@skyhook-io/k8s-ui 1.6.0 → 1.6.1

package/src/components/ui/drawer-components.tsx

@@ -724,7 +724,8 @@ export function RelatedResourcesSection({ relationships, onNavigate }: RelatedRe
     (relationships.configRefs && relationships.configRefs.length > 0) ||
     (relationships.consumers && relationships.consumers.length > 0) ||
     (relationships.scalers && relationships.scalers.length > 0) ||
-    (relationships.policies && relationships.policies.length > 0) ||
+    (relationships.pdbs && relationships.pdbs.length > 0) ||
+    (relationships.networkPolicies && relationships.networkPolicies.length > 0) ||
     relationships.scaleTarget
 
   if (!hasRelationships) return null
@@ -765,25 +766,12 @@ export function RelatedResourcesSection({ relationships, onNavigate }: RelatedRe
         {relationships.scalers && relationships.scalers.length > 0 && (
           <RelationshipGroup label="Autoscaler" refs={dedupeRefs(relationships.scalers)} onNavigate={onNavigate} />
         )}
-        {relationships.policies && relationships.policies.length > 0 && (() => {
-          const policyKinds = new Set(['NetworkPolicy', 'CiliumNetworkPolicy', 'CiliumClusterwideNetworkPolicy', 'ClusterNetworkPolicy'])
-          const pdbs = relationships.policies.filter(r => r.kind === 'PodDisruptionBudget')
-          const netpols = relationships.policies.filter(r => policyKinds.has(r.kind))
-          const other = relationships.policies.filter(r => r.kind !== 'PodDisruptionBudget' && !policyKinds.has(r.kind))
-          return (
-            <>
-              {pdbs.length > 0 && (
-                <RelationshipGroup label="Disruption Budget" refs={dedupeRefs(pdbs)} onNavigate={onNavigate} />
-              )}
-              {netpols.length > 0 && (
-                <RelationshipGroup label="Network Policies" refs={dedupeRefs(netpols)} onNavigate={onNavigate} />
-              )}
-              {other.length > 0 && (
-                <RelationshipGroup label="Policies" refs={dedupeRefs(other)} onNavigate={onNavigate} />
-              )}
-            </>
-          )
-        })()}
+        {relationships.pdbs && relationships.pdbs.length > 0 && (
+          <RelationshipGroup label="Disruption Budget" refs={dedupeRefs(relationships.pdbs)} onNavigate={onNavigate} />
+        )}
+        {relationships.networkPolicies && relationships.networkPolicies.length > 0 && (
+          <RelationshipGroup label="Network Policies" refs={dedupeRefs(relationships.networkPolicies)} onNavigate={onNavigate} />
+        )}
         {relationships.scaleTarget && (
           <RelationshipGroup label="Scale Target" refs={[relationships.scaleTarget]} onNavigate={onNavigate} />
         )}

package/src/components/workload/WorkloadView.tsx

@@ -23,7 +23,7 @@ import {
 import type { TimelineEvent, ResourceRef, Relationships, SelectedResource, ResolvedEnvFrom } from '../../types'
 import type { NavigateToResource } from '../../utils/navigation'
 import { refToSelectedResource, pluralToKind } from '../../utils/navigation'
-import { detectGitOpsOwner, type GitOpsOwnerRef } from '../../utils/gitops-owner'
+import { gitOpsOwnerFromRelationships, type GitOpsOwnerRef } from '../../utils/gitops-owner'
 import { gitOpsRouteForResource } from '../../utils/gitops-route'
 import { isChangeEvent, isHistoricalEvent } from '../../types'
 import { getKindBadgeColor, getHealthBadgeColor } from '../../utils/badge-colors'
@@ -311,7 +311,7 @@ export function WorkloadView({
 
