@skyhook-io/k8s-ui 1.6.0 → 1.6.2

package/src/components/shared/ResourceRendererDispatch.tsx

@@ -105,6 +105,7 @@ import {
   ClusterNetworkPolicyRenderer,
   PodDisruptionBudgetRenderer,
   ServiceAccountRenderer,
+  NamespaceRenderer,
   RoleRenderer,
   RoleBindingRenderer,
   WebhookConfigRenderer,
@@ -199,7 +200,23 @@ import {
   AzureManagedControlPlaneRenderer,
   AzureManagedMachinePoolRenderer,
   AzureMachineRenderer,
+  ManagedResourceRenderer,
+  CompositeRenderer,
+  CrossplanePackageRenderer,
+  CrossplaneProviderConfigRenderer,
+  CompositionRenderer,
+  CompositionRevisionRenderer,
+  XRDRenderer,
 } from '../resources/renderers'
+import type { ComposedRefStatus } from '../resources/renderers/CompositeRenderer'
+import {
+  getCrossplaneStatus,
+  getProviderStatus,
+  getProviderConfigStatus,
+  isManagedResource,
+  isComposite,
+  isClaim,
+} from '../resources/resource-utils-crossplane'
 import type { SelectedResource, Relationships, ResourceRef, SecretCertificateInfo, ResolvedEnvFrom, TimelineEvent } from '../../types'
 import type { CopyHandler } from '../ui/drawer-components'
 import { AlertBanner } from '../ui/drawer-components'
@@ -229,6 +246,51 @@ export interface RendererOverrides {
     kind: string; data: any
     onNavigate?: (ref: ResourceRef) => void
   }>
+  // Optional override for Crossplane Composite / Claim — host wraps the
+  // package renderer to fan out per-composed-ref status fetches via React Query.
+  CompositeRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+    composedRefStatuses?: Map<string, ComposedRefStatus>
+  }>
+  // ServiceAccount reverse-lookup: the host fetches /api/rbac/subject/... and
+  // feeds the result into the base renderer via this wrapper.
+  ServiceAccountRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  // Role / ClusterRole reverse-lookup: host fetches /api/rbac/role/... so the
+  // detail page can show "who is bound to this role".
+  RoleRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  // RoleBinding inline rules preview: host fetches the referenced Role/
+  // ClusterRole's rules so the binding view can show what's granted without
+  // a navigation step.
+  RoleBindingRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  // Namespace RBAC summary: host fetches /api/rbac/namespace/{ns} so the
+  // namespace page can show bindings configured here without falling
+  // through to GenericRenderer.
+  NamespaceRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  // HPA: host wraps the base renderer to add Prometheus-backed replicas /
+  // metric charts below the static spec data.
+  HPARenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
+  // PVC: host wraps the base renderer to add a kubelet-derived usage gauge
+  // when Prometheus is scraping kubelet endpoints.
+  PVCRenderer?: React.ComponentType<{
+    data: any
+    onNavigate?: (ref: ResourceRef) => void
+  }>
 }
 
 // Known resource types with specific renderers (module-level to avoid re-allocation)
@@ -243,7 +305,7 @@ const KNOWN_KINDS = new Set([
   'networkpolicies', 'networkpolicy',
   'ciliumnetworkpolicies', 'ciliumnetworkpolicy', 'ciliumclusterwidenetworkpolicies', 'ciliumclusterwidenetworkpolicy',
   'clusternetworkpolicies', 'clusternetworkpolicy',
-  'poddisruptionbudgets', 'serviceaccounts',
+  'poddisruptionbudgets', 'serviceaccounts', 'namespaces',
   'roles', 'clusterroles', 'rolebindings', 'clusterrolebindings',
   'events', 'gitrepositories', 'ocirepositories', 'helmrepositories',
   'kustomizations', 'helmreleases', 'alerts', 'applications',
@@ -282,6 +344,12 @@ const KNOWN_KINDS = new Set([
   // Azure CAPI Infrastructure Provider
   'azuremanagedcontrolplanes', 'azuremanagedmachinepools', 'azuremachines',
   'azuremachinetemplates', 'azuremanagedclusters',
+  // Crossplane core (Managed Resources, Composites, and Claims are detected
+  // dynamically by spec shape — their plurals are unbounded so they're handled
+  // via fall-through, not enumerated in KNOWN_KINDS).
+  'providers', 'providerconfigs',
+  'compositeresourcedefinitions', 'compositions', 'compositionrevisions',
+  'functions', 'configurations',
 ])
 
