@mark1russell7/kind 0.1.4 → 0.1.5

package/README.md

@@ -79,7 +79,7 @@ The tests read three real records of `/1` (`test/records/`): a cell that holds,
   - Each `rules-alive` line gives the source of the table (`ct`). It counts the reads since the last line, and the entries of the ClusterIP in each state. A read that fails stops the reads, and `ct.error` tells why. The lab drops the lines from before the first measurement, thus an early failure shows only in `ct.error`.
   - `ct.syn` gives up to three entries in SYN_SENT, with the backend of their NAT and their life. A new SYN has the life 120 s, and an older one less.
   - Each second, the agent reads the counters of dropped packets (`drops.ts`), and it writes a `drops` line with each counter that grew. For the node, these are the drops of the backlogs, the squeezes of the softirqs, and the drops of each veth.
-  - For each client pod, the agent reads `/proc/<pid>/net`. These counters are the IP discards, the sends with no route, the failed connects, the drops of its interfaces, and its neighbors with no address. A SYN that does not get to the conntrack of the node leaves its trace in one of them.
+  - For each client pod, the agent reads `/proc/<pid>/net`. These counters are the IP discards, the sends with no route, the failed connects, the drops of its interfaces, and its neighbors with no address. From 0.1.5, they also count the ICMP errors of an unreachable destination. A refusal by a reject rule is such an error, not a reset. A SYN that does not get to the conntrack of the node leaves its trace in one of them.
 - **The rules of each node.** The agent reads the rules of kube-proxy in the namespaces of the node each 50 ms: `iptables-save`, `nft list table ip kube-proxy`, or `/proc/net/ip_vs`. It writes a line when the backends of the Service change (`backends.ts`). A backend of IPVS with the weight zero takes no new connection, thus it is not a backend.
 - **The injector of each node** is the image of the harness, in the PID namespace of the node. `crictl` on the node gives the PID of a container, and `nsenter -n` enters the network namespace of its pod. The injector of the harness then applies its rules there.
 - **The watcher** is a container on the network of the cluster. It watches the pods, the EndpointSlices and the events through the API, and it follows the log of each pod of the cell.

package/image/agent.mjs

@@ -89,8 +89,8 @@ const clientsOf = () => {
 /**
  * the counters of dropped packets, by name. For the node: the drops of the backlogs and the squeezes
  * of the softirqs (the kernel, all CPUs), and the drops of each veth. For each client pod, through
- * /proc/<pid>/net: the IP discards and the sends with no route, the failed connects, the drops of
- * each interface, and the neighbors with no address yet
+ * /proc/<pid>/net: the IP discards and the sends with no route, the failed connects, the ICMP
+ * errors of an unreachable destination, the drops of each interface, and the neighbors with no address yet
  */
 const countersOf = () => {
   const values = {};
@@ -125,6 +125,8 @@ const countersOf = () => {
     values[`client.${pid}.ip-out-discards`] = ip["OutDiscards"] ?? 0;
     values[`client.${pid}.ip-out-no-routes`] = ip["OutNoRoutes"] ?? 0;
     values[`client.${pid}.tcp-attempt-fails`] = tcp["AttemptFails"] ?? 0;
+    // a refused connect is a reset, or an ICMP error such as the port unreachable of a reject rule
+    values[`client.${pid}.icmp-in-unreachable`] = snmpOf(snmp, "Icmp")["InDestUnreachs"] ?? 0;
     for (const [name, drops] of Object.entries(devOf(own))) {
       if (name === "lo") continue;
       values[`client.${pid}.${name}.rx-drops`] = drops.rx;

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@mark1russell7/kind",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Kubernetes in Docker as a lab for connection timers: a kind cluster from a scenario, faults in the namespaces of its pods, observations on the one monotonic clock of the VM, and predictions from the ordering law. Its judge entry reads and judges a raw record without Docker.",
   "keywords": [
     "kubernetes",