@mark1russell7/kind 0.13.1 → 0.13.3

package/build/index.js

@@ -1,4 +1,4 @@
-import { $ as signalsOf, A as HBONE_PORT, B as isTunnelState, C as observationEnd, Ct as drainBand, D as reusesReset, Dt as secondsOf, E as referenceOf, Et as seconds, F as deletionOf, G as podsOf, H as outcomesOf, I as dropOf, J as restartOf, K as recordsOf, L as emptyOf, M as backendsAt, N as byClients, O as unitOf, Ot as showBand, P as byNode, Q as signalOf, R as failuresOf, S as observationAfter, St as bandOf, T as propagationSource, Tt as requestBand, U as periodOf, V as kernelCounts, W as podsAt, X as rulesOf, Y as restartsAt, Z as sessionsAt, _ as checkRun, _t as LOG_LABEL, a as calibrationOf, at as socketsOf, b as factsOf, bt as SERVER, c as predictionText, ct as tunnelsOf, d as FORMAT_V1, dt as RELATIVE, et as sliceDropOf, f as judge, ft as medianInterval, g as LAST_SLACK, gt as HEALTH_PORT, h as KIND_NOISE, ht as CLIENT, i as readRecord, it as slicesOf, j as TCP_STATE, k as updatesOf, l as timeSpread, lt as ztunnelPodsOf, m as upgradeCell, mt as quantileOf, n as kindCellRecordSchema, nt as sliceReadyAt, o as cellsTable, ot as stoppingOf, p as upgrade, pt as middle, q as requestsOf, r as kindCellRecordV1Schema, rt as sliceReadyOf, s as medianText, st as transitionOf, t as STAGES, tt as sliceEmptyOf, u as FORMAT, ut as ztunnelReplaced, v as cyclesOf, vt as PORT, w as propagationOf, wt as overshootBand, x as judgeKind, xt as backlogEnd, y as deletionsOf, yt as REDIS, z as intakeOf } from "./judge-DA754h1o.js";
+import { $ as signalsOf, A as HBONE_PORT, At as secondsOf, B as isTunnelState, C as observationEnd, Ct as VIP_ANNOTATION, D as reusesReset, Dt as overshootBand, E as referenceOf, Et as drainBand, F as deletionOf, G as podsOf, H as outcomesOf, I as dropOf, J as restartOf, K as recordsOf, L as emptyOf, M as backendsAt, N as byClients, O as unitOf, Ot as requestBand, P as byNode, Q as signalOf, R as failuresOf, S as observationAfter, St as SERVER, T as propagationSource, Tt as bandOf, U as periodOf, V as kernelCounts, W as podsAt, X as rulesOf, Y as restartsAt, Z as sessionsAt, _ as checkRun, _t as LB_CLASS, a as calibrationOf, at as socketsOf, b as factsOf, bt as PORT, c as predictionText, ct as tunnelsOf, d as FORMAT_V1, dt as RELATIVE, et as sliceDropOf, f as judge, ft as medianInterval, g as LAST_SLACK, gt as HEALTH_PORT, h as KIND_NOISE, ht as CLIENT, i as readRecord, it as slicesOf, j as TCP_STATE, jt as showBand, k as updatesOf, kt as seconds, l as timeSpread, lt as ztunnelPodsOf, m as upgradeCell, mt as quantileOf, n as kindCellRecordSchema, nt as sliceReadyAt, o as cellsTable, ot as stoppingOf, p as upgrade, pt as middle, q as requestsOf, r as kindCellRecordV1Schema, rt as sliceReadyOf, s as medianText, st as transitionOf, t as STAGES, tt as sliceEmptyOf, u as FORMAT, ut as ztunnelReplaced, v as cyclesOf, vt as LOG_LABEL, w as propagationOf, wt as backlogEnd, x as judgeKind, xt as REDIS, y as deletionsOf, yt as OUTSIDE, z as intakeOf } from "./judge-DKrgfhAt.js";
 import { valueIn } from "@mark1russell7/quantity";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -642,6 +642,55 @@ const createCluster = async (scenario, dir) => {
 	return cluster;
 };
 //#endregion
+//#region src/helm.ts
+/** This function gives the path of a chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
+const ensurePinnedChart = async (chart, cache = cacheFolder()) => {
+	const path = join(cache, "charts", `${chart.name}-${chart.version}.tgz`);
+	const bytes = existsSync(path) ? readFileSync(path) : await download(chart.url);
+	const found = sha256(bytes);
+	if (found !== chart.sha256) throw new Error(`the chart ${chart.name} ${chart.version} has the sha256 ${found}, not the pinned ${chart.sha256}`);
+	if (!existsSync(path)) {
+		mkdirSync(join(cache, "charts"), { recursive: true });
+		writeFileSync(path, bytes);
+	}
+	return path;
+};
+/**
+* This function installs a pinned chart in a cluster with the values `values`. It writes the values
+* to a file in the folder of the cluster. Helm waits for each workload of the chart, for up to 10 min.
+*/
+const helmInstall = async (cluster, release, chart, namespace, values, options = {}) => {
+	const helm = await ensureTool(HELM);
+	const path = await ensurePinnedChart(chart);
+	const file = join(cluster.dir, `${release}-values.json`);
+	writeFileSync(file, `${JSON.stringify(values, null, 2)}\n`);
+	const home = join(cluster.dir, "helm");
+	const env = {
+		HELM_CACHE_HOME: join(home, "cache"),
+		HELM_CONFIG_HOME: join(home, "config"),
+		HELM_DATA_HOME: join(home, "data")
+	};
+	const create = options.createNamespace === true ? ["--create-namespace"] : [];
+	await command(helm, [
+		"install",
+		release,
+		path,
+		"-n",
+		namespace,
+		...create,
+		"--kubeconfig",
+		cluster.kubeconfig,
+		"-f",
+		file,
+		"--wait",
+		"--timeout",
+		"10m"
+	], {
+		env,
+		timeout: 9e5
+	});
+};
+//#endregion
 //#region src/cilium.ts
 /**
 * This module installs Cilium 1.20.4 in a kind cluster with Helm, from images pinned by digest.
@@ -652,6 +701,8 @@ const createCluster = async (scenario, dir) => {
 const CILIUM_VERSION = "1.20.4";
 /** This chart is the Helm chart of Cilium 1.20.4. The sha256 is of the file on `helm.cilium.io` (read on 2026-10-27). */
 const CILIUM_CHART = {
+	name: "cilium",
+	version: CILIUM_VERSION,
 	url: "https://helm.cilium.io/cilium-1.20.4.tgz",
 	sha256: "505abff8385811df1a949776fc42e9f10697989a332acc86d6e8933efcb855ed"
 };
@@ -712,17 +763,7 @@ const CILIUM_WORKLOADS = [
 	"daemonset/cilium-envoy"
 ];
 /** This function gives the path of the chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
-const ensureChart = async (cache = cacheFolder()) => {
-	const path = join(cache, "charts", `cilium-${CILIUM_VERSION}.tgz`);
-	const bytes = existsSync(path) ? readFileSync(path) : await download(CILIUM_CHART.url);
-	const found = sha256(bytes);
-	if (found !== CILIUM_CHART.sha256) throw new Error(`the chart of Cilium has the sha256 ${found}, not the pinned ${CILIUM_CHART.sha256}`);
-	if (!existsSync(path)) {
-		mkdirSync(join(cache, "charts"), { recursive: true });
-		writeFileSync(path, bytes);
-	}
-	return path;
-};
+const ensureChart = (cache = cacheFolder()) => ensurePinnedChart(CILIUM_CHART, cache);
 /**
 * This function installs Cilium in a cluster with no CNI and no kube-proxy. Helm keeps its own
 * files in the folder of the cluster. The function waits for each workload, for each node to be
@@ -730,34 +771,8 @@ const ensureChart = async (cache = cacheFolder()) => {
 * lines of the log of the agent.
 */
 const installCilium = async (cluster, images) => {
-	const helm = await ensureTool(HELM);
-	const chart = await ensureChart();
-	const file = join(cluster.dir, "cilium-values.json");
-	writeFileSync(file, `${JSON.stringify(ciliumValues(cluster.scenario.name, images), null, 2)}\n`);
-	const home = join(cluster.dir, "helm");
-	const env = {
-		HELM_CACHE_HOME: join(home, "cache"),
-		HELM_CONFIG_HOME: join(home, "config"),
-		HELM_DATA_HOME: join(home, "data")
-	};
 	try {
-		await command(helm, [
-			"install",
-			"cilium",
-			chart,
-			"-n",
-			"kube-system",
-			"--kubeconfig",
-			cluster.kubeconfig,
-			"-f",
-			file,
-			"--wait",
-			"--timeout",
-			"10m"
-		], {
-			env,
-			timeout: 9e5
-		});
+		await helmInstall(cluster, "cilium", CILIUM_CHART, "kube-system", ciliumValues(cluster.scenario.name, images));
 		for (const workload of CILIUM_WORKLOADS) await cluster.kubectl([
 			"-n",
 			"kube-system",
@@ -2223,6 +2238,809 @@ const ztunnelCertificates = async (cluster) => {
 	return out;
 };
 //#endregion
+//#region src/kubevip.ts
+/**
+* This module installs kube-vip 1.3.1 in a kind cluster (SYS-51). The install gives a Service of type
+* LoadBalancer an address on the Docker network of the nodes: the VIP. In ARP mode, one node holds
+* the VIP on its link, and it sends a gratuitous ARP for it each `vip_arpRate`. A Lease elects that
+* node. Each value of the install is in `kubeVipObjects`, with its reason.
