@skyhook-io/k8s-ui 1.8.10 → 1.8.12

package/src/utils/application-topology.ts

@@ -0,0 +1,261 @@
+import type { GitOpsResourceTree, HealthStatus, HelmOwnedResource, Topology, TopologyNode } from '../types'
+import { apiVersionToGroup, groupQualifiesLaneId } from './navigation'
+import { pluralize } from './pluralize'
+
+export type DeploymentMembership = 'runtime-only' | 'source-only'
+
+export interface DeploymentInventoryNode {
+  id: string
+  kind: string
+  group?: string
+  namespace: string
+  name: string
+  role: 'declared' | 'generated'
+  status?: HealthStatus
+}
+
+export interface DeploymentInventory {
+  nodes: DeploymentInventoryNode[]
+  warnings?: string[]
+  complete?: boolean
+}
+
+export interface DeploymentTopologyLayer {
+  topology: Topology
+  managedRuntimeCount: number
+  runtimeOnlyCount: number
+  managedOnly: DeploymentInventoryNode[]
+  managedOnlySummary?: string
+  inventoryComplete: boolean
+}
+
+export function collapseStableReplicaSets(topology: Topology, expandedOwners: ReadonlySet<string>): Topology {
+  const nodesByID = new Map(topology.nodes.map((node) => [node.id, node]))
+  const replicaSetsByOwner = new Map<string, string[]>()
+  for (const edge of topology.edges) {
+    if (edge.type !== 'manages' || nodesByID.get(edge.target)?.kind !== 'ReplicaSet') continue
+    replicaSetsByOwner.set(edge.source, [...(replicaSetsByOwner.get(edge.source) ?? []), edge.target])
+  }
+
+  const collapsedReplicaSets = new Set<string>()
+  const rewiredEdges = [] as Topology['edges']
+  const parentData = new Map<string, Record<string, unknown>>()
+
+  for (const [ownerID, replicaSetIDs] of replicaSetsByOwner) {
+    const owner = nodesByID.get(ownerID)
+    const replicaSet = replicaSetIDs.length === 1 ? nodesByID.get(replicaSetIDs[0]) : undefined
+    const ready = Number(replicaSet?.data?.readyReplicas ?? 0)
+    const total = Number(replicaSet?.data?.totalReplicas ?? 0)
+    const incoming = topology.edges.filter((edge) => edge.target === replicaSet?.id)
+    const stable = owner?.status === 'healthy'
+      && replicaSet?.status === 'healthy'
+      && total > 0
+      && ready >= total
+      && incoming.every((edge) => edge.source === ownerID && edge.type === 'manages')
+    const shouldCollapse = replicaSetIDs.length === 1 && stable && !expandedOwners.has(ownerID)
+    parentData.set(ownerID, {
+      replicaSetCount: replicaSetIDs.length,
+      replicaSetsCollapsed: shouldCollapse,
+      replicaSetsExpandable: stable && replicaSetIDs.length === 1,
+    })
+    if (shouldCollapse && replicaSet) collapsedReplicaSets.add(replicaSet.id)
+  }
+
+  for (const edge of topology.edges) {
+    if (collapsedReplicaSets.has(edge.target)) continue
+    if (!collapsedReplicaSets.has(edge.source)) {
+      rewiredEdges.push(edge)
+      continue
+    }
+    const ownerEdge = topology.edges.find((candidate) => candidate.target === edge.source && candidate.type === 'manages')
+    if (!ownerEdge) continue
+    rewiredEdges.push({
+      ...edge,
+      id: `${ownerEdge.source}-to-${edge.target}`,
+      source: ownerEdge.source,
+      type: 'manages',
+    })
+  }
+
+  return {
+    ...topology,
+    nodes: topology.nodes
+      .filter((node) => !collapsedReplicaSets.has(node.id))
+      .map((node) => parentData.has(node.id) ? { ...node, data: { ...node.data, ...parentData.get(node.id) } } : node),
+    edges: rewiredEdges,
+  }
+}
+
+const GENERATED_RUNTIME_KINDS = new Set(['pod', 'podgroup', 'replicaset'])
+const MAX_INDIVIDUAL_SOURCE_ONLY_RESOURCES = 12
+
+function identityKey(kind: string, group: string | undefined, namespace: string, name: string): string {
+  const identityGroup = groupQualifiesLaneId(group) ? group!.toLowerCase() : ''
