ci: update artifact hub metadata for v0.1.0

chore: bump version to 0.1.0 and fix release workflow race condition
Fetch latest main before pushing metadata update to prevent non-fast-forward rejections when main moves during the release run. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-07 16:37:15 +00:00 · 2026-02-07 11:36:13 -05:00 · 2026-02-07 10:47:43 -05:00 · 2026-02-07 10:46:42 -05:00 · 2026-02-07 10:35:51 -05:00 · 2026-02-07 10:25:59 -05:00
12 changed files with 275 additions and 95 deletions
@@ -18,7 +18,7 @@ jobs:
      - name: Check if release is already finalized
        run: |
          VERSION=${GITHUB_REF_NAME#v}
-          TARBALL_URL="https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/${GITHUB_REF_NAME}/polaris-headlamp-plugin-${VERSION}.tar.gz"
+          TARBALL_URL="https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/${GITHUB_REF_NAME}/headlamp-polaris-plugin-${VERSION}.tar.gz"
          HTTP_CODE=$(curl -sL -o /tmp/release.tar.gz -w "%{http_code}" "$TARBALL_URL" 2>/dev/null)
          if [ "$HTTP_CODE" = "200" ]; then
            ACTUAL="sha256:$(sha256sum /tmp/release.tar.gz | awk '{print $1}')"
@@ -161,12 +161,13 @@ jobs:
        run: |
          [ "$SKIP_BUILD" = "true" ] && exit 0
          VERSION=${GITHUB_REF_NAME#v}
-          git checkout main
-          sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
-          sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/${GITHUB_REF_NAME}/polaris-headlamp-plugin-${VERSION}.tar.gz\"|" artifacthub-pkg.yml
-          sed -i "s|^version:.*|version: ${VERSION}|" artifacthub-pkg.yml
          git config user.name "gitea-actions[bot]"
          git config user.email "gitea-actions[bot]@git.farh.net"
+          git fetch origin main
+          git checkout origin/main -B main
+          sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
+          sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/${GITHUB_REF_NAME}/headlamp-polaris-plugin-${VERSION}.tar.gz\"|" artifacthub-pkg.yml
+          sed -i "s|^version:.*|version: ${VERSION}|" artifacthub-pkg.yml
          git add artifacthub-pkg.yml
          git diff --cached --quiet || {
            git commit -m "ci: update artifact hub metadata for ${GITHUB_REF_NAME}"
@@ -6,5 +6,5 @@ COPY src/ src/
 RUN npx @kinvolk/headlamp-plugin build

 FROM alpine:3.20
-COPY --from=build /app/dist/ /plugins/polaris-headlamp-plugin/
-COPY --from=build /app/package.json /plugins/polaris-headlamp-plugin/
+COPY --from=build /app/dist/ /plugins/headlamp-polaris-plugin/
+COPY --from=build /app/package.json /plugins/headlamp-polaris-plugin/
@@ -1,39 +1,44 @@
-# polaris-headlamp-plugin
+# headlamp-polaris-plugin

-[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/polaris-headlamp-plugin)](https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin)
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/polaris)](https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin)

 A [Headlamp](https://headlamp.dev/) plugin that surfaces [Fairwinds Polaris](https://polaris.docs.fairwinds.com/) audit results directly in the Headlamp UI.

 ## What It Does

-Adds a **Polaris** sidebar entry to Headlamp that displays:
+Adds a **Polaris** top-level sidebar section to Headlamp with the following views:

- **Cluster Score** -- overall Polaris score as a percentage (color-coded green/amber/red)
- **Check Summary** -- total, pass, warning, and danger counts across all workloads
- **Cluster Info** -- node, pod, namespace, and controller counts
+- **Overview** -- cluster score as a percentage (color-coded green/amber/red), check summary (pass/warning/danger counts), and cluster info (nodes, pods, namespaces, controllers)
+- **Full Audit** -- same as overview but includes skipped checks in the totals
+- **Namespace drill-down** -- per-namespace score, check counts, and a resource table showing pass/warning/danger per workload. Namespace entries appear dynamically in the sidebar based on live audit data.
+- **External link** -- quick jump to the native Polaris dashboard via the Kubernetes service proxy

-Data is read from the `ConfigMap/polaris-dashboard` in the `polaris` namespace (key: `dashboard.json`), which is created by the standard Polaris Helm chart. The plugin is read-only -- it never writes to the cluster.
+Data is fetched from the Polaris dashboard API through the Kubernetes service proxy (`/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json`). The plugin is read-only -- it never writes to the cluster.

