@skyhook-io/radar-app 1.16.3 → 1.17.1

package/src/components/cnpg/actions/actionModel.ts

@@ -0,0 +1,127 @@
+import { cnpgFormatLag } from '@skyhook-io/k8s-ui'
+import { formatBytes } from '../lsn'
+import type { CNPGBackupMethod } from '../../../api/cnpg'
+import type { ActionCapability } from '../../../api/actions'
+
+export interface StandbyChoice {
+  pod: string
+  podUID: string
+  ineligible?: string
+  /** pg_stat_replication replay_lag: the recent replay delay, which can stay high after the standby caught up. */
+  replayLagSeconds?: number
+  /** WAL the primary has written that this standby has not replayed, in bytes: what it still has to catch up on. */
+  replayBacklogBytes?: number
+  state?: string
+  syncState?: string
+  /** What the live read shows wrong with it as a new primary: not connected, replay paused, another timeline. */
+  concerns?: SwitchoverConcern[]
+}
+
+function pad(n: number) {
+  return String(n).padStart(2, '0')
+}
+
+/** `<cluster>-<yyyymmddhhmmss>` in UTC, the name kubectl-cnpg uses. */
+export function backupNameFor(cluster: string, now = new Date()): string {
+  const ts = `${now.getUTCFullYear()}${pad(now.getUTCMonth() + 1)}${pad(now.getUTCDate())}${pad(now.getUTCHours())}${pad(now.getUTCMinutes())}${pad(now.getUTCSeconds())}`
+  return `${cluster}-${ts}`
+}
+
+export function describeBackupMethod(m: CNPGBackupMethod): string {
+  switch (m.method) {
+    case 'plugin':
+      return `Plugin ${m.pluginName ?? ''}${m.capability === 'unknown' ? ' (backup support not reported)' : ''}`.trim()
+    case 'volumeSnapshot':
+      return 'Volume snapshot'
+    default:
+      return 'Barman object store (in-tree, deprecated)'
+  }
+}
+
+/**
+ * Synchronous standbys first, then the least WAL still to replay, then the
+ * least replay delay. Never an ineligible one, and never one the live read
+ * shows trouble with: when only such standbys remain, the user picks.
+ */
+export function pickDefaultStandby(standbys: StandbyChoice[]): StandbyChoice | undefined {
+  const eligible = standbys.filter((s) => !s.ineligible && !(s.concerns?.length ?? 0))
+  const rank = (s: StandbyChoice) => (s.syncState === 'sync' || s.syncState === 'quorum' ? 0 : 1)
+  const inf = Number.POSITIVE_INFINITY
+  return [...eligible].sort(
+    (a, b) =>
+      rank(a) - rank(b) ||
+      (a.replayBacklogBytes ?? inf) - (b.replayBacklogBytes ?? inf) ||
+      (a.replayLagSeconds ?? inf) - (b.replayLagSeconds ?? inf),
+  )[0]
+}
+
+/** The switchover target: the default pick until the user has chosen one (or the dialog opened on one). */
+export function switchoverDefault(input: { touched: boolean; current: string | undefined; standbys: StandbyChoice[] }): string | undefined {
+  return input.touched ? input.current : pickDefaultStandby(input.standbys)?.pod
+}
+
+/** The live facts that make a standby a poor switchover target, in the words the dialog shows. */
+export interface SwitchoverConcern {
+  code: 'not_receiving' | 'replay_paused' | 'timeline_mismatch'
+  text: string
+}
+
+export function switchoverConcerns(
+  primary: { state: string; timeline?: number; replication?: { applicationName: string; state?: string }[] | null } | undefined,
+  standby: { pod: string; status: { state: string; timeline?: number; replayPaused?: boolean; roleDetail?: string } } | undefined,
+): SwitchoverConcern[] {
+  if (!primary || !standby) return []
+  const out: SwitchoverConcern[] = []
+  if (primary.state === 'ok' && primary.replication && !primary.replication.some((r) => r.applicationName === standby.pod)) out.push({ code: 'not_receiving', text: 'not connected to the primary' })
+  if (standby.status.replayPaused || standby.status.roleDetail === 'replayPaused') out.push({ code: 'replay_paused', text: 'replay paused' })
+  // An instance reports the timeline of its last checkpoint, which on a
+  // standby lags until its next restartpoint. One streaming from the current
+  // primary follows the primary's timeline whatever it reports.
+  const streaming = !!primary.replication?.some((r) => r.applicationName === standby.pod && r.state === 'streaming')
+  if (!streaming && standby.status.timeline !== undefined && primary.timeline !== undefined && standby.status.timeline !== primary.timeline) {
+    out.push({ code: 'timeline_mismatch', text: `timeline ${standby.status.timeline}, primary on ${primary.timeline}` })
+  }
+  return out
+}
+
+/** The warning for a chosen target the live read shows trouble with; nothing it says depends on how CloudNativePG then handles the promotion. */
+export function switchoverConcernWarning(pod: string, concerns: SwitchoverConcern[]): string | null {
+  if (concerns.length === 0) return null
+  const notReceiving = concerns.some((c) => c.code === 'not_receiving')
+  return `${pod}: ${concerns.map((c) => c.text).join(' · ')}. ${notReceiving ? 'It is not receiving WAL from the current primary, so writes since then reach it only if it replays them from the WAL archive, and ' : ''}Radar cannot measure how far behind it is. Check its logs, or pick a streaming standby.`
+}
+
+/**
+ * What blocks destroying an instance, for the dialog's alert. The missing
+ * fence is left out when the dialog already offers "Fence first": saying it
+ * again as an alert only repeats the callout. The server checks the fence
+ * after every other state guard, so its reason names the fence only when
+ * nothing else blocks.
+ */
+export function cnpgDestroyBlocker(cap: ActionCapability | undefined, fenceOffered: boolean): string | undefined {
+  if (!cap || cap.allowed) return undefined
+  if (fenceOffered && cap.permission !== 'denied' && cap.reasonCode === 'fence_required') return undefined
+  return cap.reason ?? 'Not allowed'
+}
+
+/**
+ * The note under a switchover candidate that still has WAL to replay. The
+ * new primary replays it before it takes over, so the switchover can take
+ * longer; nothing is lost by choosing it. Based on the LSN backlog, not on
+ * replay_lag, which is a recent delay and stays high after a standby caught up.
+ */
+export function switchoverLagNote(s: Pick<StandbyChoice, 'pod' | 'replayBacklogBytes' | 'state'>): string | undefined {
+  const b = s.replayBacklogBytes
+  if (b === undefined || b <= 0) return undefined
+  // No pg_stat_replication row: it isn't receiving WAL, so "catches up" would be a guess.
+  if (s.state === undefined) return `${s.pod} has ${formatBytes(b)} of WAL still to replay and isn't connected to the primary to receive it.`
+  return `${s.pod} has ${formatBytes(b)} of WAL still to replay; the switchover may take longer while it catches up.`
+}
+
+/** A switchover candidate's catch-up facts: the backlog first, then the replay delay. */
+export function switchoverCandidateFacts(s: Pick<StandbyChoice, 'replayBacklogBytes' | 'replayLagSeconds'>): string[] {
+  return [
+    s.replayBacklogBytes !== undefined ? `backlog ${formatBytes(s.replayBacklogBytes)}` : null,
+    s.replayLagSeconds !== undefined ? `replay delay ${cnpgFormatLag(s.replayLagSeconds)}` : null,
+  ].filter((x): x is string => !!x)
+}

