@skyhook-io/radar-app 1.8.6 → 1.8.7

package/src/components/workload/WorkloadView.tsx

@@ -1,5 +1,5 @@
 import { useMemo, useEffect, useCallback, useState } from 'react'
-import { useQueries } from '@tanstack/react-query'
+import { useQueries, useQueryClient } from '@tanstack/react-query'
 import { useNavigate, useLocation, useSearchParams } from 'react-router-dom'
 import { clsx } from 'clsx'
 import { Terminal } from 'lucide-react'
@@ -12,23 +12,31 @@ import {
   type GitOpsOwnerRef,
   type GitOpsStatus,
   type HelmOwnerRef,
+  type AppRow,
+  type ResourceOwnershipContext,
+  type ServingResourceDetail,
+  type AuditFinding,
   gitOpsRouteForOwner,
   gitOpsOwnerFromRelationships,
   getGitOpsResourceStatus,
   resolvedEnvFromKey,
 } from '@skyhook-io/k8s-ui'
+import type { ServicePortRenderProps } from '@skyhook-io/k8s-ui/components/resources/renderers/ServiceRenderer'
 import type { SelectedResource, ResourceRef, Relationships, ResolvedEnvFrom } from '../../types'
-import { kindToPlural, buildWorkloadPath, type NavigateToResource } from '../../utils/navigation'
+import { kindToPlural, pluralToKind, relatedResourcePath, type NavigateToResource } from '../../utils/navigation'
 import {
   useChanges, useResourceWithRelationships, usePodLogs, useTopology, useUpdateResource,
   useDeleteResource, useTriggerCronJob, useSuspendCronJob, useResumeCronJob,
   useRestartWorkload, useWorkloadRevisions, useRollbackWorkload,
+  useWorkloadPods,
   useFluxReconcile, useFluxSyncWithSource, useFluxSuspend, useFluxResume,
   useArgoSync, useArgoRefresh, useArgoSuspend, useArgoResume,
   useCordonNode, useUncordonNode, useDrainNode,
   useCascadeDeletePreview,
   useResourceEvents,
   useResource,
+  useWorkloadRuns,
+  useApplications,
   fetchJSON,
 } from '../../api/client'
 import { PrometheusCharts, isPrometheusSupported } from '../resource/PrometheusCharts'
@@ -38,10 +46,14 @@ import { RightsizingStrip } from '../resource/RightsizingStrip'
 import { useResourceAudit, useResourceIssues, useResources } from '../../api/client'
 import { AuditAlerts, ResourceIssuesSection } from '@skyhook-io/k8s-ui'
 import { WorkloadLogsViewer } from '../logs/WorkloadLogsViewer'
+import { ScheduledWorkloadLogsViewer } from '../logs/ScheduledWorkloadLogsViewer'
 import { LogsViewer } from '../logs/LogsViewer'
+import { BatchExecutionFullscreen } from '../execution/BatchExecutionView'
+import { workloadRunTimelineEvents } from '../execution/batch-timeline'
 import { useCanUpdateSecrets, useCanNodeWrite, useNamespacedCapabilities, useIsLocalDeployment } from '../../contexts/CapabilitiesContext'
 import { useOpenTerminal, useOpenLogs, useOpenWorkloadLogs, useOpenNodeTerminal } from '../dock'
-import { PortForwardButton } from '../portforward/PortForwardButton'
+import { PortForwardButton, PortForwardInlineButton } from '../portforward/PortForwardButton'
+import { CurlButton, CurlPanel, isHttpishPort, defaultScheme, defaultPathForPort } from '../curl/ServiceCurlButton'
 import { useToast } from '../ui/Toast'
 import { Tooltip } from '../ui/Tooltip'
 import { PodRenderer } from '../resources/renderers/PodRenderer'
@@ -59,9 +71,11 @@ import { CreateResourceDialog } from '../shared/CreateResourceDialog'
 import { cleanYamlForDuplicate } from '../../utils/skeleton-yaml'
 import { useDesktopDownload } from '../../hooks/useDesktopDownload'
 import { useCompareLauncher } from '../compare/useCompareLauncher'
+import { useDiagnoseCustomization } from '../../context/DiagnoseCustomization'
 import { apiVersionToGroup } from '../../utils/navigation'
 
 type TabType = WorkloadTabType
+const BATCH_EXECUTION_KINDS = new Set(['Job', 'CronJob', 'Workflow', 'CronWorkflow', 'WorkflowTemplate', 'ClusterWorkflowTemplate', 'ScaledJob'])
 
