@skyhook-io/radar-app 1.16.3 → 1.17.1

package/src/components/issues/IssuesPane.render.test.tsx

@@ -0,0 +1,122 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { MemoryRouter } from 'react-router-dom'
+import type { IssuesResponse, SubjectIssuesResponse } from '../../api/client'
+import { IssuesPane } from './IssuesPane'
+
+const state = vi.hoisted(() => ({
+  fleet: { data: undefined as IssuesResponse | undefined, isLoading: false, error: null as Error | null, dataUpdatedAt: 0, refetch: vi.fn() },
+  subject: { data: undefined as SubjectIssuesResponse | undefined, isLoading: false, error: null as Error | null, dataUpdatedAt: 0, refetch: vi.fn() },
+}))
+vi.mock('../../api/client', () => ({ useIssues: () => state.fleet, useSubjectIssues: () => state.subject }))
+vi.mock('../../api/apiResources', () => ({ useAPIResources: () => ({ data: undefined }), karpenterCapacityAvailable: () => false }))
+vi.mock('../../contexts/CapabilitiesContext', () => ({ useCapabilitiesContext: () => ({}) }))
+vi.mock('../../context/ConnectionContext', () => ({ useConnection: () => ({ connection: { state: 'connected' } }) }))
+vi.mock('../diagnose/LocalDiagnoseAction', () => ({ IssueDiagnoseButton: () => null }))
+
+const subjectUrl = '/issues?kind=Pod&resource=db%2Fpg-1'
+const issue = {
+  id: 'pod-failed', severity: 'critical' as const, source: 'problem', category: 'workload', category_group: 'workload', grouping_scope: 'resource',
+  kind: 'Pod', group: '', namespace: 'db', name: 'pg-1', reason: 'CrashLoopBackOff', message: 'The selected Pod keeps crashing',
+}
+
+function render(url = subjectUrl, namespaces: string[] = []) {
+  return renderToString(<MemoryRouter initialEntries={[url]}><IssuesPane namespaces={namespaces} onNavigateToResource={() => {}} /></MemoryRouter>).replaceAll('<!-- -->', '')
+}
+
+beforeEach(() => {
+  state.fleet = { data: undefined, isLoading: false, error: null, dataUpdatedAt: 0, refetch: vi.fn() }
+  state.subject = { data: { issues: [issue], coverage: 'ok' }, isLoading: false, error: null, dataUpdatedAt: 0, refetch: vi.fn() }
+})
+
+describe('Issues page query ownership', () => {
+  it.each(['loading', 'failed'] as const)('renders subject results while the fleet query is %s', (fleetState) => {
+    state.fleet.isLoading = fleetState === 'loading'
+    state.fleet.error = fleetState === 'failed' ? new Error('Fleet unavailable') : null
+    const html = render()
+    expect(html).toContain('The selected Pod keeps crashing')
+    expect(html).toContain('Showing issues about Pod')
+    expect(html).not.toContain('Failed to load issues')
+    expect(html).not.toContain('Loading issues…')
+  })
+
+  it('uses the subject visibility rather than stale fleet visibility', () => {
+    state.fleet.data = { issues: [], visibility: { impact: 'Fleet-only limitation' } }
+    state.subject.data!.visibility = { state: 'limited', impact: 'Subject evidence is incomplete.' }
+    const html = render()
+    expect(html).toContain('Subject evidence is incomplete.')
+    expect(html).not.toContain('Fleet-only limitation')
+  })
+
+  it.each(['loading', 'failed'] as const)('reports a %s subject lookup independently of fleet failure', (subjectState) => {
+    state.fleet.error = new Error('Fleet unavailable')
+    state.subject.data = undefined
+    state.subject.isLoading = subjectState === 'loading'
