[nadaverell]

Summary

This turns the Application view into a source-aware app-level workspace. Developers can understand the application boundary, runtime health, delivery status, entrypoints, dependencies, recent changes, and the relationship between declared deployment inventory and live Kubernetes resources without starting from raw objects.

What changed

Application overview and history

• Adds exact app-level entrypoint and dependency relationships for Services, ingress/routes, configuration, autoscaling, storage, disruption budgets, and network policies.
• Presents authoritative Helm, Argo CD, Flux Kustomization, or Flux HelmRelease provenance with source-specific navigation; ambiguous or inferred application boundaries explain their evidence instead of implying certainty.
• Separates runtime health from deployment-source delivery status and folds Argo CD delivery degradation into the app health signal.
• Adds a compact latest-change summary to Overview and keeps the complete retained record in the History tab.

Source-aware application topology

• Overlays Argo CD, Flux, and Helm deployment inventory onto the live runtime topology using exact group/kind/namespace/name identity.
• Shows source-only and runtime-only indicators only when they represent a real difference; incomplete inventories never produce unsupported runtime-only claims.
• Renders small source-only inventories in the graph and summarizes large deployment bundles in the source-differences rail so umbrella apps remain readable.
• Uses real Argo CD and Flux logos for source context and keeps native Helm terminology distinct from generic GitOps.

Runtime relationships and rollout detail

• Adds workload-to-ServiceAccount topology edges for explicitly selected workload identities.
• Adds SealedSecret provenance through the generated Secret, with a direct workload relationship when Secret visibility is unavailable.
• Adds ServiceMonitor-to-Service and PodMonitor-to-workload topology relationships with full label-selector and namespace-selector semantics.
• Excludes completed Jobs and CronJob templates from Service backend edges, while preserving active Job backends.
• Collapses one stable ReplicaSet by default while preserving it during rollouts, failures, multi-ReplicaSet states, and explicit expansion.
• Reserves responsive graph space for the workload/source rail so leftmost and disconnected nodes remain visible at laptop and desktop widths.

Integration and permissions

• Adds ServiceAccount, SealedSecret, ServiceMonitor, and PodMonitor to topology rendering, filtering, layout, resource navigation, and relationship metadata.
• Corrects the SealedSecret API group in the Helm chart RBAC and documents the supported relationships.

Testing

• make tsc
• make test
• make build
• Focused topology and ApplicationDetail tests, including identity edges, encrypted-secret provenance, exact source/runtime matching, monitor selectors, namespace filtering, incomplete inventories, large bundle summarization, and adaptive ReplicaSet collapse.
• Live-cluster API audits against GKE and EKS for Argo CD and Helm application inventories.
• Live GKE topology audit for ServiceMonitor selectors and the completed-Job Service regression.
• Visual smoke at 1280x800 and 1920x1080 covering source-only/runtime-only differences, ServiceAccount, SealedSecret, and ServiceMonitor edges, ReplicaSet expansion, large Argo bundles, responsive rail fit, and node-to-resource navigation.

Follow-ups

• Flux and native Helm delivery-health rollups need a separate parity pass; this change provides source inventory parity but does not infer delivery state that the current Application API cannot prove.
• APIService/webhook-to-Service edges remain a promising topology integration identified by the cluster audit.

---

Note

Medium Risk
Touches application grouping/health APIs and topology build paths used by the main UI; RBAC group change for Sealed Secrets could affect watch permissions on clusters using the old API group.

Overview
Delivers a source-aware Application workspace: overview separates runtime from delivery (including Argo CD sync/health rollups), surfaces authoritative deployment sources vs inferred boundaries, and exposes navigable entrypoint/dependency refs (including network policies).

Application topology overlays Argo CD / Flux / Helm declared inventory on live runtime with source-only and runtime-only markers when inventories are complete; large bundles summarize in the rail. Stable single ReplicaSet tiers collapse by default with explicit expand.

Backend/API enriches app relationships (service upstream routes, typed refs), registers SealedSecret under bitnami.com, and fixes Helm RBAC for sealed secrets. Topology gains ServiceAccount, SealedSecret, ServiceMonitor, and PodMonitor kinds plus includeReplicaSets query support.

^{Reviewed by Cursor Bugbot for commit a4ef228. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 84eb13d. Configure here.}