@mark1russell7/kind 0.11.11 → 0.12.0

package/README.md

@@ -62,10 +62,12 @@ The tests read three real records of `/1` (`test/records/`): a cell that holds,
 
 ## The cluster
 
-- **The scenario** (`scenario.ts`) is the cluster as data: its nodes, its version, the mode and the sync periods of kube-proxy, its CNI and its subnets. `kindConfig(scenario)` generates the configuration of kind from it.
+- **The scenario** (`scenario.ts`) is the cluster as data: its nodes, its version, its dataplane, the sync periods of kube-proxy, its CNI and its subnets. `kindConfig(scenario)` generates the configuration of kind from it.
+- **The dataplane** (`Dataplane`) is the path of a Service on each node, and the mode of a cell. From 0.12.0, it is a mode of kube-proxy (`iptables`, `ipvs`, `nftables`), or `cilium`. A scenario of `cilium` has no kube-proxy and no kindnet (`kubeProxy: null`, `cni: "cilium"`).
 - **The node image** is `kindest/node:v1.37.0`, pinned by digest, the default of kind v0.33.0. The research names v1.37.1 for some defaults. The patch release is the mismatch.
 - **The tools** (`tools.ts`) are kind v0.33.0 and kubectl v1.37.0. The lab downloads each one into `.cache/` in this package, and it compares the sha256 with the pinned value at each use. `KIND_CACHE` names another folder. The lab installs nothing on the system, and the same code works on Linux, macOS and Windows.
 - **istioctl 1.31.3** (`ISTIOCTL`) comes in a gzipped tar file. The pinned sha256 is that of the tar file. The cache keeps the tar file, and each use examines it and takes the tool from it again (`tarEntry`). The release has a zip file for Windows, thus Windows has no asset of istioctl.
+- **Helm v3.22.1** (`HELM`) installs Cilium. It also comes in a gzipped tar file. Its tar file for Windows has `helm.exe`, thus Windows has no asset of Helm.
 - **The isolation.** Each cluster gets its own Docker network, its own kubeconfig and its own cache for kubectl, in its run folder. The lab refuses a pod or service subnet that overlaps a Docker network.
 
 ## The lab
@@ -82,6 +84,7 @@ The tests read three real records of `/1` (`test/records/`): a cell that holds,
   - Each second, the agent reads the counters of dropped packets (`drops.ts`), and it writes a `drops` line with each counter that grew. For the node, these are the drops of the backlogs, the squeezes of the softirqs, and the drops of each veth.
   - For each client pod, the agent reads `/proc/<pid>/net`. These counters are the IP discards, the sends with no route, the failed connects, the drops of its interfaces, and its neighbors with no address. From 0.1.5, they also count the ICMP errors of an unreachable destination. A refusal by a reject rule is such an error, not a reset. A SYN that does not get to the conntrack of the node leaves its trace in one of them.
 - **The rules of each node.** The agent reads the rules of kube-proxy in the namespaces of the node each 50 ms: `iptables-save`, `nft list table ip kube-proxy`, or `/proc/net/ip_vs`. It writes a line when the backends of the Service change (`backends.ts`). A backend of IPVS with the weight zero takes no new connection, thus it is not a backend.
+  - From 0.12.0, in the dataplane `cilium`, the agent asks the agent of Cilium on its socket in the node: `GET /v1/service`. The backends are those in the state `active`, or the `terminating` ones when no backend is active (`ciliumBackendsOf`). A reply that does not parse gives a `rules-fail` line.
 - **The endpoints of each client sidecar.** From 0.3.0, in a sidecar mesh, the agent also polls the Envoy of the client sidecar on its node each 50 ms (`eds`). The client sidecar picks the backend of each call, thus these endpoints and not the rules are the propagation of the cell (`propagationSource`).
   - A poller enters the network namespace of the client pod (`nsenter -n`). It reads `/clusters` on `127.0.0.1:15000` with a filter that selects the server cluster (`eds.ts`).
   - Each change of the healthy hosts gives an `eds` line with the start of the poll before it. That line has the form of a rules line. Each second, an `eds-alive` line counts the polls and gives their mean time.
@@ -152,6 +155,7 @@ The lab image (`image/`) holds the service of a cell on `@mark1russell7/service`
 