 // Stable reference — web renderer wrappers inject platform hooks internally
 const rendererOverrides: RendererOverrides = {
@@ -122,7 +136,7 @@ export function WorkloadViewRoute({ onNavigateToResource }: WorkloadViewRoutePro
   }, [navigate])
 
   const handleNavigate = useCallback((resource: SelectedResource) => {
-    navigate(buildWorkloadPath(resource))
+    navigate(relatedResourcePath(resource))
   }, [navigate])
 
   // Hooks must run unconditionally — the invalid-URL guard comes after them.
@@ -169,6 +183,7 @@ interface WorkloadViewProps {
   onCancelExpandIntent?: () => void
   initialTab?: 'detail' | 'yaml'
   group?: string
+  pushTabHistory?: boolean
 }
 
 function useActionsBarProps(kind: string, namespace: string, name: string) {
@@ -210,6 +225,8 @@ function useActionsBarProps(kind: string, namespace: string, name: string) {
   const uncordonMutation = useUncordonNode()
   const drainMutation = useDrainNode()
 
+  const renderDiagnose = useDiagnoseCustomization()
+
   return {
     canExec,
     canViewLogs,
@@ -222,6 +239,7 @@ function useActionsBarProps(kind: string, namespace: string, name: string) {
     renderPortForward: ({ type, namespace: ns, name: n, className }: { type: 'pod' | 'service'; namespace: string; name: string; className?: string }) => (
       <PortForwardButton type={type} namespace={ns} name={n} className={className} />
     ),
+    renderDiagnose,
     onDelete: (params: Parameters<typeof deleteMutation.mutate>[0], callbacks?: { onSuccess?: () => void }) => deleteMutation.mutate(params, { onSuccess: callbacks?.onSuccess }),
     isDeleting: deleteMutation.isPending,
     cascadeDependents: cascadePreview?.dependents,
@@ -270,9 +288,12 @@ export function WorkloadView({
   namespace,
   name,
   expanded = true,
+  pushTabHistory = false,
   ...rest
 }: WorkloadViewProps) {
   const [searchParams, setSearchParams] = useSearchParams()
+  const apiKind = kindToPlural(kindProp)
+  const queryClient = useQueryClient()
 
   // Tab state from URL query param — migrate legacy tab names
   const rawTab = searchParams.get('tab')
@@ -280,26 +301,63 @@ export function WorkloadView({
     : rawTab === 'events' ? 'timeline'
     : (rawTab as TabType) || 'overview'
 
-  const handleTabChange = useCallback((tab: TabType) => {
+  const handleTabChange = useCallback((tab: TabType, opts?: { replace?: boolean }) => {
     const params = new URLSearchParams(searchParams)
     if (tab === 'overview') {
       params.delete('tab')
     } else {
       params.set('tab', tab)
     }
+    setSearchParams(params, { replace: opts?.replace ?? !pushTabHistory })
+  }, [pushTabHistory, searchParams, setSearchParams])
+
+  const selectedRunKey = searchParams.get('run') ?? ''
+  const handleSelectedRunChange = useCallback((runKey: string) => {
+    const params = new URLSearchParams(searchParams)
+    if (runKey) params.set('run', runKey)
+    else params.delete('run')
     setSearchParams(params, { replace: true })
   }, [searchParams, setSearchParams])
 
