@skyhook-io/radar-app 1.10.0 → 1.12.2

package/src/components/resources/ResourcesView.tsx

@@ -49,6 +49,13 @@ const LARGE_RESOURCE_LIST_GUARD_KEYS = new Set([
   'apps/ReplicaSet',
   'discovery.k8s.io/EndpointSlice',
 ])
+// Kinds the server slims with ?include=summary: rows carry only the fields the
+// table reads (5–8x smaller for pods — a production pod is ~9–13KB raw,
+// ~1–2.5KB slimmed), so the browser holds far more rows before the guard must
+// block. The detail drawer is unaffected — row clicks always refetch the full
+// object.
+const SUMMARY_LIST_KINDS = new Set(['Pod', 'apps/ReplicaSet'])
+const SUMMARY_LIST_LIMIT = 50000
 
 const deniedWorkloadWrites: WorkloadWritePermissions = {
   deployments: false,
@@ -189,13 +196,17 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
   const selectedCountKnown = selectedCountKey ? hasResourceCount(countsData?.counts, selectedCountKey) : false
   const selectedCountUnavailable = selectedCountKey ? countsData?.unavailable?.includes(selectedCountKey) ?? false : false
   const isSelectedKindGuarded = selectedCountKey !== '' && LARGE_RESOURCE_LIST_GUARD_KEYS.has(selectedCountKey)
+  const selectedKindSummaryServed = SUMMARY_LIST_KINDS.has(selectedCountKey)
+  const selectedKindRowLimit = selectedKindSummaryServed ? SUMMARY_LIST_LIMIT : LARGE_RESOURCE_LIST_LIMIT
   const waitingForGuardCount = isSelectedKindGuarded && !countsData && !countsIsError
-  const largeListBlocked = isSelectedKindGuarded && countsData != null && (selectedCountUnavailable || (selectedCountKnown && (selectedCount ?? 0) > LARGE_RESOURCE_LIST_LIMIT))
+  const largeListBlocked = isSelectedKindGuarded && countsData != null && (selectedCountUnavailable || (selectedCountKnown && (selectedCount ?? 0) > selectedKindRowLimit))
   const selectedKindQueryBlocked = waitingForGuardCount || largeListBlocked
   const podCount = countsData?.counts.Pod
   const podCountKnown = hasResourceCount(countsData?.counts, 'Pod')
   const podCountUnavailable = countsData?.unavailable?.includes('Pod') ?? false
-  const podCountAllowsBulkMetrics = countsData != null && podCountKnown && !podCountUnavailable && (podCount ?? 0) <= LARGE_RESOURCE_LIST_LIMIT
+  // Metrics rows are ~100B each (ns/name + cpu/mem), so they track the pods
+  // guard rather than the raw-list limit.
+  const podCountAllowsBulkMetrics = countsData != null && podCountKnown && !podCountUnavailable && (podCount ?? 0) <= SUMMARY_LIST_LIMIT
   const selectedKindName = selectedKind?.name.toLowerCase() ?? ''
   const topPodMetricsEnabled = selectedKindName === 'pods' && podCountAllowsBulkMetrics
   // Node metrics back the Nodes table and, for the Pods table, the pod-vs-node
@@ -210,7 +221,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
         kind: selectedKind.name,
         count: selectedCountUnavailable ? undefined : selectedCount,
         reason: selectedCountUnavailable ? 'count-unavailable' as const : 'too-many' as const,
-        limit: LARGE_RESOURCE_LIST_LIMIT,
+        limit: selectedKindRowLimit,
         namespaces,
       }
     : null
@@ -223,6 +234,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       const params = new URLSearchParams()
       if (namespaces.length > 0) params.set('namespaces', namespacesParam)
       if (isSelectedCrd && selectedKind.group) params.set('group', selectedKind.group)
+      if (selectedKindSummaryServed) params.set('include', 'summary')
       const startedAt = performance.now()
       debugNamespaceLog('resources:selected-kind-fetch-start', {
         kind: selectedKind.name,

package/src/components/resources/renderers/CNPGClusterRenderer.tsx

@@ -1 +1,116 @@
-export * from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGClusterRenderer'
+import { Database } from 'lucide-react'
+import { CNPGClusterRenderer as BaseCNPGClusterRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGClusterRenderer'
+import { Section, RelationshipGroup, getCNPGDeclarativeStatus } from '@skyhook-io/k8s-ui'
+import { LookupFailureNote } from '@skyhook-io/k8s-ui/components/resources/renderers/LookupFailureNote'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useResources } from '../../../api/client'
+
+const CNPG_GROUP = 'postgresql.cnpg.io'
+
+/**
+ * Host wrapper adding the reverse lookup: which Databases, Publications and
+ * Subscriptions are declared against this cluster.
