@mark1russell7/kind 0.2.3 → 0.4.0

package/build/index.js

@@ -1,4 +1,4 @@
-import { $ as transitionOf, A as quantileOf, B as outcomesOf, C as propagationOf, D as RELATIVE, E as unitOf, F as dropOf, G as restartsAt, H as podsOf, I as emptyOf, J as signalsOf, K as rulesOf, L as failuresOf, M as byClients, N as byNode, O as medianInterval, P as deletionOf, Q as stoppingOf, R as intakeOf, S as observationEnd, T as reusesReset, U as recordsOf, V as podsAt, W as requestsOf, X as sliceEmptyOf, Y as sliceDropOf, Z as slicesOf, _ as checkRun, a as calibrationOf, at as SERVER, b as judgeKind, c as predictionText, ct as secondsOf, d as FORMAT_V1, et as CLIENT, f as judge, g as LAST_SLACK, h as KIND_NOISE, i as readRecord, it as REDIS, j as backendsAt, k as middle, l as timeSpread, lt as showBand, m as upgradeCell, n as kindCellRecordSchema, nt as LOG_LABEL, o as cellsTable, ot as bandOf, p as upgrade, q as signalOf, r as kindCellRecordV1Schema, rt as PORT, s as medianText, st as seconds, t as STAGES, tt as HEALTH_PORT, u as FORMAT, v as deletionsOf, w as referenceOf, x as observationAfter, y as factsOf, z as kernelCounts } from "./judge-B3CHoiTW.js";
+import { $ as slicesOf, A as medianInterval, B as intakeOf, C as propagationOf, D as unitOf, E as reusesReset, F as byNode, G as recordsOf, H as outcomesOf, I as deletionOf, J as rulesOf, K as requestsOf, L as dropOf, M as quantileOf, N as backendsAt, O as updatesOf, P as byClients, Q as sliceEmptyOf, R as emptyOf, S as observationEnd, T as referenceOf, U as podsAt, V as kernelCounts, W as podsOf, X as signalsOf, Y as signalOf, Z as sliceDropOf, _ as checkRun, a as calibrationOf, at as PORT, b as judgeKind, c as predictionText, ct as bandOf, d as FORMAT_V1, dt as showBand, et as stoppingOf, f as judge, g as LAST_SLACK, h as KIND_NOISE, i as readRecord, it as LOG_LABEL, j as middle, k as RELATIVE, l as timeSpread, lt as seconds, m as upgradeCell, n as kindCellRecordSchema, nt as CLIENT, o as cellsTable, ot as REDIS, p as upgrade, q as restartsAt, r as kindCellRecordV1Schema, rt as HEALTH_PORT, s as medianText, st as SERVER, t as STAGES, tt as transitionOf, u as FORMAT, ut as secondsOf, v as deletionsOf, w as propagationSource, x as observationAfter, y as factsOf, z as failuresOf } from "./judge-Bkbs7VVG.js";
 import { valueIn } from "@mark1russell7/quantity";
 import { execFile, execFileSync } from "node:child_process";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -6,6 +6,7 @@ import { dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
+import { gunzipSync } from "node:zlib";
 import { failSpan, lint, service } from "@mark1russell7/service";
 import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
@@ -227,6 +228,57 @@ const KUBECTL = {
 		}
 	}
 };
+/**
+* This release of istioctl is 1.31.3, from 2026-10-22. It holds the charts of its own version, thus the
+* lab needs no other tool to install Istio. The sums are from the `.sha256` assets of the release. The
+* release has a zip file for Windows, and the lab reads only a gzipped tar file. Thus Windows has no asset.
+*/
+const ISTIOCTL = {
+	name: "istioctl",
+	version: "1.31.3",
+	entry: "istioctl",
+	assets: {
+		"linux-x64": {
+			url: "https://github.com/istio/istio/releases/download/1.31.3/istioctl-1.31.3-linux-amd64.tar.gz",
+			sha256: "382c3004ce2e9c5ed3064b092ae0da7f6bbe30c766a1be282f45725add004860"
+		},
+		"linux-arm64": {
+			url: "https://github.com/istio/istio/releases/download/1.31.3/istioctl-1.31.3-linux-arm64.tar.gz",
+			sha256: "7476801623dbb900073cb1dba6a23b6a15c564b7e92b208aed36829315fefff1"
+		},
+		"darwin-arm64": {
+			url: "https://github.com/istio/istio/releases/download/1.31.3/istioctl-1.31.3-osx-arm64.tar.gz",
+			sha256: "881c3b443d9e458e8f19feed6ffa187dcfcb03dc032cb56068f7d1d0cd976c82"
+		}
+	}
+};
+/**
+* This function gives the bytes of one file of a gzipped tar file. A header of the ustar format has
+* 512 bytes. It has the name at 0, the size in octal at 124, the type at 156 and the prefix of the
+* name at 345. The data follows the header, in blocks of 512 bytes. The match is on the last part of the
+* name. A link, a folder and an extended header are not a file, thus the search skips them.