 - **The keep-alive clients.** A workload with `connections` gives each HTTP client that count of keep-alive connections. Each request goes on the next connection in turn. kube-proxy selects a backend only for a new connection. SIGHUP gives the client new connections, and its old connections close after the timeout. With no `connections`, each request has a new connection, as before.
 - **The lame duck.** The declaration has the optional field `lameDuck`. With true or no value, the edge sends `Connection: close` while the service is not ready (`httpTransport` as it is). With false, the app gives the transport `keepAlive: () => true`, thus each connection stays open and a caller learns only from the endpoints.
+- **The shared gate.** The declaration has the optional field `sharedGate`, a candidate of S6 that is off by default. With true, the app gives its health server `sharedGate()` of this package. The readiness probe that the kubelet reads then leaves out each check of the Redis of the declaration, which must have Redis. The controller still reads those checks, thus the service refuses each request with a 503. A check of no dependency, a drain or a failed liveness still fails the probe.
 - **HTTP/2.** The declaration has the optional field `protocol` (`EdgeProtocol`). With `h2c`, the app listens with `node:http2` through the same `httpTransport`, and the lame duck is a GOAWAY on each session. The manifests give each client `PROTOCOL=h2c`. The client then keeps `connections` sessions, and sends each request as a stream on the next session in turn.
   - A GOAWAY, a close or an error of a session makes its slot open a new session at the next stream. Then kube-proxy selects a backend for that new connection.
   - The client sends a stream that the server did not take again, once, on a new session (RFC 9113, section 8.7). Its line has `r: 1`.
@@ -265,7 +269,11 @@ From 0.8.0, a prediction `ends` can be the end of the tunnel of each client (`of
 - The first request of each client after the heal must be `ok`, on a new tunnel. The main value is the middle of the ends, in `s`.
 - From 0.8.1, `ends` has the optional band `answer`. A change to CLOSE_WAIT in that band ± δ also agrees: the peer answers the close of the client, and its FIN comes first. Before the band, the peer closed first.
 
-The optional field `protocol` of a declaration, the type `EdgeProtocol` and the mode h2c of the lab image are new features. They keep the old behavior. Before `1.0.0`, a feature is a patch, thus the next version is `0.11.1`. The record format stays `/2`.
+In 0.12.0, `kubeProxy` of a scenario can be null, `cni` can be `cilium`, and the mode of a cell can be `cilium`. A reader of `kubeProxy.mode` breaks, thus this is a breaking change before 1.0.0. To migrate, examine `kubeProxy` for null, and read the mode from `dataplane`. The record format stays `/2`.
+
+The optional field `protocol` of a declaration, the type `EdgeProtocol` and the mode h2c of the lab image are new features. The optional field `sharedGate` of a declaration and the function `sharedGate` are new features. They keep the old behavior, thus their release is a patch. The record format stays `/2`.
+
+They keep the old behavior. Before `1.0.0`, a feature is a patch, thus the next version is `0.11.1`. The record format stays `/2`.
 
 A new member of the union `TriggerKind`, `cannot-serve`, breaks a reader that switches on it. That is a breaking change before 1.0.0, thus the next version is 0.11.0. The record format stays `/2`, with the optional fields `connections` of a workload and `lameDuck` of a declaration. The line `client` of the reconnect is a new line of a run.
 
@@ -291,11 +299,25 @@ A preStop sleep that is longer than the grace is a command in the container (`sh
 
 The catalogs are in `@systems/cells` (`t07.ts`, `t18.ts`, `grpc/t07.ts` and `grpc/t15.ts`). `KIND_LAB=1` starts them in kind.
 
+## Cilium
+
+From 0.12.0, a cell can have the dataplane `cilium`: Cilium 1.20.4 is the CNI, and it replaces kube-proxy (`cilium.ts`).
+
+- **The cluster.** kind makes the cluster with no kube-proxy and no CNI, thus it does not wait for ready nodes. Then the lab loads the images of Cilium and installs it, before each other image.
+- **The install.** `installCilium` installs the chart of 1.20.4, pinned by sha256 (`CILIUM_CHART`), with Helm. Then it waits for the agent, the operator, Envoy, each node and CoreDNS. A failed install gives the pods of kube-system and the log of the agent in its error.
+- **The values** (`ciliumValues`). `kubeProxyReplacement` is true, and the agent reaches the API server on the control plane. The IPAM is `kubernetes`, as the kind guide of Cilium tells. The operator has one replica. Each other value is the default of the chart.
+- **Socket LB** stays at its default: on, because the replacement of kube-proxy sets it. It selects a backend at each `connect()`, thus an established connection keeps its backend, as with kube-proxy.
+- **The images.** `CILIUM_IMAGES` pins the agent, the operator and Envoy by the digests of the chart. `pullPolicy` is `Never`.
+- **The mode** of the cluster manifest gives the version of Cilium and the keys of `cilium-config` that a cell depends on (`ciliumMode`).
+- **The target `kube-proxy`** of a freeze needs kube-proxy. A cell of `cilium` with that target fails with a clear error.
+
 ## CI
 
