@skyhook-io/k8s-ui 1.8.4 → 1.8.6

package/src/components/resources/renderers/TraefikMiddlewareRenderer.tsx

@@ -0,0 +1,185 @@
+import { SlidersHorizontal, Layers, ShieldCheck } from 'lucide-react'
+import { Section, PropertyList, Property, AlertBanner, ResourceLink } from '../../ui/drawer-components'
+import { Badge } from '../../ui/Badge'
+import { getMiddlewareType } from '../resource-utils-traefik'
+
+interface TraefikMiddlewareRendererProps {
+  data: any
+  onNavigate?: (ref: { kind: string; namespace: string; name: string }) => void
+}
+
+// Keys whose value is inline credential MATERIAL — redacted in the generic
+// config view. Mirrors the backend's value-key set (pkg/ai/context/redact.go)
+// plus `users` (basicAuth htpasswd). Deliberately excludes reference keys like
+// `secret`/`secretName` (the NAME of a Secret, which is safe and useful to show).
+const SECRET_VALUE_KEYS = new Set([
+  'password', 'passwd', 'passphrase', 'token', 'clientsecret', 'privatekey',
+  'apikey', 'apitoken', 'accesstoken', 'sessiontoken', 'secretaccesskey',
+  'secretkey', 'authtoken', 'bearertoken', 'users',
+])
+
+function isSecretKey(key: string): boolean {
+  return SECRET_VALUE_KEYS.has(key.toLowerCase().replace(/[-_]/g, ''))
+}
+
+function formatScalar(v: any): string {
+  if (Array.isArray(v)) return v.length === 0 ? '[]' : v.join(', ')
+  if (typeof v === 'object' && v !== null) return JSON.stringify(v)
+  return String(v)
+}
+
+// Deep-redact: replace any credential-keyed value with "(hidden)" at EVERY
+// depth, so a secret under e.g. plugin.config.clientSecret can't survive a
+// later JSON.stringify of a nested object. Non-secret values are kept — the
+// drawer is not a secrecy boundary (the YAML tab shows the full spec the user
+// already has RBAC to read); hiding only credential KEYS keeps the generic
+// config legible for unknown/plugin middleware types.
+function redactConfig(v: any): any {
+  if (Array.isArray(v)) return v.map(redactConfig)
+  if (v && typeof v === 'object') {
+    const out: Record<string, any> = {}
+    for (const [k, val] of Object.entries(v)) {
+      out[k] = isSecretKey(k) ? '(hidden)' : redactConfig(val)
+    }
+    return out
+  }
+  return v
+}
+
+// Renders a middleware config object as a property list, collapsing nested
+// objects/arrays to a compact one-line summary. Credential keys are redacted
+// at every depth (redactConfig) before rendering.
+function ConfigProperties({ config }: { config: Record<string, any> }) {
+  const safe = redactConfig(config) as Record<string, any>
+  const entries = Object.entries(safe)
+  if (entries.length === 0) {
+    return <Property label="Config" value="(empty)" />
+  }
+  return (
+    <>
+      {entries.map(([key, value]) => {
+        if (Array.isArray(value)) {
+          return <Property key={key} label={key} value={value.length === 0 ? '[]' : value.map(formatScalar).join(', ')} />
+        }
+        if (typeof value === 'object' && value !== null) {
+          const inner = Object.entries(value)
+            .map(([k, v]) => `${k}: ${formatScalar(v)}`)
+            .join('  ·  ')
+          return <Property key={key} label={key} value={inner || '{}'} />
+        }
+        return <Property key={key} label={key} value={formatScalar(value)} />
+      })}
+    </>
+  )
+}
+
+export function TraefikMiddlewareRenderer({ data, onNavigate }: TraefikMiddlewareRendererProps) {
+  const spec = data.spec || {}
+  const type = getMiddlewareType(data)
+  const ns = data.metadata?.namespace || ''
+  const kindLabel = data.kind || 'Middleware'
+  // A middleware spec carries exactly one top-level key (its type). For known
+  // types that's `type`; for unrecognized ones fall back to whatever key the
+  // spec actually has, so the generic config section isn't rendered empty.
+  const typeKey = type === 'unknown' ? Object.keys(spec)[0] : type
+  const config = (typeKey && spec[typeKey]) || {}
+
+  const isChain = type === 'chain'
+  // A MiddlewareTCP chain references MiddlewareTCP members, not Middleware.
+  const chainMemberKind = data.kind === 'MiddlewareTCP' ? 'middlewaretcps' : 'middlewares'
+  const isAuth = type === 'basicAuth' || type === 'digestAuth'
+  const isForwardAuth = type === 'forwardAuth'
+  const isErrors = type === 'errors'
+
+  return (