   // Metadata
   const metadata = useMemo(() => extractMetadata(kind, resource), [kind, resource])
-  const gitopsOwner = useMemo(() => detectGitOpsOwner(resource), [resource])
+  const gitopsOwner = useMemo(() => gitOpsOwnerFromRelationships(relationships), [relationships])
   // When the resource itself is a portal GitOps CR (Application, Kustomization,
   // HelmRelease, etc.), surface a link to its dedicated GitOps detail page —
   // the drawer's renderer is thorough but the tab has the tree + insights +

package/src/types/core.ts

@@ -1,6 +1,8 @@
 // Topology types matching the Go backend
 
-// Per-resource-type RBAC permissions (matches backend k8s.ResourcePermissions)
+// Per-resource-type RBAC permissions. Field names must match the JSON keys
+// produced by ResourcePermissions in internal/k8s/capabilities.go — there
+// is no automated check across the Go/TS boundary.
 export interface ResourcePermissions {
   pods: boolean
   services: boolean
@@ -12,20 +14,39 @@ export interface ResourcePermissions {
   configMaps: boolean
   secrets: boolean
   events: boolean
-  pvcs: boolean
+  persistentVolumeClaims: boolean
   nodes: boolean
   namespaces: boolean
   jobs: boolean
   cronJobs: boolean
-  hpas: boolean
-  gateways: boolean
-  httpRoutes: boolean
+  horizontalPodAutoscalers: boolean
+  persistentVolumes: boolean
+  storageClasses: boolean
+  podDisruptionBudgets: boolean
+  networkPolicies: boolean
+  serviceAccounts: boolean
   roles: boolean
   clusterRoles: boolean
   roleBindings: boolean
   clusterRoleBindings: boolean
+  limitRanges: boolean
+  gateways: boolean
+  httpRoutes: boolean
+  verticalPodAutoscalers: boolean
 }
 
+// Keys in ResourcePermissions that represent optional CRDs Radar can monitor
+// when they're installed in the cluster. A `false` here means "CRD not
+// installed (or RBAC denied)" — NOT "Radar is missing data the user expects",
+// so banners about RBAC restrictions should ignore these keys.
+//
+// Keep in sync with dynamicCapabilityKinds in internal/k8s/capabilities_alignment_test.go.
+export const OPTIONAL_RESOURCE_KINDS: ReadonlyArray<keyof ResourcePermissions> = [
+  'gateways',
+  'httpRoutes',
+  'verticalPodAutoscalers',
+]
+
 // Feature capabilities based on RBAC permissions
 export interface Capabilities {
   exec: boolean           // Terminal feature (pods/exec)
@@ -394,6 +415,7 @@ export interface ResourceRef {
 export interface Relationships {
   owner?: ResourceRef
   deployment?: ResourceRef   // Grandparent Deployment (for Pods owned by ReplicaSets)
+  managedBy?: ResourceRef[]  // Topmost meaningful manager(s): GitOps controller (ArgoCD Application / Flux Kustomization / Flux HelmRelease), Helm release, or the topmost K8s owner. Synthesized server-side; replaces client-side detectGitOpsOwner.
   children?: ResourceRef[]
   services?: ResourceRef[]
   ingresses?: ResourceRef[]
@@ -403,8 +425,11 @@ export interface Relationships {
   consumers?: ResourceRef[]
   scalers?: ResourceRef[]
   scaleTarget?: ResourceRef
-  policies?: ResourceRef[]
+  pdbs?: ResourceRef[]              // PodDisruptionBudgets protecting this workload
+  networkPolicies?: ResourceRef[]   // NetworkPolicy / CiliumNetworkPolicy / ClusterNetworkPolicy variants selecting this workload
   pods?: ResourceRef[]
+  serviceAccount?: ResourceRef      // For Pods: derived from pod.spec.serviceAccountName
+  node?: ResourceRef                // For scheduled Pods: derived from pod.spec.nodeName
 }
 
 // Parsed X.509 certificate metadata (from backend cert parsing)

package/src/utils/badge-colors.ts

@@ -286,6 +286,31 @@ export function getHelmStatusColor(status: string): string {
   return HELM_STATUS_COLORS[statusLower] || 'bg-theme-hover/50 text-theme-text-secondary'
 }
 
