@skyhook-io/k8s-ui 1.7.14 → 1.8.0

package/src/types/core.ts

@@ -47,6 +47,15 @@ export const OPTIONAL_RESOURCE_KINDS: ReadonlyArray<keyof ResourcePermissions> =
   'verticalPodAutoscalers',
 ]
 
+// Per-workload write permissions. Field names must match
+// WorkloadWritePermissions in internal/k8s/capabilities.go.
+export interface WorkloadWritePermissions {
+  deployments: boolean
+  daemonSets: boolean
+  statefulSets: boolean
+  rollouts: boolean
+}
+
 // Feature capabilities based on RBAC permissions
 export interface Capabilities {
   exec: boolean           // Terminal feature (pods/exec)
@@ -57,6 +66,7 @@ export interface Capabilities {
   secretsUpdate: boolean  // Update secrets (inline editing)
   helmWrite: boolean      // Helm write operations (install, upgrade, rollback, uninstall, apply values)
   nodeWrite: boolean      // Node write operations (cordon, uncordon, drain)
+  workloadWrites?: WorkloadWritePermissions // Workload patch permissions (restart/scale controls)
   mcpEnabled: boolean     // MCP server is running
   // How / where this Radar binary is running. Optional on the wire so a
   // newer frontend (e.g. radar-hub-web bundling a fresher @skyhook-io/radar-app)
@@ -462,11 +472,63 @@ export interface SecretCertificateInfo {
   certificates: CertificateInfo[]
 }
 
+export type HPADiagnosisState =
+  | 'ok'
+  | 'scaling_up'
+  | 'scaling_down'
+  | 'limited_max'
+  | 'limited_min'
+  | 'metrics_unavailable'
+  | 'metrics_incomplete'
+  | 'unable_to_scale'
+  | 'disabled'
+  | 'pinned'
+  | 'stale'
+  | 'stabilized'
+  | 'unknown'
+
+export interface HPADiagnosis {
+  state: HPADiagnosisState
+  summary: string
+  target: {
+    apiVersion?: string
+    kind?: string
+    name?: string
+  }
+  bounds: {
+    min: number
+    max: number
+    current: number
+    desired: number
+    observedGeneration?: number
+    generation?: number
+  }
+  metrics?: HPAMetricSummary[]
+  reasons?: HPAReasonSummary[]
+}
+
+export interface HPAReasonSummary {
+  id: string
+  message: string
+  detail?: string
+  conditionType?: string
+  conditionReason?: string
+}
+
+export interface HPAMetricSummary {
+  type: string
+  name: string
+  current?: string
+  target?: string
+  status: string
+}
+
 // Resource with computed relationships and optional certificate info (API response wrapper)
 export interface ResourceWithRelationships<T = unknown> {
   resource: T
   relationships?: Relationships
   certificateInfo?: SecretCertificateInfo
+  hpaDiagnosis?: HPADiagnosis
 }
 
 // API Resource (from discovery endpoint)
@@ -937,11 +999,11 @@ export interface TrafficFilters {
   timeRange: string
 }
 
-// Main view type now includes 'traffic', 'cost', 'audit', 'gitops'.
+// Main view type now includes 'traffic', 'cost', 'checks', 'gitops'.
 // Library consumers (Radar Hub) get all GitOps surfaces — the package
 // IS the public surface, so adding new top-level views must extend
 // this type rather than rely on app-local extensions.
-export type ExtendedMainView = MainView | 'traffic' | 'cost' | 'audit' | 'gitops' | 'issues'
+export type ExtendedMainView = MainView | 'traffic' | 'cost' | 'checks' | 'gitops' | 'issues' | 'applications'
 
 // ============================================================================
 // Image Filesystem Types