-Results are cached and refreshed on a user-configurable interval (1 / 5 / 10 / 30 minutes, default 5). The setting persists in the browser's localStorage.
+Results are refreshed on a user-configurable interval (1 / 5 / 10 / 30 minutes, default 5). The setting is available in **Settings > Plugins > Polaris** and persists in the browser's localStorage.

-Error states are handled explicitly: RBAC denied (403), Polaris not installed (404), malformed JSON, and loading.
+Error states are handled explicitly: RBAC denied (403), Polaris not installed (404/503), malformed JSON, and loading.

 ## Prerequisites

- **Headlamp** >= v0.26 deployed in your cluster
- **Polaris** installed via the [official Helm chart](https://github.com/FairwindsOps/polaris) with the dashboard component enabled
- The Headlamp service account must have RBAC permission to `get` ConfigMaps in the `polaris` namespace
+| Requirement | Minimum version |
+|-------------|----------------|
+| Headlamp | v0.26+ |
+| Polaris (with dashboard enabled) | Any recent release |
+| Kubernetes | v1.24+ |
+
+Polaris must be deployed in the `polaris` namespace with the dashboard component enabled (`dashboard.enabled: true` in the Helm chart, which is the default). The plugin reads from the `polaris-dashboard` ClusterIP service on port 80.

 ## Installing

 ### Option 1: Artifact Hub + Headlamp plugin manager (recommended)

-The plugin is published on [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin). Configure Headlamp's `pluginsManager` in your Helm values to install it automatically:
+The plugin is published on [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin). Configure Headlamp's `pluginsManager` in your Helm values to install it automatically:

 ```yaml
 pluginsManager:
  sources:
-    - url: https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin
+    - url: https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin
 ```

 Headlamp will fetch and install the plugin on startup.
@@ -67,7 +72,7 @@ volumeMounts:
 Download the `.tar.gz` from the [GitHub releases page](https://github.com/cpfarhood/headlamp-polaris-plugin/releases) or the [Gitea releases page](https://git.farh.net/farhoodliquor/headlamp-polaris-plugin/releases), then extract into Headlamp's plugin directory:

 ```bash
-tar xzf polaris-headlamp-plugin-0.0.1.tar.gz -C /headlamp/plugins/
+tar xzf headlamp-polaris-plugin-0.0.1.tar.gz -C /headlamp/plugins/
 ```

 ### Option 4: Build from source
@@ -78,42 +83,77 @@ npm run build
 npx @kinvolk/headlamp-plugin extract . /headlamp/plugins
 ```

-## RBAC
+## RBAC / Security Setup

-The plugin reads a single ConfigMap. Minimum RBAC required for the Headlamp service account:
+The plugin fetches audit data through the Kubernetes API server's **service proxy** sub-resource. The identity making the request (Headlamp's service account, or the user's own token in token-auth mode) must be granted:
+
+| Verb | API Group | Resource | Resource Name | Namespace |
+|------|-----------|----------|---------------|-----------|
+| `get` | `""` (core) | `services/proxy` | `polaris-dashboard` | `polaris` |
+
+### Minimal RBAC manifests