+    state.subject.error = subjectState === 'failed' ? new Error('Subject unavailable') : null
+    const html = render()
+    expect(html).toContain(subjectState === 'loading' ? 'Checking issues about Pod' : 'Subject unavailable')
+    expect(html).not.toContain('Failed to load issues')
+    expect(html).not.toContain('none now')
+  })
+
+  it('explains a hidden subject even when the fleet query fails', () => {
+    state.fleet.error = new Error('Fleet unavailable')
+    const html = render(subjectUrl, ['other'])
+    expect(html).toContain('namespace filter hides')
+    expect(html).not.toContain('The selected Pod keeps crashing')
+    expect(html).not.toContain('Failed to load issues')
+    expect(html).not.toContain('Auto-updating')
+  })
+
+  it.each(['loading', 'failed'] as const)('retains the fleet %s state on the unfiltered page', (fleetState) => {
+    state.fleet.isLoading = fleetState === 'loading'
+    state.fleet.error = fleetState === 'failed' ? new Error('Fleet unavailable') : null
+    expect(render('/issues')).toContain(fleetState === 'loading' ? 'Loading issues…' : 'Failed to load issues')
+  })
+})
+
+describe('Issues page when Radar could not read Helm releases', () => {
+  const line = "Helm releases couldn't be checked, so failed or stuck releases may be missing."
+  const text = (html: string) => html.replace(/&#x27;|&#39;/g, "'")
+
+  it('shows no all-clear when nothing else was found', () => {
+    state.fleet.data = { issues: [], total: 0, total_matched: 0, unchecked_sources: [{ source: 'helm', reason: 'read_failed' }] }
+    const html = text(render('/issues'))
+    expect(html).toContain('No issues found')
+    expect(html).toContain(line)
+    expect(html).not.toContain('Nothing broken right now')
+    expect(html.split(line).length - 1).toBe(1)
+  })
+
+  it('says so above the rows when there are other issues', () => {
+    state.fleet.data = { issues: [issue], total: 1, total_matched: 1, unchecked_sources: [{ source: 'helm', reason: 'read_failed' }] }
+    const html = text(render('/issues'))
+    expect(html).toContain(line)
+    expect(html).toContain('The selected Pod keeps crashing')
+  })
+
+  it('shows no all-clear for a source this version does not know, with a generic line', () => {
+    state.fleet.data = { issues: [], total: 0, total_matched: 0, unchecked_sources: [{ source: 'some-new-source', reason: 'read_failed' }] }
+    const html = text(render('/issues'))
+    expect(html).toContain('No issues found')
+    expect(html).toContain("Some issue checks couldn't run, so issues may be missing.")
+    expect(html).not.toContain('some-new-source')
+    expect(html).not.toContain('Nothing broken right now')
+  })
+
+  it('keeps the all-clear for a Radar that read Helm or predates the field', () => {
+    state.fleet.data = { issues: [], total: 0, total_matched: 0 }
+    const html = text(render('/issues'))
+    expect(html).toContain('Nothing broken right now')
+    expect(html).not.toContain('couldn')
+  })
+})
+
+describe('Helm notice in subject mode', () => {
+  it('is left out: the per-resource lookup never reads Helm storage', () => {
+    state.fleet.data = { issues: [], unchecked_sources: [{ source: 'helm', reason: 'read_failed' }] }
+    const html = render()
+    expect(html).toContain('The selected Pod keeps crashing')
+    expect(html).not.toContain('Helm releases couldn')
+  })
+})