+*/
+const tarEntry = (gzipped, entry) => {
+	const tar = gunzipSync(gzipped);
+	const text = (from, length) => {
+		const field = tar.subarray(from, from + length);
+		const end = field.indexOf(0);
+		return field.subarray(0, end === -1 ? field.length : end).toString("latin1");
+	};
+	let at = 0;
+	while (at + 512 <= tar.length) {
+		const name = text(at, 100);
+		if (name === "") break;
+		const size = Number.parseInt(text(at + 124, 12).trim() || "0", 8);
+		if (!Number.isFinite(size)) throw new Error(`the tar entry ${name} has no size in octal`);
+		const type = String.fromCharCode(tar[at + 156] ?? 0);
+		const prefix = text(at + 345, 155);
+		const full = prefix === "" ? name : `${prefix}/${name}`;
+		if ((type === "0" || type === "\0") && full.split("/").at(-1) === entry) return new Uint8Array(tar.subarray(at + 512, at + 512 + size));
+		at += 512 + Math.ceil(size / 512) * 512;
+	}
+	throw new Error(`the tar file has no file ${entry}`);
+};
 /** This folder is the cache of the tools: `.cache/` in this package, which git ignores. `KIND_CACHE` names another folder. */
 const cacheFolder = () => process.env["KIND_CACHE"] ?? fileURLToPath(new URL("../.cache/", import.meta.url));
 /** This function gives the platform key of this process, as the assets name it. */
@@ -235,29 +287,43 @@ const platformKey = (platform = process.platform, arch = process.arch) => `${pla
 const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
 /** This function gives the path of a tool in the cache, for a platform. */
 const toolPath = (tool, key = platformKey(), cache = cacheFolder()) => join(cache, "tools", `${tool.name}-${tool.version}-${key}`, key.startsWith("win32") ? `${tool.name}.exe` : tool.name);
+/** This function writes a file through a partial file, thus a stop in the middle leaves no file at the path. */
+const writeWhole = (path, bytes, executable) => {
+	mkdirSync(dirname(path), { recursive: true });
+	const partial = `${path}.partial`;
+	writeFileSync(partial, bytes);
+	if (executable) chmodSync(partial, 493);
+	renameSync(partial, path);
+};
 /**
 * This function gives the path of a tool, after a download when the cache does not have it. It
-* refuses bytes whose sha256 is not the pinned value, from the cache or from the download.
+* refuses bytes whose sha256 is not the pinned value, from the cache or from the download. For a
+* tool in a tar file, the cache keeps the tar file beside the tool. Each use examines the tar file,
+* and writes the tool again when its bytes are not those of the entry.
 */
 const ensureTool = async (tool, key = platformKey(), cache = cacheFolder()) => {
 	const asset = tool.assets[key];
 	if (asset === void 0) throw new Error(`${tool.name} ${tool.version} has no pinned asset for ${key}`);
 	const path = toolPath(tool, key, cache);
-	if (existsSync(path)) {
-		const found = sha256(readFileSync(path));
-		if (found !== asset.sha256) throw new Error(`${path} has the sha256 ${found}, not the pinned ${asset.sha256}`);
-		return path;
+	const executable = !key.startsWith("win32");
+	const kept = tool.entry === void 0 ? path : `${path}.tar.gz`;
+	let bytes;
+	if (existsSync(kept)) {
+		bytes = readFileSync(kept);
+		const found = sha256(bytes);
+		if (found !== asset.sha256) throw new Error(`${kept} has the sha256 ${found}, not the pinned ${asset.sha256}`);
+		if (tool.entry === void 0) return path;
+	} else {
+		const response = await fetch(asset.url, { redirect: "follow" });
+		if (!response.ok) throw new Error(`the download of ${asset.url} answered ${response.status}`);
+		bytes = new Uint8Array(await response.arrayBuffer());
+		const found = sha256(bytes);
+		if (found !== asset.sha256) throw new Error(`${asset.url} has the sha256 ${found}, not the pinned ${asset.sha256}`);
+		writeWhole(kept, bytes, executable && tool.entry === void 0);
+		if (tool.entry === void 0) return path;
 	}
-	const response = await fetch(asset.url, { redirect: "follow" });
-	if (!response.ok) throw new Error(`the download of ${asset.url} answered ${response.status}`);
-	const bytes = new Uint8Array(await response.arrayBuffer());
-	const found = sha256(bytes);
-	if (found !== asset.sha256) throw new Error(`${asset.url} has the sha256 ${found}, not the pinned ${asset.sha256}`);
-	mkdirSync(dirname(path), { recursive: true });
-	const partial = `${path}.partial`;
-	writeFileSync(partial, bytes);
-	if (!key.startsWith("win32")) chmodSync(partial, 493);
-	renameSync(partial, path);
+	const binary = tarEntry(bytes, tool.entry);
+	if (!existsSync(path) || sha256(readFileSync(path)) !== sha256(binary)) writeWhole(path, binary, executable);
 	return path;
 };
 //#endregion
@@ -507,6 +573,37 @@ const compose = (name, declaration, parts = {}) => {
 	return svc;
 };
 //#endregion
+//#region src/eds.ts
+/**
+* This function gives the name of the outbound cluster of a Service port in a sidecar of Istio:
+* `outbound|<port>||<service>.<namespace>.svc.cluster.local`.