+*
+* The lab uses a VIP of a Service, not a VIP of the control plane. A VIP of the control plane needs
+* three control-plane nodes and TLS on port 6443. A VIP of a Service needs one DaemonSet on the
+* workers, and it serves the server of the cell.
+*
+* Each term of the election comes from the source of v1.3.1:
+* - With `svc_election` off, one election of the lease `plndr-svcs-lock` gives each VIP to one
+*   node (pkg/manager/worker/common.go, `GlobalLeader`). The lease is in the namespace of the pod.
+* - The election is `leaderelection.RunOrDie` of client-go v0.37.1, with a Lease lock and
+*   `ReleaseOnCancel` (pkg/election/election.go). The identity is the name of the node.
+* - A leader that loses its lease stops the process (`OnStoppedLeading`), and the kubelet starts it again.
+* - The ARP manager sends a gratuitous ARP for each VIP at each tick of one ticker of
+*   `vip_arpRate`. A new VIP gets its first one at the next tick, not at once (pkg/arp/arp.go).
+*/
+/** This version is the release of kube-vip of the lab, from 2026-10-19: the tag of its image. */
+const KUBE_VIP_VERSION = "1.3.1";
+/**
+* This image is kube-vip 1.3.1 for linux/amd64, pinned by the digest of its manifest. The digest of
+* the index of the tag is sha256:1962f9daf226503f7e6b107f595cb28b7917fd2d0113957075e19a3e5a6c1e33.
+* The manifest of one platform loads into kind with no index.
+*/
+const KUBE_VIP_IMAGE = "ghcr.io/kube-vip/kube-vip:v1.3.1@sha256:47353c7bde7fec21642cf621bc3fda2b999c051342912efda468999a399be667";
+/** This is the name of kube-vip: of its ServiceAccount, its DaemonSet and its container. */
+const KUBE_VIP = "kube-vip";
+/** This is the Lease of the election of the VIPs of the Services (`svc_leasename`, cmd/kube-vip.go of v1.3.1). */
+const KUBE_VIP_LEASE = {
+	namespace: "kube-system",
+	name: "plndr-svcs-lock"
+};
+/**
+* These are the times of the election, as the install sets them. Each one is the default of the
+* flags of v1.3.1 (cmd/kube-vip.go, lines 91–94). They are a lease of 15 s, a renew deadline of 10 s
+* and a retry period of 2 s. The install sets each one in the environment, thus a new default cannot
+* change a cell.
+*/
+const KUBE_VIP_ELECTION = {
+	lease: {
+		value: 15,
+		unit: "s"
+	},
+	renew: {
+		value: 10,
+		unit: "s"
+	},
+	retry: {
+		value: 2,
+		unit: "s"
+	}
+};
+/** This time is the interval of the gratuitous ARPs, the default of the flag `arpRate` of v1.3.1 (cmd/kube-vip.go, line 61). */
+const KUBE_VIP_ARP_RATE = {
+	value: 3e3,
+	unit: "ms"
+};
+/** This label of a node selects the nodes of kube-vip: the DaemonSet has a pod only on a node with it. */
+const VIP_LABEL = "lab.systems/vip";
+/** This label of a pod of kube-vip selects them. */
+const APP = { "app.kubernetes.io/name": KUBE_VIP };
+const whole$1 = (amount) => String(Math.round(valueIn(amount, "s")));
+/**
+* This function gives the objects of kube-vip in kube-system. They are its ServiceAccount, its
+* ClusterRole and binding, and its DaemonSet. The rules of the role are those of the manifest that
+* v1.3.1 generates (pkg/kubevip/config_generator.go, lines 95–134). The DaemonSet:
+* - is on the host network, with NET_ADMIN and NET_RAW. It adds the VIP to `eth0` and sends ARP.
+* - has a pod only on a node with `VIP_LABEL`. Thus the lab chooses the holder of the VIP.
+* - sets ARP mode, the Services, one election for all VIPs, and each time of the election.
+* - takes the image from the node (`imagePullPolicy: Never`).
+*/
+const kubeVipObjects = (image) => {
+	const env = {
+		vip_arp: "true",
+		vip_interface: "eth0",
+		port: "6443",
+		cp_enable: "false",
+		svc_enable: "true",
+		svc_election: "false",
+		svc_leasename: KUBE_VIP_LEASE.name,
+		vip_leaderelection: "true",
+		vip_leaseduration: whole$1(KUBE_VIP_ELECTION.lease),
+		vip_renewdeadline: whole$1(KUBE_VIP_ELECTION.renew),
+		vip_retryperiod: whole$1(KUBE_VIP_ELECTION.retry),
+		vip_arpRate: String(Math.round(valueIn(KUBE_VIP_ARP_RATE, "ms")))
+	};
+	const namespace = KUBE_VIP_LEASE.namespace;
+	return [
+		{
+			apiVersion: "v1",
+			kind: "ServiceAccount",
+			metadata: {
+				name: KUBE_VIP,
+				namespace
+			}
+		},
+		{
+			apiVersion: "rbac.authorization.k8s.io/v1",
+			kind: "ClusterRole",
+			metadata: { name: "system:kube-vip-role" },
+			rules: [
+				{
+					apiGroups: [""],
+					resources: ["services/status"],
+					verbs: ["update"]
+				},
+				{
+					apiGroups: [""],
+					resources: ["services", "endpoints"],
+					verbs: [
+						"list",
+						"get",
+						"watch",
+						"update"
+					]
+				},
+				{
+					apiGroups: [""],
+					resources: ["nodes"],
+					verbs: [
+						"list",
+						"get",
+						"watch",
+						"update",
+						"patch"
+					]
+				},
+				{
+					apiGroups: ["coordination.k8s.io"],
+					resources: ["leases"],
+					verbs: [
+						"list",
+						"get",
+						"watch",
+						"update",
+						"create"
+					]
+				},
+				{
+					apiGroups: ["discovery.k8s.io"],
+					resources: ["endpointslices"],
+					verbs: [
+						"list",
+						"get",
+						"watch",
+						"update"
+					]
+				},
+				{
+					apiGroups: [""],
+					resources: ["pods"],
+					verbs: ["list"]
+				},
+				{
+					apiGroups: ["networking.k8s.io"],
+					resources: ["servicecidrs"],
+					verbs: [
+						"list",
+						"get",
+						"watch"
+					]
+				}
+			]
+		},
+		{
+			apiVersion: "rbac.authorization.k8s.io/v1",
+			kind: "ClusterRoleBinding",
+			metadata: { name: "system:kube-vip-binding" },
+			roleRef: {
+				apiGroup: "rbac.authorization.k8s.io",
+				kind: "ClusterRole",
+				name: "system:kube-vip-role"
+			},
+			subjects: [{
+				kind: "ServiceAccount",
+				name: KUBE_VIP,
+				namespace
+			}]
+		},
+		{
+			apiVersion: "apps/v1",
+			kind: "DaemonSet",
+			metadata: {
+				name: KUBE_VIP,
+				namespace,
+				labels: APP
+			},
+			spec: {
+				selector: { matchLabels: APP },
+				template: {
+					metadata: { labels: APP },
+					spec: {
+						serviceAccountName: KUBE_VIP,
+						hostNetwork: true,
+						nodeSelector: { [VIP_LABEL]: "1" },
+						containers: [{
+							name: KUBE_VIP,
+							image,
+							imagePullPolicy: "Never",
+							args: ["manager"],
+							env: [...Object.entries(env).map(([name, value]) => ({
+								name,
+								value
+							})), {
+								name: "vip_nodename",
+								valueFrom: { fieldRef: { fieldPath: "spec.nodeName" } }
+							}],
+							securityContext: { capabilities: { add: ["NET_ADMIN", "NET_RAW"] } }
+						}]
+					}
+				}
+			}
+		}
+	];
+};
+/** This function gives the Lease of the election, or null when it is not there yet. */
+const vipLeaseOf = async (cluster) => {
+	const text = await cluster.kubectl([
+		"-n",
+		KUBE_VIP_LEASE.namespace,
+		"get",
+		"lease",
+		KUBE_VIP_LEASE.name,
+		"-o",
+		"json",
+		"--ignore-not-found"
+	]);
+	if (text.trim() === "") return null;
+	const spec = JSON.parse(text).spec ?? {};
+	const text0 = (key) => typeof spec[key] === "string" && spec[key] !== "" ? spec[key] : null;
+	const number0 = (key) => typeof spec[key] === "number" ? spec[key] : null;
+	return {
+		holder: text0("holderIdentity"),
+		acquireTime: text0("acquireTime"),
+		renewTime: text0("renewTime"),
+		leaseDurationSeconds: number0("leaseDurationSeconds"),
+		leaseTransitions: number0("leaseTransitions")
+	};
+};
+/** This function reads the Docker network of a cluster: its IPv4 subnet, and the MAC address of each container. */
+const vipNetworkOf = async (network) => {
+	const [info] = JSON.parse(await command("docker", [
+		"network",
+		"inspect",
+		network
+	]));
+	const subnet = (info?.IPAM?.Config ?? []).map((config) => config.Subnet ?? "").find((each) => /^\d+\.\d+\.\d+\.\d+\/\d+$/.test(each));
+	if (subnet === void 0) throw new Error(`the Docker network ${network} has no IPv4 subnet`);
+	const macs = {};
+	for (const container of Object.values(info?.Containers ?? {})) if (container.Name !== void 0 && container.MacAddress !== void 0) macs[container.Name] = container.MacAddress.toLowerCase();
+	return {
+		subnet,
+		macs
+	};
+};
+/**
+* This function gives the VIP of a subnet: the sixth address from its end. Docker gives the address
+* of each container from the start of the subnet, thus no container takes it.
