@skyhook-io/radar-app 1.13.4 → 1.14.0

package/src/components/resources/PodFilesystemModal.tsx

@@ -1,6 +1,6 @@
 import { createElement, useState, useRef, useEffect, useMemo, useCallback } from 'react'
 import { createPortal } from 'react-dom'
-import { X, File, Link2, ChevronRight, AlertTriangle, Loader2, Search, Download, FolderOpen } from 'lucide-react'
+import { X, File, Link2, ChevronRight, ArrowLeft, AlertTriangle, Loader2, Search, Download, FolderOpen } from 'lucide-react'
 import { PaneLoader, Input } from '@skyhook-io/k8s-ui'
 import { clsx } from 'clsx'
 import type { FileNode } from '../../types'
@@ -11,6 +11,7 @@ import { isDesktopApp } from '../../utils/desktop-download'
 import { openFile, openFolder } from '../../utils/desktop-open-folder'
 import { useToast } from '../ui/Toast'
 import { Tooltip } from '../ui/Tooltip'
+import { PodFilePreview, PREVIEW_BYTE_CAP } from './PodFilePreview'
 
 interface PodFilesystem {
   root: FileNode
@@ -68,6 +69,56 @@ async function savePodFileToDisk(
   return body.path
 }
 
+type PodFileToast = Pick<ReturnType<typeof useToast>, 'showSuccess' | 'showError'>
+
+// One download path for the listing row and the preview header. Desktop saves
+// straight from the backend; the browser gets a blob.
+async function downloadPodFile(
+  namespace: string,
+  podName: string,
+  container: string,
+  node: Pick<FileNode, 'path' | 'name'>,
+  { showSuccess, showError }: PodFileToast,
+) {
+  try {
+    if (await isDesktopApp()) {
+      const savedPath = await savePodFileToDisk(namespace, podName, container, node.path)
+      showSuccess(
+        'File saved',
+        savedPath,
+        {
+          label: 'Show in Finder',
+          icon: createElement(FolderOpen, { className: 'w-3.5 h-3.5' }),
+          onClick: () => openFolder(savedPath),
+        },
+        () => openFile(savedPath),
+      )
+      return
+    }
+
+    const params = new URLSearchParams()
+    params.set('container', container)
+    params.set('path', node.path)
+
+    const response = await fetch(apiUrl(`/pods/${namespace}/${podName}/files/download?${params.toString()}`), {
+      credentials: getCredentialsMode(),
+      headers: getAuthHeaders(),
+    })
+    if (!response.ok) {
+      const err = await response.json().catch(() => ({ error: 'Download failed' }))
+      throw new Error(err.error || `HTTP ${response.status}`)
+    }
+
+    const blob = await response.blob()
+    await downloadBlob(blob, node.name)
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err)
+    if (message !== 'cancelled') {
+      showError(`Could not download ${node.name}`, message)
+    }
+  }
+}
+
 interface PodFilesystemModalProps {
   open: boolean
   onClose: () => void
@@ -94,8 +145,12 @@ export function PodFilesystemModal({
   const [filesystem, setFilesystem] = useState<PodFilesystem | null>(null)
   const [isLoading, setIsLoading] = useState(false)
   const [error, setError] = useState<string | null>(null)
+  // The file being viewed in place of the listing; null shows the directory.
+  const [previewFile, setPreviewFile] = useState<FileNode | null>(null)
+  const toast = useToast()
 
   const loadDirectory = useCallback(async (dirPath: string) => {
+    setPreviewFile(null)
     setIsLoading(true)
     setError(null)
     try {
@@ -124,19 +179,24 @@ export function PodFilesystemModal({
       setError(null)
       setIsLoading(false)
       setCurrentPath('/')
+      setPreviewFile(null)
       setSelectedContainer(initialContainer || containers[0] || '')
     }
   }, [open, initialContainer, containers])
 
-  // Handle ESC key
+  // ESC steps back one level: out of a file to its listing, then out of the
+  // dialog. One listener owns both so the two can never race.
   useEffect(() => {
     if (!open) return
     const handleKeyDown = (e: KeyboardEvent) => {
-      if (e.key === 'Escape') { e.stopPropagation(); onClose() }
+      if (e.key !== 'Escape') return
+      e.stopPropagation()
+      if (previewFile) setPreviewFile(null)
+      else onClose()
     }
     document.addEventListener('keydown', handleKeyDown, true)
     return () => document.removeEventListener('keydown', handleKeyDown, true)
-  }, [open, onClose])
+  }, [open, onClose, previewFile])
 