package/src/components/cnpg/actions/renderCNPGHeaderActions.tsx

@@ -0,0 +1,60 @@
+import { useRadarFeature } from '../../../api/client'
+import type { ReactNode } from 'react'
+import { CNPG_BARMAN_OBJECTSTORE_GROUP, isApiGroup, type NavigateToResource } from '@skyhook-io/k8s-ui'
+import { CNPGClusterActions } from './CNPGClusterActions'
+import { CNPGConnectButton } from './CNPGConnectButton'
+import { CNPGScheduleActions } from './CNPGScheduleActions'
+import { CNPGPoolerActions } from './CNPGPoolerActions'
+import { CNPGOperationTracker } from '../operations/CNPGOperationTracker'
+import { CNPGRestoreButton } from '../recovery/CNPGRestoreButton'
+
+function backupRestoreBlocker(b: any): string | undefined {
+  if (b?.status?.phase !== 'completed') return 'Only a completed Backup can be restored'
+  const plugin = b?.spec?.method === 'plugin' || b?.status?.method === 'plugin'
+  if (plugin && !b?.status?.backupId) return 'The Backup records no backup ID, which a plugin restore needs'
+  return undefined
+}
+
+function headerActions({
+  resource,
+  namespace,
+  name,
+  compact,
+  onNavigate,
+}: {
+  resource: any
+  namespace: string
+  name: string
+  compact: boolean
+  onNavigate?: NavigateToResource
+}): ReactNode {
+  if (isApiGroup(resource?.apiVersion, CNPG_BARMAN_OBJECTSTORE_GROUP) && resource.kind === 'ObjectStore') {
+    return <CNPGRestoreButton namespace={namespace} entry={{ kind: 'objectStore', name }} compact={compact} />
+  }
+  if (!isApiGroup(resource?.apiVersion, 'postgresql.cnpg.io')) return null
+  if (resource.kind === 'Cluster') {
+    return (
+      <div className="flex items-center gap-1.5">
+        <CNPGOperationTracker namespace={namespace} name={name} uid={resource.metadata.uid} />
+        <CNPGConnectButton namespace={namespace} name={name} compact={compact} onNavigate={onNavigate} />
+        <CNPGClusterActions namespace={namespace} name={name} compact={compact} />
+      </div>
+    )
+  }
+  if (resource.kind === 'Backup') {
+    return <CNPGRestoreButton namespace={namespace} entry={{ kind: 'backup', name }} disabledReason={backupRestoreBlocker(resource)} compact={compact} />
+  }
+  if (resource.kind === 'ScheduledBackup') return <CNPGScheduleActions namespace={namespace} name={name} />
+  if (resource.kind === 'Pooler') return <CNPGPoolerActions namespace={namespace} name={name} />
+  return null
+}
+
+
+function CNPGHeaderActionsForServer(props: Parameters<typeof headerActions>[0]) {
+  const { support } = useRadarFeature('cnpgWorkspace')
+  return support === 'supported' ? headerActions(props) : null
+}
+
+export function renderCNPGHeaderActions(props: Parameters<typeof headerActions>[0]): ReactNode {
+  return <CNPGHeaderActionsForServer {...props} />
+}