+  const batchKind = pluralToKind(apiKind)
+  const batchExecution = BATCH_EXECUTION_KINDS.has(batchKind)
+  const batchRunsQuery = useWorkloadRuns(apiKind, namespace, name, expanded && batchExecution, {
+    refetchActive: true,
+    clusterScoped: batchKind === 'ClusterWorkflowTemplate',
+  })
+  const relatedTimelineEvents = useMemo(
+    () => workloadRunTimelineEvents(batchRunsQuery.data?.runs ?? []),
+    [batchRunsQuery.data?.runs],
+  )
+
   // Fetch resource with relationships
-  const { data: resourceResponse, isLoading: resourceLoading, error: resourceError, refetch: refetchResource } = useResourceWithRelationships<any>(kindProp, namespace, name, rest.group)
+  const { data: resourceResponse, isLoading: resourceLoading, error: resourceError, refetch: refetchResource } = useResourceWithRelationships<any>(apiKind, namespace, name, rest.group)
   const resource = resourceResponse?.resource
   const relationships = resourceResponse?.relationships
+  const refetchResourceAndRuns = useCallback(async () => {
+    await Promise.all([
+      refetchResource(),
+      queryClient.refetchQueries({ queryKey: ['workload-runs', apiKind, namespace, name] }),
+    ])
+  }, [apiKind, name, namespace, queryClient, refetchResource])
+  const podWorkloadOwner = useMemo(
+    () => podWorkloadOwnerFromRelationships(apiKind, namespace, relationships, resource),
+    [apiKind, namespace, relationships, resource],
+  )
+  const podOwnerAppsQuery = useApplications(
+    podWorkloadOwner?.namespace ? [podWorkloadOwner.namespace] : [],
+    { enabled: Boolean(podWorkloadOwner?.namespace) },
+  )
+  const ownershipContext = useMemo(
+    () => buildPodOwnershipContext(podWorkloadOwner, podOwnerAppsQuery.data?.applications),
+    [podWorkloadOwner, podOwnerAppsQuery.data?.applications],
+  )
   const certificateInfo = resourceResponse?.certificateInfo
   const hpaDiagnosis = resourceResponse?.hpaDiagnosis
   const relationshipGitopsOwner = useMemo(() => gitOpsOwnerFromRelationships(relationships), [relationships])
   const inheritedGitOpsLookupRef = useMemo(
-    () => findInheritedGitOpsLookupRef(relationships, relationshipGitopsOwner, { kind: kindProp, namespace, name, group: rest.group }),
-    [relationships, relationshipGitopsOwner, kindProp, namespace, name, rest.group],
+    () => findInheritedGitOpsLookupRef(relationships, relationshipGitopsOwner, { kind: apiKind, namespace, name, group: rest.group }),
+    [relationships, relationshipGitopsOwner, apiKind, namespace, name, rest.group],
   )
   const inheritedGitOpsResponse = useResourceWithRelationships<any>(
     inheritedGitOpsLookupRef ? kindToPlural(inheritedGitOpsLookupRef.kind) : '',
@@ -353,7 +411,7 @@ export function WorkloadView({
   )
 
   // For pods: extract envFrom ConfigMap/Secret names and resolve their keys
-  const isPod = kindProp.toLowerCase() === 'pods'
+  const isPod = apiKind === 'pods'
   const { envFromConfigMapNames, envFromSecretNames } = useMemo(() => {
     if (!isPod || !resource) return { envFromConfigMapNames: [] as string[], envFromSecretNames: [] as string[] }
     const cmNames = new Set<string>()
@@ -418,7 +476,7 @@ export function WorkloadView({
     isLoading: resourceFocusedEventsLoading,
     k8sError: resourceFocusedK8sError,
     updatesError: resourceFocusedUpdatesError,
-  } = useResourceEvents(kindProp, namespace, name)
+  } = useResourceEvents(apiKind, namespace, name)
 
   // Fetch all events for this resource's namespace (only when expanded)
   const { data: allEvents, isLoading: eventsLoading } = useChanges({
@@ -432,8 +490,60 @@ export function WorkloadView({
 
