@mark1russell7/kind 0.13.1 → 0.13.3

package/build/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as unitOf, $n as scenario, $t as REDIS, A as TriggerV1, An as Template, At as recordsOf, B as RunCheck, Bn as KubeProxyMode, Bt as sliceReadyAt, C as KindCellResult, Cn as PodSettings, Ct as intakeOf, D as PredictionV1, Dn as Replica, Dt as periodOf, E as LoadSample, En as Reference, Et as outcomesOf, F as KIND_NOISE, Fn as DATAPLANES, Ft as sessionsAt, G as factsOf, Gn as ZONE_LOST, Gt as transitionOf, H as checkRun, Hn as NodeImage, Ht as slicesOf, I as KindDecision, In as Dataplane, It as signalOf, J as observationEnd, Jn as goDuration, Jt as ztunnelReplaced, K as judgeKind, Kn as cidrOverlap, Kt as tunnelsOf, L as KindVerdict, Ln as KUBE_PROXY_MODES, Lt as signalsOf, M as upgrade, Mn as TriggerKind, Mt as restartOf, N as upgradeCell, Nn as WindowPrediction, Nt as restartsAt, O as RunCheckV1, On as ResetReuse, Ot as podsAt, P as Deleted, Pn as Workload, Pt as rulesOf, Q as reusesReset, Qn as nodeNames, Qt as PORT, R as LAST_SLACK, Rn as KindConfig, Rt as sliceDropOf, S as KindCellRecordV1, Sn as NonePrediction, St as failuresOf, T as KindVerdictV1, Tn as RedisDeclaration, Tt as kernelCounts, U as cyclesOf, Un as ZONE_KEPT, Ut as socketsOf, V as RunFacts, Vn as NODE_IMAGES, Vt as sliceReadyOf, W as deletionsOf, Wn as ZONE_LABEL, Wt as stoppingOf, X as propagationSource, Xn as kindConfig, Xt as HEALTH_PORT, Y as propagationOf, Yn as isKubeProxyMode, Yt as CLIENT, Z as referenceOf, Zn as kubeProxyPatch, Zt as LOG_LABEL, _ as ClusterManifest, _n as KindRun, _t as byClients, a as STAGES, an as overshootBand, at as PodLine, b as FORMAT_V1, bn as MeshFlavor, bt as dropOf, c as readRecord, cn as secondsOf, ct as Request, d as calibrationOf, dn as Band, dt as SliceLine, en as SERVER, er as scenarioProblems, et as updatesOf, f as cellsTable, fn as Cycle, ft as SocketLine, g as BandV1, gn as KindCell, gt as backendsAt, h as timeSpread, hn as Flap, ht as ZtunnelPodLine, i as quantileOf, in as drainBand, it as Period, j as judge, jn as Trigger, jt as requestsOf, k as RunFactsV1, kn as Stack, kt as podsOf, l as Judged, ln as showBand, lt as RulesLine, m as predictionText, mn as EdgeProtocol, mt as TunnelLine, n as medianInterval, nn as backlogEnd, nt as HBONE_PORT, o as kindCellRecordSchema, on as requestBand, ot as PropagationSource, p as medianText, pn as Declaration, pt as TCP_STATE, q as observationAfter, qn as cidrRange, qt as ztunnelPodsOf, r as middle, rn as bandOf, rt as Line, s as kindCellRecordV1Schema, sn as seconds, st as RecordLine, t as RELATIVE, tn as CountBand, tr as zoneOf, tt as Endpoint, u as TimeSpread, un as BacklogTerm, ut as Sessions, v as EnvironmentManifest, vn as KubeletProbe, vt as byNode, w as KindCellV1, wn as Prediction, wt as isTunnelState, x as KindCellRecord, xn as MeshMode, xt as emptyOf, y as FORMAT, yn as Mesh, yt as deletionOf, z as Propagated, zn as KindScenario, zt as sliceEmptyOf } from "./judge-CSWVew2-.js";
+import { $ as unitOf, $n as cidrRange, $t as OUTSIDE, A as TriggerV1, An as Reference, At as recordsOf, B as RunCheck, Bn as Workload, Bt as sliceReadyAt, C as KindCellResult, Cn as MeshFlavor, Ct as intakeOf, D as PredictionV1, Dn as PodSettings, Dt as periodOf, E as LoadSample, En as PermittedWindow, Et as outcomesOf, F as KIND_NOISE, Fn as Trigger, Ft as sessionsAt, G as factsOf, Gn as KindScenario, Gt as transitionOf, H as checkRun, Hn as Dataplane, Ht as slicesOf, I as KindDecision, In as TriggerKind, It as signalOf, J as observationEnd, Jn as NodeImage, Jt as ztunnelReplaced, K as judgeKind, Kn as KubeProxyMode, Kt as tunnelsOf, L as KindVerdict, Ln as VipAnnouncerName, Lt as signalsOf, M as