 ```yaml
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
+kind: Role
 metadata:
-  name: headlamp-polaris-reader
+  name: polaris-proxy-reader
+  namespace: polaris
 rules:
  - apiGroups: [""]
-    resources: ["configmaps"]
+    resources: ["services/proxy"]
    resourceNames: ["polaris-dashboard"]
    verbs: ["get"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
+kind: RoleBinding
 metadata:
-  name: headlamp-polaris-reader
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: headlamp-polaris-reader
+  name: headlamp-polaris-proxy
+  namespace: polaris
 subjects:
  - kind: ServiceAccount
-    name: headlamp
-    namespace: headlamp
+    name: headlamp              # adjust to match your Headlamp service account
+    namespace: kube-system      # adjust to match the namespace Headlamp runs in
+roleRef:
+  kind: Role
+  name: polaris-proxy-reader
+  apiGroup: rbac.authorization.k8s.io
 ```

+Apply with `kubectl apply -f polaris-rbac.yaml`.
+
+### Token-auth mode
+
+When Headlamp is configured for user-supplied tokens (rather than a fixed service account), **each user** must have the RoleBinding above attached to their own identity. A 403 error in the plugin means the currently logged-in user lacks this binding.
+
+### NetworkPolicy
+
+If the `polaris` namespace enforces network policies, ensure ingress is allowed from the Kubernetes API server (which performs the proxy hop) to `polaris-dashboard` on port 80.
+
+### Read-only access
+
+The plugin only performs `GET` requests through the service proxy. No `create`, `update`, `delete`, or `patch` verbs are required. Do not grant broader access than `get` on `services/proxy`.
+
+### Audit logging
+
+Every proxied request is recorded in Kubernetes API audit logs as a `get` on `services/proxy` in the `polaris` namespace. If the auto-refresh interval generates more audit volume than desired, increase the refresh interval in the plugin settings or adjust your audit policy.
+
+## Troubleshooting
+
+| Symptom | Likely cause | Fix |
+|---------|-------------|-----|
+| **403 Access Denied** | Missing RBAC binding for `services/proxy` | Apply the Role + RoleBinding from the RBAC section above |
+| **404 or 503** | Polaris not installed, or dashboard disabled | Install Polaris with `dashboard.enabled: true` in the `polaris` namespace |
+| **No data** | Polaris running but no workloads scanned yet | Wait for the next Polaris audit cycle or restart the Polaris pod |
+| **Stale data** | Refresh interval too long | Lower the interval in **Settings > Plugins > Polaris** |
+
 ## Development

 ### Setup

 ```bash
 git clone https://github.com/cpfarhood/headlamp-polaris-plugin.git
-cd polaris-headlamp-plugin
+cd headlamp-polaris-plugin
 npm install
 ```

@@ -129,7 +169,7 @@ This starts the Headlamp plugin dev server. Point a running Headlamp instance at

 ```bash
 npm run build        # outputs dist/main.js
-npm run package      # creates polaris-headlamp-plugin-<version>.tar.gz
+npm run package      # creates headlamp-polaris-plugin-<version>.tar.gz
 ```

 ### Type-check
@@ -142,29 +182,30 @@ npm run tsc

 ```
 src/
-  index.tsx                  -- Entry point. Registers sidebar entry and route at /polaris.
+  index.tsx                           -- Entry point. Registers sidebar entries and routes.
  api/
-    polaris.ts               -- TypeScript types matching the Polaris AuditData schema,
-                                usePolarisData() hook with caching, countResults() utility,
-                                and refresh interval settings (localStorage).
+    polaris.ts                        -- TypeScript types (AuditData schema), usePolarisData hook,
+                                         countResults utilities, refresh interval settings.
+    PolarisDataContext.tsx             -- React context provider; shared data fetch across views.
  components/
-    PolarisView.tsx          -- Main page component. Score badge, check summary cards,
-                                cluster info, error states, refresh interval selector.
+    DashboardView.tsx                 -- Overview / Full Audit page (score, check summary, cluster info).
+    NamespaceDetailView.tsx           -- Per-namespace drill-down with resource table.
+    DynamicSidebarRegistrar.tsx       -- Registers sidebar entries dynamically from audit namespaces.
+    PolarisSettings.tsx               -- Plugin settings page (refresh interval selector).
 ```

 ## Data Source

-The plugin reads from:
+The plugin fetches live audit results from the Polaris dashboard HTTP API via the Kubernetes service proxy:

- **ConfigMap**: `polaris-dashboard`
- **Namespace**: `polaris`
- **Key**: `dashboard.json`
+```
+GET /api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/results.json
+```

-This ConfigMap is created automatically when Polaris is installed with the dashboard enabled. The JSON structure matches Polaris's `AuditData` schema (`pkg/validator/output.go`):
+This endpoint is served by the `polaris-dashboard` ClusterIP service, which is created by the Polaris Helm chart when `dashboard.enabled: true`. The JSON response matches Polaris's `AuditData` schema (`pkg/validator/output.go`):

