@skyhook-io/radar-app 1.13.5 → 1.14.0

package/src/components/diagnose/investigationEvidence/adapters/resource.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it } from "vitest";
+import { groupsOf, project, tool } from "../evidenceFixtures";
+
+describe("resource cards scaled by an HPA", () => {
+  const scaled = (state: string) =>
+    tool("workload", "diagnose", {
+      resource: {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { namespace: "shop", name: "api" },
+      },
+      resourceContext: {
+        tier: "basic",
+        workloadSummary: { replicas: { desired: 5, ready: 5, available: 5 } },
+        scaledBy: [
+          {
+            kind: "HorizontalPodAutoscaler",
+            namespace: "shop",
+            name: "api-hpa",
+            hpaSummary: {
+              state,
+              summary: "summary from Radar",
+              bounds: { min: 1, max: 5, current: 5, desired: 5 },
+            },
+          },
+        ],
+      },
+    });
+
+  it("lifts a healthy workload whose autoscaler cannot act", () => {
+    const result = project([scaled("metrics_unavailable")]);
+    const card = groupsOf(result.groups, "resource")[0].latest;
+    expect(card.tier).toBe("supporting");
+    expect(card.tone).toBe("warning");
+    expect(card.summary).toBe("5/5 replicas ready · HPA: Metrics unavailable");
+  });
+
+  it("treats a maxed-out autoscaler as adverse", () => {
+    const card = groupsOf(
+      project([scaled("limited_max")]).groups,
+      "resource",
+    )[0].latest;
+    expect(card.tone).toBe("warning");
+    expect(card.summary).toBe("5/5 replicas ready · HPA: Maxed");
+  });
+
+  it("leaves an autoscaler that is simply scaling as context", () => {
+    const card = groupsOf(project([scaled("scaling_up")]).groups, "resource")[0]
+      .latest;
+    expect(card.tier).toBe("context");
+    expect(card.tone).toBe("neutral");
+    expect(card.summary).toBe("5/5 replicas ready");
+  });
+});

package/src/components/diagnose/investigationEvidence/adapters/resource.ts

@@ -0,0 +1,257 @@
+import {
+  type IssueRecentChange,
+  displayKind,
+  englishPlural,
+  kindToPlural,
+} from "@skyhook-io/k8s-ui";
+import { apiVersionToGroup } from "../../../../utils/navigation";
+import {
+  ProjectionBuilder,
+  addChanges,
+  addEvents,
+  addNarrowHint,
+  addResourceObservation,
+  contextFrom,
+  invalidPayload,
+  relevanceForResource,
+  scopeFromArgs,
+} from "../observations";
+import {
+  event,
+  kubernetesResource,
+  nonEmptyString,
+  parseJSON,
+  recentChange,
+  record,
+  resourceSummary,
+  stringArray,
+} from "../parse";
+import {
+  type InvestigationEventEvidence,
+  type InvestigationEvidenceSource,
+  type InvestigationResourceSummary,
+} from "../types";
+
+export function adaptGetResource(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  // Current producer modes are discriminated by the resource's own identity,
+  // never by guessing an undocumented legacy wrapper:
+  //   1. bare Kubernetes resource
+  //   2. {resource, resourceContext, warnings}
+  //   3. the same wrapper with requested extras.
+  // Core Secrets use the producer's deliberately value-free detail shape,
+  // normalized by kubernetesResource above.
