@mark1russell7/kind 0.2.3 → 0.4.0

package/README.md

@@ -65,6 +65,7 @@ The tests read three real records of `/1` (`test/records/`): a cell that holds,
 - **The scenario** (`scenario.ts`) is the cluster as data: its nodes, its version, the mode and the sync periods of kube-proxy, its CNI and its subnets. `kindConfig(scenario)` generates the configuration of kind from it.
 - **The node image** is `kindest/node:v1.37.0`, pinned by digest, the default of kind v0.33.0. The research names v1.37.1 for some defaults. The patch release is the mismatch.
 - **The tools** (`tools.ts`) are kind v0.33.0 and kubectl v1.37.0. The lab downloads each one into `.cache/` in this package, and it compares the sha256 with the pinned value at each use. `KIND_CACHE` names another folder. The lab installs nothing on the system, and the same code works on Linux, macOS and Windows.
+- **istioctl 1.31.3** (`ISTIOCTL`) comes in a gzipped tar file. The pinned sha256 is that of the tar file. The cache keeps the tar file, and each use examines it and takes the tool from it again (`tarEntry`). The release has a zip file for Windows, thus Windows has no asset of istioctl.
 - **The isolation.** Each cluster gets its own Docker network, its own kubeconfig and its own cache for kubectl, in its run folder. The lab refuses a pod or service subnet that overlaps a Docker network.
 
 ## The lab
@@ -81,8 +82,17 @@ The tests read three real records of `/1` (`test/records/`): a cell that holds,
   - Each second, the agent reads the counters of dropped packets (`drops.ts`), and it writes a `drops` line with each counter that grew. For the node, these are the drops of the backlogs, the squeezes of the softirqs, and the drops of each veth.
   - For each client pod, the agent reads `/proc/<pid>/net`. These counters are the IP discards, the sends with no route, the failed connects, the drops of its interfaces, and its neighbors with no address. From 0.1.5, they also count the ICMP errors of an unreachable destination. A refusal by a reject rule is such an error, not a reset. A SYN that does not get to the conntrack of the node leaves its trace in one of them.
 - **The rules of each node.** The agent reads the rules of kube-proxy in the namespaces of the node each 50 ms: `iptables-save`, `nft list table ip kube-proxy`, or `/proc/net/ip_vs`. It writes a line when the backends of the Service change (`backends.ts`). A backend of IPVS with the weight zero takes no new connection, thus it is not a backend.
+- **The endpoints of each client sidecar.** From 0.3.0, in a sidecar mesh, the agent also polls the Envoy of the client sidecar on its node each 50 ms (`eds`). The client sidecar picks the backend of each call, thus these endpoints and not the rules are the propagation of the cell (`propagationSource`).
+  - A poller enters the network namespace of the client pod (`nsenter -n`). It reads `/clusters` on `127.0.0.1:15000` with a filter that selects the server cluster (`eds.ts`).
+  - Each change of the healthy hosts gives an `eds` line with the start of the poll before it. That line has the form of a rules line. Each second, an `eds-alive` line counts the polls and gives their mean time.
+- **The listeners of each server sidecar.** From 0.4.0, the agent also polls the Envoy of each server sidecar on its node each 50 ms (`lds`). It does this for a policy in a sidecar mesh (`pollsListeners`).
+  - A poller enters the network namespace of the server pod through the PID of its app. It reads `/stats` on `127.0.0.1:15000` with a filter that selects two counters of the listener manager (`lds.ts`).
+  - `listener_modified` counts each update of a listener, and `listener_in_place_updated` counts each update of its filter chains only.
+  - Each change of the counters gives an `lds` line with the start of the poll before it. The first line of a poller has no poll before it, thus it is no update (`updatesOf`).
 - **The injector of each node** is the image of the harness, in the PID namespace of the node. `crictl` on the node gives the PID of a container, and `nsenter -n` enters the network namespace of its pod. The injector of the harness then applies its rules there.
 - **The watcher** is a container on the network of the cluster. It watches the pods, the EndpointSlices and the events through the API, and it follows the log of each pod of the cell.
+  - From 0.3.0, it also follows the sidecar of Istio (`istio-proxy`), and a pod line gives the state of the sidecar (`sc`). Each line of the sidecar becomes a `proxy` line, stamped at its arrival. Its own stamps are of the wall clock, thus no band reads them.
+  - The access line of a call that succeeded at its first try is only counted, in a `proxy-ok` line each second. The record keeps each failure, each retry and each local reply, with its response flags and its upstream host.
 - **The prober** of the harness watches the network namespace of each pod, by its inode. The lab keeps its resets, errors and retransmissions, and it counts the other records.
 