+    <>
+      {type === 'unknown' && (
+        <AlertBanner
+          variant="info"
+          title="Unrecognized middleware type"
+          message="This middleware uses a type Radar doesn't render specially (e.g. a plugin or a newer/commercial middleware). The raw configuration is shown below."
+        />
+      )}
+
+      <Section title={kindLabel} icon={SlidersHorizontal} defaultExpanded>
+        <PropertyList>
+          <Property label="Type" value={type === 'unknown' ? Object.keys(spec)[0] || 'unknown' : type} />
+        </PropertyList>
+      </Section>
+
+      {isChain ? (
+        <Section title="Chain" icon={Layers} defaultExpanded>
+          <div className="space-y-1">
+            {(config.middlewares || []).map((m: any, i: number) => (
+              <div key={i} className="flex items-center gap-2 text-xs">
+                <span className="text-theme-text-tertiary w-4 text-right">{i + 1}.</span>
+                <ResourceLink
+                  name={m.name}
+                  kind={chainMemberKind}
+                  namespace={m.namespace || ns}
+                  onNavigate={onNavigate}
+                />
+                {m.namespace && m.namespace !== ns && (
+                  <Badge tone="note" size="sm">{m.namespace}</Badge>
+                )}
+              </div>
+            ))}
+            {(config.middlewares || []).length === 0 && (
+              <span className="text-xs text-theme-text-tertiary">No middlewares in chain</span>
+            )}
+          </div>
+        </Section>
+      ) : isAuth ? (
+        <Section title="Authentication" icon={ShieldCheck} defaultExpanded>
+          <PropertyList>
+            {config.secret && (
+              <Property label="Secret" value={
+                <ResourceLink name={config.secret} kind="secrets" namespace={ns} onNavigate={onNavigate} />
+              } />
+            )}
+            {Array.isArray(config.users) && (
+              <Property label="Inline users" value={<span className="text-theme-text-tertiary italic">{config.users.length} — hidden</span>} />
+            )}
+            {config.usersFile && <Property label="Users file" value={config.usersFile} />}
+            {config.realm && <Property label="Realm" value={config.realm} />}
+            {config.removeHeader !== undefined && <Property label="Remove header" value={String(config.removeHeader)} />}
+          </PropertyList>
+        </Section>
+      ) : isForwardAuth ? (
+        <Section title="Forward Auth" icon={ShieldCheck} defaultExpanded>
+          <PropertyList>
+            {config.address && <Property label="Address" value={config.address} />}
+            {config.trustForwardHeader !== undefined && <Property label="Trust forward header" value={String(config.trustForwardHeader)} />}
+            {Array.isArray(config.authResponseHeaders) && config.authResponseHeaders.length > 0 && (
+              <Property label="Auth response headers" value={config.authResponseHeaders.join(', ')} />
+            )}
+            {config.authResponseHeadersRegex && <Property label="Headers regex" value={config.authResponseHeadersRegex} />}
+            {config.tls?.caSecret && (
+              <Property label="CA secret" value={
+                <ResourceLink name={config.tls.caSecret} kind="secrets" namespace={ns} onNavigate={onNavigate} />
+              } />
+            )}
+          </PropertyList>
+        </Section>
+      ) : isErrors ? (
+        <Section title="Errors" defaultExpanded>
+          <PropertyList>
+            {config.status && <Property label="Status" value={Array.isArray(config.status) ? config.status.join(', ') : String(config.status)} />}
+            {config.service?.name && (
+              <Property label="Service" value={
+                <ResourceLink name={config.service.name} kind="services" namespace={config.service.namespace || ns} onNavigate={onNavigate} />
+              } />
+            )}
+            {config.query && <Property label="Query" value={config.query} />}
+          </PropertyList>
+        </Section>
+      ) : (
+        <Section title="Configuration" defaultExpanded>
+          <PropertyList>
+            <ConfigProperties config={config} />
+          </PropertyList>
+        </Section>
+      )}
+    </>
+  )
+}