upgrade, Mn as ResetReuse, Mt as restartOf, N as upgradeCell, Nn as Stack, Nt as restartsAt, O as RunCheckV1, On as Prediction, Ot as podsAt, P as Deleted, Pn as Template, Pt as rulesOf, Q as reusesReset, Qn as cidrOverlap, Qt as LOG_LABEL, R as LAST_SLACK, Rn as VipSettings, Rt as sliceDropOf, S as KindCellRecordV1, Sn as Mesh, St as failuresOf, T as KindVerdictV1, Tn as NonePrediction, Tt as kernelCounts, U as cyclesOf, Un as KUBE_PROXY_MODES, Ut as socketsOf, V as RunFacts, Vn as DATAPLANES, Vt as sliceReadyOf, W as deletionsOf, Wn as KindConfig, Wt as stoppingOf, X as propagationSource, Xn as ZONE_LABEL, Xt as HEALTH_PORT, Y as propagationOf, Yn as ZONE_KEPT, Yt as CLIENT, Z as referenceOf, Zn as ZONE_LOST, Zt as LB_CLASS, _ as ClusterManifest, _n as EdgeProtocol, _t as byClients, a as STAGES, an as backlogEnd, ar as scenario, at as PodLine, b as FORMAT_V1, bn as KindRun, bt as dropOf, c as readRecord, cn as overshootBand, ct as Request, d as calibrationOf, dn as secondsOf, dt as SliceLine, en as PORT, er as goDuration, et as updatesOf, f as cellsTable, fn as showBand, ft as SocketLine, g as BandV1, gn as Declaration, gt as backendsAt, h as timeSpread, hn as Cycle, ht as ZtunnelPodLine, i as quantileOf, in as CountBand, ir as nodeNames, it as Period, j as judge, jn as Replica, jt as requestsOf, k as RunFactsV1, kn as RedisDeclaration, kt as podsOf, l as Judged, ln as requestBand, lt as RulesLine, m as predictionText, mn as Band, mt as TunnelLine, n as medianInterval, nn as SERVER, nr as kindConfig, nt as HBONE_PORT, o as kindCellRecordSchema, on as bandOf, or as scenarioProblems, ot as PropagationSource, p as medianText, pn as BacklogTerm, pt as TCP_STATE, q as observationAfter, qn as NODE_IMAGES, qt as ztunnelPodsOf, r as middle, rn as VIP_ANNOTATION, rr as kubeProxyPatch, rt as Line, s as kindCellRecordV1Schema, sn as drainBand, sr as zoneOf, st as RecordLine, t as RELATIVE, tn as REDIS, tr as isKubeProxyMode, tt as Endpoint, u as TimeSpread, un as seconds, ut as Sessions, v as EnvironmentManifest, vn as Flap, vt as byNode, w as KindCellV1, wn as MeshMode, wt as isTunnelState, x as KindCellRecord, xn as KubeletProbe, xt as emptyOf, y as FORMAT, yn as KindCell, yt as deletionOf, z as Propagated, zn as WindowPrediction, zt as sliceEmptyOf } from "./judge-DhLShDUj.js";
 import { Quantity } from "@mark1russell7/quantity";
 import { CheckFn, Coupling, Finding, HealthServer, Poll, Scenario, ServiceBuilder, ServiceDescription, Stage, StopWay, Timing, TransportImpl, Verdict } from "@mark1russell7/service";
 import { BuildImage } from "@mark1russell7/harness";
@@ -75,6 +75,29 @@ interface Cluster {
  */
 export declare const createCluster: (scenario: KindScenario, dir: string) => Promise<Cluster>;
 //#endregion
+//#region src/helm.d.ts
+/**
+ * This module installs a Helm chart that is pinned by the sha256 of its file. The installs of Cilium
+ * (`cilium.ts`) and of MetalLB (`metallb.ts`) use it. Helm keeps its own files in the folder of the
+ * cluster, thus two clusters do not share a cache of Helm.
+ */
+/** A pinned chart is a Helm chart: its name, its version, the URL of its file and the sha256 of that file. */
+interface PinnedChart {
+  readonly name: string;
+  readonly version: string;
+  readonly url: string;
+  readonly sha256: string;
+}
+/** This function gives the path of a chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
+export declare const ensurePinnedChart: (chart: PinnedChart, cache?: string) => Promise<string>;
+/**
+ * This function installs a pinned chart in a cluster with the values `values`. It writes the values
+ * to a file in the folder of the cluster. Helm waits for each workload of the chart, for up to 10 min.
