@skyhook-io/k8s-ui 1.6.1 → 1.7.0

package/src/perf/store.ts

@@ -0,0 +1,110 @@
+// Always-on, in-memory performance instrumentation for k8s-ui internals.
+// Records ELK layout duration and structureKey rebuild duration so users can
+// include them in bug reports via the host app's diagnostics overlay.
+// Cost is one performance.now() pair + a 50-entry ring buffer append per
+// topology layout — negligible.
+
+const RING_SIZE = 50
+
+interface Ring {
+  samples: number[]
+  next: number
+  count: number
+  last: number
+}
+
+function makeRing(): Ring {
+  return { samples: new Array(RING_SIZE), next: 0, count: 0, last: 0 }
+}
+
+function ringAdd(r: Ring, v: number): void {
+  r.samples[r.next] = v
+  r.next = (r.next + 1) % RING_SIZE
+  if (r.count < RING_SIZE) r.count++
+  r.last = v
+}
+
+export interface SampleWindow {
+  count: number
+  last: number
+  min: number
+  p50: number
+  p95: number
+  p99: number
+  max: number
+}
+
+function ringSnapshot(r: Ring): SampleWindow {
+  if (r.count === 0) return { count: 0, last: 0, min: 0, p50: 0, p95: 0, p99: 0, max: 0 }
+  const buf = r.samples.slice(0, r.count).sort((a, b) => a - b)
+  const pick = (p: number) => buf[Math.min(buf.length - 1, Math.floor((buf.length - 1) * p))]
+  return {
+    count: r.count,
+    last: r.last,
+    min: buf[0],
+    p50: pick(0.5),
+    p95: pick(0.95),
+    p99: pick(0.99),
+    max: buf[buf.length - 1],
+  }
+}
+
+const layoutMs = makeRing()
+const structureKeyUs = makeRing()
+const lastLayoutNodeCount = { value: 0 }
+const lastLayoutEdgeCount = { value: 0 }
+let totalLayouts = 0
+let totalLayoutsSkipped = 0
+let totalStructureKeyComputes = 0
+
+export interface K8sUIPerfSnapshot {
+  totalLayouts: number
+  totalLayoutsSkipped: number
+  totalStructureKeyComputes: number
+  lastLayoutNodeCount: number
+  lastLayoutEdgeCount: number
+  layoutMs: SampleWindow
+  structureKeyUs: SampleWindow
+}
+
+export function recordLayoutDuration(ms: number, nodeCount: number, edgeCount: number): void {
+  totalLayouts++
+  ringAdd(layoutMs, ms)
+  lastLayoutNodeCount.value = nodeCount
+  lastLayoutEdgeCount.value = edgeCount
+}
+
+export function recordLayoutSkipped(): void {
+  totalLayoutsSkipped++
+}
+
+export function recordStructureKeyDuration(us: number): void {
+  totalStructureKeyComputes++
+  ringAdd(structureKeyUs, us)
+}
+
+export function getK8sUIPerfSnapshot(): K8sUIPerfSnapshot {
+  return {
+    totalLayouts,
+    totalLayoutsSkipped,
+    totalStructureKeyComputes,
+    lastLayoutNodeCount: lastLayoutNodeCount.value,
+    lastLayoutEdgeCount: lastLayoutEdgeCount.value,
+    layoutMs: ringSnapshot(layoutMs),
+    structureKeyUs: ringSnapshot(structureKeyUs),
+  }
+}
+
+// Test seam — reset all counters and windows. Not safe to call concurrently
+// with the record functions.
+export function resetK8sUIPerf(): void {
+  layoutMs.samples = new Array(RING_SIZE)
+  layoutMs.next = 0; layoutMs.count = 0; layoutMs.last = 0
+  structureKeyUs.samples = new Array(RING_SIZE)
+  structureKeyUs.next = 0; structureKeyUs.count = 0; structureKeyUs.last = 0
+  totalLayouts = 0
+  totalLayoutsSkipped = 0
+  totalStructureKeyComputes = 0
+  lastLayoutNodeCount.value = 0
+  lastLayoutEdgeCount.value = 0
+}

package/src/types/core.ts

@@ -212,9 +212,19 @@ export interface Topology {
   largeCluster?: boolean // True if cluster exceeds large cluster threshold
   hiddenKinds?: string[] // Resource kinds auto-hidden for performance
   requiresNamespaceFilter?: boolean // True if cluster is too large for all-namespace topology
+  estimatedNodes?: number // Pre-build node count estimate
+  summaryMode?: boolean // True when the pod tier was collapsed into per-workload/service counts
   crdDiscoveryStatus?: 'idle' | 'discovering' | 'ready' // CRD discovery status
 }
 