   // Focus trap
   useEffect(() => {
@@ -149,10 +209,19 @@ export function PodFilesystemModal({
 
   const showFilesystem = filesystem && filesystem.root
 
-  // Build breadcrumb segments
-  const pathSegments = currentPath === '/'
+  // Breadcrumb: the directory path, plus the file when one is open. Clicking
+  // the current directory while viewing a file just returns to its listing.
+  const breadcrumbPath = previewFile ? previewFile.path : currentPath
+  const pathSegments = breadcrumbPath === '/'
     ? ['/']
-    : ['/', ...currentPath.split('/').filter(Boolean)]
+    : ['/', ...breadcrumbPath.split('/').filter(Boolean)]
+  const goToDirectory = (dirPath: string) => {
+    if (dirPath === currentPath) setPreviewFile(null)
+    else loadDirectory(dirPath)
+  }
+  const downloadPreviewFile = () => {
+    if (previewFile) downloadPodFile(namespace, podName, selectedContainer, previewFile, toast)
+  }
 
   return createPortal(
     <div className="fixed inset-0 z-[100] flex items-center justify-center">
@@ -163,19 +232,47 @@ export function PodFilesystemModal({
       <div
         ref={dialogRef}
         tabIndex={-1}
-        className="relative dialog w-full max-w-4xl mx-4 max-h-[85vh] flex flex-col outline-none"
+        className="relative dialog w-full max-w-4xl mx-4 h-[85vh] flex flex-col outline-none"
       >
         {/* Header */}
         <div className="flex items-center justify-between p-4 border-b border-theme-border shrink-0">
-          <div className="flex-1 min-w-0">
-            <h3 className="text-lg font-semibold text-theme-text-primary">Pod Files</h3>
-            <p className="text-sm text-theme-text-secondary truncate mt-0.5">
-              {namespace}/{podName}
-            </p>
-          </div>
+          {previewFile ? (
+            <>
+              <Tooltip content="Back to files">
+                <button
+                  onClick={() => setPreviewFile(null)}
+                  className="p-2 mr-2 text-theme-text-secondary hover:text-theme-text-primary hover:bg-theme-elevated rounded"
+                >
+                  <ArrowLeft className="w-5 h-5" />
+                </button>
+              </Tooltip>
+              <div className="flex-1 min-w-0">
+                <h3 className="text-lg font-semibold text-theme-text-primary truncate">{previewFile.name}</h3>
+                <p className="text-sm text-theme-text-secondary truncate mt-0.5">
+                  {namespace}/{podName} · {selectedContainer}
+                  {previewFile.size !== undefined ? ` · ${formatBytes(previewFile.size)}` : null}
+                </p>
+              </div>
+              <Tooltip content="Download file">
+                <button
+                  onClick={downloadPreviewFile}
+                  className="p-2 text-theme-text-secondary hover:text-theme-text-primary hover:bg-theme-elevated rounded"
+                >
+                  <Download className="w-5 h-5" />
+                </button>
+              </Tooltip>
+            </>
+          ) : (
+            <div className="flex-1 min-w-0">
+              <h3 className="text-lg font-semibold text-theme-text-primary">Pod Files</h3>
+              <p className="text-sm text-theme-text-secondary truncate mt-0.5">
+                {namespace}/{podName}
+              </p>
+            </div>
+          )}
 
           {/* Container selector */}
-          {containers.length > 1 && (
+          {!previewFile && containers.length > 1 && (
             <select
               value={selectedContainer}
               onChange={(e) => setSelectedContainer(e.target.value)}
@@ -206,7 +303,7 @@ export function PodFilesystemModal({
                 <span key={segmentPath} className="flex items-center gap-1">
                   {i > 0 && <ChevronRight className="w-3 h-3 text-theme-text-tertiary shrink-0" />}
                   <button
-                    onClick={() => !isLast && loadDirectory(segmentPath)}
+                    onClick={() => !isLast && goToDirectory(segmentPath)}
                     className={clsx(
                       'truncate',
                       isLast
@@ -222,7 +319,7 @@ export function PodFilesystemModal({
           </div>
 