+*/
+const vipOf = (subnet) => {
+	const [first, last] = cidrRange(subnet);
+	const address = last - 5;
+	if (address <= first + 1) throw new Error(`the subnet ${subnet} is too small for a VIP`);
+	return [
+		24,
+		16,
+		8,
+		0
+	].map((shift) => Math.floor(address / 2 ** shift) % 256).join(".");
+};
+const sleep$2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** This function gives the pods of kube-vip that are not deleted. */
+const kubeVipPods = async (cluster) => {
+	return JSON.parse(await cluster.kubectl([
+		"-n",
+		KUBE_VIP_LEASE.namespace,
+		"get",
+		"pods",
+		"-l",
+		`app.kubernetes.io/name=${KUBE_VIP}`,
+		"-o",
+		"json"
+	])).items.filter((pod) => pod.metadata.deletionTimestamp === void 0).map((pod) => {
+		const statuses = pod.status?.containerStatuses ?? [];
+		return {
+			name: pod.metadata.name,
+			node: pod.spec.nodeName ?? "",
+			ready: statuses.length > 0 && statuses.every((status) => status.ready),
+			restarts: statuses.reduce((sum, status) => sum + (status.restartCount ?? 0), 0)
+		};
+	});
+};
+/** This function gives the nodes with a ready pod of kube-vip that is not deleted. */
+const kubeVipReady = async (cluster) => (await kubeVipPods(cluster)).filter((pod) => pod.ready && pod.node !== "").map((pod) => pod.node).sort();
+/** This function waits until a condition gives null, and gives null, or the last reason after `within` ms. */
+const until$1 = async (within, check) => {
+	const end = Date.now() + within;
+	let why = await check();
+	while (why !== null && Date.now() < end) {
+		await sleep$2(500);
+		why = await check();
+	}
+	return why;
+};
+const label = (cluster, node, on) => cluster.kubectl([
+	"label",
+	"node",
+	node,
+	on ? `${VIP_LABEL}=1` : `${VIP_LABEL}-`,
+	...on ? ["--overwrite"] : []
+]);
+/**
+* This function makes `holder` the holder of the VIP, with a ready pod of kube-vip on each node of
+* `nodes`. It gives null, or why it could not in `within` ms. If another node holds the lease, the
+* function takes the label from each other node. The DaemonSet then deletes their pods. The leader
+* gives back its lease at its stop (`ReleaseOnCancel`). The function gives each label back after
+* `holder` takes the lease.
+*
+* A leader that lost its lease restarted its container. The kubelet gives a container a longer
+* back-off at each restart, thus the function first deletes each pod of kube-vip with a restart.
+* The DaemonSet then makes a new pod with no back-off.
+*/
+const holdVip = async (cluster, holder, nodes, within = 18e4) => {
+	const others = nodes.filter((node) => node !== holder);
+	for (const pod of await kubeVipPods(cluster)) if (pod.restarts > 0) await cluster.kubectl([
+		"-n",
+		KUBE_VIP_LEASE.namespace,
+		"delete",
+		"pod",
+		pod.name,
+		"--wait=true",
+		"--timeout=120s"
+	]);
+	await label(cluster, holder, true);
+	const own = await until$1(within, async () => (await kubeVipReady(cluster)).includes(holder) ? null : `kube-vip on ${holder} is not ready`);
+	if (own !== null) return own;
+	const held = async () => {
+		const lease = await vipLeaseOf(cluster);
+		return lease?.holder === holder ? null : `the lease ${KUBE_VIP_LEASE.name} is held by ${lease?.holder ?? "no node"}, not ${holder}`;
+	};
+	if (await held() !== null) {
+		for (const node of others) await label(cluster, node, false);
+		const moved = await until$1(within, held);
+		if (moved !== null) return moved;
+	}
+	for (const node of others) await label(cluster, node, true);
+	return until$1(within, async () => {
+		const ready = await kubeVipReady(cluster);
+		const missing = nodes.filter((node) => !ready.includes(node));
+		return missing.length === 0 ? null : `kube-vip is not ready on ${missing.join(", ")}`;
+	});
+};
+/**
+* This function installs kube-vip in a cluster, with its image on each node (`cluster.load`), and
+* makes `holder` the holder of the VIP. A failed install gives the pods of kube-vip and the tail of
+* their logs.
+*/
+const installKubeVip = async (cluster, image, holder, nodes) => {
+	try {
+		await label(cluster, holder, true);
+		await cluster.apply(kubeVipObjects(image));
+		const why = await holdVip(cluster, holder, nodes);
+		if (why !== null) throw new Error(why);
+	} catch (error) {
+		const state = async (args) => (await cluster.kubectl([
+			"-n",
+			KUBE_VIP_LEASE.namespace,
+			...args
+		]).catch((failure) => String(failure))).slice(-4e3);
+		const pods = await state([
+			"get",
+			"pods",
+			"-l",
+			`app.kubernetes.io/name=${KUBE_VIP}`,
+			"-o",
+			"wide"
+		]);
+		const logs = await state([
+			"logs",
+			"-l",
+			`app.kubernetes.io/name=${KUBE_VIP}`,
+			"--tail=40",
+			"--prefix"
+		]);
+		throw new Error(`the install of kube-vip failed: ${String(error)}\nthe pods of kube-vip:\n${pods}\nthe logs:\n${logs}`);
+	}
+};
+/**
+* This function waits until the Service of a VIP has the VIP in its status: kube-vip took it. It
+* gives null, or why not in `within` ms.
+*/
+const vipServed = (cluster, namespace, service, vip, within = 12e4) => until$1(within, async () => {
+	const ingress = (await cluster.kubectl([
+		"-n",
+		namespace,
+		"get",
+		"service",
+		service,
+		"-o",
+		"jsonpath={.status.loadBalancer.ingress[*].ip}"
+	])).trim();
+	return ingress.split(/\s+/).includes(vip) ? null : `the Service ${service} has the ingress ${ingress || "none"}, not ${vip}`;
+});
+//#endregion
+//#region src/metallb.ts
+/**
+* This module installs MetalLB 0.16.1 in L2 mode in a kind cluster (SYS-53). The controller of
+* MetalLB gives a Service of type LoadBalancer an address from a pool: the VIP. A speaker on each
+* worker answers ARP for the VIP if its node owns the VIP. The VIP is on no interface of a node.
+* Thus a frozen speaker answers nothing.
+*
+* Each term of the owner comes from the source of the tag v0.16.1 (commit 791dfcc6):
+* - The owner of a VIP is the first node in the order of sha256(node + "#" + VIP), of the nodes with
+*   a usable speaker (speaker/layer2_controller.go, lines 83–129). A usable speaker is a member of
+*   memberlist that is not dead (internal/speakerlist/speakerlist.go, lines 303–320).
+* - The speakers start memberlist from `DefaultLANConfig` (speakerlist.go, line 72). A file
+*   /etc/metallb/memberlist/config.json replaces that config (lines 77–84). The install makes no
+*   such file, thus each value is the default of hashicorp/memberlist v0.5.1.
+* - Each event of memberlist (a join, a leave or an update) calls `ForceSync` (speakerlist.go, lines
+*   339–349). `ForceSync` reconciles each Service at once, with no delay (internal/k8s/k8s.go, lines
+*   181–184, and internal/k8s/controllers/service_controller_reload.go, lines 62–118).
+* - The owner sends a gratuitous ARP at each reconcile. It sends one at once, then one each 1100 ms
+*   for 5 s (internal/layer2/announcer.go, lines 157–197 and 258–272).
+*/
+/** This version is the release of MetalLB of the lab: the tag v0.16.1, the commit 791dfcc63ced7a6b3e869131eae75e645150fff0. */
+const METALLB_VERSION = "0.16.1";
+/** This chart is the Helm chart of MetalLB 0.16.1. The sha256 is of the file of the release, and it is the digest in the index of the charts. */
+const METALLB_CHART = {
+	name: "metallb",
+	version: METALLB_VERSION,
+	url: "https://github.com/metallb/metallb/releases/download/metallb-chart-0.16.1/metallb-0.16.1.tgz",
+	sha256: "fb06bb584fcb7856f15733b2a6a2aff5b61b5c350687e341c163ae24a5938adc"
+};
+/**
+* These are the images of MetalLB 0.16.1 for linux/amd64, pinned by the digest of the manifest of the
+* platform. The lab pulls each one by its digest, tags it (`localPin`), and loads it into each node.