+  return `${identityGroup}/${kind.toLowerCase()}/${namespace}/${name}`
+}
+
+export function topologyGroup(node: TopologyNode): string | undefined {
+  return apiVersionToGroup(node.data?.apiVersion as string | undefined) || (node.data?.sourceGroup as string | undefined)
+}
+
+export function deploymentInventoryFromGitOps(tree: GitOpsResourceTree | undefined): DeploymentInventory | undefined {
+  if (!tree) return undefined
+  return {
+    nodes: tree.nodes
+      .filter((node) => node.role === 'declared' || node.role === 'generated')
+      .map((node) => ({
+        id: node.id,
+        kind: node.ref.kind,
+        group: node.ref.group,
+        namespace: node.ref.namespace,
+        name: node.ref.name,
+        role: node.role as 'declared' | 'generated',
+        status: node.topologyStatus,
+      })),
+    warnings: tree.warnings,
+  }
+}
+
+export function deploymentInventoryFromHelm(resources: HelmOwnedResource[] | undefined): DeploymentInventory | undefined {
+  if (!resources) return undefined
+  return {
+    complete: false,
+    nodes: resources.map((resource) => ({
+      id: `helm/${resource.kind.toLowerCase()}/${resource.namespace}/${resource.name}`,
+      kind: resource.kind,
+      group: apiVersionToGroup(resource.apiVersion),
+      namespace: resource.namespace,
+      name: resource.name,
+      role: 'declared',
+      status: helmResourceStatus(resource.status),
+    })),
+  }
+}
+
+function helmResourceStatus(status: string | undefined): HealthStatus {
+  const normalized = status?.toLowerCase() ?? ''
+  if (['running', 'active', 'ready', 'succeeded', 'completed', 'bound'].includes(normalized)) return 'healthy'
+  if (['failed', 'error', 'unhealthy'].includes(normalized)) return 'unhealthy'
+  if (['pending', 'degraded'].includes(normalized)) return 'degraded'
+  return 'unknown'
+}
+
+export function layerDeploymentInventory(
+  topology: Topology,
+  inventory: DeploymentInventory,
+  sourceLabel: string,
+): DeploymentTopologyLayer {
+  const inventoryByExact = new Map(inventory.nodes.map((node) => [
+    identityKey(node.kind, node.group, node.namespace, node.name),
+    node,
+  ]))
+  const matchedInventoryIds = new Set<string>()
+  let managedRuntimeCount = 0
+  let runtimeOnlyCount = 0
+  const inventoryComplete = inventory.complete !== false && (inventory.warnings?.length ?? 0) === 0
+
+  const runtimeNodes = topology.nodes.map((node) => {
+    if (node.kind === 'PodGroup' || node.kind === 'Internet') return node
+    const namespace = (node.data?.namespace as string) || ''
+    const match = inventoryByExact.get(identityKey(node.kind, topologyGroup(node), namespace, node.name))
+    if (match) {
+      matchedInventoryIds.add(match.id)
+      managedRuntimeCount += 1
+      return node
+    }
+    if (!inventoryComplete || GENERATED_RUNTIME_KINDS.has(node.kind.toLowerCase())) return node
+    runtimeOnlyCount += 1
+    return {
+      ...node,
+      data: {
+        ...node.data,
+        deploymentMembership: 'runtime-only' satisfies DeploymentMembership,
+        deploymentSourceLabel: sourceLabel,
+      },
+    }
+  })
+
+  const managedOnly = inventory.nodes.filter((node) => node.role === 'declared' && !matchedInventoryIds.has(node.id))
+  const managedOnlySummary = managedOnly.length > MAX_INDIVIDUAL_SOURCE_ONLY_RESOURCES
+    ? summarizeInventory(managedOnly)
+    : undefined
+  const sourceOnlyNodes = managedOnlySummary
+    ? []
+    : groupedSourceOnlyNodes(managedOnly, sourceLabel)
+
+  return {
+    topology: { ...topology, nodes: [...runtimeNodes, ...sourceOnlyNodes] },
+    managedRuntimeCount,
+    runtimeOnlyCount,
+    managedOnly,
+    managedOnlySummary,
+    inventoryComplete,