 // ============================================================================
@@ -355,12 +423,47 @@ export function ResourceRendererDispatch({
 }: ResourceRendererDispatchProps) {
   const kind = resource.kind.toLowerCase()
 
-  const isKnownKind = KNOWN_KINDS.has(kind)
+  // Crossplane Managed Resources / Composites / Claims are detected by spec
+  // shape because their plurals are unbounded (one CRD kind per provider
+  // service). These flags suppress the GenericRenderer fall-through and route
+  // to the right Crossplane renderer below.
+  const isCrossplaneMR = isManagedResource(data)
+  const isCrossplaneClaim = !isCrossplaneMR && isClaim(data)
+  const isCrossplaneXR = !isCrossplaneMR && !isCrossplaneClaim && isComposite(data)
+
+  // Crossplane plurals that collide with foreign CRDs — `configurations`
+  // overlaps Knative serving.knative.dev/Configuration, `functions` could
+  // collide with OpenFaaS, `compositions` is in this list because its
+  // render line is apiVersion-gated. We add these to KNOWN_KINDS so the
+  // Crossplane renderer wins on apiVersion match, but a foreign CR with
+  // the same plural needs to fall through to GenericRenderer — otherwise
+  // it renders blank (no Crossplane match + isKnownKind suppresses
+  // generic). Only kinds whose render lines are apiVersion-gated belong
+  // here; `providerconfigs`/`compositionrevisions`/`compositeresource-
+  // definitions` are Crossplane-specific plurals with no realistic
+  // collision and unguarded render lines, so including them would risk
+  // double-render for foreign CRDs we'll never see.
+  const isCollisionGatedKind =
+    kind === 'providers' || kind === 'functions' || kind === 'configurations' || kind === 'compositions'
+  const crossplaneApiVersionMatched = isCollisionGatedKind && (
+    data?.apiVersion?.startsWith('pkg.crossplane.io/')
+    || data?.apiVersion?.startsWith('apiextensions.crossplane.io/')
+  )
+  const crossplaneCollisionFallthrough = isCollisionGatedKind && !crossplaneApiVersionMatched
+
+  const isKnownKind = KNOWN_KINDS.has(kind) || isCrossplaneMR || isCrossplaneClaim || isCrossplaneXR
 
   const PodComp = rendererOverrides?.PodRenderer ?? PodRenderer
   const WorkloadComp = rendererOverrides?.WorkloadRenderer ?? WorkloadRenderer
   const NodeComp = rendererOverrides?.NodeRenderer ?? NodeRenderer
   const ServiceComp = rendererOverrides?.ServiceRenderer ?? ServiceRenderer
+  const CompositeComp = rendererOverrides?.CompositeRenderer ?? CompositeRenderer
+  const ServiceAccountComp = rendererOverrides?.ServiceAccountRenderer ?? ServiceAccountRenderer
+  const RoleComp = rendererOverrides?.RoleRenderer ?? RoleRenderer
+  const RoleBindingComp = rendererOverrides?.RoleBindingRenderer ?? RoleBindingRenderer
+  const NamespaceComp = rendererOverrides?.NamespaceRenderer ?? NamespaceRenderer
+  const HPAComp = rendererOverrides?.HPARenderer ?? HPARenderer
+  const PVCComp = rendererOverrides?.PVCRenderer ?? PVCRenderer
 