+  const bare = kubernetesResource(payload);
+  const wrapper = record(payload);
+  const resource = bare ?? kubernetesResource(wrapper?.resource);
+  if (!resource) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const value = bare ? undefined : wrapper;
+  const context = value ? contextFrom(value.resourceContext) : undefined;
+  if (value?.resourceContext !== undefined && !context) {
+    invalidPayload(builder, source, "Resource context");
+  }
+  const warnings = stringArray(value?.warnings) ?? [];
+  const relevance = relevanceForResource(builder, {
+    kind: resource.kind,
+    group: apiVersionToGroup(resource.apiVersion),
+    namespace: resource.metadata.namespace,
+    name: resource.metadata.name,
+  });
+  addResourceObservation(
+    builder,
+    source,
+    resource,
+    context,
+    warnings,
+    undefined,
+    false,
+    relevance,
+  );
+  if (!value) return;
+  addNarrowHint(builder, source, value);
+
+  const errors: Array<[string, string]> = [
+    ["eventsError", "Events"],
+    ["recentChangesError", "Recent changes"],
+    ["metricsError", "Metrics"],
+    ["revisionsError", "Revisions"],
+    ["includeError", "Requested include"],
+  ];
+  for (const [field, label] of errors) {
+    if (nonEmptyString(value[field])) {
+      builder.limit(source, label, value[field] as string, "error");
+    }
+  }
+
+  if (Array.isArray(value.events)) {
+    const events = value.events
+      .map(event)
+      .filter((item): item is InvestigationEventEvidence => Boolean(item));
+    if (events.length === value.events.length) {
+      addEvents(
+        builder,
+        source,
+        events,
+        `events:get-resource:${scopeFromArgs(source)}`,
+        (typeof value.eventsTotalGroups !== "number" ||
+          value.eventsTotalGroups <= events.length) &&
+          !nonEmptyString(value.eventsError),
+        true,
+        relevance,
+      );
+      if (
+        typeof value.eventsTotalGroups === "number" &&
+        value.eventsTotalGroups > events.length
+      ) {
+        builder.limit(
+          source,
+          "Events",
+          `Radar received ${events.length} of ${value.eventsTotalGroups} event groups.`,
+          "truncated",
+        );
+      }
+    } else {
+      invalidPayload(builder, source, "Events");
+    }
+  }
+  const resourceChangesSubject = {
+    kind: resource.kind,
+    namespace: resource.metadata.namespace,
+    name: resource.metadata.name,
+  };
+  const recentChangesRaw = value.recentChanges;
+  const recentChangesSaturatedRaw = value.recentChangesSaturated;
+  const recentChangesCoverageLimitedRaw = value.recentChangesCoverageLimited;
+  const hasRecentChangesResult =
+    recentChangesRaw !== undefined ||
+    recentChangesSaturatedRaw !== undefined ||
+    recentChangesCoverageLimitedRaw !== undefined;
+  const recentChangesMetadataValid =
+    typeof recentChangesSaturatedRaw === "boolean" &&
+    typeof recentChangesCoverageLimitedRaw === "boolean";
+  if (hasRecentChangesResult && !recentChangesMetadataValid) {
+    invalidPayload(builder, source, "Recent changes");
+  }
+  if (Array.isArray(recentChangesRaw)) {
+    const changes = recentChangesRaw
+      .map(recentChange)
+      .filter((item): item is IssueRecentChange => Boolean(item));
+    if (changes.length === recentChangesRaw.length) {
+      addChanges(
+        builder,
+        source,
+        changes,
+        `changes:get-resource:${scopeFromArgs(source)}`,
+        undefined,
+        recentChangesMetadataValid &&
+          recentChangesSaturatedRaw === false &&
+          recentChangesCoverageLimitedRaw === false &&
+          !nonEmptyString(value.recentChangesError),
+        true,
+        relevance,
+        resourceChangesSubject,
+      );
+    } else {
+      invalidPayload(builder, source, "Recent changes");
+    }
+  } else if (
+    recentChangesRaw === undefined &&
+    recentChangesMetadataValid &&
+    !nonEmptyString(value.recentChangesError)
+  ) {
+    addChanges(
+      builder,
+      source,
+      [],
+      `changes:get-resource:${scopeFromArgs(source)}`,
+      undefined,
+      recentChangesSaturatedRaw === false &&
+        recentChangesCoverageLimitedRaw === false,
+      true,
+      relevance,
+      resourceChangesSubject,
+    );
+  } else if (recentChangesRaw !== undefined) {
+    invalidPayload(builder, source, "Recent changes");
+  }
+  if (recentChangesSaturatedRaw === true) {
+    builder.limit(
+      source,
+      "Recent changes",
+      "The recent-change result limit was reached; additional changes may exist in the requested window.",
+      "truncated",
+    );
+  }
+  if (recentChangesCoverageLimitedRaw === true) {
+    builder.limit(
+      source,
+      "Recent changes",
+      `Change history for ${scopeFromArgs(source)} is incomplete.`,
+      "unknown",
+      "history",
+    );
+  }
+}
+export function adaptListResources(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  if (!Array.isArray(payload)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const resources = payload
+    .map(resourceSummary)
+    .filter((item): item is InvestigationResourceSummary => Boolean(item));
+  if (resources.length !== payload.length) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const scope = scopeFromArgs(source);
+  const args = record(parseJSON(source.args ?? ""));
+  const kinds = [...new Set(resources.map((resource) => resource.kind))];
+  const noun =
+    kinds.length === 1
+      ? kindToPlural(kinds[0]) === kinds[0].toLowerCase()
+        ? displayKind(kinds[0])
+        : englishPlural(displayKind(kinds[0]))
+      : "Resources";
+  const namespace = nonEmptyString(args?.namespace)
+    ? args.namespace
+    : undefined;
+  const title = namespace ? `${noun} in ${namespace}` : noun;
+  if (resources.length === 0) {
+    // list_resources intentionally returns [] for some RBAC-filtered reads;
+    // even a successful transport outcome therefore cannot prove absence.
