 'applications', namespace: parsed.namespace, name: parsed.name }
+    }
+  }
+
+  const instance = labels[ARGO_INSTANCE_LABEL]
+  if (instance) {
+    // App namespace unknown without tracking-id; emit empty so the consumer can
+    // either skip the link or default to a well-known namespace.
+    return { tool: 'argocd', kind: 'applications', namespace: '', name: instance }
+  }
+
+  return null
+}
+
+// Argo CD writes its tracking-id in one of two forms depending on whether
+// installationID / namespaced-install is configured:
+//   "<appName>:<group>/<kind>:<resourceNs>/<resourceName>"                   default
+//   "<appNamespace>_<appName>:<group>/<kind>:<resourceNs>/<resourceName>"    namespaced install
+// We accept both. The legacy single-name form yields an empty namespace so the
+// caller can route to a "find this app" search instead of guessing.
+function parseArgoTrackingID(value: string): { namespace: string; name: string } | null {
+  const firstColon = value.indexOf(':')
+  if (firstColon < 0) return null
+  const head = value.slice(0, firstColon)
+  const sep = head.indexOf('_')
+  if (sep < 0) {
+    return head ? { namespace: '', name: head } : null
+  }
+  const namespace = head.slice(0, sep)
+  const name = head.slice(sep + 1)
+  if (!name) return null
+  return { namespace, name }
+}

package/src/utils/gitops-route.test.ts

@@ -0,0 +1,78 @@
+import { describe, it, expect } from 'vitest'
+import { gitOpsRouteForOwner, gitOpsRouteForResource } from './gitops-route'
+
+describe('gitOpsRouteForOwner', () => {
+  it('routes to detail URL for Argo with known namespace', () => {
+    expect(gitOpsRouteForOwner({ tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'guestbook' }))
+      .toBe('/gitops/detail/applications/argocd/guestbook')
+  })
+  it('routes to fleet when Argo namespace is unknown (bare instance label)', () => {
+    expect(gitOpsRouteForOwner({ tool: 'argocd', kind: 'applications', namespace: '', name: 'guestbook' }))
+      .toBe('/gitops')
+  })
+  it('routes Flux Kustomization owners with their namespace', () => {
+    expect(gitOpsRouteForOwner({ tool: 'fluxcd', kind: 'kustomizations', namespace: 'flux-system', name: 'podinfo' }))
+      .toBe('/gitops/detail/kustomizations/flux-system/podinfo')
+  })
+  it('routes Flux HelmRelease owners', () => {
+    expect(gitOpsRouteForOwner({ tool: 'fluxcd', kind: 'helmreleases', namespace: 'flux-system', name: 'podinfo' }))
+      .toBe('/gitops/detail/helmreleases/flux-system/podinfo')
+  })
+  it('encodes path components', () => {
+    expect(gitOpsRouteForOwner({ tool: 'fluxcd', kind: 'kustomizations', namespace: 'has space', name: 'a/b' }))
+      .toBe('/gitops/detail/kustomizations/has%20space/a%2Fb')
+  })
+})
+
+describe('gitOpsRouteForResource', () => {
+  const mk = (api: string, kind: string, ns = 'x', name = 'y') => ({
+    apiVersion: api, kind, metadata: { namespace: ns, name },
+  })
+
+  it('routes Argo CRs (Application/ApplicationSet/AppProject)', () => {
+    expect(gitOpsRouteForResource(mk('argoproj.io/v1alpha1', 'Application', 'argocd', 'app')))
+      .toBe('/gitops/detail/applications/argocd/app')
+    expect(gitOpsRouteForResource(mk('argoproj.io/v1alpha1', 'ApplicationSet', 'argocd', 'set')))
+      .toBe('/gitops/detail/applicationsets/argocd/set')
+    expect(gitOpsRouteForResource(mk('argoproj.io/v1alpha1', 'AppProject', 'argocd', 'proj')))
+      .toBe('/gitops/detail/appprojects/argocd/proj')
+  })
+
+  it('routes Flux reconcilers (Kustomization/HelmRelease)', () => {
+    expect(gitOpsRouteForResource(mk('kustomize.toolkit.fluxcd.io/v1', 'Kustomization', 'flux-system', 'k')))
+      .toBe('/gitops/detail/kustomizations/flux-system/k')
+    expect(gitOpsRouteForResource(mk('helm.toolkit.fluxcd.io/v2', 'HelmRelease', 'flux-system', 'hr')))
+      .toBe('/gitops/detail/helmreleases/flux-system/hr')
+  })
+
+  // Source CRs are *not* portals — the resource drawer renders them better.
+  // If this ever flips, also update pkg/gitops/tree/graph.go classifyGitOpsKind
+  // and web/src/components/gitops/GitOpsView.tsx isGitOpsDetailRef.
+  it('returns null for Flux source CRs (drawer-only)', () => {
+    expect(gitOpsRouteForResource(mk('source.toolkit.fluxcd.io/v1', 'GitRepository'))).toBeNull()
+    expect(gitOpsRouteForResource(mk('source.toolkit.fluxcd.io/v1', 'HelmRepository'))).toBeNull()
+    expect(gitOpsRouteForResource(mk('source.toolkit.fluxcd.io/v1beta2', 'OCIRepository'))).toBeNull()
+    expect(gitOpsRouteForResource(mk('source.toolkit.fluxcd.io/v1beta2', 'Bucket'))).toBeNull()
+    expect(gitOpsRouteForResource(mk('source.toolkit.fluxcd.io/v1', 'HelmChart'))).toBeNull()
+  })
+
+  it('returns null for ordinary K8s resources', () => {
+    expect(gitOpsRouteForResource(mk('apps/v1', 'Deployment'))).toBeNull()
+    expect(gitOpsRouteForResource(mk('v1', 'Service'))).toBeNull()
+    expect(gitOpsRouteForResource(mk('v1', 'Pod'))).toBeNull()
+  })
+
+  it('returns null on malformed input', () => {
+    expect(gitOpsRouteForResource(null)).toBeNull()
+    expect(gitOpsRouteForResource(undefined)).toBeNull()
+    expect(gitOpsRouteForResource({})).toBeNull()
+    expect(gitOpsRouteForResource({ kind: 'Application' })).toBeNull() // no apiVersion → no group
+  })
+
+  it('distinguishes name collisions by group', () => {
+    // Knative Service vs core Service — not a portal kind, but pins behavior.
+    expect(gitOpsRouteForResource(mk('serving.knative.dev/v1', 'Service'))).toBeNull()
+    // A hypothetical "Application" CR in another group must not portal.
+    expect(gitOpsRouteForResource(mk('example.com/v1', 'Application'))).toBeNull()
+  })
+})