   const sidebarContent = showCommonSections && (
     <>
@@ -385,9 +488,9 @@ export function ResourceRendererDispatch({
         {kind === 'secrets' && <SecretRenderer data={data} certificateInfo={certificateInfo} resourceData={data} onSaveSecretValue={onSaveSecretValue} isSaving={isSavingSecret} />}
         {kind === 'jobs' && <JobRenderer data={data} />}
         {kind === 'cronjobs' && <CronJobRenderer data={data} onNavigate={onNavigate} />}
-        {(kind === 'hpas' || kind === 'horizontalpodautoscalers') && <HPARenderer data={data} onNavigate={onNavigate} />}
+        {(kind === 'hpas' || kind === 'horizontalpodautoscalers') && <HPAComp data={data} onNavigate={onNavigate} />}
         {kind === 'nodes' && <NodeComp data={data} relationships={relationships} />}
-        {kind === 'persistentvolumeclaims' && <PVCRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'persistentvolumeclaims' && <PVCComp data={data} onNavigate={onNavigate} />}
         {kind === 'rollouts' && <RolloutRenderer data={data} />}
         {kind === 'certificates' && !data?.apiVersion?.includes('networking.internal.knative.dev') && <CertificateRenderer data={data} />}
         {kind === 'workflows' && <WorkflowRenderer data={data} />}
@@ -410,9 +513,10 @@ export function ResourceRendererDispatch({
         {(kind === 'ciliumnetworkpolicies' || kind === 'ciliumnetworkpolicy' || kind === 'ciliumclusterwidenetworkpolicies' || kind === 'ciliumclusterwidenetworkpolicy') && <CiliumNetworkPolicyRenderer data={data} />}
         {(kind === 'clusternetworkpolicies' || kind === 'clusternetworkpolicy') && <ClusterNetworkPolicyRenderer data={data} />}
         {kind === 'poddisruptionbudgets' && <PodDisruptionBudgetRenderer data={data} />}
-        {kind === 'serviceaccounts' && <ServiceAccountRenderer data={data} />}
-        {(kind === 'roles' || kind === 'clusterroles') && <RoleRenderer data={data} />}
-        {(kind === 'rolebindings' || kind === 'clusterrolebindings') && <RoleBindingRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'serviceaccounts' && <ServiceAccountComp data={data} onNavigate={onNavigate} />}
+        {kind === 'namespaces' && <NamespaceComp data={data} onNavigate={onNavigate} />}
+        {(kind === 'roles' || kind === 'clusterroles') && <RoleComp data={data} onNavigate={onNavigate} />}
+        {(kind === 'rolebindings' || kind === 'clusterrolebindings') && <RoleBindingComp data={data} onNavigate={onNavigate} />}
         {kind === 'events' && <EventRenderer data={data} onNavigate={onNavigate} />}
         {kind === 'gitrepositories' && <GitRepositoryRenderer data={data} />}
         {kind === 'ocirepositories' && <OCIRepositoryRenderer data={data} />}
@@ -525,8 +629,23 @@ export function ResourceRendererDispatch({
         {/* Contour */}
         {kind === 'httpproxies' && <ContourHTTPProxyRenderer data={data} onNavigate={onNavigate} />}
 