 Each pod of a cluster shares the kernel of the Docker VM. Thus each stamp of the agent, the injector, the watcher, the clients, the service and the prober is on the same CLOCK_MONOTONIC.
@@ -104,6 +114,21 @@ From 0.2.0, a cell names its stack (`stack`): its server and its clients. A cell
 
 A declaration that can be null changes the type `KindCell`. That is a breaking change before 1.0.0, thus the version is 0.2.0.
 
+## The mesh
+
+From 0.3.0, a cell can name a mesh (`mesh`): Istio 1.31.3 in its cluster. This is the template `T15`, the lifecycle of T07 through two mesh hops.
+
+- **The field.** `mesh.flavor` is the install: `sidecar` is istiod only. `mesh.mode` is the data plane of the pods of the cell. The flavor `ambient` comes in step 3 of the plan, and the lab refuses it until then.
+- **The cluster.** The cells of one kube-proxy mode, one node count and one mesh flavor share a cluster. `shardOf` keeps them together, and in each mode the cells with no mesh come first.
+- **The install.** `installMesh` writes the IstioOperator of the flavor (`istioOperator`), and `istioctl install` applies it with the kubeconfig of the cluster. Then the lab waits for istiod.
+- **The values.** The profile is `minimal`, because the profile `default` also has an ingress gateway. The pod of istiod requests 256 MiB, with one replica and no autoscaler. The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
+- **The images.** `ISTIO_IMAGES` pins istiod and the proxy by the digest of their index on Docker Hub. The lab pulls each one by its digest and tags it with that digest (`localPin`). Then `kind load` puts it on each node.
+- **No pull.** Each image is a full reference, thus the charts use it as it is. The init container of the injector gets the image of the proxy too. `imagePullPolicy` is `Never`, thus an image that the lab did not load fails the install.
+- **The namespace.** In the sidecar mode, the namespace of the cell has the label `istio-injection=enabled` (`namespaceObject`). The injector then puts a native sidecar in each pod: an init container that runs beside the app, because each kubelet is at least 1.33.
+- **The probes.** The injector changes the gRPC probe of grpc-go into an HTTP probe of pilot-agent. Then pilot-agent sends the gRPC check to the app, with the service of the probe.
+
+A new member of the union `Template` breaks a reader that switches on it. That is a breaking change before 1.0.0, thus the version is 0.3.0. The record format stays `/2`, with the optional field `mesh`. A judge before 0.3.0 cannot read a record of T15.
+
 ## The image
 
 The lab image (`image/`) holds the service of a cell on `@mark1russell7/service`, its clients, the agent and the watcher, on Node 24.21.0. Its base is pinned by digest, and `npm-lock.json` pins the packages from npm. `stageLabImage()` stages its context, and `labImage()` tags the image by its content.
@@ -136,6 +161,7 @@ The lab image (`image/`) holds the service of a cell on `@mark1russell7/service`
 | `app-stall` | the event loop of the first replica blocked |
 | `rollout` | no Redis pod, then a rolling update |
 | `cpu-throttle` | `cpu.max` in the cgroup of the container of the first replica |
+| `authorization-policy` | `kubectl apply` of a DENY AuthorizationPolicy on the server pods for the principal of an account (`account`, the account `default` of the clients when not given), then `kubectl delete` after the hold |
 
 A cgroup path that is not the scope of one container is refused. A write to the root of the node throttles or freezes each pod of the node.
 
@@ -176,19 +202,29 @@ From 0.2.3, a window can also give the propagation that it assumes (`propagation
 - An earlier drop only closes the window earlier, thus the judge does not test the start of the band.
 - `predictionText` adds `the rules drop the replica in` and the band.
 