           {/* Search */}
-          {showFilesystem && (
+          {showFilesystem && !previewFile && (
             <div className="relative flex-1 min-w-[200px]">
               <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-theme-text-tertiary" />
               <Input
@@ -236,9 +333,22 @@ export function PodFilesystemModal({
         </div>
 
         {/* Content */}
-        <div className="flex-1 overflow-y-auto p-4">
+        {previewFile ? (
+          <div className="flex-1 min-h-0 flex flex-col">
+            <PodFilePreview
+              key={previewFile.path}
+              namespace={namespace}
+              podName={podName}
+              container={selectedContainer}
+              filePath={previewFile.path}
+              fileName={previewFile.name}
+              onDownload={downloadPreviewFile}
+            />
+          </div>
+        ) : (
+        <div className="flex-1 min-h-0 overflow-y-auto p-4">
           {/* Loading */}
-          {isLoading && <PaneLoader label="Loading files…" className="h-64" />}
+          {isLoading && <PaneLoader label="Loading files…" className="h-full" />}
 
           {/* Error */}
           {error && !isLoading && (
@@ -262,9 +372,11 @@ export function PodFilesystemModal({
               podName={podName}
               container={selectedContainer}
               onNavigate={loadDirectory}
+              onOpenFile={setPreviewFile}
             />
           )}
         </div>
+        )}
 
         {/* Footer with stats */}
         <div className="p-3 border-t border-theme-border text-xs text-theme-text-tertiary flex items-center gap-4 shrink-0">
@@ -300,9 +412,10 @@ interface PodFileTreeViewProps {
   podName: string
   container: string
   onNavigate: (path: string) => void
+  onOpenFile: (node: FileNode) => void
 }
 
-function PodFileTreeView({ root, searchQuery, namespace, podName, container, onNavigate }: PodFileTreeViewProps) {
+function PodFileTreeView({ root, searchQuery, namespace, podName, container, onNavigate, onOpenFile }: PodFileTreeViewProps) {
   const filteredRoot = useMemo(() => {
     if (!searchQuery.trim()) return root
     return filterTree(root, searchQuery.toLowerCase())
@@ -326,6 +439,7 @@ function PodFileTreeView({ root, searchQuery, namespace, podName, container, onN
           podName={podName}
           container={container}
           onNavigate={onNavigate}
+          onOpenFile={onOpenFile}
         />
       ))}
     </div>
@@ -338,72 +452,48 @@ interface PodFileTreeNodeProps {
   podName: string
   container: string
   onNavigate: (path: string) => void
+  onOpenFile: (node: FileNode) => void
 }
 
-function PodFileTreeNode({ node, namespace, podName, container, onNavigate }: PodFileTreeNodeProps) {
+function PodFileTreeNode({ node, namespace, podName, container, onNavigate, onOpenFile }: PodFileTreeNodeProps) {
   const [downloading, setDownloading] = useState(false)
-  const { showSuccess, showError } = useToast()
+  const toast = useToast()
   const isDir = node.type === 'dir'
   const isSymlink = node.type === 'symlink'
-  const isDownloadable = !isDir // files and symlinks can be downloaded
+  // Size is the one preview rejection the listing can see coming. Whether a
+  // file is binary or readable is only known once its bytes are read.
+  const tooLarge = !isDir && (node.size ?? 0) > PREVIEW_BYTE_CAP
 
   const handleDownload = async (e: React.MouseEvent) => {
     e.stopPropagation()
     if (downloading) return
-
     setDownloading(true)
     try {
-      if (await isDesktopApp()) {
-        const savedPath = await savePodFileToDisk(namespace, podName, container, node.path)
-        showSuccess(
-          'File saved',
-          savedPath,
-          {
-            label: 'Show in Finder',
-            icon: createElement(FolderOpen, { className: 'w-3.5 h-3.5' }),
-            onClick: () => openFolder(savedPath),
-          },
-          () => openFile(savedPath),
-        )
-        return
-      }
-
-      const params = new URLSearchParams()
-      params.set('container', container)
-      params.set('path', node.path)
-
-      const response = await fetch(apiUrl(`/pods/${namespace}/${podName}/files/download?${params.toString()}`), {
-        credentials: getCredentialsMode(),
-        headers: getAuthHeaders(),
-      })
-      if (!response.ok) {
-        const err = await response.json().catch(() => ({ error: 'Download failed' }))
-        throw new Error(err.error || `HTTP ${response.status}`)
-      }
-
-      const blob = await response.blob()
-      await downloadBlob(blob, node.name)
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err)
-      if (message !== 'cancelled') {
-        showError(`Could not download ${node.name}`, message)
-      }
+      await downloadPodFile(namespace, podName, container, node, toast)
     } finally {
       setDownloading(false)
     }
   }
 