+/**
+ * Helm release statuses where the row UI should signpost the user
+ * toward the drawer (history / rollback / logs).
+ *
+ * Currently `failed` only. The `pending-*` statuses (install /
+ * upgrade / rollback) are excluded deliberately: they're Helm's
+ * normal in-flight states during every routine operation. Treating
+ * them as "actionable" would briefly attach an alarming chevron +
+ * tooltip to every install while it ran — indistinguishable from
+ * the genuinely-stuck case (controller crashed mid-flight). Until
+ * we have release age available client-side to disambiguate
+ * "in-flight" from "stuck > N min", we give up the stuck-detect
+ * signpost rather than wrongly alarm the common case.
+ *
+ * @see https://github.com/helm/helm/blob/dev-v3/pkg/release/status.go
+ */
+const ACTIONABLE_HELM_STATUSES: ReadonlySet<string> = new Set([
+  'failed',
+])
+
+export function isHelmReleaseActionable(status: string | null | undefined): boolean {
+  if (!status) return false
+  return ACTIONABLE_HELM_STATUSES.has(status.toLowerCase())
+}
+
 // =============================================================================
 // VULNERABILITY SEVERITY COLORS - for Trivy and other security scanners
 // =============================================================================

package/src/utils/gitops-owner.test.ts

@@ -1,136 +1,95 @@
 import { describe, it, expect } from 'vitest'
-import { detectGitOpsOwner } from './gitops-owner'
 
-const FLUX_HELM_NAME = 'helm.toolkit.fluxcd.io/name'
-const FLUX_HELM_NS = 'helm.toolkit.fluxcd.io/namespace'
-const FLUX_KUSTOMIZE_NAME = 'kustomize.toolkit.fluxcd.io/name'
-const FLUX_KUSTOMIZE_NS = 'kustomize.toolkit.fluxcd.io/namespace'
-const ARGO_TRACKING_ID = 'argocd.argoproj.io/tracking-id'
-const ARGO_INSTANCE = 'argocd.argoproj.io/instance'
-const HELM_INSTANCE = 'app.kubernetes.io/instance'
+import type { Relationships } from '../types/core'
 
-function resource(labels: Record<string, string> = {}, annotations: Record<string, string> = {}) {
-  return { metadata: { labels, annotations } }
-}
+import { gitOpsOwnerFromRelationships } from './gitops-owner'
 
-describe('detectGitOpsOwner', () => {
-  it('returns null for non-objects', () => {
-    expect(detectGitOpsOwner(null)).toBeNull()
-    expect(detectGitOpsOwner(undefined)).toBeNull()
-    expect(detectGitOpsOwner('string')).toBeNull()
+describe('gitOpsOwnerFromRelationships', () => {
+  it('returns null when relationships is undefined', () => {
+    expect(gitOpsOwnerFromRelationships(undefined)).toBeNull()
   })
 
-  it('returns null when no GitOps labels/annotations present', () => {
-    expect(detectGitOpsOwner(resource({ app: 'foo' }))).toBeNull()
+  it('returns null when managedBy is absent', () => {
+    expect(gitOpsOwnerFromRelationships({})).toBeNull()
   })
 
-  describe('Flux HelmRelease labels', () => {
-    it('extracts name + namespace', () => {
-      const got = detectGitOpsOwner(resource({
-        [FLUX_HELM_NAME]: 'podinfo',
-        [FLUX_HELM_NS]: 'flux-system',
-      }))
-      expect(got).toEqual({ tool: 'fluxcd', kind: 'helmreleases', namespace: 'flux-system', name: 'podinfo' })
-    })
-
-    it('wins over Flux Kustomize labels when both are present (most-direct owner)', () => {
-      const got = detectGitOpsOwner(resource({
-        [FLUX_HELM_NAME]: 'podinfo',
-        [FLUX_HELM_NS]: 'flux-system',
-        [FLUX_KUSTOMIZE_NAME]: 'parent',
-        [FLUX_KUSTOMIZE_NS]: 'flux-system',
-      }))
-      expect(got?.kind).toBe('helmreleases')
-      expect(got?.name).toBe('podinfo')
-    })
-
-    it('requires both name and namespace', () => {
-      expect(detectGitOpsOwner(resource({ [FLUX_HELM_NAME]: 'podinfo' }))).toBeNull()
-      expect(detectGitOpsOwner(resource({ [FLUX_HELM_NS]: 'flux-system' }))).toBeNull()
-    })
+  it('returns null when managedBy is empty', () => {
+    expect(gitOpsOwnerFromRelationships({ managedBy: [] })).toBeNull()
   })
 
