@spinnaker/kubernetes 2026.2.2 → 2026.3.0

package/src/loadBalancer/details/sections/LoadBalancerAnnotationCustomSection.tsx

@@ -1,9 +1,8 @@
 import React from 'react';
 import type { IKubernetesLoadBalancerDetailsSectionProps } from './IKubernetesLoadBalancerDetailsSectionProps';
-import { KubernetesReactInjector } from '../../../reactShims';
+import { AnnotationCustomSections } from '../../../manifest/AnnotationCustomSections';
 
 export function LoadBalancerAnnotationCustomSection({ loadBalancer }: IKubernetesLoadBalancerDetailsSectionProps) {
   const { manifest } = loadBalancer;
-  const { KubernetesAnnotationCustomSections } = KubernetesReactInjector;
-  return <KubernetesAnnotationCustomSections manifest={manifest.manifest} resource={loadBalancer} />;
+  return <AnnotationCustomSections manifest={manifest.manifest} resource={loadBalancer} />;
 }

package/src/loadBalancer/transformer.ts

@@ -5,7 +5,7 @@ import type { IInstanceCounts, IServerGroup } from '@spinnaker/core';
 import type { IKubernetesLoadBalancer } from '../interfaces';
 
 export class KubernetesLoadBalancerTransformer {
-  public normalizeLoadBalancer(loadBalancer: IKubernetesLoadBalancer): PromiseLike<IKubernetesLoadBalancer> {
+  public normalizeLoadBalancer(loadBalancer: IKubernetesLoadBalancer): Promise<IKubernetesLoadBalancer> {
     loadBalancer.provider = loadBalancer.type;
     loadBalancer.instances = [];
     loadBalancer.instanceCounts = this.buildInstanceCounts(loadBalancer.serverGroups);