+ *
+ * Each of those objects links forward to its cluster. Without this the
+ * relationship is one-way, so an operator reading a cluster has no way to see
+ * that three databases were declared against it and one of them never applied.
+ */
+export function CNPGClusterRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const namespace = data?.metadata?.namespace ?? ''
+  const name = data?.metadata?.name ?? ''
+  const enabled = !!namespace && !!name
+
+  const databases = useResources<any>('databases', namespace, CNPG_GROUP, { enabled })
+  const publications = useResources<any>('publications', namespace, CNPG_GROUP, { enabled })
+  const subscriptions = useResources<any>('subscriptions', namespace, CNPG_GROUP, { enabled })
+
+  const mine = (items: any[] | undefined) =>
+    (items ?? []).filter((o) => o?.spec?.cluster?.name === name)
+
+  const dbs = mine(databases.data)
+  const pubs = mine(publications.data)
+  const subs = mine(subscriptions.data)
+  const total = dbs.length + pubs.length + subs.length
+
+  const loading = databases.isLoading || publications.isLoading || subscriptions.isLoading
+  // Three independent lookups, so "it failed" is not all-or-nothing: two can
+  // return rows while the third does not, and every count below is then drawn
+  // from a population smaller than the real one.
+  const lookupErrors = [databases.error, publications.error, subscriptions.error]
+  const failed = lookupErrors.some(Boolean)
+
+  // Not applied is the state worth surfacing here: the manifest exists and
+  // PostgreSQL does not have the object. Counting it on the cluster is how an
+  // operator notices without opening each one.
+  const notApplied = [...dbs, ...pubs, ...subs].filter(
+    (o) => getCNPGDeclarativeStatus(o).level === 'unhealthy',
+  ).length
+
+  const refs = (items: any[], kind: string) =>
+    items.map((o) => ({
+      kind,
+      namespace: o?.metadata?.namespace ?? '',
+      name: o?.metadata?.name ?? '',
+      group: CNPG_GROUP,
+    }))
+
+  return (
+    <>
+      <BaseCNPGClusterRenderer
+        data={data}
+        onNavigate={onNavigate}
+        declared={
+          <Section title="Declared Objects" icon={Database} defaultExpanded={notApplied > 0}>
+            {loading ? (
+              <div className="text-sm text-theme-text-tertiary">Looking for declared objects…</div>
+            ) : total === 0 ? (
+              // "None declared" and "could not check" are different answers, and
+              // only one of them means the cluster has no declarative objects.
+              failed ? (
+                <LookupFailureNote
+                  errors={lookupErrors}
+                  what="which objects are declared against this cluster"
+                />
+              ) : (
+                <div className="text-sm text-theme-text-tertiary">
+                  No Database, Publication or Subscription is declared against this cluster.
