@mark1russell7/kind 0.11.12 → 0.12.1

package/build/{judge-BKe6dJ3O.d.ts → judge-Cnn42gih.d.ts}

@@ -4,9 +4,17 @@ import { Coupling, Gate, Poll, Stage, Timing } from "@mark1russell7/service";
 import { RedisKnobs } from "@mark1russell7/service/redis";
 import { SessionCheckKnobs } from "@mark1russell7/service/http-client";
 //#region src/scenario.d.ts
-/** A kube-proxy mode is the dataplane of each node: iptables (the default of kind), IPVS or nftables. */
+/** A kube-proxy mode is the mode of kube-proxy on each node: iptables (the default of kind), IPVS or nftables. */
 type KubeProxyMode = "iptables" | "ipvs" | "nftables";
 declare const KUBE_PROXY_MODES: readonly KubeProxyMode[];
+/**
+ * A dataplane is the path of a Service on each node, and the mode of a cell. It is kube-proxy in one
+ * of its modes, or `cilium`: Cilium is the CNI and replaces kube-proxy (`cilium.ts`).
+ */
+type Dataplane = KubeProxyMode | "cilium";
+declare const DATAPLANES: readonly Dataplane[];
+/** This function tells if a dataplane is a mode of kube-proxy. */
+declare const isKubeProxyMode: (mode: Dataplane) => mode is KubeProxyMode;
 /** A node image is the kind node image of one Kubernetes version, pinned by digest. */
 interface NodeImage {
   readonly kubernetes: string;
@@ -20,8 +28,8 @@ interface NodeImage {
 declare const NODE_IMAGES: Readonly<Record<string, NodeImage>>;
 /**
  * A scenario is one kind cluster as data. The lab generates the configuration of kind from it, and
- * nothing comes from a default of kind. The scenario gives the node count, the version, the mode
- * of kube-proxy and its sync periods, the CNI and the subnets.
+ * nothing comes from a default of kind. The scenario gives the node count, the version, the
+ * dataplane, the sync periods of kube-proxy, the CNI and the subnets.
  */
 interface KindScenario {
   /** This name names the cluster and its Docker network: lowercase letters, digits and dashes. */
@@ -30,15 +38,18 @@ interface KindScenario {
   readonly kubernetes: string;
   /** This count is the number of workers. The cluster also has one control plane. */
   readonly workers: number;
+  /** This dataplane is the path of a Service on each node. */
+  readonly dataplane: Dataplane;
+  /** This is kube-proxy and its sync periods, or null when Cilium replaces kube-proxy. */
   readonly kubeProxy: {
     readonly mode: KubeProxyMode;
     /** This time is the shortest interval between two syncs of the rules. */
     readonly minSyncPeriod: Quantity;
     /** This time is the interval of the full sync of the rules. */
     readonly syncPeriod: Quantity;
-  };
-  /** This CNI is kindnet, the CNI of kind. Cilium comes later. */
-  readonly cni: "kindnet";
+  } | null;
+  /** This CNI is kindnet, the CNI of kind, beside kube-proxy. The CNI of the dataplane `cilium` is Cilium. */
+  readonly cni: "kindnet" | "cilium";
   readonly podSubnet: string;
   readonly serviceSubnet: string;
   /**
@@ -55,15 +66,21 @@ declare const ZONE_KEPT = "zone-a";
 declare const ZONE_LOST = "zone-b";
 /** This function gives the zone of the node at the position `at` of `nodeNames`, in a cluster of `count` nodes. */
 declare const zoneOf: (at: number, count: number) => string;
-/** This function gives a scenario with the defaults of Kubernetes for kube-proxy, as explicit values. */
-declare const scenario: (name: string, mode: KubeProxyMode, workers: number, kubernetes?: string, zoned?: boolean) => KindScenario;
-/** This function gives the problems of a scenario: a name that kind refuses, no image for the version, or a count out of range. */
+/**
+ * This function gives a scenario with the defaults of Kubernetes for kube-proxy, as explicit values.
+ * The dataplane `cilium` has no kube-proxy, and its CNI is Cilium.
+ */
+declare const scenario: (name: string, mode: Dataplane, workers: number, kubernetes?: string, zoned?: boolean) => KindScenario;
+/**
+ * This function gives the problems of a scenario. A problem is a name that kind refuses, no image for
+ * the version, or a count out of range. A kube-proxy or a CNI that does not agree with the dataplane is a problem too.
+ */
 declare const scenarioProblems: (s: KindScenario) => string[];
 /** This function gives the names of the node containers, as kind names them: the control plane, then each worker. */
 declare const nodeNames: (s: KindScenario) => string[];
 /** This function gives a duration as kube-proxy reads it, in whole milliseconds: `1s`, `500ms`. */
 declare const goDuration: (amount: Quantity) => string;
-/** This function gives the KubeProxyConfiguration patch of a scenario, as kubeadm reads it. */
+/** This function gives the KubeProxyConfiguration patch of a scenario, as kubeadm reads it. It refuses a scenario with no kube-proxy. */
 declare const kubeProxyPatch: (s: KindScenario) => string;
 /** A kind configuration is the cluster file that `kind create cluster --config` reads. JSON is YAML, thus the lab writes it as JSON. */
 interface KindConfig {
@@ -71,7 +88,8 @@ interface KindConfig {
   readonly apiVersion: "kind.x-k8s.io/v1alpha4";
   readonly networking: {
     readonly ipFamily: "ipv4";
