feat(audit): badge resources with high-signal Cluster Audit findings (topology + list) (#1028)

Author: nadaverell

internal/server/audit_handlers.go

@@ -166,17 +166,22 @@ func (s *Server) handleAuditResource(w http.ResponseWriter, r *http.Request) {
 	}
 	index := bp.IndexByResource(results.Findings)
 
-	// Try exact kind first, then map API resource name (e.g. "deployments") to Go kind (e.g. "Deployment").
-	// This handler is the UI's per-resource audit drill-down — group isn't on
-	// the URL today (the UI doesn't list grouped CRDs here yet), so we look
-	// up with group="" which matches the built-ins the audit suite scans.
-	// When CRD audit lands (#35 follow-up), thread group through the URL.
-	findings := index[bp.ResourceKey("", kind, namespace, name)]
-	if findings == nil {
-		goKind := apiResourceToKind(kind)
-		if goKind != kind {
-			findings = index[bp.ResourceKey("", goKind, namespace, name)]
-		}
+	// Resolve to the Go kind (built-in plural "deployments" → "Deployment"), then
+	// look up with the audit's keying convention. Findings carry group backfilled
+	// from the builtin table (built-ins → their group e.g. "apps"; CRDs → ""), so
+	// a bare group="" lookup missed every built-in finding keyed under a real
+	// group (Deployment under "apps", Job under "batch", …) — the drawer showed
+	// nothing for them. Group still resolves to "" for CRDs, so those keep working.
+	goKind := kind
+	if mapped := apiResourceToKind(kind); mapped != kind {
+		goKind = mapped
+	}
+	group := bp.GroupForBuiltinKind(goKind)
+	findings := index[bp.ResourceKey(group, goKind, namespace, name)]
+	if findings == nil && group != "" {
+		// Defensive: resolve even if a finding for this kind was emitted with an
+		// empty group despite the builtin table classifying it under a real one.
+		findings = index[bp.ResourceKey("", goKind, namespace, name)]
 	}
 	if findings == nil {
 		findings = []bp.Finding{}

packages/k8s-ui/src/components/audit/AuditAlerts.tsx

@@ -5,6 +5,10 @@ import { SEVERITY_TEXT, BP_CATEGORY_BADGE, DEFAULT_BADGE_COLOR } from '../../uti
 
 export interface AuditFinding {
   kind: string
+  /** API group, backfilled by the backend from the builtin Kind→group table
+   *  (built-ins → e.g. "apps"/"batch"; CRDs → ""). Part of the resource key
+   *  used to join findings onto topology nodes / list rows. */
+  group?: string
   namespace: string
   name: string
   checkID: string

packages/k8s-ui/src/components/audit/AuditBadgeTooltip.test.tsx

@@ -0,0 +1,30 @@
+import { describe, expect, it } from 'vitest'
+import { renderToString } from 'react-dom/server'
+import { AuditBadgeTooltip } from './AuditBadgeTooltip'
+
+const msgs = [
+  { severity: 'warning', message: 'Service selector matches no pods' },
+  { severity: 'danger', message: 'Ingress references missing Service' },
+  { severity: 'warning', message: 'Uses a deprecated API version' },
+  { severity: 'warning', message: 'A fourth finding' },
+]
+
+describe('AuditBadgeTooltip', () => {
+  it('lists each finding message up to the cap', () => {
+    const html = renderToString(<AuditBadgeTooltip messages={msgs.slice(0, 2)} />)
+    expect(html).toContain('Service selector matches no pods')
+    expect(html).toContain('Ingress references missing Service')
+    expect(html).not.toContain('more')
+  })
+
+  it('caps the list and collapses the rest into "+N more"', () => {
+    const html = renderToString(<AuditBadgeTooltip messages={msgs} max={3} />)
+    expect(html).toContain('+1 more')
+    expect(html).not.toContain('A fourth finding')
+  })
+
+  it('shows the click hint by default and omits it when disabled', () => {
+    expect(renderToString(<AuditBadgeTooltip messages={msgs.slice(0, 1)} />)).toContain('Click to open')
+    expect(renderToString(<AuditBadgeTooltip messages={msgs.slice(0, 1)} clickHint={false} />)).not.toContain('Click to open')
+  })
+})