+  }
+}
+
+function groupedSourceOnlyNodes(nodes: DeploymentInventoryNode[], sourceLabel: string): TopologyNode[] {
+  const groups = new Map<string, DeploymentInventoryNode[]>()
+  for (const node of nodes) {
+    const key = `${node.group ?? ''}/${node.kind}/${node.namespace}`
+    groups.set(key, [...(groups.get(key) ?? []), node])
+  }
+
+  const result: TopologyNode[] = []
+  for (const [groupKey, group] of groups) {
+    if (group.length <= 3) {
+      result.push(...group.map((node) => sourceOnlyNode(node, sourceLabel)))
+      continue
+    }
+    const representative = group[0]
+    result.push({
+      id: `source-group/${groupKey}`,
+      kind: representative.kind,
+      name: pluralize(group.length, representative.kind),
+      status: worstTopologyStatus(group.map((node) => node.status)),
+      data: {
+        namespace: representative.namespace,
+        sourceGroup: representative.group,
+        sourceInventoryGroup: true,
+        sourceInventoryCount: group.length,
+        deploymentMembership: 'source-only' satisfies DeploymentMembership,
+        deploymentSourceLabel: sourceLabel,
+      },
+    })
+  }
+  return result
+}
+
+function summarizeInventory(nodes: DeploymentInventoryNode[]): string {
+  const counts = new Map<string, number>()
+  for (const node of nodes) counts.set(node.kind, (counts.get(node.kind) ?? 0) + 1)
+  const leadingKinds = [...counts.entries()]
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .slice(0, 2)
+  const summarizedCount = leadingKinds.reduce((total, [, count]) => total + count, 0)
+  const summary = [
+    ...leadingKinds.map(([kind, count]) => pluralize(count, kind)),
+    ...(nodes.length > summarizedCount ? [`${nodes.length - summarizedCount} more`] : []),
+  ].join(' · ')
+
+  return summary
+}
+
+function sourceOnlyNode(node: DeploymentInventoryNode, sourceLabel: string): TopologyNode {
+  return {
+    id: `source/${node.id}`,
+    kind: node.kind,
+    name: node.name,
+    status: node.status ?? 'unknown',
+    data: {
+      namespace: node.namespace,
+      sourceGroup: node.group,
+      deploymentMembership: 'source-only' satisfies DeploymentMembership,
+      deploymentSourceLabel: sourceLabel,
+    },
+  }
+}
+
+function worstTopologyStatus(statuses: Array<HealthStatus | undefined>): HealthStatus {
+  const rank: Record<HealthStatus, number> = { unknown: 0, neutral: 1, healthy: 2, degraded: 3, unhealthy: 4 }
+  return statuses.reduce<HealthStatus>((worst, status) => status && rank[status] > rank[worst] ? status : worst, 'unknown')
+}

package/src/utils/applications.test.ts

@@ -1,5 +1,47 @@
 import { describe, it, expect } from 'vitest'
-import { compareVersions, appGroupingExplainer, APP_IDENTITY_ANNOTATION, appGroupLagMessage, matchWorkloadAcrossInstances, foldAppGroups, identityEnvInferred, worstHealth, type AppGroupFoldEntry } from './applications'
+import { compareVersions, appGroupingExplainer, APP_IDENTITY_ANNOTATION, appGroupLagMessage, matchWorkloadAcrossInstances, foldAppGroups, identityEnvInferred, worstHealth, buildAppMembershipIndex, batchActivityForApp, batchRuntimeForApp, servingReadiness, type AppGroupFoldEntry, type AppRow, type AppWorkload } from './applications'
+
+describe('batch application runtime', () => {
+  it('uses the latest retained outcome instead of historical failure count', () => {
+    const app: AppRow = {
+      key: 'batch', name: 'batch', health: 'unhealthy', workload_class: 'job',
+      workloads: [{
+        kind: 'CronJob', namespace: 'demo', name: 'nightly', workload_class: 'job', health: 'unhealthy', ready: 0, desired: 0, restarts: 0,
+        batch: { retainedRuns: 4, failedRuns: 1, succeededRuns: 3, latestRunName: 'nightly-new', latestRunPhase: 'Succeeded', latestFinishedAt: '2026-07-10T00:00:00Z' },