package/src/components/issues/IssuesPane.test.ts

@@ -1,6 +1,8 @@
 import { describe, expect, it } from "vitest";
 import type { Issue } from "@skyhook-io/k8s-ui";
-import { capacityHrefForIssue } from "./IssuesPane";
+import type { SubjectIssuesResponse } from "../../api/client";
+import { writeViewParams } from "../../utils/navigation";
+import { capacityHrefForIssue, issueSubjectFromParams, issueSubjectKindLabel, issueSubjectState } from "./IssuesPane";
 
 function issue(partial: Partial<Issue>): Issue {
   return {
@@ -140,3 +142,65 @@ describe("capacityHrefForIssue subject carry", () => {
     ).toBe("/capacity/demand");
   });
 });
+
+describe('issue subject links', () => {
+  it('reads the subject a link narrows to, with its API group', () => {
+    expect(issueSubjectFromParams(new URLSearchParams('kind=Cluster&apiGroup=postgresql.cnpg.io&resource=pg%2Fpg-main'))).toEqual({ kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'pg', name: 'pg-main' })
+    expect(issueSubjectFromParams(new URLSearchParams('kind=Pod&resource=pg%2Fpg-main-1'))).toEqual({ kind: 'Pod', group: '', namespace: 'pg', name: 'pg-main-1' })
+    expect(issueSubjectFromParams(new URLSearchParams('kind=ClusterImageCatalog&apiGroup=postgresql.cnpg.io&resource=pg'))).toEqual({ kind: 'ClusterImageCatalog', group: 'postgresql.cnpg.io', namespace: '', name: 'pg' })
+    expect(issueSubjectFromParams(new URLSearchParams('kind=Cluster'))).toBeNull()
+    expect(issueSubjectFromParams(new URLSearchParams('kind=Cluster&resource=pg%2F'))).toBeNull()
+  })
+  it('keeps the API group through App’s URL sync on the Issues view', () => {
+    for (const [search, subject] of [
+      ['kind=Cluster&apiGroup=postgresql.cnpg.io&resource=pg%2Fpg-main', { kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'pg', name: 'pg-main' }],
+      ['kind=Service&apiGroup=serving.knative.dev&resource=web%2Fapi', { kind: 'Service', group: 'serving.knative.dev', namespace: 'web', name: 'api' }],
+    ] as const) {
+      const params = new URLSearchParams(search)
+      writeViewParams(params, ['web'], null)
+      expect(issueSubjectFromParams(params)).toEqual(subject)
+    }
+  })
+  it('names the API group when the kind could be another resource', () => {
+    expect(issueSubjectKindLabel({ kind: 'Service', group: 'serving.knative.dev', namespace: 'web', name: 'api' })).toBe('Service (serving.knative.dev)')
+    expect(issueSubjectKindLabel({ kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'pg', name: 'main' })).toBe('Cluster (postgresql.cnpg.io)')
+    expect(issueSubjectKindLabel({ kind: 'Service', group: '', namespace: 'web', name: 'api' })).toBe('Service')
+    expect(issueSubjectKindLabel({ kind: 'Deployment', group: 'apps', namespace: 'web', name: 'api' })).toBe('Deployment')
+  })
+  it('never reads the view filter as the subject namespace', () => {
+    expect(issueSubjectFromParams(new URLSearchParams('kind=Cluster&namespace=pg&name=pg-main'))).toBeNull()
+  })
+})
+
+describe('issueSubjectState', () => {
+  const subject = { kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'pg', name: 'main' }
+  const loaded = (data: Partial<SubjectIssuesResponse>) => ({ isLoading: false, error: null, data: { issues: [], coverage: 'ok' as const, ...data } })
+  it('says the view filter hides the subject rather than none', () => {
+    expect(issueSubjectState(subject, ['app'], loaded({}))).toEqual({ state: 'hidden' })
+    expect(issueSubjectState(subject, ['app', 'pg'], loaded({}))).toEqual({ state: 'none' })
+    expect(issueSubjectState(subject, [], loaded({}))).toEqual({ state: 'none' })
+    expect(issueSubjectState({ ...subject, kind: 'ClusterImageCatalog', namespace: '' }, ['app'], loaded({}))).toEqual({ state: 'none' })
+  })
+  it('reads an empty answer as unconfirmed when Radar does not read the kind', () => {
+    expect(issueSubjectState(subject, [], loaded({ coverage: 'notWatched' }))).toEqual({ state: 'unconfirmed', why: "Radar isn't watching Cluster" })
+    expect(issueSubjectState(subject, [], loaded({ coverage: 'syncing' }))).toEqual({ state: 'unconfirmed', why: 'Radar is still loading Cluster' })
+  })
+  it('says when the cluster has no such kind, as for a link made on another cluster', () => {
+    expect(issueSubjectState(subject, [], loaded({ coverage: 'unknownKind' }))).toEqual({ state: 'unconfirmed', why: 'this cluster has no such kind' })
+  })
+  it('reads an empty answer as unconfirmed when RBAC withheld issues about it', () => {
+    expect(issueSubjectState(subject, [], loaded({ withheld: { issues: 2 } }))).toEqual({ state: 'unconfirmed', why: 'your permissions withhold 2 issues about it' })
+  })
+  it('reads an empty answer under limited visibility as unconfirmed, never none', () => {
+    expect(issueSubjectState(subject, [], loaded({ visibility: { state: 'degraded', impact: 'Pods are not readable.' } }))).toEqual({ state: 'unconfirmed', why: "some evidence isn't readable (Pods are not readable)" })
+    expect(issueSubjectState(subject, [], loaded({ visibility: { state: 'limited' } }))).toEqual({ state: 'unconfirmed', why: "some evidence isn't readable" })
+  })
+  it('reports a failed lookup as unconfirmed and a pending one as checking', () => {
+    expect(issueSubjectState(subject, [], { isLoading: false, error: new Error('no access to Cluster main'), data: undefined })).toEqual({ state: 'unconfirmed', why: 'no access to Cluster main' })
+    expect(issueSubjectState(subject, [], { isLoading: true, error: null, data: undefined })).toEqual({ state: 'checking' })
+  })
+  it('takes the per-resource answer, which covers members past the inline cap', () => {
+    const grouped = issue({ kind: 'Cluster', group: 'postgresql.cnpg.io', namespace: 'pg', name: 'main', members: [], members_truncated: true })
+    expect(issueSubjectState(subject, [], loaded({ issues: [grouped], withheld: { issues: 1 } }))).toEqual({ state: 'found', issues: [grouped], withheld: 1 })
+  })
+})

