akv-manager 0.2.0 → 0.3.0

package/README.md

@@ -32,6 +32,10 @@ If you're not signed in, the UI tells you to run `az login` and press Refresh.
   **secrets, keys and certificates**.
   - reveal a secret value, **create** secrets (one or in batch with a common expiry),
     **edit** values (current value pre-filled), and **batch** enable/disable/set-expiry.
+  - **batch delete** secrets: tick several (or *select all*) and use *Delete…* in the
+    batch bar — confirmed by typing the vault name. On soft-delete vaults (the default)
+    the secrets become recoverable until their scheduled purge date; **purging is not
+    exposed** in this tool. Needs `secrets/delete` (e.g. *Key Vault Secrets Officer*).
 - **Expiry** — scan every readable vault for secrets/certs that are expired or near
   expiry, plotted on a time horizon.
 - **Clusters** — read-only AKS monitoring: browse namespaces and pods, read **pod
@@ -93,6 +97,9 @@ AZBO_ENV_RULES='[["-prd-","Prod"],["-dev-","Dev"],["-tst-","Test"]]' npx akv-man
   permission problem.
 - Write actions (create/edit/enable/disable) only succeed where you have write
   permission; failures are reported per item.
+- **Delete** is a distinct permission from write: an identity that can `Set` secrets
+  may still be refused `Delete`. Deleted secrets stop resolving immediately, so
+  anything reading them (AKS CSI mounts, running apps) breaks at once.
 
 ## Publishing (for maintainers)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akv-manager",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Local web console to browse and manage Azure Key Vaults — secrets, keys, certificates, expiry — plus read-only AKS monitoring (pods, logs, ingress, key-vault tracing), using your own az login. No credentials are stored.",
   "type": "commonjs",
   "main": "server.js",

