@skyhook-io/k8s-ui 1.7.15 → 1.8.0

package/src/types/core.ts

@@ -472,11 +472,63 @@ export interface SecretCertificateInfo {
   certificates: CertificateInfo[]
 }
 
+export type HPADiagnosisState =
+  | 'ok'
+  | 'scaling_up'
+  | 'scaling_down'
+  | 'limited_max'
+  | 'limited_min'
+  | 'metrics_unavailable'
+  | 'metrics_incomplete'
+  | 'unable_to_scale'
+  | 'disabled'
+  | 'pinned'
+  | 'stale'
+  | 'stabilized'
+  | 'unknown'
+
+export interface HPADiagnosis {
+  state: HPADiagnosisState
+  summary: string
+  target: {
+    apiVersion?: string
+    kind?: string
+    name?: string
+  }
+  bounds: {
+    min: number
+    max: number
+    current: number
+    desired: number
+    observedGeneration?: number
+    generation?: number
+  }
+  metrics?: HPAMetricSummary[]
+  reasons?: HPAReasonSummary[]
+}
+
+export interface HPAReasonSummary {
+  id: string
+  message: string
+  detail?: string
+  conditionType?: string
+  conditionReason?: string
+}
+
+export interface HPAMetricSummary {
+  type: string
+  name: string
+  current?: string
+  target?: string
+  status: string
+}
+
 // Resource with computed relationships and optional certificate info (API response wrapper)
 export interface ResourceWithRelationships<T = unknown> {
   resource: T
   relationships?: Relationships
   certificateInfo?: SecretCertificateInfo
+  hpaDiagnosis?: HPADiagnosis
 }
 
 // API Resource (from discovery endpoint)
@@ -947,11 +999,11 @@ export interface TrafficFilters {
   timeRange: string
 }
 
-// Main view type now includes 'traffic', 'cost', 'audit', 'gitops'.
+// Main view type now includes 'traffic', 'cost', 'checks', 'gitops'.
 // Library consumers (Radar Hub) get all GitOps surfaces — the package
 // IS the public surface, so adding new top-level views must extend
 // this type rather than rely on app-local extensions.
-export type ExtendedMainView = MainView | 'traffic' | 'cost' | 'audit' | 'gitops' | 'issues'
+export type ExtendedMainView = MainView | 'traffic' | 'cost' | 'checks' | 'gitops' | 'issues' | 'applications'
 
 // ============================================================================
 // Image Filesystem Types

package/src/utils/rbac-blast-radius.test.ts

@@ -35,15 +35,59 @@ describe('detectBlastRadius', () => {
     expect(reasons[0].reason).toMatch(/cluster-admin/)
   })
 
-  it('flags verb wildcards', () => {
+  it('flags an admin-shaped grant via ClusterRoleBinding', () => {
+    // apiGroups/resources/verbs all `*` bound cluster-wide is god-mode.
     const b = binding({
-      rules: [{ verbs: ['*'], resources: ['pods'], apiGroups: [''] }],
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'admin-crb', roleRef: { kind: 'ClusterRole', namespace: '', name: 'admin' } },
+      rules: [{ verbs: ['*'], resources: ['*'], apiGroups: ['*'] }],
     })
     const reasons = detectBlastRadius(subject([b]))
     expect(reasons).toHaveLength(1)
     expect(reasons[0].reason).toMatch(/verb wildcard/)
   })
 
