@skyhook-io/radar-app 1.14.5 → 1.15.0

package/src/components/nav/PrimaryNavRail.tsx

@@ -14,6 +14,7 @@ import {
   Gauge,
   ShieldCheck,
   Settings,
+  Megaphone,
   PanelLeftClose,
   PanelLeftOpen,
 } from "lucide-react";
@@ -49,9 +50,7 @@ type NavRailView =
 //                content under the cursor).
 //
 // In embedded mode (Radar Hub) this rail is not rendered at all — the host
-// owns the left chrome via its own fleet LeftRail, and Radar falls back to
-// its top-bar pill nav. That keeps the @skyhook-io/radar-app surface
-// non-breaking and avoids triple-stacked left chrome.
+// owns primary view navigation via its own fleet LeftRail.
 
 interface NavItemDef {
   view: NavRailView;
@@ -66,8 +65,7 @@ interface NavItemDef {
 // sits there — next to Cost, its spend-lever sibling. It renders on every
 // cluster (like Issues/Topology): the view itself reads the cluster's capacity
 // posture across all node managers, not just Karpenter. The rail's vertical
-// room lets us surface the views the 8-slot pill bar dropped (Issues,
-// Applications, Cost).
+// room lets us surface every supported standalone destination.
 const NAV_ITEMS: NavItemDef[] = [
   { view: "home", icon: Home, label: "Home" },
   { view: "resources", icon: List, label: "Resources" },
@@ -100,6 +98,8 @@ interface PrimaryNavRailProps {
   // which self-nulls without auth so the row vanishes in no-auth OSS).
   onOpenSettings?: () => void;
   accountSlot?: ReactNode;
+  // Present only when release notes exist for this version; unread adds a dot.
+  whatsNew?: { unread: boolean; onOpen: () => void };
 }
 
 export function PrimaryNavRail({
@@ -110,6 +110,7 @@ export function PrimaryNavRail({
   showPinToggle = true,
   onOpenSettings,
   accountSlot,
+  whatsNew,
 }: PrimaryNavRailProps) {
   return (
     <aside
@@ -160,6 +161,15 @@ export function PrimaryNavRail({
           accountSlot self-nulls without auth, so no-auth OSS shows only Settings. */}
       <nav className="flex flex-col gap-0.5 px-2 pt-1 border-t border-theme-border/50">
         {accountSlot}
+        {whatsNew && (
+          <RailActionRow
+            icon={Megaphone}
+            label="What's new"
+            pinned={pinned}
+            onClick={whatsNew.onOpen}
+            unread={whatsNew.unread}
+          />
+        )}
         {onOpenSettings && (
           <RailActionRow
             icon={Settings}
@@ -340,11 +350,13 @@ export function RailActionRow({
   label,
   pinned,
   onClick,
+  unread = false,
 }: {
   icon: ComponentType<{ className?: string }>;
   label: string;
   pinned: boolean;
   onClick: () => void;
+  unread?: boolean;
 }) {
   return (
     <div className={clsx("group/item relative", !pinned && "w-10")}>
@@ -356,11 +368,18 @@ export function RailActionRow({
           !pinned && "max-w-10 overflow-hidden",
         )}
       >
-        <span className="flex w-10 shrink-0 items-center justify-center">
-          <Icon className="w-[18px] h-[18px] text-theme-text-tertiary group-hover/item:text-theme-text-secondary" />
+        <span className="relative flex w-10 shrink-0 items-center justify-center">
+          <Icon className={clsx(
+            "w-[18px] h-[18px] group-hover/item:text-theme-text-secondary",
+            unread ? "text-accent" : "text-theme-text-tertiary",
+          )} />
+          {unread && (
+            <span aria-hidden className="absolute top-1.5 right-2 h-2 w-2 rounded-full bg-accent ring-2 ring-theme-sidebar" />
+          )}
         </span>
-        <span className={clsx("pr-3 truncate", !pinned && "opacity-0")}>
+        <span className={clsx("pr-3 truncate", !pinned && "opacity-0", unread && "text-theme-text-primary")}>
           {label}
+          {unread && <span className="sr-only"> (unread)</span>}
         </span>
       </button>
       {!pinned && (