package/public/index.html

@@ -662,7 +662,8 @@ function renderBatchBar(){
   bar.classList.remove('hide');
   const secretOnly = DRW.kind==='secrets'
     ? `<input type="date" id="batchExp"><button class="iconbtn" onclick="batchApply('expiry')">Set expiry</button>
-       <button class="iconbtn" onclick="batchEditValues()">Edit values…</button>` : '';
+       <button class="iconbtn" onclick="batchEditValues()">Edit values…</button>
+       <button class="iconbtn danger" onclick="confirmBatchDelete()">Delete…</button>` : '';
   bar.innerHTML = `<span class="bn">${n} selected</span>
     <button class="iconbtn" onclick="batchApply('enable')">Enable</button>
     <button class="iconbtn" onclick="batchApply('disable')">Disable</button>
@@ -671,7 +672,7 @@ function renderBatchBar(){
 }
 async function batchEditValues(){
   const names=[...DRW.sel]; if(!names.length) return;
-  const el=$('#dCreate'); $('#dBatch').classList.add('hide'); el.classList.remove('hide');
+  const el=$('#dCreate'); $('#dBatch').classList.add('hide'); el.classList.remove('hide'); el.classList.remove('danger');
   el.innerHTML = `<h4>Edit ${names.length} secret value${names.length!==1?'s':''}</h4><div class="empty"><span class="spin"></span> loading current values…</div>`;
   const vals = await Promise.all(names.map(n=>
     api(`/api/vaults/${DRW.vault}/secrets/${n}/value`).then(r=>({n, ok:r.ok, val:r.ok?(r.data.value||''):'', err:r.forbidden?'no read permission':(r.error||'failed')}))));
@@ -689,11 +690,58 @@ async function batchEditValues(){
       <button class="btn sm ghost" onclick="closeCreate()">Cancel</button>
       <span class="hint" id="cMsg">${esc(notes.join(' · '))}</span></div>`;
 }
+// Delete is the one batch action that cannot be undone from this UI, so it gets a
+// typed confirmation (the vault name) instead of the usual one-click confirm().
+function confirmBatchDelete(){
+  const names=[...DRW.sel]; if(!names.length) return;
+  const el=$('#dCreate'); $('#dBatch').classList.add('hide');
+  el.classList.remove('hide'); el.classList.add('danger');
+  const n=names.length, plural=n!==1?'s':'';
+  el.innerHTML = `<h4>Delete ${n} secret${plural} from ${esc(DRW.vault)}</h4>
+    <div class="dellist">${names.map(x=>`<div>${esc(x)}</div>`).join('')}</div>
+    <div class="hint" style="margin:10px 0">They stop resolving immediately — anything reading them (AKS CSI mounts, running apps) breaks now, not at the next deploy.
+      On a soft-delete vault they stay recoverable until their scheduled purge date; purging is not available here.</div>
+    <div class="fld"><label>Confirm</label><input type="text" id="delConfirm" placeholder="type the vault name: ${esc(DRW.vault)}" autocomplete="off"></div>
+    <div class="actions"><button class="btn sm danger" id="delGo" disabled onclick="batchDelete()">Delete ${n} secret${plural}</button>
+      <button class="btn sm ghost" onclick="closeCreate()">Cancel</button>
+      <span class="hint" id="cMsg"></span></div>`;
+  const inp=$('#delConfirm'), go=$('#delGo');
+  inp.oninput=()=>{ go.disabled = inp.value.trim().toLowerCase()!==DRW.vault.toLowerCase(); };
+  inp.onkeydown=e=>{ if(e.key==='Enter' && !go.disabled) batchDelete(); };
+  inp.focus();
+}
+async function batchDelete(){
+  const names=[...DRW.sel]; if(!names.length) return;
+  const go=$('#delGo'); if(go){ go.disabled=true; go.textContent='Deleting…'; }
+  const items = names.map(n=>({vault:DRW.vault, kind:'secret', name:n}));
+  const r = await api('/api/batch',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({op:{delete:true}, items})});
+  if(!r.ok){
+    toast(r.error||'delete failed');
+    if(go){ go.disabled=false; go.textContent=`Delete ${names.length} secret${names.length!==1?'s':''}`; }
+    return;
+  }
+  const ok=r.results.filter(x=>x.ok).length, fail=r.results.length-ok;
+  toast(`${ok} deleted${fail?`, ${fail} failed`:''}`);
+  if(fail){
+    const failed=r.results.filter(x=>!x.ok); console.warn('Delete failures:', failed);
+    banner(`Delete: ${ok} deleted, ${fail} failed (${failed.slice(0,3).map(f=>esc(f.name+': '+f.error)).join('; ')}${fail>3?'…':''}). See console for all.`);
+    setTimeout(()=>banner(''),8000);
+  } else {
+    const purge=(r.results.find(x=>x.scheduledPurgeDate)||{}).scheduledPurgeDate;
+    if(purge){
+      banner(`Deleted ${ok} secret${ok!==1?'s':''} — recoverable until ${esc(String(purge).slice(0,10))} (soft-delete), then purged automatically.`);
+      setTimeout(()=>banner(''),8000);
+    }
+  }
+  closeCreate();
+  DRW.sel.clear(); if($('#dSelAll'))$('#dSelAll').checked=false;
+  setTimeout(loadKind, 350);
+}
 function toggleSel(nm){ DRW.sel.has(nm)?DRW.sel.delete(nm):DRW.sel.add(nm); renderDrawerList(); }
 function clearSel(){ DRW.sel.clear(); if($('#dSelAll'))$('#dSelAll').checked=false; renderDrawerList(); }