-  describe('Flux Kustomize labels', () => {
-    it('extracts name + namespace', () => {
-      const got = detectGitOpsOwner(resource({
-        [FLUX_KUSTOMIZE_NAME]: 'infra',
-        [FLUX_KUSTOMIZE_NS]: 'flux-system',
-      }))
-      expect(got).toEqual({ tool: 'fluxcd', kind: 'kustomizations', namespace: 'flux-system', name: 'infra' })
+  it('maps an ArgoCD Application ref', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'storefront' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'argocd',
+      kind: 'applications',
+      namespace: 'argocd',
+      name: 'storefront',
     })
   })
 
-  describe('Argo tracking-id annotation', () => {
-    it('parses the namespaced form (<ns>_<name>:...)', () => {
-      const got = detectGitOpsOwner(resource({}, {
-        [ARGO_TRACKING_ID]: 'argocd_my-app:apps/Deployment:default/web',
-      }))
-      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'my-app' })
-    })
-
-    it('parses the legacy single-name form (no underscore)', () => {
-      const got = detectGitOpsOwner(resource({}, {
-        [ARGO_TRACKING_ID]: 'my-app:apps/Deployment:default/web',
-      }))
-      // Empty namespace is the contract — caller defaults / routes accordingly.
-      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: '', name: 'my-app' })
-    })
-
-    it('returns null on a malformed tracking-id (no colon)', () => {
-      const got = detectGitOpsOwner(resource({}, { [ARGO_TRACKING_ID]: 'just-garbage-no-colon' }))
-      // Falls through to label scan; with no labels present, returns null.
-      expect(got).toBeNull()
-    })
-
-    it('returns null on tracking-id with empty name after underscore', () => {
-      const got = detectGitOpsOwner(resource({}, { [ARGO_TRACKING_ID]: 'my-ns_:apps/Deployment:default/web' }))
-      expect(got).toBeNull()
+  it('maps a Flux Kustomization ref', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'Kustomization', group: 'kustomize.toolkit.fluxcd.io', namespace: 'flux-system', name: 'prod-apps' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'fluxcd',
+      kind: 'kustomizations',
+      namespace: 'flux-system',
+      name: 'prod-apps',
     })
+  })
 
-    it('wins over the bare instance label (most authoritative)', () => {
-      const got = detectGitOpsOwner(resource(
-        { [ARGO_INSTANCE]: 'wrong-app' },
-        { [ARGO_TRACKING_ID]: 'argocd_right-app:apps/Deployment:default/web' },
-      ))
-      expect(got?.name).toBe('right-app')
-      expect(got?.namespace).toBe('argocd')
+  it('maps a Flux HelmRelease ref', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'HelmRelease', group: 'helm.toolkit.fluxcd.io', namespace: 'flux-system', name: 'cert-manager' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'fluxcd',
+      kind: 'helmreleases',
+      namespace: 'flux-system',
+      name: 'cert-manager',
     })
   })
 
-  describe('Argo instance label fallback', () => {
-    it('extracts name from argocd-specific instance label', () => {
-      const got = detectGitOpsOwner(resource({ [ARGO_INSTANCE]: 'guestbook' }))
-      expect(got).toEqual({ tool: 'argocd', kind: 'applications', namespace: '', name: 'guestbook' })
-    })
+  it('disambiguates Flux HelmRelease from native Helm via API group', () => {
+    // A native Helm release would not carry the helm.toolkit.fluxcd.io group;
+    // server-side SynthesizeManagedBy only assigns that group for Flux.
+    const rel: Relationships = {
+      managedBy: [{ kind: 'HelmRelease', group: 'helm.sh', namespace: 'default', name: 'native-helm' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toBeNull()
+  })
 