package/src/manifest/AnnotationCustomSections.spec.tsx

@@ -0,0 +1,178 @@
+import { mount } from 'enzyme';
+import React from 'react';
+
+import { AnnotationCustomSections } from './AnnotationCustomSections';
+
+describe('<AnnotationCustomSections />', () => {
+  it('renders text annotations under section groups', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'deployment-details.details.spinnaker.io/owner-name': 'Delivery Platform',
+          'support.details.spinnaker.io/contact': 'On call',
+        })}
+        resource={resource()}
+      />,
+    );
+
+    expect(wrapper.find('h4').at(0).text()).toContain('deployment details');
+    expect(wrapper.find('h4').at(1).text()).toContain('support');
+    expect(wrapper.text()).toContain('owner name');
+    expect(wrapper.text()).toContain('Delivery Platform');
+    expect(wrapper.text()).toContain('contact');
+    expect(wrapper.text()).toContain('On call');
+  });
+
+  it('sanitizes HTML annotations while enforcing rel on targeted links', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'links.details.html.spinnaker.io/runbook':
+            '<a href="https://example.com/runbook" target="_blank" onclick="alert(1)">Runbook</a><a href="https://example.com/dashboard" target="dashboard">Dashboard</a><script>alert(2)</script>',
+        })}
+        resource={resource()}
+      />,
+    );
+
+    const html = wrapper.html();
+    expect((html.match(/target="_blank"/g) || []).length).toBe(2);
+    expect(html).not.toContain('target="dashboard"');
+    expect(html).toContain('rel="noopener noreferrer"');
+    expect((html.match(/rel="noopener noreferrer"/g) || []).length).toBe(2);
+    expect(html).toContain('Runbook');
+    expect(html).toContain('Dashboard');
+    expect(html).not.toContain('onclick');
+    expect(html).not.toContain('<script>');
+  });
+
+  it('escapes interpolated resource values in HTML annotations', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'summary.details.html.spinnaker.io/name': '<strong>Owner:</strong> {{ displayName }}',
+        })}
+        resource={resource({
+          displayName: '<a href="https://evil.example" target="_blank">Evil</a>',
+        })}
+      />,
+    );
+
+    const html = wrapper.html();
+    expect(html).toContain('<strong>Owner:</strong>');
+    expect(html).toContain('&lt;a href="https://evil.example" target="_blank"&gt;Evil&lt;/a&gt;');
+    expect(wrapper.find('a[href="https://evil.example"]').exists()).toBe(false);
+  });
+
+  it('interpolates path placeholders against resource and manifest values', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'summary.details.spinnaker.io/name': '{{ displayName }} in {{ namespace }} from {{ manifest.metadata.name }}',
+        })}
+        resource={resource({ displayName: 'frontend', namespace: 'production' })}
+      />,
+    );
+
+    expect(wrapper.text()).toContain('frontend in production from frontend-manifest');
+  });
+
+  it('leaves non-path expression placeholders unresolved', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'summary.details.spinnaker.io/name': '{{ displayName | uppercase }} {{ getDisplayName() }}',
+        })}
+        resource={resource({
+          displayName: 'frontend',
+          getDisplayName: () => 'frontend',
+        })}
+      />,
+    );
+
+    expect(wrapper.text()).toContain('{{ displayName | uppercase }} {{ getDisplayName() }}');
+  });
+
+  it('leaves prototype-chain path placeholders unresolved', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'summary.details.spinnaker.io/name':
+            '{{ constructor }} {{ resource.constructor }} {{ resource["constructor"] }} {{ resource.__proto__ }} {{ resource.prototype }} {{ displayName }}',
+        })}
+        resource={resource({ displayName: 'frontend' })}
+      />,
+    );
+
+    const text = wrapper.text();
+    expect(text).toContain(
+      '{{ constructor }} {{ resource.constructor }} {{ resource["constructor"] }} {{ resource.__proto__ }} {{ resource.prototype }} frontend',
+    );
+    expect(text).not.toContain('function Object');
+    expect(text).not.toContain('[object Object]');
+  });
+
+  it('treats inherited function path values as missing', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'summary.details.spinnaker.io/name': 'before {{ toString }} {{ resource.toString }} after {{ displayName }}',
+        })}
+        resource={resource({ displayName: 'frontend' })}
+      />,
+    );
+
+    const text = wrapper.text();
+    expect(text).toContain('before   after frontend');
+    expect(text).not.toContain('function toString');
+    expect(text).not.toContain('[native code]');
+  });
+
+  it('strips target attributes from sanitized non-anchor elements', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'links.details.html.spinnaker.io/runbook':
+            '<div target="_blank">Container</div><a href="https://example.com/runbook" target="_blank">Runbook</a>',
+        })}
+        resource={resource()}
+      />,
+    );
+
+    const html = wrapper.html();
+    expect(html).toContain('<div>Container</div>');
+    expect(html).toContain('target="_blank"');
+    expect(html).toContain('rel="noopener noreferrer"');
+    expect(html).not.toContain('<div target="_blank">');
+  });
+
+  it('renders text entries before HTML entries within the same section', () => {
+    const wrapper = mount(
+      <AnnotationCustomSections
+        manifest={manifestWithAnnotations({
+          'runbook.details.html.spinnaker.io/link': '<a href="https://example.com" target="_blank">Runbook</a>',
+          'runbook.details.spinnaker.io/summary': 'Read this first',
+        })}
+        resource={resource()}
+      />,
+    );
+
+    const sectionText = wrapper.find('.content-body').at(0).text();
+    expect(sectionText.indexOf('Read this first')).toBeLessThan(sectionText.indexOf('Runbook'));
+  });
+});
+
+const manifestWithAnnotations = (annotations: { [key: string]: string }) => ({
+  metadata: {
+    name: 'frontend-manifest',
+    annotations,
+  },
+});
+
+const resource = (overrides: any = {}) =>
+  ({
+    apiVersion: 'apps/v1',
+    displayName: 'frontend',
+    kind: 'Deployment',
+    namespace: 'default',
+    ...overrides,
+  } as any);

package/src/manifest/AnnotationCustomSections.tsx

@@ -1,6 +1,183 @@
-import type { IKubernetesResource } from '../interfaces';
+import DOMPurify from 'dompurify';
+import { get, partition } from 'lodash';
+import React from 'react';
+
+import { CollapsibleSection } from '@spinnaker/core';
+
+const PATH_EXPRESSION_PATTERN = /^[A-Za-z_$][\w$]*(?:(?:\.[A-Za-z_$][\w$]*)|\[(?:\d+|'[^']+'|"[^"]+")\])*$/;
+const BLOCKED_PATH_SEGMENT_PATTERN = /(?:^|\.)(?:constructor|__proto__|prototype)(?=\.|\[|$)|\[(?:"(?:constructor|__proto__|prototype)"|'(?:constructor|__proto__|prototype)')\]/;
 