-    readonly kubeProxyMode: KubeProxyMode;
+    /** This mode is the mode of kube-proxy, or `none` for no kube-proxy. */
+    readonly kubeProxyMode: KubeProxyMode | "none";
     readonly disableDefaultCNI: boolean;
     readonly podSubnet: string;
     readonly serviceSubnet: string;
@@ -83,7 +101,12 @@ interface KindConfig {
   }>;
   readonly kubeadmConfigPatches: readonly string[];
 }
-/** This function generates the configuration of kind from a scenario. It refuses a scenario with a problem. */
+/**
+ * This function generates the configuration of kind from a scenario. It refuses a scenario with a
+ * problem. The dataplane `cilium` gets no kindnet, as the kind guide of Cilium 1.20.4 tells
+ * (`Documentation/installation/kind-configure.rst`). It also gets no kube-proxy, because Cilium
+ * replaces it (`Documentation/network/kubernetes/kubeproxy-free.rst`).
+ */
 declare const kindConfig: (s: KindScenario) => KindConfig;
 /** This function gives the first and the last address of an IPv4 CIDR, as numbers. */
 declare const cidrRange: (cidr: string) => [number, number];
@@ -337,6 +360,12 @@ interface Workload {
    * then closes the session, and the next stream opens a new one. Without them, a session has no check.
    */
   readonly sessionCheck?: SessionCheckKnobs | undefined;
+  /**
+   * This count is the sessions of all clients that the lab places on the target before each run
+   * (`placementOf`). The other sessions go to the other replicas. Each client opens each session again
+   * until its first answer comes from its backend. With no value, the rules pick the backend of each session.
+   */
+  readonly onTarget?: number | undefined;
 }
 /**
  * A band is a range of times after a reference event of the run. The format `/1` gives each end
@@ -553,7 +582,8 @@ interface KindCell<A = Quantity> {
   readonly mesh?: Mesh | undefined;
   /** This text names a system of the plan that the cell replaces with the service of this repository, or null. */
   readonly substitutes: string | null;
-  readonly mode: KubeProxyMode;
+  /** This mode is the dataplane of the cluster of the cell: a mode of kube-proxy, or Cilium. */
+  readonly mode: Dataplane;
   readonly workers: number;
   readonly trigger: Trigger<A>;
   readonly pod: PodSettings;
@@ -747,6 +777,20 @@ declare const outcomesOf: (requests: readonly Request[]) => Record<string, numbe
 declare const byClients: <T extends {
   readonly pod: string;
 }>(replicas: readonly T[], answers: ReadonlyMap<string, string>) => T[];
+/** These are the sessions of the clients at an instant: those on the target, of all, and those on the target by client. */
+interface Sessions {
+  readonly onTarget: number;
+  readonly of: number;
+  readonly byClient: Readonly<Record<string, number>>;
+}
+/**
+ * This function gives the sessions of the clients at an instant (`at`), and how many of them are on
+ * the target pod. A client sends each request on its next session in turn. Thus its last `connections`
+ * requests that started before the instant name its sessions, each by its local port. The backend of
+ * a session is the body of the last answer on its port before the instant: the name of the pod. A
+ * session with no such answer is not on the target. A request with no port names no session.
+ */
+declare const sessionsAt: (lines: readonly Line[], at: number, target: string, connections: number) => Sessions;
 /** This function gives the requests of each node, by the name of the node. */
 declare const byNode: (requests: readonly Request[]) => Map<string, Request[]>;
 /** This function gives the time that the watcher first received a deletion timestamp of one of the pods, after a time. */
@@ -882,6 +926,19 @@ interface RunFacts<A = Quantity> {
     readonly empty: A | null;
     readonly ready: A | null;
   }> | undefined;
+  /**
+   * These are the sessions of the clients at the fault (`sessionsAt`): those on the target, of all,
+   * and those on the target by client. A run of a workload with kept connections and a target has them.
+   */
+  readonly sessions?: Sessions | undefined;
+  /**
+   * This is the stall of the target (`app-stall`): its start after the fault, and how long its loop
+   * stayed blocked. The app writes a line at each end of the stall. A run with no such line gives null.
+   */
+  readonly stall?: {
+    readonly start: A | null;
+    readonly held: A | null;
+  } | undefined;
 }
 /** A deleted replica is a replica of a run that got a deletion. It gives its pod, and the stamps of its intake (or null) and of its deletion. */
 interface Deleted {
@@ -1156,5 +1213,5 @@ declare const quantileOf: (sorted: readonly number[], p: number) => number;
  */
 declare const medianInterval: (sorted: readonly number[]) => [number, number];
 //#endregion