+                </div>
+              )
+            ) : (
+              <div className="space-y-3">
+                {notApplied > 0 && (
+                  <div className="text-sm text-warning-text">
+                    {`${notApplied} of ${total} could not be applied to PostgreSQL — the manifest exists, the object does not.`}
+                  </div>
+                )}
+                {/* Rows arrived, so the failure is not "nothing found" — it is
+                    that both counts above are drawn from less than the cluster
+                    has, which is the reading they would otherwise invite. */}
+                <LookupFailureNote
+                  errors={lookupErrors}
+                  what="which objects are declared against this cluster"
+                  incomplete
+                />
+                {dbs.length > 0 && (
+                  <RelationshipGroup label="Databases" refs={refs(dbs, 'Database')} onNavigate={onNavigate} />
+                )}
+                {pubs.length > 0 && (
+                  <RelationshipGroup label="Publications" refs={refs(pubs, 'Publication')} onNavigate={onNavigate} />
+                )}
+                {subs.length > 0 && (
+                  <RelationshipGroup label="Subscriptions" refs={refs(subs, 'Subscription')} onNavigate={onNavigate} />
+                )}
+              </div>
+            )}
+          </Section>
+        }
+      />
+    </>
+  )
+}

package/src/components/resources/renderers/CNPGDeclarativeRenderer.tsx

@@ -0,0 +1,227 @@
+import { Share2 } from 'lucide-react'
+import {
+  CNPGDatabaseRenderer as BaseDatabase,
+  CNPGPublicationRenderer as BasePublication,
+  CNPGSubscriptionRenderer as BaseSubscription,
+} from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGDeclarativeRenderer'
+import { ResourceLink, Section, RelationshipGroup } from '@skyhook-io/k8s-ui'
+import { LookupFailureNote } from '@skyhook-io/k8s-ui/components/resources/renderers/LookupFailureNote'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useResources } from '../../../api/client'
+import { splitCNPGDeclarativeByApplied } from '../resource-utils-cnpg'
+
+const CNPG_GROUP = 'postgresql.cnpg.io'
+
+/**
+ * Resolves a PostgreSQL-side name back to the CR that declares it.
+ *
+ * A Publication says it lives in database `demo_app`; the Database CR is called
+ * `demo-app` and carries `spec.name: demo_app`. The two are not the same string,
+ * so the page can name the database and still leave the reader with no way to
+ * open it — the dead end this exists to close.
+ *
+ * Returns undefined when nothing matches, and the caller falls back to plain
+ * text: an unresolved name is still the truth, it just isn't a link.
+ */
+function useDeclaredRef(
+  plural: 'databases' | 'publications',
+  namespace: string,
+  cluster: string | undefined,
+  pgName: string | undefined,
+  onNavigate?: (ref: ResourceRef) => void,
+) {
+  const enabled = !!namespace && !!cluster && !!pgName
+  const { data } = useResources<any>(plural, namespace, CNPG_GROUP, { enabled })
+  if (!enabled) return undefined
+  const match = (data ?? []).find(
+    (o: any) => o?.spec?.cluster?.name === cluster && o?.spec?.name === pgName,
+  )
+  if (!match) return undefined
+  return (
+    <ResourceLink
+      name={pgName as string}
+      kind={plural}
+      namespace={match?.metadata?.namespace ?? namespace}
+      group={CNPG_GROUP}
+      label={pgName}
+      onNavigate={
+        onNavigate
+          ? () =>
+              onNavigate({
+                kind: plural === 'databases' ? 'Database' : 'Publication',
+                namespace: match?.metadata?.namespace ?? namespace,
+                name: match?.metadata?.name ?? '',
+                group: CNPG_GROUP,
+              })
+          : undefined
+      }
+    />
+  )
+}
+
+/**
+ * Database, with the objects that replicate out of it.
+ *
+ * The link only exists in one direction in the API: a Publication names its
+ * database, a Database names nothing. Without this, "what publishes from here"
+ * has no answer on the page that raises the question.
+ */
+export function CNPGDatabaseRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const ns = data?.metadata?.namespace ?? ''
+  const cluster = data?.spec?.cluster?.name
+  const dbname = data?.spec?.name
+  const enabled = !!ns && !!cluster && !!dbname
+
+  const publications = useResources<any>('publications', ns, CNPG_GROUP, { enabled })
+  const subscriptions = useResources<any>('subscriptions', ns, CNPG_GROUP, { enabled })
+
+  const inThisDatabase = (o: any) =>
+    o?.spec?.cluster?.name === cluster && o?.spec?.dbname === dbname
+  const pubs = (publications.data ?? []).filter(inThisDatabase)
+  const subs = (subscriptions.data ?? []).filter(inThisDatabase)
+
+  const toRef = (kind: 'Publication' | 'Subscription') => (o: any) => ({
+    kind,
+    namespace: o?.metadata?.namespace ?? ns,
+    name: o?.metadata?.name ?? '',
+    group: CNPG_GROUP,
+  })
+
+  // Three states, not two — the same distinction the status badge and the issue
+  // detector make. Applied is replicating. `applied: false` is a failed apply
+  // the operator can explain. ABSENT is not yet reconciled, and calling that
+  // "exists in Kubernetes and not in PostgreSQL" condemns every object in its
+  // first seconds.