+  // Directories open in place; anything else opens in the viewer, which
+  // reports a symlink to a directory as "not a regular file" itself.
   const handleClick = () => {
-    if (isDir) {
-      onNavigate(node.path)
-    }
+    if (isDir) onNavigate(node.path)
+    else if (!tooLarge) onOpenFile(node)
   }
 
   return (
+    <Tooltip
+      content={`Too large to preview (${formatBytes(node.size ?? 0)}) — download instead`}
+      disabled={!tooLarge}
+      wrapperClassName="flex w-full"
+      position="bottom"
+    >
     <div
       className={clsx(
-        'flex items-center gap-1 py-0.5 px-1 rounded hover:bg-theme-elevated',
-        isDir && 'font-medium cursor-pointer'
+        'flex flex-1 min-w-0 items-center gap-1 py-0.5 px-1 rounded hover:bg-theme-elevated',
+        isDir && 'font-medium',
+        tooLarge ? 'cursor-default' : 'cursor-pointer'
       )}
       onClick={handleClick}
     >
@@ -415,7 +505,7 @@ function PodFileTreeNode({ node, namespace, podName, container, onNavigate }: Po
         <File className="w-4 h-4 text-theme-text-tertiary shrink-0" />
       )}
 
-      <span className="text-theme-text-primary truncate flex-1">{node.name}</span>
+      <span className={clsx('truncate flex-1', tooLarge ? 'text-theme-text-secondary' : 'text-theme-text-primary')}>{node.name}</span>
 
       {isSymlink && node.linkTarget && (
         <span className="text-xs text-cyan-400 truncate max-w-48">
@@ -435,7 +525,7 @@ function PodFileTreeNode({ node, namespace, podName, container, onNavigate }: Po
         </span>
       )}
 
-      {isDownloadable && (
+      {!isDir && (
         <Tooltip content="Download file" wrapperClassName="ml-1">
         <button
           onClick={handleDownload}
@@ -451,6 +541,6 @@ function PodFileTreeNode({ node, namespace, podName, container, onNavigate }: Po
         </Tooltip>
       )}
     </div>
+    </Tooltip>
   )
 }
-

package/src/components/resources/ResourcesView.tsx

@@ -1,7 +1,7 @@
 import { useState, useMemo, useCallback, useEffect } from 'react'
 import { useLocation, useNavigate } from 'react-router-dom'
 import { useQuery } from '@tanstack/react-query'
-import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, useCapabilities, useNamespaceCapabilities, useResources, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
+import { ApiError, debugNamespaceLog, fetchJSON, isForbiddenError, isKindSyncFailed, isStillLoadingError, useCapabilities, useNamespaceCapabilities, useResources, useSecretCertExpiry, useTopPodMetrics, useTopNodeMetrics, useBulkDeleteResources, useBulkRestartWorkloads, useBulkScaleWorkloads, useAudit } from '../../api/client'
 import { isBadgeWorthy } from '../../utils/auditBadges'
 import type { AuditBadgeMessage } from '@skyhook-io/k8s-ui'
 import { apiUrl, getAuthHeaders, getCredentialsMode, stripBasename } from '../../api/config'
@@ -143,7 +143,18 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       }
     },
     staleTime: 10000,
-    refetchInterval: 60000, // Safety net — SSE k8s_event drives near-real-time invalidation
+    // SSE invalidation isn't running while connecting, and mid-sync counts
+    // are what unlatch guarded kinds as their informers finish — poll fast
+    // during the shell, settle to the safety net once connected.
+    refetchInterval: connection.state === 'connecting' ? 3000 : 60000,
+    // During the first seconds of the progressive shell the endpoint 503s
+    // (cluster_connecting) until the mid-sync cache handle exists; keep the
+    // query pending rather than parking it in error state, which would
+    // unlatch the large-list guard at the connected flip.
+    retry: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? true : failureCount < 3,
+    retryDelay: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
   })
 