+ */
+export declare const helmInstall: (cluster: Pick<Cluster, "dir" | "kubeconfig">, release: string, chart: PinnedChart, namespace: string, values: Readonly<Record<string, unknown>>, options?: {
+  readonly createNamespace?: boolean;
+}) => Promise<void>;
+//#endregion
 //#region src/cilium.d.ts
 /**
  * This module installs Cilium 1.20.4 in a kind cluster with Helm, from images pinned by digest.
@@ -84,10 +107,7 @@ export declare const createCluster: (scenario: KindScenario, dir: string) => Pro
 /** This version is the release of Cilium of the lab, from 2026-10-23: the version of the chart and the tag of each image. */
 export declare const CILIUM_VERSION = "1.20.4";
 /** This chart is the Helm chart of Cilium 1.20.4. The sha256 is of the file on `helm.cilium.io` (read on 2026-10-27). */
-export declare const CILIUM_CHART: {
-  readonly url: string;
-  readonly sha256: string;
-};
+export declare const CILIUM_CHART: PinnedChart;
 /**
  * These are the images that the install needs, pinned by the digests that the chart of 1.20.4 names
  * (`values.yaml`). The agent, the operator and Envoy are the only images: the install has no
@@ -581,6 +601,20 @@ interface LdsSpec {
     readonly pid: number;
   }>;
 }
+/**
+ * This function gives the MAC address of `ip` in a table of /proc/net/arp, in lower case. It gives
+ * null if the table has no row for `ip`, or if the row has the flags 0x0: no MAC yet. The ARP watch
+ * of `client.mjs` reads the table the same way.
+ */
+export declare const arpMacOf: (table: string, ip: string) => string | null;
+/** An outside spec is the clients outside the cluster: their target, interval, timeout and count, and the address whose MAC they watch. */
+interface OutsideSpec {
+  readonly target: string;
+  readonly every: Quantity;
+  readonly timeout: Quantity;
+  readonly count: number;
+  readonly arp: string;
+}
 /** A kind lab is the instruments of one cluster: a sidecar pair on each node, the watcher of the API and the prober. */
 interface KindLab {
   readonly cluster: Cluster;
@@ -607,6 +641,18 @@ interface KindLab {
   }): Promise<void>;
   probe(netns: readonly number[]): Promise<void>;
   stopProbe(): Promise<void>;
+  /**
+   * This method starts the clients outside the cluster of a VIP (`KindCell.vip`). Each one is a
+   * container of the lab image on the Docker network of the nodes, and runs `client.mjs`. Its lines
+   * have the node `outside`, and a line `arp` at each change of the MAC address of the VIP. A
+   * call stops the clients of the last call first. With null, it only stops them.
+   */
+  outside(spec: OutsideSpec | null): Promise<void>;
+  /** This method gives the MAC address of `ip` in the neighbour table of each client outside the cluster. It is null for a client with no MAC for it. */
+  outsideMacs(ip: string): Promise<ReadonlyArray<{
+    readonly client: string;
+    readonly mac: string | null;
+  }>>;
   /** This method asks each agent to poll the backends of a Service in the rules of its node, `every` apart, or to stop with null. */
   rules(rule: (ServiceRule & {
     readonly every: Quantity;
@@ -660,6 +706,288 @@ export declare const openKindLab: (cluster: Cluster, image: string) => Promise<K
 /** This function pins a Docker image by digest under a local tag that holds the digest, for `kind load` and `imagePullPolicy: Never`. */
 export declare const localPin: (image: string) => Promise<string>;
 //#endregion
+//#region src/kubevip.d.ts
+/**
+ * This module installs kube-vip 1.3.1 in a kind cluster (SYS-51). The install gives a Service of type
+ * LoadBalancer an address on the Docker network of the nodes: the VIP. In ARP mode, one node holds
+ * the VIP on its link, and it sends a gratuitous ARP for it each `vip_arpRate`. A Lease elects that
+ * node. Each value of the install is in `kubeVipObjects`, with its reason.
+ *
+ * The lab uses a VIP of a Service, not a VIP of the control plane. A VIP of the control plane needs
+ * three control-plane nodes and TLS on port 6443. A VIP of a Service needs one DaemonSet on the
+ * workers, and it serves the server of the cell.
+ *
+ * Each term of the election comes from the source of v1.3.1:
+ * - With `svc_election` off, one election of the lease `plndr-svcs-lock` gives each VIP to one
+ *   node (pkg/manager/worker/common.go, `GlobalLeader`). The lease is in the namespace of the pod.