+From 0.4.0, a window can count from the heal (`heal`), the first act that ends the fault. A window can also name its outcomes (`outcomes`). A failure in the window with another outcome then fails the run.
+
+- The client of gRPC gives the outcome `denied` to PERMISSION_DENIED: the local reply 403 of an RBAC deny of a sidecar.
+- For a policy, the propagation of a window is the LDS update of each server sidecar, after the apply and after the delete (`updatesOf`). An update after the band agrees with the law, and the cell is `extend`.
+- A denial after the window, before the last update after the delete and one more call, is a `tail`. A denied call has no pod, because the sidecar answers it. Thus the judge reads the last update of each server sidecar.
+- `calibrationOf` gives the updates after the apply by node, and the updates after the delete (`heal`).
+
+A new member of the union `TriggerKind` breaks a reader that switches on it. That is a breaking change before 1.0.0, thus the version is 0.4.0. The record format stays `/2`, with the optional fields `account`, `outcomes`, `updates` and `healUpdates`, and the reference `heal`.
+
 A preStop sleep that is longer than the grace is a command in the container (`sh -c "sleep 60"`). The API server refuses a sleep action that is longer than the grace.
 
 ## Tests
 
 `pnpm --filter @mark1russell7/kind test` starts the tests of the configuration, the tools, the parser of the rules and the fault mapping. It also starts the tests of the predictions, the verdict and the judge of the real records. They do not need Docker.
 
-The catalogs are in `@systems/cells` (`t07.ts`, `t18.ts`). `KIND_LAB=1` starts them in kind.
+The catalogs are in `@systems/cells` (`t07.ts`, `t18.ts`, `grpc/t07.ts` and `grpc/t15.ts`). `KIND_LAB=1` starts them in kind.
 
 ## CI
 
 The cells operate on the runners of GitHub, and not on a machine that does other work (`.github/workflows/kind.yml`). Each shard gets a runner, and each job makes its own clusters and deletes them.
 
 - **The modes of the kernel.** kube-proxy in a node container uses the modules of the host kernel. Thus the job loads `ip_vs` and `nf_tables` first. A cell of a mode that the kernel cannot do waits, and `summary.ndjson` tells why.
+- **The inotify limits.** The pods of each node share the inotify limits of the kernel of the runner. Thus the job raises them to 512 instances and 524288 watches, the values of the known issues of kind.
 - **The shards.** `shardOf` gives each shard an equal share of the estimated time, and the cells of one mode stay together. Thus a shard makes few clusters.
 - **The output.** Each job uploads its raw records, `summary.ndjson`, and what the runner is. The run folder of each cluster stays out of the output, because a kubeconfig holds credentials.
 - **A pull request** that changes the workflow starts a smoke run: the calibration of each mode, with 2 runs on one cluster.