 ```
 AuditData
-  Score            -- cluster score (0-100)
  ClusterInfo      -- nodes, pods, namespaces, controllers
  Results[]        -- per-workload results
    Results{}      -- top-level check results (ResultSet)
@@ -174,7 +215,7 @@ AuditData
        Results{}  -- container-level check results
 ```

-Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"` or `"danger"`).
+Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"`, `"danger"`, or `"ignore"`). The cluster score is computed client-side as `pass / total * 100`.

 ## Releasing

@@ -219,7 +260,7 @@ When releasing a new version, update `artifacthub-pkg.yml`:

 ## Links

- [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin)
+- [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris/headlamp-polaris-plugin)
 - [GitHub (mirror)](https://github.com/cpfarhood/headlamp-polaris-plugin)
 - [Gitea (source of truth)](https://git.farh.net/farhoodliquor/headlamp-polaris-plugin)
 - [Headlamp](https://headlamp.dev/)
@@ -1,8 +1,14 @@
-version: 0.0.8
+version: 0.1.0
 name: headlamp-polaris-plugin
 displayName: Polaris
 createdAt: "2026-02-05T19:00:00Z"
-description: Surfaces Fairwinds Polaris audit results inside the Headlamp UI.
+description: >-
+  Surfaces Fairwinds Polaris audit results inside the Headlamp UI.
+  Shows cluster score, check summary, and per-namespace drill-downs
+  with per-resource pass/warning/danger breakdowns. Data is fetched
+  read-only via the Kubernetes service proxy to the Polaris dashboard.
+  Requires a Role granting `get` on `services/proxy` for the
+  `polaris-dashboard` service in the `polaris` namespace.
 license: MIT
 homeURL: "https://github.com/cpfarhood/headlamp-polaris-plugin"
 category: security
@@ -22,7 +28,7 @@ maintainers:
  - name: cpfarhood
    email: "chris@farhood.org"
 annotations:
-  headlamp/plugin/archive-url: "https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/v0.0.8/polaris-headlamp-plugin-0.0.8.tar.gz"
+  headlamp/plugin/archive-url: "https://github.com/cpfarhood/headlamp-polaris-plugin/releases/download/v0.1.0/headlamp-polaris-plugin-0.1.0.tar.gz"
  headlamp/plugin/version-compat: ">=0.26"
-  headlamp/plugin/archive-checksum: sha256:425082de35c4c59363c8cfe5859145781f76dc2423084bd8b4585b28bec66784
+  headlamp/plugin/archive-checksum: sha256:c720f4386a8581560412be43a796316812a5850173d4428a7d0f289d7a04c1a3
  headlamp/plugin/distro-compat: in-cluster
@@ -29,14 +29,63 @@ npx eslint src/