 function selectAll(on){ DRW.sel.clear(); if(on) drawerFiltered().filter(i=>!i.managed).forEach(i=>DRW.sel.add(i.name)); renderDrawerList(); }
 function openCreate(mode){
-  const el=$('#dCreate'); DRW.sel.clear(); $('#dBatch').classList.add('hide');
+  const el=$('#dCreate'); DRW.sel.clear(); $('#dBatch').classList.add('hide'); el.classList.remove('danger');
   if(mode==='single'){
     el.innerHTML = `<h4>Create a secret</h4>
       <div class="fld"><label>Name</label><input type="text" id="cName" placeholder="my-secret-name" autocomplete="off"></div>
@@ -711,7 +759,7 @@ function openCreate(mode){
   }
   el.classList.remove('hide');
 }
-function closeCreate(){ const el=$('#dCreate'); if(el){ el.classList.add('hide'); el.innerHTML=''; } renderBatchBar(); }
+function closeCreate(){ const el=$('#dCreate'); if(el){ el.classList.add('hide'); el.classList.remove('danger'); el.innerHTML=''; } renderBatchBar(); }
 async function submitCreate(mode){
   const msg=$('#cMsg');
   const expRaw=$('#cExp').value;
@@ -1457,9 +1505,53 @@ function renderPodRows(){
       <td>${kvCell(p)}</td>
       <td class="right" style="white-space:nowrap"><button class="iconbtn" onclick="openPodDetail('${esc(p.namespace)}','${esc(p.name)}')">Details</button>
         <button class="iconbtn" onclick="showLogs('${esc(p.namespace)}','${esc(p.name)}')">Logs</button>
-        <button class="iconbtn" onclick="openTerminal('${esc(p.namespace)}','${esc(p.name)}')">Terminal</button></td>
+        <button class="iconbtn" onclick="openTerminal('${esc(p.namespace)}','${esc(p.name)}')">Terminal</button>
+        <button class="iconbtn warn" title="rolling-restart the workload that owns this pod" onclick="restartPod('${esc(p.namespace)}','${esc(p.name)}',this)">Restart</button></td>
     </tr>`).join('')}</tbody></table></div></div>`;
 }
+// Restart is the only write this app makes to a cluster. Two calls on purpose: the
+// first resolves the owning workload without touching it, so the confirmation names the
+// Deployment being rolled rather than the pod that was clicked.
+async function restartPod(ns,pod,btn){
+  const label = btn ? btn.textContent : '';
+  if(btn){ btn.disabled=true; btn.textContent='…'; }
+  const restore=()=>{ if(btn){ btn.disabled=false; btn.textContent=label||'Restart'; } };
+  const base=`/api/aks/${CL.name}/${ns}/pods/${pod}/restart`;
+  const probe = await api(base+'?dryRun=1',{method:'POST'});
+  if(!probe.ok){ restore(); restartError(probe, ns, pod); return; }
+  const wl=probe.data;
+  const ok = confirm(`Rolling-restart ${wl.kind} "${wl.name}" in ${ns}?\n\n`+
+    `Every pod it owns is replaced, not just ${pod}. New pods start before old ones stop, `+
+    `so there is normally no downtime — but this is a live workload on ${CL.name}.`);
+  if(!ok){ restore(); return; }
+  if(btn) btn.textContent='restarting…';
+  const r = await api(base,{method:'POST'});
+  restore();
+  if(!r.ok){ restartError(r, ns, pod); return; }
+  toast(`${r.data.kind} ${r.data.name} restarting`);
+  banner(`Rolling restart requested on ${esc(r.data.kind)} <b>${esc(r.data.name)}</b> in ${esc(ns)} — watch the Ready/Age columns as replicas cycle.`);
+  setTimeout(()=>banner(''),8000);
+  setTimeout(()=>{ if(STATE.route==='cluster' && CL.kind==='pods') loadClusterContent(); }, 2500);
+}
+// Off-VPN the API server simply isn't reachable. Rather than dead-end, hand over the
+// `az aks command invoke` equivalent — it runs from inside the cluster, so it needs no
+// network path. It is NOT wired to a button: RunCommand executes as cluster-admin
+// regardless of the caller's Kubernetes RBAC, which this app otherwise never does.
+function restartError(r, ns, pod){
+  if(r.network){
+    const c=CL.cluster||{};
+    const cmd=`az aks command invoke -g ${c.resourceGroup||'<rg>'} -n ${CL.name} --command "kubectl rollout restart deploy -n ${ns} --selector=app=<app>"`;
+    banner(`🚫 Can't reach ${esc(CL.name)}'s API server (private — needs the VPN). From anywhere, Azure can run it inside the cluster instead:<br>`+
+      `<code class="mono">${esc(cmd)}</code><br><span class="hint">Note: <code>command invoke</code> runs as cluster-admin, not as your Kubernetes identity.</span>`);
+    setTimeout(()=>banner(''),16000);
+    return;
+  }
+  if(r.forbidden){
+    banner(`🔒 ${esc(r.error||'Forbidden')}`); setTimeout(()=>banner(''),10000); return;
+  }
+  toast(r.error||'restart failed');
+  if(r.error && r.error.length>60){ banner(esc(r.error)); setTimeout(()=>banner(''),10000); }
+}
 async function openPodDetail(ns,pod){
   CL.logPod=null; CL.termPod=null; teardownTerm();
   $('#clBody').innerHTML = `<div class="cmctl"><button class="iconbtn" onclick="loadClusterContent()">← Pods</button>