package/build/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as Line, $t as Workload, A as TriggerV1, At as LOG_LABEL, B as RunCheck, Bt as KindCell, C as KindCellResult, Ct as sliceDropOf, D as PredictionV1, Dt as transitionOf, E as LoadSample, Et as stoppingOf, F as KIND_NOISE, Ft as seconds, G as judgeKind, Gt as RedisDeclaration, H as checkRun, Ht as KubeletProbe, I as KindDecision, It as secondsOf, J as propagationOf, Jt as ResetReuse, K as observationAfter, Kt as Reference, L as KindVerdict, Lt as showBand, M as upgrade, Mt as REDIS, N as upgradeCell, Nt as SERVER, O as RunCheckV1, Ot as CLIENT, P as Deleted, Pt as bandOf, Q as Endpoint, Qt as TriggerKind, R as LAST_SLACK, Rt as Band, S as KindCellRecordV1, St as signalsOf, T as KindVerdictV1, Tt as slicesOf, U as deletionsOf, Ut as PodSettings, V as RunFacts, Vt as KindRun, W as factsOf, Wt as Prediction, X as reusesReset, Xt as Template, Y as referenceOf, Yt as Stack, Z as unitOf, Zt as Trigger, _ as ClusterManifest, _t as recordsOf, a as STAGES, an as NodeImage, at as backendsAt, b as FORMAT_V1, bt as rulesOf, c as readRecord, cn as goDuration, ct as deletionOf, d as calibrationOf, dn as nodeNames, dt as failuresOf, en as KUBE_PROXY_MODES, et as PodLine, f as cellsTable, fn as scenario, ft as intakeOf, g as BandV1, gt as podsOf, h as timeSpread, ht as podsAt, i as quantileOf, in as NODE_IMAGES, it as SliceLine, j as judge, jt as PORT, k as RunFactsV1, kt as HEALTH_PORT, l as Judged, ln as kindConfig, lt as dropOf, m as predictionText, mt as outcomesOf, n as medianInterval, nn as KindScenario, nt as Request, o as kindCellRecordSchema, on as cidrOverlap, ot as byClients, p as medianText, pn as scenarioProblems, pt as kernelCounts, q as observationEnd, qt as Replica, r as middle, rn as KubeProxyMode, rt as RulesLine, s as kindCellRecordV1Schema, sn as cidrRange, st as byNode, t as RELATIVE, tn as KindConfig, tt as RecordLine, u as TimeSpread, un as kubeProxyPatch, ut as emptyOf, v as EnvironmentManifest, vt as requestsOf, w as KindCellV1, wt as sliceEmptyOf, x as KindCellRecord, xt as signalOf, y as FORMAT, yt as restartsAt, z as Propagated, zt as Declaration } from "./judge-CctoUEo8.js";
+import { $ as updatesOf, $t as Replica, A as TriggerV1, At as transitionOf, B as RunCheck, Bt as showBand, C as KindCellResult, Ct as rulesOf, D as PredictionV1, Dt as sliceEmptyOf, E as LoadSample, Et as sliceDropOf, F as KIND_NOISE, Ft as REDIS, G as judgeKind, Gt as KubeletProbe, H as checkRun, Ht as Declaration, I as KindDecision, It as SERVER, J as propagationOf, Jt as MeshMode, K as observationAfter, Kt as Mesh, L as KindVerdict, Lt as bandOf, M as upgrade, Mt as HEALTH_PORT, N as upgradeCell, Nt as LOG_LABEL, O as RunCheckV1, Ot as slicesOf, P as Deleted, Pt as PORT, Q as unitOf, Qt as Reference, R as LAST_SLACK, Rt as seconds, S as KindCellRecordV1, St as restartsAt, T as KindVerdictV1, Tt as signalsOf, U as deletionsOf, Ut as KindCell, V as RunFacts, Vt as Band, W as factsOf, Wt as KindRun, X as referenceOf, Xt as Prediction, Y as propagationSource, Yt as PodSettings, Z as reusesReset, Zt as RedisDeclaration, _ as ClusterManifest, _n as nodeNames, _t as outcomesOf, a as STAGES, an as Workload, at as Request, b as FORMAT_V1, bt as recordsOf, c as readRecord, cn as KindScenario, ct as backendsAt, d as calibrationOf, dn as NodeImage, dt as deletionOf, en as ResetReuse, et as Endpoint, f as cellsTable, fn as cidrOverlap, ft as dropOf, g as BandV1, gn as kubeProxyPatch, gt as kernelCounts, h as timeSpread, hn as kindConfig, ht as intakeOf, i as quantileOf, in as TriggerKind, it as RecordLine, j as judge, jt as CLIENT, k as RunFactsV1, kt as stoppingOf, l as Judged, ln as KubeProxyMode, lt as byClients, m as predictionText, mn as goDuration, mt as failuresOf, n as medianInterval, nn as Template, nt as PodLine, o as kindCellRecordSchema, on as KUBE_PROXY_MODES, ot as RulesLine, p as medianText, pn as cidrRange, pt as emptyOf, q as observationEnd, qt as MeshFlavor, r as middle, rn as Trigger, rt as PropagationSource, s as kindCellRecordV1Schema, sn as KindConfig, st as SliceLine, t as RELATIVE, tn as Stack, tt as Line, u as TimeSpread, un as NODE_IMAGES, ut as byNode, v as EnvironmentManifest, vn as scenario, vt as podsAt, w as KindCellV1, wt as signalOf, x as KindCellRecord, xt as requestsOf, y as FORMAT, yn as scenarioProblems, yt as podsOf, z as Propagated, zt as secondsOf } from "./judge-DMuI3aDn.js";