 export interface IAnnotationCustomSectionsProps {
   manifest: any;
-  resource: IKubernetesResource;
+  resource: any;
+}
+
+interface IAnnotationsMap {
+  [key: string]: string;
+}
+
+interface ICustomSection {
+  title: string;
+  key: string;
+  isHtml: boolean;
+  content: string;
+}
+
+interface ICustomSectionMap {
+  [key: string]: ICustomSection[];
+}
+
+interface IParsedAnnotationKey {
+  title: string;
+  key: string;
+  isHtml: boolean;
+}
+
+export function AnnotationCustomSections({ manifest, resource }: IAnnotationCustomSectionsProps) {
+  const customSections = buildAnnotationSections(manifest?.metadata?.annotations, resource, manifest);
+
+  return (
+    <>
+      {Object.entries(customSections).map(([section, entries]) => (
+        <CollapsibleSection key={section} heading={section} defaultExpanded={true}>
+          {entries.map((entry, index) =>
+            entry.isHtml ? (
+              <div
+                key={`${entry.key}-${index}`}
+                dangerouslySetInnerHTML={{
+                  __html: entry.content,
+                }}
+              />
+            ) : (
+              <div key={`${entry.key}-${index}`}>
+                {entry.key && <span style={{ fontWeight: 'bold' }}>{entry.key}</span>} <span>{entry.content}</span>
+              </div>
+            ),
+          )}
+        </CollapsibleSection>
+      ))}
+    </>
+  );
+}
+
+function buildAnnotationSections(
+  annotations: IAnnotationsMap | undefined,
+  resource: any,
+  manifest: any,
+): ICustomSectionMap {
+  if (annotations == null) {
+    return {};
+  }
+
+  const customSections = Object.keys(annotations).reduce((memo: ICustomSectionMap, annotationKey: string) => {
+    const entry = annotationToEntry(annotations[annotationKey], annotationKey, resource, manifest);
+    if (entry != null && entry.title) {
+      memo[entry.title] = memo[entry.title] || [];
+      memo[entry.title].push(entry);
+    }
+    return memo;
+  }, {});
+
+  return Object.keys(customSections).reduce((memo: ICustomSectionMap, sectionTitle: string) => {
+    const [htmlEntries, textEntries] = partition(customSections[sectionTitle], (section) => section.isHtml);
+    memo[sectionTitle] = textEntries.concat(htmlEntries);
+    return memo;
+  }, {});
+}
+
+function annotationToEntry(
+  annotationContent: string,
+  annotationKey: string,
+  resource: any,
+  manifest: any,
+): ICustomSection | null {
+  const parsed = parseAnnotationKey(annotationKey);
+  if (parsed == null) {
+    return null;
+  }
+
+  const content =
+    resource && annotationContent.includes('{{')
+      ? interpolateAnnotation(annotationContent, resource, manifest, parsed.isHtml)
+      : annotationContent;
+
+  return {
+    title: parsed.title.replace(/-/g, ' ').trim(),
+    key: parsed.key.replace(/-/g, ' ').trim(),
+    content: parsed.isHtml ? sanitizeContent(content) : content,
+    isHtml: parsed.isHtml,
+  };
+}
+
+function parseAnnotationKey(annotationKey: string): IParsedAnnotationKey | null {
+  const keyParts = /([^.]+)\.details\.(html\.)?spinnaker\.io(?:\/(.*))?/.exec(annotationKey);
+  if (keyParts == null || keyParts.length !== 4) {
+    return null;
+  }
+  return {
+    title: keyParts[1] || '',
+    key: keyParts[3] || '',
+    isHtml: !!keyParts[2],
+  };
+}
+
+function interpolateAnnotation(content: string, resource: any, manifest: any, escapeValues = false): string {
+  const context = { ...resource, resource, manifest };
+  return content.replace(/{{\s*([^}]+?)\s*}}/g, (match, path: string) => {
+    const expression = path.trim();
+    if (!isPathExpression(expression)) {
+      return match;
+    }
+
+    const value = get(context, expression);
+    if (value == null || typeof value === 'function') {
+      return '';
+    }
+
+    const stringValue = String(value);
+    return escapeValues ? escapeHtml(stringValue) : stringValue;
+  });
+}
+
+function isPathExpression(expression: string): boolean {
+  return PATH_EXPRESSION_PATTERN.test(expression) && !BLOCKED_PATH_SEGMENT_PATTERN.test(expression);
+}
+
+function escapeHtml(value: string): string {
+  return value.replace(/[&<>"']/g, (character) => {
+    switch (character) {
+      case '&':
+        return '&amp;';
+      case '<':
+        return '&lt;';
+      case '>':
+        return '&gt;';
+      case '"':
+        return '&quot;';
+      case "'":
+        return '&#39;';
+      default:
+        return character;
+    }
+  });
+}
+
+function sanitizeContent(unsanitized: string): string {
+  const sanitized = DOMPurify.sanitize(unsanitized, {
+    ADD_ATTR: ['target'],
+  });
+  const container = document.createElement('div');
+  container.innerHTML = sanitized;
+  container.querySelectorAll('[target]').forEach((element) => {
+    if (element.tagName !== 'A') {
+      element.removeAttribute('target');
+      return;
+    }
+
+    const rel = new Set((element.getAttribute('rel') || '').split(/\s+/).filter(Boolean));
+    rel.add('noopener');
+    rel.add('noreferrer');
+    element.setAttribute('rel', Array.from(rel).join(' '));
+  });
+  return container.innerHTML;
 }