package/src/components/cnpg/actions/useCNPGWriteGuard.tsx

@@ -0,0 +1,58 @@
+import { useState, type ReactNode } from 'react'
+import { GitOpsWriteWarning, canConfirmGitOpsWrite, gitOpsRouteForOwner, type GitOpsWrite } from '@skyhook-io/k8s-ui'
+import { useGitOpsWriteGuard } from '../../../hooks/useGitOpsWriteGuard'
+import { useCNPGNavigate } from '../useCNPGNavigate'
+
+export type CNPGWriteScope =
+  | { kind: 'status' }
+  | { kind: 'metadata' | 'spec'; paths: string[] }
+  | { kind: 'create-child' }
+  | { kind: 'delete-operator-owned'; owner: string }
+
+/**
+ * The shared GitOps write guard for a CNPG action on `name` (a Cluster unless
+ * `targetKind` says otherwise). Returns the warning block and whether the
+ * dialog may confirm.
+ */
+export function useCNPGWriteGuard({
+  namespace,
+  name,
+  scope,
+  targetKind = 'Cluster',
+}: {
+  namespace: string
+  name: string
+  scope: CNPGWriteScope
+  targetKind?: string
+}): { node: ReactNode; satisfied: boolean } {
+  const navigate = useCNPGNavigate()
+  const [acked, setAcked] = useState(false)
+  const operatorOwned = scope.kind === 'delete-operator-owned'
+  const writes: GitOpsWrite[] = operatorOwned
+    ? []
+    : [{ scope: scope.kind, paths: 'paths' in scope ? scope.paths : undefined }]
+  const { guard } = useGitOpsWriteGuard({
+    target: { kind: targetKind, group: 'postgresql.cnpg.io', namespace, name },
+    writes,
+    enabled: !operatorOwned,
+  })
+  if (operatorOwned) {
+    return {
+      node: <div className="text-xs text-theme-text-secondary">{scope.owner} recreates this Pod; GitOps sync is not involved.</div>,
+      satisfied: true,
+    }
+  }
+  if (!guard) return { node: null, satisfied: false }
+  const route = guard.owner ? gitOpsRouteForOwner(guard.owner) : null
+  return {
+    node: (
+      <GitOpsWriteWarning
+        guard={guard}
+        acknowledged={acked}
+        onAcknowledgedChange={setAcked}
+        onOpenOwner={route ? () => navigate(route) : undefined}
+      />
+    ),
+    satisfied: canConfirmGitOpsWrite(guard, acked),
+  }
+}

package/src/components/cnpg/actions/useOpenCNPGPsql.ts

@@ -0,0 +1,22 @@
+import { useOpenTerminal } from '../../dock'
+
+/**
+ * Opens psql in an instance's postgres container in the dock terminal, over
+ * the caller's own pods/exec. It connects on the local socket as the postgres
+ * superuser, like `kubectl cnpg psql`.
+ */
+export function useOpenCNPGPsql() {
+  const openTerminal = useOpenTerminal()
+  return (namespace: string, pod: string, isPrimary: boolean) =>
+    openTerminal({
+      namespace,
+      podName: pod,
+      containerName: 'postgres',
+      containers: ['postgres'],
+      shell: 'psql',
+      title: `psql · ${pod}`,
+      sessionNote: isPrimary
+        ? 'psql as postgres (superuser) · currently the primary: read-write'
+        : 'psql as postgres (superuser) · currently a standby: read-only while it stays a standby',
+    })
+}