package/src/utils/bulk-workload-actions.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest'
+import {
+  canBulkRestartKind,
+  canBulkScaleKind,
+  intersectWorkloadWrites,
+} from './bulk-workload-actions'
+import type { Capabilities, WorkloadWritePermissions } from '../types/core'
+
+const writes = (overrides: Partial<WorkloadWritePermissions> = {}): WorkloadWritePermissions => ({
+  deployments: false,
+  daemonSets: false,
+  statefulSets: false,
+  rollouts: false,
+  ...overrides,
+})
+
+const caps = (workloadWrites: WorkloadWritePermissions): Pick<Capabilities, 'workloadWrites'> => ({
+  workloadWrites,
+})
+
+describe('bulk workload action gating', () => {
+  it('allows restart for patchable workload kinds', () => {
+    const all = writes({ deployments: true, daemonSets: true, statefulSets: true, rollouts: true })
+
+    expect(canBulkRestartKind({ name: 'deployments', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'daemonsets', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'statefulsets', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'rollouts', group: 'argoproj.io' }, all)).toBe(true)
+  })
+
+  it('requires the apps group for built-in workload restart', () => {
+    const all = writes({ deployments: true, daemonSets: true, statefulSets: true })
+
+    expect(canBulkRestartKind({ name: 'deployments', group: 'apps' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'deployments', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'deployments' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'daemonsets', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'statefulsets', group: 'example.com' }, all)).toBe(false)
+  })
+
+  it('requires the Argo group for rollout restart', () => {
+    const all = writes({ rollouts: true })
+
+    expect(canBulkRestartKind({ name: 'rollouts', group: 'argoproj.io' }, all)).toBe(true)
+    expect(canBulkRestartKind({ name: 'rollouts', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkRestartKind({ name: 'rollouts' }, all)).toBe(false)
+  })
+
+  it('allows scale only for deployments and statefulsets', () => {
+    const all = writes({ deployments: true, daemonSets: true, statefulSets: true, rollouts: true })
+
+    expect(canBulkScaleKind({ name: 'deployments', group: 'apps' }, all)).toBe(true)
+    expect(canBulkScaleKind({ name: 'statefulsets', group: 'apps' }, all)).toBe(true)
+    expect(canBulkScaleKind({ name: 'daemonsets', group: 'apps' }, all)).toBe(false)
+    expect(canBulkScaleKind({ name: 'rollouts', group: 'argoproj.io' }, all)).toBe(false)
+    expect(canBulkScaleKind({ name: 'deployments', group: 'example.com' }, all)).toBe(false)
+    expect(canBulkScaleKind({ name: 'deployments' }, all)).toBe(false)
+  })
+
+  it('withholds actions when permissions are absent', () => {
+    expect(canBulkRestartKind({ name: 'deployments', group: 'apps' }, undefined)).toBe(false)
+    expect(canBulkScaleKind({ name: 'deployments', group: 'apps' }, undefined)).toBe(false)
+    expect(intersectWorkloadWrites(undefined)).toBeUndefined()
+    expect(intersectWorkloadWrites([])).toBeUndefined()
+  })
+
+  it('intersects multi-namespace permissions with AND semantics', () => {
+    expect(intersectWorkloadWrites([
+      caps(writes({ deployments: true, daemonSets: true, statefulSets: true, rollouts: true })),
+      caps(writes({ deployments: true, statefulSets: true })),
+    ])).toEqual({
+      deployments: true,
+      daemonSets: false,
+      statefulSets: true,
+      rollouts: false,
+    })
+  })
+})

package/src/utils/bulk-workload-actions.ts

@@ -0,0 +1,50 @@
+import type { Capabilities, WorkloadWritePermissions } from '../types/core'
+
+export type BulkWorkloadKindInfo = {
+  name: string
+  group?: string
+}
+
+export function canBulkRestartKind(
+  kind: BulkWorkloadKindInfo | null | undefined,
+  writes: WorkloadWritePermissions | undefined,
+): boolean {
+  switch (kind?.name.toLowerCase()) {
+    case 'deployments':
+      return kind.group === 'apps' && writes?.deployments === true
+    case 'daemonsets':
+      return kind.group === 'apps' && writes?.daemonSets === true
+    case 'statefulsets':
+      return kind.group === 'apps' && writes?.statefulSets === true
+    case 'rollouts':
+      return kind.group === 'argoproj.io' && writes?.rollouts === true
+    default:
+      return false
+  }
+}
+
+export function canBulkScaleKind(
+  kind: BulkWorkloadKindInfo | null | undefined,
+  writes: WorkloadWritePermissions | undefined,
+): boolean {
+  switch (kind?.name.toLowerCase()) {
+    case 'deployments':
+      return kind.group === 'apps' && writes?.deployments === true
+    case 'statefulsets':
+      return kind.group === 'apps' && writes?.statefulSets === true
+    default:
+      return false
+  }
+}
+
+export function intersectWorkloadWrites(
+  capabilities: Array<Pick<Capabilities, 'workloadWrites'>> | undefined,
+): WorkloadWritePermissions | undefined {
+  if (!capabilities || capabilities.length === 0) return undefined
+  return {
+    deployments: capabilities.every(c => c.workloadWrites?.deployments === true),
+    daemonSets: capabilities.every(c => c.workloadWrites?.daemonSets === true),
+    statefulSets: capabilities.every(c => c.workloadWrites?.statefulSets === true),
+    rollouts: capabilities.every(c => c.workloadWrites?.rollouts === true),
+  }
+}

package/src/utils/index.ts

@@ -22,3 +22,4 @@ export * from './rbac-badges'
 export * from './git-provider-urls'
 export * from './applications'
 export * from './topology-neighborhood'
+export * from './bulk-workload-actions'

package/src/utils/rbac-blast-radius.test.ts

@@ -35,15 +35,59 @@ describe('detectBlastRadius', () => {
     expect(reasons[0].reason).toMatch(/cluster-admin/)
   })
 