package/src/manifest/ManifestKindSearch.tsx

@@ -13,7 +13,7 @@ interface IManifestKindSearchResults {
 }
 
 export class ManifestKindSearchService {
-  public static search(kind: string, namespace: string, account: string): PromiseLike<IManifestKindSearchResults[]> {
+  public static search(kind: string, namespace: string, account: string): Promise<IManifestKindSearchResults[]> {
     return SearchService.search<IManifestKindSearchResults>({
       q: namespace,
       type: kind,

package/src/manifest/delete/Delete.tsx

@@ -1,10 +1,7 @@
-import { module } from 'angular';
 import React from 'react';
 import { MenuItem } from 'react-bootstrap';
-import { react2angular } from 'react2angular';
 
 import type { Application } from '@spinnaker/core';
-import { withErrorBoundary } from '@spinnaker/core';
 import { useModal } from '@spinnaker/core';
 
 import { DeleteModal } from './DeleteModal';
@@ -26,9 +23,3 @@ export function Delete(props: IDeleteProps) {
     </>
   );
 }
-
-export const KUBERNETES_DELETE = 'spinnaker.kubernetes.delete';
-module(KUBERNETES_DELETE, []).component(
-  'kubernetesDelete',
-  react2angular(withErrorBoundary(Delete, 'kubernetesDelete'), ['application', 'resource', 'manifestController']),
-);

package/src/manifest/delete/DeleteModal.tsx

@@ -1,5 +1,4 @@
 import { UISref } from '@uirouter/react';
-import { UIRouterContextComponent } from '@uirouter/react-hybrid';
 import type { FormikProps } from 'formik';
 import { Form } from 'formik';
 import React, { useState } from 'react';
@@ -19,7 +18,7 @@ import {
   ValidationMessage,
 } from '@spinnaker/core';
 
-import type { IDeleteOptions } from './delete.controller';
+import type { IDeleteOptions } from './delete.types';
 import type { IAnyKubernetesResource } from '../../interfaces';
 import DeleteManifestOptionsForm from '../../pipelines/stages/deleteManifest/DeleteManifestOptionsForm';
 
