ResourceClasses is keyed by kind alone. Several call sites look up ResourceClasses[kind] and use the result without checking the object's apiVersion, so a CRD that shares a kind with a built-in silently resolves to the built-in class:
frontend/src/lib/k8s/event.ts:179 — Event.involvedObjectInstance, whose result cluster/Overview.tsx:170 renders as a link. A mismatched hit produces a link to a details page for an object that doesn't exist.frontend/src/components/advancedSearch/utils/useKubeLists.ts:46 — a discovered CRD carrying its own apiVersion/pluralName is replaced by the built-in class, listing from the wrong API group.frontend/src/components/common/Resource/MetadataDisplay.tsx:75 — owner references.
makeCustomResourceClass already guards the same lookup behind UNDER_TEST || STORYBOOK, so the hazard is recognized; these three sites have no equivalent check.
This became reachable in practice with #6562, which registers scheduling.k8s.io PodGroup and Workload. Kueue ships kueue.x-k8s.io/v1beta1 kind Workload, and Volcano and sig-scheduling coscheduling ship kind PodGroup — clusters that are likely to run both.
Suggested fix: compare the API group before using a built-in class at these lookups, falling back to the ad-hoc KubeObject subclass (or null) on mismatch. Regression tests should cover a same-kind/different-group object at each site.
ResourceClassesis keyed by kind alone. Several call sites look upResourceClasses[kind]and use the result without checking the object'sapiVersion, so a CRD that shares a kind with a built-in silently resolves to the built-in class:frontend/src/lib/k8s/event.ts:179—Event.involvedObjectInstance, whose resultcluster/Overview.tsx:170renders as a link. A mismatched hit produces a link to a details page for an object that doesn't exist.frontend/src/components/advancedSearch/utils/useKubeLists.ts:46— a discovered CRD carrying its ownapiVersion/pluralNameis replaced by the built-in class, listing from the wrong API group.frontend/src/components/common/Resource/MetadataDisplay.tsx:75— owner references.makeCustomResourceClassalready guards the same lookup behindUNDER_TEST || STORYBOOK, so the hazard is recognized; these three sites have no equivalent check.This became reachable in practice with #6562, which registers
scheduling.k8s.ioPodGroupandWorkload. Kueue shipskueue.x-k8s.io/v1beta1kindWorkload, and Volcano and sig-scheduling coscheduling ship kindPodGroup— clusters that are likely to run both.Suggested fix: compare the API group before using a built-in class at these lookups, falling back to the ad-hoc
KubeObjectsubclass (ornull) on mismatch. Regression tests should cover a same-kind/different-group object at each site.