+  const p = splitCNPGDeclarativeByApplied(pubs)
+  const sub = splitCNPGDeclarativeByApplied(subs)
+  const tagged = (list: any[], kind: 'Publication' | 'Subscription') =>
+    list.map((o: any) => ({ o, kind }))
+  const livePubs = p.applied
+  const liveSubs = sub.applied
+  const notApplied = [...tagged(p.notApplied, 'Publication'), ...tagged(sub.notApplied, 'Subscription')]
+  const pending = [...tagged(p.pending, 'Publication'), ...tagged(sub.pending, 'Subscription')]
+
+  const loading = publications.isLoading || subscriptions.isLoading
+  // Two independent lookups: one can return rows while the other does not, and
+  // the groups below would then describe half the replication as all of it.
+  const lookupErrors = [publications.error, subscriptions.error]
+  const failed = lookupErrors.some(Boolean)
+
+  return (
+    <BaseDatabase
+      data={data}
+      onNavigate={onNavigate}
+      usedBy={
+        <Section title="Replication" icon={Share2} defaultExpanded>
+          {loading ? (
+            <div className="text-sm text-theme-text-tertiary">Looking for publications…</div>
+          ) : pubs.length === 0 && subs.length === 0 ? (
+            failed ? (
+              <LookupFailureNote
+                errors={lookupErrors}
+                what="what replicates out of this database"
+              />
+            ) : (
+              <div className="text-sm text-theme-text-tertiary">
+                Nothing publishes from or subscribes to this database.
+              </div>
+            )
+          ) : (
+            <div className="space-y-3">
+              {/* Rows are showing, so the failure means this list is short —
+                  not that nothing replicates. */}
+              <LookupFailureNote
+                errors={lookupErrors}
+                what="what replicates out of this database"
+                incomplete
+              />
+              {livePubs.length > 0 && (
+                <RelationshipGroup
+                  label="Publishes from here"
+                  refs={livePubs.map(toRef('Publication'))}
+                  onNavigate={onNavigate}
+                />
+              )}
+              {liveSubs.length > 0 && (
+                <RelationshipGroup
+                  label="Subscribes into here"
+                  refs={liveSubs.map(toRef('Subscription'))}
+                  onNavigate={onNavigate}
+                />
+              )}
+              {notApplied.length > 0 && (
+                <div className="space-y-1.5">
+                  <RelationshipGroup
+                    label="Declared, but not replicating"
+                    refs={notApplied.map(({ o, kind }) => toRef(kind)(o))}
+                    onNavigate={onNavigate}
+                  />
+                  <div className="text-xs text-warning-text">
+                    {notApplied.length === 1
+                      ? 'This exists in Kubernetes and not in PostgreSQL, so no data moves through it. Open it for the operator’s reason.'
+                      : 'These exist in Kubernetes and not in PostgreSQL, so no data moves through them. Open one for the operator’s reason.'}
+                  </div>
+                </div>
+              )}
+              {pending.length > 0 && (
+                <div className="space-y-1.5">
+                  <RelationshipGroup
+                    label="Not reconciled yet"
+                    refs={pending.map(({ o, kind }) => toRef(kind)(o))}
+                    onNavigate={onNavigate}
+                  />
+                  <div className="text-xs text-theme-text-secondary">
+                    The operator has not reported on these yet. They have not failed.
+                  </div>
+                </div>
+              )}
+            </div>
+          )}
+        </Section>
+      }
+    />
+  )
+}
+
+export function CNPGPublicationRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const ns = data?.metadata?.namespace ?? ''
+  const cluster = data?.spec?.cluster?.name
+  const database = useDeclaredRef('databases', ns, cluster, data?.spec?.dbname, onNavigate)
+  return <BasePublication data={data} onNavigate={onNavigate} links={{ database }} />
+}
+
+export function CNPGSubscriptionRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const ns = data?.metadata?.namespace ?? ''
+  const cluster = data?.spec?.cluster?.name
+  const database = useDeclaredRef('databases', ns, cluster, data?.spec?.dbname, onNavigate)
+  // The publication a subscription reads from lives on the *upstream* cluster in
+  // a real topology. Resolving locally is right for the single-cluster demo and
+  // simply finds nothing otherwise, which falls back to plain text rather than
+  // linking to the wrong object.