package/public/styles.css

@@ -221,6 +221,16 @@
     background:var(--ink);border:1px solid var(--line);color:var(--text);border-radius:6px;padding:8px 10px;flex:1;width:100%;color-scheme:dark}
   .createp textarea{min-height:120px;resize:vertical;line-height:1.6}
   .createp .actions{display:flex;gap:8px;align-items:center;margin-top:6px}
+  /* destructive variant of the same panel */
+  .createp.danger{border-color:rgba(255,92,108,.6);
+    background:linear-gradient(180deg,rgba(255,92,108,.08),var(--panel2))}
+  .createp.danger h4{color:#ffd9dd}
+  .createp .dellist{font-family:var(--mono);font-size:12px;color:var(--text);max-height:180px;overflow:auto;
+    background:var(--ink);border:1px solid var(--line);border-radius:6px;padding:8px 10px;line-height:1.7}
+  .iconbtn.warn{color:#FBC56B;border-color:rgba(242,181,61,.4)}
+  .iconbtn.warn:hover{color:#06101f;background:var(--warn);border-color:var(--warn)}
+  .iconbtn.danger{color:#FF8893;border-color:rgba(255,92,108,.45)}
+  .iconbtn.danger:hover{color:#fff;background:var(--alert);border-color:var(--alert)}
   .newbtns{display:flex;gap:6px;margin-left:auto}
   .editor .fld{display:flex;align-items:center;gap:10px;margin-bottom:10px}
   .editor label{font-family:var(--mono);font-size:11px;color:var(--muted);width:78px;flex:none}

package/server.js

@@ -744,10 +744,14 @@ async function kvWrite(vaultName, method, pathQuery, body) {
   const timer = setTimeout(() => ctrl.abort(), 20000);
   let resp;
   try {
-    resp = await fetch(`https://${vaultName.toLowerCase()}.vault.azure.net${pathQuery}`, {
-      method, headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify(body), signal: ctrl.signal,
-    });
+    // DELETE carries no body — sending one (or a JSON content-type) is what makes
+    // some proxies reject the request, so build the init conditionally.
+    const init = { method, headers: { Authorization: `Bearer ${token}` }, signal: ctrl.signal };
+    if (body !== undefined) {
+      init.headers['Content-Type'] = 'application/json';
+      init.body = JSON.stringify(body);
+    }
+    resp = await fetch(`https://${vaultName.toLowerCase()}.vault.azure.net${pathQuery}`, init);
   } catch (e) {
     throw Object.assign(new Error(e.name === 'AbortError' ? 'Vault request timed out' : e.message), {});
   } finally { clearTimeout(timer); }
@@ -782,6 +786,22 @@ app.put('/api/vaults/:name/secrets/:secret', (req, res) => {
   send(res, kvWrite(name, 'PUT', `/secrets/${secret}?api-version=${KV_API}`, body));
 });
 