   // RBAC
   const canUpdateSecrets = useCanUpdateSecrets()
+  const { canPortForward } = useNamespacedCapabilities(namespace)
+  const isLocalDeployment = useIsLocalDeployment()
+  const showServingPortForward = canPortForward || !isLocalDeployment
+  const showServingCurl = !isLocalDeployment
+  const [servingCurl, setServingCurl] = useState<{ namespace: string; serviceName: string; port: number; closing: boolean } | null>(null)
+  const closeServingCurl = useCallback(() => {
+    setServingCurl((p) => (p ? { ...p, closing: true } : null))
+    window.setTimeout(() => setServingCurl((p) => (p?.closing ? null : p)), 220)
+  }, [])
+  const renderServicePortAction = useCallback((props: ServicePortRenderProps) => {
+    const active = servingCurl?.namespace === props.namespace &&
+      servingCurl?.serviceName === props.serviceName &&
+      servingCurl?.port === props.port &&
+      !servingCurl.closing
+    return (
+      <>
+        {showServingCurl && isHttpishPort(props.port, props.name, props.appProtocol, props.protocol) && (
+          <CurlButton
+            active={active}
+            onClick={() => {
+              if (active) closeServingCurl()
+              else setServingCurl({ namespace: props.namespace, serviceName: props.serviceName, port: props.port, closing: false })
+            }}
+          />
+        )}
+        {showServingPortForward && (
+          <PortForwardInlineButton
+            namespace={props.namespace}
+            serviceName={props.serviceName}
+            port={props.port}
+            protocol={props.protocol}
+          />
+        )}
+      </>
+    )
+  }, [closeServingCurl, servingCurl, showServingCurl, showServingPortForward])
+  const renderServicePortPanel = useCallback((props: ServicePortRenderProps) => {
+    const active = servingCurl?.namespace === props.namespace &&
+      servingCurl?.serviceName === props.serviceName &&
+      servingCurl?.port === props.port
+    return active ? (
+      <CurlPanel
+        namespace={props.namespace}
+        serviceName={props.serviceName}
+        port={props.port}
+        initialScheme={defaultScheme(props.port, props.name, props.appProtocol)}
+        initialPath={defaultPathForPort(props.port, props.name, props.appProtocol)}
+        open={!servingCurl.closing}
+        onClose={closeServingCurl}
+      />
+    ) : null
+  }, [closeServingCurl, servingCurl])
   const updateResource = useUpdateResource()
-  const baseActionsBarProps = useActionsBarProps(kindProp, namespace, name)
+  const baseActionsBarProps = useActionsBarProps(apiKind, namespace, name)
   const desktopDownload = useDesktopDownload()
 
   const resourceGroup = useMemo(
@@ -443,14 +553,16 @@ export function WorkloadView({
   // Live Operational Issues for this resource. Fetched here (not inside the lead
   // render-prop) so the count also gates `hasOperationalIssues` — which tells the
   // renderers to suppress their own status-derived problems and avoid duplicates.
-  // Keyed on the STABLE prop kind+group (same inputs as the resource fetch above),
+  // Keyed on the stable API kind+group (same inputs as the resource fetch above),
   // NOT the manifest-derived ones: deriving kind/group from the loaded resource
   // would flip the query key when the manifest arrives, drop liveIssues, and flash
   // the renderer banners. The backend canonicalizes a plural kind via discovery,
-  // so passing the route's plural kindProp resolves correctly.
-  const { data: liveIssues } = useResourceIssues(kindProp, rest.group, namespace, name)
+  // so using the normalized API kind resolves direct links and app navigation alike.
+  const { data: liveIssues } = useResourceIssues(apiKind, rest.group, namespace, name)
+  const { data: auditFindings } = useResourceAudit(apiKind, namespace, name)
+  const hasOperationalIssues = Boolean(liveIssues?.length)
   const { onCompareTo, onCompareAcrossClusters, picker: comparePicker } = useCompareLauncher({
-    kind: kindProp,
+    kind: apiKind,
     namespace,
     name,
     // Prefer the URL-supplied group so Compare works even before the resource
@@ -491,6 +603,19 @@ export function WorkloadView({
     },
     [navigateRouter, searchParams],
   )
+  const handleOpenApplication = useCallback(
+    (appKey: string) => {
+      const params = new URLSearchParams()
+      const namespaces = new Set((searchParams.get('namespaces') ?? '').split(',').map((ns) => ns.trim()).filter(Boolean))
+      if (ownershipContext?.application?.key === appKey && ownershipContext.workload.namespace) {
+        namespaces.add(ownershipContext.workload.namespace)
+      }
+      if (namespaces.size > 0) params.set('namespaces', Array.from(namespaces).join(','))
+      params.set('app', appKey)
+      navigateRouter({ pathname: '/applications', search: params.toString() })
+    },
+    [navigateRouter, ownershipContext, searchParams],
+  )
 