+ * - The election is `leaderelection.RunOrDie` of client-go v0.37.1, with a Lease lock and
+ *   `ReleaseOnCancel` (pkg/election/election.go). The identity is the name of the node.
+ * - A leader that loses its lease stops the process (`OnStoppedLeading`), and the kubelet starts it again.
+ * - The ARP manager sends a gratuitous ARP for each VIP at each tick of one ticker of
+ *   `vip_arpRate`. A new VIP gets its first one at the next tick, not at once (pkg/arp/arp.go).
+ */
+/** This version is the release of kube-vip of the lab, from 2026-10-19: the tag of its image. */
+export declare const KUBE_VIP_VERSION = "1.3.1";
+/**
+ * This image is kube-vip 1.3.1 for linux/amd64, pinned by the digest of its manifest. The digest of
+ * the index of the tag is sha256:1962f9daf226503f7e6b107f595cb28b7917fd2d0113957075e19a3e5a6c1e33.
+ * The manifest of one platform loads into kind with no index.
+ */
+export declare const KUBE_VIP_IMAGE = "ghcr.io/kube-vip/kube-vip:v1.3.1@sha256:47353c7bde7fec21642cf621bc3fda2b999c051342912efda468999a399be667";
+/** This is the name of kube-vip: of its ServiceAccount, its DaemonSet and its container. */
+export declare const KUBE_VIP = "kube-vip";
+/** This is the Lease of the election of the VIPs of the Services (`svc_leasename`, cmd/kube-vip.go of v1.3.1). */
+export declare const KUBE_VIP_LEASE: {
+  readonly namespace: string;
+  readonly name: string;
+};
+/**
+ * These are the times of the election, as the install sets them. Each one is the default of the
+ * flags of v1.3.1 (cmd/kube-vip.go, lines 91–94). They are a lease of 15 s, a renew deadline of 10 s
+ * and a retry period of 2 s. The install sets each one in the environment, thus a new default cannot
+ * change a cell.
+ */
+export declare const KUBE_VIP_ELECTION: {
+  readonly lease: Quantity;
+  readonly renew: Quantity;
+  readonly retry: Quantity;
+};
+/** This time is the interval of the gratuitous ARPs, the default of the flag `arpRate` of v1.3.1 (cmd/kube-vip.go, line 61). */
+export declare const KUBE_VIP_ARP_RATE: Quantity;
+/** This label of a node selects the nodes of kube-vip: the DaemonSet has a pod only on a node with it. */
+export declare const VIP_LABEL = "lab.systems/vip";
+/**
+ * This function gives the objects of kube-vip in kube-system. They are its ServiceAccount, its
+ * ClusterRole and binding, and its DaemonSet. The rules of the role are those of the manifest that
+ * v1.3.1 generates (pkg/kubevip/config_generator.go, lines 95–134). The DaemonSet:
+ * - is on the host network, with NET_ADMIN and NET_RAW. It adds the VIP to `eth0` and sends ARP.
+ * - has a pod only on a node with `VIP_LABEL`. Thus the lab chooses the holder of the VIP.
+ * - sets ARP mode, the Services, one election for all VIPs, and each time of the election.
+ * - takes the image from the node (`imagePullPolicy: Never`).
+ */
+export declare const kubeVipObjects: (image: string) => unknown[];
+/** This is the Lease of the election, as the API gives it: its holder and its times. */
+interface VipLease {
+  readonly holder: string | null;
+  readonly acquireTime: string | null;
+  readonly renewTime: string | null;
+  readonly leaseDurationSeconds: number | null;
+  readonly leaseTransitions: number | null;
+}
+/** This function gives the Lease of the election, or null when it is not there yet. */
+export declare const vipLeaseOf: (cluster: Pick<Cluster, "kubectl">) => Promise<VipLease | null>;
+/** This is the Docker network of a cluster: its IPv4 subnet, and the MAC address of each container on it, by name. */
+interface VipNetwork {
+  readonly subnet: string;
+  readonly macs: Readonly<Record<string, string>>;
+}
+/** This function reads the Docker network of a cluster: its IPv4 subnet, and the MAC address of each container. */
+export declare const vipNetworkOf: (network: string) => Promise<VipNetwork>;
+/**
+ * This function gives the VIP of a subnet: the sixth address from its end. Docker gives the address
+ * of each container from the start of the subnet, thus no container takes it.