-export { unitOf as $, secondsOf as $t, TriggerV1 as A, NodeImage as An, restartsAt as At, RunCheck as B, scenario as Bn, stoppingOf as Bt, KindCellResult as C, WindowPrediction as Cn, kernelCounts as Ct, PredictionV1 as D, KindScenario as Dn, recordsOf as Dt, LoadSample as E, KindConfig as En, podsOf as Et, KIND_NOISE as F, cidrRange as Fn, sliceEmptyOf as Ft, factsOf as G, CLIENT as Gt, checkRun as H, zoneOf as Hn, tunnelsOf as Ht, KindDecision as I, goDuration as In, sliceReadyAt as It, observationEnd as J, PORT as Jt, judgeKind as K, HEALTH_PORT as Kt, KindVerdict as L, kindConfig as Ln, sliceReadyOf as Lt, upgrade as M, ZONE_LABEL as Mn, signalOf as Mt, upgradeCell as N, ZONE_LOST as Nn, signalsOf as Nt, RunCheckV1 as O, KubeProxyMode as On, requestsOf as Ot, Deleted as P, cidrOverlap as Pn, sliceDropOf as Pt, reusesReset as Q, seconds as Qt, LAST_SLACK as R, kubeProxyPatch as Rn, slicesOf as Rt, KindCellRecordV1 as S, TriggerKind as Sn, isTunnelState as St, KindVerdictV1 as T, KUBE_PROXY_MODES as Tn, podsAt as Tt, cyclesOf as U, ztunnelPodsOf as Ut, RunFacts as V, scenarioProblems as Vn, transitionOf as Vt, deletionsOf as W, ztunnelReplaced as Wt, propagationSource as X, SERVER as Xt, propagationOf as Y, REDIS as Yt, referenceOf as Z, bandOf as Zt, ClusterManifest as _, Replica as _n, deletionOf as _t, STAGES as a, Flap as an, PropagationSource as at, FORMAT_V1 as b, Template as bn, failuresOf as bt, readRecord as c, KubeletProbe as cn, RulesLine as ct, calibrationOf as d, MeshMode as dn, TCP_STATE as dt, showBand as en, updatesOf as et, cellsTable as f, NonePrediction as fn, TunnelLine as ft, BandV1 as g, Reference as gn, byNode as gt, timeSpread as h, RedisDeclaration as hn, byClients as ht, quantileOf as i, EdgeProtocol as in, PodLine as it, judge as j, ZONE_KEPT as jn, rulesOf as jt, RunFactsV1 as k, NODE_IMAGES as kn, restartOf as kt, Judged as l, Mesh as ln, SliceLine as lt, predictionText as m, Prediction as mn, backendsAt as mt, medianInterval as n, Cycle as nn, HBONE_PORT as nt, kindCellRecordSchema as o, KindCell as on, RecordLine as ot, medianText as p, PodSettings as pn, ZtunnelPodLine as pt, observationAfter as q, LOG_LABEL as qt, middle as r, Declaration as rn, Line as rt, kindCellRecordV1Schema as s, KindRun as sn, Request as st, RELATIVE as t, Band as tn, Endpoint as tt, TimeSpread as u, MeshFlavor as un, SocketLine as ut, EnvironmentManifest as v, ResetReuse as vn, dropOf as vt, KindCellV1 as w, Workload as wn, outcomesOf as wt, KindCellRecord as x, Trigger as xn, intakeOf as xt, FORMAT as y, Stack as yn, emptyOf as yt, Propagated as z, nodeNames as zn, socketsOf as zt };
-//# sourceMappingURL=judge-BKe6dJ3O.d.ts.map
+export { unitOf as $, bandOf as $t, TriggerV1 as A, KindConfig as An, restartOf as At, RunCheck as B, goDuration as Bn, slicesOf as Bt, KindCellResult as C, Trigger as Cn, isTunnelState as Ct, PredictionV1 as D, DATAPLANES as Dn, podsOf as Dt, LoadSample as E, Workload as En, podsAt as Et, KIND_NOISE as F, ZONE_KEPT as Fn, signalsOf as Ft, factsOf as G, scenario as Gn, ztunnelPodsOf as Gt, checkRun as H, kindConfig as Hn, stoppingOf as Ht, KindDecision as I, ZONE_LABEL as In, sliceDropOf as It, observationEnd as J, HEALTH_PORT as Jt, judgeKind as K, scenarioProblems as Kn, ztunnelReplaced as Kt, KindVerdict as L, ZONE_LOST as Ln, sliceEmptyOf as Lt, upgrade as M, KubeProxyMode as Mn, rulesOf as Mt, upgradeCell as N, NODE_IMAGES as Nn, sessionsAt as Nt, RunCheckV1 as O, Dataplane as On, recordsOf as Ot, Deleted as P, NodeImage as Pn, signalOf as Pt, reusesReset as Q, SERVER as Qt, LAST_SLACK as R, cidrOverlap as Rn, sliceReadyAt as Rt, KindCellRecordV1 as S, Template as Sn, intakeOf as St, KindVerdictV1 as T, WindowPrediction as Tn, outcomesOf as Tt, cyclesOf as U, kubeProxyPatch as Un, transitionOf as Ut, RunFacts as V, isKubeProxyMode as Vn, socketsOf as Vt, deletionsOf as W, nodeNames as Wn, tunnelsOf as Wt, propagationSource as X, PORT as Xt, propagationOf as Y, LOG_LABEL as Yt, referenceOf as Z, REDIS as Zt, ClusterManifest as _, RedisDeclaration as _n, byNode as _t, STAGES as a, Declaration as an, PropagationSource as at, FORMAT_V1 as b, ResetReuse as bn, emptyOf as bt, readRecord as c, KindCell as cn, RulesLine as ct, calibrationOf as d, Mesh as dn, SocketLine as dt, seconds as en, updatesOf as et, cellsTable as f, MeshFlavor as fn, TCP_STATE as ft, BandV1 as g, Prediction as gn, byClients as gt, timeSpread as h, PodSettings as hn, backendsAt as ht, quantileOf as i, Cycle as in, PodLine as it, judge as j, KindScenario as jn, restartsAt as jt, RunFactsV1 as k, KUBE_PROXY_MODES as kn, requestsOf as kt, Judged as l, KindRun as ln, Sessions as lt, predictionText as m, NonePrediction as mn, ZtunnelPodLine as mt, medianInterval as n, showBand as nn, HBONE_PORT as nt, kindCellRecordSchema as o, EdgeProtocol as on, RecordLine as ot, medianText as p, MeshMode as pn, TunnelLine as pt, observationAfter as q, zoneOf as qn, CLIENT as qt, middle as r, Band as rn, Line as rt, kindCellRecordV1Schema as s, Flap as sn, Request as st, RELATIVE as t, secondsOf as tn, Endpoint as tt, TimeSpread as u, KubeletProbe as un, SliceLine as ut, EnvironmentManifest as v, Reference as vn, deletionOf as vt, KindCellV1 as w, TriggerKind as wn, kernelCounts as wt, KindCellRecord as x, Stack as xn, failuresOf as xt, FORMAT as y, Replica as yn, dropOf as yt, Propagated as z, cidrRange as zn, sliceReadyOf as zt };
+//# sourceMappingURL=judge-Cnn42gih.d.ts.map