   // Duplicate dialog
   const [duplicateDialogOpen, setDuplicateDialogOpen] = useState(false)
@@ -501,10 +626,46 @@ export function WorkloadView({
     setDuplicateDialogOpen(true)
   }, [])
 
+  const supportsWorkloadPods = ['deployments', 'statefulsets', 'daemonsets'].includes(apiKind)
+  const workloadPodsQuery = useWorkloadPods(
+    supportsWorkloadPods ? apiKind : '',
+    namespace,
+    name,
+  )
+  const servingRefs = useMemo(() => collectServingRefs(relationships), [relationships])
+  const servingQueries = useQueries({
+    queries: servingRefs.map((ref) => {
+      const pluralKind = kindToPlural(ref.kind)
+      const ns = ref.namespace || '_'
+      const params = new URLSearchParams()
+      if (ref.group) params.set('group', ref.group)
+      const queryString = params.toString()
+      return {
+        queryKey: ['resource', pluralKind, ref.namespace, ref.name, ref.group],
+        queryFn: () => fetchJSON<any>(`/resources/${pluralKind}/${ns}/${ref.name}${queryString ? `?${queryString}` : ''}`),
+        enabled: expanded && Boolean(ref.kind && ref.name),
+        staleTime: 30000,
+      }
+    }),
+  })
+  const servingResources = useMemo<ServingResourceDetail[]>(
+    () => servingRefs.map((ref, index) => {
+      const query = servingQueries[index]
+      const data = query?.data?.resource ?? query?.data
+      return {
+        ref,
+        resource: data,
+        loading: query?.isLoading ?? false,
+        error: (query?.error as Error | null) ?? null,
+      }
+    }),
+    [servingRefs, servingQueries],
+  )
+
   return (
     <>
     <BaseWorkloadView
-      kind={kindProp}
+      kind={apiKind}
       namespace={namespace}
       name={name}
       expanded={expanded}
@@ -512,14 +673,23 @@ export function WorkloadView({
       // Data
       resource={resource}
       relationships={relationships}
+      ownershipContext={ownershipContext}
+      onOpenApplication={handleOpenApplication}
       certificateInfo={certificateInfo}
       hpaDiagnosis={hpaDiagnosis}
+      workloadPods={supportsWorkloadPods ? workloadPodsQuery.data?.pods : undefined}
+      workloadPodsLoading={supportsWorkloadPods ? workloadPodsQuery.isLoading : false}
+      workloadPodsError={supportsWorkloadPods ? (workloadPodsQuery.error as Error | null) : null}
+      servingResources={servingResources}
+      renderServicePortAction={renderServicePortAction}
+      renderServicePortPanel={renderServicePortPanel}
       isLoading={resourceLoading}
       resourceError={resourceError}
-      refetch={refetchResource}
+      refetch={refetchResourceAndRuns}
       // Timeline
       allEvents={allEvents}
-      eventsLoading={eventsLoading}
+      relatedTimelineEvents={relatedTimelineEvents}
+      eventsLoading={eventsLoading || (batchExecution && batchRunsQuery.isLoading)}
       topology={topology}
       resourceFocusedK8sEvents={resourceFocusedK8sEvents}
       resourceFocusedUpdates={resourceFocusedUpdates}
@@ -536,7 +706,24 @@ export function WorkloadView({
       activeTab={migratedTab}
       onTabChange={handleTabChange}
       // Render props