package/src/components/resources/renderers/TraefikServersTransportRenderer.tsx

@@ -0,0 +1,84 @@
+import { ArrowRightLeft } from 'lucide-react'
+import { Section, PropertyList, Property, AlertBanner, ResourceLink } from '../../ui/drawer-components'
+
+interface TraefikServersTransportRendererProps {
+  data: any
+  onNavigate?: (ref: { kind: string; namespace: string; name: string }) => void
+}
+
+// Covers ServersTransport (HTTP) and ServersTransportTCP — overlapping shapes;
+// fields absent on one kind simply don't render.
+export function TraefikServersTransportRenderer({ data, onNavigate }: TraefikServersTransportRendererProps) {
+  const spec = data.spec || {}
+  const ns = data.metadata?.namespace || ''
+  const kindLabel = data.kind || 'ServersTransport'
+  const insecure = !!spec.insecureSkipVerify
+  const rootCAs: any[] = spec.rootCAsSecrets || []
+  const certs: any[] = spec.certificatesSecrets || []
+  const timeouts = spec.forwardingTimeouts
+
+  return (
+    <>
+      {insecure && (
+        <AlertBanner
+          variant="warning"
+          title="TLS verification disabled"
+          message="insecureSkipVerify is enabled — Traefik will not validate the upstream's certificate. Connections to the backend are vulnerable to interception."
+        />
+      )}
+
+      <Section title={kindLabel} icon={ArrowRightLeft} defaultExpanded>
+        <PropertyList>
+          {spec.serverName && <Property label="Server Name (SNI)" value={spec.serverName} />}
+          <Property
+            label="Insecure Skip Verify"
+            value={<span className={insecure ? 'text-orange-400' : undefined}>{String(insecure)}</span>}
+          />
+          {spec.peerCertURI && <Property label="Peer Cert URI" value={spec.peerCertURI} />}
+          {spec.maxIdleConnsPerHost !== undefined && <Property label="Max Idle Conns / Host" value={String(spec.maxIdleConnsPerHost)} />}
+          {spec.disableHTTP2 !== undefined && <Property label="Disable HTTP/2" value={String(spec.disableHTTP2)} />}
+          {spec.terminationDelay !== undefined && <Property label="Termination Delay" value={String(spec.terminationDelay)} />}
+        </PropertyList>
+      </Section>
+
+      {(rootCAs.length > 0 || certs.length > 0) && (
+        <Section title="Certificates" defaultExpanded>
+          <PropertyList>
+            {rootCAs.length > 0 && (
+              <Property label="Root CA Secrets" value={
+                <div className="flex flex-wrap gap-1">
+                  {rootCAs.map((s: any, i: number) => {
+                    const name = typeof s === 'string' ? s : s?.secret || s?.name
+                    return name ? <ResourceLink key={i} name={name} kind="secrets" namespace={ns} onNavigate={onNavigate} /> : null
+                  })}
+                </div>
+              } />
+            )}
+            {certs.length > 0 && (
+              <Property label="Client Cert Secrets" value={
+                <div className="flex flex-wrap gap-1">
+                  {certs.map((s: any, i: number) => {
+                    const name = typeof s === 'string' ? s : s?.secret || s?.name
+                    return name ? <ResourceLink key={i} name={name} kind="secrets" namespace={ns} onNavigate={onNavigate} /> : null
+                  })}
+                </div>
+              } />
+            )}
+          </PropertyList>
+        </Section>
+      )}
+
+      {timeouts && (
+        <Section title="Forwarding Timeouts">
+          <PropertyList>
+            {timeouts.dialTimeout !== undefined && <Property label="Dial" value={String(timeouts.dialTimeout)} />}
+            {timeouts.responseHeaderTimeout !== undefined && <Property label="Response Header" value={String(timeouts.responseHeaderTimeout)} />}
+            {timeouts.idleConnTimeout !== undefined && <Property label="Idle Conn" value={String(timeouts.idleConnTimeout)} />}
+            {timeouts.readIdleTimeout !== undefined && <Property label="Read Idle" value={String(timeouts.readIdleTimeout)} />}
+            {timeouts.pingTimeout !== undefined && <Property label="Ping" value={String(timeouts.pingTimeout)} />}
+          </PropertyList>
+        </Section>
+      )}
+    </>
+  )
+}