package/src/components/resource/PVCUsageBar.render.test.tsx

@@ -0,0 +1,168 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { NavCustomizationProvider } from '../../context/NavCustomization'
+import { ApiError, type PrometheusPVCUsage } from '../../api/client'
+
+let canConfigure = true
+let roleLoading = false
+let statusResult: { data?: { connected: boolean; discovering?: boolean }; error?: Error }
+let usageResult: { data?: PrometheusPVCUsage; error?: Error }
+vi.mock('../../api/client', async (importActual) => ({
+  ...(await importActual<typeof import('../../api/client')>()),
+  usePrometheusPVCUsage: () => usageResult,
+  usePrometheusStatus: () => statusResult,
+  useAutoPromConnect: () => undefined,
+  useCloudRole: () => ({ canAtLeast: () => canConfigure, isLoading: roleLoading }),
+}))
+const { PVCUsageBar } = await import('./PVCUsageBar')
+const measured: PrometheusPVCUsage = { namespace: 'demo', name: 'disk', used: 0, capacity: 1024, ratio: 0, hasData: true, status: 'available' }
+const render = () => renderToString(<PVCUsageBar namespace="demo" name="disk" />)
+
+describe('PVC usage availability', () => {
+  beforeEach(() => {
+    canConfigure = true
+    roleLoading = false
+    statusResult = { data: { connected: true } }
+    usageResult = {}
+  })
+  it.each([
+    ['no_series', 'No usage measurements reported for this volume'],
+    ['invalid_data', 'Volume usage measurements are invalid'],
+    ['query_failed', 'The usage query failed'],
+  ] as const)('explains %s without a gauge', (status, message) => {
+    usageResult = { data: { ...measured, hasData: false, status } }
+    expect(render()).toContain(message)
+    expect(render()).not.toContain('width:')
+  })
+  it('reports discovery as in progress', () => {
+    statusResult = { data: { connected: false, discovering: true } }
+    expect(render()).toContain('Discovering Prometheus')
+    expect(render()).not.toContain('not connected')
+  })
+  it('does not attribute status denial to this PVC', () => {
+    statusResult = { error: new ApiError('forbidden', 403) }
+    expect(render()).toContain('Metrics access denied')
+  })
+  it('keeps older agent unavailable responses from becoming zero gauges', () => {
+    usageResult = { data: { ...measured, status: undefined, hasData: false, capacity: 0 } }
+    expect(render()).toContain('Usage measurements are unavailable')
+    expect(render()).not.toContain('width:')
+  })
+  it('retains older agent valid measurements', () => {
+    usageResult = { data: { ...measured, status: undefined } }
+    expect(render()).toContain('width:0%')
+  })
+  it('renders valid zero usage as a measurement', () => {
+    usageResult = { data: measured }
+    expect(render().replaceAll('<!-- -->', '')).toContain('(0%)')
+    expect(render()).toContain('width:0%')
+  })
+  it('shows loading instead of an empty row', () => {
+    expect(render()).toContain('Loading usage measurements')
+  })
+  it('does not present stale usage after a refresh failure', () => {
+    usageResult = { data: measured, error: new ApiError('failed', 500) }
+    expect(render()).toContain('The usage query failed')
+    expect(render()).not.toContain('width:')
+  })
+  it('does not present stale usage when disconnected', () => {
+    statusResult = { data: { connected: false } }
+    usageResult = { data: measured }
+    expect(render()).toContain('Prometheus is not connected')
+    expect(render()).not.toContain('width:')
+  })
+  it('distinguishes denied access from unavailable measurements', () => {
+    usageResult = { data: measured, error: new ApiError('forbidden', 403) }
+    expect(render()).toContain('access to usage metrics for this PVC')
+    expect(render()).not.toContain('width:')
+  })
+  it('does not reuse metrics if connection status cannot be checked', () => {
+    statusResult = { data: { connected: true }, error: new Error('failed') }
+    usageResult = { data: measured }
+    expect(render()).toContain('Could not check the metrics connection')
+    expect(render()).not.toContain('width:')
+  })
+})
+
+
+describe('PVC metrics next step', () => {
+  beforeEach(() => {
+    canConfigure = true