-        {/* Generic renderer for CRDs and unknown resource types */}
-        {!isKnownKind && <GenericRenderer data={data} />}
+        {/* Crossplane — kind-dispatched for the static package/config kinds, spec-shape
+            detected for MR/XR/Claim (their plurals are unbounded). */}
+        {kind === 'providers' && data?.apiVersion?.startsWith('pkg.crossplane.io/') && <CrossplanePackageRenderer data={data} kindLabel="Provider" onNavigate={onNavigate} />}
+        {kind === 'functions' && data?.apiVersion?.startsWith('pkg.crossplane.io/') && <CrossplanePackageRenderer data={data} kindLabel="Function" onNavigate={onNavigate} />}
+        {kind === 'configurations' && data?.apiVersion?.startsWith('pkg.crossplane.io/') && <CrossplanePackageRenderer data={data} kindLabel="Configuration" onNavigate={onNavigate} />}
+        {kind === 'providerconfigs' && <CrossplaneProviderConfigRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'compositeresourcedefinitions' && <XRDRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'compositions' && data?.apiVersion?.startsWith('apiextensions.crossplane.io/') && <CompositionRenderer data={data} onNavigate={onNavigate} />}
+        {kind === 'compositionrevisions' && <CompositionRevisionRenderer data={data} onNavigate={onNavigate} />}
+        {isCrossplaneMR && <ManagedResourceRenderer data={data} onNavigate={onNavigate} />}
+        {(isCrossplaneXR || isCrossplaneClaim) && <CompositeComp data={data} onNavigate={onNavigate} />}
+
+        {/* Generic renderer for CRDs and unknown resource types — also fires
+            for known-plural collisions where no apiVersion-gated renderer
+            matched (e.g. a Knative Configuration sharing the `configurations`
+            plural with Crossplane Configuration). */}
+        {(!isKnownKind || crossplaneCollisionFallthrough) && <GenericRenderer data={data} />}
 
         {/* Common sections - can be disabled when parent handles them separately */}
         {showCommonSections && (
@@ -662,6 +781,16 @@ export function getResourceStatus(kind: string, data: any): { text: string; colo
   if (k === 'peerauthentications') return getPeerAuthenticationStatus(data)
   if (k === 'authorizationpolicies') return getAuthorizationPolicyStatus(data)
 
+  // Crossplane — Provider/Function/Configuration share package conditions;
+  // ProviderConfig has its own; MR/XR/Claim detected by spec shape.
+  if ((k === 'providers' || k === 'functions' || k === 'configurations') && data?.apiVersion?.startsWith('pkg.crossplane.io/')) {
+    return getProviderStatus(data)
+  }
+  if (k === 'providerconfigs') return getProviderConfigStatus(data)
+  if (isManagedResource(data) || isComposite(data) || isClaim(data)) {
+    return getCrossplaneStatus(data)
+  }
+
   // Contour HTTPProxy
   if (k === 'httpproxies') {
     const s = getHTTPProxyStatus(data)

package/src/components/ui/YamlEditor.tsx

@@ -1,5 +1,6 @@
 import { useRef, useCallback, useEffect } from 'react'
-import Editor, { OnMount, OnChange, type Monaco } from '@monaco-editor/react'
+import Editor, { DiffEditor, OnMount, OnChange, type Monaco } from '@monaco-editor/react'
+import { PaneLoader } from './PaneLoader'
 import type { editor } from 'monaco-editor'
 
 interface YamlEditorProps {
@@ -240,40 +241,52 @@ export function YamlEditor({
   )
 }
 
-// Diff editor for showing changes before apply
 interface YamlDiffEditorProps {
   original: string
   modified: string
   height?: string | number
+  /** When true, render unified (single column) instead of side-by-side. */
+  unified?: boolean
+  /** When true, only diff regions stay rendered — unchanged sections collapse. */
+  hideUnchanged?: boolean
+  /** Caller-controlled theme. Defaults to dark to match YamlEditor. */
+  theme?: 'vs-dark' | 'vs'
+  /** When true, drops the rounded border so the editor reaches its container's edges. */
+  bleed?: boolean
 }
 