package/src/components/cnpg/archivingRepair.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, it } from 'vitest'
+import { cnpgArchiveDestination, cnpgRecoveryBase, resumeBoundary, walAfter, type CNPGWALArchiver } from './archivingRepair'
+
+describe('cnpgArchiveDestination', () => {
+  it('names each credential Secret and key, never reading them', () => {
+    const d = cnpgArchiveDestination(
+      {
+        destinationPath: 's3://radar-cnpg-demo/',
+        endpointURL: 'http://192.0.2.1:9000',
+        s3Credentials: { accessKeyId: { name: 'creds', key: 'ACCESS_KEY_ID' }, secretAccessKey: { name: 'creds', key: 'ACCESS_SECRET_KEY' } },
+        endpointCA: { name: 'minio-ca', key: 'ca.crt' },
+      },
+      'ObjectStore pg-store',
+    )
+    expect(d).toMatchObject({ path: 's3://radar-cnpg-demo/', endpointURL: 'http://192.0.2.1:9000', declaredIn: 'ObjectStore pg-store' })
+    expect(d.secrets).toEqual([
+      { secret: 'creds', key: 'ACCESS_KEY_ID', what: 'S3 access key ID' },
+      { secret: 'creds', key: 'ACCESS_SECRET_KEY', what: 'S3 secret access key' },
+      { secret: 'minio-ca', key: 'ca.crt', what: 'endpoint CA bundle' },
+    ])
+    expect(d.identity).toBeUndefined()
+  })
+  it('says when credentials come from the workload identity instead', () => {
+    expect(cnpgArchiveDestination({ destinationPath: 's3://b/', s3Credentials: { inheritFromIAMRole: true } }, 'x').identity).toContain('IAM role')
+    expect(cnpgArchiveDestination({ destinationPath: 'gs://b/', googleCredentials: { gkeEnvironment: true } }, 'x').identity).toContain('GKE')
+  })
+})
+
+describe('a base backup after archiving resumed', () => {
+  const t = (iso: string) => Date.parse(iso)
+  const cluster = (since?: string) => ({ status: { conditions: since ? [{ type: 'ContinuousArchiving', status: 'True', lastTransitionTime: since }] : [] } })
+  const backup = (name: string, startedAt: string, extra: any = {}) => ({
+    apiVersion: 'postgresql.cnpg.io/v1',
+    kind: 'Backup',
+    metadata: { name, namespace: 'db' },
+    spec: { cluster: { name: 'pg' }, method: 'plugin', pluginConfiguration: { name: 'barman-cloud.cloudnative-pg.io' } },
+    status: { phase: 'completed', startedAt, ...extra },
+  })
+  const pg = { namespace: 'db', name: 'pg' }
+  const newest = (backups: any[] | null, boundary: number, archiver: CNPGWALArchiver) => {
+    const r = cnpgRecoveryBase(pg, backups, boundary, archiver)
+    return r.state === 'unread' ? 'unread' : 'backup' in r ? r.backup.metadata.name : undefined
+  }
+  const plugin: CNPGWALArchiver = { method: 'plugin', plugin: 'barman-cloud.cloudnative-pg.io' }
+
+  it('resumes no earlier than the condition turning True after the last failure', () => {
+    expect(resumeBoundary(cluster('2026-10-04T10:10:00Z'), t('2026-10-04T10:00:00Z'))).toBe(t('2026-10-04T10:10:00Z'))
+    // A True transition from before the failure says nothing about the resume.
+    expect(resumeBoundary(cluster('2026-10-01T00:00:00Z'), t('2026-10-04T10:00:00Z'))).toBe(t('2026-10-04T10:00:00Z'))
+  })
+
+  it('does not accept a backup that started between the failure and the resume', () => {
+    const boundary = resumeBoundary(cluster('2026-10-04T10:10:00Z'), t('2026-10-04T10:00:00Z'))
+    expect(newest([backup('gap', '2026-10-04T10:05:00Z')], boundary, plugin)).toBeUndefined()
+    expect(newest([backup('gap', '2026-10-04T10:05:00Z'), backup('after', '2026-10-04T10:20:00Z')], boundary, plugin)).toBe('after')
+  })
+