+*/
+const outboundCluster = (service, namespace, port) => `outbound|${port}||${service}.${namespace}.svc.cluster.local`;
+/** This function gives the filter of `/clusters` that selects one cluster: a regular expression of RE2 with anchors. */
+const clusterFilter = (cluster) => `^${cluster.replace(/[.|\\^$*+?()[\]{}]/g, (c) => `\\${c}`)}$`;
+/**
+* This function gives the hosts of a cluster from the text of `/clusters`. Each host of the text has
+* a line `<cluster>::<ip:port>::health_flags::<flags>`. The flags are `healthy`, or the names of the
+* flags that the host has (`clusters_handler.cc` and `host_utility.cc` of Envoy v1.39.4).
+*/
+const hostsOf = (text, cluster) => {
+	const healthy = [];
+	const other = {};
+	const prefix = `${cluster}::`;
+	for (const line of text.split("\n")) {
+		if (!line.startsWith(prefix)) continue;
+		const parts = line.slice(prefix.length).split("::");
+		if (parts.length !== 3 || parts[1] !== "health_flags") continue;
+		const [host, , flags] = parts;
+		if (flags.trim() === "healthy") healthy.push(host);
+		else other[host] = flags.trim();
+	}
+	return {
+		b: healthy.sort(),
+		u: other
+	};
+};
+//#endregion
 //#region src/faults.ts
 const needs = (time, what) => {
 	if (time === void 0) throw new Error(`the trigger needs ${what}`);
@@ -522,6 +619,29 @@ const NODE = "{node}";
 const VERSION = "{version}";
 /** This annotation of a pod is its deletion cost for its ReplicaSet: a lower cost goes first at a scale-in. */
 const DELETION_COST = "controller.kubernetes.io/pod-deletion-cost";
+/** This name is the name of the AuthorizationPolicy of the trigger `authorization-policy`. */
+const POLICY = "lab-deny";
+/** This service account is the account of the clients: their pods name no other account. */
+const CLIENT_ACCOUNT = "default";
+/**
+* This function gives the AuthorizationPolicy of the trigger `authorization-policy`. It denies each
+* request to the server pods from the principal of the service account `account`. Istio gives a
+* pod of the mesh the principal `cluster.local/ns/<namespace>/sa/<account>` of its account. The
+* RBAC filter of the server sidecar reads the principal of the peer from its mTLS certificate.
+*/
+const policyObject = (account) => ({
+	apiVersion: "security.istio.io/v1",
+	kind: "AuthorizationPolicy",
+	metadata: {
+		name: POLICY,
+		namespace: "{namespace}"
+	},
+	spec: {
+		selector: { matchLabels: { app: "lab" } },
+		action: "DENY",
+		rules: [{ from: [{ source: { principals: [`cluster.local/ns/{namespace}/sa/${account}`] } }] }]
+	}
+});
 /** This function gives the fault plan of a cell. */
 const planOf = (cell) => {
 	const ns = ["-n", "{namespace}"];
@@ -784,6 +904,32 @@ const planOf = (cell) => {
 				restore: []
 			};
 		}
+		case "authorization-policy": return {
+			inject: [{
+				do: "apply",
+				object: policyObject(trigger.account ?? "default")
+			}],
+			hold: needs(trigger.hold, "a hold"),
+			heal: [{
+				do: "kubectl",
+				args: [
+					...ns,
+					"delete",
+					"authorizationpolicy",
+					POLICY
+				]
+			}],
+			restore: [{
+				do: "kubectl",
+				args: [
+					...ns,
+					"delete",
+					"authorizationpolicy",
+					POLICY,
+					"--ignore-not-found"
+				]
+			}]
+		};
 	}
 };
 /** This function tells if a trigger stops a pod of the service with its grace: a deletion, an eviction, a scale-in or a rollout. */
@@ -818,7 +964,9 @@ const FILES = [
 	["compose.ts", "src/compose.ts"],
 	["backends.ts", "src/backends.ts"],
 	["conntrack.ts", "src/conntrack.ts"],
-	["drops.ts", "src/drops.ts"]
+	["drops.ts", "src/drops.ts"],
+	["eds.ts", "src/eds.ts"],
+	["lds.ts", "src/lds.ts"]
 ];
 const shell = process.platform === "win32";
 /** This function gives each file of a staged context, with its path in the context, in a stable sequence. */
@@ -912,6 +1060,166 @@ const labImage = () => {
 	return built;
 };
 //#endregion
+//#region src/istio.ts
+/**
+* This module installs Istio 1.31.3 in a kind cluster with istioctl, from images pinned by digest.
+* The release notes of 1.31.2 and 1.31.3 change no default that a cell of T15 reads. Each value
+* of the install that is not a default of Istio is in `istioOperator`, with its reason.
+*/
+/** This version is the release of Istio of the lab: the tag of istioctl and of each image. */
+const ISTIO_VERSION = "1.31.3";
+/**
+* These are the images of the flavor `sidecar`, pinned by the digest of their index on Docker Hub
+* (read on 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by
+* its digest, tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls
+* from a registry.