 import { Quantity } from "@mark1russell7/quantity";
 import { CheckFn, Finding, HealthServer, Poll, Rule, Scenario, ServiceBuilder, ServiceDescription, Stage, Timing, TransportImpl, Verdict } from "@mark1russell7/service";
 import { RedisClient } from "@mark1russell7/service/redis";
@@ -77,6 +77,29 @@ export declare const WATCHDOG = "self.event-loop";
  */
 export declare const compose: (name: string, declaration: Declaration, parts?: Parts) => ServiceBuilder;
 //#endregion
+//#region src/eds.d.ts
+/**
+ * These are the hosts of a cluster: the healthy ones (`b`, in sequence), and each other host with its
+ * health flags (`u`). Each host is `ip:port`.
+ */
+interface ClusterHosts {
+  readonly b: readonly string[];
+  readonly u: Readonly<Record<string, string>>;
+}
+/**
+ * This function gives the name of the outbound cluster of a Service port in a sidecar of Istio:
+ * `outbound|<port>||<service>.<namespace>.svc.cluster.local`.
+ */
+export declare const outboundCluster: (service: string, namespace: string, port: number) => string;
+/** This function gives the filter of `/clusters` that selects one cluster: a regular expression of RE2 with anchors. */
+export declare const clusterFilter: (cluster: string) => string;
+/**
+ * This function gives the hosts of a cluster from the text of `/clusters`. Each host of the text has
+ * a line `<cluster>::<ip:port>::health_flags::<flags>`. The flags are `healthy`, or the names of the
+ * flags that the host has (`clusters_handler.cc` and `host_utility.cc` of Envoy v1.39.4).
+ */
+export declare const hostsOf: (text: string, cluster: string) => ClusterHosts;
+//#endregion
 //#region src/faults.d.ts
 /**
  * This module maps each trigger of a cell to the acts of the lab, as data. The runner finds each
@@ -122,6 +145,9 @@ type Step = {
 } | {
   readonly do: "wait";
   readonly time: Quantity;
+} | {
+  readonly do: "apply";
+  readonly object: Readonly<Record<string, unknown>>;
 };
 /**
  * A fault plan is the steps of a run:
@@ -135,6 +161,17 @@ interface FaultPlan {
   readonly heal: readonly Step[];
   readonly restore: readonly Step[];
 }
+/** This name is the name of the AuthorizationPolicy of the trigger `authorization-policy`. */
+export declare const POLICY = "lab-deny";
+/** This service account is the account of the clients: their pods name no other account. */
+export declare const CLIENT_ACCOUNT = "default";
+/**
+ * This function gives the AuthorizationPolicy of the trigger `authorization-policy`. It denies each
+ * request to the server pods from the principal of the service account `account`. Istio gives a
+ * pod of the mesh the principal `cluster.local/ns/<namespace>/sa/<account>` of its account. The
+ * RBAC filter of the server sidecar reads the principal of the peer from its mTLS certificate.
+ */
+export declare const policyObject: (account: string) => Readonly<Record<string, unknown>>;
 /** This function gives the fault plan of a cell. */
 export declare const planOf: (cell: KindCell) => FaultPlan;
 /** This function tells if a trigger stops a pod of the service with its grace: a deletion, an eviction, a scale-in or a rollout. */
@@ -150,6 +187,66 @@ export declare const stageLabImage: () => string;
 /** This function builds the lab image one time for each process, and gives its tag. Docker keeps its layers between builds. */
 export declare const labImage: () => Promise<string>;
 //#endregion
+//#region src/istio.d.ts
+/**
+ * This module installs Istio 1.31.3 in a kind cluster with istioctl, from images pinned by digest.
+ * The release notes of 1.31.2 and 1.31.3 change no default that a cell of T15 reads. Each value
+ * of the install that is not a default of Istio is in `istioOperator`, with its reason.
+ */
+/** This version is the release of Istio of the lab: the tag of istioctl and of each image. */
+export declare const ISTIO_VERSION = "1.31.3";
+/**
+ * These are the images of the flavor `sidecar`, pinned by the digest of their index on Docker Hub
+ * (read on 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by
+ * its digest, tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls
+ * from a registry.
+ */
+export declare const ISTIO_IMAGES: {
+  readonly pilot: string;
+  readonly proxy: string;
+};
+/**
+ * This format is the JSON access log of each sidecar. Each field is a command of the formatter of
+ * Envoy v1.39.4. The fields give the status, the response flags and their details, and the gRPC