package/src/components/issues/IssuesPane.tsx

@@ -1,6 +1,6 @@
 import { useMemo, useState } from "react";
-import { useNavigate } from "react-router-dom";
-import { useIssues } from "../../api/client";
+import { useNavigate, useSearchParams } from "react-router-dom";
+import { useIssues, useSubjectIssues, type SubjectIssuesResponse } from "../../api/client";
 import {
   useAPIResources,
   karpenterCapacityAvailable,
@@ -9,6 +9,7 @@ import { useCapabilitiesContext } from "../../contexts/CapabilitiesContext";
 import { useConnection } from "../../context/ConnectionContext";
 import type { SelectedResource } from "../../types";
 import {
+  EmptyState,
   IssuesView,
   PaneLoader,
   PageHeader,
@@ -21,8 +22,10 @@ import {
   type IssueSeverity,
   type SummaryTone,
 } from "@skyhook-io/k8s-ui";
+import { builtinGroupForKind } from "@skyhook-io/k8s-ui/utils/api-resources";
 import { AlertTriangle } from "lucide-react";
 import { IssueDiagnoseButton } from "../diagnose/LocalDiagnoseAction";
+import { uncheckedSourceLines } from "./uncheckedSources";
 
 // A capacity-relevant issue links to its Karpenter diagnosis. Karpenter is
 // always single-cluster (unlike Argo hub-and-spoke), so the issue and the
@@ -75,6 +78,82 @@ export function capacityHrefForIssue(
   return null;
 }
 
+/**
+ * The subject a link into Issues narrows to (?kind=&apiGroup=&resource=ns/name),
+ * or null. The group is `apiGroup`, as in resource links: App's URL sync owns
+ * `group` (topology grouping) and drops it on every other view.
+ */
+export function issueSubjectFromParams(params: URLSearchParams): IssueSubject | null {
+  const kind = params.get("kind");
+  const resource = params.get("resource");
+  if (!kind || !resource) return null;
+  const group = params.get("apiGroup") ?? "";
+  const slash = resource.indexOf("/");
+  if (slash < 0) return { kind, group, namespace: "", name: resource };
+  const name = resource.slice(slash + 1);
+  return name ? { kind, group, namespace: resource.slice(0, slash), name } : null;
+}
+
+export interface IssueSubject {
+  kind: string;
+  /** The API group; "" for the core group. Tells a CNPG Cluster from a CAPI one. */
+  group: string;
+  namespace: string;
+  name: string;
+}
+
+/** The subject's kind, with its API group when that isn't the built-in kind's (a Knative Service). */
+export function issueSubjectKindLabel(subject: IssueSubject): string {
+  return subject.group && subject.group !== builtinGroupForKind(subject.kind)
+    ? `${subject.kind} (${subject.group})`
+    : subject.kind;
+}
+
+export type IssueSubjectState =
+  | { state: "hidden" }
+  | { state: "checking" }
+  | { state: "unconfirmed"; why: string }
+  | { state: "found"; issues: Issue[]; withheld: number }
+  | { state: "none" };
+
+/**
+ * What can be said about the subject's issues. They come from the per-resource
+ * lookup, which matches every grouped member (the list's inline members are
+ * capped) by exact API group; an empty answer is "none" only when Radar reads
+ * the subject's kind, nothing kept it from the evidence, and RBAC withheld no
+ * issue about it.
+ */
+export function issueSubjectState(
+  subject: IssueSubject,
+  viewNamespaces: string[],
+  related: { isLoading: boolean; error: unknown; data: SubjectIssuesResponse | undefined },
+): IssueSubjectState {
+  if (subject.namespace && viewNamespaces.length > 0 && !viewNamespaces.includes(subject.namespace)) {
+    return { state: "hidden" };
+  }
+  if (related.error) {
+    return { state: "unconfirmed", why: related.error instanceof Error ? related.error.message : String(related.error) };
+  }
+  const data = related.data;
+  if (related.isLoading || !data) return { state: "checking" };
+  if (data.issues.length > 0) return { state: "found", issues: data.issues, withheld: data.withheld?.issues ?? 0 };
+  if (data.coverage === "unknownKind") return { state: "unconfirmed", why: "this cluster has no such kind" };
+  if (data.coverage === "notWatched") return { state: "unconfirmed", why: `Radar isn't watching ${subject.kind}` };
+  if (data.coverage === "syncing") return { state: "unconfirmed", why: `Radar is still loading ${subject.kind}` };
+  const withheld = data.withheld?.issues ?? 0;
+  if (withheld > 0) {
+    return { state: "unconfirmed", why: `your permissions withhold ${withheld} ${withheld === 1 ? "issue" : "issues"} about it` };
+  }
+  const visibility = data.visibility;
+  if (visibility?.state === "degraded" || visibility?.state === "limited") {
+    return {
+      state: "unconfirmed",
+      why: `some evidence isn't readable${visibility.impact ? ` (${visibility.impact.replace(/\.$/, "")})` : ""}`,
+    };
+  }
+  return { state: "none" };
+}
+
 const SEVERITY_TONE: Record<IssueSeverity, SummaryTone> = {
   critical: "error",
   warning: "warning",
@@ -83,6 +162,8 @@ const SEVERITY_TONE: Record<IssueSeverity, SummaryTone> = {
 interface IssuesPaneProps {
   namespaces: string[];
   onNavigateToResource: (resource: SelectedResource) => void;
+  /** Brings a namespace into the view filter: added to it, or (where Radar's scope allows only one) switched to it. */
+  showNamespace?: { mode: "add" | "switch"; show: (namespace: string) => void };
 }
 