 The cells operate on the runners of GitHub, and not on a machine that does other work (`.github/workflows/kind.yml`). Each shard gets a runner, and each job makes its own clusters and deletes them.
 
 - **The modes of the kernel.** kube-proxy in a node container uses the modules of the host kernel. Thus the job loads `ip_vs` and `nf_tables` first. A cell of a mode that the kernel cannot do waits, and `summary.ndjson` tells why.
+- **The dataplane `cilium`** needs cgroup v2 on the runner. The job examines it, and a cell of `cilium` waits on a runner without it.
+- **The capture.** The job `capture` makes a cluster of `cilium` and dumps the services of the agent of each node in three states of the backends (`src/cilium.capture.test.ts`). It uploads the artifact `cilium-capture`. The unit tests of `ciliumBackendsOf` read a part of a real dump (`test/cilium/`).
 - **The inotify limits.** The pods of each node share the inotify limits of the kernel of the runner. Thus the job raises them to 512 instances and 524288 watches, the values of the known issues of kind.
 - **The shards.** `shardOf` gives each shard an equal share of the estimated time, and the cells of one mode stay together. Thus a shard makes few clusters.
 - **The output.** Each job uploads its raw records, `summary.ndjson`, and what the runner is. The run folder of each cluster stays out of the output, because a kubeconfig holds credentials.