   // Determine if selected kind is a CRD (only CRDs should send ?group= to backend)
@@ -200,8 +211,29 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
   const isSelectedKindGuarded = selectedCountKey !== '' && LARGE_RESOURCE_LIST_GUARD_KEYS.has(selectedCountKey)
   const selectedKindSummaryServed = SUMMARY_LIST_KINDS.has(selectedCountKey)
   const selectedKindRowLimit = selectedKindSummaryServed ? SUMMARY_LIST_LIMIT : LARGE_RESOURCE_LIST_LIMIT
-  const waitingForGuardCount = isSelectedKindGuarded && !countsData && !countsIsError
-  const largeListBlocked = isSelectedKindGuarded && countsData != null && (selectedCountUnavailable || (selectedCountKnown && (selectedCount ?? 0) > selectedKindRowLimit))
+  // While still 'connecting', /resource-counts is unavailable — its error
+  // must NOT unlatch the large-list guard, or a huge Pods list could fetch
+  // unguarded on exactly the clusters the guard protects. Counts arrive
+  // right after 'connected' and settle the guard then.
+  const syncShellActive = connection.state === 'connecting'
+  // A kind whose sync deadline fired is unavailable-with-a-reason: hand it to
+  // the list endpoint, whose 503 kind_sync_failed renders the honest error —
+  // the guard would otherwise trap it on "count unavailable" forever. Safe to
+  // unblock: the server serves no rows for a failed kind.
+  const selectedCountFailedSync =
+    selectedCountUnavailable && countsData?.reasons?.[selectedCountKey] === 'kind_sync_failed'
+  // A guarded kind whose informer hasn't finished reports unavailable with a
+  // kind_sync_pending reason — "count not known YET", so keep the loading
+  // state. Keyed on the reason, not on connection.state: deferred kinds sync
+  // after connect. Reasonless unavailable stays a real verification failure
+  // and blocks the view as before.
+  const selectedCountPendingSync =
+    (selectedCountUnavailable && countsData?.reasons?.[selectedCountKey] === 'kind_sync_pending') ||
+    (syncShellActive && selectedCountUnavailable && !selectedCountFailedSync)
+  const waitingForGuardCount = isSelectedKindGuarded &&
+    ((!countsData && (!countsIsError || syncShellActive)) || selectedCountPendingSync)
+  const largeListBlocked = isSelectedKindGuarded && countsData != null && !selectedCountPendingSync && !selectedCountFailedSync &&
+    (selectedCountUnavailable || (selectedCountKnown && (selectedCount ?? 0) > selectedKindRowLimit))
   const selectedKindQueryBlocked = waitingForGuardCount || largeListBlocked
   const podCount = countsData?.counts.Pod
   const podCountKnown = hasResourceCount(countsData?.counts, 'Pod')
@@ -285,9 +317,15 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
     staleTime: 30000,
     refetchInterval: 120000, // Safety net — SSE k8s_event drives near-real-time invalidation
     retry: (failureCount: number, error: Error) => {
-      if (isForbiddenError(error)) return false
+      if (isForbiddenError(error) || isKindSyncFailed(error)) return false
+      // Cluster still connecting, or this kind's informer still completing
+      // its initial sync: keep the query in its loading state and retry —
+      // the header's sync-progress label explains the wait.
+      if (isStillLoadingError(error)) return true
       return failureCount < 3
     },
+    retryDelay: (failureCount: number, error: Error) =>
+      isStillLoadingError(error) ? 2000 : Math.min(1000 * 2 ** failureCount, 30000),
   })
 