+      }],
+    }
+    expect(batchRuntimeForApp(app)).toMatchObject({ label: 'Succeeded', health: 'healthy' })
+  })
+
+  it('does not let one workload success mask another workload latest failure', () => {
+    const app: AppRow = {
+      key: 'batch', name: 'batch', health: 'healthy', workload_class: 'job',
+      workloads: [
+        {
+          kind: 'CronJob', namespace: 'demo', name: 'nightly', workload_class: 'job', health: 'healthy', ready: 0, desired: 0, restarts: 0,
+          batch: { retainedRuns: 1, succeededRuns: 1, latestRunName: 'nightly-new', latestRunPhase: 'Succeeded', latestFinishedAt: '2026-07-10T01:00:00Z' },
+        },
+        {
+          kind: 'CronWorkflow', namespace: 'demo', name: 'sync', workload_class: 'job', health: 'unhealthy', ready: 0, desired: 0, restarts: 0,
+          batch: { retainedRuns: 1, failedRuns: 1, latestRunName: 'sync-old', latestRunPhase: 'Failed', latestFinishedAt: '2026-07-10T00:00:00Z' },
+        },
+      ],
+    }
+
+    expect(batchRuntimeForApp(app)).toEqual({
+      label: 'Failed',
+      health: 'unhealthy',
+      detail: 'CronWorkflow/sync latest retained run sync-old failed.',
+    })
+  })
+
+  it('excludes batch workloads from serving readiness', () => {
+    expect(servingReadiness([
+      { kind: 'Deployment', namespace: 'demo', name: 'api', workload_class: 'service', health: 'healthy', ready: 2, desired: 3, restarts: 0 },
+      { kind: 'Job', namespace: 'demo', name: 'run', workload_class: 'job', health: 'healthy', ready: 1, desired: 1, restarts: 0, batch: { retainedRuns: 1 } },
+    ])).toEqual({ ready: 2, desired: 3 })
+  })
+})
 
 describe('compareVersions', () => {
   it('orders semver', () => {
@@ -87,6 +129,46 @@ describe('identityEnvInferred', () => {
   })
 })
 
+describe('batchActivityForApp', () => {
+  const workload = (kind: string, name: string, batch?: AppWorkload['batch']): AppWorkload => ({
+    kind,
+    namespace: 'prod',
+    name,
+    health: 'neutral',
+    ready: 0,
+    desired: 0,
+    restarts: 0,
+    workload_class: kind === 'Deployment' ? 'service' : 'job',
+    batch,
+  })
+  const app = (workloads: AppWorkload[]): AppRow => ({
+    key: 'billing',
+    name: 'billing',
+    health: 'neutral',
+    workloads,
+  })
+
+  it('ranks failed, active, suspended, and quiet batch workloads without inventing retained history', () => {
+    const activity = batchActivityForApp(app([
+      workload('Deployment', 'api'),
+      workload('CronJob', 'nightly-success', { retainedRuns: 2, latestRunPhase: 'Succeeded', latestRunName: 'nightly-success-1' }),
+      workload('CronWorkflow', 'hourly-suspended', { suspended: true, retainedRuns: 0, schedule: '0 * * * *' }),
+      workload('Job', 'active-reindex', { activeRuns: 1, retainedRuns: 1, latestRunPhase: 'Running' }),
+      workload('Workflow', 'failed-migration', { failedRuns: 1, retainedRuns: 1, latestRunPhase: 'Failed', latestRunName: 'failed-migration', message: 'pod crashed' }),
+    ]))
+
+    expect(activity.map((item) => item.workload.name)).toEqual([
+      'failed-migration',
+      'active-reindex',
+      'hourly-suspended',
+      'nightly-success',
+    ])
+    expect(activity[0]).toMatchObject({ tone: 'rose', label: 'Latest run failed', failedRuns: 1, detail: 'pod crashed' })
+    expect(activity[1]).toMatchObject({ tone: 'sky', label: '1 active run', activeRuns: 1 })
+    expect(activity[3]).toMatchObject({ tone: 'muted', label: 'Latest run succeeded', retainedRuns: 2 })
+  })
+})
+
 // Position-preserving env switch: exact match, stem fallback (suffix, prefix,
 // discovered tokens), and the explicit no-counterpart null.