+// Delete a secret. Soft-delete vaults keep it recoverable until its scheduled purge;
+// purging is deliberately NOT exposed here — it is irreversible.
+app.delete('/api/vaults/:name/secrets/:secret', async (req, res) => {
+  const { name, secret } = req.params;
+  if (!isValidName(name) || !isValidName(secret)) return res.status(400).json({ ok: false, error: 'Invalid name' });
+  try {
+    const d = await kvWrite(name, 'DELETE', `/secrets/${secret}?api-version=${KV_API}`);
+    res.json({ ok: true, data: { name: secret, ...deletedInfo(d) } });
+  } catch (e) {
+    res.status(e.needLogin ? 401 : e.forbidden ? 403 : e.notFound ? 404 : 500).json({
+      ok: false, error: writeReason(e, 'delete'),
+      needLogin: !!e.needLogin, forbidden: !!e.forbidden, firewall: !!e.firewall, notFound: !!e.notFound,
+    });
+  }
+});
+
 // Update a certificate's attributes (enabled only — expiry is intrinsic to the cert).
 app.patch('/api/vaults/:name/certificates/:cert', (req, res) => {
   const { name, cert } = req.params;
@@ -794,12 +814,27 @@ app.patch('/api/vaults/:name/certificates/:cert', (req, res) => {
 // Turn a write failure into a precise, actionable reason. A 403 from Key Vault is
 // either a network/firewall block (fix: VPN) or a real data-plane permission gap
 // (fix: grant Set on secrets) — never conflate the two as a bare "forbidden".
-function writeReason(e) {
+function writeReason(e, action = 'write') {
   if (e.firewall) return 'blocked by the vault firewall — your IP is not allowed (connect to the corporate VPN)';
-  if (e.forbidden) return 'no write permission — your identity can read but not Set secrets on this vault';
+  if (e.forbidden) {
+    return action === 'delete'
+      ? 'no delete permission — your identity can read but not Delete secrets on this vault (needs secrets/delete, e.g. the Key Vault Secrets Officer role)'
+      : 'no write permission — your identity can read but not Set secrets on this vault';
+  }
   return e.message || 'failed';
 }
 
+// A Key Vault DELETE returns a DeletedSecretBundle. On a soft-delete vault (the
+// default, and mandatory since 2020) the secret is NOT erased — it moves to a
+// recoverable state and Azure purges it on `scheduledPurgeDate` (unix seconds).
+function deletedInfo(d) {
+  const ts = d && d.scheduledPurgeDate;
+  return {
+    recoverable: !!(d && d.recoveryId),
+    scheduledPurgeDate: typeof ts === 'number' ? new Date(ts * 1000).toISOString() : (ts || null),
+  };
+}
+
 // Create one or many secrets in a vault. items: [{name, value}], optional common expires.
 app.post('/api/vaults/:name/secrets-create', async (req, res) => {
   const { name } = req.params;
@@ -822,16 +857,26 @@ app.post('/api/vaults/:name/secrets-create', async (req, res) => {
   res.json({ ok: true, results });
 });
 