package/build/index.d.ts

@@ -1,13 +1,13 @@
-import { $ as unitOf, $t as secondsOf, A as TriggerV1, An as NodeImage, At as restartsAt, B as RunCheck, Bn as scenario, Bt as stoppingOf, C as KindCellResult, Cn as WindowPrediction, Ct as kernelCounts, D as PredictionV1, Dn as KindScenario, Dt as recordsOf, E as LoadSample, En as KindConfig, Et as podsOf, F as KIND_NOISE, Fn as cidrRange, Ft as sliceEmptyOf, G as factsOf, Gt as CLIENT, H as checkRun, Hn as zoneOf, Ht as tunnelsOf, I as KindDecision, In as goDuration, It as sliceReadyAt, J as observationEnd, Jt as PORT, K as judgeKind, Kt as HEALTH_PORT, L as KindVerdict, Ln as kindConfig, Lt as sliceReadyOf, M as upgrade, Mn as ZONE_LABEL, Mt as signalOf, N as upgradeCell, Nn as ZONE_LOST, Nt as signalsOf, O as RunCheckV1, On as KubeProxyMode, Ot as requestsOf, P as Deleted, Pn as cidrOverlap, Pt as sliceDropOf, Q as reusesReset, Qt as seconds, R as LAST_SLACK, Rn as kubeProxyPatch, Rt as slicesOf, S as KindCellRecordV1, Sn as TriggerKind, St as isTunnelState, T as KindVerdictV1, Tn as KUBE_PROXY_MODES, Tt as podsAt, U as cyclesOf, Ut as ztunnelPodsOf, V as RunFacts, Vn as scenarioProblems, Vt as transitionOf, W as deletionsOf, Wt as ztunnelReplaced, X as propagationSource, Xt as SERVER, Y as propagationOf, Yt as REDIS, Z as referenceOf, Zt as bandOf, _ as ClusterManifest, _n as Replica, _t as deletionOf, a as STAGES, an as Flap, at as PropagationSource, b as FORMAT_V1, bn as Template, bt as failuresOf, c as readRecord, cn as KubeletProbe, ct as RulesLine, d as calibrationOf, dn as MeshMode, dt as TCP_STATE, en as showBand, et as updatesOf, f as cellsTable, fn as NonePrediction, ft as TunnelLine, g as BandV1, gn as Reference, gt as byNode, h as timeSpread, hn as RedisDeclaration, ht as byClients, i as quantileOf, in as EdgeProtocol, it as PodLine, j as judge, jn as ZONE_KEPT, jt as rulesOf, k as RunFactsV1, kn as NODE_IMAGES, kt as restartOf, l as Judged, ln as Mesh, lt as SliceLine, m as predictionText, mn as Prediction, mt as backendsAt, n as medianInterval, nn as Cycle, nt as HBONE_PORT, o as kindCellRecordSchema, on as KindCell, ot as RecordLine, p as medianText, pn as PodSettings, pt as ZtunnelPodLine, q as observationAfter, qt as LOG_LABEL, r as middle, rn as Declaration, rt as Line, s as kindCellRecordV1Schema, sn as KindRun, st as Request, t as RELATIVE, tn as Band, tt as Endpoint, u as TimeSpread, un as MeshFlavor, ut as SocketLine, v as EnvironmentManifest, vn as ResetReuse, vt as dropOf, w as KindCellV1, wn as Workload, wt as outcomesOf, x as KindCellRecord, xn as Trigger, xt as intakeOf, y as FORMAT, yn as Stack, yt as emptyOf, z as Propagated, zn as nodeNames, zt as socketsOf } from "./judge-0ku_4dsJ.js";
+import { $ as unitOf, $t as secondsOf, A as TriggerV1, An as KubeProxyMode, At as restartsAt, B as RunCheck, Bn as kindConfig, Bt as stoppingOf, C as KindCellResult, Cn as WindowPrediction, Ct as kernelCounts, D as PredictionV1, Dn as KUBE_PROXY_MODES, Dt as recordsOf, E as LoadSample, En as Dataplane, Et as podsOf, F as KIND_NOISE, Fn as ZONE_LOST, Ft as sliceEmptyOf, G as factsOf, Gn as zoneOf, Gt as CLIENT, H as checkRun, Hn as nodeNames, Ht as tunnelsOf, I as KindDecision, In as cidrOverlap, It as sliceReadyAt, J as observationEnd, Jt as PORT, K as judgeKind, Kt as HEALTH_PORT, L as KindVerdict, Ln as cidrRange, Lt as sliceReadyOf, M as upgrade, Mn as NodeImage, Mt as signalOf, N as upgradeCell, Nn as ZONE_KEPT, Nt as signalsOf, O as RunCheckV1, On as KindConfig, Ot as requestsOf, P as Deleted, Pn as ZONE_LABEL, Pt as sliceDropOf, Q as reusesReset, Qt as seconds, R as LAST_SLACK, Rn as goDuration, Rt as slicesOf, S as KindCellRecordV1, Sn as TriggerKind, St as isTunnelState, T as KindVerdictV1, Tn as DATAPLANES, Tt as podsAt, U as cyclesOf, Un as scenario, Ut as ztunnelPodsOf, V as RunFacts, Vn as kubeProxyPatch, Vt as transitionOf, W as deletionsOf, Wn as scenarioProblems, Wt as ztunnelReplaced, X as propagationSource, Xt as SERVER, Y as propagationOf, Yt as REDIS, Z as referenceOf, Zt as bandOf, _ as ClusterManifest, _n as Replica, _t as deletionOf, a as STAGES, an as Flap, at as PropagationSource, b as FORMAT_V1, bn as Template, bt as failuresOf, c as readRecord, cn as KubeletProbe, ct as RulesLine, d as calibrationOf, dn as MeshMode, dt as TCP_STATE, en as showBand, et as updatesOf, f as cellsTable, fn as NonePrediction, ft as TunnelLine, g as BandV1, gn as Reference, gt as byNode, h as timeSpread, hn as RedisDeclaration, ht as