-  it('flags verb wildcards', () => {
+  it('flags an admin-shaped grant via ClusterRoleBinding', () => {
+    // apiGroups/resources/verbs all `*` bound cluster-wide is god-mode.
     const b = binding({
-      rules: [{ verbs: ['*'], resources: ['pods'], apiGroups: [''] }],
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'admin-crb', roleRef: { kind: 'ClusterRole', namespace: '', name: 'admin' } },
+      rules: [{ verbs: ['*'], resources: ['*'], apiGroups: ['*'] }],
     })
     const reasons = detectBlastRadius(subject([b]))
     expect(reasons).toHaveLength(1)
     expect(reasons[0].reason).toMatch(/verb wildcard/)
   })
 
+  it('does NOT flag the same admin-shaped grant via a namespace RoleBinding', () => {
+    // A RoleBinding is namespace-scoped by apiserver construction — even
+    // `*/*/*` is namespace-admin, not cluster takeover, so it stays collapsed.
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['*'], apiGroups: ['*'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
+  it('flags verb wildcards on a cluster-wide binding (incl. cluster-wide secrets)', () => {
+    // Cluster-wide `verbs:['*']` on secrets is read-every-secret takeover and
+    // MUST stay loud even though the resource is named, not `*`.
+    const b = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'cluster-b', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
+      rules: [{ verbs: ['*'], resources: ['secrets'], apiGroups: [''] }],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/verb wildcard/)
+  })
+
+  it("does NOT flag a verb wildcard scoped to one operator's own CRDs", () => {
+    // `verbs:['*']` confined to a specific apiGroup+resources in a single
+    // namespace (RoleBinding) is the routine operator-owns-its-CRDs grant —
+    // expanding the Permissions section on every such SA is the over-fire
+    // this exclusion fixes.
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['widgets'], apiGroups: ['acme.example.com'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
+  it('does NOT flag a namespace RoleBinding with resource-wildcard verb-wildcard over one group', () => {
+    // `verbs:['*']` over `resources:['*']` in one apiGroup, bound via a
+    // namespace RoleBinding, is namespace-scoped — broad within the namespace
+    // but not cluster takeover. Common operator shape; stays collapsed.
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['*'], apiGroups: ['acme.example.com'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
   it('flags escalation verbs', () => {
     const b = binding({
       rules: [{ verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] }],
@@ -89,8 +133,9 @@ describe('detectBlastRadius', () => {
 
   it('dedupes by binding identity when multiple risky rules match', () => {
     const b = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'cluster-b', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
       rules: [
-        { verbs: ['*'], resources: ['pods'], apiGroups: [''] },
+        { verbs: ['*'], resources: ['secrets'], apiGroups: [''] },
         { verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] },
       ],
     })

package/src/utils/rbac-blast-radius.ts

@@ -47,14 +47,19 @@ export interface BlastRadiusReason {
  *
  *   1. cluster-admin role-name match (covers the "bound my SA to cluster-admin
  *      for testing" pattern even when rules aren't loaded)
- *   2. verb wildcards (`*`)
+ *   2. verb wildcards (`*`) granted by a cluster-wide binding (ClusterRoleBinding)
  *   3. escalation verbs (`escalate` / `bind` / `impersonate`)
  *   4. cluster-wide `create pods` (lateral-movement vector)
  *
  * Resource-only wildcards (e.g. `view`'s fluxcd CRD coverage) deliberately
  * do NOT trigger — they fire on every authenticated SA and would train
- * operators to ignore the alarm. The current set is the calibrated minimum
- * for "the Pod's identity is genuinely god-mode".
+ * operators to ignore the alarm. A verb wildcard granted by a RoleBinding is
+ * likewise excluded — a RoleBinding is namespace-scoped by apiserver
+ * construction, so even `verbs:['*']` over `resources:['*']` across every
+ * apiGroup (namespace-admin) is not cluster takeover, and operators routinely
+ * hold broad wildcards over their own CRDs. Only a cluster-wide binding counts
+ * as genuine god-mode. The current set is the calibrated minimum for "the
+ * Pod's identity is genuinely god-mode".
  *
  * Dedupes by binding identity so a binding with multiple risky rules
  * counts once; first matching reason wins.
@@ -73,7 +78,12 @@ export function detectBlastRadius(rbacData: RBACSubjectResponse): BlastRadiusRea
     for (const r of br.rules ?? []) {
       const verbs = r.verbs ?? []
       const resources = r.resources ?? []
-      if (verbs.includes('*')) {
+      // A verb wildcard is only cluster takeover when the binding is itself
+      // cluster-wide. A RoleBinding is namespace-scoped by apiserver
+      // construction no matter how broad its rule (apiGroups/resources `*`
+      // included), so namespace-admin SAs stay collapsed; only
+      // ClusterRoleBindings count.
+      if (verbs.includes('*') && br.binding.kind === 'ClusterRoleBinding') {
         reasons.push({ binding: br, reason: 'grants verb wildcard (*) — every action on the listed resources' })
         break
       }

package/tsconfig.json

@@ -9,6 +9,7 @@
     "isolatedModules": true,
     "noEmit": true,
     "jsx": "react-jsx",
+    "types": ["node"],
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,