 describe('matchWorkloadAcrossInstances', () => {
@@ -296,3 +378,121 @@ describe('foldAppGroups pathKey disambiguation', () => {
     expect(rows.filter((r) => r.kind === 'instance').length).toBe(2)
   })
 })
+
+describe('buildAppMembershipIndex', () => {
+  // Minimal AppRow builder — only the fields the index reads.
+  const row = (over: Partial<AppRow>): AppRow => ({
+    key: 'k', name: 'app', health: 'healthy', workloads: [], ...over,
+  })
+
+  it('indexes workloads by Kind/ns/name and satellites by the app namespace', () => {
+    const idx = buildAppMembershipIndex([
+      row({
+        key: 'team-a/app/billing', name: 'billing', namespace: 'team-a',
+        workloads: [{ kind: 'Deployment', namespace: 'team-a', name: 'billing-api', health: 'healthy', ready: 1, desired: 1, restarts: 0 }],
+        relationships: { services: ['billing-svc'], ingresses: ['billing-ing'] },
+      }),
+    ])
+    expect(idx.byResource.get('Deployment/team-a/billing-api')?.appName).toBe('billing')
+    expect(idx.byResource.get('Service/team-a/billing-svc')?.appName).toBe('billing')
+    expect(idx.byResource.get('Ingress/team-a/billing-ing')?.appName).toBe('billing')
+  })
+
+  it('indexes routes under their concrete kind, not a generic "Route"', () => {
+    // The server ships "Kind/name" for polymorphic routes; the index must key on
+    // the concrete kind so it matches the route lane id (HTTPRoute/…/name).
+    const idx = buildAppMembershipIndex([
+      row({
+        key: 'team-a/app/web', name: 'web', namespace: 'team-a',
+        relationships: { routes: ['HTTPRoute/web-http', 'GRPCRoute/web-grpc'] },
+      }),
+    ])
+    expect(idx.byResource.get('HTTPRoute/team-a/web-http')?.appName).toBe('web')
+    expect(idx.byResource.get('GRPCRoute/team-a/web-grpc')?.appName).toBe('web')
+    expect(idx.byResource.has('Route/team-a/HTTPRoute/web-http')).toBe(false)
+  })
+
+  it('indexes explicit relationship refs across namespaces', () => {
+    const idx = buildAppMembershipIndex([
+      row({
+        key: 'team-a/app/billing', name: 'billing', namespaces: ['team-a', 'shared'],
+        relationships: {
+          serviceRefs: [{ kind: 'Service', namespace: 'team-a', name: 'billing-api' }],
+          configRefs: [{ kind: 'ConfigMap', namespace: 'shared', name: 'billing-config' }],
+          storageRefs: [{ kind: 'PersistentVolumeClaim', namespace: 'team-a', name: 'billing-data' }],
+        },
+      }),
+    ])
+
+    expect(idx.byResource.get('Service/team-a/billing-api')?.appName).toBe('billing')
+    expect(idx.byResource.get('ConfigMap/shared/billing-config')?.appName).toBe('billing')
+    expect(idx.byResource.get('PersistentVolumeClaim/team-a/billing-data')?.appName).toBe('billing')
+  })
+
+  it('indexes the exact deployment source object', () => {
+    const idx = buildAppMembershipIndex([
+      row({
+        key: 'team-a/app/billing', name: 'billing',
+        sourceRef: {
+          type: 'gitops',