byClients, i as quantileOf, in as EdgeProtocol, it as PodLine, j as judge, jn as NODE_IMAGES, jt as rulesOf, k as RunFactsV1, kn as KindScenario, kt as restartOf, l as Judged, ln as Mesh, lt as SliceLine, m as predictionText, mn as Prediction, mt as backendsAt, n as medianInterval, nn as Cycle, nt as HBONE_PORT, o as kindCellRecordSchema, on as KindCell, ot as RecordLine, p as medianText, pn as PodSettings, pt as ZtunnelPodLine, q as observationAfter, qt as LOG_LABEL, r as middle, rn as Declaration, rt as Line, s as kindCellRecordV1Schema, sn as KindRun, st as Request, t as RELATIVE, tn as Band, tt as Endpoint, u as TimeSpread, un as MeshFlavor, ut as SocketLine, v as EnvironmentManifest, vn as ResetReuse, vt as dropOf, w as KindCellV1, wn as Workload, wt as outcomesOf, x as KindCellRecord, xn as Trigger, xt as intakeOf, y as FORMAT, yn as Stack, yt as emptyOf, z as Propagated, zn as isKubeProxyMode, zt as socketsOf } from "./judge-BH4WtL3f.js";
 import { Quantity } from "@mark1russell7/quantity";
-import { CheckFn, Finding, HealthServer, Poll, Scenario, ServiceBuilder, ServiceDescription, Stage, StopWay, Timing, TransportImpl, Verdict } from "@mark1russell7/service";
+import { CheckFn, Coupling, Finding, HealthServer, Poll, Scenario, ServiceBuilder, ServiceDescription, Stage, StopWay, Timing, TransportImpl, Verdict } from "@mark1russell7/service";
 import { BuildImage } from "@mark1russell7/harness";
 import { RedisClient } from "@mark1russell7/service/redis";
 import { DRAIN_RULES, O04, O09, O10, O16 } from "@mark1russell7/service/rules";
 //#region src/backends.d.ts
-/** A service rule names the Service whose backends the agent reads: its namespace, its name, and its ClusterIP and port for IPVS. */
+/** A service rule names the Service whose backends the agent reads: its namespace, its name, and its ClusterIP and port for IPVS and Cilium. */
 interface ServiceRule {
-  readonly mode: "iptables" | "ipvs" | "nftables";
+  readonly mode: "iptables" | "ipvs" | "nftables" | "cilium";
   readonly ns: string;
   readonly svc: string;
   readonly ip: string;
@@ -20,8 +20,26 @@ interface ServiceRule {
  * - iptables: the `KUBE-SVC` chain of the Service jumps to a `KUBE-SEP` chain for each backend, and that chain does the DNAT.
  * - nftables: the `service-` chain of the Service does the DNAT to each backend, or it names an `endpoint-` chain for each one.
  * - IPVS: `/proc/net/ip_vs` has the line of the virtual service, then a line for each real server.
+ * - Cilium: the JSON of the services of the agent (`ciliumBackendsOf`).
  */
 export declare const backendsOf: (mode: ServiceRule["mode"], text: string, rule: Pick<ServiceRule, "ns" | "svc" | "ip" | "port">) => string[];
+/**
+ * This function gives the backends of a Service in the reply of `GET /v1/service` of the agent of
+ * Cilium 1.20, as `ip:port`, sorted. The model is `ServiceSpec` of `api/v1/openapi.yaml`. The
+ * frontend is the ClusterIP and the port of the rule, with the scope `external` or no scope.
+ *
+ * The backends are those in the state `active`, or with no state. If no backend is active, the
+ * backends are those in the state `terminating`. The BPF reconciler gives the slots of a service
+ * in this sequence (`pkg/loadbalancer/reconciler/bpf_reconciler.go`). Thus a new connection goes
+ * only to them. kube-proxy does the same with the endpoints that serve and stop. The other
+ * states take no new connection: `terminating-not-serving`, `quarantined` and `maintenance`.
+ */
+export declare const ciliumBackendsOf: (text: string, rule: Pick<ServiceRule, "ip" | "port">) => string[];
+/**
+ * This function tells if a dump of the rules names the Service of a rule. The rules of kube-proxy
+ * name it as `namespace/name`. The JSON of Cilium names it in the flags of its frontend.
+ */
+export declare const namesService: (mode: ServiceRule["mode"], text: string, rule: Pick<ServiceRule, "ns" | "svc">) => boolean;
 //#endregion
 //#region src/cluster.d.ts
 /** The credentials of the API, as a container on the network of the cluster reaches it. */
@@ -57,6 +75,71 @@ interface Cluster {
  */
 export declare const createCluster: (scenario: KindScenario, dir: string) => Promise<Cluster>;
 //#endregion
+//#region src/cilium.d.ts
+/**
+ * This module installs Cilium 1.20.4 in a kind cluster with Helm, from images pinned by digest.
+ * Cilium is the CNI and replaces kube-proxy (the dataplane `cilium`). Each value of the install