-// Batch update across one or many vaults. items: [{vault, kind, name}], op: {enabled?, expires?}
+// Batch update across one or many vaults. items: [{vault, kind, name}],
+// op: {enabled?, expires?} or {delete: true} (secrets only).
 app.post('/api/batch', async (req, res) => {
   const { op = {}, items } = req.body || {};
   if (!Array.isArray(items) || !items.length) return res.status(400).json({ ok: false, error: 'No items selected' });
   if (items.length > 500) return res.status(400).json({ ok: false, error: 'Too many items (max 500 per batch)' });
+  const isDelete = op.delete === true;
   const attrs = buildAttrs(op);
   const results = await pool(items, async (it) => {
     const r = { vault: it.vault, name: it.name, kind: it.kind };
     try {
       if (!isValidName(it.vault) || !isValidName(it.name)) throw new Error('Invalid name');
+      if (isDelete) {
+        // Certificates and keys are out of scope on purpose: deleting a certificate
+        // also drops its managed secret/key pair, which is not what a "delete these
+        // rows" gesture in the secrets list should ever do.
+        if (it.kind !== 'secret') throw new Error('Only secrets can be deleted here');
+        const d = await kvWrite(it.vault, 'DELETE', `/secrets/${it.name}?api-version=${KV_API}`);
+        return { ...r, ok: true, ...deletedInfo(d) };
+      }
       if (it.kind === 'certificate') {
         if (op.expires) throw new Error("A certificate's expiry is fixed by the certificate itself");
         const a = {}; if (typeof op.enabled === 'boolean') a.enabled = op.enabled;
@@ -842,7 +887,7 @@ app.post('/api/batch', async (req, res) => {
         await kvWrite(it.vault, 'PATCH', `/secrets/${it.name}?api-version=${KV_API}`, { attributes: attrs });
       }
       return { ...r, ok: true };
-    } catch (e) { return { ...r, ok: false, error: writeReason(e), firewall: !!e.firewall, forbidden: !!e.forbidden }; }
+    } catch (e) { return { ...r, ok: false, error: writeReason(e, isDelete ? 'delete' : 'write'), firewall: !!e.firewall, forbidden: !!e.forbidden }; }
   }, 12);
   res.json({ ok: true, results });
 });
@@ -926,15 +971,24 @@ function imageTag(img) {
   return c >= 0 ? repoTag.slice(c + 1) : '';
 }
 
-// One GET against a cluster's Kubernetes API. raw=true returns text (for pod logs).
-function k8sGet(cred, pathQuery, { raw = false, timeout = 25000 } = {}) {
+// One request against a cluster's Kubernetes API. raw=true returns text (for pod logs).
+// Everything read-only goes through k8sGet; the single mutating caller is the workload
+// restart, which PATCHes a controller's pod template. The AAD token is the user's own,
+// so Kubernetes RBAC still decides what is allowed — this grants nothing they lack.
+function k8sReq(cred, method, pathQuery, { raw = false, timeout = 25000, body, contentType } = {}) {
   return new Promise((resolve, reject) => {
     getAksToken(cred.sub).then((token) => {
       const u = new URL(cred.server + pathQuery);
+      const payload = body === undefined ? null : Buffer.from(JSON.stringify(body));
+      const headers = { Authorization: `Bearer ${token}`, Accept: raw ? '*/*' : 'application/json' };
+      if (payload) {
+        headers['Content-Type'] = contentType || 'application/json';
+        headers['Content-Length'] = payload.length;
+      }
       const req = https.request({
-        hostname: u.hostname, port: u.port || 443, path: u.pathname + u.search, method: 'GET',
+        hostname: u.hostname, port: u.port || 443, path: u.pathname + u.search, method,
         // '*/*' for raw so the log subresource returns text/plain without tripping content negotiation
-        headers: { Authorization: `Bearer ${token}`, Accept: raw ? '*/*' : 'application/json' },
+        headers,
         ca: cred.ca, timeout,
       }, (res) => {
         let data = ''; res.setEncoding('utf8');
@@ -957,10 +1011,12 @@ function k8sGet(cred, pathQuery, { raw = false, timeout = 25000 } = {}) {
           : e.message), { network }));
       });
       req.on('timeout', () => req.destroy(Object.assign(new Error('Cluster API request timed out — is the VPN connected?'), { network: true })));
+      if (payload) req.write(payload);
       req.end();
     }).catch(reject);
   });
 }
+const k8sGet = (cred, pathQuery, opts) => k8sReq(cred, 'GET', pathQuery, opts);
 
 // Discover clusters you have ARM read on (best-effort) and merge with the configured list.
 const AKS_QUERY =
@@ -1087,6 +1143,65 @@ app.get('/api/aks/:cluster/:ns/pods/:pod/detail', (req, res) => {
   })());
 });
 