+// PodSummary is stamped onto a workload or service node's data in summary mode.
+export interface PodSummary {
+  total: number
+  healthy: number
+  degraded: number
+  unhealthy: number
+}
+
 // K8s Event (from SSE stream)
 export interface K8sEvent {
   kind: string

package/src/types/index.ts

@@ -2,3 +2,4 @@ export * from './core'
 export * from './gitops'
 export * from './gitops-tree'
 export * from './gitops-insights'
+export * from './rbac'

package/src/types/rbac.ts

@@ -0,0 +1,99 @@
+// Wire types for the /api/rbac/* endpoints, kept in the shared package so
+// both the host (which fetches) and the renderers (which display) agree on
+// the shape. Mirrors the Go types in internal/server/rbac_handlers.go and
+// pkg/rbac/index.go.
+
+export interface RBACSubject {
+  kind: string // "ServiceAccount" | "User" | "Group"
+  namespace: string // empty for User/Group
+  name: string
+}
+
+export interface RBACRoleRef {
+  kind: string // "Role" | "ClusterRole"
+  namespace: string // empty for ClusterRole
+  name: string
+}
+
+export interface RBACBindingRef {
+  kind: string // "RoleBinding" | "ClusterRoleBinding"
+  namespace: string // empty for ClusterRoleBinding
+  name: string
+  roleRef: RBACRoleRef
+}
+
+export interface RBACPolicyRule {
+  verbs?: string[]
+  apiGroups?: string[]
+  resources?: string[]
+  resourceNames?: string[]
+  nonResourceURLs?: string[]
+}
+
+export interface RBACBindingRules {
+  binding: RBACBindingRef
+  role: RBACRoleRef
+  rules: RBACPolicyRule[]
+  /** Populated when a RoleBinding references a ClusterRole — rules apply
+   *  only in this namespace. */
+  scopeNamespace?: string
+}
+
+export interface RBACInheritedGroup {
+  groupName: string // e.g. "system:authenticated"
+  bindings: RBACBindingRules[]
+}
+
+export interface RBACSubjectResponse {
+  subject: RBACSubject
+  direct: RBACBindingRules[]
+  inheritedFromGroups: RBACInheritedGroup[]
+  flat: RBACPolicyRule[]
+  truncated: boolean
+  /** Pods whose spec.serviceAccountName references this SA. Populated only
+   *  for ServiceAccount subjects; undefined or empty for User/Group. */
+  usedByPods?: RBACPodRef[]
+}
+
+export interface RBACPodRef {
+  namespace: string
+  name: string
+}
+
+export interface RBACNamespaceResponse {
+  namespace: string
+  roleBindings: RBACBindingWithSubjects[]
+  /** ClusterRoleBindings with at least one subject in this namespace. */
+  clusterRoleBindingsWithLocalSubject: RBACBindingWithSubjects[]
+  serviceAccountCount: number
+}
+
+export interface RBACBindingWithSubjects {
+  binding: RBACBindingRef
+  subjects: RBACSubject[]
+}
+
+export interface RBACRoleResponse {
+  role: RBACRoleRef
+  bindings: RBACBindingWithSubjects[]
+}
+
+export interface RBACResourceRule {
+  verbs: string[]
+  apiGroups?: string[]
+  resources?: string[]
+  resourceNames?: string[]
+}
+
+export interface RBACNonResourceRule {
+  verbs: string[]
+  nonResourceURLs?: string[]
+}
+
+export interface RBACWhoamiResponse {
+  namespace: string
+  resourceRules: RBACResourceRule[]
+  nonResourceRules: RBACNonResourceRule[]
+  incomplete: boolean
+  evaluationError?: string
+}