package/build/judge.d.ts

@@ -1,2 +1,2 @@
-import { $ as unitOf, $t as secondsOf, A as TriggerV1, At as restartsAt, B as RunCheck, Bt as stoppingOf, C as KindCellResult, Cn as WindowPrediction, Ct as kernelCounts, D as PredictionV1, Dt as recordsOf, E as LoadSample, Et as podsOf, F as KIND_NOISE, Ft as sliceEmptyOf, G as factsOf, Gt as CLIENT, H as checkRun, Ht as tunnelsOf, I as KindDecision, It as sliceReadyAt, J as observationEnd, Jt as PORT, K as judgeKind, Kt as HEALTH_PORT, L as KindVerdict, Lt as sliceReadyOf, M as upgrade, Mt as signalOf, N as upgradeCell, Nt as signalsOf, O as RunCheckV1, On as KubeProxyMode, Ot as requestsOf, P as Deleted, Pt as sliceDropOf, Q as reusesReset, Qt as seconds, R as LAST_SLACK, Rt as slicesOf, S as KindCellRecordV1, Sn as TriggerKind, St as isTunnelState, T as KindVerdictV1, Tt as podsAt, U as cyclesOf, Ut as ztunnelPodsOf, V as RunFacts, Vt as transitionOf, W as deletionsOf, Wt as ztunnelReplaced, X as propagationSource, Xt as SERVER, Y as propagationOf, Yt as REDIS, Z as referenceOf, Zt as bandOf, _ as ClusterManifest, _n as Replica, _t as deletionOf, a as STAGES, an as Flap, at as PropagationSource, b as FORMAT_V1, bn as Template, bt as failuresOf, c as readRecord, cn as KubeletProbe, ct as RulesLine, d as calibrationOf, dn as MeshMode, dt as TCP_STATE, en as showBand, et as updatesOf, f as cellsTable, fn as NonePrediction, ft as TunnelLine, g as BandV1, gn as Reference, gt as byNode, h as timeSpread, hn as RedisDeclaration, ht as byClients, i as quantileOf, in as EdgeProtocol, it as PodLine, j as judge, jt as rulesOf, k as RunFactsV1, kt as restartOf, l as Judged, ln as Mesh, lt as SliceLine, m as predictionText, mn as Prediction, mt as backendsAt, n as medianInterval, nn as Cycle, nt as HBONE_PORT, o as kindCellRecordSchema, on as KindCell, ot as RecordLine, p as medianText, pn as PodSettings, pt as ZtunnelPodLine, q as observationAfter, qt as LOG_LABEL, r as middle, rn as Declaration, rt as Line, s as kindCellRecordV1Schema, sn as KindRun, st as Request, t as RELATIVE, tn as Band, tt as Endpoint, u as TimeSpread, un as MeshFlavor, ut as SocketLine, v as EnvironmentManifest, vn as ResetReuse, vt as dropOf, w as KindCellV1, wn as Workload, wt as outcomesOf, x as KindCellRecord, xn as Trigger, xt as intakeOf, y as FORMAT, yn as Stack, yt as emptyOf, z as Propagated, zt as socketsOf } from "./judge-BKe6dJ3O.js";
-export { type Band, type BandV1, CLIENT, type ClusterManifest, type Cycle, type Declaration, type Deleted, type EdgeProtocol, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindDecision, type KindRun, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, Line, type LoadSample, type Mesh, type MeshFlavor, type MeshMode, type NonePrediction, PORT, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, SERVER, STAGES, SliceLine, SocketLine, type Stack, TCP_STATE, type Template, type TimeSpread, type Trigger, type TriggerKind, type TriggerV1, TunnelLine, type WindowPrediction, type Workload, ZtunnelPodLine, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cyclesOf, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, intakeOf, isTunnelState, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, medianInterval, medianText, middle, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, ztunnelPodsOf, ztunnelReplaced };
+import { $ as unitOf, $t as bandOf, A as TriggerV1, At as restartOf, B as RunCheck, Bt as slicesOf, C as KindCellResult, Cn as Trigger, Ct as isTunnelState, D as PredictionV1, Dt as podsOf, E as LoadSample, En as Workload, Et as podsAt, F as KIND_NOISE, Ft as signalsOf, G as factsOf, Gt as ztunnelPodsOf, H as checkRun, Ht as stoppingOf, I as KindDecision, It as sliceDropOf, J as observationEnd, Jt as HEALTH_PORT, K as judgeKind, Kt as ztunnelReplaced, L as KindVerdict, Lt as sliceEmptyOf, M as upgrade, Mn as KubeProxyMode, Mt as rulesOf, N as upgradeCell, Nt as sessionsAt, O as RunCheckV1, On as Dataplane, Ot as recordsOf, P as Deleted, Pt as signalOf, Q as reusesReset, Qt as SERVER, R as LAST_SLACK, Rt as sliceReadyAt, S as KindCellRecordV1, Sn as Template, St as intakeOf, T as KindVerdictV1, Tn as WindowPrediction, Tt as outcomesOf, U as cyclesOf, Ut as transitionOf, V as RunFacts, Vt as socketsOf, W as deletionsOf, Wt as tunnelsOf, X as propagationSource, Xt as PORT, Y as propagationOf, Yt as LOG_LABEL, Z as referenceOf, Zt as REDIS, _ as ClusterManifest, _n as RedisDeclaration, _t as byNode, a as STAGES, an as Declaration, at as PropagationSource, b as FORMAT_V1, bn as ResetReuse, bt as emptyOf, c as readRecord, cn as KindCell, ct as RulesLine, d as calibrationOf, dn as Mesh, dt as SocketLine, en as seconds, et as updatesOf, f as cellsTable, fn as MeshFlavor, ft as TCP_STATE, g as BandV1, gn as Prediction, gt as byClients, h as timeSpread, hn as PodSettings, ht as backendsAt, i as quantileOf, in as Cycle, it as PodLine, j as judge, jt as restartsAt, k as RunFactsV1, kt as requestsOf, l as Judged, ln as KindRun, lt as Sessions, m as predictionText, mn as NonePrediction, mt as ZtunnelPodLine, n as medianInterval, nn as showBand, nt as HBONE_PORT, o as kindCellRecordSchema, on as EdgeProtocol, ot as RecordLine, p as medianText, pn as MeshMode, pt as TunnelLine, q as observationAfter, qt as CLIENT, r as middle, rn as Band, rt as Line, s as kindCellRecordV1Schema, sn as Flap, st as Request, t as RELATIVE, tn as secondsOf, tt as Endpoint, u as TimeSpread, un as KubeletProbe, ut as SliceLine, v as EnvironmentManifest, vn as Reference, vt as deletionOf, w as KindCellV1, wn as TriggerKind, wt as kernelCounts, x as KindCellRecord, xn as Stack, xt as failuresOf, y as FORMAT, yn as Replica, yt as dropOf, z as Propagated, zt as sliceReadyOf } from "./judge-Cnn42gih.js";
+export { type Band, type BandV1, CLIENT, type ClusterManifest, type Cycle, type Dataplane, type Declaration, type Deleted, type EdgeProtocol, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindDecision, type KindRun, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, Line, type LoadSample, type Mesh, type MeshFlavor, type MeshMode, type NonePrediction, PORT, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, SERVER, STAGES, Sessions, SliceLine, SocketLine, type Stack, TCP_STATE, type Template, type TimeSpread, type Trigger, type TriggerKind, type TriggerV1, TunnelLine, type WindowPrediction, type Workload, ZtunnelPodLine, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cyclesOf, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, intakeOf, isTunnelState, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, medianInterval, medianText, middle, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, seconds, secondsOf, sessionsAt, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, ztunnelPodsOf, ztunnelReplaced };