+  it('ignores other clusters, unfinished runs, and says when Backups could not be read', () => {
+    const boundary = t('2026-10-04T10:00:00Z')
+    const other = { ...backup('other', '2026-10-04T11:00:00Z'), spec: { cluster: { name: 'pg-b' } } }
+    const running = backup('running', '2026-10-04T11:00:00Z', { phase: 'running' })
+    expect(newest([other, running], boundary, plugin)).toBeUndefined()
+    expect(newest(null, boundary, plugin)).toBe('unread')
+  })
+
+  it('accepts only a Backup a restore can start from with this cluster\'s WAL archive', () => {
+    const boundary = t('2026-10-04T10:00:00Z')
+    const otherPlugin = { ...backup('other-plugin', '2026-10-04T11:00:00Z'), spec: { cluster: { name: 'pg' }, method: 'plugin', pluginConfiguration: { name: 'other.example.io' } } }
+    const inTree = { ...backup('in-tree', '2026-10-04T11:00:00Z'), spec: { cluster: { name: 'pg' } } }
+    const snapshot = { ...backup('snap', '2026-10-04T11:00:00Z'), spec: { cluster: { name: 'pg' }, method: 'volumeSnapshot' } }
+    expect(newest([otherPlugin, inTree], boundary, plugin)).toBeUndefined()
+    expect(newest([otherPlugin, inTree], boundary, { method: 'barmanObjectStore' })).toBe('in-tree')
+    expect(newest([otherPlugin, snapshot], boundary, plugin)).toBe('snap')
+  })
+
+  it('takes the resume from the condition when the instance manager no longer reports the failure', () => {
+    expect(resumeBoundary(cluster('2026-10-04T10:10:00Z'), NaN)).toBe(t('2026-10-04T10:10:00Z'))
+    expect(resumeBoundary(cluster(), NaN)).toBeNaN()
+  })
+
+  it('counts a backup only when it begins after the last WAL that failed to archive', () => {
+    const boundary = t('2026-10-04T10:00:00Z')
+    const failed = '000000010000000000000004'
+    // Started after the resume, but taken from a standby that had replayed only to segment 3.
+    const lagging = backup('lagging', '2026-10-04T11:00:00Z', { beginWal: '000000010000000000000003' })
+    const after = backup('after', '2026-10-04T10:30:00Z', { beginWal: '000000010000000000000006' })
+    expect(cnpgRecoveryBase(pg, [lagging], boundary, plugin, failed)).toMatchObject({ state: 'beginsBefore', failedWal: failed })
+    expect(cnpgRecoveryBase(pg, [lagging, after], boundary, plugin, failed)).toMatchObject({ state: 'verified', backup: { metadata: { name: 'after' } } })
+    // Without the failed WAL (the primary's stats restarted) nothing can be verified.
+    expect(cnpgRecoveryBase(pg, [after], boundary, plugin)).toMatchObject({ state: 'unverifiable', missing: 'failedWal' })
+    // A backup whose status does not say where it begins is not diagnosed as beginning before.
+    const unreported = backup('unreported', '2026-10-04T11:30:00Z')
+    const malformed = backup('malformed', '2026-10-04T11:30:00Z', { beginWal: 'n/a' })
+    expect(cnpgRecoveryBase(pg, [unreported], boundary, plugin, failed)).toMatchObject({ state: 'unverifiable', missing: 'beginWal' })
+    expect(cnpgRecoveryBase(pg, [malformed, lagging], boundary, plugin, failed)).toMatchObject({ state: 'unverifiable', missing: 'beginWal' })
+    expect(cnpgRecoveryBase(pg, [], boundary, plugin, failed)).toEqual({ state: 'none' })
+  })
+
+  it('orders WAL files by position across timelines', () => {
+    expect(walAfter('000000020000000000000005', '000000010000000000000004')).toBe(true)
+    expect(walAfter('000000020000000000000003', '000000010000000000000004')).toBe(false)
+    expect(walAfter(undefined, '000000010000000000000004')).toBeNull()
+  })
+})