-      renderLogsTab={(props) => <LogsTabContent {...props} />}
+      renderLogsTab={(props) => <LogsTabContent {...props} selectedRunKey={selectedRunKey} onSelectRun={handleSelectedRunChange} />}
+      renderExpandedOverview={({ kind: k, apiKind, namespace: ns, name: n, resource: res }) =>
+        BATCH_EXECUTION_KINDS.has(k) && res ? (
+          <BatchExecutionFullscreen
+            kind={k}
+            apiKind={apiKind}
+            namespace={ns}
+            name={n}
+            resource={res}
+            selectedRunKey={selectedRunKey}
+            canViewLogs={baseActionsBarProps.canViewLogs}
+            onSelectRun={handleSelectedRunChange}
+            onSwitchToLogs={() => handleTabChange('logs')}
+            onSwitchToTimeline={() => handleTabChange('timeline')}
+            onNavigateToResource={rest.onNavigateToResource}
+          />
+        ) : null
+      }
       renderRelatedYaml={(ref) => <RelatedResourceYaml key={`${ref.kind}/${ref.namespace}/${ref.name}`} target={ref} />}
       renderMetricsTab={({ kind, namespace: ns, name: n }) => (
         <MetricsTabContent kind={kind} namespace={ns} name={n} resource={resource} expanded={expanded} />
@@ -551,8 +738,8 @@ export function WorkloadView({
       resolvedEnvFrom={resolvedEnvFrom}
       renderOverviewExtra={({ kind: k, namespace: ns, name: n }) => (
         <>
-          <AuditSection kind={k} namespace={ns} name={n} />
           <FluxSourceConsumersSection kind={k} namespace={ns} name={n} />
+          <AuditOverviewSection findings={auditFindings ?? []} onViewAll={() => navigateRouter('/checks')} />
         </>
       )}
       renderOverviewLead={() => (
@@ -571,7 +758,7 @@ export function WorkloadView({
           }
         />
       )}
-      hasOperationalIssues={!!liveIssues?.length}
+      hasOperationalIssues={hasOperationalIssues}
       onOpenGitOpsResource={gitopsOwnerQuery.data ? handleOpenGitOpsResource : undefined}
       resolvedGitOpsOwner={gitopsOwner}
       gitOpsOwnerVerified={gitOpsOwnerVerified}
@@ -597,6 +784,26 @@ export function WorkloadView({
   )
 }
 
+function collectServingRefs(relationships: Relationships | undefined): ResourceRef[] {
+  if (!relationships) return []
+  return dedupeRefs([
+    ...(relationships.services ?? []),
+    ...(relationships.ingresses ?? []),
+    ...(relationships.gateways ?? []),
+    ...(relationships.routes ?? []),
+  ])
+}
+
+function dedupeRefs(refs: ResourceRef[]): ResourceRef[] {
+  const seen = new Set<string>()
+  return refs.filter((ref) => {
+    const key = `${ref.kind}/${ref.namespace}/${ref.name}/${ref.group ?? ''}`
+    if (seen.has(key)) return false
+    seen.add(key)
+    return true
+  })
+}
+
 function resolveGitOpsOwner(owner: GitOpsOwnerRef | null, argoApplications: any[] | undefined): GitOpsOwnerRef | null {
   if (!owner || owner.namespace || owner.tool !== 'argocd') return owner
   const matches = (argoApplications ?? []).filter((app) => app?.metadata?.name === owner.name)
@@ -624,6 +831,60 @@ function findInheritedGitOpsLookupRef(
   return candidates.find((ref) => !isCurrentResource(ref, current)) ?? null
 }
 