package/src/components/resources/renderers/TraefikServiceRenderer.tsx

@@ -0,0 +1,118 @@
+import { Split, Copy } from 'lucide-react'
+import { Section, PropertyList, Property, AlertBanner, ResourceLink } from '../../ui/drawer-components'
+import { Badge } from '../../ui/Badge'
+import { getTraefikServiceType } from '../resource-utils-traefik'
+
+interface TraefikServiceRendererProps {
+  data: any
+  onNavigate?: (ref: { kind: string; namespace: string; name: string }) => void
+}
+
+function ServiceRow({ svc, ns, weightPct, onNavigate }: {
+  svc: any
+  ns: string
+  weightPct?: number
+  onNavigate?: (ref: { kind: string; namespace: string; name: string }) => void
+}) {
+  const isTraefik = svc.kind === 'TraefikService'
+  const port = svc.port ? `:${svc.port}` : ''
+  return (
+    <div className="flex items-center gap-2 text-xs">
+      {isTraefik && <Badge kind="TraefikService" size="sm">TraefikService</Badge>}
+      <ResourceLink
+        name={svc.name}
+        kind={isTraefik ? 'traefikservices' : 'services'}
+        namespace={svc.namespace || ns}
+        label={<span className="text-blue-400">{svc.name}{port}</span>}
+        onNavigate={onNavigate}
+      />
+      {weightPct !== undefined && (
+        <div className="flex items-center gap-1.5 ml-auto">
+          <div className="w-20 h-1.5 bg-theme-hover rounded-full overflow-hidden">
+            <div className="h-full bg-skyhook-500" style={{ width: `${Math.min(100, weightPct)}%` }} />
+          </div>
+          <span className="text-theme-text-tertiary tabular-nums w-10 text-right">{weightPct.toFixed(0)}%</span>
+        </div>
+      )}
+    </div>
+  )
+}
+
+export function TraefikServiceRenderer({ data, onNavigate }: TraefikServiceRendererProps) {
+  const spec = data.spec || {}
+  const ns = data.metadata?.namespace || ''
+  const type = getTraefikServiceType(data)
+
+  const weighted = spec.weighted?.services || []
+  const totalWeight = weighted.reduce((sum: number, s: any) => sum + (typeof s.weight === 'number' ? s.weight : 0), 0)
+  const mirroring = spec.mirroring
+  const hrw = spec.highestRandomWeight?.services || []
+
+  const noBackends = weighted.length === 0 && !mirroring && hrw.length === 0
+
+  return (
+    <>
+      {noBackends && (
+        <AlertBanner variant="warning" title="No backend services" message="This TraefikService defines no weighted, mirroring, or HRW backends." />
+      )}
+
+      <Section title="TraefikService" icon={Split} defaultExpanded>
+        <PropertyList>
+          <Property label="Type" value={type} />
+        </PropertyList>
+      </Section>
+
+      {weighted.length > 0 && (
+        <Section title={`Weighted Services (${weighted.length})`} defaultExpanded>
+          <div className="space-y-1.5">
+            {weighted.map((s: any, i: number) => (
+              <ServiceRow
+                key={i}
+                svc={s}
+                ns={ns}
+                weightPct={typeof s.weight === 'number' && totalWeight > 0 ? (s.weight / totalWeight) * 100 : undefined}
+                onNavigate={onNavigate}
+              />
+            ))}
+          </div>
+        </Section>
+      )}
+
+      {mirroring && (
+        <Section title="Mirroring" icon={Copy} defaultExpanded>
+          <div className="space-y-2">
+            <div>
+              <div className="text-[10px] font-medium text-theme-text-tertiary uppercase tracking-wider mb-1">Primary</div>
+              <ServiceRow svc={mirroring} ns={ns} onNavigate={onNavigate} />
+            </div>
+            {(mirroring.mirrors || []).length > 0 && (
+              <div>
+                <div className="text-[10px] font-medium text-theme-text-tertiary uppercase tracking-wider mb-1">Mirrors</div>
+                <div className="space-y-1">
+                  {mirroring.mirrors.map((m: any, i: number) => (
+                    <div key={i} className="flex items-center gap-2 text-xs">
+                      <ServiceRow svc={m} ns={ns} onNavigate={onNavigate} />
+                      {m.percent !== undefined && (
+                        <span className="text-theme-text-tertiary">{m.percent}%</span>
+                      )}
+                    </div>
+                  ))}
+                </div>
+              </div>
+            )}
+          </div>
+        </Section>
+      )}
+
+      {hrw.length > 0 && (
+        <Section title={`Highest Random Weight (${hrw.length})`} defaultExpanded>
+          <div className="space-y-1">
+            {hrw.map((s: any, i: number) => (
+              <ServiceRow key={i} svc={s} ns={ns} onNavigate={onNavigate} />
+            ))}
+          </div>
+        </Section>
+      )}
+    </>
+  )
+}