+*/
+const ISTIO_IMAGES = {
+	pilot: "istio/pilot:1.31.3@sha256:6ad1e816c4d4767ba3f30a6286a96d121851ddb23d33e20736758acb5f3f4ea9",
+	proxy: "istio/proxyv2:1.31.3@sha256:eb74eacea98d3fb1e239ea84016085155478586a554158676b9b67d960151084"
+};
+/**
+* This format is the JSON access log of each sidecar. Each field is a command of the formatter of
+* Envoy v1.39.4. The fields give the status, the response flags and their details, and the gRPC
+* status as a number. They also give the tries of the router, the upstream host and cluster, and
+* the reasons of a failed connection. The watcher reads `code`, `flags`, `grpc` and `attempts`
+* (`image/watch.mjs`).
+*/
+const ACCESS_LOG_FORMAT = {
+	start: "%START_TIME%",
+	code: "%RESPONSE_CODE%",
+	flags: "%RESPONSE_FLAGS%",
+	details: "%RESPONSE_CODE_DETAILS%",
+	grpc: "%GRPC_STATUS_NUMBER%",
+	attempts: "%UPSTREAM_REQUEST_ATTEMPT_COUNT%",
+	host: "%UPSTREAM_HOST%",
+	cluster: "%UPSTREAM_CLUSTER%",
+	local: "%DOWNSTREAM_LOCAL_ADDRESS%",
+	remote: "%DOWNSTREAM_REMOTE_ADDRESS%",
+	duration: "%DURATION%",
+	failure: "%UPSTREAM_TRANSPORT_FAILURE_REASON%",
+	termination: "%CONNECTION_TERMINATION_DETAILS%"
+};
+/**
+* This function gives the IstioOperator of a flavor. The values that are not the defaults of Istio:
+* - The profile `minimal` is istiod only. The profile `default` also has an ingress gateway, which no cell uses.
+* - Each image is a full reference, thus the charts use it as it is (`contains "/"` in the
+*   templates of istiod and of the injector). The init container of the injector has the image of the proxy too (`proxy_init`).
+* - `imagePullPolicy: Never`: each image is on each node. An image that the lab did not load fails the install at once.
+* - istiod requests 256 MiB, not 2 GiB, and has one replica with no autoscaler. Each node of kind
+*   reports the whole runner, and no cell scales istiod.
+* - The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
+*
+* The flavor `ambient` comes in a later step, thus it is refused.
+*/
+const istioOperator = (flavor, images) => {
+	if (flavor !== "sidecar") throw new Error(`the lab installs the mesh flavor sidecar only, not ${flavor}`);
+	return {
+		apiVersion: "install.istio.io/v1alpha1",
+		kind: "IstioOperator",
+		metadata: {
+			name: "lab",
+			namespace: "istio-system"
+		},
+		spec: {
+			profile: "minimal",
+			hub: "docker.io/istio",
+			tag: ISTIO_VERSION,
+			meshConfig: {
+				accessLogFile: "/dev/stdout",
+				accessLogEncoding: "JSON",
+				accessLogFormat: JSON.stringify(ACCESS_LOG_FORMAT)
+			},
+			values: {
+				global: {
+					imagePullPolicy: "Never",
+					proxy: { image: images.proxy },
+					proxy_init: { image: images.proxy }
+				},
+				pilot: {
+					image: images.pilot,
+					autoscaleEnabled: false,
+					replicaCount: 1,
+					resources: { requests: {
+						cpu: "500m",
+						memory: "256Mi"
+					} }
+				}
+			}
+		}
+	};
+};
+/**
+* This function installs the mesh of a flavor in a cluster with `istioctl install` and the operator
+* of the flavor. Then it waits for istiod. The kubeconfig of the cluster goes to istioctl.
+*/
+const installMesh = async (cluster, flavor, images) => {
+	const istioctl = await ensureTool(ISTIOCTL);
+	const file = join(cluster.dir, `istio-${flavor}.json`);
+	writeFileSync(file, `${JSON.stringify(istioOperator(flavor, images), null, 2)}\n`);
+	await command(istioctl, [
+		"install",
+		"--kubeconfig",
+		cluster.kubeconfig,
+		"-y",
+		"-f",
+		file,
+		"--readiness-timeout",
+		"10m0s"
+	], { timeout: 9e5 });
+	await cluster.kubectl([
+		"-n",
+		"istio-system",
+		"rollout",
+		"status",
+		"deployment/istiod",
+		"--timeout=300s"
+	]);
+};
+/** This function gives the key of the mesh of a cell for its cluster: its flavor, or `none`. */
+const meshKey = (cell) => cell.mesh?.flavor ?? "none";
+/** This function gives the outbound cluster of the server of a cell in each client sidecar: the port 80 of its Service. */
+const serverCluster = (namespace) => outboundCluster("lab", namespace, 80);
+/** This time is the interval of the EDS poll of each client sidecar, the same as the poll of the rules. */
+const EDS_EVERY = {
+	value: 50,
+	unit: "ms"
+};
+/** This time is the interval of the LDS poll of each server sidecar, the same as the poll of EDS. */
+const LDS_EVERY = {
+	value: 50,
+	unit: "ms"
+};
+/** This function tells if the lab polls the LDS updates of the server sidecars of a cell: a policy in a sidecar mesh. */
+const pollsListeners = (cell) => cell.mesh?.mode === "sidecar" && cell.trigger.kind === "authorization-policy";
+//#endregion
+//#region src/lds.ts
+/**
+* This filter of RE2 selects the two counters of the listener manager of Envoy that an update of LDS
+* moves (`/stats?filter=`, `source/server/admin/stats_params.cc` of Envoy v1.39.4). An update of a
+* listener counts `listener_modified`. An update in place, of its filter chains only, also counts
+* `listener_in_place_updated` (`listener_manager_impl.cc:644`, `:692`).