packages/k8s-ui/src/components/audit/AuditBadgeTooltip.tsx

@@ -0,0 +1,47 @@
+import { ShieldAlert, AlertTriangle } from 'lucide-react'
+import { clsx } from 'clsx'
+import { SEVERITY_TEXT } from '../../utils/badge-colors'
+
+export interface AuditBadgeMessage {
+  severity: string
+  message: string
+}
+
+interface AuditBadgeTooltipProps {
+  messages: AuditBadgeMessage[]
+  /** Max messages to list before collapsing the rest into "+N more". */
+  max?: number
+  /** Hint that clicking opens the resource — omitted when the badge isn't clickable. */
+  clickHint?: boolean
+}
+
+/**
+ * Inline tooltip body for an audit badge: lists the actual finding messages
+ * (danger-first) so the operator reads WHAT is wrong on hover, instead of a
+ * content-free "N findings". Shared by the resource-list and topology-node
+ * badges so the two can't drift.
+ */
+export function AuditBadgeTooltip({ messages, max = 3, clickHint = true }: AuditBadgeTooltipProps) {
+  const shown = messages.slice(0, max)
+  const overflow = messages.length - shown.length
+  return (
+    <div className="flex flex-col gap-1 text-left">
+      {shown.map((m, i) => {
+        const isDanger = m.severity === 'danger'
+        const Icon = isDanger ? ShieldAlert : AlertTriangle
+        return (
+          <div key={i} className="flex items-start gap-1.5">
+            <Icon className={clsx('w-3 h-3 shrink-0 mt-0.5', isDanger ? SEVERITY_TEXT.error : SEVERITY_TEXT.warning)} />
+            <span>{m.message}</span>
+          </div>
+        )
+      })}
+      {overflow > 0 && (
+        <div className="text-theme-text-tertiary">{`+${overflow} more`}</div>
+      )}
+      {clickHint && (
+        <div className="text-theme-text-tertiary mt-0.5">Click to open →</div>
+      )}
+    </div>
+  )
+}

packages/k8s-ui/src/components/audit/AuditFindingsTable.tsx

@@ -27,6 +27,10 @@ export interface CheckMeta {
   remediation: string
   frameworks?: string[]
   references?: CheckReference[]
+  /** Finding means the specific resource is broken (reference-integrity /
+   *  lifecycle), worth a per-resource topology/list badge — vs posture /
+   *  best-practice checks that fire near-universally. Set by the backend registry. */
+  badgeWorthy?: boolean
 }
 
 /** An authoritative link for a check (K8s docs, CIS, NSA/CISA, …). */

packages/k8s-ui/src/components/audit/index.ts

@@ -1,3 +1,4 @@
 export { AuditCard, type AuditCardData } from './AuditCard'
 export { AuditAlerts, type AuditFinding } from './AuditAlerts'
+export { AuditBadgeTooltip, type AuditBadgeMessage } from './AuditBadgeTooltip'
 export { AuditFindingsTable, type AuditFindingsTableProps, type ResourceGroup, type CheckMeta, type CheckReference } from './AuditFindingsTable'

packages/k8s-ui/src/components/resources/ResourcesView.tsx

@@ -129,11 +129,12 @@ import {
   podMatchesProblemCategory,
   SEVERITY_DOT_COLOR,
 } from './resource-utils'
-import { SEVERITY_BADGE, EVENT_TYPE_COLORS } from '../../utils/badge-colors'
+import { SEVERITY_BADGE, EVENT_TYPE_COLORS, SEVERITY_TEXT } from '../../utils/badge-colors'
 import { pluralize } from '../../utils/pluralize'
 import { getPodGpuCount, getNodeGpuCount } from '../../utils/extended-resources'
 import { type CustomColumnDef, type CustomColumnSource, customColumnKey, readCustomColumnValue, sanitizeCustomColumnDefs } from '../../utils/custom-columns'
 import { Tooltip } from '../ui/Tooltip'
+import { AuditBadgeTooltip, type AuditBadgeMessage } from '../audit/AuditBadgeTooltip'
 // CRD-specific cell components (extracted)
 import { GitRepositoryCell, OCIRepositoryCell, HelmRepositoryCell, KustomizationCell, FluxHelmReleaseCell, FluxAlertCell } from './renderers/flux-cells'
 import { ArgoApplicationCell, ArgoApplicationSetCell, ArgoAppProjectCell } from './renderers/argo-cells'
@@ -1800,6 +1801,9 @@ interface ResourcesViewData {
   onNavigate?: (path: string, options?: { replace?: boolean }) => void
   certExpiry?: Record<string, { expired?: boolean; daysLeft: number }>
   certExpiryError?: boolean
+  // Cluster Audit findings for the listed kind, keyed by "namespace/name" (the
+  // list shows one kind at a time, so ns/name is unambiguous). Host-injected.
+  auditBadges?: Record<string, { danger: number; warning: number; messages?: AuditBadgeMessage[] }>
   onOpenLogs?: (params: { namespace: string; podName: string; containers: string[]; containerName?: string }) => void
   onOpenWorkloadLogs?: (params: { namespace: string; workloadKind: string; workloadName: string }) => void
 }
@@ -1852,6 +1856,8 @@ interface ResourcesViewProps {
   topNodeMetrics?: TopNodeMetrics[]
   certExpiry?: Record<string, { expired?: boolean; daysLeft: number }>
   certExpiryError?: boolean
+  // Cluster Audit findings for the selected kind, keyed by "namespace/name".
+  auditBadges?: Record<string, { danger: number; warning: number; messages?: AuditBadgeMessage[] }>
   // Pinned kinds
   pinned?: Array<{ name: string; kind: string; group: string }>
   togglePin?: (kind: { name: string; kind: string; group: string }) => void
@@ -2070,6 +2076,7 @@ export function ResourcesView({
   topNodeMetrics,
   certExpiry,
   certExpiryError,
+  auditBadges,
   pinned = [],
   togglePin = () => {},
   isPinned = () => false,
@@ -4014,9 +4021,10 @@ export function ResourcesView({
     onNavigate,
     certExpiry,
     certExpiryError,
+    auditBadges,
     onOpenLogs,
     onOpenWorkloadLogs,
-  }), [onNavigate, certExpiry, certExpiryError, onOpenLogs, onOpenWorkloadLogs])
+  }), [onNavigate, certExpiry, certExpiryError, auditBadges, onOpenLogs, onOpenWorkloadLogs])
 