package/src/components/resources/renderers/TraefikTLSOptionRenderer.tsx

@@ -0,0 +1,62 @@
+import { Lock } from 'lucide-react'
+import { Section, PropertyList, Property } from '../../ui/drawer-components'
+import { Badge } from '../../ui/Badge'
+
+interface TraefikTLSOptionRendererProps {
+  data: any
+}
+
+export function TraefikTLSOptionRenderer({ data }: TraefikTLSOptionRendererProps) {
+  const spec = data.spec || {}
+  const ciphers: string[] = spec.cipherSuites || []
+  const curves: string[] = spec.curvePreferences || []
+  const alpn: string[] = spec.alpnProtocols || []
+  const clientAuth = spec.clientAuth
+
+  return (
+    <>
+      <Section title="TLS Option" icon={Lock} defaultExpanded>
+        <PropertyList>
+          <Property label="Min Version" value={spec.minVersion || 'default (VersionTLS12)'} />
+          {spec.maxVersion && <Property label="Max Version" value={spec.maxVersion} />}
+          {spec.sniStrict !== undefined && <Property label="SNI Strict" value={String(spec.sniStrict)} />}
+          {spec.preferServerCipherSuites !== undefined && (
+            <Property label="Prefer Server Ciphers" value={String(spec.preferServerCipherSuites)} />
+          )}
+          {alpn.length > 0 && <Property label="ALPN Protocols" value={alpn.join(', ')} />}
+        </PropertyList>
+      </Section>
+
+      {ciphers.length > 0 && (
+        <Section title={`Cipher Suites (${ciphers.length})`}>
+          <div className="flex flex-wrap gap-1">
+            {ciphers.map((c, i) => (
+              <Badge key={i} tone="structural" size="sm" className="font-mono">{c}</Badge>
+            ))}
+          </div>
+        </Section>
+      )}
+
+      {curves.length > 0 && (
+        <Section title={`Curve Preferences (${curves.length})`}>
+          <div className="flex flex-wrap gap-1">
+            {curves.map((c, i) => (
+              <Badge key={i} tone="structural" size="sm" className="font-mono">{c}</Badge>
+            ))}
+          </div>
+        </Section>
+      )}
+
+      {clientAuth && (
+        <Section title="Client Authentication" defaultExpanded>
+          <PropertyList>
+            {clientAuth.clientAuthType && <Property label="Type" value={clientAuth.clientAuthType} />}
+            {Array.isArray(clientAuth.secretNames) && clientAuth.secretNames.length > 0 && (
+              <Property label="CA Secrets" value={clientAuth.secretNames.join(', ')} />
+            )}
+          </PropertyList>
+        </Section>
+      )}
+    </>
+  )
+}

