@mark1russell7/kind 0.13.2 → 0.13.3

package/build/index.js

@@ -1,4 +1,4 @@
-import { $ as signalsOf, A as HBONE_PORT, At as secondsOf, B as isTunnelState, C as observationEnd, Ct as VIP_ANNOTATION, D as reusesReset, Dt as overshootBand, E as referenceOf, Et as drainBand, F as deletionOf, G as podsOf, H as outcomesOf, I as dropOf, J as restartOf, K as recordsOf, L as emptyOf, M as backendsAt, N as byClients, O as unitOf, Ot as requestBand, P as byNode, Q as signalOf, R as failuresOf, S as observationAfter, St as SERVER, T as propagationSource, Tt as bandOf, U as periodOf, V as kernelCounts, W as podsAt, X as rulesOf, Y as restartsAt, Z as sessionsAt, _ as checkRun, _t as LB_CLASS, a as calibrationOf, at as socketsOf, b as factsOf, bt as PORT, c as predictionText, ct as tunnelsOf, d as FORMAT_V1, dt as RELATIVE, et as sliceDropOf, f as judge, ft as medianInterval, g as LAST_SLACK, gt as HEALTH_PORT, h as KIND_NOISE, ht as CLIENT, i as readRecord, it as slicesOf, j as TCP_STATE, jt as showBand, k as updatesOf, kt as seconds, l as timeSpread, lt as ztunnelPodsOf, m as upgradeCell, mt as quantileOf, n as kindCellRecordSchema, nt as sliceReadyAt, o as cellsTable, ot as stoppingOf, p as upgrade, pt as middle, q as requestsOf, r as kindCellRecordV1Schema, rt as sliceReadyOf, s as medianText, st as transitionOf, t as STAGES, tt as sliceEmptyOf, u as FORMAT, ut as ztunnelReplaced, v as cyclesOf, vt as LOG_LABEL, w as propagationOf, wt as backlogEnd, x as judgeKind, xt as REDIS, y as deletionsOf, yt as OUTSIDE, z as intakeOf } from "./judge-C7Zr4KoS.js";
+import { $ as signalsOf, A as HBONE_PORT, At as secondsOf, B as isTunnelState, C as observationEnd, Ct as VIP_ANNOTATION, D as reusesReset, Dt as overshootBand, E as referenceOf, Et as drainBand, F as deletionOf, G as podsOf, H as outcomesOf, I as dropOf, J as restartOf, K as recordsOf, L as emptyOf, M as backendsAt, N as byClients, O as unitOf, Ot as requestBand, P as byNode, Q as signalOf, R as failuresOf, S as observationAfter, St as SERVER, T as propagationSource, Tt as bandOf, U as periodOf, V as kernelCounts, W as podsAt, X as rulesOf, Y as restartsAt, Z as sessionsAt, _ as checkRun, _t as LB_CLASS, a as calibrationOf, at as socketsOf, b as factsOf, bt as PORT, c as predictionText, ct as tunnelsOf, d as FORMAT_V1, dt as RELATIVE, et as sliceDropOf, f as judge, ft as medianInterval, g as LAST_SLACK, gt as HEALTH_PORT, h as KIND_NOISE, ht as CLIENT, i as readRecord, it as slicesOf, j as TCP_STATE, jt as showBand, k as updatesOf, kt as seconds, l as timeSpread, lt as ztunnelPodsOf, m as upgradeCell, mt as quantileOf, n as kindCellRecordSchema, nt as sliceReadyAt, o as cellsTable, ot as stoppingOf, p as upgrade, pt as middle, q as requestsOf, r as kindCellRecordV1Schema, rt as sliceReadyOf, s as medianText, st as transitionOf, t as STAGES, tt as sliceEmptyOf, u as FORMAT, ut as ztunnelReplaced, v as cyclesOf, vt as LOG_LABEL, w as propagationOf, wt as backlogEnd, x as judgeKind, xt as REDIS, y as deletionsOf, yt as OUTSIDE, z as intakeOf } from "./judge-DKrgfhAt.js";
 import { valueIn } from "@mark1russell7/quantity";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -642,6 +642,55 @@ const createCluster = async (scenario, dir) => {
 	return cluster;
 };
 //#endregion
+//#region src/helm.ts
+/** This function gives the path of a chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
+const ensurePinnedChart = async (chart, cache = cacheFolder()) => {
+	const path = join(cache, "charts", `${chart.name}-${chart.version}.tgz`);
+	const bytes = existsSync(path) ? readFileSync(path) : await download(chart.url);
+	const found = sha256(bytes);
+	if (found !== chart.sha256) throw new Error(`the chart ${chart.name} ${chart.version} has the sha256 ${found}, not the pinned ${chart.sha256}`);
+	if (!existsSync(path)) {
+		mkdirSync(join(cache, "charts"), { recursive: true });
+		writeFileSync(path, bytes);
+	}
+	return path;
+};
+/**
+* This function installs a pinned chart in a cluster with the values `values`. It writes the values
+* to a file in the folder of the cluster. Helm waits for each workload of the chart, for up to 10 min.
+*/
+const helmInstall = async (cluster, release, chart, namespace, values, options = {}) => {
+	const helm = await ensureTool(HELM);
+	const path = await ensurePinnedChart(chart);
+	const file = join(cluster.dir, `${release}-values.json`);
+	writeFileSync(file, `${JSON.stringify(values, null, 2)}\n`);
+	const home = join(cluster.dir, "helm");
+	const env = {
+		HELM_CACHE_HOME: join(home, "cache"),
+		HELM_CONFIG_HOME: join(home, "config"),
+		HELM_DATA_HOME: join(home, "data")
+	};
+	const create = options.createNamespace === true ? ["--create-namespace"] : [];
+	await command(helm, [
+		"install",
+		release,
+		path,
+		"-n",
+		namespace,
+		...create,
+		"--kubeconfig",
+		cluster.kubeconfig,
+		"-f",
+		file,
+		"--wait",
+		"--timeout",
+		"10m"
+	], {
+		env,
+		timeout: 9e5
+	});
+};
+//#endregion
 //#region src/cilium.ts
 /**
 * This module installs Cilium 1.20.4 in a kind cluster with Helm, from images pinned by digest.