+*/
+const METALLB_IMAGES = {
+	speaker: "quay.io/metallb/speaker:v0.16.1@sha256:37a98a9d1cd970051c5dededb6f922c1e6c3b90fdd0fc1350d1686e67675af0e",
+	controller: "quay.io/metallb/controller:v0.16.1@sha256:5a3e101335f5ea2cfb0ddf51acdfa9538251e0623ffcd6cbfc1b274b7898790c"
+};
+/** This namespace holds MetalLB: its controller, its speakers and its objects. */
+const METALLB_NAMESPACE = "metallb-system";
+/** This annotation of a Service gives the controller of MetalLB the address of its VIP. */
+const METALLB_ANNOTATION = "metallb.io/loadBalancerIPs";
+/** This name is the name of the pool of the VIP and of its L2Advertisement. */
+const METALLB_POOL = "lab-vip";
+/** This annotation of the Service makes each speaker reconcile it. The owner then sends its gratuitous ARPs. */
+const ANNOUNCE_ANNOTATION = "lab.systems/announce";
+/**
+* These are the terms of memberlist v0.5.1 that the speakers use: the defaults of `DefaultLANConfig`
+* (config.go, lines 302–341).
+* - `probeInterval` is the interval of the probes (line 318). The awareness of a healthy member does not scale it.
+* - `probeTimeout` is the wait for the ack of a direct ping (line 317).
+* - `suspicionMult` and `suspicionMaxTimeoutMult` give the time from suspect to dead (lines 314–315).
+* - `pushPullInterval` is the interval of the full exchange of state (line 316).
+* - `gossipInterval` is the interval of the gossip (line 323).
+*/
+const MEMBERLIST = {
+	probeInterval: {
+		value: 1,
+		unit: "s"
+	},
+	probeTimeout: {
+		value: 500,
+		unit: "ms"
+	},
+	suspicionMult: 4,
+	suspicionMaxTimeoutMult: 6,
+	pushPullInterval: {
+		value: 30,
+		unit: "s"
+	},
+	gossipInterval: {
+		value: 200,
+		unit: "ms"
+	}
+};
+/** These are the gratuitous ARPs of the owner at each reconcile: one at once, then one each `every` until `for` (announcer.go, lines 172–182). */
+const METALLB_SPAM = {
+	every: {
+		value: 1100,
+		unit: "ms"
+	},
+	for: {
+		value: 5,
+		unit: "s"
+	}
+};
+/**
+* This function gives the time from suspect to dead in memberlist v0.5.1, for a cluster of `members`
+* members with no peer that can confirm. The terms:
+* - `suspicionTimeout` is SuspicionMult × max(1, log10(n)) × ProbeInterval (util.go, lines 71–76).
+* - `suspectNode` sets k = SuspicionMult − 2 confirmations, and k = 0 if n − 2 < k (state.go, lines 1216–1224).
+* - With k = 0, the timer fires at the minimum, not at the maximum (suspicion.go, lines 70–76).
+* With confirmations to wait for, the function gives the maximum: SuspicionMaxTimeoutMult times the minimum.
+*/
+const suspicionOf = (members, terms = MEMBERLIST) => {
+	const min = Math.floor(Math.max(1, Math.log10(Math.max(1, members))) * 1e3) * valueIn(terms.probeInterval, "ms") * terms.suspicionMult / 1e3;
+	return {
+		value: (members - 2 < terms.suspicionMult - 2 ? 0 : terms.suspicionMult - 2) < 1 ? min : min * terms.suspicionMaxTimeoutMult,
+		unit: "ms"
+	};
+};
+/**
+* This function gives the Helm values of the install. The values that are not the defaults of the chart:
+* - No FRR and no frr-k8s: the lab uses L2 mode only, thus it needs no BGP.
+* - A speaker only on a node with `VIP_LABEL`, the workers. Thus memberlist has the workers as its
+*   members, and the control plane does not answer ARP.
+* - The controller on the control plane. A zone loss of a worker then does not take it away.
+* - Each image from the node (`pullPolicy: Never`).
+*/
+const metallbValues = (images) => {
+	const image = (local) => {
+		const at = local.lastIndexOf(":");
+		if (at <= 0) throw new Error(`the image ${local} has no tag`);
+		return {
+			repository: local.slice(0, at),
+			tag: local.slice(at + 1),
+			pullPolicy: "Never"
+		};
+	};
+	return {
+		frrk8s: { enabled: false },
+		controller: {
+			image: image(images.controller),
+			nodeSelector: { "node-role.kubernetes.io/control-plane": "" },
+			tolerations: [{
+				key: "node-role.kubernetes.io/control-plane",
+				operator: "Exists",
+				effect: "NoSchedule"
+			}]
+		},
+		speaker: {
+			image: image(images.speaker),
+			frr: { enabled: false },
+			tolerateMaster: false,
+			nodeSelector: { [VIP_LABEL]: "1" },
+			memberlist: {
+				enabled: true,
+				mlBindPort: 7946
+			}
+		}
+	};
+};
+/** This function gives the pool of the VIP and its L2Advertisement. The pool has only the VIP. */
+const metallbObjects = (vip) => [{
+	apiVersion: "metallb.io/v1beta1",
+	kind: "IPAddressPool",
+	metadata: {
+		name: METALLB_POOL,
+		namespace: METALLB_NAMESPACE
+	},
+	spec: { addresses: [`${vip}/32`] }
+}, {
+	apiVersion: "metallb.io/v1beta1",
+	kind: "L2Advertisement",
+	metadata: {
+		name: METALLB_POOL,
+		namespace: METALLB_NAMESPACE
+	},
+	spec: { ipAddressPools: [METALLB_POOL] }
+}];
+/** This function gives the nodes in the order of the election of the owner of `vip`: by sha256(node + "#" + vip), as bytes (layer2_controller.go, lines 115–120). */
+const ownerOrder = (nodes, vip) => {
+	const hash = (node) => createHash("sha256").update(`${node}#${vip}`).digest();
+	return [...nodes].sort((a, b) => Buffer.compare(hash(a), hash(b)));
+};
+const dotted = (address) => [
+	24,
+	16,
+	8,
+	0
+].map((shift) => Math.floor(address / 2 ** shift) % 256).join(".");
+/**
+* This function gives the VIP of a subnet for MetalLB. It looks down from the sixth address from the
+* end, and it gives the first address that `owner` owns, of the nodes `nodes`. Docker gives the address of each container
+* from the start of the subnet, thus no container takes it.
+*/
+const metallbVipOf = (subnet, owner, nodes) => {
+	if (!nodes.includes(owner)) throw new Error(`the owner ${owner} is not one of the nodes ${nodes.join(", ")}`);
+	const [first, last] = cidrRange(subnet);
+	for (let address = last - 5; address > first + 1 && address > last - 260; address--) {
+		const vip = dotted(address);
+		if (ownerOrder(nodes, vip)[0] === owner) return vip;
+	}
+	throw new Error(`the subnet ${subnet} has no VIP that ${owner} owns`);
+};
+const sleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** This function waits until a condition gives null, and gives null, or the last reason after `within` ms. */
+const until = async (within, check) => {
+	const end = Date.now() + within;
+	let why = await check();
+	while (why !== null && Date.now() < end) {
+		await sleep$1(500);
+		why = await check();
+	}
+	return why;
+};
+/** This function gives the nodes that announce a Service, from the ServiceL2Status objects of the speakers. */
+const announcementsOf = async (cluster, namespace, service) => {
+	return JSON.parse(await cluster.kubectl([
+		"-n",
+		METALLB_NAMESPACE,
+		"get",
+		"servicel2statuses.metallb.io",
+		"-o",
+		"json"
+	])).items.filter((item) => item.status?.serviceName === service && item.status.serviceNamespace === namespace && typeof item.status.node === "string").map((item) => ({
+		node: item.status.node,
+		created: item.metadata?.creationTimestamp ?? null
+	})).sort((a, b) => a.node.localeCompare(b.node));
+};
+/** This function gives the nodes with a ready speaker that is not deleted. */
+const speakersReady = async (cluster) => {
+	return JSON.parse(await cluster.kubectl([
+		"-n",
+		METALLB_NAMESPACE,
+		"get",
+		"pods",
+		"-l",
+		"app.kubernetes.io/component=speaker",
+		"-o",
+		"json"
+	])).items.filter((pod) => pod.metadata.deletionTimestamp === void 0 && pod.spec.nodeName !== void 0).filter((pod) => (pod.status?.containerStatuses ?? []).length > 0 && pod.status.containerStatuses.every((status) => status.ready)).map((pod) => pod.spec.nodeName).sort();
+};
+/**
+* This function makes `owner` the only node that announces the Service, with a ready speaker on each
+* node of `nodes`. It gives null, or why it could not in `within` ms. After a heal, the other node
+* stops when it sees that the owner is alive again. The function then annotates the Service. Each
+* speaker reconciles it, and the owner sends its gratuitous ARPs for 5 s. Thus each client learns
+* the MAC address of the owner.