-    it('does NOT fall back to standard k8s instance label', () => {
-      // app.kubernetes.io/instance is stamped by virtually every Helm chart.
-      // Treating it as an Argo signal produced a false "Managed by <release>"
-      // chip on plain Helm-installed resources, so detection now requires an
-      // Argo-specific signal (tracking-id annotation or argocd.argoproj.io/instance).
-      expect(detectGitOpsOwner(resource({ [HELM_INSTANCE]: 'guestbook-healthy' }))).toBeNull()
-    })
+  it('returns null for native K8s owners (no GitOps chip)', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'Deployment', namespace: 'prod', name: 'web' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toBeNull()
+  })
 
-    it('argocd-specific label still wins when both labels present', () => {
-      const got = detectGitOpsOwner(resource({
-        [ARGO_INSTANCE]: 'argo-pick',
-        [HELM_INSTANCE]: 'helm-pick',
-      }))
-      expect(got?.name).toBe('argo-pick')
-    })
+  it('returns null for an unrecognized manager kind', () => {
+    const rel: Relationships = {
+      managedBy: [{ kind: 'CustomController', group: 'example.com', namespace: 'prod', name: 'thing' }],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toBeNull()
   })
 
-  describe('Flux labels beat Argo annotations', () => {
-    it('Flux HelmRelease wins over Argo tracking-id', () => {
-      const got = detectGitOpsOwner(resource(
-        {
-          [FLUX_HELM_NAME]: 'podinfo',
-          [FLUX_HELM_NS]: 'flux-system',
-        },
-        { [ARGO_TRACKING_ID]: 'argocd_some-app:apps/Deployment:default/web' },
-      ))
-      expect(got?.tool).toBe('fluxcd')
-      expect(got?.kind).toBe('helmreleases')
+  it('only considers the first managedBy entry', () => {
+    // The server emits the topmost meaningful manager first; if there are
+    // multiple, downstream chips intentionally only render the primary.
+    const rel: Relationships = {
+      managedBy: [
+        { kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name: 'primary' },
+        { kind: 'Kustomization', group: 'kustomize.toolkit.fluxcd.io', namespace: 'flux-system', name: 'secondary' },
+      ],
+    }
+    expect(gitOpsOwnerFromRelationships(rel)).toEqual({
+      tool: 'argocd',
+      kind: 'applications',
+      namespace: 'argocd',
+      name: 'primary',
     })
   })
 })

package/src/utils/gitops-owner.ts

@@ -1,13 +1,12 @@
-// Detect whether a Kubernetes resource is managed by a GitOps controller
-// (ArgoCD or FluxCD) and return a navigable ref to its owning GitOps CR so the
-// drawer can render a "Managed by <app>" affordance.
+// Map a resource's server-side `Relationships.managedBy` to a navigable
+// GitOps owner ref, used by the drawer to render the "Managed by <app>" chip.
 //
-// Precedence (most-specific wins):
-//   1. Flux HelmRelease labels
-//   2. Flux Kustomize labels
-//   3. Argo tracking-id annotation
-//   4. Argo-specific instance label
-//   5. Standard k8s instance label (best-effort; false positives possible)
+// The detection (label/annotation parsing, Argo tracking-id decoding, Flux
+// label inspection, Helm release annotation, owner-chain walk) lives server-
+// side in pkg/topology.SynthesizeManagedBy. This file is now a thin mapper
+// from the structured ref into the discriminated union the chip + router need.
+
+import type { Relationships, ResourceRef } from '../types/core'
 
 // GitOpsOwnerRef is a discriminated union — the tool determines which kind is
 // valid. Modeling it this way prevents callers (and consumers of the returned
@@ -20,73 +19,37 @@ export type GitOpsOwnerRef =
 // Vocabulary mirrors `pkg/gitops/tree.Tool` so the wire labels match end-to-end.
 export type GitOpsOwnerTool = GitOpsOwnerRef['tool']
 