 ```
 src/
-├── index.tsx                    # Entry point: registerSidebarEntry + registerRoute for /polaris
+├── index.tsx                           # Entry point: registers sidebar entries + routes
 ├── api/
-│   └── polaris.ts               # Types (AuditData schema), usePolarisData hook, countResults utility, refresh settings
+│   ├── polaris.ts                      # Types (AuditData schema), usePolarisData hook, countResults utilities, refresh settings
+│   └── PolarisDataContext.tsx           # React context provider for shared data fetch
 └── components/
-    └── PolarisView.tsx           # Main page: score badge, check summary, cluster info, error states, refresh interval selector
+    ├── DashboardView.tsx                # Overview / Full Audit page (score, check summary, cluster info)
+    ├── NamespaceDetailView.tsx          # Per-namespace drill-down with resource table
+    ├── DynamicSidebarRegistrar.tsx       # Registers namespace sidebar entries from live audit data
+    └── PolarisSettings.tsx              # Plugin settings (refresh interval selector)
 ```

-Single sidebar page at `/polaris`. Data is fetched via `ApiProxy.request` to the Polaris dashboard service proxy and refreshed on a user-configurable interval (stored in localStorage under `polaris-plugin-refresh-interval`, default 5 minutes). Score is computed from result counts (pass/total).
+Top-level sidebar section at `/polaris` with sub-routes for full audit (`/polaris/full-audit`) and per-namespace views (`/polaris/ns/:namespace`). Data is fetched via `ApiProxy.request` to the Polaris dashboard service proxy and refreshed on a user-configurable interval (stored in localStorage under `polaris-plugin-refresh-interval`, default 5 minutes). Score is computed from result counts (pass/total).
+
+## Security / RBAC Requirements
+
+The plugin reaches Polaris through the Kubernetes API server's service proxy sub-resource (`/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/...`). The Headlamp service account (or the user's bearer token when Headlamp runs in token-auth mode) must be granted:
+
+| Verb | API Group | Resource | Resource Name | Namespace |
+|------|-----------|----------|---------------|-----------|
+| `get` | `""` (core) | `services/proxy` | `polaris-dashboard` | `polaris` |
+
+Minimal RBAC example:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: polaris-proxy-reader
+  namespace: polaris
+rules:
+  - apiGroups: [""]
+    resources: ["services/proxy"]
+    resourceNames: ["polaris-dashboard"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: headlamp-polaris-proxy
+  namespace: polaris
+subjects:
+  - kind: ServiceAccount
+    name: headlamp            # adjust to match your Headlamp SA
+    namespace: kube-system
+roleRef:
+  kind: Role
+  name: polaris-proxy-reader
+  apiGroup: rbac.authorization.k8s.io
+```
+
+Additional considerations:
+
+- **NetworkPolicy**: If the `polaris` namespace enforces network policies, allow ingress from the Headlamp pod (or the API server, since it performs the proxy hop) to `polaris-dashboard` on port 80.
+- **Polaris dashboard listen address**: The Polaris Helm chart exposes the dashboard on a ClusterIP service (`polaris-dashboard:80`). If the chart is installed with `dashboard.enabled: false`, the service will not be created, resulting in a 404 error for proxy requests.
+- **No write operations**: The plugin only performs `GET` requests through the proxy. No `create`, `update`, or `delete` verbs are required. Do not grant broader service proxy access than `get`.
+- **Token-auth mode**: When Headlamp is configured for user-supplied tokens (rather than a fixed service account), each user's own RBAC bindings must include the role above. A 403 from the plugin means the logged-in user lacks the binding.
+- **Audit logging**: Kubernetes API audit logs will record every proxied request as a `get` on `services/proxy` in the `polaris` namespace. Set an appropriate audit policy level if request volume from the auto-refresh interval is a concern.

 ## Key Constraints

@@ -1,12 +1,12 @@