   return (
     <ResourcesViewDataContext.Provider value={resourcesViewDataContextValue}>
@@ -5155,6 +5163,7 @@ interface CellContentProps {
 }
 
 function CellContent({ resource, kind, column, group, majorityNodeMinorVersion, extraColumn, nameHref }: CellContentProps) {
+  const { auditBadges } = useContext(ResourcesViewDataContext)
   // Parent-injected extra columns short-circuit the built-in switch.
   // Used by hosts that inject leading columns (e.g. a multi-cluster Cluster column).
   if (extraColumn) {
@@ -5167,6 +5176,8 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
   if (column === 'name') {
     const isTerminating = !!meta.deletionTimestamp
     const nameClass = clsx('text-sm font-medium truncate block', isTerminating ? 'text-theme-text-tertiary line-through' : 'text-theme-text-primary')
+    const audit = auditBadges?.[`${meta.namespace || ''}/${meta.name}`]
+    const auditTotal = audit ? audit.danger + audit.warning : 0
     return (
       <div className="flex items-center gap-1.5 min-w-0">
         <Tooltip content={meta.name}>
@@ -5184,6 +5195,16 @@ function CellContent({ resource, kind, column, group, majorityNodeMinorVersion,
           )}
         </Tooltip>
         <CopyNameButton name={meta.name} />
+        {auditTotal > 0 && audit && (
+          <Tooltip content={audit.messages && audit.messages.length > 0
+            ? <AuditBadgeTooltip messages={audit.messages} />
+            : `${auditTotal} audit ${auditTotal === 1 ? 'finding' : 'findings'}${audit.danger > 0 ? ` · ${audit.danger} danger` : ''}`}>
+            <span className={clsx('shrink-0 inline-flex items-center gap-0.5 text-[10px] font-medium cursor-help', audit.danger > 0 ? SEVERITY_TEXT.error : SEVERITY_TEXT.warning)}>
+              <AlertTriangle className="w-3 h-3" />
+              {auditTotal}
+            </span>
+          </Tooltip>
+        )}
         {isTerminating && (
           <Tooltip content="Resource is being deleted (has deletionTimestamp set). May be stuck due to finalizers.">
             <span className="shrink-0 flex items-center gap-1 px-1.5 py-0.5 text-[10px] font-medium bg-red-500/15 text-red-600 dark:text-red-400 rounded">
@@ -6022,6 +6043,7 @@ function ReplicaSetCell({ resource, column }: { resource: any; column: string })
 }
 
 function ServiceCell({ resource, column }: { resource: any; column: string }) {
+  const { auditBadges } = useContext(ResourcesViewDataContext)
   switch (column) {
     case 'type': {
       const status = getServiceStatus(resource)
@@ -6042,6 +6064,20 @@ function ServiceCell({ resource, column }: { resource: any; column: string }) {
       )
     }
     case 'endpoints': {
+      // getServiceEndpointsStatus can't see live pods, so it optimistically
+      // reports "Active" for any service with a selector. The audit's
+      // serviceNoMatchingPods check DOES resolve the selector against live pods —
+      // the only badge-worthy finding a Service can carry — so when it fired,
+      // trust it over the guess instead of showing a false-green "Active".
+      const meta = resource.metadata || {}
+      const flagged = auditBadges?.[`${meta.namespace || ''}/${meta.name}`]
+      if (flagged && flagged.danger + flagged.warning > 0) {
+        return (
+          <span className={clsx('badge', flagged.danger > 0 ? 'status-unhealthy' : 'status-degraded')}>
+            No endpoints
+          </span>
+        )
+      }
       const { status, color } = getServiceEndpointsStatus(resource)
       return (
         <span className={clsx('badge', color)}>