package/src/utils/api-resources.ts

@@ -124,8 +124,11 @@ export function formatGroupName(group: string): string {
     'gateway.networking.k8s.io': 'Gateway API',
     'traefik.io': 'Traefik',
     'traefik.containo.us': 'Traefik',
+    'crossplane.io': 'Crossplane',
     'pkg.crossplane.io': 'Crossplane',
     'apiextensions.crossplane.io': 'Crossplane',
+    'helm.crossplane.io': 'Crossplane',
+    'kubernetes.crossplane.io': 'Crossplane',
     'source.toolkit.fluxcd.io': 'Flux',
     'helm.toolkit.fluxcd.io': 'Flux',
     'kustomize.toolkit.fluxcd.io': 'Flux',
@@ -167,7 +170,12 @@ export function formatGroupName(group: string): string {
     'kubeflow.org': 'Kubeflow',
     'snapshot.storage.k8s.io': 'Snapshots',
   }
-  return knownGroups[group] || group
+  if (knownGroups[group]) return knownGroups[group]
+  // Suffix rules — for unbounded provider group sets (Crossplane providers ship
+  // their own per-service groups like s3.aws.upbound.io, compute.gcp.upbound.io).
+  if (group.endsWith('.upbound.io')) return 'Crossplane'
+  if (group.endsWith('.crossplane.io')) return 'Crossplane'
+  return group
 }
 
 export function shortenGroupName(group: string): string {

package/src/utils/index.ts

@@ -16,3 +16,4 @@ export * from './view-transition'
 export * from './validators'
 export * from './gitops-owner'
 export * from './gitops-route'
+export * from './rbac-badges'

package/src/utils/rbac-badges.ts

@@ -0,0 +1,61 @@
+// Theme-aware badge classes for RBAC display (verbs, resources, API groups).
+// Reuses the same light/dark pairs as Badge.tsx's SEVERITY/KIND maps so the
+// RBAC views read with the same contrast as the rest of the app — the
+// inherited `text-*-400` foreground without a light counterpart was washing
+// out on light backgrounds.
+//
+// Centralized here so SA / Pod / RoleBinding renderers and the
+// MyPermissions dialog all stay in sync; previous duplicate copies drifted.
+
+import { BADGE_SEVERITY_COLORS, BADGE_KIND_COLORS } from '../components/ui/Badge'
+import {
+  RBAC_BLAST_READ_VERBS,
+  RBAC_BLAST_WRITE_VERBS,
+  RBAC_BLAST_DELETE_VERBS,
+  RBAC_BLAST_ESCALATION_VERBS,
+} from './rbac-blast-radius'
+
+/** Theme-aware classes for an RBAC verb chip. */
+export function rbacVerbBadgeClass(verb: string): string {
+  if (verb === '*') return BADGE_SEVERITY_COLORS.error
+  if (RBAC_BLAST_ESCALATION_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.error
+  if (RBAC_BLAST_DELETE_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.error
+  if (RBAC_BLAST_WRITE_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.warning
+  if (RBAC_BLAST_READ_VERBS.has(verb)) return BADGE_SEVERITY_COLORS.success
+  return BADGE_SEVERITY_COLORS.info
+}
+
+/** Theme-aware classes for an RBAC resource chip (pods, configmaps, …). */
+export const rbacResourceBadgeClass: string =
+  BADGE_KIND_COLORS.HTTPRoute // purple-100/-700 in light, purple-950/-400 in dark
+
+/**
+ * Theme-aware kind badge for the four RBAC kinds. We can't put these in
+ * Badge.tsx's KIND map without churn there, so reuse the closest existing
+ * palette entry: blue/info for namespaced (Role/RoleBinding), purple for
+ * cluster-scoped (ClusterRole/ClusterRoleBinding).
+ */
+export function rbacKindBadgeClass(kind: string): string {
+  switch (kind) {
+    case 'Role':
+    case 'RoleBinding':
+      return BADGE_KIND_COLORS.Service // blue-100/-700 light, blue-950/-400 dark
+    case 'ClusterRole':
+    case 'ClusterRoleBinding':
+      return BADGE_KIND_COLORS.HelmRelease // purple-100/-700 light, purple-950/-400 dark
+    default:
+      return BADGE_KIND_COLORS.HelmRelease
+  }
+}
+
+/** Theme-aware classes for an API group chip (notification.toolkit.fluxcd.io, …). */
+export const rbacApiGroupBadgeClass: string =
+  'bg-theme-hover/60 text-theme-text-secondary border-theme-border'
+
+/** Theme-aware classes for a resourceName chip (rare — `resourceNames: [...]`). */
+export const rbacResourceNameBadgeClass: string =
+  BADGE_KIND_COLORS.PersistentVolumeClaim // cyan, distinct from resources
+
+/** Theme-aware classes for a non-resource URL chip (/healthz etc). */
+export const rbacNonResourceUrlBadgeClass: string =
+  BADGE_KIND_COLORS.Application // orange, distinct from everything above