@@ -76,77 +75,75 @@ export function DeleteModal({
   };
 
   return (
-    <UIRouterContextComponent>
-      <Modal show={isOpen} onHide={dismissModal}>
-        <TaskMonitorWrapper monitor={taskMonitor} />
-        <SpinFormik<IKubernetesDeleteValues>
-          initialValues={initialValues}
-          onSubmit={submit}
-          render={(formik) => (
-            <>
-              <ModalClose dismiss={dismissModal} />
-              <Modal.Header>
-                <Modal.Title>
-                  Delete {robotToHuman(resource.name)} in {resource.namespace}
-                </Modal.Title>
-              </Modal.Header>
-              {manifestController && (
-                <div className="alert alert-warning">
-                  Manifest is controlled by{' '}
-                  <UISref
-                    to="^.serverGroupManager"
-                    params={{
-                      accountId: resource.account,
-                      region: resource.region,
-                      serverGroupManager: manifestController,
-                      provider: 'kubernetes',
-                    }}
-                  >
-                    <a> {robotToHuman(manifestController)} </a>
-                  </UISref>{' '}
-                  and may be recreated after deletion.
+    <Modal show={isOpen} onHide={dismissModal}>
+      <TaskMonitorWrapper monitor={taskMonitor} />
+      <SpinFormik<IKubernetesDeleteValues>
+        initialValues={initialValues}
+        onSubmit={submit}
+        render={(formik) => (
+          <>
+            <ModalClose dismiss={dismissModal} />
+            <Modal.Header>
+              <Modal.Title>
+                Delete {robotToHuman(resource.name)} in {resource.namespace}
+              </Modal.Title>
+            </Modal.Header>
+            {manifestController && (
+              <div className="alert alert-warning">
+                Manifest is controlled by{' '}
+                <UISref
+                  to="^.serverGroupManager"
+                  params={{
+                    accountId: resource.account,
+                    region: resource.region,
+                    serverGroupManager: manifestController,
+                    provider: 'kubernetes',
+                  }}
+                >
+                  <a> {robotToHuman(manifestController)} </a>
+                </UISref>{' '}
+                and may be recreated after deletion.
+              </div>
+            )}
+            <Modal.Body>
+              <Form className="form-horizontal">
+                <DeleteManifestOptionsForm
+                  onOptionsChange={(options: IDeleteOptions) => onOptionChange(formik, options)}
+                  options={{
+                    gracePeriodSeconds: formik.values.gracePeriodSeconds,
+                    cascading: formik.values.cascading,
+                  }}
+                />
+                <TaskReason reason={formik.values.reason} onChange={(val) => formik.setFieldValue('reason', val)} />
+              </Form>
+              {formik.status?.error && (
+                <div className="sp-margin-xl-top">
+                  <ValidationMessage
+                    type="error"
+                    message={
+                      <span className="flex-container-v">
+                        <span className="text-bold">Something went wrong:</span>
+                        {formik.status.error.message && <span>{formik.status.error.message}</span>}
+                      </span>
+                    }
+                  />
                 </div>
               )}
-              <Modal.Body>
-                <Form className="form-horizontal">
-                  <DeleteManifestOptionsForm
-                    onOptionsChange={(options: IDeleteOptions) => onOptionChange(formik, options)}
-                    options={{
-                      gracePeriodSeconds: formik.values.gracePeriodSeconds,
-                      cascading: formik.values.cascading,
-                    }}
-                  />
-                  <TaskReason reason={formik.values.reason} onChange={(val) => formik.setFieldValue('reason', val)} />
-                </Form>
-                {formik.status?.error && (
-                  <div className="sp-margin-xl-top">
-                    <ValidationMessage
-                      type="error"
-                      message={
-                        <span className="flex-container-v">
-                          <span className="text-bold">Something went wrong:</span>
-                          {formik.status.error.message && <span>{formik.status.error.message}</span>}
-                        </span>
-                      }
-                    />
-                  </div>
-                )}
-              </Modal.Body>
-              <Modal.Footer>
-                <UserVerification account={resource.account} onValidChange={setVerified} />
-                <Button onClick={dismissModal}>Cancel</Button>
-                <SubmitButton
-                  onClick={() => submit(formik.values)}
-                  isDisabled={!formik.isValid || formik.isSubmitting || !verified}
-                  isFormSubmit={true}
-                  submitting={formik.isSubmitting}
-                  label={`Delete ${resource.name}`}
-                />
-              </Modal.Footer>
-            </>
-          )}
-        />
-      </Modal>
-    </UIRouterContextComponent>
+            </Modal.Body>
+            <Modal.Footer>
+              <UserVerification account={resource.account} onValidChange={setVerified} />
+              <Button onClick={dismissModal}>Cancel</Button>
+              <SubmitButton
+                onClick={() => submit(formik.values)}
+                isDisabled={!formik.isValid || formik.isSubmitting || !verified}
+                isFormSubmit={true}
+                submitting={formik.isSubmitting}
+                label={`Delete ${resource.name}`}
+              />
+            </Modal.Footer>
+          </>
+        )}
+      />
+    </Modal>
   );
 }