package/src/utils/gitops-route.ts

@@ -0,0 +1,104 @@
+// Routes to the GitOps detail page (in fleet view if the lookup is ambiguous).
+//
+// Two distinct entry points:
+//
+//   gitOpsRouteForOwner(owner)
+//     For "Managed by <app>" affordances: an ordinary K8s resource carries
+//     GitOps ownership labels/annotations and we want to navigate to its
+//     owning GitOps CR. Wraps the detect→navigate split: detectGitOpsOwner
+//     gives us a typed ref, this helper turns the ref into a URL.
+//
+//   gitOpsRouteForResource(resource)
+//     For "Open in GitOps" affordances on the GitOps CR itself
+//     (Application, ApplicationSet, AppProject, Kustomization, HelmRelease).
+//     Source CRs (GitRepository/HelmRepository/OCIRepository/Bucket/HelmChart)
+//     return null — they're not portal kinds; the standard resource drawer
+//     renders them better.
+//
+// Keep the portal catalog in sync with:
+//   - pkg/gitops/tree/graph.go        (Go classifier)
+//   - web/src/components/gitops/GitOpsView.tsx isGitOpsDetailRef
+// If a kind is added or removed here, update those too.
+
+import type { GitOpsOwnerRef } from './gitops-owner'
+
+export interface GitOpsResource {
+  apiVersion?: string
+  kind?: string
+  metadata?: { namespace?: string; name?: string }
+}
+
+// gitOpsRouteForOwner turns a detected GitOps owner ref into a navigable URL.
+// When the owner namespace is unknown (Argo apps detected only by the bare
+// app.kubernetes.io/instance label), routes to the GitOps fleet view so the
+// user can locate the app rather than landing on a 404'd detail URL.
+export function gitOpsRouteForOwner(owner: GitOpsOwnerRef): string {
+  if (owner.tool === 'argocd' && !owner.namespace) {
+    return '/gitops'
+  }
+  return gitOpsDetailUrl(owner.kind, owner.namespace, owner.name)
+}
+
+// gitOpsRouteForResource returns the GitOps detail URL for a portal-kind
+// resource, or null when the resource isn't itself a GitOps CR that has its
+// own detail page. Callers should fall back to the standard resource drawer
+// on null.
+export function gitOpsRouteForResource(resource: GitOpsResource | null | undefined): string | null {
+  if (!resource) return null
+  const kind = resource.kind?.toLowerCase()
+  const group = apiGroup(resource.apiVersion)
+  const ns = resource.metadata?.namespace ?? ''
+  const name = resource.metadata?.name ?? ''
+  if (!kind || !name) return null
+
+  const plural = portalPluralFor(kind, group)
+  if (!plural) return null
+  return gitOpsDetailUrl(plural, ns, name)
+}
+
+function portalPluralFor(kindLower: string, group: string): string | null {
+  if (group === 'argoproj.io') {
+    if (kindLower === 'application') return 'applications'
+    if (kindLower === 'applicationset') return 'applicationsets'
+    if (kindLower === 'appproject') return 'appprojects'
+    return null
+  }
+  if (group === 'kustomize.toolkit.fluxcd.io' && kindLower === 'kustomization') return 'kustomizations'
+  if (group === 'helm.toolkit.fluxcd.io' && kindLower === 'helmrelease') return 'helmreleases'
+  return null
+}
+
+function apiGroup(apiVersion: string | undefined): string {
+  if (!apiVersion) return ''
+  const slash = apiVersion.indexOf('/')