+ */
+export declare const vipOf: (subnet: string) => string;
+/** This is a pod of kube-vip that is not deleted: its name, its node, if it is ready, and the restarts of its container. */
+interface KubeVipPod {
+  readonly name: string;
+  readonly node: string;
+  readonly ready: boolean;
+  readonly restarts: number;
+}
+/** This function gives the pods of kube-vip that are not deleted. */
+export declare const kubeVipPods: (cluster: Pick<Cluster, "kubectl">) => Promise<KubeVipPod[]>;
+/** This function gives the nodes with a ready pod of kube-vip that is not deleted. */
+export declare const kubeVipReady: (cluster: Pick<Cluster, "kubectl">) => Promise<string[]>;
+/**
+ * This function makes `holder` the holder of the VIP, with a ready pod of kube-vip on each node of
+ * `nodes`. It gives null, or why it could not in `within` ms. If another node holds the lease, the
+ * function takes the label from each other node. The DaemonSet then deletes their pods. The leader
+ * gives back its lease at its stop (`ReleaseOnCancel`). The function gives each label back after
+ * `holder` takes the lease.
+ *
+ * A leader that lost its lease restarted its container. The kubelet gives a container a longer
+ * back-off at each restart, thus the function first deletes each pod of kube-vip with a restart.
+ * The DaemonSet then makes a new pod with no back-off.
+ */
+export declare const holdVip: (cluster: Pick<Cluster, "kubectl">, holder: string, nodes: readonly string[], within?: number) => Promise<string | null>;
+/**
+ * This function installs kube-vip in a cluster, with its image on each node (`cluster.load`), and
+ * makes `holder` the holder of the VIP. A failed install gives the pods of kube-vip and the tail of
+ * their logs.
+ */
+export declare const installKubeVip: (cluster: Cluster, image: string, holder: string, nodes: readonly string[]) => Promise<void>;
+/**
+ * This function waits until the Service of a VIP has the VIP in its status: kube-vip took it. It
+ * gives null, or why not in `within` ms.
+ */
+export declare const vipServed: (cluster: Pick<Cluster, "kubectl">, namespace: string, service: string, vip: string, within?: number) => Promise<string | null>;
+//#endregion
+//#region src/announcer.d.ts
+/**
+ * This module gives one shape to each announcer of a VIP: kube-vip (SYS-51) and MetalLB in L2 mode
+ * (SYS-53). The lab, the Service of the VIP and the clients outside the cluster are the same for
+ * each one. Only the install, the choice of the VIP, the hold before each run and the record differ.
+ */
+/** This is how the Service of a VIP selects its announcer: its class of load balancer, or none, and the annotation of its address. */
+interface VipService {
+  readonly loadBalancerClass: string | null;
+  readonly annotation: string;
+}
+/** An announcer is one way to give a Service of type LoadBalancer a VIP on the Docker network of the nodes. */
+interface VipAnnouncer {
+  readonly name: VipAnnouncerName;
+  /** These are the images of the announcer, pinned by digest, by their names in the manifest of a record. */
+  readonly images: Readonly<Record<string, string>>;
+  readonly service: VipService;
+  /** This time is the most from the end of a hold to the first gratuitous ARP of the holder. */
+  readonly settle: Quantity;
+  /** This function gives the VIP of a subnet, with `owner` its holder among `nodes`. */
+  readonly vipOf: (subnet: string, owner: string, nodes: readonly string[]) => string;
+  /** This function installs the announcer, with the local tags of its images, by the names of `images`. */
+  readonly install: (cluster: Cluster, local: Readonly<Record<string, string>>, owner: string, nodes: readonly string[], vip: string) => Promise<void>;
+  /** This function makes `owner` the holder of the VIP before a run. It gives null, or why not. */
+  readonly hold: (cluster: Cluster, owner: string, nodes: readonly string[], namespace: string, service: string) => Promise<string | null>;
+  /** This function gives the state of the announcer after a run, for the line `vip`. */
+  readonly record: (cluster: Cluster, namespace: string, service: string) => Promise<Record<string, unknown>>;
+}
+/** This announcer is kube-vip 1.3.1 in ARP mode, with one Lease for each VIP of a Service (`kubevip.ts`). */
+export declare const KUBE_VIP_ANNOUNCER: VipAnnouncer;
+/** This announcer is MetalLB 0.16.1 in L2 mode, with its speakers in memberlist (`metallb.ts`). */
+export declare const METALLB_ANNOUNCER: VipAnnouncer;
+/** This function gives the announcer of the VIP of a cell: kube-vip when the cell names none. */
+export declare const announcerOf: (cell: Pick<KindCell, "vip">) => VipAnnouncer;
+/** This function gives null if each client sends to `mac`, or the clients that do not. */
+export declare const macsAt: (found: ReadonlyArray<{
+  readonly client: string;
+  readonly mac: string | null;
+}>, mac: string, count: number) => string | null;
+//#endregion
+//#region src/metallb.d.ts
+/**
+ * This module installs MetalLB 0.16.1 in L2 mode in a kind cluster (SYS-53). The controller of
+ * MetalLB gives a Service of type LoadBalancer an address from a pool: the VIP. A speaker on each
+ * worker answers ARP for the VIP if its node owns the VIP. The VIP is on no interface of a node.