package/src/manifest/delete/delete.types.ts

@@ -0,0 +1,4 @@
+export interface IDeleteOptions {
+  gracePeriodSeconds?: number;
+  cascading: boolean;
+}

package/src/manifest/index.ts

@@ -2,9 +2,6 @@ export * from './manifest.service';
 export * from './manifestCommandBuilder.service';
 export * from './IManifestCoordinates';
 export * from './artifact/ManifestArtifact';
-export * from './delete/delete.controller';
-export * from './rollout/pause.controller';
-export * from './rollout/undo.controller';
-export * from './scale/scale.controller';
-export * from './status/condition.component';
-export * from './status/status.component';
+export * from './delete/delete.types';
+export * from './scale/ScaleSettingsForm';
+export * from './status/ManifestCondition';

package/src/manifest/manifest.service.ts

@@ -10,6 +10,23 @@ export interface IStageManifest {
   };
 }
 
+// A manifest that the artifact-store entity storage feature has replaced with a
+// reference, rather than expanding it back into a real manifest before deck ever
+// sees it (e.g. gate isn't configured to expand these on read).
+export interface IStoredManifestReference {
+  type: string;
+  reference: string;
+}
+
+export function isStoredManifestReference(manifest: unknown): manifest is IStoredManifestReference {
+  return (
+    !!manifest &&
+    typeof manifest === 'object' &&
+    (manifest as IStoredManifestReference).type === 'remote/map/base64' &&
+    typeof (manifest as IStoredManifestReference).reference === 'string'
+  );
+}
+
 export interface IManifestParams {
   account: string;
   location: string;
@@ -21,7 +38,7 @@ export type IManifestCallback = (manifest: IManifest) => void;
 export class KubernetesManifestService {
   public static subscribe(app: Application, params: IManifestParams, fn: IManifestCallback): () => void {
     KubernetesManifestService.updateManifest(params, fn);
-    return app.onRefresh(null, () => KubernetesManifestService.updateManifest(params, fn));
+    return app.onRefresh(() => KubernetesManifestService.updateManifest(params, fn));
   }
 
   private static updateManifest(params: IManifestParams, fn: IManifestCallback) {

package/src/manifest/manifestCommandBuilder.service.spec.ts

@@ -0,0 +1,41 @@
+import { AccountService } from '@spinnaker/core';
+
+import { KubernetesManifestCommandBuilder } from './manifestCommandBuilder.service';
+
+describe('KubernetesManifestCommandBuilder', () => {
+  beforeEach(() => {
+    spyOn(AccountService, 'getArtifactAccounts').and.returnValue(
+      Promise.resolve([{ name: 'artifact-account' }]) as any,
+    );
+  });
+
+  it('uses the source account when it is available', async () => {
+    spyOn(AccountService, 'getAllAccountDetailsForProvider').and.returnValue(
+      Promise.resolve([{ name: 'fallback-account' }, { name: 'source-account' }]) as any,
+    );
+
+    const result = await KubernetesManifestCommandBuilder.buildNewManifestCommand(
+      { name: 'frontend' } as any,
+      { kind: 'Deployment' },
+      undefined,
+      'source-account',
+    );
+
+    expect(result.command.account).toBe('source-account');
+  });
+
+  it('falls back to the first account when the source account is unavailable', async () => {
+    spyOn(AccountService, 'getAllAccountDetailsForProvider').and.returnValue(
+      Promise.resolve([{ name: 'fallback-account' }]) as any,
+    );
+
+    const result = await KubernetesManifestCommandBuilder.buildNewManifestCommand(
+      { name: 'frontend' } as any,
+      { kind: 'Deployment' },
+      undefined,
+      'missing-account',
+    );
+
+    expect(result.command.account).toBe('fallback-account');
+  });
+});