+  return slash < 0 ? '' : apiVersion.slice(0, slash)
+}
+
+function gitOpsDetailUrl(kindPlural: string, namespace: string, name: string): string {
+  const ns = encodeURIComponent(namespace || '_')
+  return `/gitops/detail/${encodeURIComponent(kindPlural)}/${ns}/${encodeURIComponent(name)}`
+}
+
+// gitOpsRouteForKind is a kind-only variant for callers that only have
+// (kind, namespace, name) — e.g. Audit findings, which today don't carry the
+// apiGroup of the resource they subject. Matches by kind alone, accepting the
+// (very small) risk of routing a CRD named "Application" or "Kustomization"
+// from a non-GitOps group to a "not found" GitOps detail page. When/if those
+// callers grow apiGroup access, prefer gitOpsRouteForResource.
+export function gitOpsRouteForKind(kind: string, namespace: string, name: string): string | null {
+  if (!kind || !name) return null
+  switch (kind) {
+    case 'Application':
+      return gitOpsDetailUrl('applications', namespace, name)
+    case 'ApplicationSet':
+      return gitOpsDetailUrl('applicationsets', namespace, name)
+    case 'AppProject':
+      return gitOpsDetailUrl('appprojects', namespace, name)
+    case 'Kustomization':
+      return gitOpsDetailUrl('kustomizations', namespace, name)
+    case 'HelmRelease':
+      return gitOpsDetailUrl('helmreleases', namespace, name)
+    default:
+      return null
+  }
+}

package/src/utils/index.ts

@@ -14,3 +14,5 @@ export * from './k8s-errors'
 export * from './parse-go-time'
 export * from './view-transition'
 export * from './validators'
+export * from './gitops-owner'
+export * from './gitops-route'

package/src/utils/navigation.ts

@@ -142,3 +142,17 @@ export function refToSelectedResource(ref: ResourceRef): SelectedResource {
     group: ref.group,
   }
 }
+
+/**
+ * Extract the API group from an apiVersion string.
+ * Returns '' for core resources (e.g. "v1") and for missing/empty input.
+ * Examples:
+ *   "v1"                          → ""
+ *   "apps/v1"                     → "apps"
+ *   "cluster.x-k8s.io/v1beta1"    → "cluster.x-k8s.io"
+ */
+export function apiVersionToGroup(apiVersion?: string | null): string {
+  if (!apiVersion) return ''
+  const i = apiVersion.indexOf('/')
+  return i === -1 ? '' : apiVersion.slice(0, i)
+}

package/src/utils/resource-hierarchy.ts

@@ -13,6 +13,7 @@
 
 import type { TimelineEvent, Topology } from '../types/core'
 import { isWorkloadKind } from '../types/core'
+import { apiVersionToGroup } from './navigation'
 
 /**
  * Resource lane representing a single resource and its timeline events.
@@ -21,6 +22,12 @@ import { isWorkloadKind } from '../types/core'
 export interface ResourceLane {
   id: string
   kind: string
+  /**
+   * API group for the resource (e.g. "cluster.x-k8s.io"). Empty for core
+   * resources. Needed to disambiguate CRDs whose kind collides with another
+   * (e.g. CAPI Cluster vs CNPG Cluster) when the lane is clicked.
+   */
+  group?: string
   namespace: string
   name: string
   events: TimelineEvent[]
@@ -179,6 +186,25 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
   const { events, topology, rootResource, groupByApp = true } = options
   const laneMap = new Map<string, ResourceLane>()
 