package/src/components/resources/renderers/WorkflowRenderer.tsx

@@ -48,7 +48,7 @@ function getPhaseBadgeClass(phase: string): string {
     case 'Succeeded':
       return 'status-healthy'
     case 'Running':
-      return 'status-degraded'
+      return 'status-neutral'
     case 'Failed':
     case 'Error':
       return 'status-unhealthy'

package/src/components/resources/renderers/WorkloadRenderer.tsx

@@ -422,7 +422,7 @@ export function WorkloadRenderer({ kind, data, onNavigate, onViewPods, onScale,
 
 function ScalerDiagnosisRow({ entry }: { entry: ScalerDiagnosis }) {
   if (entry.loading) {
-    return <div className="text-xs text-theme-text-tertiary">Loading autoscaler diagnosis...</div>
+    return <div className="text-xs text-theme-text-tertiary">Loading autoscaler diagnosis…</div>
   }
   if (entry.error) {
     return <div className="text-xs text-theme-text-tertiary">Autoscaler diagnosis unavailable</div>

package/src/components/resources/renderers/badge-no-handrolled.test.tsx

@@ -0,0 +1,66 @@
+import { describe, it, expect } from 'vitest'
+import { readdirSync, readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+
+// Ratchet guard for the badge token system (see DESIGN.md "Badges").
+//
+// Hand-rolled chip color strings (`bg-<color>-N/NN text-<color>-N`) bypass the
+// theme and overload hues across intents. The migration to <Badge> is
+// incremental: this test pins the set of renderer files that STILL contain
+// hand-rolled chips. The set may SHRINK (clean a file → remove it here) but must
+// never GROW — a new renderer must use <Badge>/tokens, not literal colors.
+//
+// When this fails because you cleaned a file: delete it from BASELINE.
+// When it fails because you added a chip: use <Badge severity|kind|protocol|tone>
+// instead (DESIGN.md has the decision tree).
+
+const CHIP_RE =
+  /bg-(red|green|blue|yellow|orange|amber|purple|cyan|pink|indigo|emerald|teal|violet|rose|lime|sky)-[0-9]+\/[0-9]+ text-(red|green|blue|yellow|orange|amber|purple|cyan|pink|indigo|emerald|teal|violet|rose|lime|sky)-[0-9]+/
+
+// Renderer files that still contain hand-rolled chips, pending migration.
+// Ratchet: this list only shrinks. Do not add to it.
+const BASELINE = new Set<string>([
+  'AlertRenderer.tsx', 'ArgoApplicationRenderer.tsx', 'CertificateRenderer.tsx',
+  'CertificateRequestRenderer.tsx', 'ChallengeRenderer.tsx', 'CiliumNetworkPolicyRenderer.tsx',
+  'ClusterExternalSecretRenderer.tsx', 'ClusterIssuerRenderer.tsx', 'ClusterNetworkPolicyRenderer.tsx',
+  'cnpg-cells.tsx', 'CNPGClusterRenderer.tsx', 'EventRenderer.tsx', 'GatewayRenderer.tsx',
+  'GenericRenderer.tsx', 'IngressClassRenderer.tsx', 'IstioPeerAuthenticationRenderer.tsx',
+  'IstioServiceEntryRenderer.tsx', 'KarpenterNodeClaimRenderer.tsx', 'knative-cells.tsx',
+  'KnativeEventingRenderer.tsx', 'KnativeRevisionRenderer.tsx', 'kyverno-cells.tsx',
+  'KyvernoPolicyReportRenderer.tsx', 'NetworkPolicyRenderer.tsx', 'NodeRenderer.tsx',
+  'OrderRenderer.tsx', 'PodRenderer.tsx', 'RoleRenderer.tsx', 'RolloutRenderer.tsx',