packages/k8s-ui/src/components/topology/K8sResourceNode.tsx

@@ -3,15 +3,17 @@ import { Handle, Position } from '@xyflow/react'
 import {
   ChevronDown,
   ChevronUp,
+  TriangleAlert,
 } from 'lucide-react'
 import { clsx } from 'clsx'
 import type { NodeKind, HealthStatus, PodSummary } from '../../types'
 import { displayKind } from '../../types'
-import { healthToSeverity, SEVERITY_DOT } from '../../utils/badge-colors'
+import { healthToSeverity, SEVERITY_DOT, SEVERITY_TEXT } from '../../utils/badge-colors'
 import { workloadHue } from '../../utils/workload-colors'
 import { ownershipOf } from '../../utils/topology-neighborhood'
 import { midTruncate } from '../../utils/format'
 import { Tooltip } from '../ui/Tooltip'
+import { AuditBadgeTooltip, type AuditBadgeMessage } from '../audit/AuditBadgeTooltip'
 
 // Get actionable tooltip content for health issues
 function getIssueTooltip(issue: string | undefined): React.ReactNode {
@@ -382,6 +384,15 @@ export const K8sResourceNode = memo(function K8sResourceNode({
   id,
 }: K8sResourceNodeProps) {
   const { kind, name, status, nodeData, selected, dimmed, onExpand, onCollapse, isExpanded } = data
+  // Cluster Audit findings joined onto this node by the host (web/ enriches each
+  // node's data by auditKey). The host only counts "badge-worthy" findings —
+  // reference-integrity / lifecycle, "this resource is actually broken" — not the
+  // posture/best-practice nags that fire near-universally, so the indicator stays
+  // a signal. Colored by worst severity (danger red, else warning amber).
+  const auditDanger = typeof nodeData.auditDanger === 'number' ? nodeData.auditDanger : 0
+  const auditWarning = typeof nodeData.auditWarning === 'number' ? nodeData.auditWarning : 0
+  const auditTotal = auditDanger + auditWarning
+  const auditMessages = Array.isArray(nodeData.auditMessages) ? (nodeData.auditMessages as AuditBadgeMessage[]) : []
   // Workload tint (application graph): a node owned by exactly one workload
   // carries that workload's hue. Only on healthy/unknown cards — degraded/
   // unhealthy already own the card background for health, which must win.
@@ -512,6 +523,16 @@ export const K8sResourceNode = memo(function K8sResourceNode({
                   <ChevronUp className="w-3.5 h-3.5 text-theme-text-secondary" />
                 </button>
               )}
+              {auditTotal > 0 && (
+                <Tooltip
+                  content={auditMessages.length > 0
+                    ? <AuditBadgeTooltip messages={auditMessages} clickHint={false} />
+                    : `${auditTotal} audit ${auditTotal === 1 ? 'finding' : 'findings'}${auditDanger > 0 ? ` · ${auditDanger} danger` : ''}`}
+                  position="right"
+                >
+                  <TriangleAlert className={clsx('w-3 h-3 cursor-help', auditDanger > 0 ? SEVERITY_TEXT.error : SEVERITY_TEXT.warning)} />
+                </Tooltip>
+              )}
               {issueTooltip ? (
                 <Tooltip content={issueTooltip} position="right">
                   <span className={clsx('w-1.5 h-1.5 rounded-full cursor-help', getStatusDotColor(status))} />

pkg/audit/helpers.go

@@ -13,6 +13,13 @@ func ResourceKey(group, kind, namespace, name string) string {
 	return resourceid.ResourceKey(group, kind, namespace, name)
 }
 
+// GroupForBuiltinKind re-exports the builtin Kind→group table from pkg/resourceid
+// so callers resolving a finding's key (which backfills group the same way) don't
+// need a second import.
+func GroupForBuiltinKind(kind string) string {
+	return resourceid.GroupForBuiltinKind(kind)
+}
+
 // IndexByResource builds a lookup map from ResourceKey → []Finding.
 func IndexByResource(findings []Finding) map[string][]Finding {
 	m := make(map[string][]Finding)