 // The per-cluster Issues surface. Renders the same shared triage queue
@@ -96,9 +177,12 @@ interface IssuesPaneProps {
 export function IssuesPane({
   namespaces,
   onNavigateToResource,
+  showNamespace,
 }: IssuesPaneProps) {
+  const [searchParams, setSearchParams] = useSearchParams();
+  const subject = useMemo(() => issueSubjectFromParams(searchParams), [searchParams]);
   const { data, isLoading, error, dataUpdatedAt, refetch } =
-    useIssues(namespaces);
+    useIssues(namespaces, !subject);
   const { connection } = useConnection();
   const navigate = useNavigate();
   const apiResources = useAPIResources();
@@ -110,15 +194,37 @@ export function IssuesPane({
     new Set(),
   );
 
-  const allIssues = useMemo(() => data?.issues ?? [], [data]);
-  const totals = useMemo(() => {
-    const t: Record<IssueSeverity, number> = { critical: 0, warning: 0 };
-    for (const i of allIssues) t[i.severity] = (t[i.severity] ?? 0) + 1;
-    return t;
-  }, [allIssues]);
+  const subjectHidden =
+    !!subject?.namespace && namespaces.length > 0 && !namespaces.includes(subject.namespace);
+  const related = useSubjectIssues(subject, !subjectHidden);
+  const subjectState = subject
+    ? issueSubjectState(subject, namespaces, related)
+    : null;
+  const visibility = subject
+    ? subjectHidden ? undefined : related.data?.visibility
+    : data?.visibility;
+  const pageIssues = useMemo(() => data?.issues ?? [], [data]);
+  const uncheckedLines = subject ? [] : uncheckedSourceLines(data?.unchecked_sources);
+  // With a subject set, the tiles and the list both describe the subject.
+  const scopeIssues = subjectState
+    ? subjectState.state === "found" ? subjectState.issues : []
+    : pageIssues;
+  const totals: Record<IssueSeverity, number> = { critical: 0, warning: 0 };
+  for (const i of scopeIssues) totals[i.severity] = (totals[i.severity] ?? 0) + 1;
   const shown = severityFilter.size
-    ? allIssues.filter((i) => severityFilter.has(i.severity))
-    : allIssues;
+    ? scopeIssues.filter((i) => severityFilter.has(i.severity))
+    : scopeIssues;
+  const clearSubject = () =>
+    setSearchParams(
+      (prev) => {
+        const next = new URLSearchParams(prev);
+        next.delete("kind");
+        next.delete("apiGroup");
+        next.delete("resource");
+        return next;
+      },
+      { replace: true },
+    );
 
   const toggleSeverity = (s: IssueSeverity) =>
     setSeverityFilter((prev) => {
@@ -136,11 +242,11 @@ export function IssuesPane({
       group: ref.group ?? "",
     });
 
-  if (isLoading) {
+  if (!subject && isLoading) {
     return <PaneLoader label="Loading issues…" className="flex-1" />;
   }
 