 export function YamlDiffEditor({
-  original: _original,
+  original,
   modified,
   height = '100%',
+  unified = false,
+  hideUnchanged = false,
+  theme = 'vs-dark',
+  bleed = false,
 }: YamlDiffEditorProps) {
-  // TODO: Use Monaco DiffEditor to show actual diff
-  void _original
   return (
-    <div className="rounded-lg overflow-hidden border border-theme-border" style={{ height }}>
-      <Editor
-        defaultLanguage="yaml"
-        value={modified}
-        theme="vs-dark"
+    <div className={bleed ? 'overflow-hidden' : 'rounded-lg overflow-hidden border border-theme-border'} style={{ height }}>
+      <DiffEditor
+        original={original}
+        modified={modified}
+        language="yaml"
+        theme={theme}
         options={{
           readOnly: true,
+          renderSideBySide: !unified,
+          hideUnchangedRegions: { enabled: hideUnchanged },
           minimap: { enabled: false },
           lineNumbers: 'on',
           scrollBeyondLastLine: false,
+          wordWrap: 'on',
           fontSize: 13,
           fontFamily: 'ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace',
           padding: { top: 12, bottom: 12 },
+          renderOverviewRuler: true,
+          ignoreTrimWhitespace: false,
+          automaticLayout: true,
         }}
-        loading={
-          <div className="flex items-center justify-center h-full bg-theme-surface text-theme-text-secondary">
-            Loading diff...
-          </div>
-        }
+        loading={<PaneLoader label="Loading resources…" className="h-full" />}
       />
     </div>
   )

package/src/components/ui/drawer-components.tsx

@@ -724,7 +724,8 @@ export function RelatedResourcesSection({ relationships, onNavigate }: RelatedRe
     (relationships.configRefs && relationships.configRefs.length > 0) ||
     (relationships.consumers && relationships.consumers.length > 0) ||
     (relationships.scalers && relationships.scalers.length > 0) ||
-    (relationships.policies && relationships.policies.length > 0) ||
+    (relationships.pdbs && relationships.pdbs.length > 0) ||
+    (relationships.networkPolicies && relationships.networkPolicies.length > 0) ||
     relationships.scaleTarget
 
   if (!hasRelationships) return null
@@ -765,25 +766,12 @@ export function RelatedResourcesSection({ relationships, onNavigate }: RelatedRe
         {relationships.scalers && relationships.scalers.length > 0 && (
           <RelationshipGroup label="Autoscaler" refs={dedupeRefs(relationships.scalers)} onNavigate={onNavigate} />
         )}
-        {relationships.policies && relationships.policies.length > 0 && (() => {
-          const policyKinds = new Set(['NetworkPolicy', 'CiliumNetworkPolicy', 'CiliumClusterwideNetworkPolicy', 'ClusterNetworkPolicy'])
-          const pdbs = relationships.policies.filter(r => r.kind === 'PodDisruptionBudget')
-          const netpols = relationships.policies.filter(r => policyKinds.has(r.kind))
-          const other = relationships.policies.filter(r => r.kind !== 'PodDisruptionBudget' && !policyKinds.has(r.kind))
-          return (
-            <>
-              {pdbs.length > 0 && (
-                <RelationshipGroup label="Disruption Budget" refs={dedupeRefs(pdbs)} onNavigate={onNavigate} />
-              )}
-              {netpols.length > 0 && (
-                <RelationshipGroup label="Network Policies" refs={dedupeRefs(netpols)} onNavigate={onNavigate} />
-              )}
-              {other.length > 0 && (
-                <RelationshipGroup label="Policies" refs={dedupeRefs(other)} onNavigate={onNavigate} />
-              )}
-            </>
-          )
-        })()}
+        {relationships.pdbs && relationships.pdbs.length > 0 && (
+          <RelationshipGroup label="Disruption Budget" refs={dedupeRefs(relationships.pdbs)} onNavigate={onNavigate} />
+        )}
+        {relationships.networkPolicies && relationships.networkPolicies.length > 0 && (
+          <RelationshipGroup label="Network Policies" refs={dedupeRefs(relationships.networkPolicies)} onNavigate={onNavigate} />
+        )}
         {relationships.scaleTarget && (
           <RelationshipGroup label="Scale Target" refs={[relationships.scaleTarget]} onNavigate={onNavigate} />
         )}