package/src/utils/rbac-blast-radius.test.ts

@@ -0,0 +1,137 @@
+import { describe, it, expect } from 'vitest'
+import { detectBlastRadius, rulePermissivenessScore } from './rbac-blast-radius'
+import type { RBACBindingRules, RBACSubjectResponse } from '../types/rbac'
+
+// Skeleton helpers — keep fixtures terse so each test reads as a contract.
+function binding(over: Partial<RBACBindingRules> = {}): RBACBindingRules {
+  return {
+    binding: { kind: 'RoleBinding', namespace: 'default', name: 'b', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } },
+    role: { kind: 'Role', namespace: 'default', name: 'r' },
+    rules: [],
+    ...over,
+  }
+}
+
+function subject(direct: RBACBindingRules[] = [], inherited: { groupName: string; bindings: RBACBindingRules[] }[] = []): RBACSubjectResponse {
+  return {
+    subject: { kind: 'ServiceAccount', namespace: 'default', name: 'app-sa' },
+    direct,
+    inheritedFromGroups: inherited,
+    flat: [],
+    truncated: false,
+  }
+}
+
+describe('detectBlastRadius', () => {
+  // The five documented triggers; each is a security-UX invariant the PR
+  // description and inline comments call load-bearing. If any of these
+  // silently regresses, the Pod blast-radius banner stops alarming on the
+  // exact scenarios it was added for.
+
+  it('flags cluster-admin role-name match', () => {
+    const b = binding({ role: { kind: 'ClusterRole', name: 'cluster-admin', namespace: '' } })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/cluster-admin/)
+  })
+
+  it('flags verb wildcards', () => {
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['pods'], apiGroups: [''] }],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/verb wildcard/)
+  })
+
+  it('flags escalation verbs', () => {
+    const b = binding({
+      rules: [{ verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] }],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/escalate/)
+  })
+
+  it('flags impersonate and bind too', () => {
+    const b1 = binding({ binding: { kind: 'RoleBinding', namespace: 'default', name: 'b1', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } }, rules: [{ verbs: ['impersonate'], resources: ['users'], apiGroups: [''] }] })
+    const b2 = binding({ binding: { kind: 'RoleBinding', namespace: 'default', name: 'b2', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } }, rules: [{ verbs: ['bind'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] }] })
+    const reasons = detectBlastRadius(subject([b1, b2]))
+    expect(reasons).toHaveLength(2)
+    expect(reasons[0].reason).toMatch(/impersonate/)
+    expect(reasons[1].reason).toMatch(/bind/)
+  })
+
+  it('flags cluster-wide "create pods" but NOT namespace-scoped "create pods"', () => {
+    // The cluster-wide form is the lateral-movement vector — a Pod with
+    // namespace-scoped pod-create can only move within its namespace.
+    const cluster = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'cluster-b', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
+      rules: [{ verbs: ['create'], resources: ['pods'], apiGroups: [''] }],
+    })
+    const namespaced = binding({
+      binding: { kind: 'RoleBinding', namespace: 'default', name: 'ns-b', roleRef: { kind: 'Role', namespace: 'default', name: 'r' } },
+      rules: [{ verbs: ['create'], resources: ['pods'], apiGroups: [''] }],
+    })
+    expect(detectBlastRadius(subject([cluster]))).toHaveLength(1)
+    expect(detectBlastRadius(subject([namespaced]))).toHaveLength(0)
+  })
+
+  it('does NOT flag resource-only wildcards', () => {
+    // The `view` ClusterRole grants get/list/watch on `*` resources in
+    // every fluxcd CRD. Flagging this would alarm on every authenticated
+    // SA — calibration call documented in the source.
+    const b = binding({
+      rules: [{ verbs: ['get', 'list', 'watch'], resources: ['*'], apiGroups: ['source.toolkit.fluxcd.io'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
+  it('dedupes by binding identity when multiple risky rules match', () => {
+    const b = binding({
+      rules: [
+        { verbs: ['*'], resources: ['pods'], apiGroups: [''] },
+        { verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] },
+      ],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+  })
+
+  it('includes inherited-from-group bindings, not just direct', () => {
+    const b = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'inherited', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
+      rules: [{ verbs: ['*'], resources: ['secrets'], apiGroups: [''] }],
+    })
+    const reasons = detectBlastRadius(subject([], [{ groupName: 'system:authenticated', bindings: [b] }]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/verb wildcard/)
+  })
+
+  it('returns empty for benign bindings', () => {
+    const b = binding({
+      rules: [{ verbs: ['get', 'list'], resources: ['configmaps'], apiGroups: [''] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+})
+
+describe('rulePermissivenessScore', () => {
+  it('scores wildcards highest', () => {
+    const wildcard = rulePermissivenessScore({ verbs: ['*'], resources: ['*'], apiGroups: ['*'] })
+    const benign = rulePermissivenessScore({ verbs: ['get'], resources: ['configmaps'], apiGroups: [''] })
+    expect(wildcard).toBeGreaterThan(benign)
+  })
+
+  it('boosts cluster-wide "create pods"', () => {
+    const createPods = rulePermissivenessScore({ verbs: ['create'], resources: ['pods'], apiGroups: [''] })
+    const createOthers = rulePermissivenessScore({ verbs: ['create'], resources: ['configmaps'], apiGroups: [''] })
+    expect(createPods).toBeGreaterThan(createOthers)
+  })
+
+  it('scores escalation verbs higher than plain writes', () => {
+    const escalate = rulePermissivenessScore({ verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] })
+    const patch = rulePermissivenessScore({ verbs: ['patch'], resources: ['configmaps'], apiGroups: [''] })
+    expect(escalate).toBeGreaterThan(patch)
+  })
+})