-  if (error) {
+  if (!subject && error) {
     return (
       <div className="flex-1 flex items-center justify-center text-theme-text-secondary">
         <p>Failed to load issues</p>
@@ -156,17 +262,20 @@ export function IssuesPane({
         description="Live cluster problems — crashes, scheduling failures, bad references — grouped by the resource they affect."
         actions={
           <>
-            <FreshnessControl
+            {subjectHidden ? null : <FreshnessControl
               mode="auto"
-              dataUpdatedAt={dataUpdatedAt}
-              onRefresh={() => refetch()}
+              dataUpdatedAt={subject ? related.dataUpdatedAt : dataUpdatedAt}
+              onRefresh={() => {
+                if (subject) related.refetch();
+                else refetch();
+              }}
               connectionState={connection.state}
-            />
-            {allIssues.length > 0 && (
+            />}
+            {scopeIssues.length > 0 && (
               <>
                 <SummaryTile
-                  label={allIssues.length === 1 ? "issue" : "issues"}
-                  value={allIssues.length}
+                  label={scopeIssues.length === 1 ? "issue" : "issues"}
+                  value={scopeIssues.length}
                 />
                 {ISSUE_SEVERITIES.map((s) =>
                   totals[s] > 0 || severityFilter.has(s) ? (
@@ -189,19 +298,29 @@ export function IssuesPane({
       {/* Visibility honesty: when RBAC reads are incomplete, an empty queue may
           mean "can't see" rather than "nothing broken" — say so up front so the
           empty state isn't mistaken for a clean bill of health. */}
-      {data?.visibility?.impact && (
+      {visibility?.impact && (
         <div className="flex items-start gap-2 rounded-lg border border-theme-border bg-theme-elevated px-3 py-2 text-xs text-theme-text-secondary">
           <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-amber-500" />
           <span>
-            Limited visibility — {data.visibility.impact} Results may be
+            Limited visibility — {visibility.impact} Results may be
             incomplete.
           </span>
         </div>
       )}
 
+      {/* Unchecked-source honesty: the rows can't include issues from a
+          source Radar couldn't check. With no rows the empty state below says
+          it instead. */}
+      {scopeIssues.length > 0 && uncheckedLines.map((line) => (
+        <div key={line} className="flex items-start gap-2 rounded-lg border border-theme-border bg-theme-elevated px-3 py-2 text-xs text-theme-text-secondary">
+          <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-amber-500" />
+          <span>{line}</span>
+        </div>
+      ))}
+
       {/* Truncation honesty: when more issues matched than were returned, say
           so — don't present a capped list as the complete picture. */}
-      {data?.total_matched != null &&
+      {!subject && data?.total_matched != null &&
         data.total_matched > (data.issues?.length ?? 0) && (
           <p className="text-xs text-theme-text-tertiary">
             Showing {data.issues?.length ?? 0} of {data.total_matched} issues
@@ -209,10 +328,52 @@ export function IssuesPane({
           </p>
         )}
 