+ * that is not a default of the chart is in `ciliumValues`, with its reason.
+ */
+/** This version is the release of Cilium of the lab, from 2026-10-23: the version of the chart and the tag of each image. */
+export declare const CILIUM_VERSION = "1.20.4";
+/** This chart is the Helm chart of Cilium 1.20.4. The sha256 is of the file on `helm.cilium.io` (read on 2026-10-27). */
+export declare const CILIUM_CHART: {
+  readonly url: string;
+  readonly sha256: string;
+};
+/**
+ * These are the images that the install needs, pinned by the digests that the chart of 1.20.4 names
+ * (`values.yaml`). The agent, the operator and Envoy are the only images: the install has no
+ * node init, no preflight and no Hubble relay. The lab pulls each one by its digest, tags it
+ * (`localPin`), and loads it into each node. Thus no node pulls from a registry.
+ */
+export declare const CILIUM_IMAGES: {
+  readonly agent: string;
+  readonly operator: string;
+  readonly envoy: string;
+};
+/** These are the local tags of the images of Cilium, after the pull by digest. */
+interface CiliumImages {
+  readonly agent: string;
+  readonly operator: string;
+  readonly envoy: string;
+}
+/**
+ * This function gives the Helm values of the install in a cluster. The values that are not the
+ * defaults of the chart:
+ * - `kubeProxyReplacement: true`, and the address of the API server on the control plane. With no
+ *   kube-proxy, the agent cannot reach the API through its Service
+ *   (`Documentation/network/kubernetes/kubeproxy-free.rst`).
+ * - `ipam.mode: kubernetes`: the agent takes the pod CIDR of each node from the node, as the kind
+ *   guide tells (`Documentation/installation/kind.rst`). Thus the pod subnet of the scenario holds.
+ * - Each image is an `override`: the helper `cilium.image` of the chart then uses it as it is
+ *   (`templates/_helpers.tpl`). `pullPolicy: Never`: each image is on each node.
+ * - The operator has one replica, not two. Its anti-affinity puts each replica on a different node,
+ *   and no cell examines a failover of the operator.
+ *
+ * Socket LB stays at its default. KPR sets it on (`pkg/kpr/kpr.go`). It selects a backend at
+ * `connect()`. A connection keeps its backend, as with the conntrack NAT of kube-proxy. On the
+ * deletion of a backend, the agent destroys only its UDP sockets, because
+ * `LBSockTerminateAllProtos` is off by default (`pkg/loadbalancer/reconciler/termination.go`).
+ */
+export declare const ciliumValues: (clusterName: string, images: CiliumImages) => Record<string, unknown>;
+/** These are the workloads in kube-system that the install waits for, then the DNS that waits for the CNI. */
+export declare const CILIUM_WORKLOADS: readonly string[];
+/** This function gives the path of the chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
+export declare const ensureChart: (cache?: string) => Promise<string>;
+/**
+ * This function installs Cilium in a cluster with no CNI and no kube-proxy. Helm keeps its own
+ * files in the folder of the cluster. The function waits for each workload, for each node to be
+ * ready, and for CoreDNS. If the install fails, the error has the pods of kube-system and the last
+ * lines of the log of the agent.
+ */
+export declare const installCilium: (cluster: Cluster, images: CiliumImages) => Promise<void>;
+/** This is the setting of Cilium that a cluster manifest records: the version and the keys of `cilium-config` that the cells depend on. */
+export declare const CILIUM_CONFIG_KEYS: readonly string[];
+/** This function gives the mode of a cluster manifest of the dataplane `cilium`, from the data of the configmap `cilium-config`. */
+export declare const ciliumMode: (data: Readonly<Record<string, string>>) => string;
+//#endregion
 //#region src/compose.d.ts
 /** These are the parts of a running service. A composition for `lint()` gives none of them. */
 interface Parts {
@@ -72,6 +155,17 @@ export declare const ROUTE = "GET /work";
 export declare const FLAG_CHECK = "self.flag";
 /** This name is the watchdog of the event loop. */
 export declare const WATCHDOG = "self.event-loop";
+/**
+ * This function gives the health server of the shared gate (S6, candidate E). Its readiness probe
+ * leaves out each check of `dependency`, a dependency that each replica shares. The controller still
+ * reads each check, thus the service still refuses each request at once with a 503. The other
+ * probes, and the readiness of a controller, answer as before.