package/src/components/cnpg/archivingRepair.ts

@@ -0,0 +1,145 @@
+// The parts of a barman-cloud destination an on-call engineer checks when WAL
+// archiving fails: where it writes and which Secrets hold its credentials.
+// Secrets are named, never read.
+
+export interface CNPGArchiveDestination {
+  /** destinationPath, e.g. s3://bucket/prefix */
+  path?: string
+  endpointURL?: string
+  /** Each Secret key the destination reads its credentials from. */
+  secrets: { secret: string; key?: string; what: string }[]
+  /** Credentials come from the workload's identity instead of a Secret. */
+  identity?: string
+  /** Where this configuration is declared. */
+  declaredIn: string
+}
+
+const SECRET_FIELDS: [string, string, string][] = [
+  ['s3Credentials', 'accessKeyId', 'S3 access key ID'],
+  ['s3Credentials', 'secretAccessKey', 'S3 secret access key'],
+  ['s3Credentials', 'region', 'S3 region'],
+  ['s3Credentials', 'sessionToken', 'S3 session token'],
+  ['azureCredentials', 'connectionString', 'Azure connection string'],
+  ['azureCredentials', 'storageAccount', 'Azure storage account'],
+  ['azureCredentials', 'storageKey', 'Azure storage key'],
+  ['azureCredentials', 'storageSasToken', 'Azure SAS token'],
+  ['googleCredentials', 'applicationCredentials', 'Google application credentials'],
+]
+
+/** Reads a barman-cloud object store configuration (in-tree `spec.backup.barmanObjectStore` or an ObjectStore's `spec.configuration`). */
+export function cnpgArchiveDestination(config: any, declaredIn: string): CNPGArchiveDestination {
+  const secrets: CNPGArchiveDestination['secrets'] = []
+  for (const [group, field, what] of SECRET_FIELDS) {
+    const ref = config?.[group]?.[field]
+    if (typeof ref?.name === 'string' && ref.name) secrets.push({ secret: ref.name, key: typeof ref.key === 'string' ? ref.key : undefined, what })
+  }
+  const ca = config?.endpointCA
+  if (typeof ca?.name === 'string' && ca.name) secrets.push({ secret: ca.name, key: typeof ca.key === 'string' ? ca.key : undefined, what: 'endpoint CA bundle' })
+  const identity = config?.s3Credentials?.inheritFromIAMRole
+    ? 'the Pod’s IAM role (inheritFromIAMRole)'
+    : config?.azureCredentials?.inheritFromAzureAD
+      ? 'the Pod’s Azure AD workload identity (inheritFromAzureAD)'
+      : config?.googleCredentials?.gkeEnvironment
+        ? 'the GKE workload identity (gkeEnvironment)'
+        : undefined
+  return {
+    path: typeof config?.destinationPath === 'string' ? config.destinationPath : undefined,
+    endpointURL: typeof config?.endpointURL === 'string' ? config.endpointURL : undefined,
+    secrets,
+    identity,
+    declaredIn,
+  }
+}
+
+/**
+ * When archiving resumed, at the latest: the later of the last failure the
+ * instance manager saw and the ContinuousArchiving condition turning True. A
+ * Backup that started after the last failure saw no archive failure while it
+ * ran. NaN when neither is known.
+ */
+export function resumeBoundary(cluster: any, failedAt: number): number {
+  const conds = cluster?.status?.conditions
+  const c = Array.isArray(conds) ? conds.find((x: any) => x?.type === 'ContinuousArchiving') : null
+  const trueSince = c?.status === 'True' ? Date.parse(c.lastTransitionTime ?? '') : NaN
+  if (!Number.isFinite(trueSince)) return failedAt
+  return Number.isFinite(failedAt) && failedAt > trueSince ? failedAt : trueSince
+}
+
+/** The method a Backup ran with; CloudNativePG defaults an unset one to barmanObjectStore. */
+export function backupMethod(b: any): string {
+  return b?.status?.method || b?.spec?.method || 'barmanObjectStore'
+}
+
+export type CNPGWALArchiver = { method: 'plugin'; plugin: string } | { method: 'barmanObjectStore' }
+
+const WAL_FILE = /^[0-9A-F]{24}$/i
+
+/**
+ * Whether WAL file `a` comes after `b`. The last 16 hex digits are the
+ * segment's position, which keeps increasing across timelines; null when
+ * either name is not a WAL file name.
+ */
+export function walAfter(a: unknown, b: unknown): boolean | null {
+  if (typeof a !== 'string' || typeof b !== 'string' || !WAL_FILE.test(a) || !WAL_FILE.test(b)) return null
+  return a.slice(8).toUpperCase() > b.slice(8).toUpperCase()
+}
+
+/**
+ * Whether a restore can start after the failure without any WAL that failed
+ * to archive. A Backup that started after archiving resumed can still begin
+ * earlier in the WAL — CloudNativePG backs up a standby by default, and a
+ * lagging one begins where it has replayed to — so its own beginWal decides,
+ * against the last WAL the instance manager failed to archive.
+ */
+export type CNPGRecoveryBase =
+  | { state: 'unread' }
+  | { state: 'none' }
+  | { state: 'verified'; backup: any; failedWal: string }
+  | { state: 'beginsBefore'; backup: any; failedWal: string }
+  /** `missing` says which side of the comparison could not be read. */
+  | { state: 'unverifiable'; backup: any; missing: 'failedWal' | 'beginWal' }
+
+export function cnpgRecoveryBase(
+  cluster: { namespace: string; name: string },
+  backups: any[] | null,
+  boundary: number,
+  archiver: CNPGWALArchiver,
+  failedWal?: string,
+): CNPGRecoveryBase {
+  if (backups === null) return { state: 'unread' }
+  const candidates = backupsAfterResume(cluster, backups, boundary, archiver)
+  if (candidates.length === 0) return { state: 'none' }
+  if (!failedWal || walAfter(failedWal, failedWal) === null) return { state: 'unverifiable', backup: candidates[0], missing: 'failedWal' }
+  const verified = candidates.find((b) => walAfter(b?.status?.beginWal, failedWal) === true)
+  if (verified) return { state: 'verified', backup: verified, failedWal }
+  const newest = candidates[0]
+  return walAfter(newest?.status?.beginWal, failedWal) === false
+    ? { state: 'beginsBefore', backup: newest, failedWal }
+    : { state: 'unverifiable', backup: newest, missing: 'beginWal' }
+}
+
+/**
+ * Completed Backups of this cluster that started after `boundary`, newest
+ * first, that a restore can start from with this cluster's WAL archive: one
+ * written by the same archiver, or a volume snapshot (restored by replaying
+ * WAL from the archive).
+ */
+export function backupsAfterResume(cluster: { namespace: string; name: string }, backups: any[], boundary: number, archiver: CNPGWALArchiver): any[] {
+  const sameArchive = (b: any) => {
+    const m = backupMethod(b)
+    if (m === 'volumeSnapshot') return true
+    if (archiver.method === 'plugin') return m === 'plugin' && b?.spec?.pluginConfiguration?.name === archiver.plugin
+    return m === 'barmanObjectStore'
+  }
+  return backups
+    .filter(
+      (b) =>
+        String(b?.apiVersion ?? '').startsWith('postgresql.cnpg.io/') &&
+        b?.metadata?.namespace === cluster.namespace &&
+        b?.spec?.cluster?.name === cluster.name &&
+        b?.status?.phase === 'completed' &&
+        sameArchive(b) &&
+        Date.parse(b?.status?.startedAt ?? '') > boundary,
+    )
+    .sort((a, b) => Date.parse(b.status.startedAt) - Date.parse(a.status.startedAt))
+}