+    roleLoading = false
+    statusResult = { data: { connected: true } }
+    usageResult = { data: { ...measured, hasData: false, status: 'no_series' } }
+  })
+  it.each(['no_series', 'invalid_data', 'query_failed'] as const)('offers the existing settings flow for %s', status => {
+    usageResult = { data: { ...measured, hasData: false, status } }
+    expect(render()).toContain('Configure metrics')
+    expect(render()).toContain('type="button"')
+  })
+  it('offers configuration when disconnected', () => {
+    statusResult = { data: { connected: false } }
+    expect(render()).toContain('Configure metrics')
+  })
+  it('offers configuration after a status query failure', () => {
+    statusResult = { error: new Error('status failed') }
+    expect(render()).toContain('Configure metrics')
+  })
+  it('offers configuration for older-agent unavailable measurements', () => {
+    usageResult = { data: { ...measured, status: undefined, hasData: false } }
+    expect(render()).toContain('Configure metrics')
+  })
+  it('gives a non-owner factual guidance without a locked-settings link', () => {
+    canConfigure = false
+    expect(render()).not.toContain('Configure metrics')
+    expect(render()).toContain('check metrics availability for this volume')
+    expect(render()).not.toContain('check the metrics connection')
+  })
+  it('gives a non-owner connection guidance only when disconnected', () => {
+    canConfigure = false
+    statusResult = { data: { connected: false } }
+    expect(render()).toContain('check the metrics connection for this cluster')
+    expect(render()).not.toContain('Configure metrics')
+  })
+  it('does not offer inaccessible standalone settings in an embedded host', () => {
+    const text = renderToString(<NavCustomizationProvider value={{ embedded: true }}><PVCUsageBar namespace="demo" name="disk" /></NavCustomizationProvider>)
+    expect(text).not.toContain('Configure metrics')
+    expect(text).toContain('check metrics availability')
+  })
+  it('does not flash an action while permissions load', () => {
+    roleLoading = true
+    expect(render()).not.toContain('Configure metrics')
+    expect(render()).not.toContain('Ask your operator')
+  })
+  it.each(['usage', 'status'])('guides %s denial toward access rather than connection settings', source => {
+    if (source === 'usage') usageResult = { error: new ApiError('forbidden', 403) }
+    else statusResult = { error: new ApiError('forbidden', 403) }
+    expect(render()).not.toContain('Configure metrics')
+    expect(render()).toContain('review your metrics access')
+  })
+  it.each([true, false])('keeps discovery quiet with a retained usage error (owner=%s)', owner => {
+    canConfigure = owner
+    statusResult = { data: { connected: false, discovering: true } }
+    usageResult = { error: new ApiError('retained query failure', 500) }
+    expect(render()).toContain('Discovering Prometheus')
+    expect(render()).not.toContain('Configure metrics')
+    expect(render()).not.toContain('Ask your operator')
+  })
+  it('keeps status loading quiet with a retained usage error', () => {
+    statusResult = {}
+    usageResult = { error: new ApiError('retained query failure', 500) }
+    expect(render()).toContain('Checking metrics availability')
+    expect(render()).not.toContain('Configure metrics')
+  })
+  it('retains access guidance when denied during discovery', () => {
+    statusResult = { data: { connected: false, discovering: true } }
+    usageResult = { error: new ApiError('forbidden', 403) }
+    expect(render()).toContain('review your metrics access')
+    expect(render()).not.toContain('Configure metrics')
+  })
+  it.each(['status', 'discovery', 'usage', 'available'])('does not add an action during %s', state => {
+    if (state === 'status') statusResult = {}
+    if (state === 'discovery') statusResult = { data: { connected: false, discovering: true } }
+    if (state === 'usage') usageResult = {}
+    if (state === 'available') usageResult = { data: measured }
+    expect(render()).not.toContain('Configure metrics')
+    expect(render()).not.toContain('Ask your operator')
+  })
+})