+ * Thus a frozen speaker answers nothing.
+ *
+ * Each term of the owner comes from the source of the tag v0.16.1 (commit 791dfcc6):
+ * - The owner of a VIP is the first node in the order of sha256(node + "#" + VIP), of the nodes with
+ *   a usable speaker (speaker/layer2_controller.go, lines 83–129). A usable speaker is a member of
+ *   memberlist that is not dead (internal/speakerlist/speakerlist.go, lines 303–320).
+ * - The speakers start memberlist from `DefaultLANConfig` (speakerlist.go, line 72). A file
+ *   /etc/metallb/memberlist/config.json replaces that config (lines 77–84). The install makes no
+ *   such file, thus each value is the default of hashicorp/memberlist v0.5.1.
+ * - Each event of memberlist (a join, a leave or an update) calls `ForceSync` (speakerlist.go, lines
+ *   339–349). `ForceSync` reconciles each Service at once, with no delay (internal/k8s/k8s.go, lines
+ *   181–184, and internal/k8s/controllers/service_controller_reload.go, lines 62–118).
+ * - The owner sends a gratuitous ARP at each reconcile. It sends one at once, then one each 1100 ms
+ *   for 5 s (internal/layer2/announcer.go, lines 157–197 and 258–272).
+ */
+/** This version is the release of MetalLB of the lab: the tag v0.16.1, the commit 791dfcc63ced7a6b3e869131eae75e645150fff0. */
+export declare const METALLB_VERSION = "0.16.1";
+/** This chart is the Helm chart of MetalLB 0.16.1. The sha256 is of the file of the release, and it is the digest in the index of the charts. */
+export declare const METALLB_CHART: PinnedChart;
+/**
+ * These are the images of MetalLB 0.16.1 for linux/amd64, pinned by the digest of the manifest of the
+ * platform. The lab pulls each one by its digest, tags it (`localPin`), and loads it into each node.
+ */
+export declare const METALLB_IMAGES: {
+  readonly speaker: string;
+  readonly controller: string;
+};
+/** These are the local tags of the images of MetalLB, after the pull by digest. */
+interface MetallbImages {
+  readonly speaker: string;
+  readonly controller: string;
+}
+/** This namespace holds MetalLB: its controller, its speakers and its objects. */
+export declare const METALLB_NAMESPACE = "metallb-system";
+/** This annotation of a Service gives the controller of MetalLB the address of its VIP. */
+export declare const METALLB_ANNOTATION = "metallb.io/loadBalancerIPs";
+/** This name is the name of the pool of the VIP and of its L2Advertisement. */
+export declare const METALLB_POOL = "lab-vip";
+/** This annotation of the Service makes each speaker reconcile it. The owner then sends its gratuitous ARPs. */
+export declare const ANNOUNCE_ANNOTATION = "lab.systems/announce";
+/**
+ * These are the terms of memberlist v0.5.1 that the speakers use: the defaults of `DefaultLANConfig`
+ * (config.go, lines 302–341).
+ * - `probeInterval` is the interval of the probes (line 318). The awareness of a healthy member does not scale it.
+ * - `probeTimeout` is the wait for the ack of a direct ping (line 317).
+ * - `suspicionMult` and `suspicionMaxTimeoutMult` give the time from suspect to dead (lines 314–315).
+ * - `pushPullInterval` is the interval of the full exchange of state (line 316).
+ * - `gossipInterval` is the interval of the gossip (line 323).
+ */
+export declare const MEMBERLIST: {
+  readonly probeInterval: Quantity;
+  readonly probeTimeout: Quantity;
+  readonly suspicionMult: number;
+  readonly suspicionMaxTimeoutMult: number;
+  readonly pushPullInterval: Quantity;
+  readonly gossipInterval: Quantity;
+};
+/** These are the gratuitous ARPs of the owner at each reconcile: one at once, then one each `every` until `for` (announcer.go, lines 172–182). */
+export declare const METALLB_SPAM: {
+  readonly every: Quantity;
+  readonly for: Quantity;
+};
+/**
+ * This function gives the time from suspect to dead in memberlist v0.5.1, for a cluster of `members`
+ * members with no peer that can confirm. The terms:
+ * - `suspicionTimeout` is SuspicionMult × max(1, log10(n)) × ProbeInterval (util.go, lines 71–76).