@@ -652,6 +701,8 @@ const createCluster = async (scenario, dir) => {
 const CILIUM_VERSION = "1.20.4";
 /** This chart is the Helm chart of Cilium 1.20.4. The sha256 is of the file on `helm.cilium.io` (read on 2026-10-27). */
 const CILIUM_CHART = {
+	name: "cilium",
+	version: CILIUM_VERSION,
 	url: "https://helm.cilium.io/cilium-1.20.4.tgz",
 	sha256: "505abff8385811df1a949776fc42e9f10697989a332acc86d6e8933efcb855ed"
 };
@@ -712,17 +763,7 @@ const CILIUM_WORKLOADS = [
 	"daemonset/cilium-envoy"
 ];
 /** This function gives the path of the chart in the cache, after a download when the cache does not have it. It refuses a file whose sha256 is not the pinned value. */
-const ensureChart = async (cache = cacheFolder()) => {
-	const path = join(cache, "charts", `cilium-${CILIUM_VERSION}.tgz`);
-	const bytes = existsSync(path) ? readFileSync(path) : await download(CILIUM_CHART.url);
-	const found = sha256(bytes);
-	if (found !== CILIUM_CHART.sha256) throw new Error(`the chart of Cilium has the sha256 ${found}, not the pinned ${CILIUM_CHART.sha256}`);
-	if (!existsSync(path)) {
-		mkdirSync(join(cache, "charts"), { recursive: true });
-		writeFileSync(path, bytes);
-	}
-	return path;
-};
+const ensureChart = (cache = cacheFolder()) => ensurePinnedChart(CILIUM_CHART, cache);
 /**
 * This function installs Cilium in a cluster with no CNI and no kube-proxy. Helm keeps its own
 * files in the folder of the cluster. The function waits for each workload, for each node to be
@@ -730,34 +771,8 @@ const ensureChart = async (cache = cacheFolder()) => {
 * lines of the log of the agent.
 */
 const installCilium = async (cluster, images) => {
-	const helm = await ensureTool(HELM);
-	const chart = await ensureChart();
-	const file = join(cluster.dir, "cilium-values.json");
-	writeFileSync(file, `${JSON.stringify(ciliumValues(cluster.scenario.name, images), null, 2)}\n`);
-	const home = join(cluster.dir, "helm");
-	const env = {
-		HELM_CACHE_HOME: join(home, "cache"),
-		HELM_CONFIG_HOME: join(home, "config"),
-		HELM_DATA_HOME: join(home, "data")
-	};
 	try {
-		await command(helm, [
-			"install",
-			"cilium",
-			chart,
-			"-n",
-			"kube-system",
-			"--kubeconfig",
-			cluster.kubeconfig,
-			"-f",
-			file,
-			"--wait",
-			"--timeout",
-			"10m"
-		], {
-			env,
-			timeout: 9e5
-		});
+		await helmInstall(cluster, "cilium", CILIUM_CHART, "kube-system", ciliumValues(cluster.scenario.name, images));
 		for (const workload of CILIUM_WORKLOADS) await cluster.kubectl([
 			"-n",
 			"kube-system",
@@ -2496,7 +2511,7 @@ const vipOf = (subnet) => {
 		0
 	].map((shift) => Math.floor(address / 2 ** shift) % 256).join(".");
 };
-const sleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const sleep$2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /** This function gives the pods of kube-vip that are not deleted. */
 const kubeVipPods = async (cluster) => {
 	return JSON.parse(await cluster.kubectl([
@@ -2521,11 +2536,11 @@ const kubeVipPods = async (cluster) => {
 /** This function gives the nodes with a ready pod of kube-vip that is not deleted. */
 const kubeVipReady = async (cluster) => (await kubeVipPods(cluster)).filter((pod) => pod.ready && pod.node !== "").map((pod) => pod.node).sort();
 /** This function waits until a condition gives null, and gives null, or the last reason after `within` ms. */
-const until = async (within, check) => {
+const until$1 = async (within, check) => {
 	const end = Date.now() + within;
 	let why = await check();
 	while (why !== null && Date.now() < end) {
-		await sleep$1(500);
+		await sleep$2(500);
 		why = await check();
 	}
 	return why;
@@ -2560,7 +2575,7 @@ const holdVip = async (cluster, holder, nodes, within = 18e4) => {
 		"--timeout=120s"
 	]);
 	await label(cluster, holder, true);
-	const own = await until(within, async () => (await kubeVipReady(cluster)).includes(holder) ? null : `kube-vip on ${holder} is not ready`);
+	const own = await until$1(within, async () => (await kubeVipReady(cluster)).includes(holder) ? null : `kube-vip on ${holder} is not ready`);
 	if (own !== null) return own;
 	const held = async () => {
 		const lease = await vipLeaseOf(cluster);
@@ -2568,11 +2583,11 @@ const holdVip = async (cluster, holder, nodes, within = 18e4) => {
 	};
 	if (await held() !== null) {
 		for (const node of others) await label(cluster, node, false);
-		const moved = await until(within, held);
+		const moved = await until$1(within, held);
 		if (moved !== null) return moved;
 	}
 	for (const node of others) await label(cluster, node, true);
-	return until(within, async () => {
+	return until$1(within, async () => {
 		const ready = await kubeVipReady(cluster);
 		const missing = nodes.filter((node) => !ready.includes(node));
 		return missing.length === 0 ? null : `kube-vip is not ready on ${missing.join(", ")}`;
@@ -2617,7 +2632,7 @@ const installKubeVip = async (cluster, image, holder, nodes) => {
 * This function waits until the Service of a VIP has the VIP in its status: kube-vip took it. It
 * gives null, or why not in `within` ms.
 */
-const vipServed = (cluster, namespace, service, vip, within = 12e4) => until(within, async () => {
+const vipServed = (cluster, namespace, service, vip, within = 12e4) => until$1(within, async () => {
 	const ingress = (await cluster.kubectl([
 		"-n",
 		namespace,
@@ -2630,6 +2645,402 @@ const vipServed = (cluster, namespace, service, vip, within = 12e4) => until(wit
 	return ingress.split(/\s+/).includes(vip) ? null : `the Service ${service} has the ingress ${ingress || "none"}, not ${vip}`;
 });
 //#endregion
+//#region src/metallb.ts
+/**
+* This module installs MetalLB 0.16.1 in L2 mode in a kind cluster (SYS-53). The controller of
+* MetalLB gives a Service of type LoadBalancer an address from a pool: the VIP. A speaker on each
+* worker answers ARP for the VIP if its node owns the VIP. The VIP is on no interface of a node.