+      {subject && subjectState && (
+        <div className="flex flex-wrap items-center gap-2 text-xs text-theme-text-secondary">
+          {subjectState.state === "hidden" ? (
+            <>
+              <span>
+                {issueSubjectKindLabel(subject)}{" "}
+                <span className="font-mono">{subject.namespace}/{subject.name}</span>{" "}
+                is in namespace <span className="font-mono">{subject.namespace}</span>, which your
+                namespace filter hides.
+              </span>
+              {showNamespace && (
+                <button
+                  type="button"
+                  onClick={() => showNamespace.show(subject.namespace)}
+                  className="text-accent-text hover:underline"
+                >
+                  {showNamespace.mode === "add" ? "Add" : "Switch to"}{" "}
+                  <span className="font-mono">{subject.namespace}</span>
+                  {showNamespace.mode === "add" ? " to the view" : ""}
+                </button>
+              )}
+            </>
+          ) : (
+            <span>
+              {subjectState.state === "checking" ? "Checking issues about" : "Showing issues about"}{" "}
+              {issueSubjectKindLabel(subject)}{" "}
+              <span className="font-mono">
+                {subject.namespace ? `${subject.namespace}/` : ""}
+                {subject.name}
+              </span>
+              {subjectState.state === "none" && " — none now"}
+              {subjectState.state === "unconfirmed" && ` — can't confirm: ${subjectState.why}`}
+              {subjectState.state === "found" && subjectState.withheld > 0 &&
+                ` — your permissions withhold ${subjectState.withheld} more`}
+            </span>
+          )}
+          <button type="button" onClick={clearSubject} className="text-accent-text hover:underline">
+            Show all issues
+          </button>
+        </div>
+      )}
+
       {/* Filtered-empty is NOT the healthy empty state: when a severity filter
           hides every row but issues still exist, say "no matches" rather than
           letting IssuesView render its "nothing broken" terminal state. */}
-      {severityFilter.size > 0 && allIssues.length > 0 && shown.length === 0 ? (
+      {subject && scopeIssues.length === 0 ? null : severityFilter.size > 0 && scopeIssues.length > 0 && shown.length === 0 ? (
         <div className="flex flex-col items-center gap-2 py-12 text-center text-sm text-theme-text-secondary">
           <p>No issues match the selected severity.</p>
           <button
@@ -223,12 +384,14 @@ export function IssuesPane({
             Clear filter
           </button>
         </div>
+      ) : uncheckedLines.length > 0 && scopeIssues.length === 0 ? (
+        <EmptyState tone="neutral" variant="card" headline="No issues found" body={uncheckedLines.join(" ")} />
       ) : (
         /* anyData = the query resolved, i.e. the cluster is reachable; an empty
            list then means "nothing broken" rather than "not connected". */
         <IssuesView
           issues={shown}
-          anyData={!!data}
+          anyData={subject ? !!related.data : !!data}
           onResourceClick={onResourceClick}
           renderActions={({ issue }) => {
             const capacityHref = capacityHrefForIssue(issue, hasKarpenter);

package/src/components/issues/uncheckedSources.ts

@@ -0,0 +1,21 @@
+import type { IssuesResponse } from "../../api/client";
+
+// The issue sources /api/issues can list in unchecked_sources, and the line
+// each one gets wherever Radar's issues would otherwise read as complete.
+const SOURCE_LINES: Record<string, string> = {
+  helm: "Helm releases couldn't be checked, so failed or stuck releases may be missing.",
+};
+
+// For a source this version doesn't know, sent by a newer Radar.
+export const UNKNOWN_SOURCE_LINE = "Some issue checks couldn't run, so issues may be missing.";
+
+/** One line per unchecked source, known sources first, without repeats. */
+export function uncheckedSourceLines(sources: IssuesResponse["unchecked_sources"]): string[] {
+  const known = new Set<string>();
+  let unknown = false;
+  for (const { source } of sources ?? []) {
+    if (Object.hasOwn(SOURCE_LINES, source)) known.add(SOURCE_LINES[source]);
+    else unknown = true;
+  }
+  return unknown ? [...known, UNKNOWN_SOURCE_LINE] : [...known];
+}

package/src/components/resource/PVCUsageBar.render.test.tsx

@@ -182,3 +182,35 @@ describe('PVC metrics next step', () => {
     expect(render()).not.toContain('Ask your operator')
   })
 })
+
+describe('PVC scope remedies', () => {
+  it.each(['ambiguous_scope', 'scope_mismatch'] as const)('shows operator scope controls for %s to owners and viewers', scope => {
+    statusResult = { data: { connected: true } }
+    usageResult = { data: { ...measured, hasData: false, status: scope } }
+    roleLoading = false
+    for (const owner of [true, false]) {
+      canConfigure = owner
+      const html = render()
+      expect(html).toContain('--prometheus-cluster-label')
+      expect(html).toContain('traffic.prometheusClusterLabels')
+      expect(html).toContain('not available in Settings or Desktop')
+      expect(html).not.toContain('Configure metrics')
+      expect(html).not.toContain('verified labels')
+      if (scope === 'scope_mismatch') {
+        expect(html).toContain('align cluster labels')
+        expect(html).toContain('affects all these charts')
+        expect(html).toContain('dedicated to this cluster')
+      }
+    }
+  })
+
+  it('keeps connection settings when a cached scope failure outlives the connection', () => {
+    canConfigure = true
+    roleLoading = false
+    statusResult = { data: { connected: false } }
+    usageResult = { data: { ...measured, hasData: false, status: 'ambiguous_scope' } }
+    const html = render()
+    expect(html).toContain('Configure metrics')
+    expect(html).not.toContain('--prometheus-cluster-label')
+  })
+})