+  // API group lookup by lane ID (kind/namespace/name) sourced from topology nodes.
+  // Lanes built from events (which carry apiVersion) take precedence over this fallback,
+  // but parent lanes that exist only as edge endpoints still need a group.
+  const topoGroupByLaneId = new Map<string, string>()
+  if (topology?.nodes) {
+    for (const node of topology.nodes) {
+      const laneId = nodeIdToLaneId(node.id)
+      if (!laneId) continue
+      const apiVersion = node.data?.apiVersion as string | undefined
+      const group = apiVersionToGroup(apiVersion)
+      if (group) topoGroupByLaneId.set(laneId, group)
+    }
+  }
+  const resolveGroup = (laneId: string, event?: TimelineEvent): string => {
+    const fromEvent = apiVersionToGroup(event?.apiVersion)
+    if (fromEvent) return fromEvent
+    return topoGroupByLaneId.get(laneId) ?? ''
+  }
+
   // Track events that should be attached to their owner instead of their own lane
   const eventsToAttach: { event: TimelineEvent; ownerLaneId: string }[] = []
 
@@ -192,19 +218,28 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
     }
 
     const laneId = `${event.kind}/${event.namespace}/${event.name}`
-    if (!laneMap.has(laneId)) {
+    const existing = laneMap.get(laneId)
+    if (!existing) {
       laneMap.set(laneId, {
         id: laneId,
         kind: event.kind,
+        group: resolveGroup(laneId, event),
         namespace: event.namespace,
         name: event.name,
-        events: [],
+        events: [event],
         isWorkload: isWorkloadKind(event.kind),
         children: [],
         childEventCount: 0,
       })
+    } else {
+      // Stored events may lack apiVersion; upgrade the lane's group from any
+      // later event that carries it.
+      if (!existing.group) {
+        const fromEvent = apiVersionToGroup(event.apiVersion)
+        if (fromEvent) existing.group = fromEvent
+      }
+      existing.events.push(event)
     }
-    laneMap.get(laneId)!.events.push(event)
   }
 
   // Attach K8s Events to their owner lanes
@@ -218,6 +253,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
       laneMap.set(ownerLaneId, {
         id: ownerLaneId,
         kind: parts[0],
+        group: resolveGroup(ownerLaneId),
         namespace: parts[1],
         name: parts.slice(2).join('/'),
         events: [event],
@@ -242,6 +278,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
         laneMap.set(ownerLaneId, {
           id: ownerLaneId,
           kind: eventWithOwner.owner.kind,
+          group: resolveGroup(ownerLaneId),
           namespace: lane.namespace,
           name: eventWithOwner.owner.name,
           events: [],
@@ -277,6 +314,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
             laneMap.set(sourceLaneId, {
               id: sourceLaneId,
               kind: parts[0],
+              group: resolveGroup(sourceLaneId),
               namespace: parts[1],
               name: parts.slice(2).join('/'),
               events: [],
@@ -304,6 +342,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
               laneMap.set(sourceLaneId, {
                 id: sourceLaneId,
                 kind: parts[0],
+                group: resolveGroup(sourceLaneId),
                 namespace: parts[1],
                 name: parts.slice(2).join('/'),
                 events: [],
@@ -323,6 +362,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
               laneMap.set(targetLaneId, {
                 id: targetLaneId,
                 kind: parts[0],
+                group: resolveGroup(targetLaneId),
                 namespace: parts[1],
                 name: parts.slice(2).join('/'),
                 events: [],
@@ -342,6 +382,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
               laneMap.set(targetLaneId, {
                 id: targetLaneId,
                 kind: parts[0],
+                group: resolveGroup(targetLaneId),
                 namespace: parts[1],
                 name: parts.slice(2).join('/'),
                 events: [],
@@ -361,6 +402,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
               laneMap.set(sourceLaneId, {
                 id: sourceLaneId,
                 kind: parts[0],
+                group: resolveGroup(sourceLaneId),
                 namespace: parts[1],
                 name: parts.slice(2).join('/'),
                 events: [],
@@ -382,6 +424,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
             laneMap.set(targetLaneId, {
               id: targetLaneId,
               kind: parts[0],
+              group: resolveGroup(targetLaneId),
               namespace: parts[1],
               name: parts.slice(2).join('/'),
               events: [],
@@ -582,6 +625,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
     const placeholderLane: ResourceLane = {
       id: rootLaneId,
       kind: rootResource.kind,
+      group: resolveGroup(rootLaneId),
       namespace: rootResource.namespace,
       name: rootResource.name,
       events: [],