+ * status as a number. They also give the tries of the router, the upstream host and cluster, and
+ * the reasons of a failed connection. The watcher reads `code`, `flags`, `grpc` and `attempts`
+ * (`image/watch.mjs`).
+ */
+export declare const ACCESS_LOG_FORMAT: Readonly<Record<string, string>>;
+/** These are the local tags of the images, after the pull by digest. */
+interface MeshImages {
+  readonly pilot: string;
+  readonly proxy: string;
+}
+/**
+ * This function gives the IstioOperator of a flavor. The values that are not the defaults of Istio:
+ * - The profile `minimal` is istiod only. The profile `default` also has an ingress gateway, which no cell uses.
+ * - Each image is a full reference, thus the charts use it as it is (`contains "/"` in the
+ *   templates of istiod and of the injector). The init container of the injector has the image of the proxy too (`proxy_init`).
+ * - `imagePullPolicy: Never`: each image is on each node. An image that the lab did not load fails the install at once.
+ * - istiod requests 256 MiB, not 2 GiB, and has one replica with no autoscaler. Each node of kind
+ *   reports the whole runner, and no cell scales istiod.
+ * - The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
+ *
+ * The flavor `ambient` comes in a later step, thus it is refused.
+ */
+export declare const istioOperator: (flavor: MeshFlavor, images: MeshImages) => Record<string, unknown>;
+/**
+ * This function installs the mesh of a flavor in a cluster with `istioctl install` and the operator
+ * of the flavor. Then it waits for istiod. The kubeconfig of the cluster goes to istioctl.
+ */
+export declare const installMesh: (cluster: Cluster, flavor: MeshFlavor, images: MeshImages) => Promise<void>;
+/** This function gives the key of the mesh of a cell for its cluster: its flavor, or `none`. */
+export declare const meshKey: (cell: Pick<KindCell, "mesh">) => MeshFlavor | "none";
+/** This function gives the outbound cluster of the server of a cell in each client sidecar: the port 80 of its Service. */
+export declare const serverCluster: (namespace: string) => string;
+/** This time is the interval of the EDS poll of each client sidecar, the same as the poll of the rules. */
+export declare const EDS_EVERY: Quantity;
+/** This time is the interval of the LDS poll of each server sidecar, the same as the poll of EDS. */
+export declare const LDS_EVERY: Quantity;
+/** This function tells if the lab polls the LDS updates of the server sidecars of a cell: a policy in a sidecar mesh. */
+export declare const pollsListeners: (cell: Pick<KindCell, "mesh" | "trigger">) => boolean;
+//#endregion
 //#region src/lab.d.ts
 /** A stamp brackets an act on CLOCK_MONOTONIC, in milliseconds. */
 interface Stamp {
@@ -158,6 +255,25 @@ interface Stamp {
 }
 /** These kinds of kernel record stay in the raw record of a run. The lab counts the other kinds and drops them. */
 export declare const KEPT_KERNEL: ReadonlySet<string>;
+/** An EDS spec is the cluster that the EDS pollers read, their interval, and each client pod with its node and a PID in it. */
+interface EdsSpec {
+  readonly cluster: string;
+  readonly every: Quantity;
+  readonly pods: ReadonlyArray<{
+    readonly node: string;
+    readonly pod: string;
+    readonly pid: number;
+  }>;
+}
+/** An LDS spec is the interval of the LDS pollers, and each server pod with its node and a PID in it. */
+interface LdsSpec {
+  readonly every: Quantity;
+  readonly pods: ReadonlyArray<{
+    readonly node: string;
+    readonly pod: string;
+    readonly pid: number;
+  }>;
+}
 /** A kind lab is the instruments of one cluster: a sidecar pair on each node, the watcher of the API and the prober. */
 interface KindLab {
   readonly cluster: Cluster;
@@ -179,6 +295,17 @@ interface KindLab {
   rules(rule: (ServiceRule & {
     readonly every: Quantity;
   }) | null): Promise<void>;
+  /**
+   * This method asks each agent to poll the sidecar of each client pod of its node, `every` apart.
+   * Each poll gives the hosts of one cluster. With null, the polls stop. A pod gives the PID of one
+   * of its processes, and the agent enters the network namespace of that PID.
+   */
+  eds(spec: EdsSpec | null): Promise<void>;
+  /**
+   * This method asks each agent to poll the sidecar of each server pod of its node, `every` apart.
+   * Each poll gives the counters of LDS updates of that sidecar (`lds.ts`). With null, the polls stop.