package/src/components/cnpg/baseBackup.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest'
+import type { CNPGRuntimeInstance, CNPGRuntimeResponse } from '../../api/cnpg'
+import { cnpgBaseBackupFacts, describeCNPGBaseBackup } from './baseBackup'
+
+function rt(status: Partial<CNPGRuntimeInstance['status']>, proxy: 'allowed' | 'denied' = 'allowed'): CNPGRuntimeResponse {
+  return {
+    cluster: { namespace: 'db', name: 'pg', uid: 'u' },
+    sampledAt: '2026-09-30T10:00:00Z',
+    permission: { proxy },
+    instances: [{ pod: 'pg-1', role: 'primary', status: { state: 'ok', ...status }, metrics: { state: 'ok' } }],
+  }
+}
+
+describe('cnpgBaseBackupFacts', () => {
+  it('is unknown, not none, when the primary report was not read', () => {
+    expect(cnpgBaseBackupFacts(undefined)).toBeUndefined()
+    expect(cnpgBaseBackupFacts(rt({ baseBackups: [] }, 'denied'))).toBeUndefined()
+    expect(cnpgBaseBackupFacts(rt({ state: 'unreachable' }))).toBeUndefined()
+    expect(cnpgBaseBackupFacts(rt({}))).toBeUndefined()
+    expect(cnpgBaseBackupFacts(rt({ state: 'partial', incomplete: true, maskedError: 'x', baseBackups: null }))).toBeUndefined()
+  })
+
+  it('says none only when the readable report lists none', () => {
+    expect(cnpgBaseBackupFacts(rt({ baseBackups: [] }))?.fact.text).toBe('None running')
+  })
+
+  it('shows progress, and never 0 % when the total is not estimated', () => {
+    const f = cnpgBaseBackupFacts(
+      rt({ baseBackups: [{ applicationName: 'pg-4-join', instance: 'pg-4', phase: 'streaming database files', totalBytes: 4096, streamedBytes: 1024, tablespacesTotal: 1, tablespacesStreamed: 0 }] }),
+    )
+    expect(f?.fact.text).toBe('Base backup to new instance pg-4: streaming database files, 1.0 KiB of 4.0 KiB (25 %)')
+    expect(describeCNPGBaseBackup({ applicationName: 'x-join', instance: 'x', phase: 'waiting for checkpoint to finish', streamedBytes: 0, tablespacesTotal: 0, tablespacesStreamed: 0 })).toBe(
+      'Base backup to new instance x: waiting for checkpoint to finish, 0 B streamed, total not estimated yet',
+    )
+  })
+})