+* Thus a frozen speaker answers nothing.
+*
+* Each term of the owner comes from the source of the tag v0.16.1 (commit 791dfcc6):
+* - The owner of a VIP is the first node in the order of sha256(node + "#" + VIP), of the nodes with
+*   a usable speaker (speaker/layer2_controller.go, lines 83–129). A usable speaker is a member of
+*   memberlist that is not dead (internal/speakerlist/speakerlist.go, lines 303–320).
+* - The speakers start memberlist from `DefaultLANConfig` (speakerlist.go, line 72). A file
+*   /etc/metallb/memberlist/config.json replaces that config (lines 77–84). The install makes no
+*   such file, thus each value is the default of hashicorp/memberlist v0.5.1.
+* - Each event of memberlist (a join, a leave or an update) calls `ForceSync` (speakerlist.go, lines
+*   339–349). `ForceSync` reconciles each Service at once, with no delay (internal/k8s/k8s.go, lines
+*   181–184, and internal/k8s/controllers/service_controller_reload.go, lines 62–118).
+* - The owner sends a gratuitous ARP at each reconcile. It sends one at once, then one each 1100 ms
+*   for 5 s (internal/layer2/announcer.go, lines 157–197 and 258–272).
+*/
+/** This version is the release of MetalLB of the lab: the tag v0.16.1, the commit 791dfcc63ced7a6b3e869131eae75e645150fff0. */
+const METALLB_VERSION = "0.16.1";
+/** This chart is the Helm chart of MetalLB 0.16.1. The sha256 is of the file of the release, and it is the digest in the index of the charts. */
+const METALLB_CHART = {
+	name: "metallb",
+	version: METALLB_VERSION,
+	url: "https://github.com/metallb/metallb/releases/download/metallb-chart-0.16.1/metallb-0.16.1.tgz",
+	sha256: "fb06bb584fcb7856f15733b2a6a2aff5b61b5c350687e341c163ae24a5938adc"
+};
+/**
+* These are the images of MetalLB 0.16.1 for linux/amd64, pinned by the digest of the manifest of the
+* platform. The lab pulls each one by its digest, tags it (`localPin`), and loads it into each node.
+*/
+const METALLB_IMAGES = {
+	speaker: "quay.io/metallb/speaker:v0.16.1@sha256:37a98a9d1cd970051c5dededb6f922c1e6c3b90fdd0fc1350d1686e67675af0e",
+	controller: "quay.io/metallb/controller:v0.16.1@sha256:5a3e101335f5ea2cfb0ddf51acdfa9538251e0623ffcd6cbfc1b274b7898790c"
+};
+/** This namespace holds MetalLB: its controller, its speakers and its objects. */
+const METALLB_NAMESPACE = "metallb-system";
+/** This annotation of a Service gives the controller of MetalLB the address of its VIP. */
+const METALLB_ANNOTATION = "metallb.io/loadBalancerIPs";
+/** This name is the name of the pool of the VIP and of its L2Advertisement. */
+const METALLB_POOL = "lab-vip";
+/** This annotation of the Service makes each speaker reconcile it. The owner then sends its gratuitous ARPs. */
+const ANNOUNCE_ANNOTATION = "lab.systems/announce";
+/**
+* These are the terms of memberlist v0.5.1 that the speakers use: the defaults of `DefaultLANConfig`
+* (config.go, lines 302–341).
+* - `probeInterval` is the interval of the probes (line 318). The awareness of a healthy member does not scale it.
+* - `probeTimeout` is the wait for the ack of a direct ping (line 317).
+* - `suspicionMult` and `suspicionMaxTimeoutMult` give the time from suspect to dead (lines 314–315).
+* - `pushPullInterval` is the interval of the full exchange of state (line 316).
+* - `gossipInterval` is the interval of the gossip (line 323).
+*/
+const MEMBERLIST = {
+	probeInterval: {
+		value: 1,
+		unit: "s"
+	},
+	probeTimeout: {
+		value: 500,
+		unit: "ms"
+	},
+	suspicionMult: 4,
+	suspicionMaxTimeoutMult: 6,
+	pushPullInterval: {
+		value: 30,
+		unit: "s"
+	},
+	gossipInterval: {
+		value: 200,
+		unit: "ms"
+	}
+};
+/** These are the gratuitous ARPs of the owner at each reconcile: one at once, then one each `every` until `for` (announcer.go, lines 172–182). */
+const METALLB_SPAM = {
+	every: {
+		value: 1100,
+		unit: "ms"
+	},
+	for: {
+		value: 5,
+		unit: "s"
+	}
+};
+/**
+* This function gives the time from suspect to dead in memberlist v0.5.1, for a cluster of `members`
+* members with no peer that can confirm. The terms:
+* - `suspicionTimeout` is SuspicionMult × max(1, log10(n)) × ProbeInterval (util.go, lines 71–76).
+* - `suspectNode` sets k = SuspicionMult − 2 confirmations, and k = 0 if n − 2 < k (state.go, lines 1216–1224).
+* - With k = 0, the timer fires at the minimum, not at the maximum (suspicion.go, lines 70–76).
+* With confirmations to wait for, the function gives the maximum: SuspicionMaxTimeoutMult times the minimum.
+*/
+const suspicionOf = (members, terms = MEMBERLIST) => {
+	const min = Math.floor(Math.max(1, Math.log10(Math.max(1, members))) * 1e3) * valueIn(terms.probeInterval, "ms") * terms.suspicionMult / 1e3;
+	return {
+		value: (members - 2 < terms.suspicionMult - 2 ? 0 : terms.suspicionMult - 2) < 1 ? min : min * terms.suspicionMaxTimeoutMult,
+		unit: "ms"
+	};
+};
+/**
+* This function gives the Helm values of the install. The values that are not the defaults of the chart:
+* - No FRR and no frr-k8s: the lab uses L2 mode only, thus it needs no BGP.
+* - A speaker only on a node with `VIP_LABEL`, the workers. Thus memberlist has the workers as its
+*   members, and the control plane does not answer ARP.
+* - The controller on the control plane. A zone loss of a worker then does not take it away.
+* - Each image from the node (`pullPolicy: Never`).