package/build/judge.js

@@ -1 +1 @@
-export { pt as CLIENT, u as FORMAT, d as FORMAT_V1, P as HBONE_PORT, mt as HEALTH_PORT, h as KIND_NOISE, g as LAST_SLACK, ht as LOG_LABEL, gt as PORT, _t as REDIS, A as RELATIVE, vt as SERVER, t as STAGES, F as TCP_STATE, I as backendsAt, yt as bandOf, L as byClients, R as byNode, a as calibrationOf, o as cellsTable, _ as checkRun, v as cyclesOf, z as deletionOf, y as deletionsOf, B as dropOf, V as emptyOf, b as factsOf, H as failuresOf, U as intakeOf, W as isTunnelState, f as judge, x as judgeKind, G as kernelCounts, n as kindCellRecordSchema, r as kindCellRecordV1Schema, j as medianInterval, s as medianText, M as middle, S as observationAfter, C as observationEnd, K as outcomesOf, q as podsAt, J as podsOf, c as predictionText, w as propagationOf, T as propagationSource, N as quantileOf, i as readRecord, Y as recordsOf, E as referenceOf, X as requestsOf, Z as restartOf, Q as restartsAt, D as reusesReset, $ as rulesOf, bt as seconds, xt as secondsOf, St as showBand, et as signalOf, tt as signalsOf, nt as sliceDropOf, rt as sliceEmptyOf, it as sliceReadyAt, at as sliceReadyOf, ot as slicesOf, st as socketsOf, ct as stoppingOf, l as timeSpread, lt as transitionOf, ut as tunnelsOf, O as unitOf, k as updatesOf, p as upgrade, m as upgradeCell, dt as ztunnelPodsOf, ft as ztunnelReplaced } from "./judge-n0rL_RR0.js";
+export { mt as CLIENT, u as FORMAT, d as FORMAT_V1, P as HBONE_PORT, ht as HEALTH_PORT, h as KIND_NOISE, g as LAST_SLACK, gt as LOG_LABEL, _t as PORT, vt as REDIS, A as RELATIVE, yt as SERVER, t as STAGES, F as TCP_STATE, I as backendsAt, bt as bandOf, L as byClients, R as byNode, a as calibrationOf, o as cellsTable, _ as checkRun, v as cyclesOf, z as deletionOf, y as deletionsOf, B as dropOf, V as emptyOf, b as factsOf, H as failuresOf, U as intakeOf, W as isTunnelState, f as judge, x as judgeKind, G as kernelCounts, n as kindCellRecordSchema, r as kindCellRecordV1Schema, j as medianInterval, s as medianText, M as middle, S as observationAfter, C as observationEnd, K as outcomesOf, q as podsAt, J as podsOf, c as predictionText, w as propagationOf, T as propagationSource, N as quantileOf, i as readRecord, Y as recordsOf, E as referenceOf, X as requestsOf, Z as restartOf, Q as restartsAt, D as reusesReset, $ as rulesOf, xt as seconds, St as secondsOf, et as sessionsAt, Ct as showBand, tt as signalOf, nt as signalsOf, rt as sliceDropOf, it as sliceEmptyOf, at as sliceReadyAt, ot as sliceReadyOf, st as slicesOf, ct as socketsOf, lt as stoppingOf, l as timeSpread, ut as transitionOf, dt as tunnelsOf, O as unitOf, k as updatesOf, p as upgrade, m as upgradeCell, ft as ztunnelPodsOf, pt as ztunnelReplaced } from "./judge-BdykXjF2.js";