+*/
+const LDS_FILTER = "^listener_manager\\.listener_(in_place_updated|modified)$";
+/**
+* This function gives the listener counts of the text of `/stats`, one `name: value` on each line
+* (`stats_render.cc:15`). It gives null when the text has no counter `listener_modified`.
+*/
+const listenerCountsOf = (text) => {
+	let mod = null;
+	let inPlace = 0;
+	for (const line of text.split("\n")) {
+		const match = /^listener_manager\.listener_(in_place_updated|modified): (\d+)$/.exec(line.trim());
+		if (match === null) continue;
+		if (match[1] === "modified") mod = Number(match[2]);
+		else inPlace = Number(match[2]);
+	}
+	return mod === null ? null : {
+		mod,
+		inPlace
+	};
+};
+//#endregion
 //#region src/conntrack.ts
 /** This function gives the count of entries that `conntrack -D` deleted, from its last line: "N flow entries have been deleted". */
 const deletedOf = (text) => {
@@ -1019,6 +1327,33 @@ const openKindLab = async (cluster, image) => {
 		return found;
 	};
 	const firstNode = cluster.nodes[0];
+	/**
+	* This function writes the file of the pollers of one kind on each agent: `fields`, the interval
+	* and the pods of its node. A node without a pod, or a spec of null, gets no file.
+	*/
+	const pollersOf = async (kind, fields, spec) => {
+		for (const [node, { agent }] of sidecars) {
+			const pods = spec === null ? [] : spec.pods.filter((pod) => pod.node === node).map(({ pod, pid }) => ({
+				pod,
+				pid
+			}));
+			const file = spec === null || pods.length === 0 ? null : JSON.stringify({
+				...fields,
+				every: valueIn(spec.every, "ms"),
+				pods
+			});
+			if (file === null) await output(agent, [
+				"rm",
+				"-f",
+				`/tmp/${kind}.json`
+			]);
+			else await output(agent, [
+				"sh",
+				"-c",
+				`printf '%s' '${file}' > /tmp/${kind}.json.partial && mv /tmp/${kind}.json.partial /tmp/${kind}.json`
+			]);
+		}
+	};
 	const lab = {
 		cluster,
 		image,
@@ -1093,6 +1428,12 @@ const openKindLab = async (cluster, image) => {
 				`printf '%s' '${file}' > /tmp/rules.json`
 			]);
 		},
+		async eds(spec) {
+			await pollersOf("eds", spec === null ? null : { cluster: spec.cluster }, spec);
+		},
+		async lds(spec) {
+			await pollersOf("lds", {}, spec);
+		},
 		async forgetHandshakes(ip, port) {
 			const out = {};
 			for (const [node, { agent }] of sidecars) {
@@ -1251,6 +1592,18 @@ const whole = (amount, what) => {
 /** This function gives the namespace of a cell: `lab-` and 10 digits of the sha256 of its name. */
 const namespaceOf = (cell) => `lab-${createHash("sha256").update(cell.name).digest("hex").slice(0, 10)}`;
 /**
+* This function gives the Namespace object of a cell. In the sidecar mode of a mesh, the label
+* `istio-injection=enabled` makes the injector of Istio put a sidecar in each pod of the namespace.
+*/
+const namespaceObject = (cell, namespace) => ({
+	apiVersion: "v1",
+	kind: "Namespace",
+	metadata: {
+		name: namespace,
+		...cell.mesh?.mode === "sidecar" ? { labels: { "istio-injection": "enabled" } } : {}
+	}
+});
+/**
 * This function gives a probe of the pod, with each field of the cell. The probe of the service is an
 * HTTP GET of its health server (`path`). The probe of grpc-go (`path` null) is the gRPC probe of the
 * kubelet. It is a Check of the service "" on the port of the server, and the answer is SERVING until
@@ -1808,11 +2161,17 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const slug = (name) => name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
 /** This function tells if a cell has Redis: only a declaration of the service can have it. */
 const hasRedis = (cell) => cell.declaration !== null && cell.declaration.redis !== null;
-/** This tracker keeps the latest state of the cell from the lines: each pod, each slice, the backends of each node and each client. */
+/** This function gives the key of the cluster of a cell: its kube-proxy mode, its node count, and the flavor of its mesh. */
+const clusterKey = (cell) => cell.mesh === void 0 ? `${cell.mode}-${cell.workers}` : `${cell.mode}-${cell.workers}-${cell.mesh.flavor}`;
+/**
+* This tracker keeps the latest state of the cell from the lines: each pod, each slice and each
+* client. It also has, for each node, the backends of its rules and the hosts of its client sidecar.