+*/
+const metallbValues = (images) => {
+	const image = (local) => {
+		const at = local.lastIndexOf(":");
+		if (at <= 0) throw new Error(`the image ${local} has no tag`);
+		return {
+			repository: local.slice(0, at),
+			tag: local.slice(at + 1),
+			pullPolicy: "Never"
+		};
+	};
+	return {
+		frrk8s: { enabled: false },
+		controller: {
+			image: image(images.controller),
+			nodeSelector: { "node-role.kubernetes.io/control-plane": "" },
+			tolerations: [{
+				key: "node-role.kubernetes.io/control-plane",
+				operator: "Exists",
+				effect: "NoSchedule"
+			}]
+		},
+		speaker: {
+			image: image(images.speaker),
+			frr: { enabled: false },
+			tolerateMaster: false,
+			nodeSelector: { [VIP_LABEL]: "1" },
+			memberlist: {
+				enabled: true,
+				mlBindPort: 7946
+			}
+		}
+	};
+};
+/** This function gives the pool of the VIP and its L2Advertisement. The pool has only the VIP. */
+const metallbObjects = (vip) => [{
+	apiVersion: "metallb.io/v1beta1",
+	kind: "IPAddressPool",
+	metadata: {
+		name: METALLB_POOL,
+		namespace: METALLB_NAMESPACE
+	},
+	spec: { addresses: [`${vip}/32`] }
+}, {
+	apiVersion: "metallb.io/v1beta1",
+	kind: "L2Advertisement",
+	metadata: {
+		name: METALLB_POOL,
+		namespace: METALLB_NAMESPACE
+	},
+	spec: { ipAddressPools: [METALLB_POOL] }
+}];
+/** This function gives the nodes in the order of the election of the owner of `vip`: by sha256(node + "#" + vip), as bytes (layer2_controller.go, lines 115–120). */
+const ownerOrder = (nodes, vip) => {
+	const hash = (node) => createHash("sha256").update(`${node}#${vip}`).digest();
+	return [...nodes].sort((a, b) => Buffer.compare(hash(a), hash(b)));
+};
+const dotted = (address) => [
+	24,
+	16,
+	8,
+	0
+].map((shift) => Math.floor(address / 2 ** shift) % 256).join(".");
+/**
+* This function gives the VIP of a subnet for MetalLB. It looks down from the sixth address from the
+* end, and it gives the first address that `owner` owns, of the nodes `nodes`. Docker gives the address of each container
+* from the start of the subnet, thus no container takes it.
+*/
+const metallbVipOf = (subnet, owner, nodes) => {
+	if (!nodes.includes(owner)) throw new Error(`the owner ${owner} is not one of the nodes ${nodes.join(", ")}`);
+	const [first, last] = cidrRange(subnet);
+	for (let address = last - 5; address > first + 1 && address > last - 260; address--) {
+		const vip = dotted(address);
+		if (ownerOrder(nodes, vip)[0] === owner) return vip;
+	}
+	throw new Error(`the subnet ${subnet} has no VIP that ${owner} owns`);
+};
+const sleep$1 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** This function waits until a condition gives null, and gives null, or the last reason after `within` ms. */
+const until = async (within, check) => {
+	const end = Date.now() + within;
+	let why = await check();
+	while (why !== null && Date.now() < end) {
+		await sleep$1(500);
+		why = await check();
+	}
+	return why;
+};
+/** This function gives the nodes that announce a Service, from the ServiceL2Status objects of the speakers. */
+const announcementsOf = async (cluster, namespace, service) => {
+	return JSON.parse(await cluster.kubectl([
+		"-n",
+		METALLB_NAMESPACE,
+		"get",
+		"servicel2statuses.metallb.io",
+		"-o",
+		"json"
+	])).items.filter((item) => item.status?.serviceName === service && item.status.serviceNamespace === namespace && typeof item.status.node === "string").map((item) => ({
+		node: item.status.node,
+		created: item.metadata?.creationTimestamp ?? null
+	})).sort((a, b) => a.node.localeCompare(b.node));
+};
+/** This function gives the nodes with a ready speaker that is not deleted. */
+const speakersReady = async (cluster) => {
+	return JSON.parse(await cluster.kubectl([
+		"-n",
+		METALLB_NAMESPACE,
+		"get",
+		"pods",
+		"-l",
+		"app.kubernetes.io/component=speaker",
+		"-o",
+		"json"
+	])).items.filter((pod) => pod.metadata.deletionTimestamp === void 0 && pod.spec.nodeName !== void 0).filter((pod) => (pod.status?.containerStatuses ?? []).length > 0 && pod.status.containerStatuses.every((status) => status.ready)).map((pod) => pod.spec.nodeName).sort();
+};
+/**
+* This function makes `owner` the only node that announces the Service, with a ready speaker on each
+* node of `nodes`. It gives null, or why it could not in `within` ms. After a heal, the other node
+* stops when it sees that the owner is alive again. The function then annotates the Service. Each
+* speaker reconciles it, and the owner sends its gratuitous ARPs for 5 s. Thus each client learns
+* the MAC address of the owner.
+*/
+const holdMetallb = async (cluster, owner, nodes, namespace, service, within = 18e4) => {
+	const ready = await until(within, async () => {
+		const found = await speakersReady(cluster);
+		const missing = nodes.filter((node) => !found.includes(node));
+		return missing.length === 0 ? null : `the speaker of MetalLB is not ready on ${missing.join(", ")}`;
+	});
+	if (ready !== null) return ready;
+	const sole = await until(within, async () => {
+		const found = (await announcementsOf(cluster, namespace, service)).map((each) => each.node);
+		return found.length === 1 && found[0] === owner ? null : `the Service ${service} is announced by ${found.join(", ") || "no node"}, not only by ${owner}`;
+	});
+	if (sole !== null) return sole;
+	await cluster.kubectl([
+		"-n",
+		namespace,
+		"annotate",
+		"service",
+		service,
+		`${ANNOUNCE_ANNOTATION}=${Date.now()}`,
+		"--overwrite"
+	]);
+	return null;
+};
+/**
+* This function installs MetalLB in a cluster, with its images on each node, the speakers on `nodes`,
+* and a pool of the VIP. The webhook of the controller checks the pool, thus the function tries the
+* pool again until the webhook answers. A failed install gives the pods of MetalLB and the tail of
+* their logs.