-const ARGO_TRACKING_ID_ANNOTATION = 'argocd.argoproj.io/tracking-id'
-const ARGO_INSTANCE_LABEL = 'argocd.argoproj.io/instance'
-// app.kubernetes.io/instance is intentionally NOT a fallback signal here.
-// It's the standard k8s recommended label and stamped by virtually every
-// Helm chart in existence, not just Argo. Treating it as an Argo ownership
-// hint produced false positives on plain Helm-installed resources, which
-// surfaced as a misleading "Managed by <release>" chip on ordinary workload
-// drawers. Argo installs that rely on this default can still be detected
-// via the tracking-id annotation; the `argocd.argoproj.io/instance` label
-// (above) covers Argo deployments that explicitly set their own label key.
-
-const FLUX_KUSTOMIZE_NAME = 'kustomize.toolkit.fluxcd.io/name'
-const FLUX_KUSTOMIZE_NS = 'kustomize.toolkit.fluxcd.io/namespace'
-const FLUX_HELM_NAME = 'helm.toolkit.fluxcd.io/name'
-const FLUX_HELM_NS = 'helm.toolkit.fluxcd.io/namespace'
-
-export function detectGitOpsOwner(resource: unknown): GitOpsOwnerRef | null {
-  if (!resource || typeof resource !== 'object') return null
-  const meta = (resource as { metadata?: { labels?: Record<string, string>; annotations?: Record<string, string> } }).metadata
-  const labels = meta?.labels ?? {}
-  const annotations = meta?.annotations ?? {}
-
-  const helmName = labels[FLUX_HELM_NAME]
-  const helmNs = labels[FLUX_HELM_NS]
-  if (helmName && helmNs) {
-    return { tool: 'fluxcd', kind: 'helmreleases', namespace: helmNs, name: helmName }
-  }
-  const kustName = labels[FLUX_KUSTOMIZE_NAME]
-  const kustNs = labels[FLUX_KUSTOMIZE_NS]
-  if (kustName && kustNs) {
-    return { tool: 'fluxcd', kind: 'kustomizations', namespace: kustNs, name: kustName }
-  }
+// API groups for GitOps manager kinds. Used to disambiguate Flux HelmRelease
+// from a future native-Helm kind, etc.
+const ARGO_APPLICATION_GROUP = 'argoproj.io'
+const FLUX_KUSTOMIZE_GROUP = 'kustomize.toolkit.fluxcd.io'
+const FLUX_HELM_GROUP = 'helm.toolkit.fluxcd.io'
 
-  const trackingID = annotations[ARGO_TRACKING_ID_ANNOTATION]
-  if (trackingID) {
-    const parsed = parseArgoTrackingID(trackingID)
-    if (parsed) {
-      return { tool: 'argocd', kind: 'applications', namespace: parsed.namespace, name: parsed.name }
-    }
-  }
-
-  const instance = labels[ARGO_INSTANCE_LABEL]
-  if (instance) {
-    // App namespace unknown without tracking-id; emit empty so the consumer can
-    // either skip the link or default to a well-known namespace.
-    return { tool: 'argocd', kind: 'applications', namespace: '', name: instance }
-  }
-
-  return null
+// gitOpsOwnerFromRelationships reads relationships.managedBy[0] and maps it to
+// a GitOpsOwnerRef when the manager is a GitOps controller. Returns null when
+// the manager is a native K8s owner (Deployment, ReplicaSet, etc.), a plain
+// Helm release, or when no manager is reported.
+//
+// Old radar binaries (pre-T2) emit no managedBy field; this returns null in
+// that case and the drawer silently skips the chip — natural pressure to
+// upgrade rather than carry a label-parsing fallback in the client.
+export function gitOpsOwnerFromRelationships(
+  rel: Relationships | undefined | null,
+): GitOpsOwnerRef | null {
+  const refs = rel?.managedBy
+  if (!refs || refs.length === 0) return null
+  return refToGitOpsOwner(refs[0])
 }
 