+*/
 var Tracker = class {
 	pods = /* @__PURE__ */ new Map();
 	slices = /* @__PURE__ */ new Map();
 	backends = /* @__PURE__ */ new Map();
+	hosts = /* @__PURE__ */ new Map();
 	clients = /* @__PURE__ */ new Map();
 	/** This map is the backend of the last answer of each client, by client. */
 	answers = /* @__PURE__ */ new Map();
@@ -1827,6 +2186,7 @@ var Tracker = class {
 			if (line["type"] === "DELETED") this.slices.delete(String(line["name"]));
 			else this.slices.set(String(line["name"]), line);
 		} else if (line.ev === "rules") this.backends.set(String(line["node"]), line["b"]);
+		else if (line.ev === "eds") this.hosts.set(String(line["node"]), line["b"]);
 		else if (line.ev === "req") {
 			const request = line;
 			const client = this.clients.get(request.p) ?? {
@@ -1861,6 +2221,9 @@ const unsteady = (ctx) => {
 	if (ready.join() !== ips.join()) return `the EndpointSlice has ${ready.join(" ")}, not ${ips.join(" ")}`;
 	const expected = ips.map((ip) => `${ip}:8080`).sort().join();
 	for (const node of ctx.cluster.nodes) if ((tracker.backends.get(node) ?? []).join() !== expected) return `the rules of ${node} have ${(tracker.backends.get(node) ?? []).join(" ")}`;
+	if (cell.mesh?.mode === "sidecar") {
+		for (const node of ctx.cluster.nodes) if ((tracker.hosts.get(node) ?? []).join() !== expected) return `the client sidecar of ${node} has ${(tracker.hosts.get(node) ?? []).join(" ") || "no host"}`;
+	}
 	const nodes = new Set([...tracker.clients.values()].map((client) => client.node));
 	if (nodes.size !== ctx.cluster.nodes.length) return `clients answer on ${nodes.size} nodes`;
 	for (const [pod, client] of tracker.clients) {
@@ -1923,11 +2286,7 @@ const quiet = async (ctx, ours) => {
 * the backoff of grpc-js longer, up to 120 s.
 */
 const deploy = async (lab, cluster, cell, namespace, images) => {
-	await cluster.apply([{
-		apiVersion: "v1",
-		kind: "Namespace",
-		metadata: { name: namespace }
-	}]);
+	await cluster.apply([namespaceObject(cell, namespace)]);
 	await lab.watch([namespace]);
 	if (hasRedis(cell)) {
 		await cluster.apply(redisObjects(namespace, images.redis));
@@ -1979,8 +2338,62 @@ const deploy = async (lab, cluster, cell, namespace, images) => {
 		port: 80,
 		every: RULES_EVERY
 	});
+	if (cell.mesh?.mode === "sidecar") await pollEndpoints(lab, cluster, namespace);
 	return clusterIp;
 };
+/**
+* This function starts the EDS poll of the client sidecar on each node: the hosts of the server
+* cluster, each 50 ms. The agent enters the network namespace of the client pod through the PID of
+* its client process. The sidecar shares that namespace.
+*/
+const pollEndpoints = async (lab, cluster, namespace) => {
+	const listed = JSON.parse(await cluster.kubectl([
+		"-n",
+		namespace,
+		"get",
+		"pods",
+		"-l",
+		`app=${CLIENT}`,
+		"-o",
+		"json"
+	]));
+	const pods = [];
+	for (const item of listed.items.filter((each) => each.metadata.deletionTimestamp === void 0)) {
+		const node = item.spec.nodeName ?? "";
+		pods.push({
+			node,
+			pod: item.metadata.name,
+			pid: await lab.pidOf(node, namespace, item.metadata.name, CLIENT)
+		});
+	}
+	await lab.eds({
+		cluster: serverCluster(namespace),
+		every: EDS_EVERY,
+		pods
+	});
+};
+/**
+* This function starts the LDS poll of the sidecar of each server pod, each 50 ms, for a cell that
+* polls them (`pollsListeners`). It starts the pollers again only when the server pods changed. The
+* agent enters the network namespace of the pod through the PID of its app.