package/src/components/resource/PVCUsageBar.tsx

@@ -1,26 +1,72 @@
 import { formatMemoryBytes } from '@skyhook-io/k8s-ui/utils/format'
-import { useAutoPromConnect, usePrometheusPVCUsage, usePrometheusStatus } from '../../api/client'
-
-/**
- * PVCUsageBar — single-line capacity gauge derived from kubelet_volume_stats_*.
- *
- * Hidden silently when:
- *  - Prometheus isn't connected
- *  - The CSI driver doesn't implement NodeGetVolumeStats
- *  - Prometheus isn't scraping kubelet endpoints (notably GMP default config)
- *
- * Operators get nothing rather than a "no data" message that'd look like Radar
- * is broken — the absence is information enough.
- */
+import { isForbiddenError, useAutoPromConnect, useCloudRole, usePrometheusPVCUsage, usePrometheusStatus } from '../../api/client'
+import { useNavCustomization } from '../../context/NavCustomization'
+
 export function PVCUsageBar({ namespace, name }: { namespace: string; name: string }) {
   // PVC detail can be the first Prometheus-backed surface a user opens; without
   // this, the gauge silently stays hidden until they open a workload metrics tab.
   useAutoPromConnect()
-  const { data: status } = usePrometheusStatus()
+  const { canAtLeast, isLoading: roleLoading } = useCloudRole()
+  const settingsAvailable = !useNavCustomization().embedded
+  const canConfigure = settingsAvailable && !roleLoading && canAtLeast('owner')
+  const { data: status, error: statusError } = usePrometheusStatus()
   const isConnected = status?.connected === true
-  const { data: usage } = usePrometheusPVCUsage(namespace, name, isConnected)
+  const { data: usage, error } = usePrometheusPVCUsage(namespace, name, isConnected)
+
+  let unavailable: string | undefined
+  if (isForbiddenError(error)) {
+    unavailable = "You don't have access to usage metrics for this PVC."
+  } else if (isForbiddenError(statusError)) {
+    unavailable = 'Metrics access denied.'
+  } else if (statusError) {
+    unavailable = 'Could not check the metrics connection.'
+  } else if (!status) {
+    unavailable = 'Checking metrics availability…'
+  } else if (status.discovering) {
+    unavailable = 'Discovering Prometheus…'
+  } else if (!isConnected) {
+    unavailable = 'Prometheus is not connected. Used space is unknown.'
+  } else if (error || usage?.status === 'query_failed') {
+    unavailable = 'The usage query failed. Used space is unknown.'
+  } else if (!usage) {
+    unavailable = 'Loading usage measurements…'
+  } else if (usage.status === 'no_series') {
+    unavailable = 'No usage measurements reported for this volume.'
+  } else if (usage.status === 'invalid_data') {
+    unavailable = 'Volume usage measurements are invalid. Used space is unknown.'
+  } else if (!usage.hasData) {
+    unavailable = 'Usage measurements are unavailable.'
+  }
+
+  const denied = isForbiddenError(error) || isForbiddenError(statusError)
+  const waiting = !denied && !statusError && (!status || status.discovering || (isConnected && !usage && !error))
+  const guidance = denied
+    ? 'Ask your operator to review your metrics access.'
+    : !canConfigure && !roleLoading
+      ? !isConnected || statusError
+        ? 'Ask your operator to check the metrics connection for this cluster.'
+        : 'Ask your operator to check metrics availability for this volume.'
+      : undefined
 
-  if (!usage || !usage.hasData) return null
+  if (unavailable || !usage) {
+    return (
+      <section aria-label="PVC usage" className="rounded-lg border border-theme-border bg-theme-surface/30 p-3">
+        <div className="text-xs font-medium text-theme-text-secondary uppercase tracking-wide mb-1">Usage</div>
+        <p className="text-sm text-theme-text-tertiary">{unavailable}</p>
+        {!waiting && (
+          canConfigure && !denied ? (
+            <button
+              type="button"
+              className="mt-2 text-xs text-accent hover:underline"
+              onClick={() => window.dispatchEvent(new CustomEvent('radar:open-settings', { detail: { section: 'prometheus' } }))}
+            >Configure metrics</button>
+          ) : guidance ? (
+            <p className="mt-2 text-xs text-theme-text-tertiary">{guidance}</p>
+          ) : null
+        )}
+      </section>
+    )
+  }
 
   const pct = Math.max(0, Math.min(1, usage.ratio))
   const usedLabel = formatMemoryBytes(usage.used)

package/src/components/resource/PrometheusChartsGrid.render.test.tsx

@@ -30,7 +30,7 @@ vi.mock('@skyhook-io/k8s-ui/components/charts', async (importActual) => ({
 const { PrometheusChartsGrid } = await import('./PrometheusChartsGrid')
 const resource = { spec: { template: { spec: { containers: [{ resources: { requests: { cpu: '100m' }, limits: { cpu: '200m' } } }] } } } }
 const render = (url = '/workloads/Deployment/demo/web?tab=metrics', embedded = false) => renderToString(
-  <MemoryRouter initialEntries={[url]}><NavCustomizationProvider value={embedded ? { embedded: true, rightExtras: null } : {}}>
+  <MemoryRouter initialEntries={[url]}><NavCustomizationProvider value={embedded ? { embedded: true } : {}}>
     <PrometheusChartsGrid kind="Deployment" namespace="demo" name="web" resource={resource} />
   </NavCustomizationProvider></MemoryRouter>,
 )