+  const publication = useDeclaredRef(
+    'publications',
+    ns,
+    cluster,
+    data?.spec?.publicationName,
+    onNavigate,
+  )
+  return <BaseSubscription data={data} onNavigate={onNavigate} links={{ database, publication }} />
+}

package/src/components/resources/renderers/CNPGImageCatalogRenderer.tsx

@@ -0,0 +1,123 @@
+import { Boxes } from 'lucide-react'
+import { CNPGImageCatalogRenderer as BaseImageCatalog } from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGDeclarativeRenderer'
+import { Section, RelationshipGroup } from '@skyhook-io/k8s-ui'
+import { LookupFailureNote } from '@skyhook-io/k8s-ui/components/resources/renderers/LookupFailureNote'
+import { getCNPGImageCatalogEntries } from '../resource-utils-cnpg'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useCNPGCatalogUsers } from '../../../api/policy'
+
+const CNPG_GROUP = 'postgresql.cnpg.io'
+
+/**
+ * Host wrapper adding the reverse lookup: which clusters are pinned to this
+ * catalog.
+ *
+ * This is the diagnosis path. A cluster that references a catalog lacking its
+ * major version reports "incomplete or invalid image catalog" and stops; the
+ * catalog is where you check what it offers, and from here you need to see who
+ * depends on it before changing anything.
+ */
+export function CNPGImageCatalogRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const kind = data?.kind
+  const name = data?.metadata?.name ?? ''
+  const namespace = data?.metadata?.namespace ?? ''
+  // A ClusterImageCatalog is cluster-scoped and referenceable from any namespace,
+  // so the answer's scope is not this resource's. Read server-side rather than
+  // filtering a client-side list: omitting the namespace there means "the
+  // caller's namespace view filter", which would answer a question about the
+  // whole cluster from whichever namespaces they happen to be showing.
+  const scoped = kind === 'ImageCatalog'
+  const clusters = useCNPGCatalogUsers(name, scoped ? namespace : '', !!name)
+
+  const users = clusters.data?.clusters ?? []
+
+  // A cluster asking for a major this catalog does not carry is the failure the
+  // catalog page exists to explain, and it is invisible from the cluster side —
+  // there the reference looks fine.
+  const majors = new Set(getCNPGImageCatalogEntries(data).map((e) => e.major))
+  const unmet = users.filter((c) => !majors.has(c.major as number))
+  const met = users.filter((c) => majors.has(c.major as number))
+
+  const toRef = (c: { namespace: string; name: string }) => ({
+    kind: 'Cluster',
+    namespace: c.namespace,
+    name: c.name,
+    group: CNPG_GROUP,
+  })
+
+  return (
+    <BaseImageCatalog
+      data={data}
+      usedBy={
+        <Section title="Used By" icon={Boxes} defaultExpanded>
+          {clusters.isLoading ? (
+            <div className="text-sm text-theme-text-tertiary">Looking for clusters…</div>
+          ) : users.length === 0 ? (
+            clusters.error ? (
+              <LookupFailureNote
+                errors={[clusters.error]}
+                what="which clusters use this catalog"
+              />
+            ) : (
+              <div className="text-sm text-theme-text-tertiary">
+                {/* "Changing it affects nothing" is a claim about the cluster,
+                    and this search does not cover one. A ClusterImageCatalog is
+                    referenced from any namespace, but the lookup that answers
+                    this falls back to the reader's namespace view filter, so a
+                    filtered reader is told an edit is safe on the strength of
+                    the namespaces they happen to be looking at. The namespaced
+                    ImageCatalog has no such gap — its users can only be in its
+                    own namespace, which is exactly what was searched. */}
+                {scoped
+                  ? 'No cluster in this namespace is pinned to this catalog. Changing it affects nothing here today.'