+ * - `suspectNode` sets k = SuspicionMult − 2 confirmations, and k = 0 if n − 2 < k (state.go, lines 1216–1224).
+ * - With k = 0, the timer fires at the minimum, not at the maximum (suspicion.go, lines 70–76).
+ * With confirmations to wait for, the function gives the maximum: SuspicionMaxTimeoutMult times the minimum.
+ */
+export declare const suspicionOf: (members: number, terms?: Pick<typeof MEMBERLIST, "probeInterval" | "suspicionMult" | "suspicionMaxTimeoutMult">) => Quantity;
+/**
+ * This function gives the Helm values of the install. The values that are not the defaults of the chart:
+ * - No FRR and no frr-k8s: the lab uses L2 mode only, thus it needs no BGP.
+ * - A speaker only on a node with `VIP_LABEL`, the workers. Thus memberlist has the workers as its
+ *   members, and the control plane does not answer ARP.
+ * - The controller on the control plane. A zone loss of a worker then does not take it away.
+ * - Each image from the node (`pullPolicy: Never`).
+ */
+export declare const metallbValues: (images: MetallbImages) => Record<string, unknown>;
+/** This function gives the pool of the VIP and its L2Advertisement. The pool has only the VIP. */
+export declare const metallbObjects: (vip: string) => unknown[];
+/** This function gives the nodes in the order of the election of the owner of `vip`: by sha256(node + "#" + vip), as bytes (layer2_controller.go, lines 115–120). */
+export declare const ownerOrder: (nodes: readonly string[], vip: string) => string[];
+/**
+ * This function gives the VIP of a subnet for MetalLB. It looks down from the sixth address from the
+ * end, and it gives the first address that `owner` owns, of the nodes `nodes`. Docker gives the address of each container
+ * from the start of the subnet, thus no container takes it.
+ */
+export declare const metallbVipOf: (subnet: string, owner: string, nodes: readonly string[]) => string;
+/** This is a ServiceL2Status of MetalLB: the node that announces a Service, and the time of the object. */
+interface Announcement {
+  readonly node: string;
+  readonly created: string | null;
+}
+/** This function gives the nodes that announce a Service, from the ServiceL2Status objects of the speakers. */
+export declare const announcementsOf: (cluster: Pick<Cluster, "kubectl">, namespace: string, service: string) => Promise<Announcement[]>;
+/** This function gives the nodes with a ready speaker that is not deleted. */
+export declare const speakersReady: (cluster: Pick<Cluster, "kubectl">) => Promise<string[]>;
+/**
+ * This function makes `owner` the only node that announces the Service, with a ready speaker on each
+ * node of `nodes`. It gives null, or why it could not in `within` ms. After a heal, the other node
+ * stops when it sees that the owner is alive again. The function then annotates the Service. Each
+ * speaker reconciles it, and the owner sends its gratuitous ARPs for 5 s. Thus each client learns
+ * the MAC address of the owner.
+ */
+export declare const holdMetallb: (cluster: Pick<Cluster, "kubectl">, owner: string, nodes: readonly string[], namespace: string, service: string, within?: number) => Promise<string | null>;
+/**
+ * This function installs MetalLB in a cluster, with its images on each node, the speakers on `nodes`,
+ * and a pool of the VIP. The webhook of the controller checks the pool, thus the function tries the
+ * pool again until the webhook answers. A failed install gives the pods of MetalLB and the tail of
+ * their logs.
+ */
+export declare const installMetallb: (cluster: Cluster, images: MetallbImages, nodes: readonly string[], vip: string) => Promise<void>;
+/**
+ * This function gives the record of MetalLB after a run: the nodes that announce the Service, and
+ * some lines of each speaker. The lines are about memberlist and the announces, with the times of the kubelet.
+ */
+export declare const metallbRecord: (cluster: Pick<Cluster, "kubectl">, namespace: string, service: string) => Promise<Record<string, unknown>>;
+//#endregion
 //#region src/lds.d.ts
 /**
  * This filter of RE2 selects the two counters of the listener manager of Envoy that an update of LDS
@@ -709,11 +1037,23 @@ export declare const namespaceObject: (cell: Pick<KindCell, "mesh">, namespace:
 export declare const probeOf: (path: string | null, probe: KubeletProbe, service?: string) => Record<string, unknown>;
 /** These are the objects of Redis: one replica behind a Service, with no persistence. */
 export declare const redisObjects: (namespace: string, image: string) => unknown[];
+/**
+ * This function gives the Service of a VIP (`announcer.ts`). It is of type LoadBalancer, with the
+ * class of its announcer, if the announcer has one. The annotation of the announcer has the address
+ * of the VIP. Without `service`, the announcer is kube-vip. The policy `Cluster` lets each node
+ * send a request to a replica on another node. The holder writes the address to the status of the
+ * Service. Then kube-proxy has the rules of the address on each node.