package/src/components/resources/ResourcesView.tsx

@@ -179,14 +179,14 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
 
   // Cluster Audit findings for the selected kind, keyed by "namespace/name" for
   // the resource list. The list shows ONE kind at a time, so ns/name is enough;
-  // we still match the finding's group (built-ins → real group, CRDs → "") so a
+  // we still match the finding's group for every resource so a
   // kind shared across groups doesn't bleed findings across the two lists. Only
   // "badge-worthy" findings count (reference-integrity / lifecycle) — posture
   // and best-practice nags fire near-universally and would just be noise.
   const audit = useAudit(namespaces)
   const auditBadges = useMemo(() => {
     if (!selectedKind || !audit.data?.findings) return undefined
-    const wantGroup = isSelectedCrd ? '' : selectedKind.group
+    const wantGroup = selectedKind.group
     const map: Record<string, { danger: number; warning: number; messages: AuditBadgeMessage[] }> = {}
     for (const f of audit.data.findings) {
       if (f.kind !== selectedKindCanonical || (f.group ?? '') !== wantGroup) continue
@@ -202,7 +202,7 @@ export function ResourcesView({ namespaces, selectedResource, onResourceClick, o
       cur.messages.sort((a, b) => (a.severity === 'danger' ? 0 : 1) - (b.severity === 'danger' ? 0 : 1))
     }
     return map
-  }, [audit.data?.findings, audit.data?.checks, selectedKind, selectedKindCanonical, isSelectedCrd])
+  }, [audit.data?.findings, audit.data?.checks, selectedKind, selectedKindCanonical])
 
   const selectedCountKey = selectedKind ? resourceCountKey(selectedKind) : ''
   const selectedCount = selectedCountKey ? countsData?.counts[selectedCountKey] : undefined

package/src/components/resources/renderers/CAPIClusterRenderer.tsx

@@ -0,0 +1,8 @@
+import { CAPIClusterRenderer as BaseCAPIClusterRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/CAPIClusterRenderer'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useCapabilities } from '../../../api/client'
+
+export function CAPIClusterRenderer({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const { data: capabilities } = useCapabilities()
+  return <BaseCAPIClusterRenderer data={data} onNavigate={onNavigate} canConnect={capabilities != null && capabilities.configManagement !== 'operator'} />
+}

package/src/components/resources/renderers/JobAdmissionRenderers.test.tsx

@@ -0,0 +1,18 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it, vi } from 'vitest'
+import { JobRenderer, JobSetRenderer } from './JobAdmissionRenderers'
+vi.mock('../../execution/JobSetAdmission', () => ({ KueueAdmission: ({ presentation }: { presentation?: string }) => <div data-presentation={presentation}>admission evidence</div> }))
+const job = { apiVersion: 'batch/v1', kind: 'Job', metadata: { name: 'training', namespace: 'ml' }, status: { conditions: [{ type: 'Failed', status: 'True', reason: 'BackoffLimitExceeded' }] } }
+describe('admission renderer composition', () => {
+ it('keeps Job failure above admission evidence', () => {
+  const html = renderToStaticMarkup(<JobRenderer data={job} />)
+  expect(html).toContain('data-presentation="drawer"')
+  expect(html.indexOf('Job Issues')).toBeLessThan(html.indexOf('admission evidence'))
+ })
+ it('does not mount batch admission for a colliding Job kind', () => {
+  expect(renderToStaticMarkup(<JobRenderer data={{...job, apiVersion:'batch.volcano.sh/v1alpha1'}} />)).not.toContain('admission evidence')
+ })
+ it('mounts admission in the JobSet drawer', () => {
+  expect(renderToStaticMarkup(<JobSetRenderer data={{...job, apiVersion:'jobset.x-k8s.io/v1alpha2',kind:'JobSet'}} />)).toContain('admission evidence')
+ })
+})