+    builder.limit(
+      source,
+      "Resource inventory",
+      `Radar found no matching resources for ${scope}. Anything you do not have permission to read was not searched.`,
+      "unknown",
+    );
+    return;
+  }
+  const hasAdverseResource = resources.some((resource) => {
+    const health = resource.summaryContext?.health?.toLowerCase();
+    return (
+      health === "unhealthy" ||
+      health === "degraded" ||
+      (resource.summaryContext?.issueCount ?? 0) > 0
+    );
+  });
+  builder.observe(`inventory:${source.args ?? scope}`, "inventory", source, {
+    tier: "context",
+    relevance: "broader",
+    tone: hasAdverseResource ? "warning" : "neutral",
+    title,
+    summary: `${resources.length} returned${nonEmptyString(args?.group) ? ` · ${args.group}` : ""}`,
+    data: { type: "inventory", resources, scope },
+  });
+}

package/src/components/diagnose/investigationEvidence/adapters/topology.ts

@@ -0,0 +1,207 @@
+import {
+  ProjectionBuilder,
+  addNarrowHint,
+  addTopologyLimitations,
+  invalidPayload,
+  relevanceForResource,
+  scopeFromArgs,
+  topologyPartiality,
+} from "../observations";
+import {
+  nonEmptyString,
+  record,
+  resourceRef,
+  stringArray,
+  topologyEdge,
+  topologyNode,
+} from "../parse";
+import {
+  type InvestigationEvidenceSource,
+  type InvestigationTopologyEdge,
+  type InvestigationTopologyNode,
+} from "../types";
+
+export function adaptNeighborhood(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  const root = resourceRef(value?.root);
+  const subgraph = record(value?.subgraph);
+  if (
+    !value ||
+    !root ||
+    !subgraph ||
+    !Array.isArray(subgraph.nodes) ||
+    !Array.isArray(subgraph.edges) ||
+    typeof value.truncated !== "boolean"
+  ) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const nodes = subgraph.nodes
+    .map(topologyNode)
+    .filter((item): item is InvestigationTopologyNode => Boolean(item));
+  const edges = subgraph.edges
+    .map(topologyEdge)
+    .filter((item): item is InvestigationTopologyEdge => Boolean(item));
+  if (
+    nodes.length !== subgraph.nodes.length ||
+    edges.length !== subgraph.edges.length
+  ) {
+    invalidPayload(builder, source);
+    return;
+  }
+  addNarrowHint(builder, source, value);
+  if (value.truncated === true && !nonEmptyString(value.narrowHint)) {
+    builder.limit(
+      source,
+      "Relationships",
+      "The relationship view reached its resource limit and may be incomplete.",
+      "truncated",
+    );
+  }
+  for (const raw of Array.isArray(value.omitted) ? value.omitted : []) {
+    const omitted = record(raw);
+    if (
+      !omitted ||
+      !nonEmptyString(omitted.field) ||
+      !nonEmptyString(omitted.reason)
+    )
+      continue;
+    builder.limit(
+      source,
+      omitted.field,
+      `Relationship context omitted: ${omitted.reason.replaceAll("_", " ")}.`,
+      omitted.reason === "budget_exceeded" ? "truncated" : "unknown",
+    );
+  }
+  builder.observe(
+    `relationships:${root.group ?? ""}:${root.kind}:${root.namespace ?? ""}:${root.name}`,
+    "relationships",
+    source,
+    {
+      tier: "context",
+      relevance: relevanceForResource(builder, {
+        kind: root.kind,
+        group: root.group ?? "",
+        namespace: root.namespace,
+        name: root.name,
+      }),
+      tone: "info",
+      title: `Relationships around ${root.kind} ${root.name}`,