+  'SealedSecretRenderer.tsx', 'SecretRenderer.tsx', 'SecretStoreRenderer.tsx',
+  'VeleroBackupRenderer.tsx', 'VeleroRestoreRenderer.tsx', 'VeleroScheduleRenderer.tsx',
+  'VPARenderer.tsx', 'VulnerabilityReportRenderer.tsx', 'WebhookConfigRenderer.tsx',
+])
+
+const dir = fileURLToPath(new URL('.', import.meta.url))
+
+function filesWithHandRolledChips(): string[] {
+  return readdirSync(dir)
+    .filter((f) => f.endsWith('.tsx') && !f.endsWith('.test.tsx'))
+    .filter((f) => CHIP_RE.test(readFileSync(`${dir}/${f}`, 'utf8')))
+    .sort()
+}
+
+describe('badge token system — no hand-rolled chip colors', () => {
+  const offenders = filesWithHandRolledChips()
+
+  it('does not introduce hand-rolled chips in new/migrated files (ratchet only shrinks)', () => {
+    const newOffenders = offenders.filter((f) => !BASELINE.has(f))
+    expect(
+      newOffenders,
+      `These renderers use hand-rolled chip colors. Use <Badge severity|kind|protocol|tone> ` +
+        `(see DESIGN.md "Badges"), not literal bg-/text- color strings:\n  ${newOffenders.join('\n  ')}`,
+    ).toEqual([])
+  })
+
+  it('baseline has no stale entries (remove files you have already cleaned)', () => {
+    const stale = [...BASELINE].filter((f) => !offenders.includes(f)).sort()
+    expect(
+      stale,
+      `These files are in BASELINE but no longer contain hand-rolled chips — ` +
+        `delete them from BASELINE in this test:\n  ${stale.join('\n  ')}`,
+    ).toEqual([])
+  })
+})

package/src/components/resources/renderers/contour-cells.tsx

@@ -2,6 +2,7 @@
 
 import { Shield } from 'lucide-react'
 import { Tooltip } from '../../ui/Tooltip'
+import { Badge, type BadgeSeverity } from '../../ui/Badge'
 import {
   getHTTPProxyFQDN,
   getHTTPProxyRouteCount,
@@ -36,11 +37,11 @@ export function HTTPProxyCell({ resource, column }: { resource: any; column: str
     }
     case 'status': {
       const { label } = getHTTPProxyStatus(resource)
-      const color = label === 'Valid' ? 'text-green-500'
-        : label === 'Invalid' ? 'text-red-500'
-        : label === 'Orphaned' ? 'text-yellow-500'
-        : 'text-theme-text-secondary'
-      return <span className={`text-sm ${color}`}>{label}</span>
+      const severity: BadgeSeverity = label === 'Valid' ? 'success'
+        : label === 'Invalid' ? 'error'
+        : label === 'Orphaned' ? 'warning'
+        : 'neutral'
+      return <Badge severity={severity}>{label}</Badge>
     }
     default:
       return <span className="text-sm text-theme-text-tertiary">-</span>

package/src/components/resources/renderers/index.ts

@@ -114,6 +114,10 @@ export * from './WorkflowRenderer'
 export * from './WorkflowTemplateRenderer'
 export * from './WorkloadRenderer'
 export * from './TraefikIngressRouteRenderer'
+export * from './TraefikMiddlewareRenderer'
+export * from './TraefikServiceRenderer'
+export * from './TraefikTLSOptionRenderer'
+export * from './TraefikServersTransportRenderer'
 export * from './traefik-cells'
 export * from './ContourHTTPProxyRenderer'
 export * from './contour-cells'