package/src/components/resources/renderers/JobAdmissionRenderers.tsx

@@ -0,0 +1,18 @@
+import { JobRenderer as BaseJobRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/JobRenderer'
+import { JobSetRenderer as BaseJobSetRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/JobSetRenderer'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { KueueAdmission } from '../../execution/JobSetAdmission'
+
+type Props = { data: any; onNavigate?: (ref: ResourceRef) => void }
+
+export function JobRenderer({ data, onNavigate }: Props) {
+  return <BaseJobRenderer data={data} admissionContent={
+    data.apiVersion === 'batch/v1' && data.kind === 'Job' && <KueueAdmission presentation="drawer" resource={data} namespace={data.metadata.namespace} name={data.metadata.name} onNavigate={onNavigate} />
+  } />
+}
+
+export function JobSetRenderer({ data, onNavigate }: Props) {
+  return <BaseJobSetRenderer data={data} admissionContent={
+    <KueueAdmission presentation="drawer" resource={data} namespace={data.metadata.namespace} name={data.metadata.name} onNavigate={onNavigate} />
+  } />
+}

package/src/components/resources/renderers/KueueWorkloadRenderer.test.tsx

@@ -0,0 +1,39 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { KueueWorkloadRenderer } from './KueueWorkloadRenderer'
+
+const mock = vi.hoisted(() => ({ query: {} as any }))
+vi.mock('../../../api/client', () => ({ useKueueProvisioning: () => mock.query }))
+const data = { metadata: { name: 'work', namespace: 'ml', uid: 'new' }, status: { admissionChecks: [{ name: 'capacity', state: 'Rejected', message: 'Capacity unavailable' }] } }
+const render = () => renderToStaticMarkup(<KueueWorkloadRenderer data={data} />)
+
+describe('Workload provisioning observation', () => {
+  beforeEach(() => { mock.query = {} })
+  it('never reports failed or old-generation lookups as an empty collection', () => {
+    mock.query = { error: new Error('no access to list ProvisioningRequests'), data: { uid: 'new', requests: [] } }
+    expect(render()).toContain('Could not observe')
+    expect(render()).not.toContain('No retained')
+    mock.query = { data: { uid: 'old', installed: true, requests: [{ metadata: { name: 'old-request' } }] } }
+    expect(render()).toContain('Looking for')
+    expect(render()).not.toContain('old-request')
+  })
+  it('keeps the rejected explanation when requests have already been cleaned up', () => {
+    mock.query = { data: { uid: 'new', installed: true, requests: [], total: 0 } }
+    expect(render()).toContain('Capacity unavailable')
+    expect(render()).toContain('may have been cleaned up')
+    mock.query.data.installed = false
+    expect(render()).toContain('API is not served')
+    expect(render()).not.toContain('No retained')
+  })
+  it('shows retained request state before PodSets without inferring check membership', () => {
+    mock.query = { data: { uid: 'new', installed: true, total: 21, truncated: true, requests: [{
+      metadata: { name: 'request-1', namespace: 'ml', uid: 'request-id' }, spec: { provisioningClassName: 'test.invalid' },
+      status: { conditions: [{ type: 'Failed', status: 'True', message: 'No capacity' }] },
+    }] } }
+    const html = render()
+    expect(html).toContain('request-1')
+    expect(html).toContain('Showing 1 of 21')
+    expect(html.indexOf('Provisioning Requests')).toBeLessThan(html.indexOf('Pod Sets'))
+    expect(html).toContain('not a retry history')
+  })
+})