+      summary: `${nodes.length} nodes · ${edges.length} relationships`,
+      data: {
+        type: "relationships",
+        root,
+        nodes,
+        edges,
+        truncated: value.truncated,
+      },
+    },
+  );
+}
+export function adaptTopology(
+  builder: ProjectionBuilder,
+  source: InvestigationEvidenceSource,
+  payload: unknown,
+): void {
+  const value = record(payload);
+  if (!value) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const partiality = topologyPartiality(value);
+  if (!partiality) {
+    invalidPayload(builder, source, "Topology coverage metadata");
+    return;
+  }
+  const stats = record(value.stats);
+  if (
+    stats &&
+    typeof stats.nodes === "number" &&
+    typeof stats.edges === "number" &&
+    Array.isArray(value.namespaces)
+  ) {
+    const namespaces = value.namespaces.flatMap((raw) => {
+      const namespace = record(raw);
+      const chains = stringArray(namespace?.chains);
+      return namespace && nonEmptyString(namespace.namespace) && chains
+        ? [{ namespace: namespace.namespace, chains }]
+        : [];
+    });
+    if (namespaces.length !== value.namespaces.length) {
+      invalidPayload(builder, source);
+      return;
+    }
+    const problems =
+      value.problems === undefined ? [] : stringArray(value.problems);
+    if (!problems) {
+      invalidPayload(builder, source, "Topology problems");
+      return;
+    }
+    addTopologyLimitations(builder, source, partiality);
+    builder.observe(
+      `topology:${source.args ?? scopeFromArgs(source)}`,
+      "topology",
+      source,
+      {
+        tier: "context",
+        relevance: "broader",
+        tone: problems.length > 0 ? "warning" : "info",
+        title: "Resource topology",
+        summary: `${stats.nodes} nodes · ${stats.edges} relationships`,
+        data: {
+          type: "topology",
+          stats: { nodes: stats.nodes, edges: stats.edges },
+          namespaces,
+          problems,
+          warnings: partiality.warnings,
+        },
+      },
+    );
+    return;
+  }
+
+  if (!Array.isArray(value.nodes) || !Array.isArray(value.edges)) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const nodes = value.nodes
+    .map(topologyNode)
+    .filter((item): item is InvestigationTopologyNode => Boolean(item));
+  const edges = value.edges
+    .map(topologyEdge)
+    .filter((item): item is InvestigationTopologyEdge => Boolean(item));
+  if (
+    nodes.length !== value.nodes.length ||
+    edges.length !== value.edges.length
+  ) {
+    invalidPayload(builder, source);
+    return;
+  }
+  const problems = nodes
+    .filter((node) => node.status === "unhealthy" || node.status === "degraded")
+    .map((node) => `${node.kind} ${node.name}: ${node.status}`);
+  addTopologyLimitations(builder, source, partiality);
+  builder.observe(
+    `topology:${source.args ?? scopeFromArgs(source)}`,
+    "topology",
+    source,
+    {
+      tier: "context",
+      relevance: "broader",
+      tone: problems.length > 0 ? "warning" : "info",
+      title: "Resource topology",
+      summary: `${nodes.length} nodes · ${edges.length} relationships`,
+      data: {
+        type: "topology",
+        stats: { nodes: nodes.length, edges: edges.length },
+        namespaces: [],
+        problems,
+        warnings: partiality.warnings,
+      },
+    },
+  );
+}