+*/
+const holdMetallb = async (cluster, owner, nodes, namespace, service, within = 18e4) => {
+	const ready = await until(within, async () => {
+		const found = await speakersReady(cluster);
+		const missing = nodes.filter((node) => !found.includes(node));
+		return missing.length === 0 ? null : `the speaker of MetalLB is not ready on ${missing.join(", ")}`;
+	});
+	if (ready !== null) return ready;
+	const sole = await until(within, async () => {
+		const found = (await announcementsOf(cluster, namespace, service)).map((each) => each.node);
+		return found.length === 1 && found[0] === owner ? null : `the Service ${service} is announced by ${found.join(", ") || "no node"}, not only by ${owner}`;
+	});
+	if (sole !== null) return sole;
+	await cluster.kubectl([
+		"-n",
+		namespace,
+		"annotate",
+		"service",
+		service,
+		`${ANNOUNCE_ANNOTATION}=${Date.now()}`,
+		"--overwrite"
+	]);
+	return null;
+};
+/**
+* This function installs MetalLB in a cluster, with its images on each node, the speakers on `nodes`,
+* and a pool of the VIP. The webhook of the controller checks the pool, thus the function tries the
+* pool again until the webhook answers. A failed install gives the pods of MetalLB and the tail of
+* their logs.
+*/
+const installMetallb = async (cluster, images, nodes, vip) => {
+	try {
+		for (const node of nodes) await cluster.kubectl([
+			"label",
+			"node",
+			node,
+			`${VIP_LABEL}=1`,
+			"--overwrite"
+		]);
+		await helmInstall(cluster, "metallb", METALLB_CHART, METALLB_NAMESPACE, metallbValues(images), { createNamespace: true });
+		let failure = null;
+		const end = Date.now() + 18e4;
+		do {
+			failure = await cluster.apply(metallbObjects(vip)).then(() => null, (error) => error);
+			if (failure !== null) await sleep$1(2e3);
+		} while (failure !== null && Date.now() < end);
+		if (failure !== null) throw failure;
+		if ((await cluster.kubectl([
+			"-n",
+			"metallb-system",
+			"get",
+			"configmap",
+			"metallb-memberlist-config",
+			"--ignore-not-found",
+			"-o",
+			"name"
+		])).trim() !== "") throw new Error("the ConfigMap metallb-memberlist-config is there: memberlist would not use its defaults");
+	} catch (error) {
+		const state = async (args) => (await cluster.kubectl([
+			"-n",
+			METALLB_NAMESPACE,
+			...args
+		]).catch((why) => String(why))).slice(-4e3);
+		const pods = await state([
+			"get",
+			"pods",
+			"-o",
+			"wide"
+		]);
+		const logs = await state([
+			"logs",
+			"-l",
+			"app.kubernetes.io/name=metallb",
+			"--tail=40",
+			"--prefix",
+			"--all-containers"
+		]);
+		throw new Error(`the install of MetalLB failed: ${String(error)}\nthe pods of MetalLB:\n${pods}\nthe logs:\n${logs}`);
+	}
+};
+/** These words mark the lines of a speaker that the record keeps: the events of memberlist, the announces and the withdraws. */
+const KEPT = /node event|Marking|Suspect|Refuting|serviceAnnounced|serviceWithdrawn|memberlist/;
+/**
+* This function gives the record of MetalLB after a run: the nodes that announce the Service, and
+* some lines of each speaker. The lines are about memberlist and the announces, with the times of the kubelet.
+*/
+const metallbRecord = async (cluster, namespace, service) => {
+	return {
+		announcements: await announcementsOf(cluster, namespace, service),
+		log: (await cluster.kubectl([
+			"-n",
+			METALLB_NAMESPACE,
+			"logs",
+			"-l",
+			"app.kubernetes.io/component=speaker",
+			"-c",
+			"speaker",
+			"--since=300s",
+			"--tail=4000",
+			"--prefix",
+			"--timestamps"
+		]).catch((error) => String(error))).split("\n").filter((line) => KEPT.test(line)).slice(-120).join("\n").slice(-12e3)
+	};
+};
+//#endregion
+//#region src/announcer.ts
+const local = (images, name) => {
+	const image = images[name];
+	if (image === void 0) throw new Error(`the run has no local image of ${name}`);
+	return image;
+};
+/** This announcer is kube-vip 1.3.1 in ARP mode, with one Lease for each VIP of a Service (`kubevip.ts`). */
+const KUBE_VIP_ANNOUNCER = {
+	name: "kube-vip",
+	images: { [KUBE_VIP]: KUBE_VIP_IMAGE },
+	service: {
+		loadBalancerClass: LB_CLASS,
+		annotation: VIP_ANNOTATION
+	},
+	settle: KUBE_VIP_ARP_RATE,
+	vipOf: (subnet) => vipOf(subnet),
+	install: (cluster, images, owner, nodes) => installKubeVip(cluster, local(images, KUBE_VIP), owner, nodes),
+	hold: (cluster, owner, nodes) => holdVip(cluster, owner, nodes),
+	record: async (cluster) => {
+		return {
+			lease: await vipLeaseOf(cluster),
+			log: (await cluster.kubectl([
+				"-n",
+				KUBE_VIP_LEASE.namespace,
+				"logs",
+				"-l",
+				`app.kubernetes.io/name=${KUBE_VIP}`,
+				"--tail=30",
+				"--prefix",
+				"--timestamps"
+			]).catch((error) => String(error))).slice(-6e3)
+		};
+	}
+};
+/** This announcer is MetalLB 0.16.1 in L2 mode, with its speakers in memberlist (`metallb.ts`). */
+const METALLB_ANNOUNCER = {
+	name: "metallb",
+	images: {
+		"metallb-speaker": METALLB_IMAGES.speaker,
+		"metallb-controller": METALLB_IMAGES.controller
+	},
+	service: {
+		loadBalancerClass: null,
+		annotation: METALLB_ANNOTATION
+	},
+	settle: METALLB_SPAM.for,
+	vipOf: (subnet, owner, nodes) => metallbVipOf(subnet, owner, nodes),
+	install: (cluster, images, _owner, nodes, vip) => installMetallb(cluster, {
+		speaker: local(images, "metallb-speaker"),
+		controller: local(images, "metallb-controller")
+	}, nodes, vip),
+	hold: (cluster, owner, nodes, namespace, service) => holdMetallb(cluster, owner, nodes, namespace, service),
+	record: (cluster, namespace, service) => metallbRecord(cluster, namespace, service)
+};
+/** This function gives the announcer of the VIP of a cell: kube-vip when the cell names none. */
+const announcerOf = (cell) => cell.vip?.announcer === "metallb" ? METALLB_ANNOUNCER : KUBE_VIP_ANNOUNCER;
+/** This function gives null if each client sends to `mac`, or the clients that do not. */
+const macsAt = (found, mac, count) => {
+	const wrong = found.filter((each) => each.mac !== mac);
+	if (found.length !== count) return `${found.length} clients outside answer, not ${count}`;
+	return wrong.length === 0 ? null : wrong.map((each) => `${each.client} has ${each.mac ?? "no MAC"}`).join(", ");
+};
+//#endregion
 //#region src/lds.ts
 /**
 * This filter of RE2 selects the two counters of the listener manager of Envoy that an update of LDS
@@ -2275,6 +3093,18 @@ const KEPT_KERNEL = /* @__PURE__ */ new Set([
 ]);
 /** This function tells if the lab keeps a kernel record of the prober. */
 const keptKernel = (record) => KEPT_KERNEL.has(String(record["ev"])) || isTunnelState(record);
+/**
+* This function gives the MAC address of `ip` in a table of /proc/net/arp, in lower case. It gives
+* null if the table has no row for `ip`, or if the row has the flags 0x0: no MAC yet. The ARP watch
+* of `client.mjs` reads the table the same way.