package/src/components/resources/renderers/KueueWorkloadRenderer.tsx

@@ -0,0 +1,37 @@
+import { Boxes } from 'lucide-react'
+import { KueueWorkloadRenderer as BaseRenderer } from '@skyhook-io/k8s-ui/components/resources/renderers/KueueWorkloadRenderer'
+import { getProvisioningRequestStatus, getProvisioningRequestMessage } from '@skyhook-io/k8s-ui/components/resources/resource-utils-kueue'
+import { Badge, ResourceLink, Section, type ResourceRef } from '@skyhook-io/k8s-ui'
+import { useKueueProvisioning } from '../../../api/client'
+
+export function KueueWorkloadRenderer({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const namespace = data.metadata?.namespace ?? ''
+  const uid = data.metadata?.uid
+  const hasChecks = (data.status?.admissionChecks?.length ?? 0) > 0
+  const requests = useKueueProvisioning(namespace, data.metadata?.name ?? '', uid, hasChecks)
+  const current = requests.data?.uid === uid ? requests.data : undefined
+  const provisioning = hasChecks ? <Section title="Provisioning Requests" icon={Boxes} defaultExpanded>
+      {requests.error ? <p className="text-sm text-warning-text">Could not observe provisioning requests: {requests.error.message}</p>
+        : !current ? <p className="text-sm text-theme-text-tertiary">Looking for provisioning requests…</p>
+          : !current.installed ? <p className="text-sm text-theme-text-tertiary">The ProvisioningRequest API is not served by this cluster.</p>
+            : current.requests.length === 0 ? <p className="text-sm text-theme-text-tertiary">No retained provisioning requests found on this cluster. A request may not be needed or may have been cleaned up. Check results above retain the controller’s explanation; requests on a MultiKueue worker cluster are not included.</p>
+              : <div className="space-y-2">
+                <p className="text-xs text-theme-text-tertiary">Currently retained requests owned by this Workload, not a retry history. Requests may be removed after completion or eviction.</p>
+                {current.requests.map(request => {
+                  const status = getProvisioningRequestStatus(request)
+                  const message = getProvisioningRequestMessage(request)
+                  return <div key={request.metadata.uid} className="card-inner">
+                    <div className="flex flex-wrap items-center gap-2 break-all [&_button]:text-left">
+                      <ResourceLink kind="provisioningrequests" group="autoscaling.x-k8s.io" namespace={namespace} name={request.metadata.name} onNavigate={onNavigate} />
+                      <Badge colorClass={status.color} size="sm">{status.text}</Badge>
+                      {request.metadata.deletionTimestamp && <Badge severity="neutral" size="sm">Deleting</Badge>}
+                    </div>
+                    <p className="mt-1 break-all text-xs text-theme-text-tertiary">{request.spec.provisioningClassName}</p>
+                    {message && <p className="mt-1 whitespace-pre-wrap break-words text-sm text-theme-text-secondary">{message}</p>}
+                  </div>
+                })}
+                {current.truncated && <p className="text-xs text-theme-text-tertiary">Showing {current.requests.length} of {current.total} retained requests, newest first.</p>}
+              </div>}
+    </Section> : undefined
+  return <BaseRenderer data={data} onNavigate={onNavigate} provisioning={provisioning} />
+}

package/src/components/resources/renderers/RayClusterRenderer.test.tsx

@@ -0,0 +1,18 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { RayClusterRenderer } from './RayClusterRenderer'
+const mock = vi.hoisted(() => ({ result: {} as any, calls: [] as any[] }))
+vi.mock('../../../api/client', () => ({ useWorkloadPods: (...args: any[]) => { mock.calls.push(args); return mock.result } }))
+const root = { apiVersion: 'ray.io/v1', kind: 'RayCluster', metadata: { name: 'cluster', namespace: 'ml', uid: 'current' } }
+describe('RayCluster host evidence', () => {
+  beforeEach(() => { mock.result = {}; mock.calls = [] })
+  it('makes one bounded UID-bound query with polling', () => {
+    renderToStaticMarkup(<RayClusterRenderer data={root} />)
+    expect(mock.calls).toEqual([['rayclusters', 'ml', 'cluster', { ownerUID: 'current', limit: 200, refetchInterval: 5000 }]])
+  })
+  it.each(['Forbidden', 'Cache warming', 'RayCluster was recreated'])('surfaces %s without claiming an empty cluster', message => {
+    mock.result = { error: new Error(message) }
+    const html = renderToStaticMarkup(<RayClusterRenderer data={root} />)
+    expect(html).toContain(message); expect(html).not.toContain('No directly owned Pods')
+  })
+})