package/image/Dockerfile

@@ -14,5 +14,5 @@ RUN for name in quantity algebra service; do \
       && tar -xzf /tmp/workspace/mark1russell7-$name-*.tgz -C "node_modules/@mark1russell7/$name" --strip-components=1; \
     done \
  && rm -rf /tmp/workspace
-COPY app.mjs client.mjs client-grpc.mjs agent.mjs watch.mjs compose.ts backends.ts conntrack.ts drops.ts eds.ts lds.ts client-lines.ts ./
+COPY app.mjs client.mjs client-grpc.mjs agent.mjs watch.mjs compose.ts backends.ts conntrack.ts drops.ts eds.ts lds.ts client-lines.ts place.ts ./
 CMD ["node", "app.mjs"]

package/image/agent.mjs

@@ -27,7 +27,7 @@
 // node and the freeze of its cgroup, or the thaw and the end of the drops), and now.
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { backendsOf } from "./backends.ts";
+import { backendsOf, namesService } from "./backends.ts";
 import { entriesOf, flowsOf, staleOf, stalledOf } from "./conntrack.ts";
 import { devOf, grownOf, snmpOf, softnetOf, unresolvedOf } from "./drops.ts";
 import { clusterFilter, hostsOf } from "./eds.ts";
@@ -38,11 +38,16 @@ const node = process.env.NODE_NAME ?? "";
 const say = (line) => process.stdout.write(`${JSON.stringify({ ...line, node })}\n`);
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
-/** These commands give the backends of a Service in each mode of kube-proxy, as "ip:port" (with the weight for IPVS). */
+/**
+ * These commands give the backends of a Service in each dataplane, as "ip:port" (with the weight for
+ * IPVS). The agent of Cilium answers on its socket in the node (a hostPath of its chart), with the
+ * services of its load balancer as JSON (`GET /v1/service`).
+ */
 const DUMP = {
   iptables: ["nsenter", "-t", "1", "-m", "-n", "--", "iptables-save", "-t", "nat"],
   nftables: ["nsenter", "-t", "1", "-m", "-n", "--", "nft", "list", "table", "ip", "kube-proxy"],
   ipvs: ["nsenter", "-t", "1", "-n", "--", "cat", "/proc/net/ip_vs"],
+  cilium: ["nsenter", "-t", "1", "-m", "-n", "--", "curl", "-sS", "--fail", "--max-time", "2", "--unix-socket", "/var/run/cilium/cilium.sock", "http://localhost/v1/service"],
 };
 
 /**
@@ -185,14 +190,23 @@ const serve = async () => {
     const took = now() - t;
     polls += 1;
     spent += took;
-    if (run.status !== 0) {
-      say({ ev: "rules-fail", t, why: (run.stderr ?? "").trim().slice(0, 300) });
+    // a reply that the parser refuses (JSON that is not a list) is a failure, not a Service with no backend
+    let backends = null;
+    let refused = "";
+    if (run.status === 0) {
+      try {
+        backends = backendsOf(rule.mode, run.stdout, rule);
+      } catch (error) {
+        refused = `the dump does not parse: ${String(error)}: ${run.stdout.slice(0, 200)}`;
+      }
+    }
+    if (backends === null) {
+      say({ ev: "rules-fail", t, why: (refused || (run.stderr ?? "")).trim().slice(0, 300) });
     } else {
-      const backends = backendsOf(rule.mode, run.stdout, rule);
       const key = backends.join(",");
       // a dump that names the Service but gives no backend: once for each rule, its text, to read the format
       const config = JSON.stringify(rule);
-      if (backends.length === 0 && run.stdout.includes(`${rule.ns}/${rule.svc}`) && dumped !== config) {
+      if (backends.length === 0 && namesService(rule.mode, run.stdout, rule) && dumped !== config) {
         say({ ev: "rules-dump", t, text: run.stdout.slice(0, 30000) });
         dumped = config;
       }