+                  : 'No cluster in view is pinned to this catalog. Clusters in namespaces you are not currently showing are not covered by this check.'}
+              </div>
+            )
+          ) : (
+            <div className="space-y-3">
+              {met.length > 0 && (
+                <RelationshipGroup label="Clusters" refs={met.map(toRef)} onNavigate={onNavigate} />
+              )}
+              {unmet.length > 0 && (
+                <div className="space-y-1.5">
+                  <RelationshipGroup
+                    label="Pinned to a version this catalog does not list"
+                    refs={unmet.map(toRef)}
+                    onNavigate={onNavigate}
+                  />
+                  {unmet.some((c) => !!c.image) && (
+                    <div className="text-xs text-theme-text-secondary">
+                      {`Running now: ${unmet
+                        .filter((c) => !!c.image)
+                        .map((c) => `${c.name} on ${c.image}`)
+                        .join(', ')}`}
+                    </div>
+                  )}
+                  <div className="text-xs text-warning-text">
+                    {/* What the catalog can prove, and no further. A cluster
+                        that already resolved an image keeps running on it, so
+                        "will not start" sends a responder hunting for
+                        crash-looping pods that are not there — the failure is
+                        the NEXT time an image has to be resolved. The named
+                        form only when there is a major to name: a reference
+                        missing one lands here too, and "asks for PostgreSQL
+                        undefined" would be worse than the general sentence. */}
+                    {unmet.length === 1 && typeof unmet[0]?.major === 'number'
+                      ? `${unmet[0]?.name} asks for PostgreSQL ${unmet[0].major}, which this catalog does not list. Whatever image it is running now, the next time it has to resolve one it will fail.`
+                      : 'These clusters ask for a major version this catalog does not list. Whatever image they are running now, the next time they have to resolve one they will fail.'}
+                  </div>
+                </div>
+              )}
+            </div>
+          )}
+        </Section>
+      }
+    />
+  )
+}

package/src/components/resources/renderers/CNPGObjectStoreRenderer.tsx

@@ -0,0 +1,152 @@
+import { Database } from 'lucide-react'
+import { CNPGObjectStoreRenderer as BaseCNPGObjectStoreRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/CNPGObjectStoreRenderer'
+import { Section, RelationshipGroup, CNPG_BARMAN_PLUGIN_NAME } from '@skyhook-io/k8s-ui'
+import { LookupFailureNote } from '@skyhook-io/k8s-ui/components/resources/renderers/LookupFailureNote'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useResources } from '../../../api/client'
+
+/**
+ * Host wrapper adding the reverse lookup the package renderer cannot do: which
+ * CNPG Clusters back up into this store.
+ *
+ * The Cluster page already links forward to its ObjectStore. Without this the
+ * relationship is one-way, so an operator reading a recovery window keyed by
+ * server name has no route to the cluster behind it.
+ */
+export function CNPGObjectStoreRenderer({
+  data,
+  onNavigate,
+}: {
+  data: any
+  onNavigate?: (ref: ResourceRef) => void
+}) {
+  const namespace = data?.metadata?.namespace ?? ''
+  const storeName = data?.metadata?.name ?? ''
+
+  // Clusters reference their store by name within their own namespace, so the
+  // search is namespace-scoped rather than cluster-wide.
+  const clusters = useResources<any>('clusters', namespace, 'postgresql.cnpg.io', {
+    enabled: !!storeName && !!namespace,
+  })
+
+  // Servers the store holds data for, from its own status. Deliberately a
+  // separate question from the one below.
+  const servers: string[] = Object.keys(data?.status?.serverRecoveryWindow ?? {})
+
+  const users = (clusters.data ?? []).filter((c: any) => {
+    const plugins = c?.spec?.plugins
+    if (!Array.isArray(plugins)) return false
+    return plugins.some(
+      (p: any) =>
+        p?.name === CNPG_BARMAN_PLUGIN_NAME &&
+        p?.enabled !== false &&
+        p?.parameters?.barmanObjectName === storeName,
+    )
+  })
+
+  // A recovery window is keyed by the archive's server name, which defaults to
+  // the cluster's name and is overridden by the plugin's own `serverName`
+  // parameter — the ObjectStore rejects the field outright ("use the
+  // 'serverName' plugin parameter in the Cluster resource"), so the Cluster is
+  // the only place it can come from. Matching keys against cluster names alone
+  // reports a cluster that renamed its archive as a stranger.
+  const clusterForServer = new Map<string, string>()
+  for (const c of users) {
+    const plugin = (c?.spec?.plugins ?? []).find(
+      (p: any) => p?.name === CNPG_BARMAN_PLUGIN_NAME && p?.parameters?.barmanObjectName === storeName,
+    )
+    const server = plugin?.parameters?.serverName || c?.metadata?.name
+    if (server && c?.metadata?.name) clusterForServer.set(server, c.metadata.name)
+  }
+
+  // A recovery window is only advancing while WAL archiving works. The Cluster
+  // owns that condition, and the ObjectStore's own status cannot see it — so a
+  // server whose archiving has stopped reports its last successful backup and
+  // reads as green here while the recovery point is frozen. The page whose job is
+  // "how far back can I restore" is the last place that should have to be
+  // cross-checked against another screen.