package/src/components/resources/renderers/RayClusterRenderer.tsx

@@ -0,0 +1,17 @@
+import { useState } from 'react'
+import { RayClusterRenderer as BaseRenderer, type RayClusterPodSelection } from '@skyhook-io/k8s-ui/components/resources/renderers/RayClusterRenderer'
+import type { ResourceRef } from '@skyhook-io/k8s-ui'
+import { useWorkloadPods } from '../../../api/client'
+
+export function RayClusterRenderer(props: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  return <RayClusterEvidence key={props.data.metadata.uid} {...props} />
+}
+
+function RayClusterEvidence({ data, onNavigate }: { data: any; onNavigate?: (ref: ResourceRef) => void }) {
+  const [requestedSelection, setSelection] = useState<RayClusterPodSelection>({})
+  const selection = requestedSelection.workerGroup != null && !(data.spec?.workerGroupSpecs ?? []).some((group: any) => group.groupName === requestedSelection.workerGroup) ? {} : requestedSelection
+  const query = useWorkloadPods('rayclusters', data.metadata.namespace, data.metadata.uid ? data.metadata.name : '', {
+    ownerUID: data.metadata.uid, ...selection, limit: 200, refetchInterval: 5000,
+  })
+  return <BaseRenderer data={data} onNavigate={onNavigate} selection={selection} onSelectPods={setSelection} podEvidence={query.data} podsLoading={query.isLoading} podsError={query.error?.message} />
+}

package/src/components/resources/renderers/RayJobRenderer.test.tsx

@@ -0,0 +1,40 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { RayJobRenderer } from './RayJobRenderer'
+import { ApiError } from '../../../api/client'
+const mock = vi.hoisted(() => ({ query: {} as any, reads: [] as any[] }))
+vi.mock('../../../api/client', () => ({ ApiError: class extends Error { constructor(message: string, public status: number) { super(message) } }, useResource: (...args: any[]) => { mock.reads.push(args); return mock.query } }))
+vi.mock('../../execution/JobSetAdmission', () => ({ KueueAdmission: () => null }))
+const root = { apiVersion: 'ray.io/v1', kind: 'RayJob', metadata: { name: 'train', namespace: 'ml', uid: 'root' }, spec: {} }
+const child = { apiVersion: 'batch/v1', kind: 'Job', metadata: { name: 'train', namespace: 'ml', ownerReferences: [{ apiVersion: 'ray.io/v1', kind: 'RayJob', name: 'train', uid: 'root', controller: true }] }, spec: {}, status: {} }
+const render = (data: any = root) => renderToStaticMarkup(<RayJobRenderer data={data} onNavigate={() => {}} />)
+describe('RayJob child reads', () => {
+  beforeEach(() => { mock.query = {}; mock.reads = [] })
+  it('reads the exact submitter candidate and accepts only the controller incarnation', () => {
+    mock.query = { data: child }
+    expect(render()).toContain('Open this Job for submitter Pods')
+    expect(mock.reads).toEqual([['jobs', 'ml', 'train', 'batch']])
+    expect(render({ ...root, metadata: { ...root.metadata, uid: 'recreated' } })).toContain('ownership mismatch')
+  })
+  it.each([
+    { ...child, apiVersion: 'batch.volcano.sh/v1alpha1' },
+    { ...child, metadata: { ...child.metadata, namespace: 'other' } },
+    { ...child, metadata: { ...child.metadata, ownerReferences: [{ ...child.metadata.ownerReferences[0], controller: false }] } },
+  ])('rejects wrong identity', data => { mock.query = { data }; expect(render()).toContain('ownership mismatch') })
+  it.each(['HTTPMode', 'SidecarMode', 'InteractiveMode', 'FutureMode'])('does not read a submitter in %s', submissionMode => { render({ ...root, spec: { submissionMode } }); expect(mock.reads).toEqual([]) })
+  it('does not read remote children, including selected clusters', () => { render({ ...root, spec: { managedBy: 'remote', clusterSelector: { 'ray.io/cluster': 'shared' } } }); expect(mock.reads).toEqual([]) })
+  it('keeps missing and denied observations distinct, even with cached data', () => {
+    mock.query = { data: child, error: new ApiError('not found', 404) }
+    expect(render()).toContain('No submitter Job observed')
+    mock.query.error = new ApiError('denied', 403)
+    expect(render()).toContain('Submitter evidence unavailable')
+    expect(render()).not.toContain('Open this Job')
+  })
+  it('keeps deleting submitter logs reachable without declaring a current attempt', () => {
+    mock.query = { data: { ...child, metadata: { ...child.metadata, deletionTimestamp: '2026-09-27T00:00:00Z' } } }
+    const html = render({ ...root, status: { jobDeploymentStatus: 'Retrying' } })
+    expect(html).toContain('Deleting')
+    expect(html).toContain('attempt being cleaned up')
+    expect(html).toContain('Open this Job')
+  })
+})