package/image/client.mjs

@@ -6,11 +6,15 @@
 // unreachable, or another error) and its local port (`lp`). With PROTOCOL h2c, each connection is a
 // session of HTTP/2, and each request is a stream on the next session in turn. With SESSION_CHECK,
 // each session has the session check of the service: a stream timeout or a PING with no ACK closes it.
-// Each second, one line counts the PINGs of the checks and their ACKs (`pings`).
+// Each second, one line counts the PINGs of the checks and their ACKs (`pings`). With a placement in
+// /tmp/lab-place (place.ts), SIGHUP opens each session of HTTP/2 again until its first answer comes
+// from the backend of its slot. A line `placed` gives the port and the backend of each slot.
+import { readFileSync } from "node:fs";
 import http from "node:http";
 import http2 from "node:http2";
 import net from "node:net";
 import { sessionCheck } from "@mark1russell7/service/http-client";
+import { placeSlot, placementFrom } from "./place.ts";
 
 const [host, port] = (process.env.TARGET ?? "").split(":");
 const every = Number(process.env.EVERY_MS ?? 20);
@@ -81,11 +85,64 @@ const slotAt = (at) => {
   return slots[at];
 };
 
+// the placement of the slots: the backend of each one, or null with no placement. The lab writes it
+// before the SIGHUP, and the requests of the client go on the old slots until each new slot has its backend
+const PLACE_FILE = process.env.LAB_PLACE ?? "/tmp/lab-place";
+const PLACE_TRIES = 64;
+const placement = () => {
+  try {
+    return placementFrom(readFileSync(PLACE_FILE, "utf8"), connections);
+  } catch {
+    return null;
+  }
+};
+
+// the first answer of a new session: the body of a stream of /work, the name of its pod, or null
+const probeOf = (held) =>
+  new Promise((resolve) => {
+    let body = "";
+    let done = false;
+    const end = (value) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve(value);
+    };
+    const timer = setTimeout(() => end(null), timeout);
+    let stream;
+    try {
+      stream = held.session.request({ ":path": "/work" });
+    } catch {
+      end(null);
+      return;
+    }
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+      body += chunk;
+    });
+    stream.on("end", () => end(body === "" ? null : body.slice(0, 64)));
+    stream.on("error", () => end(null));
+    stream.on("close", () => end(body === "" ? null : body.slice(0, 64)));
+    stream.end();
+  });
+
 // SIGHUP: new agents or sessions for the next requests. The old ones go after the timeout, thus each
 // request on them ends first
 process.on("SIGHUP", () => {
   const old = agents;
   const oldSlots = slots;
+  const wanted = h2 ? placement() : null;
+  if (wanted !== null) {
+    say({ ev: "client", what: "reconnect", t: now(), place: wanted });
+    Promise.all(wanted.map((pod) => placeSlot(sessionOf, probeOf, (held) => held.session.destroy(), pod, PLACE_TRIES))).then((placed) => {
+      slots = placed.map((each) => each.held);
+      say({ ev: "client", what: "placed", t: now(), slots: placed.map((each) => ({ lp: portOf(each.held.socket), b: each.b, tries: each.tries, ok: each.ok })) });
+      setTimeout(() => {
+        for (const held of oldSlots) held.session.destroy();
+      }, timeout + 100);
+    });
+    return;
+  }
   if (h2) slots = Array.from({ length: connections }, sessionOf);
   else agents = agentsOf();
   say({ ev: "client", what: "reconnect", t: now() });

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@mark1russell7/kind",
-  "version": "0.11.12",
+  "version": "0.12.1",
   "description": "Kubernetes in Docker as a lab for connection timers: a kind cluster from a scenario, faults in the namespaces of its pods, observations on the one monotonic clock of the VM, and predictions from the ordering law. Its judge entry reads and judges a raw record without Docker.",
   "keywords": [
     "kubernetes",
@@ -58,6 +58,7 @@
     "src/eds.ts",
     "src/lds.ts",
     "src/client-lines.ts",
+    "src/place.ts",
     "README.md",
     "LICENSE"
   ],

package/src/backends.ts

@@ -1,9 +1,9 @@
-// The parser of the rules of kube-proxy. The agent of each node reads the rules with it, and the
-// image copies this file, thus it imports nothing.
+// The parser of the rules of kube-proxy and of the services of Cilium. The agent of each node reads
+// the rules with it, and the image copies this file, thus it imports nothing.
 