+ *
+ * The probe passes when the service is started and not in the drain, and liveness does not fail
+ * readiness through a coupling. Each readiness check of another dependency, or of no dependency,
+ * must also be released.
+ */
+export declare const sharedGate: (server: HealthServer, dependency: string, couplings: readonly Coupling[]) => HealthServer;
 /**
  * This function composes the service of a declaration: its policies, its couplings, its checks,
  * one server, one controller and each stage of the shutdown. A declaration with Redis needs the
@@ -843,7 +937,7 @@ export declare const shardOf: <T extends KindCell>(cells: readonly T[], index: n
  * The cache keeps the file, and each use takes the entry from it again.
  */
 interface Tool {
-  readonly name: "kind" | "kubectl" | "istioctl";
+  readonly name: "kind" | "kubectl" | "istioctl" | "helm";
   readonly version: string;
   /** These are the release assets, by the platform and the architecture of Node: `win32-x64`, `linux-x64`. */
   readonly assets: Readonly<Record<string, {
@@ -863,6 +957,12 @@ export declare const KUBECTL: Tool;
  * release has a zip file for Windows, and the lab reads only a gzipped tar file. Thus Windows has no asset.
  */
 export declare const ISTIOCTL: Tool;
+/**
+ * This release of Helm is v3.22.1, from 2026-10-15. The lab installs Cilium from its chart with it.
+ * The guide of Cilium 1.20.4 installs with Helm 3. The sums are from the `.sha256sum` files of
+ * `get.helm.sh`. The tar file for Windows has `helm.exe`, not `helm`, thus Windows has no asset.
+ */
+export declare const HELM: Tool;
 /**
  * This function gives the bytes of one file of a gzipped tar file. A header of the ustar format has
  * 512 bytes. It has the name at 0, the size in octal at 124, the type at 156 and the prefix of the
@@ -886,5 +986,5 @@ export declare const toolPath: (tool: Tool, key?: string, cache?: string) => str
  */
 export declare const ensureTool: (tool: Tool, key?: string, cache?: string) => Promise<string>;
 //#endregion
-export { type Band, type BandV1, CLIENT, type Cluster, type ClusterHosts, type ClusterManifest, type Credentials, type Cycle, DRAIN_RULES, type Declaration, type Deleted, type DeletionWindow, type EdgeProtocol, type EdsSpec, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, type LdsSpec, type LeafCertificate, type LearnWindow, Line, type ListenerCounts, type LoadSample, type Mesh, type MeshFlavor, type MeshImages, type MeshMode, NODE_IMAGES, type NodeImage, type NodeLifecycle, type NonePrediction, O04, O09, O10, O16, PORT, type Parts, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, type Propagation, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type ServiceRule, SliceLine, SocketLine, type Stack, type Stamp, type Step, TCP_STATE, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, TunnelLine, type Verdicts, type WindowPrediction, type Workload, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZtunnelPodLine, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, cyclesOf, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, isTunnelState, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, zoneOf, ztunnelPodsOf, ztunnelReplaced };
+export { type Band, type BandV1, CLIENT, type CiliumImages, type Cluster, type ClusterHosts, type ClusterManifest, type Credentials, type Cycle, DATAPLANES, DRAIN_RULES, type Dataplane, type Declaration, type Deleted, type DeletionWindow, type EdgeProtocol, type EdsSpec, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, type LdsSpec, type LeafCertificate, type LearnWindow, Line, type ListenerCounts, type LoadSample, type Mesh, type MeshFlavor, type MeshImages, type MeshMode, NODE_IMAGES, type NodeImage, type NodeLifecycle, type NonePrediction, O04, O09, O10, O16, PORT, type Parts, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, type Propagation, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type ServiceRule, SliceLine, SocketLine, type Stack, type Stamp, type Step, TCP_STATE, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, TunnelLine, type Verdicts, type WindowPrediction, type Workload, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZtunnelPodLine, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, cyclesOf, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, isKubeProxyMode, isTunnelState, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, zoneOf, ztunnelPodsOf, ztunnelReplaced };
 //# sourceMappingURL=index.d.ts.map