+*/
+const installMetallb = async (cluster, images, nodes, vip) => {
+	try {
+		for (const node of nodes) await cluster.kubectl([
+			"label",
+			"node",
+			node,
+			`${VIP_LABEL}=1`,
+			"--overwrite"
+		]);
+		await helmInstall(cluster, "metallb", METALLB_CHART, METALLB_NAMESPACE, metallbValues(images), { createNamespace: true });
+		let failure = null;
+		const end = Date.now() + 18e4;
+		do {
+			failure = await cluster.apply(metallbObjects(vip)).then(() => null, (error) => error);
+			if (failure !== null) await sleep$1(2e3);
+		} while (failure !== null && Date.now() < end);
+		if (failure !== null) throw failure;
+		if ((await cluster.kubectl([
+			"-n",
+			"metallb-system",
+			"get",
+			"configmap",
+			"metallb-memberlist-config",
+			"--ignore-not-found",
+			"-o",
+			"name"
+		])).trim() !== "") throw new Error("the ConfigMap metallb-memberlist-config is there: memberlist would not use its defaults");
+	} catch (error) {
+		const state = async (args) => (await cluster.kubectl([
+			"-n",
+			METALLB_NAMESPACE,
+			...args
+		]).catch((why) => String(why))).slice(-4e3);
+		const pods = await state([
+			"get",
+			"pods",
+			"-o",
+			"wide"
+		]);
+		const logs = await state([
+			"logs",
+			"-l",
+			"app.kubernetes.io/name=metallb",
+			"--tail=40",
+			"--prefix",
+			"--all-containers"
+		]);
+		throw new Error(`the install of MetalLB failed: ${String(error)}\nthe pods of MetalLB:\n${pods}\nthe logs:\n${logs}`);
+	}
+};
+/** These words mark the lines of a speaker that the record keeps: the events of memberlist, the announces and the withdraws. */
+const KEPT = /node event|Marking|Suspect|Refuting|serviceAnnounced|serviceWithdrawn|memberlist/;
+/**
+* This function gives the record of MetalLB after a run: the nodes that announce the Service, and
+* some lines of each speaker. The lines are about memberlist and the announces, with the times of the kubelet.
+*/
+const metallbRecord = async (cluster, namespace, service) => {
+	return {
+		announcements: await announcementsOf(cluster, namespace, service),
+		log: (await cluster.kubectl([
+			"-n",
+			METALLB_NAMESPACE,
+			"logs",
+			"-l",
+			"app.kubernetes.io/component=speaker",
+			"-c",
+			"speaker",
+			"--since=300s",
+			"--tail=4000",
+			"--prefix",
+			"--timestamps"
+		]).catch((error) => String(error))).split("\n").filter((line) => KEPT.test(line)).slice(-120).join("\n").slice(-12e3)
+	};
+};
+//#endregion
+//#region src/announcer.ts
+const local = (images, name) => {
+	const image = images[name];
+	if (image === void 0) throw new Error(`the run has no local image of ${name}`);
+	return image;
+};
+/** This announcer is kube-vip 1.3.1 in ARP mode, with one Lease for each VIP of a Service (`kubevip.ts`). */
+const KUBE_VIP_ANNOUNCER = {
+	name: "kube-vip",
+	images: { [KUBE_VIP]: KUBE_VIP_IMAGE },
+	service: {
+		loadBalancerClass: LB_CLASS,
+		annotation: VIP_ANNOTATION
+	},
+	settle: KUBE_VIP_ARP_RATE,
+	vipOf: (subnet) => vipOf(subnet),
+	install: (cluster, images, owner, nodes) => installKubeVip(cluster, local(images, KUBE_VIP), owner, nodes),
+	hold: (cluster, owner, nodes) => holdVip(cluster, owner, nodes),
+	record: async (cluster) => {
+		return {
+			lease: await vipLeaseOf(cluster),
+			log: (await cluster.kubectl([
+				"-n",
+				KUBE_VIP_LEASE.namespace,
+				"logs",
+				"-l",
+				`app.kubernetes.io/name=${KUBE_VIP}`,
+				"--tail=30",
+				"--prefix",
+				"--timestamps"
+			]).catch((error) => String(error))).slice(-6e3)
+		};
+	}
+};
+/** This announcer is MetalLB 0.16.1 in L2 mode, with its speakers in memberlist (`metallb.ts`). */
+const METALLB_ANNOUNCER = {
+	name: "metallb",
+	images: {
+		"metallb-speaker": METALLB_IMAGES.speaker,
+		"metallb-controller": METALLB_IMAGES.controller
+	},
+	service: {
+		loadBalancerClass: null,
+		annotation: METALLB_ANNOTATION
+	},
+	settle: METALLB_SPAM.for,
+	vipOf: (subnet, owner, nodes) => metallbVipOf(subnet, owner, nodes),
+	install: (cluster, images, _owner, nodes, vip) => installMetallb(cluster, {
+		speaker: local(images, "metallb-speaker"),
+		controller: local(images, "metallb-controller")
+	}, nodes, vip),
+	hold: (cluster, owner, nodes, namespace, service) => holdMetallb(cluster, owner, nodes, namespace, service),
+	record: (cluster, namespace, service) => metallbRecord(cluster, namespace, service)
+};
+/** This function gives the announcer of the VIP of a cell: kube-vip when the cell names none. */
+const announcerOf = (cell) => cell.vip?.announcer === "metallb" ? METALLB_ANNOUNCER : KUBE_VIP_ANNOUNCER;
+/** This function gives null if each client sends to `mac`, or the clients that do not. */
+const macsAt = (found, mac, count) => {
+	const wrong = found.filter((each) => each.mac !== mac);
+	if (found.length !== count) return `${found.length} clients outside answer, not ${count}`;
+	return wrong.length === 0 ? null : wrong.map((each) => `${each.client} has ${each.mac ?? "no MAC"}`).join(", ");
+};
+//#endregion
 //#region src/lds.ts
 /**
 * This filter of RE2 selects the two counters of the listener manager of Envoy that an update of LDS
@@ -2682,6 +3093,18 @@ const KEPT_KERNEL = /* @__PURE__ */ new Set([
 ]);
 /** This function tells if the lab keeps a kernel record of the prober. */
 const keptKernel = (record) => KEPT_KERNEL.has(String(record["ev"])) || isTunnelState(record);
+/**
+* This function gives the MAC address of `ip` in a table of /proc/net/arp, in lower case. It gives
+* null if the table has no row for `ip`, or if the row has the flags 0x0: no MAC yet. The ARP watch
+* of `client.mjs` reads the table the same way.