   // Map to ResourceQueryResult shape
@@ -398,7 +436,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       resourceUnavailable={countsData?.unavailable}
       selectedKindQuery={selectedKindQueryResult}
       printerTable={selectedKindQueryBlocked ? null : selectedKindQuery.data?.printerTable ?? null}
-      connectionState={connection.state}
+      connectionState={connection.state === 'connecting' && connection.syncStatus ? 'syncing' : connection.state}
       largeListGuard={largeListGuard}
       onSelectedKindChange={setSelectedKind}
       topPodMetrics={topPodMetrics}

package/src/components/resources/renderers/NamespaceRenderer.tsx

@@ -1,7 +1,7 @@
 import { NamespaceRenderer as BaseNamespaceRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/NamespaceRenderer'
 import type { ResourceRef } from '@skyhook-io/k8s-ui'
 import { useRBACNamespace } from '../../../api/rbac'
-import { useNamespaceQuotas } from '../../../api/quotas'
+import { useNamespaceLimitRanges, useNamespaceQuotas } from '../../../api/quotas'
 import { isForbiddenError } from '../../../api/client'
 
 interface NamespaceRendererProps {
@@ -17,6 +17,9 @@ export function NamespaceRenderer({ data, onNavigate }: NamespaceRendererProps)
   // RBAC sections). Surface other errors (500/503) so a quota-constrained
   // namespace doesn't silently render as quota-free.
   const quotaErr = quotaError && !isForbiddenError(quotaError) ? (quotaError as Error) : null
+  // LimitRanges keep their 403: the section states the denial rather than
+  // hiding, because "no rules apply here" is the wrong thing to imply.
+  const { data: limitRangeData, isLoading: limitRangeLoading, error: limitRangeError } = useNamespaceLimitRanges(name, !!name)
   return (
     <BaseNamespaceRenderer
       data={data}
@@ -25,6 +28,9 @@ export function NamespaceRenderer({ data, onNavigate }: NamespaceRendererProps)
       rbacError={error as Error | null}
       quotaData={quotaData}
       quotaError={quotaErr}
+      limitRangeData={limitRangeData}
+      limitRangeLoading={limitRangeLoading}
+      limitRangeError={limitRangeError}
       onNavigate={onNavigate}
     />
   )

package/src/components/resources/renderers/PodRenderer.tsx

@@ -7,6 +7,7 @@ import { useCapabilitiesContext, useNamespacedCapabilities, useIsLocalDeployment
 import { getVisibleLiveMetrics, isLiveMetricsUnavailable, shouldFetchLiveMetrics, usePodEnvironment, usePodMetrics, usePodMetricsHistory, usePrometheusResourceMetrics, usePrometheusStatus, useRevealPodEnvironment } from '../../../api/client'
 import { useRBACSubject } from '../../../api/rbac'
 import { usePolicyResource } from '../../../api/policy'
+import { podLimitRangeNames, useNamespaceLimitRanges } from '../../../api/quotas'
 import { podAwaitsScheduling } from '../../capacity/podDemandGate'
 import { PortForwardInlineButton } from '../../portforward/PortForwardButton'
 import { ImageFilesystemModal } from '../ImageFilesystemModal'
@@ -79,6 +80,8 @@ export function PodRenderer({ data, onCopy, copied, onNavigate, onOpenLogs, reso
     'pods', namespace ?? '', podName, !!namespace && !!podName,
   )
 
+  const { data: limitRanges, isSuccess: limitRangesReady } = useNamespaceLimitRanges(namespace ?? '', !!namespace)
+
   return (
     <BasePodRenderer
       data={data}
@@ -110,6 +113,7 @@ export function PodRenderer({ data, onCopy, copied, onNavigate, onOpenLogs, reso
       policyData={policyData ?? null}
       policyLoading={policyLoading}
       policyError={policyError as Error | null}
+      namespaceLimitRangeNames={limitRangesReady ? podLimitRangeNames(limitRanges) : undefined}
       canExec={canExec}
       canViewLogs={canViewLogs}
       canPortForward={showPortForward}

package/src/components/resources/renderers/RolloutRenderer.tsx

@@ -1,5 +1,12 @@
 import { RolloutRenderer as BaseRolloutRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/RolloutRenderer'
-import { useRolloutAction, useRolloutCapabilities, type RolloutAction } from '../../../api/client'
+import {
+  useRolloutAction,
+  useRolloutAnalysisRuns,
+  useRolloutCapabilities,
+  useWorkloadRevisions,
+  useWorkloadPods,
+  type RolloutAction,
+} from '../../../api/client'
 