+const POD_OWNERSHIP_WORKLOAD_KINDS = new Set(['deployments', 'statefulsets', 'daemonsets', 'jobs', 'cronjobs', 'rollouts'])
+
+function podWorkloadOwnerFromRelationships(kind: string, namespace: string, relationships: Relationships | undefined, resource: any): ResourceRef | null {
+  if (kindToPlural(kind).toLowerCase() !== 'pods') return null
+
+  if (relationships?.deployment) return relationships.deployment
+
+  const managedWorkload = relationships?.managedBy?.find((ref) => isPodOwnershipWorkloadRef(ref))
+  if (managedWorkload) return managedWorkload
+
+  if (relationships?.owner && isPodOwnershipWorkloadRef(relationships.owner)) return relationships.owner
+
+  return podControllerOwnerFromMetadata(namespace, resource)
+}
+
+function isPodOwnershipWorkloadRef(ref: ResourceRef): boolean {
+  return POD_OWNERSHIP_WORKLOAD_KINDS.has(kindToPlural(ref.kind).toLowerCase())
+}
+
+function podControllerOwnerFromMetadata(namespace: string, resource: any): ResourceRef | null {
+  const ownerRefs = resource?.metadata?.ownerReferences
+  if (!Array.isArray(ownerRefs)) return null
+  const owner = ownerRefs.find((ref) => ref?.controller === true) ?? null
+  if (!owner?.kind || !owner?.name) return null
+  if (!isPodOwnershipWorkloadRef({ kind: owner.kind, namespace, name: owner.name })) return null
+  return {
+    kind: owner.kind,
+    namespace,
+    name: owner.name,
+    group: apiVersionToGroup(owner.apiVersion),
+  }
+}
+
+function buildPodOwnershipContext(
+  workload: ResourceRef | null,
+  apps: AppRow[] | undefined,
+): ResourceOwnershipContext | undefined {
+  if (!workload) return undefined
+  const matches = (apps ?? []).filter((app) =>
+    (app.workloads ?? []).some((candidate) => sameWorkload(candidate, workload)),
+  )
+  const app = matches.length === 1 ? matches[0] : null
+  return {
+    workload,
+    application: app ? { key: app.key, name: app.name } : undefined,
+  }
+}
+
+function sameWorkload(candidate: { kind: string; namespace: string; name: string }, workload: ResourceRef): boolean {
+  return kindToPlural(candidate.kind).toLowerCase() === kindToPlural(workload.kind).toLowerCase()
+    && candidate.namespace === workload.namespace
+    && candidate.name === workload.name
+}
+
 function nativeHelmOwnerFromRelationships(relationships: Relationships | undefined, fallbackNamespace: string): HelmOwnerRef | null {
   const ref = relationships?.managedBy?.[0]
   if (!ref || !isNativeHelmManager(ref)) return null
@@ -699,7 +960,8 @@ function hasGitOpsStatusPayload(owner: GitOpsOwnerRef, resource: any): boolean {
 // LOGS TAB — platform-specific (uses data-fetching hooks)
 // ============================================================================
 
-const WORKLOAD_LOG_KINDS = new Set(['Deployment', 'StatefulSet', 'DaemonSet'])
+const WORKLOAD_LOG_KINDS = new Set(['Deployment', 'StatefulSet', 'DaemonSet', 'Job', 'Workflow'])
+const SCHEDULED_LOG_KINDS = new Set(['CronJob', 'CronWorkflow', 'WorkflowTemplate', 'ClusterWorkflowTemplate', 'ScaledJob'])
 