 {
-  "name": "polaris-headlamp-plugin",
-  "version": "0.0.8",
+  "name": "headlamp-polaris-plugin",
+  "version": "0.1.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
-      "name": "polaris-headlamp-plugin",
-      "version": "0.0.8",
+      "name": "headlamp-polaris-plugin",
+      "version": "0.1.0",
      "devDependencies": {
        "@kinvolk/headlamp-plugin": "^0.13.0"
      }
@@ -1,6 +1,6 @@
 {
-  "name": "polaris-headlamp-plugin",
-  "version": "0.0.8",
+  "name": "headlamp-polaris-plugin",
+  "version": "0.1.0",
  "description": "Headlamp plugin for Fairwinds Polaris audit results",
  "scripts": {
    "start": "headlamp-plugin start",
@@ -61,6 +61,7 @@ export interface ResultCounts {
  pass: number;
  warning: number;
  danger: number;
+  skipped: number;
 }

 function countResultSet(rs: ResultSet, counts: ResultCounts): void {
@@ -69,6 +70,8 @@ function countResultSet(rs: ResultSet, counts: ResultCounts): void {
    counts.total++;
    if (msg.Success) {
      counts.pass++;
+    } else if (msg.Severity === 'ignore') {
+      counts.skipped++;
    } else if (msg.Severity === 'warning') {
      counts.warning++;
    } else if (msg.Severity === 'danger') {
@@ -78,7 +81,7 @@ function countResultSet(rs: ResultSet, counts: ResultCounts): void {
 }

 function countResultItems(results: Result[]): ResultCounts {
-  const counts: ResultCounts = { total: 0, pass: 0, warning: 0, danger: 0 };
+  const counts: ResultCounts = { total: 0, pass: 0, warning: 0, danger: 0, skipped: 0 };
  for (const result of results) {
    countResultSet(result.Results, counts);
    if (result.PodResult) {
@@ -138,6 +141,11 @@ export function setRefreshInterval(seconds: number): void {
  localStorage.setItem(STORAGE_KEY, String(seconds));
 }

+// --- Polaris dashboard proxy URL ---
+
+export const POLARIS_DASHBOARD_PROXY =
+  '/api/v1/namespaces/polaris/services/polaris-dashboard:80/proxy/';
+
 // --- Score computation ---

 export function computeScore(counts: ResultCounts): number {
@@ -6,7 +6,7 @@ import {
  StatusLabel,
 } from '@kinvolk/headlamp-plugin/lib/CommonComponents';
 import React from 'react';
-import { AuditData, computeScore, countResults, ResultCounts } from '../api/polaris';
+import { AuditData, countResults, ResultCounts } from '../api/polaris';
 import { usePolarisDataContext } from '../api/PolarisDataContext';

 function scoreStatus(score: number): 'success' | 'warning' | 'error' {
@@ -15,10 +15,41 @@ function scoreStatus(score: number): 'success' | 'warning' | 'error' {
  return 'error';
 }

-function OverviewSection(props: { data: AuditData; counts: ResultCounts }) {
-  const score = computeScore(props.counts);
+function OverviewSection(props: {
+  data: AuditData;
+  counts: ResultCounts;
+  includeSkipped: boolean;
+}) {
+  const { counts, includeSkipped } = props;
+
+  const displayTotal = includeSkipped ? counts.total : counts.total - counts.skipped;
+  const displayPass = counts.pass;
+  const score = displayTotal === 0 ? 0 : Math.round((displayPass / displayTotal) * 100);
  const status = scoreStatus(score);

+  const summaryRows: { name: string; value: React.ReactNode }[] = [
+    { name: 'Total Checks', value: String(displayTotal) },
+    {
+      name: 'Pass',
+      value: <StatusLabel status="success">{counts.pass}</StatusLabel>,
+    },
+    {
+      name: 'Warning',
+      value: <StatusLabel status="warning">{counts.warning}</StatusLabel>,
+    },
+    {
+      name: 'Danger',
+      value: <StatusLabel status="error">{counts.danger}</StatusLabel>,
+    },
+  ];
+
+  if (includeSkipped) {
+    summaryRows.push({
+      name: 'Skipped',
+      value: <StatusLabel status="">{counts.skipped}</StatusLabel>,
+    });
+  }
+
  return (
    <>
      <SectionBox title="Score">
@@ -32,23 +63,7 @@ function OverviewSection(props: { data: AuditData; counts: ResultCounts }) {
        />
      </SectionBox>
      <SectionBox title="Check Summary">
-        <NameValueTable
-          rows={[
-            { name: 'Total Checks', value: String(props.counts.total) },