+*/
+const arpMacOf = (table, ip) => {
+	for (const row of table.split("\n").slice(1)) {
+		const [address, , flags, mac] = row.trim().split(/\s+/);
+		if (address === ip) return flags === "0x0" || mac === void 0 ? null : mac.toLowerCase();
+	}
+	return null;
+};
 /** This container class can share the process namespace of another container. */
 const shared = async () => {
 	const { GenericContainer } = await import("testcontainers");
@@ -2335,6 +3165,11 @@ const openKindLab = async (cluster, image) => {
 	const opened = [];
 	let watcher = null;
 	let prober = null;
+	let outsiders = [];
+	const stopOutside = async () => {
+		for (const container of outsiders) await container.stop({ timeout: 0 }).catch(() => void 0);
+		outsiders = [];
+	};
 	try {
 		for (const node of cluster.nodes) {
 			const agent = await new Shared(image).withPidMode(`container:${node}`).withPrivilegedMode().withNetworkMode("none").withEnvironment({ NODE_NAME: node }).withCommand([
@@ -2401,7 +3236,8 @@ const openKindLab = async (cluster, image) => {
 			return [
 				...opened,
 				...watcher === null ? [] : [watcher],
-				...prober === null ? [] : [prober]
+				...prober === null ? [] : [prober],
+				...outsiders
 			].map((container) => container.getName().replace(/^\//, ""));
 		},
 		take() {
@@ -2448,6 +3284,32 @@ const openKindLab = async (cluster, image) => {
 			})).start();
 			await Promise.race([ready, new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error("no begin line from the prober in 60 s")), 6e4))]);
 		},
+		async outside(spec) {
+			await stopOutside();
+			if (spec === null) return;
+			for (let k = 0; k < spec.count; k += 1) {
+				const client = await new GenericContainer(image).withNetworkMode(cluster.network).withEnvironment({
+					TARGET: spec.target,
+					EVERY_MS: String(valueIn(spec.every, "ms")),
+					TIMEOUT_MS: String(valueIn(spec.timeout, "ms")),
+					POD_NAME: `${OUTSIDE}-${k}`,
+					NODE_NAME: OUTSIDE,
+					ARP_WATCH: spec.arp
+				}).withCommand(["node", "client.mjs"]).withLogConsumer(consume((line) => push(line))).start();
+				outsiders.push(client);
+			}
+		},
+		async outsideMacs(ip) {
+			const found = [];
+			for (const [k, client] of outsiders.entries()) {
+				const { output } = await client.exec(["cat", "/proc/net/arp"]);
+				found.push({
+					client: `${OUTSIDE}-${k}`,
+					mac: arpMacOf(output, ip)
+				});
+			}
+			return found;
+		},
 		async stopProbe() {
 			if (prober !== null) await prober.stop({ timeout: 0 }).catch(() => void 0);
 			prober = null;
@@ -2634,6 +3496,7 @@ const openKindLab = async (cluster, image) => {
 		},
 		async close() {
 			await lab.stopProbe();
+			await stopOutside();
 			if (watcher !== null) await watcher.stop({ timeout: 0 }).catch(() => void 0);
 			watcher = null;
 			for (const container of opened.reverse()) await container.stop({ timeout: 0 }).catch(() => void 0);
@@ -2853,14 +3716,57 @@ const preStopOf = (preStop, grace) => {
 		`sleep ${preStop}`
 	] } } } };
 };
+/** This affinity keeps a pod in the zone that a zone loss keeps. */
+const keptZone = { nodeAffinity: { requiredDuringSchedulingIgnoredDuringExecution: { nodeSelectorTerms: [{ matchExpressions: [{
+	key: ZONE_LABEL,
+	operator: "NotIn",
+	values: [ZONE_LOST]
+}] }] } } };
+/**
+* This function gives the Service of a VIP (`announcer.ts`). It is of type LoadBalancer, with the
+* class of its announcer, if the announcer has one. The annotation of the announcer has the address
+* of the VIP. Without `service`, the announcer is kube-vip. The policy `Cluster` lets each node
+* send a request to a replica on another node. The holder writes the address to the status of the
+* Service. Then kube-proxy has the rules of the address on each node.
+*/
+const vipService = (namespace, vip, ports, service = {
+	loadBalancerClass: LB_CLASS,
+	annotation: VIP_ANNOTATION
+}) => ({
+	apiVersion: "v1",
+	kind: "Service",
+	metadata: {
+		name: "lab",
+		namespace,
+		annotations: { [service.annotation]: vip }
+	},
+	spec: {
+		type: "LoadBalancer",
+		...service.loadBalancerClass === null ? {} : { loadBalancerClass: service.loadBalancerClass },
+		externalTrafficPolicy: "Cluster",
+		selector: { app: "lab" },
+		ports
+	}
+});
 /**
 * These are the objects of the server: a Service of type ClusterIP, and the Deployment with the
 * settings of the cell. The image is the lab image for the service, or the image of grpc-go.
+*
+* With a VIP (`KindCell.vip`), the Service is of type LoadBalancer, with the address `vip` and the
+* class of its announcer (`vipService`). No replica is in the lost zone. Thus a zone loss takes away
+* only the holder of the VIP.
 */
-const serverObjects = (cell, namespace, image, version = 1) => {
+const serverObjects = (cell, namespace, image, version = 1, vip = null) => {
 	const preStop = whole(cell.pod.preStop, "the preStop sleep");
 	const grace = whole(cell.pod.grace, "the grace period");
-	return [{
+	if (cell.vip !== void 0 && vip === null) throw new Error(`${cell.name}: a cell with a VIP needs the address of the VIP`);
+	const ports = [{
+		name: stackOf(cell) === "grpc" ? "grpc" : "http",
+		port: 80,
+		targetPort: PORT
+	}];
+	const zoneLoss = cell.trigger.kind === "zone-loss";
+	return [vip === null ? {
 		apiVersion: "v1",
 		kind: "Service",
 		metadata: {
@@ -2869,13 +3775,9 @@ const serverObjects = (cell, namespace, image, version = 1) => {
 		},
 		spec: {
 			selector: { app: "lab" },
-			ports: [{
-				name: stackOf(cell) === "grpc" ? "grpc" : "http",
-				port: 80,
-				targetPort: PORT
-			}]
+			ports
 		}
-	}, {
+	} : vipService(namespace, vip, ports, announcerOf(cell).service), {
 		apiVersion: "apps/v1",
 		kind: "Deployment",
 		metadata: {
@@ -2908,12 +3810,13 @@ const serverObjects = (cell, namespace, image, version = 1) => {
 						topologyKey: "kubernetes.io/hostname",
 						whenUnsatisfiable: "ScheduleAnyway",
 						labelSelector: { matchLabels: { app: "lab" } }
-					}, ...cell.trigger.kind === "zone-loss" ? [{
+					}, ...zoneLoss && cell.vip === void 0 ? [{
 						maxSkew: 1,
 						topologyKey: ZONE_LABEL,
 						whenUnsatisfiable: "DoNotSchedule",
 						labelSelector: { matchLabels: { app: "lab" } }
 					}] : []],
+					...zoneLoss && cell.vip !== void 0 ? { affinity: keptZone } : {},
 					containers: [{
 						name: "app",
 						image,
@@ -2955,11 +3858,7 @@ const clientObjects = (cell, namespace, image, target) => [{
 					operator: "Exists",
 					effect: "NoSchedule"
 				}],
-				...cell.trigger.kind === "zone-loss" ? { affinity: { nodeAffinity: { requiredDuringSchedulingIgnoredDuringExecution: { nodeSelectorTerms: [{ matchExpressions: [{
-					key: ZONE_LABEL,
-					operator: "NotIn",
-					values: [ZONE_LOST]
-				}] }] } } } } : {},
+				...cell.trigger.kind === "zone-loss" ? { affinity: keptZone } : {},
 				containers: [{
 					name: CLIENT,
 					image,
@@ -3288,7 +4187,7 @@ const hasRedis = (cell) => cell.declaration !== null && cell.declaration.redis !
 * This function gives the key of the cluster of a cell: its kube-proxy mode, its node count, and the
 * flavor of its mesh. A zone loss has clusters of its own, with a zone on each node.
 */
-const clusterKey = (cell) => cell.mesh !== void 0 ? `${cell.mode}-${cell.workers}-${cell.mesh.flavor}` : zoned(cell) ? `${cell.mode}-${cell.workers}-zones` : `${cell.mode}-${cell.workers}`;
+const clusterKey = (cell) => (cell.mesh !== void 0 ? `${cell.mode}-${cell.workers}-${cell.mesh.flavor}` : zoned(cell) ? `${cell.mode}-${cell.workers}-zones` : `${cell.mode}-${cell.workers}`) + (cell.vip === void 0 ? "" : cell.vip.announcer === "metallb" ? "-vip-mlb" : "-vip");
 /** This function tells if a cell needs a cluster with zones: a zone loss. */
 const zoned = (cell) => cell.trigger.kind === "zone-loss";
 /**
@@ -3353,8 +4252,12 @@ const unsteady = (ctx) => {
 		for (const node of ctx.cluster.nodes) if ((tracker.hosts.get(node) ?? []).join() !== expected) return `the client sidecar of ${node} has ${(tracker.hosts.get(node) ?? []).join(" ") || "no host"}`;
 	}
 	const nodes = new Set([...tracker.clients.values()].map((client) => client.node));
-	const clientNodes = ctx.cluster.nodes.length - (cell.trigger.kind === "zone-loss" ? 1 : 0);
+	const clientNodes = ctx.cluster.nodes.length - (cell.trigger.kind === "zone-loss" ? 1 : 0) + (cell.vip === void 0 ? 0 : 1);
 	if (nodes.size !== clientNodes) return `clients answer on ${nodes.size} nodes, not ${clientNodes}`;
+	if (cell.vip !== void 0) {
+		const outside = [...tracker.clients.values()].filter((client) => client.node === OUTSIDE).length;
+		if (outside !== cell.vip.clients) return `${outside} clients outside answer, not ${cell.vip.clients}`;
+	}
 	for (const [pod, client] of tracker.clients) {
 		if (tracker.last - client.ok > 1e3) return `client ${pod} has no answer in the last second`;
 		if (tracker.last - client.failed < 2e3) return `client ${pod} failed in the last 2 s`;
@@ -3457,7 +4360,7 @@ const quiet = async (ctx, ours, within = QUIET_WITHIN) => {
 * clients. A client of gRPC starts after the server is ready: each failed connect of a channel makes
 * the backoff of grpc-js longer, up to 120 s.