+   */
+  lds(spec: LdsSpec | null): Promise<void>;
   act(node: string, spec: Readonly<Record<string, unknown>>): Promise<Stamp>;
   inject(node: string, pid: number, args: readonly string[]): Promise<Stamp>;
   now(): Promise<number>;
@@ -204,6 +331,25 @@ export declare const openKindLab: (cluster: Cluster, image: string) => Promise<K
 /** This function pins a Docker image by digest under a local tag that holds the digest, for `kind load` and `imagePullPolicy: Never`. */
 export declare const localPin: (image: string) => Promise<string>;
 //#endregion
+//#region src/lds.d.ts
+/**
+ * This filter of RE2 selects the two counters of the listener manager of Envoy that an update of LDS
+ * moves (`/stats?filter=`, `source/server/admin/stats_params.cc` of Envoy v1.39.4). An update of a
+ * listener counts `listener_modified`. An update in place, of its filter chains only, also counts
+ * `listener_in_place_updated` (`listener_manager_impl.cc:644`, `:692`).
+ */
+export declare const LDS_FILTER = "^listener_manager\\.listener_(in_place_updated|modified)$";
+/** The listener counts are the two counters of LDS of one sidecar: each update (`mod`), and each update in place (`inPlace`). */
+interface ListenerCounts {
+  readonly mod: number;
+  readonly inPlace: number;
+}
+/**
+ * This function gives the listener counts of the text of `/stats`, one `name: value` on each line
+ * (`stats_render.cc:15`). It gives null when the text has no counter `listener_modified`.
+ */
+export declare const listenerCountsOf: (text: string) => ListenerCounts | null;
+//#endregion
 //#region src/manifests.d.ts
 /**
  * This module generates the Kubernetes objects of a cell. They are its namespace, its Redis, the
@@ -217,6 +363,11 @@ export declare const stackOf: (cell: Pick<KindCell, "stack">) => Stack;
 export declare const REDIS_IMAGE = "redis:7.4@sha256:c6eabf748fc7a61dbb5a705c78bcf3d6377b1127a97d0ce965c11c44ba46896f";
 /** This function gives the namespace of a cell: `lab-` and 10 digits of the sha256 of its name. */
 export declare const namespaceOf: (cell: Pick<KindCell, "name">) => string;
+/**
+ * This function gives the Namespace object of a cell. In the sidecar mode of a mesh, the label
+ * `istio-injection=enabled` makes the injector of Istio put a sidecar in each pod of the namespace.
+ */
+export declare const namespaceObject: (cell: Pick<KindCell, "mesh">, namespace: string) => Record<string, unknown>;
 /**
  * This function gives a probe of the pod, with each field of the cell. The probe of the service is an
  * HTTP GET of its health server (`path`). The probe of grpc-go (`path` null) is the gRPC probe of the
@@ -379,7 +530,8 @@ export declare const runKindCells: (cells: readonly KindCell[], options: RunOpti
 export declare const estimatedTime: (cell: KindCell, environments?: number) => Quantity;
 /**
  * This function gives the share of a shard of a catalog: cells in sequence. Thus the cells of one
- * mode stay together and share clusters. Each shard gets an equal share of the estimated time.
+ * mode and one mesh flavor stay together and share clusters. Each shard gets an equal share of the
+ * estimated time. In one mode, the cells with no mesh come first, in the sequence of the catalog.
  */
 export declare const shardOf: <T extends KindCell>(cells: readonly T[], index: number, count: number) => T[];
 //#endregion
@@ -388,20 +540,38 @@ export declare const shardOf: <T extends KindCell>(cells: readonly T[], index: n
  * A tool is a binary that the lab downloads, at one pinned release, for each platform. The lab
  * keeps it in the cache folder of this package and does not install it on the system. Each use
  * compares its sha256 with the pinned value.
+ *
+ * A tool with an `entry` comes in a gzipped tar file. The pinned sha256 is the sha256 of that file.
+ * The cache keeps the file, and each use takes the entry from it again.
  */
 interface Tool {
-  readonly name: "kind" | "kubectl";
+  readonly name: "kind" | "kubectl" | "istioctl";
   readonly version: string;
   /** These are the release assets, by the platform and the architecture of Node: `win32-x64`, `linux-x64`. */
   readonly assets: Readonly<Record<string, {
     readonly url: string;
     readonly sha256: string;
   }>>;
+  /** This name is the file of the tool in its gzipped tar file, or nothing for a tool that is its own asset. */
+  readonly entry?: string | undefined;
 }