package/src/components/workload/ResourceDetailDrawer.tsx

@@ -37,7 +37,7 @@ interface ResourceDetailDrawerProps {
   }) => ReactNode
 }
 
-const MIN_WIDTH = 400
+const MIN_WIDTH = 520
 const MAX_WIDTH_PERCENT = 0.7
 const DEFAULT_WIDTH = 550
 const WIDE_WIDTH = 750

package/src/components/workload/WorkloadView.tsx

@@ -23,7 +23,7 @@ import {
 import type { TimelineEvent, ResourceRef, Relationships, SelectedResource, ResolvedEnvFrom } from '../../types'
 import type { NavigateToResource } from '../../utils/navigation'
 import { refToSelectedResource, pluralToKind } from '../../utils/navigation'
-import { detectGitOpsOwner, type GitOpsOwnerRef } from '../../utils/gitops-owner'
+import { gitOpsOwnerFromRelationships, type GitOpsOwnerRef } from '../../utils/gitops-owner'
 import { gitOpsRouteForResource } from '../../utils/gitops-route'
 import { isChangeEvent, isHistoricalEvent } from '../../types'
 import { getKindBadgeColor, getHealthBadgeColor } from '../../utils/badge-colors'
@@ -311,7 +311,7 @@ export function WorkloadView({
 
   // Metadata
   const metadata = useMemo(() => extractMetadata(kind, resource), [kind, resource])
-  const gitopsOwner = useMemo(() => detectGitOpsOwner(resource), [resource])
+  const gitopsOwner = useMemo(() => gitOpsOwnerFromRelationships(relationships), [relationships])
   // When the resource itself is a portal GitOps CR (Application, Kustomization,
   // HelmRelease, etc.), surface a link to its dedicated GitOps detail page —
   // the drawer's renderer is thorough but the tab has the tree + insights +

package/src/index.ts

@@ -42,3 +42,6 @@ export * from './components/audit'
 
 // Cluster switcher (shared trigger+dropdown for OSS Radar and Radar Hub)
 export * from './components/cluster-switcher'
+
+// Compare (ResourceCompareView, CompareResourcePicker, normalize utilities)
+export * from './components/compare'

package/src/types/core.ts

@@ -1,6 +1,8 @@
 // Topology types matching the Go backend
 
-// Per-resource-type RBAC permissions (matches backend k8s.ResourcePermissions)
+// Per-resource-type RBAC permissions. Field names must match the JSON keys
+// produced by ResourcePermissions in internal/k8s/capabilities.go — there
+// is no automated check across the Go/TS boundary.
 export interface ResourcePermissions {
   pods: boolean
   services: boolean
@@ -12,20 +14,39 @@ export interface ResourcePermissions {
   configMaps: boolean
   secrets: boolean
   events: boolean
-  pvcs: boolean
+  persistentVolumeClaims: boolean
   nodes: boolean
   namespaces: boolean
   jobs: boolean
   cronJobs: boolean
-  hpas: boolean
-  gateways: boolean
-  httpRoutes: boolean
+  horizontalPodAutoscalers: boolean
+  persistentVolumes: boolean
+  storageClasses: boolean
+  podDisruptionBudgets: boolean
+  networkPolicies: boolean
+  serviceAccounts: boolean
   roles: boolean
   clusterRoles: boolean
   roleBindings: boolean
   clusterRoleBindings: boolean
+  limitRanges: boolean
+  gateways: boolean
+  httpRoutes: boolean
+  verticalPodAutoscalers: boolean
 }
 