 */
-const deploy = async (lab, cluster, cell, namespace, images) => {
+const deploy = async (lab, cluster, cell, namespace, images, vip) => {
 	await cluster.apply([namespaceObject(cell, namespace)]);
 	await lab.watch([namespace], { ztunnel: followsZtunnel(cell) });
 	if (hasRedis(cell)) {
@@ -3473,7 +4376,7 @@ const deploy = async (lab, cluster, cell, namespace, images) => {
 	}
 	const grpc = stackOf(cell) === "grpc";
 	if (grpc && images.grpc === void 0) throw new Error(`${cell.name}: the cluster has no image of grpc-go`);
-	await cluster.apply(serverObjects(cell, namespace, grpc ? images.grpc : lab.image));
+	await cluster.apply(serverObjects(cell, namespace, grpc ? images.grpc : lab.image, 1, cell.vip === void 0 ? null : vip));
 	const clusterIp = (await cluster.kubectl([
 		"-n",
 		namespace,
@@ -3502,6 +4405,18 @@ const deploy = async (lab, cluster, cell, namespace, images) => {
 		`daemonset/${CLIENT}`,
 		"--timeout=300s"
 	]);
+	if (cell.vip !== void 0) {
+		if (vip === null) throw new Error(`${cell.name}: the cluster has no VIP`);
+		const served = await vipServed(cluster, namespace, "lab", vip);
+		if (served !== null) throw new Error(`${cell.name}: ${served}`);
+		await lab.outside({
+			target: `${vip}:80`,
+			every: cell.workload.every,
+			timeout: cell.workload.timeout,
+			count: cell.vip.clients,
+			arp: vip
+		});
+	}
 	await lab.rules({
 		mode: cluster.scenario.dataplane,
 		ns: namespace,
@@ -3938,6 +4853,31 @@ const doStep = async (ctx, step, replicas, background) => {
 };
 /** This function gives the node of the lost zone: the last worker (`zoneOf`). */
 const lostNodeOf = (cluster) => cluster.nodes.at(-1);
+/** This function gives the workers of a cluster: each node but the control plane, the first (`nodeNames`). */
+const workersOf = (cluster) => cluster.nodes.slice(1);
+/**
+* This function adds a line `vip` to the lines. The line has the state of the announcer, the MAC
+* address of each node on the Docker network, and the name of the announcer. The state of kube-vip
+* is its Lease. The state of MetalLB is the nodes that announce the Service. It also has the wall clock of the runner with its CLOCK_MONOTONIC. The times of the
+* Lease and of the logs are on the wall clock, and each stamp of the lab is on CLOCK_MONOTONIC. The containers of
+* the runner share one kernel, thus the pair converts one into the other.
+*/
+const recordVip = async (ctx) => {
+	const wall = Date.now();
+	const t = Number(process.hrtime.bigint()) / 1e6;
+	const announcer = announcerOf(ctx.cell);
+	const state = await announcer.record(ctx.cluster, ctx.namespace, "lab");
+	const { macs } = await vipNetworkOf(ctx.cluster.network);
+	ctx.lab.record({
+		ev: "vip",
+		t,
+		wall,
+		vip: ctx.vip,
+		announcer: announcer.name,
+		...state,
+		macs
+	});
+};
 /** This function puts the replicas of a node first, and keeps the sequence of the others. */
 const lostFirst = (replicas, node) => [...replicas.filter((replica) => replica.node === node), ...replicas.filter((replica) => replica.node !== node)];
 /** This function tells if a run is over: the trigger is done, and the cell is at rest again. */
@@ -3969,7 +4909,6 @@ const stoppedOf = (cell, replicas, target, lines) => deletes(cell) ? replicas.fi
 const runOnce = async (ctx, env, index, warmup, ours) => {
 	const { lab, cell, cluster, namespace } = ctx;
 	const plan = planOf(cell);
-	const atRest = await steady(ctx, 3e5);
 	const empty = (why, start) => ({
 		env,
 		index,
@@ -3988,6 +4927,7 @@ const runOnce = async (ctx, env, index, warmup, ours) => {
 		lines: lab.take(),
 		dropped: {}
 	});
+	const atRest = await steady(ctx, 3e5);
 	if (atRest !== null) return empty(`the cell was not at rest: ${atRest}`, await lab.now());
 	await probeThePods(ctx);
 	await pollListeners(ctx);
@@ -3999,11 +4939,28 @@ const runOnce = async (ctx, env, index, warmup, ours) => {
 	const zoneLoss = cell.trigger.kind === "zone-loss";
 	const lost = zoneLoss ? await nodeSteady(cluster, lostNodeOf(cluster), 3e5) : null;
 	if (lost !== null) return empty(`the node of the lost zone was not at rest: ${lost}`, await lab.now());
+	if (cell.vip !== void 0) {
+		const announcer = announcerOf(cell);
+		const holder = lostNodeOf(cluster);
+		const held = await announcer.hold(cluster, holder, workersOf(cluster), ctx.namespace, "lab");
+		if (held !== null) return empty(`the VIP is not on ${holder}: ${held}`, await lab.now());
+		if (ctx.vip === null) return empty(`${cell.name}: the cluster has no VIP`, await lab.now());
+		const mac = (await vipNetworkOf(cluster.network)).macs[holder];
+		if (mac === void 0) return empty(`the node ${holder} has no MAC address on the Docker network`, await lab.now());
+		const end = Date.now() + valueIn(announcer.settle, "ms") + 1e4;
+		let moved = macsAt(await lab.outsideMacs(ctx.vip), mac, cell.vip.clients);
+		while (moved !== null && Date.now() < end) {
+			await sleep(250);
+			moved = macsAt(await lab.outsideMacs(ctx.vip), mac, cell.vip.clients);
+		}
+		if (moved !== null) return empty(`the clients outside do not send to ${holder} (${mac}): ${moved}`, await lab.now());
+		await sleep(valueIn(announcer.settle, "ms") + valueIn(cell.workload.timeout, "ms") + 1e3);
+	}
 	if (await steady(ctx, 3e5) !== null) return empty("the cell was not at rest after the wait for a quiet VM", await lab.now());
 	const replicas = zoneLoss ? lostFirst(replicasOf(ctx), lostNodeOf(cluster)) : replicasOf(ctx);
-	if (zoneLoss && replicas[0]?.node !== lostNodeOf(cluster)) return empty(`no replica is on the node of the lost zone, ${lostNodeOf(cluster)}`, await lab.now());
+	if (zoneLoss && cell.vip === void 0 && replicas[0]?.node !== lostNodeOf(cluster)) return empty(`no replica is on the node of the lost zone, ${lostNodeOf(cluster)}`, await lab.now());
 	const restarts = new Map(ctx.tracker.servers().map((pod) => [pod.name, pod.cs.reduce((sum, status) => sum + status.rc, 0)]));
-	const target = hasRedis(cell) && [
+	const target = cell.vip !== void 0 || hasRedis(cell) && [
 		"rst",
 		"blackhole",
 		"freeze-process",
@@ -4103,6 +5060,7 @@ const runOnce = async (ctx, env, index, warmup, ours) => {
 	}
 	const end = await lab.now();
 	const timedOut = Date.now() >= limit;
+	if (cell.vip !== void 0) await recordVip(ctx).catch((error) => notes.push(`the record of the VIP failed: ${String(error)}`));
 	for (const step of plan.restore) try {
 		await doStep(ctx, step, replicas, background);
 	} catch (error) {
@@ -4220,6 +5178,13 @@ const runKindCells = async (cells, options) => {
 		operator: await localPin(CILIUM_IMAGES.operator),
 		envoy: await localPin(CILIUM_IMAGES.envoy)
 	} : void 0;
+	const announcerImages = /* @__PURE__ */ new Map();
+	for (const announcer of [KUBE_VIP_ANNOUNCER, METALLB_ANNOUNCER]) {
+		if (!cells.some((cell) => cell.vip !== void 0 && announcerOf(cell).name === announcer.name)) continue;
+		const pinned = {};
+		for (const [name, ref] of Object.entries(announcer.images)) pinned[name] = await localPin(ref);
+		announcerImages.set(announcer.name, pinned);
+	}
 	const images = {
 		lab: image,
 		redis: redisImage,
@@ -4265,6 +5230,17 @@ const runKindCells = async (cells, options) => {
 					await installMesh(cluster, mesh.flavor, images.mesh);
 					options.log(`  Istio ${mesh.flavor} installed in ${Math.round((Date.now() - began) / 100) / 10} s`);
 				}
+				let vip = null;
+				if (group[0].vip !== void 0) {
+					const announcer = announcerOf(group[0]);
+					const pinned = announcerImages.get(announcer.name);
+					if (pinned === void 0) throw new Error(`${group[0].name}: the run has no images of ${announcer.name}`);
+					for (const each of Object.values(pinned)) await cluster.load(each);
+					const began = Date.now();
+					vip = announcer.vipOf((await vipNetworkOf(cluster.network)).subnet, lostNodeOf(cluster), workersOf(cluster));
+					await announcer.install(cluster, pinned, lostNodeOf(cluster), workersOf(cluster), vip);
+					options.log(`  ${announcer.name} installed in ${Math.round((Date.now() - began) / 100) / 10} s, the VIP ${vip}`);
+				}
 				lab = await openKindLab(cluster, image);