+          tool: 'argocd',
+          kind: 'Application',
+          namespace: 'argocd',
+          name: 'billing',
+        },
+      }),
+    ])
+
+    expect(idx.byResource.get('Application/argocd/billing')?.appName).toBe('billing')
+  })
+
+  it('skips satellites for a multi-namespace app (can not place them unambiguously)', () => {
+    const idx = buildAppMembershipIndex([
+      row({
+        key: 'a', name: 'span', namespaces: ['team-a', 'team-b'],
+        workloads: [{ kind: 'Deployment', namespace: 'team-a', name: 'api', health: 'healthy', ready: 1, desired: 1, restarts: 0 }],
+        relationships: { services: ['svc'] },
+      }),
+    ])
+    expect(idx.byResource.has('Deployment/team-a/api')).toBe(true)
+    expect([...idx.byResource.keys()].some((k) => k.startsWith('Service/'))).toBe(false)
+  })
+
+  it('indexes matchKeys by evidence but excludes name-stem (exact kinds only in v1)', () => {
+    // matchKeys are namespace-scoped (kind:namespace:value); name-stem stays unscoped.
+    const idx = buildAppMembershipIndex([
+      row({ key: 'a', name: 'billing', identity: { key: 'billing', env: 'prod', confidence: 'high', evidence: 'x' }, matchKeys: ['instance:team-a:billing-prod', 'helm:team-a:billing-v2', 'name-stem:billing'] }),
+    ])
+    expect(idx.byEvidence.get('instance:team-a:billing-prod')?.appName).toBe('billing')
+    expect(idx.byEvidence.get('helm:team-a:billing-v2')?.appName).toBe('billing')
+    expect(idx.byEvidence.has('name-stem:billing')).toBe(false)
+  })
+
+  it('carries env + evidence onto the membership', () => {
+    const idx = buildAppMembershipIndex([
+      row({ key: 'a', name: 'billing', identity: { key: 'billing', env: 'prod', confidence: 'high', evidence: 'name stem billing' }, matchKeys: ['name:team-a:billing'] }),
+    ])
+    const m = idx.byEvidence.get('name:team-a:billing')
+    expect(m?.env).toBe('prod')
+    expect(m?.evidence).toBe('name stem billing')
+  })
+
+  it('collision resolves first-wins (server-sorted row order)', () => {
+    const idx = buildAppMembershipIndex([
+      row({ key: 'first', name: 'first', matchKeys: ['name:team-a:shared'] }),
+      row({ key: 'second', name: 'second', matchKeys: ['name:team-a:shared'] }),
+    ])
+    expect(idx.byEvidence.get('name:team-a:shared')?.appName).toBe('first')
+  })
+
+  it('same label value in two namespaces indexes as distinct evidence keys', () => {
+    // The whole point of namespace scoping: "shared" in team-a and team-b must
+    // NOT collapse to one key — each namespace maps to its own app.
+    const idx = buildAppMembershipIndex([
+      row({ key: 'a', name: 'app-a', matchKeys: ['instance:team-a:shared'] }),
+      row({ key: 'b', name: 'app-b', matchKeys: ['instance:team-b:shared'] }),
+    ])
+    expect(idx.byEvidence.get('instance:team-a:shared')?.appName).toBe('app-a')
+    expect(idx.byEvidence.get('instance:team-b:shared')?.appName).toBe('app-b')
+  })
+})