+// Keys in ResourcePermissions that represent optional CRDs Radar can monitor
+// when they're installed in the cluster. A `false` here means "CRD not
+// installed (or RBAC denied)" — NOT "Radar is missing data the user expects",
+// so banners about RBAC restrictions should ignore these keys.
+//
+// Keep in sync with dynamicCapabilityKinds in internal/k8s/capabilities_alignment_test.go.
+export const OPTIONAL_RESOURCE_KINDS: ReadonlyArray<keyof ResourcePermissions> = [
+  'gateways',
+  'httpRoutes',
+  'verticalPodAutoscalers',
+]
+
 // Feature capabilities based on RBAC permissions
 export interface Capabilities {
   exec: boolean           // Terminal feature (pods/exec)
@@ -394,6 +415,7 @@ export interface ResourceRef {
 export interface Relationships {
   owner?: ResourceRef
   deployment?: ResourceRef   // Grandparent Deployment (for Pods owned by ReplicaSets)
+  managedBy?: ResourceRef[]  // Topmost meaningful manager(s): GitOps controller (ArgoCD Application / Flux Kustomization / Flux HelmRelease), Helm release, or the topmost K8s owner. Synthesized server-side; replaces client-side detectGitOpsOwner.
   children?: ResourceRef[]
   services?: ResourceRef[]
   ingresses?: ResourceRef[]
@@ -403,8 +425,11 @@ export interface Relationships {
   consumers?: ResourceRef[]
   scalers?: ResourceRef[]
   scaleTarget?: ResourceRef
-  policies?: ResourceRef[]
+  pdbs?: ResourceRef[]              // PodDisruptionBudgets protecting this workload
+  networkPolicies?: ResourceRef[]   // NetworkPolicy / CiliumNetworkPolicy / ClusterNetworkPolicy variants selecting this workload
   pods?: ResourceRef[]
+  serviceAccount?: ResourceRef      // For Pods: derived from pod.spec.serviceAccountName
+  node?: ResourceRef                // For scheduled Pods: derived from pod.spec.nodeName
 }
 
 // Parsed X.509 certificate metadata (from backend cert parsing)

package/src/types/index.ts

@@ -2,3 +2,4 @@ export * from './core'
 export * from './gitops'
 export * from './gitops-tree'
 export * from './gitops-insights'
+export * from './rbac'

package/src/types/rbac.ts

@@ -0,0 +1,99 @@
+// Wire types for the /api/rbac/* endpoints, kept in the shared package so
+// both the host (which fetches) and the renderers (which display) agree on
+// the shape. Mirrors the Go types in internal/server/rbac_handlers.go and
+// pkg/rbac/index.go.
+
+export interface RBACSubject {
+  kind: string // "ServiceAccount" | "User" | "Group"
+  namespace: string // empty for User/Group
+  name: string
+}
+
+export interface RBACRoleRef {
+  kind: string // "Role" | "ClusterRole"
+  namespace: string // empty for ClusterRole
+  name: string
+}
+
+export interface RBACBindingRef {
+  kind: string // "RoleBinding" | "ClusterRoleBinding"
+  namespace: string // empty for ClusterRoleBinding
+  name: string
+  roleRef: RBACRoleRef
+}
+
+export interface RBACPolicyRule {
+  verbs?: string[]
+  apiGroups?: string[]
+  resources?: string[]
+  resourceNames?: string[]
+  nonResourceURLs?: string[]
+}
+
+export interface RBACBindingRules {
+  binding: RBACBindingRef
+  role: RBACRoleRef
+  rules: RBACPolicyRule[]
+  /** Populated when a RoleBinding references a ClusterRole — rules apply
+   *  only in this namespace. */
+  scopeNamespace?: string
+}
+
+export interface RBACInheritedGroup {
+  groupName: string // e.g. "system:authenticated"
+  bindings: RBACBindingRules[]
+}
+
+export interface RBACSubjectResponse {
+  subject: RBACSubject
+  direct: RBACBindingRules[]
+  inheritedFromGroups: RBACInheritedGroup[]
+  flat: RBACPolicyRule[]
+  truncated: boolean
+  /** Pods whose spec.serviceAccountName references this SA. Populated only
+   *  for ServiceAccount subjects; undefined or empty for User/Group. */
+  usedByPods?: RBACPodRef[]
+}
+
+export interface RBACPodRef {
+  namespace: string
+  name: string
+}
+
+export interface RBACNamespaceResponse {
+  namespace: string
+  roleBindings: RBACBindingWithSubjects[]
+  /** ClusterRoleBindings with at least one subject in this namespace. */
+  clusterRoleBindingsWithLocalSubject: RBACBindingWithSubjects[]
+  serviceAccountCount: number
+}
+
+export interface RBACBindingWithSubjects {
+  binding: RBACBindingRef
+  subjects: RBACSubject[]
+}
+
+export interface RBACRoleResponse {
+  role: RBACRoleRef
+  bindings: RBACBindingWithSubjects[]
+}
+
+export interface RBACResourceRule {
+  verbs: string[]
+  apiGroups?: string[]
+  resources?: string[]
+  resourceNames?: string[]
+}
+
+export interface RBACNonResourceRule {
+  verbs: string[]
+  nonResourceURLs?: string[]
+}
+
+export interface RBACWhoamiResponse {
+  namespace: string
+  resourceRules: RBACResourceRule[]
+  nonResourceRules: RBACNonResourceRule[]
+  incomplete: boolean
+  evaluationError?: string
+}