+*/
+const pollListeners = async (ctx) => {
+	if (!pollsListeners(ctx.cell)) return;
+	const servers = ctx.tracker.servers().filter((pod) => !pod.del && pod.node !== null);
+	const key = servers.map((pod) => `${pod.name}/${pod.cs.map((status) => status.id).join("+")}`).sort().join();
+	if (key === ctx.listened) return;
+	const pods = [];
+	for (const pod of servers) pods.push({
+		node: pod.node,
+		pod: pod.name,
+		pid: await ctx.lab.pidOf(pod.node, ctx.namespace, pod.name, "app")
+	});
+	await ctx.lab.lds({
+		every: LDS_EVERY,
+		pods
+	});
+	ctx.listened = key;
+};
 /** This function starts the prober again when the pods of the cell changed: it watches the namespace of each pod. */
 const probeThePods = async (ctx) => {
 	const pods = [...ctx.tracker.pods.values()].filter((pod) => !pod.del && pod.node !== null && pod.cs.every((status) => status.st === "running"));
@@ -2128,6 +2541,15 @@ const doStep = async (ctx, step, replicas, background) => {
 		case "wait":
 			await sleep(valueIn(step.time, "ms"));
 			return null;
+		case "apply": {
+			const object = JSON.parse(fill([JSON.stringify(step.object)])[0]);
+			const t0 = await lab.now();
+			await cluster.apply([object]);
+			return {
+				t0,
+				t1: await lab.now()
+			};
+		}
 	}
 };
 /** This function tells if a run is over: the trigger is done, and the cell is at rest again. */
@@ -2143,7 +2565,7 @@ const over = (ctx, run, lines) => {
 		"node-drain",
 		"scale-in",
 		"freeze-process"
-	].includes(kind) && ctx.cell.template === "T07") return kind === "scale-in" || kind === "node-drain" ? run.replicas.some((replica) => !ctx.tracker.pods.has(replica.pod)) : !ctx.tracker.pods.has(run.target.pod);
+	].includes(kind) && (ctx.cell.template === "T07" || ctx.cell.template === "T15")) return kind === "scale-in" || kind === "node-drain" ? run.replicas.some((replica) => !ctx.tracker.pods.has(replica.pod)) : !ctx.tracker.pods.has(run.target.pod);
 	if (kind === "rolling-update" || kind === "rollout") return run.replicas.every((replica) => !ctx.tracker.pods.has(replica.pod));
 	if (kind === "app-stall") return lines.some((line) => line.ev === "stall" && line["phase"] === "end");
 	return true;
@@ -2179,6 +2601,7 @@ const runOnce = async (ctx, env, index, warmup, ours) => {
 	});
 	if (atRest !== null) return empty(`the cell was not at rest: ${atRest}`, await lab.now());
 	await probeThePods(ctx);
+	await pollListeners(ctx);
 	await quiet(ctx, ours);
 	if (await steady(ctx, 3e5) !== null) return empty("the cell was not at rest after the wait for a quiet VM", await lab.now());
 	const replicas = replicasOf(ctx);
@@ -2348,17 +2771,22 @@ const runKindCells = async (cells, options) => {
 	const images = {
 		lab: image,
 		redis: redisImage,
-		grpc: grpcImage
+		grpc: grpcImage,
+		mesh: cells.some((cell) => cell.mesh !== void 0) ? {
+			pilot: await localPin(ISTIO_IMAGES.pilot),
+			proxy: await localPin(ISTIO_IMAGES.proxy)
+		} : void 0
 	};
 	const groups = /* @__PURE__ */ new Map();
-	for (const cell of cells) groups.set(`${cell.mode}-${cell.workers}`, [...groups.get(`${cell.mode}-${cell.workers}`) ?? [], cell]);
+	for (const cell of cells) groups.set(clusterKey(cell), [...groups.get(clusterKey(cell)) ?? [], cell]);
 	const results = [];
 	for (const [key, group] of groups) {
 		const partial = /* @__PURE__ */ new Map();
 		for (let env = 0; env < environments; env += 1) {
 			const s = scenario(`lab-${key}-${env}`, group[0].mode, group[0].workers);
 			const dir = join(options.work ?? join(tmpdir(), "systems-kind-work"), s.name);
-			options.log(`cluster ${s.name}: ${s.kubeProxy.mode}, ${s.workers} workers`);
+			const mesh = group[0].mesh;
+			options.log(`cluster ${s.name}: ${s.kubeProxy.mode}, ${s.workers} workers${mesh === void 0 ? "" : `, Istio ${mesh.flavor}`}`);
 			const cluster = await createCluster(s, dir);
 			let lab = null;
 			let loader = null;
@@ -2366,6 +2794,13 @@ const runKindCells = async (cells, options) => {
 				await cluster.load(image);
 				await cluster.load(redisImage);
 				if (grpcImage !== void 0 && group.some((cell) => stackOf(cell) === "grpc")) await cluster.load(grpcImage);
+				if (mesh !== void 0) {
+					if (images.mesh === void 0) throw new Error(`${group[0].name}: the run has no images of Istio`);
+					for (const each of [images.mesh.pilot, images.mesh.proxy]) await cluster.load(each);
+					const began = Date.now();
+					await installMesh(cluster, mesh.flavor, images.mesh);
+					options.log(`  Istio ${mesh.flavor} installed in ${Math.round((Date.now() - began) / 100) / 10} s`);
+				}
 				lab = await openKindLab(cluster, image);
 				const { GenericContainer } = await import("testcontainers");
 				const Shared = class extends GenericContainer {
@@ -2399,6 +2834,7 @@ const runKindCells = async (cells, options) => {
 							log: options.log,
 							version: 1,
 							probed: "",
+							listened: "",
 							expected: cell.pod.replicas
 						};
 						const share = Math.ceil(cell.runs / environments) - (env < cell.runs % environments || cell.runs % environments === 0 ? 0 : 1);
@@ -2417,7 +2853,11 @@ const runKindCells = async (cells, options) => {
 							images: {
 								lab: image,
 								redis: redisImage,