+// ---- AKS: restart a workload (the one mutating cluster operation) -----------
+// A pod is never restarted directly: killing a pod is a hard stop of one replica, and
+// for a bare (uncontrolled) pod it is unrecoverable. Instead we walk up to the pod's
+// controller and stamp its pod template with `kubectl.kubernetes.io/restartedAt` —
+// byte-for-byte what `kubectl rollout restart` does, so the controller rolls replicas
+// gracefully. Needs Kubernetes RBAC `patch` on that controller in that namespace.
+const RESTARTABLE = { Deployment: 'deployments', StatefulSet: 'statefulsets', DaemonSet: 'daemonsets' };
+
+async function resolveWorkload(cred, ns, pod) {
+  const p = await k8sGet(cred, `/api/v1/namespaces/${ns}/pods/${pod}`);
+  const owner = ((p.metadata || {}).ownerReferences || []).find((o) => o.controller) ||
+                ((p.metadata || {}).ownerReferences || [])[0];
+  if (!owner) {
+    throw Object.assign(new Error(
+      'This pod has no controller (it is a bare pod). Nothing would recreate it, so restarting is not offered.'), { status: 409 });
+  }
+  if (owner.kind === 'ReplicaSet') {
+    const rs = await k8sGet(cred, `/apis/apps/v1/namespaces/${ns}/replicasets/${owner.name}`);
+    const dep = ((rs.metadata || {}).ownerReferences || []).find((o) => o.kind === 'Deployment');
+    if (!dep) {
+      throw Object.assign(new Error(
+        `This pod is owned by ReplicaSet "${owner.name}" with no Deployment above it — a bare ReplicaSet does not roll its pods on a template change.`), { status: 409 });
+    }
+    return { kind: 'Deployment', name: dep.name, plural: 'deployments' };
+  }
+  const plural = RESTARTABLE[owner.kind];
+  if (!plural) {
+    throw Object.assign(new Error(
+      `This pod is owned by a ${owner.kind} ("${owner.name}"), which has no rolling-restart semantics.`), { status: 409 });
+  }
+  return { kind: owner.kind, name: owner.name, plural };
+}
+
+// dryRun=1 resolves the owning workload WITHOUT touching it, so the UI can name the
+// thing in its confirmation instead of asking the user to trust a pod name.
+app.post('/api/aks/:cluster/:ns/pods/:pod/restart', (req, res) => {
+  const { ns, pod } = req.params;
+  if (!isK8sName(ns) || !isK8sName(pod)) return res.status(400).json({ ok: false, error: 'Invalid namespace/pod' });
+  const dryRun = req.query.dryRun === '1' || req.query.dryRun === 'true';
+  send(res, (async () => {
+    const cred = await aksCredential(await getClusterChecked(req.params.cluster));
+    const wl = await resolveWorkload(cred, ns, pod);
+    if (dryRun) return { ...wl, namespace: ns, dryRun: true };
+    const restartedAt = new Date().toISOString();
+    const patch = { spec: { template: { metadata: { annotations: { 'kubectl.kubernetes.io/restartedAt': restartedAt } } } } };
+    try {
+      await k8sReq(cred, 'PATCH', `/apis/apps/v1/namespaces/${ns}/${wl.plural}/${wl.name}`, {
+        body: patch, contentType: 'application/strategic-merge-patch+json',
+      });
+    } catch (e) {
+      if (e.forbidden) {
+        e.message = `no permission to patch ${wl.plural} in "${ns}" (Kubernetes RBAC) — ${e.message}`;
+      }
+      throw e;
+    }
+    return { ...wl, namespace: ns, restartedAt };
+  })());
+});
+
 // Cluster-wide configmap list (all namespaces).
 app.get('/api/aks/:cluster/configmaps', (req, res) =>
   send(res, (async () => {