 interface RolloutRendererProps {
   data: any
@@ -11,6 +18,9 @@ export function RolloutRenderer({ data, onNavigate }: RolloutRendererProps) {
   const name = data?.metadata?.name ?? ''
   const { data: capabilities } = useRolloutCapabilities(namespace, name)
   const action = useRolloutAction()
+  const { data: analysisRunsResponse, error: analysisRunsError } = useRolloutAnalysisRuns(namespace, name)
+  const { data: revisions } = useWorkloadRevisions('rollouts', namespace, name)
+  const { data: podsResponse } = useWorkloadPods('rollouts', namespace, name)
 
   return (
     <BaseRolloutRenderer
@@ -19,6 +29,10 @@ export function RolloutRenderer({ data, onNavigate }: RolloutRendererProps) {
       capabilities={capabilities}
       onAction={(next: RolloutAction) => action.mutate({ action: next, namespace, name })}
       pendingAction={action.isPending ? action.variables?.action ?? null : null}
+      analysisRunHistory={analysisRunsResponse?.items}
+      analysisRunHistoryError={analysisRunsError}
+      revisions={revisions}
+      pods={podsResponse?.pods}
     />
   )
 }

package/src/components/resources/renderers/WorkloadRenderer.tsx

@@ -3,6 +3,7 @@ import { useNavigate } from 'react-router-dom'
 import { useScaleWorkload, fetchJSON } from '../../../api/client'
 import { useRBACSubject } from '../../../api/rbac'
 import { usePolicyResource } from '../../../api/policy'
+import { podLimitRangeNames, useNamespaceLimitRanges } from '../../../api/quotas'
 import { useQueries, useQueryClient } from '@tanstack/react-query'
 import { kindToPlural, kindToPluralWithGroup } from '@skyhook-io/k8s-ui/utils/navigation'
 import type { Relationships, ResourceRef, ResourceWithRelationships, WorkloadPodInfo } from '../../../types'
@@ -49,6 +50,7 @@ export function WorkloadRenderer({ kind, data, onNavigate, scaleBlockedBy, workl
   const { data: policyData, isLoading: policyLoading, error: policyError } = usePolicyResource(
     kindToPlural(kind), namespace, metadata.name || '', !!namespace && !!metadata.name,
   )
+  const { data: limitRanges, isSuccess: limitRangesReady } = useNamespaceLimitRanges(namespace, !!namespace)
   const hpaRefs = (scaleBlockedBy ?? []).filter(ref => {
     const refKind = ref.kind.toLowerCase()
     return refKind === 'horizontalpodautoscaler' || refKind === 'hpa'
@@ -96,6 +98,7 @@ export function WorkloadRenderer({ kind, data, onNavigate, scaleBlockedBy, workl
       policyData={policyData ?? null}
       policyLoading={policyLoading}
       policyError={policyError as Error | null}
+      namespaceLimitRangeNames={limitRangesReady ? podLimitRangeNames(limitRanges) : undefined}
       scaleBlockedBy={scaleBlockedBy}
       workloadPods={workloadPods}
       scalerDiagnostics={scalerDiagnostics}

package/src/components/rightsizing/RightsizingScanView.tsx

@@ -799,6 +799,27 @@ function FitWhy({ label, row }: { label: string; row?: RightsizingRow }) {
 }
 
 function EvidenceNote({ row }: { row: RightsizingRow }) {
+  const primary = primaryEvidenceNote(row)
+  // A denied pod read qualifies whichever reason applies rather than standing in
+  // for it: a row can both be unable to check its pods and have a limit conflict,
+  // and hiding either one behind the other loses something the reader needs.
+  const inventory =
+    row.liveInventoryUnavailable && row.resource === 'memory' ? (
+      <p className="mt-1 text-xs text-theme-text-tertiary">
+        Radar could not read this workload&apos;s pods, so it could not check them for
+        out-of-memory restarts.
+      </p>
+    ) : null
+  if (!primary && !inventory) return null
+  return (
+    <>
+      {primary}
+      {inventory}
+    </>
+  )
+}
+
+function primaryEvidenceNote(row: RightsizingRow) {
   if (row.hpaManaged)
     return (
       <p className="mt-1 text-xs text-theme-text-tertiary">