-								...stackOf(cell) === "grpc" ? { grpc: grpcImage } : {}
+								...stackOf(cell) === "grpc" ? { grpc: grpcImage } : {},
+								...cell.mesh === void 0 ? {} : {
+									"istio-pilot": ISTIO_IMAGES.pilot,
+									"istio-proxy": ISTIO_IMAGES.proxy
+								}
 							}
 						});
 						entry.loads.push(...loads);
@@ -2432,6 +2872,8 @@ const runKindCells = async (cells, options) => {
 					} finally {
 						off();
 						await lab.rules(null).catch(() => void 0);
+						await lab.eds(null).catch(() => void 0);
+						await lab.lds(null).catch(() => void 0);
 						await lab.stopProbe();
 						await cluster.kubectl([
 							"delete",
@@ -2475,12 +2917,13 @@ const estimate = (cell, environments = 2) => {
 		crash: 30,
 		"app-stall": hold + 40,
 		"cpu-throttle": hold + 40,
-		rollout: hold + 50
+		rollout: hold + 50,
+		"authorization-policy": hold + 20
 	};
 	const after = observationAfter(cell);
 	const observed = after === null ? 0 : hold + valueIn(after, "s");
 	const each = 25 + Math.max(observed, trigger[cell.trigger.kind] ?? (cell.template === "T18" ? hold + 35 : 15 + valueIn(cell.pod.preStop, "s")));
-	return 60 * environments + (cell.runs + environments) * each;
+	return (cell.mesh === void 0 ? 60 : 180) * environments + (cell.runs + environments) * each;
 };
 /**
 * This function gives an estimate of the time of a cell: its setup, then each run and each
@@ -2493,11 +2936,13 @@ const estimatedTime = (cell, environments = 2) => ({
 });
 /**
 * This function gives the share of a shard of a catalog: cells in sequence. Thus the cells of one
-* mode stay together and share clusters. Each shard gets an equal share of the estimated time.
+* mode and one mesh flavor stay together and share clusters. Each shard gets an equal share of the
+* estimated time. In one mode, the cells with no mesh come first, in the sequence of the catalog.
 */
 const shardOf = (cells, index, count) => {
 	if (!(Number.isInteger(index) && Number.isInteger(count) && count >= 1 && index >= 0 && index < count)) throw new RangeError(`shard ${index} of ${count} is not a shard`);
-	const ordered = [...cells].sort((a, b) => a.mode === b.mode ? 0 : a.mode < b.mode ? -1 : 1);
+	const rank = (cell) => `${cell.mode}/${meshKey(cell) === "none" ? "" : meshKey(cell)}`;
+	const ordered = [...cells].sort((a, b) => rank(a) === rank(b) ? 0 : rank(a) < rank(b) ? -1 : 1);
 	const total = ordered.reduce((sum, cell) => sum + estimate(cell), 0);
 	const out = [];
 	let before = 0;
@@ -2509,6 +2954,6 @@ const shardOf = (cells, index, count) => {
 	return out;
 };
 //#endregion
-export { CLIENT, CONTROLLER, DOCUMENTED, DRAIN_RULES, FLAG_CHECK, FORMAT, FORMAT_V1, HEALTH_PORT, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, LAST_SLACK, LOG_LABEL, NODE_IMAGES, O04, O09, O10, O16, PORT, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, STAGES, WATCHDOG, backendsAt, backendsOf, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, checkRun, cidrOverlap, cidrRange, clientObjects, compose, createCluster, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dropOf, emptyOf, ensureTool, estimatedTime, factsOf, failuresOf, goDuration, intakeAfter, intakeOf, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeletBand, labImage, latchBand, lintCell, localPin, medianInterval, medianText, middle, namespaceOf, nodeNames, observationAfter, observationEnd, openKindLab, outcomesOf, pausedWindow, planOf, platformKey, podsAt, podsOf, predictionText, probeOf, propagationOf, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestsOf, restartBand, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverObjects, sha256, shardOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stackOf, stageLabImage, stallRemovalBand, stoppingOf, timeSpread, toolPath, transitionOf, unitOf, upgrade, upgradeCell, verdictsOf, writeResult };
+export { ACCESS_LOG_FORMAT, CLIENT, CLIENT_ACCOUNT, CONTROLLER, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HEALTH_PORT, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, LAST_SLACK, LDS_EVERY, LDS_FILTER, LOG_LABEL, NODE_IMAGES, O04, O09, O10, O16, POLICY, PORT, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, STAGES, WATCHDOG, backendsAt, backendsOf, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, checkRun, cidrOverlap, cidrRange, clientObjects, clusterFilter, compose, createCluster, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dropOf, emptyOf, ensureTool, estimatedTime, factsOf, failuresOf, goDuration, hostsOf, installMesh, intakeAfter, intakeOf, istioOperator, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeletBand, labImage, latchBand, lintCell, listenerCountsOf, localPin, medianInterval, medianText, meshKey, middle, namespaceObject, namespaceOf, nodeNames, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, pausedWindow, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestsOf, restartBand, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sha256, shardOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stackOf, stageLabImage, stallRemovalBand, stoppingOf, tarEntry, timeSpread, toolPath, transitionOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, writeResult };
 
 //# sourceMappingURL=index.js.map