 				const { GenericContainer } = await import("testcontainers");
 				const Shared = class extends GenericContainer {
@@ -4285,7 +5261,7 @@ const runKindCells = async (cells, options) => {
 					const ztunnelEnv = cell.mesh?.ztunnel;
 					try {
 						if (ztunnelEnv !== void 0) await setZtunnelEnv(cluster, ztunnelEnv, false);
-						const clusterIp = await deploy(lab, cluster, cell, namespace, images);
+						const clusterIp = await deploy(lab, cluster, cell, namespace, images, vip);
 						for (const name of [...lab.own(), loader.getName().replace(/^\//, "")]) ours.add(name);
 						const ctx = {
 							lab,
@@ -4294,6 +5270,7 @@ const runKindCells = async (cells, options) => {
 							namespace,
 							tracker,
 							clusterIp,
+							vip: cell.vip === void 0 ? null : vip,
 							loads,
 							loader,
 							idle: options.idle ?? .6,
@@ -4322,7 +5299,8 @@ const runKindCells = async (cells, options) => {
 								redis: redisImage,
 								...stackOf(cell) === "grpc" ? { grpc: grpcImage } : {},
 								...cell.mesh === void 0 ? {} : Object.fromEntries(MESH_IMAGES[cell.mesh.flavor].map((name) => [`istio-${name}`, ISTIO_IMAGES[name]])),
-								...s.cni === "cilium" ? Object.fromEntries(Object.entries(CILIUM_IMAGES).map(([name, ref]) => [`cilium-${name}`, ref])) : {}
+								...s.cni === "cilium" ? Object.fromEntries(Object.entries(CILIUM_IMAGES).map(([name, ref]) => [`cilium-${name}`, ref])) : {},
+								...cell.vip === void 0 ? {} : announcerOf(cell).images
 							}
 						});
 						entry.loads.push(...loads);
@@ -4336,6 +5314,7 @@ const runKindCells = async (cells, options) => {
 						}));
 					} finally {
 						off();
+						await lab.outside(null).catch(() => void 0);
 						await lab.rules(null).catch(() => void 0);
 						await lab.eds(null).catch(() => void 0);
 						await lab.lds(null).catch(() => void 0);
@@ -4395,8 +5374,8 @@ const estimate = (cell, environments = 2) => {
 	const observed = after === null ? 0 : hold + valueIn(after, "s");
 	const closes = cell.prediction.kind === "ends" && cell.prediction.band !== null ? valueIn(cell.prediction.band.hi, "s") + 3 : 0;
 	const quiet = cell.trigger.quiet === true ? hold + 10 : 0;
-	const each = 25 + Math.max(observed, closes, quiet, trigger[cell.trigger.kind] ?? (cell.template === "T18" ? hold + 35 : 15 + valueIn(cell.pod.preStop, "s")));
-	return (cell.mesh === void 0 ? 60 : 180) * environments + (cell.runs + environments) * each;
+	const each = 25 + (cell.vip === void 0 ? 0 : 30) + Math.max(observed, closes, quiet, trigger[cell.trigger.kind] ?? (cell.template === "T18" ? hold + 35 : 15 + valueIn(cell.pod.preStop, "s")));
+	return ((cell.mesh === void 0 ? 60 : 180) + (cell.vip === void 0 ? 0 : 60)) * environments + (cell.runs + environments) * each;
 };
 /**
 * This function gives an estimate of the time of a cell: its setup, then each run and each
@@ -4427,6 +5406,6 @@ const shardOf = (cells, index, count) => {
 	return out;
 };
 //#endregion
-export { ACCESS_LOG_FORMAT, CHANNEL_USE, CILIUM_CHART, CILIUM_CONFIG_KEYS, CILIUM_IMAGES, CILIUM_VERSION, CILIUM_WORKLOADS, CLIENT, CLIENT_ACCOUNT, CLOSE_LEAD, CONTROLLER, DATAPLANES, DNS_PORT, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HBONE_PORT, HEALTH_PORT, HELM, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, LAST_SLACK, LDS_EVERY, LDS_FILTER, LOG_LABEL, MESH_IMAGES, MESH_WORKLOADS, MIDDLEBOX, NETEM_DRAIN, NETNS_DEFAULTS, NODE_IMAGES, NODE_LIFECYCLE, O04, O09, O10, O16, POD_LINK, POLICY, PORT, QUIET_LEAD, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, SPREAD_LEAD, STAGES, SYSCTL, TCP_STATE, WATCHDOG, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZTUNNEL_PODS, backendsAt, backendsOf, backlogEnd, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, certificateArgs, checkRun, cidrOverlap, cidrRange, ciliumBackendsOf, ciliumMode, ciliumValues, clientObjects, clusterFilter, compose, createCluster, cyclesOf, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dnsCommands, drainBand, dropOf, emptyOf, ensureChart, ensureTool, estimatedTime, factsOf, failuresOf, faultSpan, followsZtunnel, goDuration, hostsOf, installCilium, installMesh, intakeAfter, intakeOf, isKubeProxyMode, isTunnelState, istioOperator, judge, judgeKind, keptKernel, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeletBand, labImage, labSource, latchBand, leafCertificates, learnWindow, lintCell, listenerCountsOf, localPin, medianInterval, medianText, meshKey, middle, middleboxCommands, namesService, namespaceObject, namespaceOf, nodeLossBand, nodeNames, nodeReturnBand, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, overshootBand, pausedWindow, periodOf, placementOf, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestBand, requestsOf, restartBand, restartOf, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sessionsAt, setZtunnelEnv, sha256, shardOf, sharedGate, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stackOf, stageLabImage, stallRemovalBand, stopOf, stoppingOf, sysctlCommand, tarEntry, timeSpread, toolPath, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, writeResult, zoneOf, ztunnelCertificates, ztunnelEnvArgs, ztunnelPodsOf, ztunnelReplaced };
+export { ACCESS_LOG_FORMAT, ANNOUNCE_ANNOTATION, CHANNEL_USE, CILIUM_CHART, CILIUM_CONFIG_KEYS, CILIUM_IMAGES, CILIUM_VERSION, CILIUM_WORKLOADS, CLIENT, CLIENT_ACCOUNT, CLOSE_LEAD, CONTROLLER, DATAPLANES, DNS_PORT, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HBONE_PORT, HEALTH_PORT, HELM, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, KUBE_VIP, KUBE_VIP_ANNOUNCER, KUBE_VIP_ARP_RATE, KUBE_VIP_ELECTION, KUBE_VIP_IMAGE, KUBE_VIP_LEASE, KUBE_VIP_VERSION, LAST_SLACK, LB_CLASS, LDS_EVERY, LDS_FILTER, LOG_LABEL, MEMBERLIST, MESH_IMAGES, MESH_WORKLOADS, METALLB_ANNOTATION, METALLB_ANNOUNCER, METALLB_CHART, METALLB_IMAGES, METALLB_NAMESPACE, METALLB_POOL, METALLB_SPAM, METALLB_VERSION, MIDDLEBOX, NETEM_DRAIN, NETNS_DEFAULTS, NODE_IMAGES, NODE_LIFECYCLE, O04, O09, O10, O16, OUTSIDE, POD_LINK, POLICY, PORT, QUIET_LEAD, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, SPREAD_LEAD, STAGES, SYSCTL, TCP_STATE, VIP_ANNOTATION, VIP_LABEL, WATCHDOG, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZTUNNEL_PODS, announcementsOf, announcerOf, arpMacOf, backendsAt, backendsOf, backlogEnd, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, certificateArgs, checkRun, cidrOverlap, cidrRange, ciliumBackendsOf, ciliumMode, ciliumValues, clientObjects, clusterFilter, compose, createCluster, cyclesOf, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dnsCommands, drainBand, dropOf, emptyOf, ensureChart, ensurePinnedChart, ensureTool, estimatedTime, factsOf, failuresOf, faultSpan, followsZtunnel, goDuration, helmInstall, holdMetallb, holdVip, hostsOf, installCilium, installKubeVip, installMesh, installMetallb, intakeAfter, intakeOf, isKubeProxyMode, isTunnelState, istioOperator, judge, judgeKind, keptKernel, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeVipObjects, kubeVipPods, kubeVipReady, kubeletBand, labImage, labSource, latchBand, leafCertificates, learnWindow, lintCell, listenerCountsOf, localPin, macsAt, medianInterval, medianText, meshKey, metallbObjects, metallbRecord, metallbValues, metallbVipOf, middle, middleboxCommands, namesService, namespaceObject, namespaceOf, nodeLossBand, nodeNames, nodeReturnBand, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, overshootBand, ownerOrder, pausedWindow, periodOf, placementOf, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestBand, requestsOf, restartBand, restartOf, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sessionsAt, setZtunnelEnv, sha256, shardOf, sharedGate, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, speakersReady, stackOf, stageLabImage, stallRemovalBand, stopOf, stoppingOf, suspicionOf, sysctlCommand, tarEntry, timeSpread, toolPath, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, vipLeaseOf, vipNetworkOf, vipOf, vipServed, vipService, writeResult, zoneOf, ztunnelCertificates, ztunnelEnvArgs, ztunnelPodsOf, ztunnelReplaced };
 
 //# sourceMappingURL=index.js.map