+ */
+export declare const vipService: (namespace: string, vip: string, ports: readonly unknown[], service?: VipService) => unknown;
 /**
  * These are the objects of the server: a Service of type ClusterIP, and the Deployment with the
  * settings of the cell. The image is the lab image for the service, or the image of grpc-go.
+ *
+ * With a VIP (`KindCell.vip`), the Service is of type LoadBalancer, with the address `vip` and the
+ * class of its announcer (`vipService`). No replica is in the lost zone. Thus a zone loss takes away
+ * only the holder of the VIP.
  */
-export declare const serverObjects: (cell: KindCell, namespace: string, image: string, version?: number) => unknown[];
+export declare const serverObjects: (cell: KindCell, namespace: string, image: string, version?: number, vip?: string | null) => unknown[];
 /**
  * These are the objects of the clients: a DaemonSet with one client on each node, the control plane
  * too. The client of the service is `client.mjs`, and the client of grpc-go is `client-grpc.mjs`.
@@ -1011,5 +1351,5 @@ export declare const toolPath: (tool: Tool, key?: string, cache?: string) => str
  */
 export declare const ensureTool: (tool: Tool, key?: string, cache?: string) => Promise<string>;
 //#endregion
-export { type BacklogTerm, type Band, type BandV1, CLIENT, type CiliumImages, type Cluster, type ClusterHosts, type ClusterManifest, type CountBand, type Credentials, type Cycle, DATAPLANES, DRAIN_RULES, type Dataplane, type Declaration, type Deleted, type DeletionWindow, type EdgeProtocol, type EdsSpec, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, type LdsSpec, type LeafCertificate, type LearnWindow, Line, type ListenerCounts, type LoadSample, type Mesh, type MeshFlavor, type MeshImages, type MeshMode, NODE_IMAGES, type NodeImage, type NodeLifecycle, type NonePrediction, O04, O09, O10, O16, PORT, type Parts, Period, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, type Propagation, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type ServiceRule, Sessions, SliceLine, SocketLine, type Stack, type Stamp, type Step, TCP_STATE, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, TunnelLine, type Verdicts, type WindowPrediction, type Workload, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZtunnelPodLine, backendsAt, backlogEnd, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, cyclesOf, deletionOf, deletionsOf, drainBand, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, isKubeProxyMode, isTunnelState, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, overshootBand, periodOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestBand, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, sessionsAt, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, zoneOf, ztunnelPodsOf, ztunnelReplaced };
+export { type Announcement, type BacklogTerm, type Band, type BandV1, CLIENT, type CiliumImages, type Cluster, type ClusterHosts, type ClusterManifest, type CountBand, type Credentials, type Cycle, DATAPLANES, DRAIN_RULES, type Dataplane, type Declaration, type Deleted, type DeletionWindow, type EdgeProtocol, type EdsSpec, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, type Flap, HBONE_PORT, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeVipPod, type KubeletProbe, LAST_SLACK, LB_CLASS, LOG_LABEL, type LdsSpec, type LeafCertificate, type LearnWindow, Line, type ListenerCounts, type LoadSample, type Mesh, type MeshFlavor, type MeshImages, type MeshMode, type MetallbImages, NODE_IMAGES, type NodeImage, type NodeLifecycle, type NonePrediction, O04, O09, O10, O16, OUTSIDE, type OutsideSpec, PORT, type Parts, Period, type PermittedWindow, type PinnedChart, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, type Propagation, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type ServiceRule, Sessions, SliceLine, SocketLine, type Stack, type Stamp, type Step, TCP_STATE, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, TunnelLine, VIP_ANNOTATION, type Verdicts, type VipAnnouncer, type VipAnnouncerName, type VipLease, type VipNetwork, type VipService, type VipSettings, type WindowPrediction, type Workload, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZtunnelPodLine, backendsAt, backlogEnd, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, cyclesOf, deletionOf, deletionsOf, drainBand, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, isKubeProxyMode, isTunnelState, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, overshootBand, periodOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestBand, requestsOf, restartOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, sessionsAt, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stoppingOf, timeSpread, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, zoneOf, ztunnelPodsOf, ztunnelReplaced };
 //# sourceMappingURL=index.d.ts.map