+*/
+const arpMacOf = (table, ip) => {
+	for (const row of table.split("\n").slice(1)) {
+		const [address, , flags, mac] = row.trim().split(/\s+/);
+		if (address === ip) return flags === "0x0" || mac === void 0 ? null : mac.toLowerCase();
+	}
+	return null;
+};
 /** This container class can share the process namespace of another container. */
 const shared = async () => {
 	const { GenericContainer } = await import("testcontainers");
@@ -2876,6 +3299,17 @@ const openKindLab = async (cluster, image) => {
 				outsiders.push(client);
 			}
 		},
+		async outsideMacs(ip) {
+			const found = [];
+			for (const [k, client] of outsiders.entries()) {
+				const { output } = await client.exec(["cat", "/proc/net/arp"]);
+				found.push({
+					client: `${OUTSIDE}-${k}`,
+					mac: arpMacOf(output, ip)
+				});
+			}
+			return found;
+		},
 		async stopProbe() {
 			if (prober !== null) await prober.stop({ timeout: 0 }).catch(() => void 0);
 			prober = null;
@@ -3289,22 +3723,26 @@ const keptZone = { nodeAffinity: { requiredDuringSchedulingIgnoredDuringExecutio
 	values: [ZONE_LOST]
 }] }] } } };
 /**
-* This function gives the Service of a VIP (`kubevip.ts`). It is of type LoadBalancer, with the
-* class of kube-vip and the address of the VIP in its annotation. The policy `Cluster` lets each node
+* This function gives the Service of a VIP (`announcer.ts`). It is of type LoadBalancer, with the
+* class of its announcer, if the announcer has one. The annotation of the announcer has the address
+* of the VIP. Without `service`, the announcer is kube-vip. The policy `Cluster` lets each node
 * send a request to a replica on another node. The holder writes the address to the status of the
 * Service. Then kube-proxy has the rules of the address on each node.
 */
-const vipService = (namespace, vip, ports) => ({
+const vipService = (namespace, vip, ports, service = {
+	loadBalancerClass: LB_CLASS,
+	annotation: VIP_ANNOTATION
+}) => ({
 	apiVersion: "v1",
 	kind: "Service",
 	metadata: {
 		name: "lab",
 		namespace,
-		annotations: { [VIP_ANNOTATION]: vip }
+		annotations: { [service.annotation]: vip }
 	},
 	spec: {
 		type: "LoadBalancer",
-		loadBalancerClass: LB_CLASS,
+		...service.loadBalancerClass === null ? {} : { loadBalancerClass: service.loadBalancerClass },
 		externalTrafficPolicy: "Cluster",
 		selector: { app: "lab" },
 		ports
@@ -3315,7 +3753,7 @@ const vipService = (namespace, vip, ports) => ({
 * settings of the cell. The image is the lab image for the service, or the image of grpc-go.
 *
 * With a VIP (`KindCell.vip`), the Service is of type LoadBalancer, with the address `vip` and the
-* class of kube-vip (`vipService`). No replica is in the lost zone. Thus a zone loss takes away
+* class of its announcer (`vipService`). No replica is in the lost zone. Thus a zone loss takes away
 * only the holder of the VIP.
 */
 const serverObjects = (cell, namespace, image, version = 1, vip = null) => {
@@ -3339,7 +3777,7 @@ const serverObjects = (cell, namespace, image, version = 1, vip = null) => {
 			selector: { app: "lab" },
 			ports
 		}
-	} : vipService(namespace, vip, ports), {
+	} : vipService(namespace, vip, ports, announcerOf(cell).service), {
 		apiVersion: "apps/v1",
 		kind: "Deployment",
 		metadata: {
@@ -3749,7 +4187,7 @@ const hasRedis = (cell) => cell.declaration !== null && cell.declaration.redis !
 * This function gives the key of the cluster of a cell: its kube-proxy mode, its node count, and the
 * flavor of its mesh. A zone loss has clusters of its own, with a zone on each node.
 */
-const clusterKey = (cell) => (cell.mesh !== void 0 ? `${cell.mode}-${cell.workers}-${cell.mesh.flavor}` : zoned(cell) ? `${cell.mode}-${cell.workers}-zones` : `${cell.mode}-${cell.workers}`) + (cell.vip === void 0 ? "" : "-vip");
+const clusterKey = (cell) => (cell.mesh !== void 0 ? `${cell.mode}-${cell.workers}-${cell.mesh.flavor}` : zoned(cell) ? `${cell.mode}-${cell.workers}-zones` : `${cell.mode}-${cell.workers}`) + (cell.vip === void 0 ? "" : cell.vip.announcer === "metallb" ? "-vip-mlb" : "-vip");
 /** This function tells if a cell needs a cluster with zones: a zone loss. */
 const zoned = (cell) => cell.trigger.kind === "zone-loss";
 /**
@@ -4418,34 +4856,26 @@ const lostNodeOf = (cluster) => cluster.nodes.at(-1);
 /** This function gives the workers of a cluster: each node but the control plane, the first (`nodeNames`). */
 const workersOf = (cluster) => cluster.nodes.slice(1);
 /**
-* This function adds a line `vip` to the lines. The line has the Lease of the VIP and the MAC address
-* of each node on the Docker network. It also has the wall clock of the runner with its CLOCK_MONOTONIC. The times of the
-* Lease are on the wall clock, and each stamp of the lab is on CLOCK_MONOTONIC. The containers of
+* This function adds a line `vip` to the lines. The line has the state of the announcer, the MAC
+* address of each node on the Docker network, and the name of the announcer. The state of kube-vip
+* is its Lease. The state of MetalLB is the nodes that announce the Service. It also has the wall clock of the runner with its CLOCK_MONOTONIC. The times of the
+* Lease and of the logs are on the wall clock, and each stamp of the lab is on CLOCK_MONOTONIC. The containers of
 * the runner share one kernel, thus the pair converts one into the other.