 /** This release of kind is v0.33.0, from 2026-08-26. Its default node image is Kubernetes 1.37.0. The sums are from its `.sha256sum` assets. */
 export declare const KIND: Tool;
 /** This release of kubectl is v1.37.0, the version of the node image. The sums are from the `.sha256` files of `dl.k8s.io`. */
 export declare const KUBECTL: Tool;
+/**
+ * This release of istioctl is 1.31.3, from 2026-10-22. It holds the charts of its own version, thus the
+ * lab needs no other tool to install Istio. The sums are from the `.sha256` assets of the release. The
+ * release has a zip file for Windows, and the lab reads only a gzipped tar file. Thus Windows has no asset.
+ */
+export declare const ISTIOCTL: Tool;
+/**
+ * This function gives the bytes of one file of a gzipped tar file. A header of the ustar format has
+ * 512 bytes. It has the name at 0, the size in octal at 124, the type at 156 and the prefix of the
+ * name at 345. The data follows the header, in blocks of 512 bytes. The match is on the last part of the
+ * name. A link, a folder and an extended header are not a file, thus the search skips them.
+ */
+export declare const tarEntry: (gzipped: Uint8Array, entry: string) => Uint8Array;
 /** This folder is the cache of the tools: `.cache/` in this package, which git ignores. `KIND_CACHE` names another folder. */
 export declare const cacheFolder: () => string;
 /** This function gives the platform key of this process, as the assets name it. */
@@ -412,9 +582,11 @@ export declare const sha256: (bytes: Uint8Array) => string;
 export declare const toolPath: (tool: Tool, key?: string, cache?: string) => string;
 /**
  * This function gives the path of a tool, after a download when the cache does not have it. It
- * refuses bytes whose sha256 is not the pinned value, from the cache or from the download.
+ * refuses bytes whose sha256 is not the pinned value, from the cache or from the download. For a
+ * tool in a tar file, the cache keeps the tar file beside the tool. Each use examines the tar file,
+ * and writes the tool again when its bytes are not those of the entry.
  */
 export declare const ensureTool: (tool: Tool, key?: string, cache?: string) => Promise<string>;
 //#endregion
-export { type Band, type BandV1, CLIENT, type Cluster, type ClusterManifest, type Credentials, type Declaration, type Deleted, type DeletionWindow, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, Line, type LoadSample, NODE_IMAGES, type NodeImage, PORT, type Parts, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, type Propagation, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type ServiceRule, SliceLine, type Stack, type Stamp, type Step, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, type Verdicts, type Workload, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stoppingOf, timeSpread, transitionOf, unitOf, upgrade, upgradeCell };
+export { type Band, type BandV1, CLIENT, type Cluster, type ClusterHosts, type ClusterManifest, type Credentials, type Declaration, type Deleted, type DeletionWindow, type EdsSpec, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, type FaultPlan, HEALTH_PORT, type Judged, KIND_NOISE, KUBE_PROXY_MODES, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindConfig, type KindDecision, type KindLab, type KindRun, type KindScenario, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, type LdsSpec, Line, type ListenerCounts, type LoadSample, type Mesh, type MeshFlavor, type MeshImages, type MeshMode, NODE_IMAGES, type NodeImage, PORT, type Parts, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, type Propagation, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, type RunOptions, SERVER, STAGES, type ServiceRule, SliceLine, type Stack, type Stamp, type Step, type Target, type Template, type TimeSpread, type Tool, type Trigger, type TriggerKind, type TriggerV1, type Verdicts, type Workload, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, cidrOverlap, cidrRange, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, goDuration, intakeOf, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, medianInterval, medianText, middle, nodeNames, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartsAt, reusesReset, rulesOf, scenario, scenarioProblems, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stoppingOf, timeSpread, transitionOf, unitOf, updatesOf, upgrade, upgradeCell };
 //# sourceMappingURL=index.d.ts.map