-/** A service rule names the Service whose backends the agent reads: its namespace, its name, and its ClusterIP and port for IPVS. */
+/** A service rule names the Service whose backends the agent reads: its namespace, its name, and its ClusterIP and port for IPVS and Cilium. */
 export interface ServiceRule {
-  readonly mode: "iptables" | "ipvs" | "nftables";
+  readonly mode: "iptables" | "ipvs" | "nftables" | "cilium";
   readonly ns: string;
   readonly svc: string;
   readonly ip: string;
@@ -20,8 +20,10 @@ const hexIp = (hex: string): string =>
  * - iptables: the `KUBE-SVC` chain of the Service jumps to a `KUBE-SEP` chain for each backend, and that chain does the DNAT.
  * - nftables: the `service-` chain of the Service does the DNAT to each backend, or it names an `endpoint-` chain for each one.
  * - IPVS: `/proc/net/ip_vs` has the line of the virtual service, then a line for each real server.
+ * - Cilium: the JSON of the services of the agent (`ciliumBackendsOf`).
  */
 export const backendsOf = (mode: ServiceRule["mode"], text: string, rule: Pick<ServiceRule, "ns" | "svc" | "ip" | "port">): string[] => {
+  if (mode === "cilium") return ciliumBackendsOf(text, rule);
   const out = new Set<string>();
   const lines = text.split("\n");
   if (mode === "iptables") {
@@ -68,3 +70,56 @@ export const backendsOf = (mode: ServiceRule["mode"], text: string, rule: Pick<S
   }
   return [...out].sort();
 };
+
+/** This is one service of the agent of Cilium, as `GET /v1/service` gives it: the fields that the parser reads. */
+interface CiliumService {
+  readonly spec?: {
+    readonly "frontend-address"?: { readonly ip?: string; readonly port?: number; readonly protocol?: string; readonly scope?: string };
+    readonly "backend-addresses"?: ReadonlyArray<{ readonly ip?: string; readonly port?: number; readonly state?: string }> | null;
+    readonly flags?: { readonly type?: string; readonly name?: string; readonly namespace?: string };
+  };
+}
+
+/** This function gives the services in a reply of the agent of Cilium. It refuses a reply that is not a JSON list. */
+const ciliumServices = (text: string): CiliumService[] => {
+  const data: unknown = JSON.parse(text);
+  if (!Array.isArray(data)) throw new Error("the reply of the agent of Cilium is not a list of services");
+  return data as CiliumService[];
+};
+
+/**
+ * This function gives the backends of a Service in the reply of `GET /v1/service` of the agent of
+ * Cilium 1.20, as `ip:port`, sorted. The model is `ServiceSpec` of `api/v1/openapi.yaml`. The
+ * frontend is the ClusterIP and the port of the rule, with the scope `external` or no scope.
+ *
+ * The backends are those in the state `active`, or with no state. If no backend is active, the
+ * backends are those in the state `terminating`. The BPF reconciler gives the slots of a service
+ * in this sequence (`pkg/loadbalancer/reconciler/bpf_reconciler.go`). Thus a new connection goes
+ * only to them. kube-proxy does the same with the endpoints that serve and stop. The other
+ * states take no new connection: `terminating-not-serving`, `quarantined` and `maintenance`.
+ */
+export const ciliumBackendsOf = (text: string, rule: Pick<ServiceRule, "ip" | "port">): string[] => {
+  const ours = ciliumServices(text).filter((service) => {
+    const front = service.spec?.["frontend-address"];
+    const protocol = (front?.protocol ?? "tcp").toLowerCase();
+    return front?.ip === rule.ip && front.port === rule.port && (protocol === "tcp" || protocol === "any") && (front.scope ?? "external") === "external";
+  });
+  const backends = ours.flatMap((service) => service.spec?.["backend-addresses"] ?? []);
+  const of = (states: readonly (string | undefined)[]): string[] =>
+    [...new Set(backends.filter((b) => states.includes(b.state) && b.ip !== undefined).map((b) => `${b.ip}:${b.port ?? 0}`))].sort();
+  const active = of(["active", undefined]);
+  return active.length > 0 ? active : of(["terminating"]);
+};
+
+/**
+ * This function tells if a dump of the rules names the Service of a rule. The rules of kube-proxy
+ * name it as `namespace/name`. The JSON of Cilium names it in the flags of its frontend.
+ */
+export const namesService = (mode: ServiceRule["mode"], text: string, rule: Pick<ServiceRule, "ns" | "svc">): boolean => {
+  if (mode !== "cilium") return text.includes(`${rule.ns}/${rule.svc}`);
+  try {
+    return ciliumServices(text).some((service) => service.spec?.flags?.namespace === rule.ns && service.spec.flags.name === rule.svc);
+  } catch {
+    return false;
+  }
+};

package/src/place.ts

@@ -0,0 +1,43 @@
+// The placement of the sessions of the HTTP/2 client of the lab image. The lab writes the backend of
+// each slot of the client (`placementOf`), and the next SIGHUP opens each slot again until its first
+// answer comes from that backend. The client runs this module with Node, thus this module imports nothing.
+
+/** A placed slot is the session of a slot with the backend of its first answer (`b`). It also has its tries, and if that backend is the wanted one. */
+export interface Placed<H> {
+  readonly held: H;
+  readonly b: string | null;
+  readonly tries: number;
+  readonly ok: boolean;
+}
+
+/**
+ * This function opens a session for one slot until its first answer comes from the wanted backend,
+ * for `tries` sessions at the most. Each session of the wrong backend closes. The rules pick the backend of each new
+ * session, thus each try reaches the wanted backend at random or in turn. After the last try, the slot
+ * keeps its last session, and `ok` is false.
+ */
+export const placeSlot = async <H>(
+  open: () => H,
+  probe: (held: H) => Promise<string | null>,
+  close: (held: H) => void,
+  wanted: string,
+  tries: number,
+): Promise<Placed<H>> => {
+  if (!Number.isInteger(tries) || tries < 1) throw new RangeError(`a placement needs one try at the least, not ${tries}`);
+  for (let tried = 1; ; tried += 1) {
+    const held = open();
+    const b = await probe(held);
+    if (b === wanted || tried === tries) return { held, b, tries: tried, ok: b === wanted };
+    close(held);
+  }
+};
+
+/** This function reads a placement: a list of the names of the backends of the slots, one for each slot. Any other text gives null. */
+export const placementFrom = (text: string, slots: number): string[] | null => {
+  try {
+    const parsed: unknown = JSON.parse(text);
+    return Array.isArray(parsed) && parsed.length === slots && parsed.every((each) => typeof each === "string" && each !== "") ? (parsed as string[]) : null;
+  } catch {
+    return null;
+  }
+};