+  it('does NOT flag the same admin-shaped grant via a namespace RoleBinding', () => {
+    // A RoleBinding is namespace-scoped by apiserver construction — even
+    // `*/*/*` is namespace-admin, not cluster takeover, so it stays collapsed.
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['*'], apiGroups: ['*'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
+  it('flags verb wildcards on a cluster-wide binding (incl. cluster-wide secrets)', () => {
+    // Cluster-wide `verbs:['*']` on secrets is read-every-secret takeover and
+    // MUST stay loud even though the resource is named, not `*`.
+    const b = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'cluster-b', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
+      rules: [{ verbs: ['*'], resources: ['secrets'], apiGroups: [''] }],
+    })
+    const reasons = detectBlastRadius(subject([b]))
+    expect(reasons).toHaveLength(1)
+    expect(reasons[0].reason).toMatch(/verb wildcard/)
+  })
+
+  it("does NOT flag a verb wildcard scoped to one operator's own CRDs", () => {
+    // `verbs:['*']` confined to a specific apiGroup+resources in a single
+    // namespace (RoleBinding) is the routine operator-owns-its-CRDs grant —
+    // expanding the Permissions section on every such SA is the over-fire
+    // this exclusion fixes.
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['widgets'], apiGroups: ['acme.example.com'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
+  it('does NOT flag a namespace RoleBinding with resource-wildcard verb-wildcard over one group', () => {
+    // `verbs:['*']` over `resources:['*']` in one apiGroup, bound via a
+    // namespace RoleBinding, is namespace-scoped — broad within the namespace
+    // but not cluster takeover. Common operator shape; stays collapsed.
+    const b = binding({
+      rules: [{ verbs: ['*'], resources: ['*'], apiGroups: ['acme.example.com'] }],
+    })
+    expect(detectBlastRadius(subject([b]))).toHaveLength(0)
+  })
+
   it('flags escalation verbs', () => {
     const b = binding({
       rules: [{ verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] }],
@@ -89,8 +133,9 @@ describe('detectBlastRadius', () => {
 
   it('dedupes by binding identity when multiple risky rules match', () => {
     const b = binding({
+      binding: { kind: 'ClusterRoleBinding', namespace: '', name: 'cluster-b', roleRef: { kind: 'ClusterRole', namespace: '', name: 'r' } },
       rules: [
-        { verbs: ['*'], resources: ['pods'], apiGroups: [''] },
+        { verbs: ['*'], resources: ['secrets'], apiGroups: [''] },
         { verbs: ['escalate'], resources: ['roles'], apiGroups: ['rbac.authorization.k8s.io'] },
       ],
     })

package/src/utils/rbac-blast-radius.ts

@@ -47,14 +47,19 @@ export interface BlastRadiusReason {
  *
  *   1. cluster-admin role-name match (covers the "bound my SA to cluster-admin
  *      for testing" pattern even when rules aren't loaded)
- *   2. verb wildcards (`*`)
+ *   2. verb wildcards (`*`) granted by a cluster-wide binding (ClusterRoleBinding)
  *   3. escalation verbs (`escalate` / `bind` / `impersonate`)
  *   4. cluster-wide `create pods` (lateral-movement vector)
  *
  * Resource-only wildcards (e.g. `view`'s fluxcd CRD coverage) deliberately
  * do NOT trigger — they fire on every authenticated SA and would train
- * operators to ignore the alarm. The current set is the calibrated minimum
- * for "the Pod's identity is genuinely god-mode".
+ * operators to ignore the alarm. A verb wildcard granted by a RoleBinding is
+ * likewise excluded — a RoleBinding is namespace-scoped by apiserver
+ * construction, so even `verbs:['*']` over `resources:['*']` across every
+ * apiGroup (namespace-admin) is not cluster takeover, and operators routinely
+ * hold broad wildcards over their own CRDs. Only a cluster-wide binding counts
+ * as genuine god-mode. The current set is the calibrated minimum for "the
+ * Pod's identity is genuinely god-mode".
  *
  * Dedupes by binding identity so a binding with multiple risky rules
  * counts once; first matching reason wins.
@@ -73,7 +78,12 @@ export function detectBlastRadius(rbacData: RBACSubjectResponse): BlastRadiusRea
     for (const r of br.rules ?? []) {
       const verbs = r.verbs ?? []
       const resources = r.resources ?? []
-      if (verbs.includes('*')) {
+      // A verb wildcard is only cluster takeover when the binding is itself
+      // cluster-wide. A RoleBinding is namespace-scoped by apiserver
+      // construction no matter how broad its rule (apiGroups/resources `*`
+      // included), so namespace-admin SAs stay collapsed; only
+      // ClusterRoleBindings count.
+      if (verbs.includes('*') && br.binding.kind === 'ClusterRoleBinding') {
         reasons.push({ binding: br, reason: 'grants verb wildcard (*) — every action on the listed resources' })
         break
       }

package/tsconfig.json

@@ -9,6 +9,7 @@
     "isolatedModules": true,
     "noEmit": true,
     "jsx": "react-jsx",
+    "types": ["node"],
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,