package/src/utils/rbac-blast-radius.ts

@@ -0,0 +1,98 @@
+// Pure helpers for the "what's the blast radius of this Pod / Workload / SA"
+// detection. Lives outside the renderers because it's the security-UX core
+// of the RBAC visibility feature — the rule that resource-only wildcards do
+// NOT trigger (because `view` covers every fluxcd CRD via wildcards and would
+// alarm on every authenticated SA) is load-bearing and easily regressed
+// silently. Tested via rbac-blast-radius.test.ts; keep it pure.
+
+import type { RBACBindingRules, RBACPolicyRule, RBACSubjectResponse } from '../types/rbac'
+
+export const RBAC_BLAST_READ_VERBS = new Set(['get', 'list', 'watch'])
+export const RBAC_BLAST_WRITE_VERBS = new Set(['create', 'update', 'patch'])
+export const RBAC_BLAST_DELETE_VERBS = new Set(['delete', 'deletecollection'])
+export const RBAC_BLAST_ESCALATION_VERBS = new Set(['escalate', 'bind', 'impersonate'])
+
+/**
+ * Score a single PolicyRule by max permissiveness. Higher is scarier.
+ * The ordering matters more than the absolute scale — used to sort the
+ * rule preview so dangerous rules surface first in incident response.
+ */
+export function rulePermissivenessScore(r: RBACPolicyRule): number {
+  let score = 0
+  const verbs = r.verbs ?? []
+  const resources = r.resources ?? []
+  const groups = r.apiGroups ?? []
+  if (verbs.includes('*')) score += 100
+  if (resources.includes('*')) score += 100
+  if (groups.includes('*')) score += 100
+  for (const v of verbs) {
+    if (RBAC_BLAST_ESCALATION_VERBS.has(v)) score += 80
+    else if (RBAC_BLAST_DELETE_VERBS.has(v)) score += 40
+    else if (RBAC_BLAST_WRITE_VERBS.has(v)) score += 20
+    else if (RBAC_BLAST_READ_VERBS.has(v)) score += 5
+    else score += 10
+  }
+  if (verbs.includes('create') && resources.includes('pods')) score += 50
+  return score
+}
+
+export interface BlastRadiusReason {
+  binding: RBACBindingRules
+  reason: string
+}
+
+/**
+ * Detect bindings that genuinely make a Pod's compromise a cluster takeover.
+ * Triggers on, in priority order:
+ *
+ *   1. cluster-admin role-name match (covers the "bound my SA to cluster-admin
+ *      for testing" pattern even when rules aren't loaded)
+ *   2. verb wildcards (`*`)
+ *   3. escalation verbs (`escalate` / `bind` / `impersonate`)
+ *   4. cluster-wide `create pods` (lateral-movement vector)
+ *
+ * Resource-only wildcards (e.g. `view`'s fluxcd CRD coverage) deliberately
+ * do NOT trigger — they fire on every authenticated SA and would train
+ * operators to ignore the alarm. The current set is the calibrated minimum
+ * for "the Pod's identity is genuinely god-mode".
+ *
+ * Dedupes by binding identity so a binding with multiple risky rules
+ * counts once; first matching reason wins.
+ */
+export function detectBlastRadius(rbacData: RBACSubjectResponse): BlastRadiusReason[] {