package/src/components/cnpg/baseBackup.ts

@@ -0,0 +1,36 @@
+import type { Fact } from '@skyhook-io/k8s-ui'
+import type { CNPGRuntimeBaseBackup, CNPGRuntimeResponse } from '../../api/cnpg'
+import { formatBytes } from './lsn'
+
+export const CNPG_BASE_BACKUP_SOURCE =
+  'pg_basebackup on the primary, joining instances only'
+
+export function describeCNPGBaseBackup(bb: CNPGRuntimeBaseBackup): string {
+  const who = bb.instance ? `to new instance ${bb.instance}` : `for ${bb.applicationName}`
+  const progress =
+    bb.totalBytes !== undefined && bb.totalBytes > 0
+      ? `${formatBytes(bb.streamedBytes)} of ${formatBytes(bb.totalBytes)} (${Math.min(100, (bb.streamedBytes / bb.totalBytes) * 100).toFixed(0)} %)`
+      : `${formatBytes(bb.streamedBytes)} streamed, total not estimated yet`
+  return `Base backup ${who}: ${bb.phase}, ${progress}`
+}
+
+/**
+ * The primary's running base backups. Undefined when the primary's report was
+ * not read, so the Overview omits the fact rather than claiming none.
+ */
+export function cnpgBaseBackupFacts(rt: CNPGRuntimeResponse | undefined): { fact: Fact; rows: CNPGRuntimeBaseBackup[] } | undefined {
+  if (!rt || rt.permission.proxy === 'denied') return undefined
+  const primary = rt.instances.find((i) => i.role === 'primary')
+  if (!primary || (primary.status.state !== 'ok' && primary.status.state !== 'partial')) return undefined
+  const rows = primary.status.baseBackups
+  if (!rows) return undefined
+  if (rows.length === 0) return { fact: { text: 'None running', tone: 'neutral', source: CNPG_BASE_BACKUP_SOURCE }, rows }
+  return {
+    fact: {
+      text: rows.length === 1 ? describeCNPGBaseBackup(rows[0]) : `${rows.length} base backups running`,
+      tone: 'neutral',
+      source: CNPG_BASE_BACKUP_SOURCE,
+    },
+    rows,
+  }
+}

package/src/components/cnpg/blocking.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, it } from 'vitest'
+import { buildBlockingTree, cnpgConnectionFigure, cnpgNoMetricsReadings, countVictims } from './blocking'
+import type { CNPGBackend } from '../../api/cnpg-sessions'
+
+const s = (pid: number, blockedBy: number[] = []): CNPGBackend => ({ pid, blockedBy, backendStart: `t${pid}` })
+
+describe('buildBlockingTree', () => {
+  it('nests a chain under its root blocker', () => {
+    const roots = buildBlockingTree([s(1), s(2, [1]), s(3, [2])])
+    expect(roots).toHaveLength(1)
+    expect(roots[0].session.pid).toBe(1)
+    expect(roots[0].children[0].session.pid).toBe(2)
+    expect(roots[0].children[0].children[0].session.pid).toBe(3)
+    expect(countVictims(roots[0])).toBe(2)
+  })
+
+  it('shows a victim of two blockers under both, naming the other', () => {
+    const roots = buildBlockingTree([s(1), s(2), s(3, [1, 2])])
+    expect(roots.map((r) => r.session.pid)).toEqual([1, 2])
+    expect(roots[0].children[0].alsoWaitsOn).toEqual([2])
+    expect(roots[1].children[0].alsoWaitsOn).toEqual([1])
+  })
+
+  it('keeps a victim whose blocker is not listed', () => {
+    const roots = buildBlockingTree([s(5, [99])])
+    expect(roots).toHaveLength(1)
+    expect(roots[0].session.pid).toBe(5)
+    expect(roots[0].cycle).toBeUndefined()
+  })
+
+  it('marks a deadlock cycle instead of recursing forever', () => {
+    const roots = buildBlockingTree([s(1, [2]), s(2, [1])])
+    expect(roots.length).toBeGreaterThan(0)
+    expect(roots.every((r) => r.cycle)).toBe(true)
+  })
+})
+
+describe('cnpgConnectionFigure', () => {
+  it('states usable headroom from pg_stat_activity when exec read it', () => {
+    expect(cnpgConnectionFigure({ maxConnections: 100, superuserReservedConnections: 3, clientBackends: 6 }, { sessionsTotal: 6, maxConnections: 100 })).toMatchObject({
+      value: '6 in use',
+      limit: 'of 97 usable (max_connections 100, 3 reserved)',
+    })
+  })
+  it('falls back to the exporter count and says the reserve is unknown', () => {
+    const f = cnpgConnectionFigure(undefined, { sessionsTotal: 90, maxConnections: 100 })
+    expect(f).toMatchObject({ value: '90 in use', limit: 'of max_connections 100 (superuser reserve not read)', tone: 'degraded' })
+    expect(cnpgConnectionFigure(undefined, {})).toBeUndefined()
+  })
+})
+
+describe('cnpgNoMetricsReadings', () => {
+  it('says there are no readings only when no instance has metrics', () => {
+    expect(cnpgNoMetricsReadings([null, null])).toBe(true)
+    expect(cnpgNoMetricsReadings([null, { containers: [] }])).toBe(false)
+    expect(cnpgNoMetricsReadings([null, undefined])).toBe(false)
+    expect(cnpgNoMetricsReadings([])).toBe(false)
+  })
+})