+  const archivingFailing = new Set<string>()
+  for (const c of users) {
+    const stalled = (c?.status?.conditions ?? []).some(
+      (cond: any) => cond?.type === 'ContinuousArchiving' && cond?.status === 'False',
+    )
+    if (!stalled) continue
+    const plugin = (c?.spec?.plugins ?? []).find(
+      (p: any) => p?.name === CNPG_BARMAN_PLUGIN_NAME && p?.parameters?.barmanObjectName === storeName,
+    )
+    const server = plugin?.parameters?.serverName || c?.metadata?.name
+    if (server) archivingFailing.add(server)
+  }
+
+  // Named in the window, traceable to none of the clusters above — the gap the
+  // note explains.
+  const unlisted = servers.filter((s) => !clusterForServer.has(s))
+
+  return (
+    <>
+      <BaseCNPGObjectStoreRenderer
+        data={data}
+        onNavigate={onNavigate}
+        // Server key -> the Cluster that archives under it. Built from the
+        // plugin parameters rather than by name, so a cluster that renamed its
+        // archive still resolves. Undefined while the lookup is unresolved.
+        clusterForServer={clusters.isLoading || clusters.error ? undefined : clusterForServer}
+        archivingFailing={clusters.isLoading || clusters.error ? undefined : archivingFailing}
+      />
+      <Section title="Used By" icon={Database} defaultExpanded>
+        {clusters.isLoading ? (
+          <div className="text-sm text-theme-text-tertiary">Looking for clusters…</div>
+        ) : users.length === 0 ? (
+          // Not the same as "nothing uses it" — the caller may not be able to
+          // list Clusters here, and a store with no users is worth noticing.
+          clusters.error ? (
+            <LookupFailureNote
+              errors={[clusters.error]}
+              what="which clusters use this store"
+            />
+          ) : (
+            <div className="text-sm text-theme-text-tertiary">
+              No cluster in this namespace backs up to this store.
+            </div>
+          )
+        ) : (
+          // The house pattern for "these other resources relate to this one":
+          // labelled group with a count, ref badges, truncate-then-expand.
+          <RelationshipGroup
+            label="Archiving here through the plugin"
+            refs={users.map((c: any) => ({
+              kind: 'Cluster',
+              namespace: c.metadata?.namespace ?? '',
+              name: c.metadata?.name ?? '',
+              group: 'postgresql.cnpg.io',
+            }))}
+            onNavigate={onNavigate}
+          />
+        )}
+        {/* This lookup can only see `spec.plugins`. A cluster still on the
+            deprecated in-tree `spec.backup.barmanObjectStore` names a
+            destination path and never references this CR, so it CANNOT appear
+            above however much data it has here. Read as blast radius — "who
+            breaks if I rotate these credentials" — the list would silently omit
+            every legacy-path cluster, which mid-migration is most of a fleet.
+            The recovery window is the other half of the answer. */}
+        {/* Only once the plugin lookup has actually answered. Derived while the
+            list is still loading — or after it failed — every server in the
+            window looks like an in-tree cluster, which is a claim about their
+            configuration made from having no data. */}
+        {!clusters.isLoading && !clusters.error && unlisted.length > 0 && (
+          <div className="mt-2 pt-2 border-t border-theme-border text-xs text-theme-text-secondary">
+            {/* Two causes reach this note and the screen cannot tell them
+                apart, so it names both rather than asserting the one that is
+                usually true: a cluster on the older in-tree settings never
+                references this record, and a cluster that renamed its archive
+                leaves the data it already wrote under the previous name. */}
+            {`${unlisted.join(', ')} ${unlisted.length === 1 ? 'has' : 'have'} data here but ${
+              unlisted.length === 1 ? 'is' : 'are'
+            } not listed above. This finds clusters through the barman-cloud plugin, so an archive written by a cluster on the older in-tree backup settings — or under a server name it has since changed — is not traced back to one.`}
+          </div>
+        )}
+      </Section>
+    </>
+  )
+}