package/src/components/resource/PVCUsageBar.test.tsx

@@ -0,0 +1,24 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { expect, it, vi } from 'vitest'
+import { PVCUsageBar } from './PVCUsageBar'
+
+const state = vi.hoisted(() => ({ status: 'ambiguous_scope' }))
+vi.mock('../../api/client', () => ({
+  isForbiddenError: () => false,
+  useAutoPromConnect: () => {},
+  useCloudRole: () => ({ canAtLeast: () => false, isLoading: false }),
+  usePrometheusStatus: () => ({ data: { connected: true } }),
+  usePrometheusPVCUsage: () => ({ data: { status: state.status, hasData: false } }),
+}))
+vi.mock('../../context/NavCustomization', () => ({ useNavCustomization: () => ({ embedded: true }) }))
+vi.mock('../../hooks/usePreviousIntegrationSettings', () => ({ usePreviousIntegrationSettings: () => ({}), previousSettingsNote: () => undefined }))
+
+it('distinguishes mismatched volume-stat labels from multiple cluster identities', () => {
+  state.status = 'ambiguous_scope'
+  expect(renderToStaticMarkup(<PVCUsageBar namespace="demo" name="disk" />)).toContain('more than one cluster')
+  state.status = 'scope_mismatch'
+  const html = renderToStaticMarkup(<PVCUsageBar namespace="demo" name="disk" />)
+  expect(html).toContain('could not match this volume’s stats to this cluster')
+  expect(html).toContain('Used space is unknown')
+  expect(html).not.toContain('more than one cluster')
+})

package/src/components/resource/PVCUsageBar.tsx

@@ -33,23 +33,32 @@ export function PVCUsageBar({ namespace, name }: { namespace: string; name: stri
     unavailable = 'Loading usage measurements…'
   } else if (usage.status === 'no_series') {
     unavailable = 'No usage measurements reported for this volume.'
+  } else if (usage.status === 'ambiguous_scope') {
+    unavailable = 'Prometheus has volume stats with this name from more than one cluster. Radar cannot tell which belong to this cluster. Used space is unknown.'
+  } else if (usage.status === 'scope_mismatch') {
+    unavailable = 'Radar could not match this volume’s stats to this cluster. Used space is unknown.'
   } else if (usage.status === 'invalid_data') {
     unavailable = 'Volume usage measurements are invalid. Used space is unknown.'
   } else if (!usage.hasData) {
     unavailable = 'Usage measurements are unavailable.'
   }
 
+  const scopeFailure = isConnected && !error && !statusError && (usage?.status === 'ambiguous_scope' || usage?.status === 'scope_mismatch')
   const denied = isForbiddenError(error) || isForbiddenError(statusError)
   const waiting = !denied && !statusError && (!status || status.discovering || (isConnected && !usage && !error))
   const offers = usePreviousIntegrationSettings(canConfigure && !waiting && !denied && !statusError && !isConnected)
   const previousNote = offers.metrics ? previousSettingsNote('metrics', offers.metrics) : undefined
   const guidance = denied
     ? 'Ask your operator to review your metrics access.'
-    : !canConfigure && !roleLoading
-      ? !isConnected || statusError
-        ? 'Ask your operator to check the metrics connection for this cluster.'
-        : 'Ask your operator to check metrics availability for this volume.'
-      : undefined
+    : scopeFailure
+      ? usage.status === 'ambiguous_scope'
+        ? 'An operator can set this cluster’s exact metrics labels with --prometheus-cluster-label, or traffic.prometheusClusterLabels in Helm. These scope controls are not available in Settings or Desktop.'
+        : 'Ask your operator to align cluster labels across kube-state-metrics, workload metrics and volume stats. --prometheus-cluster-label (Helm: traffic.prometheusClusterLabels) affects all these charts; its labels must exist on every affected source. For a backend dedicated to this cluster, an operator can use --prometheus-single-cluster instead. These scope controls are not available in Settings or Desktop.'
+      : !canConfigure && !roleLoading
+        ? !isConnected || statusError
+          ? 'Ask your operator to check the metrics connection for this cluster.'
+          : 'Ask your operator to check metrics availability for this volume.'
+        : undefined
 
   if (unavailable || !usage) {
     return (
@@ -58,7 +67,7 @@ export function PVCUsageBar({ namespace, name }: { namespace: string; name: stri
         <p className="text-sm text-theme-text-tertiary">{unavailable}</p>
         {previousNote && <p className="mt-2 text-xs text-theme-text-secondary">{previousNote}</p>}
         {!waiting && (
-          canConfigure && !denied ? (
+          canConfigure && !denied && !scopeFailure ? (
             <button
               type="button"
               className="mt-2 text-xs text-accent hover:underline"