-            {
-              name: 'Pass',
-              value: <StatusLabel status="success">{props.counts.pass}</StatusLabel>,
-            },
-            {
-              name: 'Warning',
-              value: <StatusLabel status="warning">{props.counts.warning}</StatusLabel>,
-            },
-            {
-              name: 'Danger',
-              value: <StatusLabel status="error">{props.counts.danger}</StatusLabel>,
-            },
-          ]}
-        />
+        <NameValueTable rows={summaryRows} />
      </SectionBox>
      <SectionBox title="Cluster Info">
        <NameValueTable
@@ -64,8 +79,9 @@ function OverviewSection(props: { data: AuditData; counts: ResultCounts }) {
  );
 }

-export default function PolarisView() {
+export default function DashboardView(props: { includeSkipped: boolean }) {
  const { data, loading, error } = usePolarisDataContext();
+  const title = props.includeSkipped ? 'Polaris — Full Audit' : 'Polaris — Overview';

  if (loading) {
    return <Loader title="Loading Polaris audit data..." />;
@@ -75,7 +91,7 @@ export default function PolarisView() {

  return (
    <>
-      <SectionHeader title="Polaris" />
+      <SectionHeader title={title} />

      {error && (
        <SectionBox title="Error">
@@ -90,7 +106,9 @@ export default function PolarisView() {
        </SectionBox>
      )}

-      {data && counts && <OverviewSection data={data} counts={counts} />}
+      {data && counts && (
+        <OverviewSection data={data} counts={counts} includeSkipped={props.includeSkipped} />
+      )}

      {!data && !error && (
        <SectionBox title="No Data">
@@ -16,10 +16,10 @@ export default function DynamicSidebarRegistrar() {
      if (registeredNamespaces.has(ns)) continue;
      registeredNamespaces.add(ns);
      registerSidebarEntry({
-        parent: 'polaris',
+        parent: 'polaris-namespaces',
        name: `polaris-ns-${ns}`,
        label: ns,
-        url: `/polaris/${ns}`,
+        url: `/polaris/ns/${ns}`,
        icon: 'mdi:folder-outline',
      });
    }
@@ -12,6 +12,7 @@ import {
  computeScore,
  countResultsForItems,
  filterResultsByNamespace,
+  POLARIS_DASHBOARD_PROXY,
  Result,
  ResultCounts,
 } from '../api/polaris';
@@ -82,6 +83,21 @@ export default function NamespaceDetailView() {
    <>
      <SectionHeader title={`Polaris — ${namespace}`} />

+      <SectionBox title="External">
+        <NameValueTable
+          rows={[
+            {
+              name: 'Polaris Dashboard',
+              value: (
+                <a href={POLARIS_DASHBOARD_PROXY} target="_blank" rel="noopener noreferrer">
+                  View in Polaris Dashboard
+                </a>
+              ),
+            },
+          ]}
+        />
+      </SectionBox>
+
      <SectionBox title="Namespace Score">
        <NameValueTable
          rows={[
@@ -5,10 +5,12 @@ import {
 } from '@kinvolk/headlamp-plugin/lib';
 import React from 'react';
 import { PolarisDataProvider } from './api/PolarisDataContext';
+import DashboardView from './components/DashboardView';
 import DynamicSidebarRegistrar from './components/DynamicSidebarRegistrar';
 import NamespaceDetailView from './components/NamespaceDetailView';
 import PolarisSettings from './components/PolarisSettings';
-import PolarisView from './components/PolarisView';
+
+// --- Sidebar entries ---

 registerSidebarEntry({
  parent: null,
@@ -18,6 +20,32 @@ registerSidebarEntry({
  icon: 'mdi:shield-check',
 });

+registerSidebarEntry({
+  parent: 'polaris',
+  name: 'polaris-overview',
+  label: 'Overview',
+  url: '/polaris',
+  icon: 'mdi:view-dashboard',
+});
+
+registerSidebarEntry({
+  parent: 'polaris',
+  name: 'polaris-full',
+  label: 'Full Audit',
+  url: '/polaris/full-audit',
+  icon: 'mdi:clipboard-text-search',
+});
+
+registerSidebarEntry({
+  parent: 'polaris',
+  name: 'polaris-namespaces',
+  label: 'Namespaces',
+  url: '/polaris',
+  icon: 'mdi:dns',
+});
+
+// --- Routes ---
+
 registerRoute({
  path: '/polaris',
  sidebar: 'polaris',
@@ -26,13 +54,26 @@ registerRoute({