 */
 const recordVip = async (ctx) => {
 	const wall = Date.now();
 	const t = Number(process.hrtime.bigint()) / 1e6;
-	const lease = await vipLeaseOf(ctx.cluster);
+	const announcer = announcerOf(ctx.cell);
+	const state = await announcer.record(ctx.cluster, ctx.namespace, "lab");
 	const { macs } = await vipNetworkOf(ctx.cluster.network);
-	const log = await ctx.cluster.kubectl([
-		"-n",
-		KUBE_VIP_LEASE.namespace,
-		"logs",
-		"-l",
-		"app.kubernetes.io/name=kube-vip",
-		"--tail=30",
-		"--prefix",
-		"--timestamps"
-	]).catch((error) => String(error));
 	ctx.lab.record({
 		ev: "vip",
 		t,
 		wall,
 		vip: ctx.vip,
-		lease,
-		macs,
-		log: log.slice(-6e3)
+		announcer: announcer.name,
+		...state,
+		macs
 	});
 };
 /** This function puts the replicas of a node first, and keeps the sequence of the others. */
@@ -4510,9 +4940,21 @@ const runOnce = async (ctx, env, index, warmup, ours) => {
 	const lost = zoneLoss ? await nodeSteady(cluster, lostNodeOf(cluster), 3e5) : null;
 	if (lost !== null) return empty(`the node of the lost zone was not at rest: ${lost}`, await lab.now());
 	if (cell.vip !== void 0) {
-		const held = await holdVip(cluster, lostNodeOf(cluster), workersOf(cluster));
-		if (held !== null) return empty(`the VIP is not on ${lostNodeOf(cluster)}: ${held}`, await lab.now());
-		await sleep(valueIn(KUBE_VIP_ARP_RATE, "ms") + valueIn(cell.workload.timeout, "ms") + 1e3);
+		const announcer = announcerOf(cell);
+		const holder = lostNodeOf(cluster);
+		const held = await announcer.hold(cluster, holder, workersOf(cluster), ctx.namespace, "lab");
+		if (held !== null) return empty(`the VIP is not on ${holder}: ${held}`, await lab.now());
+		if (ctx.vip === null) return empty(`${cell.name}: the cluster has no VIP`, await lab.now());
+		const mac = (await vipNetworkOf(cluster.network)).macs[holder];
+		if (mac === void 0) return empty(`the node ${holder} has no MAC address on the Docker network`, await lab.now());
+		const end = Date.now() + valueIn(announcer.settle, "ms") + 1e4;
+		let moved = macsAt(await lab.outsideMacs(ctx.vip), mac, cell.vip.clients);
+		while (moved !== null && Date.now() < end) {
+			await sleep(250);
+			moved = macsAt(await lab.outsideMacs(ctx.vip), mac, cell.vip.clients);
+		}
+		if (moved !== null) return empty(`the clients outside do not send to ${holder} (${mac}): ${moved}`, await lab.now());
+		await sleep(valueIn(announcer.settle, "ms") + valueIn(cell.workload.timeout, "ms") + 1e3);
 	}
 	if (await steady(ctx, 3e5) !== null) return empty("the cell was not at rest after the wait for a quiet VM", await lab.now());
 	const replicas = zoneLoss ? lostFirst(replicasOf(ctx), lostNodeOf(cluster)) : replicasOf(ctx);
@@ -4736,7 +5178,13 @@ const runKindCells = async (cells, options) => {
 		operator: await localPin(CILIUM_IMAGES.operator),
 		envoy: await localPin(CILIUM_IMAGES.envoy)
 	} : void 0;
-	const kubeVip = cells.some((cell) => cell.vip !== void 0) ? await localPin(KUBE_VIP_IMAGE) : void 0;
+	const announcerImages = /* @__PURE__ */ new Map();
+	for (const announcer of [KUBE_VIP_ANNOUNCER, METALLB_ANNOUNCER]) {
+		if (!cells.some((cell) => cell.vip !== void 0 && announcerOf(cell).name === announcer.name)) continue;
+		const pinned = {};
+		for (const [name, ref] of Object.entries(announcer.images)) pinned[name] = await localPin(ref);
+		announcerImages.set(announcer.name, pinned);
+	}
 	const images = {
 		lab: image,
 		redis: redisImage,
@@ -4784,12 +5232,14 @@ const runKindCells = async (cells, options) => {
 				}
 				let vip = null;
 				if (group[0].vip !== void 0) {
-					if (kubeVip === void 0) throw new Error(`${group[0].name}: the run has no image of kube-vip`);
-					await cluster.load(kubeVip);
+					const announcer = announcerOf(group[0]);
+					const pinned = announcerImages.get(announcer.name);
+					if (pinned === void 0) throw new Error(`${group[0].name}: the run has no images of ${announcer.name}`);
+					for (const each of Object.values(pinned)) await cluster.load(each);
 					const began = Date.now();
-					await installKubeVip(cluster, kubeVip, lostNodeOf(cluster), workersOf(cluster));
-					vip = vipOf((await vipNetworkOf(cluster.network)).subnet);
-					options.log(`  kube-vip installed in ${Math.round((Date.now() - began) / 100) / 10} s, the VIP ${vip}`);
+					vip = announcer.vipOf((await vipNetworkOf(cluster.network)).subnet, lostNodeOf(cluster), workersOf(cluster));
+					await announcer.install(cluster, pinned, lostNodeOf(cluster), workersOf(cluster), vip);
+					options.log(`  ${announcer.name} installed in ${Math.round((Date.now() - began) / 100) / 10} s, the VIP ${vip}`);
 				}
 				lab = await openKindLab(cluster, image);
 				const { GenericContainer } = await import("testcontainers");
@@ -4850,7 +5300,7 @@ const runKindCells = async (cells, options) => {
 								...stackOf(cell) === "grpc" ? { grpc: grpcImage } : {},
 								...cell.mesh === void 0 ? {} : Object.fromEntries(MESH_IMAGES[cell.mesh.flavor].map((name) => [`istio-${name}`, ISTIO_IMAGES[name]])),
 								...s.cni === "cilium" ? Object.fromEntries(Object.entries(CILIUM_IMAGES).map(([name, ref]) => [`cilium-${name}`, ref])) : {},
-								...cell.vip === void 0 ? {} : { "kube-vip": KUBE_VIP_IMAGE }
+								...cell.vip === void 0 ? {} : announcerOf(cell).images
 							}
 						});
 						entry.loads.push(...loads);
@@ -4956,6 +5406,6 @@ const shardOf = (cells, index, count) => {
 	return out;
 };
 //#endregion