+  const reasons: BlastRadiusReason[] = []
+  const allBindings = [
+    ...rbacData.direct,
+    ...rbacData.inheritedFromGroups.flatMap((g) => g.bindings),
+  ]
+  for (const br of allBindings) {
+    if (br.role.name === 'cluster-admin' && br.role.kind === 'ClusterRole') {
+      reasons.push({ binding: br, reason: 'bound to cluster-admin (full god-mode access)' })
+      continue
+    }
+    for (const r of br.rules ?? []) {
+      const verbs = r.verbs ?? []
+      const resources = r.resources ?? []
+      if (verbs.includes('*')) {
+        reasons.push({ binding: br, reason: 'grants verb wildcard (*) — every action on the listed resources' })
+        break
+      }
+      const escalations = verbs.filter((v) => RBAC_BLAST_ESCALATION_VERBS.has(v))
+      if (escalations.length > 0) {
+        reasons.push({ binding: br, reason: `grants privilege-escalation verbs: ${escalations.join(', ')}` })
+        break
+      }
+      if (verbs.includes('create') && resources.includes('pods') && br.binding.kind === 'ClusterRoleBinding') {
+        reasons.push({ binding: br, reason: 'grants cluster-wide "create pods" — a known lateral-movement vector' })
+        break
+      }
+    }
+  }
+  const seen = new Set<string>()
+  return reasons.filter((r) => {
+    const key = r.binding.binding.kind + '/' + r.binding.binding.namespace + '/' + r.binding.binding.name
+    if (seen.has(key)) return false
+    seen.add(key)
+    return true
+  })
+}

package/src/utils/resource-hierarchy.ts

@@ -559,13 +559,23 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
           TraefikService: 2, Middleware: 3, MiddlewareTCP: 3,
           HTTPProxy: 1, // Contour
         }
+        // Precompute each child's latest event time once — otherwise the
+        // comparator below reparses every child's event timestamps on every
+        // comparison (O(children log children × events) Date parses).
+        const latestByChildId = new Map<string, number>()
+        for (const c of lane.children) {
+          let latest = 0
+          for (const e of c.events) {
+            const t = new Date(e.timestamp).getTime()
+            if (t > latest) latest = t
+          }
+          latestByChildId.set(c.id, latest)
+        }
         lane.children.sort((a, b) => {
           const aPriority = kindPriority[a.kind] || 10
           const bPriority = kindPriority[b.kind] || 10
           if (aPriority !== bPriority) return aPriority - bPriority
-          const aLatest = a.events.length > 0 ? Math.max(...a.events.map(e => new Date(e.timestamp).getTime())) : 0
-          const bLatest = b.events.length > 0 ? Math.max(...b.events.map(e => new Date(e.timestamp).getTime())) : 0
-          return bLatest - aLatest
+          return (latestByChildId.get(b.id) ?? 0) - (latestByChildId.get(a.id) ?? 0)
         })
       }