package/src/components/resources/renderers/istio-cells.tsx

@@ -1,7 +1,7 @@
 // Istio cell components for ResourcesView table
 
 import { clsx } from 'clsx'
-import { BADGE_INACTIVE } from '../../../utils/badge-colors'
+import { Badge, type BadgeSeverity } from '../../ui/Badge'
 import {
   getVirtualServiceStatus,
   getVirtualServiceHosts,
@@ -26,17 +26,17 @@ import {
   getAuthorizationPolicyRuleCount,
 } from '../resource-utils-istio'
 
-const modeColors: Record<string, string> = {
-  STRICT: 'bg-green-500/20 text-green-400',
-  PERMISSIVE: 'bg-yellow-500/20 text-yellow-400',
-  DISABLE: 'bg-red-500/20 text-red-400',
+const modeSeverity: Record<string, BadgeSeverity> = {
+  STRICT: 'success',
+  PERMISSIVE: 'warning',
+  DISABLE: 'error',
 }
 
-const actionColors: Record<string, string> = {
-  ALLOW: 'bg-green-500/20 text-green-400',
-  DENY: 'bg-red-500/20 text-red-400',
-  CUSTOM: 'bg-blue-500/20 text-blue-400',
-  AUDIT: 'bg-yellow-500/20 text-yellow-400',
+const actionSeverity: Record<string, BadgeSeverity> = {
+  ALLOW: 'success',
+  DENY: 'error',
+  CUSTOM: 'info',
+  AUDIT: 'warning',
 }
 
 export function VirtualServiceCell({ resource, column }: { resource: any; column: string }) {
@@ -133,12 +133,9 @@ export function ServiceEntryCell({ resource, column }: { resource: any; column:
     case 'location': {
       const location = getServiceEntryLocation(resource)
       return (
-        <span className={clsx(
-          'badge',
-          location === 'MESH_EXTERNAL' ? 'bg-orange-500/20 text-orange-400' : 'bg-blue-500/20 text-blue-400'
-        )}>
+        <Badge tone={location === 'MESH_EXTERNAL' ? 'accent2' : 'accent1'}>
           {location === 'MESH_EXTERNAL' ? 'External' : 'Internal'}
-        </span>
+        </Badge>
       )
     }
     case 'ports': {
@@ -163,12 +160,9 @@ export function PeerAuthenticationCell({ resource, column }: { resource: any; co
     case 'mode': {
       const mode = getPeerAuthenticationMode(resource)
       return (
-        <span className={clsx(
-          'badge',
-          modeColors[mode] || BADGE_INACTIVE
-        )}>
+        <Badge severity={modeSeverity[mode] ?? 'neutral'}>
           {mode}
-        </span>
+        </Badge>
       )
     }
     case 'selector': {
@@ -193,12 +187,9 @@ export function AuthorizationPolicyCell({ resource, column }: { resource: any; c
     case 'action': {
       const action = getAuthorizationPolicyAction(resource)
       return (
-        <span className={clsx(
-          'badge',
-          actionColors[action] || BADGE_INACTIVE
-        )}>
+        <Badge severity={actionSeverity[action] ?? 'neutral'}>
           {action}
-        </span>
+        </Badge>
       )
     }
     case 'rules': {

package/src/components/resources/resource-utils-cnpg.ts

@@ -283,7 +283,7 @@ export function getCNPGScheduledBackupStatus(resource: any): StatusBadge {
   const isSuspended = resource.spec?.suspend === true
 
   if (isSuspended) {
-    return { text: 'Suspended', color: healthColors.degraded, level: 'degraded' }
+    return { text: 'Suspended', color: healthColors.neutral, level: 'neutral' }
   }
 
   // If we have a last schedule time, it's active