-// Argo CD writes its tracking-id in one of two forms depending on whether
-// installationID / namespaced-install is configured:
-//   "<appName>:<group>/<kind>:<resourceNs>/<resourceName>"                   default
-//   "<appNamespace>_<appName>:<group>/<kind>:<resourceNs>/<resourceName>"    namespaced install
-// We accept both. The legacy single-name form yields an empty namespace so the
-// caller can route to a "find this app" search instead of guessing.
-function parseArgoTrackingID(value: string): { namespace: string; name: string } | null {
-  const firstColon = value.indexOf(':')
-  if (firstColon < 0) return null
-  const head = value.slice(0, firstColon)
-  const sep = head.indexOf('_')
-  if (sep < 0) {
-    return head ? { namespace: '', name: head } : null
+function refToGitOpsOwner(ref: ResourceRef): GitOpsOwnerRef | null {
+  switch (true) {
+    case ref.kind === 'Application' && ref.group === ARGO_APPLICATION_GROUP:
+      return { tool: 'argocd', kind: 'applications', namespace: ref.namespace, name: ref.name }
+    case ref.kind === 'Kustomization' && ref.group === FLUX_KUSTOMIZE_GROUP:
+      return { tool: 'fluxcd', kind: 'kustomizations', namespace: ref.namespace, name: ref.name }
+    case ref.kind === 'HelmRelease' && ref.group === FLUX_HELM_GROUP:
+      return { tool: 'fluxcd', kind: 'helmreleases', namespace: ref.namespace, name: ref.name }
+    default:
+      return null
   }
-  const namespace = head.slice(0, sep)
-  const name = head.slice(sep + 1)
-  if (!name) return null
-  return { namespace, name }
 }

package/src/utils/helm-status.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect } from 'vitest'
+import { isHelmReleaseActionable } from './badge-colors'
+
+// Pin the membership set so adding a new Helm status becomes a
+// deliberate decision here.
+
+describe('isHelmReleaseActionable', () => {
+  it('returns true for `failed`', () => {
+    expect(isHelmReleaseActionable('failed')).toBe(true)
+  })
+
+  it('is case-insensitive (matches Helm SDK serialisation variants)', () => {
+    expect(isHelmReleaseActionable('FAILED')).toBe(true)
+    expect(isHelmReleaseActionable('Failed')).toBe(true)
+  })
+
+  it('returns FALSE for the pending-* in-flight statuses', () => {
+    // These are Helm's NORMAL in-flight states during every
+    // routine install/upgrade/rollback. If we treated them as
+    // actionable, every routine install would briefly attach an
+    // alarming chevron + tooltip to its own row. Until we have
+    // release age available client-side to distinguish
+    // "transient" from "stuck > N min", we give up the
+    // stuck-controller signpost rather than alarm the common case.
+    expect(isHelmReleaseActionable('pending-install')).toBe(false)
+    expect(isHelmReleaseActionable('pending-upgrade')).toBe(false)
+    expect(isHelmReleaseActionable('pending-rollback')).toBe(false)
+  })
+
+  it('returns false for the success / normal statuses', () => {
+    expect(isHelmReleaseActionable('deployed')).toBe(false)
+    expect(isHelmReleaseActionable('superseded')).toBe(false)
+    expect(isHelmReleaseActionable('uninstalled')).toBe(false)
+  })
+
+  it('returns false for `uninstalling` (in-progress, not stuck)', () => {
+    expect(isHelmReleaseActionable('uninstalling')).toBe(false)
+  })
+
+  it('returns false for null / undefined / empty', () => {
+    expect(isHelmReleaseActionable(null)).toBe(false)
+    expect(isHelmReleaseActionable(undefined)).toBe(false)
+    expect(isHelmReleaseActionable('')).toBe(false)
+  })
+
+  it('returns false for unknown strings (defensive)', () => {
+    expect(isHelmReleaseActionable('mystery-status')).toBe(false)
+    expect(isHelmReleaseActionable('error')).toBe(false) // Helm uses 'failed', not 'error'
+  })
+})