-export { ACCESS_LOG_FORMAT, CHANNEL_USE, CILIUM_CHART, CILIUM_CONFIG_KEYS, CILIUM_IMAGES, CILIUM_VERSION, CILIUM_WORKLOADS, CLIENT, CLIENT_ACCOUNT, CLOSE_LEAD, CONTROLLER, DATAPLANES, DNS_PORT, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HBONE_PORT, HEALTH_PORT, HELM, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, KUBE_VIP, KUBE_VIP_ARP_RATE, KUBE_VIP_ELECTION, KUBE_VIP_IMAGE, KUBE_VIP_LEASE, KUBE_VIP_VERSION, LAST_SLACK, LB_CLASS, LDS_EVERY, LDS_FILTER, LOG_LABEL, MESH_IMAGES, MESH_WORKLOADS, MIDDLEBOX, NETEM_DRAIN, NETNS_DEFAULTS, NODE_IMAGES, NODE_LIFECYCLE, O04, O09, O10, O16, OUTSIDE, POD_LINK, POLICY, PORT, QUIET_LEAD, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, SPREAD_LEAD, STAGES, SYSCTL, TCP_STATE, VIP_ANNOTATION, VIP_LABEL, WATCHDOG, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZTUNNEL_PODS, backendsAt, backendsOf, backlogEnd, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, certificateArgs, checkRun, cidrOverlap, cidrRange, ciliumBackendsOf, ciliumMode, ciliumValues, clientObjects, clusterFilter, compose, createCluster, cyclesOf, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dnsCommands, drainBand, dropOf, emptyOf, ensureChart, ensureTool, estimatedTime, factsOf, failuresOf, faultSpan, followsZtunnel, goDuration, holdVip, hostsOf, installCilium, installKubeVip, installMesh, intakeAfter, intakeOf, isKubeProxyMode, isTunnelState, istioOperator, judge, judgeKind, keptKernel, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeVipObjects, kubeVipPods, kubeVipReady, kubeletBand, labImage, labSource, latchBand, leafCertificates, learnWindow, lintCell, listenerCountsOf, localPin, medianInterval, medianText, meshKey, middle, middleboxCommands, namesService, namespaceObject, namespaceOf, nodeLossBand, nodeNames, nodeReturnBand, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, overshootBand, pausedWindow, periodOf, placementOf, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestBand, requestsOf, restartBand, restartOf, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sessionsAt, setZtunnelEnv, sha256, shardOf, sharedGate, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, stackOf, stageLabImage, stallRemovalBand, stopOf, stoppingOf, sysctlCommand, tarEntry, timeSpread, toolPath, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, vipLeaseOf, vipNetworkOf, vipOf, vipServed, vipService, writeResult, zoneOf, ztunnelCertificates, ztunnelEnvArgs, ztunnelPodsOf, ztunnelReplaced };
+export { ACCESS_LOG_FORMAT, ANNOUNCE_ANNOTATION, CHANNEL_USE, CILIUM_CHART, CILIUM_CONFIG_KEYS, CILIUM_IMAGES, CILIUM_VERSION, CILIUM_WORKLOADS, CLIENT, CLIENT_ACCOUNT, CLOSE_LEAD, CONTROLLER, DATAPLANES, DNS_PORT, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HBONE_PORT, HEALTH_PORT, HELM, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, KUBE_VIP, KUBE_VIP_ANNOUNCER, KUBE_VIP_ARP_RATE, KUBE_VIP_ELECTION, KUBE_VIP_IMAGE, KUBE_VIP_LEASE, KUBE_VIP_VERSION, LAST_SLACK, LB_CLASS, LDS_EVERY, LDS_FILTER, LOG_LABEL, MEMBERLIST, MESH_IMAGES, MESH_WORKLOADS, METALLB_ANNOTATION, METALLB_ANNOUNCER, METALLB_CHART, METALLB_IMAGES, METALLB_NAMESPACE, METALLB_POOL, METALLB_SPAM, METALLB_VERSION, MIDDLEBOX, NETEM_DRAIN, NETNS_DEFAULTS, NODE_IMAGES, NODE_LIFECYCLE, O04, O09, O10, O16, OUTSIDE, POD_LINK, POLICY, PORT, QUIET_LEAD, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, SPREAD_LEAD, STAGES, SYSCTL, TCP_STATE, VIP_ANNOTATION, VIP_LABEL, WATCHDOG, ZONE_KEPT, ZONE_LABEL, ZONE_LOST, ZTUNNEL_PODS, announcementsOf, announcerOf, arpMacOf, backendsAt, backendsOf, backlogEnd, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, certificateArgs, checkRun, cidrOverlap, cidrRange, ciliumBackendsOf, ciliumMode, ciliumValues, clientObjects, clusterFilter, compose, createCluster, cyclesOf, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dnsCommands, drainBand, dropOf, emptyOf, ensureChart, ensurePinnedChart, ensureTool, estimatedTime, factsOf, failuresOf, faultSpan, followsZtunnel, goDuration, helmInstall, holdMetallb, holdVip, hostsOf, installCilium, installKubeVip, installMesh, installMetallb, intakeAfter, intakeOf, isKubeProxyMode, isTunnelState, istioOperator, judge, judgeKind, keptKernel, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeVipObjects, kubeVipPods, kubeVipReady, kubeletBand, labImage, labSource, latchBand, leafCertificates, learnWindow, lintCell, listenerCountsOf, localPin, macsAt, medianInterval, medianText, meshKey, metallbObjects, metallbRecord, metallbValues, metallbVipOf, middle, middleboxCommands, namesService, namespaceObject, namespaceOf, nodeLossBand, nodeNames, nodeReturnBand, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, overshootBand, ownerOrder, pausedWindow, periodOf, placementOf, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestBand, requestsOf, restartBand, restartOf, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sessionsAt, setZtunnelEnv, sha256, shardOf, sharedGate, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, sliceReadyAt, sliceReadyOf, slicesOf, socketsOf, speakersReady, stackOf, stageLabImage, stallRemovalBand, stopOf, stoppingOf, suspicionOf, sysctlCommand, tarEntry, timeSpread, toolPath, transitionOf, tunnelsOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, vipLeaseOf, vipNetworkOf, vipOf, vipServed, vipService, writeResult, zoneOf, ztunnelCertificates, ztunnelEnvArgs, ztunnelPodsOf, ztunnelReplaced };
 
 //# sourceMappingURL=index.js.map