 function LogsTabContent({
   kind,
@@ -712,6 +974,8 @@ function LogsTabContent({
   onSelectPod,
   initialContainer,
   onConsumeInitialContainer,
+  selectedRunKey,
+  onSelectRun,
 }: {
   kind: string
   apiKind: string
@@ -723,12 +987,22 @@ function LogsTabContent({
   onSelectPod: (name: string | null) => void
   initialContainer: string | null
   onConsumeInitialContainer: () => void
+  selectedRunKey: string
+  onSelectRun: (runKey: string) => void
 }) {
-  // Workload kinds (Deployment, StatefulSet, DaemonSet) use the aggregated workload logs viewer
+  if (SCHEDULED_LOG_KINDS.has(kind)) {
+    return (
+      <div className="h-full">
+        <ScheduledWorkloadLogsViewer kind={apiKind} namespace={namespace} name={name} selectedRunKey={selectedRunKey} onSelectRun={onSelectRun} />
+      </div>
+    )
+  }
+
+  // Workload kinds with stable pod selectors use the aggregated workload logs viewer
   if (WORKLOAD_LOG_KINDS.has(kind)) {
     return (
       <div className="h-full">
-        <WorkloadLogsViewer kind={apiKind} namespace={namespace} name={name} />
+        <WorkloadLogsViewer kind={apiKind} namespace={namespace} name={name} autoStream={shouldAutoStreamWorkloadLogs(kind, resource)} />
       </div>
     )
   }
@@ -750,6 +1024,17 @@ function LogsTabContent({
   )
 }
 
+function shouldAutoStreamWorkloadLogs(kind: string, resource: any): boolean {
+  if (kind === 'Job') {
+    return (resource?.status?.active ?? 0) > 0
+  }
+  if (kind === 'Workflow') {
+    const phase = resource?.status?.phase
+    return phase === 'Running' || phase === 'Pending'
+  }
+  return true
+}
+
 function PodLogsTab({ namespace, name, resource, initialContainer, onConsumeInitialContainer }: {
   namespace: string
   name: string
@@ -860,11 +1145,9 @@ function MultiPodLogsTab({ pods, namespace, selectedPod, onSelectPod, initialCon
   )
 }
 
-function AuditSection({ kind, namespace, name }: { kind: string; namespace: string; name: string }) {
-  const navigate = useNavigate()
-  const { data: findings } = useResourceAudit(kind, namespace, name)
-  if (!findings || findings.length === 0) return null
-  return <AuditAlerts findings={findings} onViewAll={() => navigate('/checks')} />
+function AuditOverviewSection({ findings, onViewAll }: { findings: AuditFinding[]; onViewAll: () => void }) {
+  if (findings.length === 0) return null
+  return <AuditAlerts findings={findings} onViewAll={onViewAll} />
 }
 
 // FluxSourceConsumersSection lists the reconcilers (Kustomization, HelmRelease)
@@ -917,15 +1200,16 @@ function FluxSourceConsumersInner({ sourceKind, namespace, name }: { sourceKind:
 
   if (consumers.length === 0) {
     return (
-      <div className="rounded-lg border border-theme-border bg-theme-elevated/40 p-3 text-xs text-theme-text-tertiary">
-        Consumed by — no Kustomization or HelmRelease references this source.
-      </div>
+      <section className="rounded-lg border border-theme-border bg-theme-surface p-4 shadow-theme-sm">
+        <h3 className="mb-2 text-sm font-semibold text-theme-text-primary">Consumed by</h3>
+        <p className="text-xs text-theme-text-tertiary">No Kustomization or HelmRelease references this source.</p>
+      </section>
     )
   }
 
   return (
-    <div className="rounded-lg border border-theme-border bg-theme-elevated/40 p-3">
-      <h3 className="mb-2 text-xs font-medium text-theme-text-secondary">
+    <section className="rounded-lg border border-theme-border bg-theme-surface p-4 shadow-theme-sm">
+      <h3 className="mb-3 text-sm font-semibold text-theme-text-primary">
         Consumed by ({consumers.length})
       </h3>
       <div className="flex flex-wrap gap-1.5">
@@ -944,7 +1228,7 @@ function FluxSourceConsumersInner({ sourceKind, namespace, name }: { sourceKind:
           </Tooltip>
         ))}
       </div>
-    </div>
+    </section>
   )
 }