package/src/utils/api-resources.ts

@@ -124,8 +124,11 @@ export function formatGroupName(group: string): string {
     'gateway.networking.k8s.io': 'Gateway API',
     'traefik.io': 'Traefik',
     'traefik.containo.us': 'Traefik',
+    'crossplane.io': 'Crossplane',
     'pkg.crossplane.io': 'Crossplane',
     'apiextensions.crossplane.io': 'Crossplane',
+    'helm.crossplane.io': 'Crossplane',
+    'kubernetes.crossplane.io': 'Crossplane',
     'source.toolkit.fluxcd.io': 'Flux',
     'helm.toolkit.fluxcd.io': 'Flux',
     'kustomize.toolkit.fluxcd.io': 'Flux',
@@ -167,7 +170,12 @@ export function formatGroupName(group: string): string {
     'kubeflow.org': 'Kubeflow',
     'snapshot.storage.k8s.io': 'Snapshots',
   }
-  return knownGroups[group] || group
+  if (knownGroups[group]) return knownGroups[group]
+  // Suffix rules — for unbounded provider group sets (Crossplane providers ship
+  // their own per-service groups like s3.aws.upbound.io, compute.gcp.upbound.io).
+  if (group.endsWith('.upbound.io')) return 'Crossplane'
+  if (group.endsWith('.crossplane.io')) return 'Crossplane'
+  return group
 }
 
 export function shortenGroupName(group: string): string {

package/src/utils/badge-colors.ts

@@ -286,6 +286,31 @@ export function getHelmStatusColor(status: string): string {
   return HELM_STATUS_COLORS[statusLower] || 'bg-theme-hover/50 text-theme-text-secondary'
 }
 
+/**
+ * Helm release statuses where the row UI should signpost the user
+ * toward the drawer (history / rollback / logs).
+ *
+ * Currently `failed` only. The `pending-*` statuses (install /
+ * upgrade / rollback) are excluded deliberately: they're Helm's
+ * normal in-flight states during every routine operation. Treating
+ * them as "actionable" would briefly attach an alarming chevron +
+ * tooltip to every install while it ran — indistinguishable from
+ * the genuinely-stuck case (controller crashed mid-flight). Until
+ * we have release age available client-side to disambiguate
+ * "in-flight" from "stuck > N min", we give up the stuck-detect
+ * signpost rather than wrongly alarm the common case.
+ *
+ * @see https://github.com/helm/helm/blob/dev-v3/pkg/release/status.go
+ */
+const ACTIONABLE_HELM_STATUSES: ReadonlySet<string> = new Set([
+  'failed',
+])
+
+export function isHelmReleaseActionable(status: string | null | undefined): boolean {
+  if (!status) return false
+  return ACTIONABLE_HELM_STATUSES.has(status.toLowerCase())
+}
+
 // =============================================================================
 // VULNERABILITY SEVERITY COLORS - for Trivy and other security scanners
 // =============================================================================