  component: () => (
    <PolarisDataProvider>
      <DynamicSidebarRegistrar />
-      <PolarisView />
+      <DashboardView includeSkipped={false} />
    </PolarisDataProvider>
  ),
 });

 registerRoute({
-  path: '/polaris/:namespace',
+  path: '/polaris/full-audit',
+  sidebar: 'polaris-full',
+  name: 'polaris-full-audit',
+  exact: true,
+  component: () => (
+    <PolarisDataProvider>
+      <DynamicSidebarRegistrar />
+      <DashboardView includeSkipped />
+    </PolarisDataProvider>
+  ),
+});
+
+registerRoute({
+  path: '/polaris/ns/:namespace',
  sidebar: 'polaris',
  name: 'polaris-namespace',
  exact: true,
@@ -44,4 +85,4 @@ registerRoute({
  ),
 });

-registerPluginSettings('polaris-headlamp-plugin', PolarisSettings, true);
+registerPluginSettings('headlamp-polaris-plugin', PolarisSettings, true);
Author	SHA1	Message	Date
gitea-actions[bot]	4126439e52	ci: update artifact hub metadata for v0.1.0	2026-02-07 16:37:15 +00:00
Chris Farhood	49ed3ea7ff	chore: bump version to 0.1.0 and fix release workflow race condition Fetch latest main before pushing metadata update to prevent non-fast-forward rejections when main moves during the release run. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 11:36:13 -05:00
Chris Farhood	deafe68893	chore: bump version to 0.0.11 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 10:47:43 -05:00
Chris Farhood	a6f30bf681	ci: update artifact hub metadata for v0.0.10 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 10:46:42 -05:00
Chris Farhood	9df30c3943	docs: address review feedback on dashboard.enabled wording Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 10:35:51 -05:00
Chris Farhood	cc3cc81af9	docs: add service proxy RBAC/security requirements and update outdated docs The README, CLAUDE.md, and artifacthub-pkg.yml all referenced the old ConfigMap-based data source. Updated to document the actual Kubernetes service proxy path, the correct RBAC Role/RoleBinding (services/proxy get), and added sections for token-auth mode, NetworkPolicy, audit logging, and troubleshooting. Also updated the project structure and feature descriptions to match the current codebase. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 10:25:59 -05:00
Chris Farhood	d5ab99116c	chore: bump version to 0.0.10 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 09:53:22 -05:00
Chris Farhood	5e330798e1	Merge pull request 'feat: restructure sidebar hierarchy and add full audit view' (#15 ) from feat/sidebar-restructure-dashboard-views into main Reviewed-on: farhoodliquor/headlamp-polaris-plugin#15	2026-02-07 09:52:49 -05:00
Chris Farhood	1559a9ffcd	feat: restructure sidebar hierarchy and add full audit view Reorganize the sidebar into a proper hierarchy (Overview, Full Audit, Namespaces) and add a Full Audit dashboard view that includes skipped checks. Namespace routes move to /polaris/ns/:namespace to avoid path collisions, and namespace detail pages now link out to the Polaris dashboard. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 09:50:28 -05:00
gitea-actions[bot]	bea7eaa67b	ci: update artifact hub metadata for v0.0.9	2026-02-07 13:46:45 +00:00
Chris Farhood	9a1d7f961f	chore: bump version to 0.0.9 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 08:45:43 -05:00
Chris Farhood	e6e2aa63a5	Merge pull request 'docs: update ArtifactHub URLs in README' (#14 ) from fix/readme-artifacthub-urls into main Reviewed-on: farhoodliquor/headlamp-polaris-plugin#14 Reviewed-by: Chris Farhood <cpfarhood@noreply.git.farh.net>	2026-02-07 08:45:14 -05:00
Chris Farhood	dab068a963	refactor: rename npm package to headlamp-polaris-plugin Aligns npm package name with the repo and ArtifactHub package name. Updates all references: package.json, registerPluginSettings, Dockerfile, release workflow tarball URLs, artifacthub-pkg.yml archive-url, and README. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 08:43:55 -05:00
Chris Farhood	244714316f	docs: update ArtifactHub URLs to match new package name Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-02-07 08:43:43 -05:00