@mark1russell7/kind 0.2.3 → 0.4.0

package/build/{judge-CctoUEo8.d.ts → judge-DMuI3aDn.d.ts}

@@ -77,8 +77,26 @@ declare const cidrRange: (cidr: string) => [number, number];
 declare const cidrOverlap: (a: string, b: string) => boolean;
 //#endregion
 //#region src/cell.d.ts
-/** A template is the topology of a cell: T07, the endpoint lifecycle of a Service, or T18, a health-gated fleet. */
-type Template = "T07" | "T18";
+/**
+ * A template is the topology of a cell:
+ * - `T07` is the endpoint lifecycle of a Service.
+ * - `T15` is the same lifecycle through an Istio mesh: a mesh hop at the client and a mesh hop at the server.
+ * - `T18` is a health-gated fleet.
+ */
+type Template = "T07" | "T15" | "T18";
+/**
+ * A mesh flavor is the install of Istio 1.31.3 in the cluster:
+ * - `sidecar`: the profile `minimal`, istiod only. The injector puts an Envoy sidecar in each pod of a labeled namespace.
+ * - `ambient`: the profile `ambient`, with istio-cni and ztunnel. The lab does not install it yet.
+ */
+type MeshFlavor = "sidecar" | "ambient";
+/** A mesh mode is the data plane of the pods of a cell: an Envoy sidecar in each pod, or ztunnel on each node. */
+type MeshMode = "sidecar" | "ambient";
+/** A mesh is the install of Istio in the cluster of a cell, and the data plane of the pods of the cell. */
+interface Mesh {
+  readonly flavor: MeshFlavor;
+  readonly mode: MeshMode;
+}
 /**
  * A stack is the server and the clients of a cell:
  * - `service`: the service of this repository with its declaration, and the HTTP client, which opens a
@@ -99,9 +117,10 @@ type Stack = "service" | "grpc";
  * - `app-stall` blocks the event loop of one replica.
  * - `rollout` is a rolling update while Redis is down.
  * - `cpu-throttle` sets `cpu.max` in the cgroup of one replica.
+ * - `authorization-policy` applies an AuthorizationPolicy of Istio that denies the clients, for the hold (T15).
  * - `none` injects nothing: a calibration measures the path itself.
  */
-type TriggerKind = "pod-deletion" | "rolling-update" | "node-drain" | "scale-in" | "crash" | "liveness-restart" | "freeze-process" | "rst" | "blackhole" | "peer-gone-without-close" | "app-stall" | "rollout" | "cpu-throttle";
+type TriggerKind = "pod-deletion" | "rolling-update" | "node-drain" | "scale-in" | "crash" | "liveness-restart" | "freeze-process" | "rst" | "blackhole" | "peer-gone-without-close" | "app-stall" | "rollout" | "cpu-throttle" | "authorization-policy";
 /**
  * A trigger is its kind and the settings of its fault. The parameter `A` is the form of an amount:
  * a quantity in the format `/2`, a number in the format `/1`.
@@ -117,6 +136,12 @@ interface Trigger<A = Quantity> {
     readonly quota: A;
     readonly period: A;
   } | undefined;
+  /**
+   * This name is the service account that an AuthorizationPolicy denies (`authorization-policy`). The
+   * default is `default`, the account of the clients. An account that no pod has changes the policy,
+   * and denies no call.
+   */
+  readonly account?: string | undefined;
 }
 /** A kubelet probe is the period, the failure threshold and the timeout of one probe of the pod. */
 interface KubeletProbe {
@@ -193,8 +218,9 @@ interface Band<A = Quantity> {
  * - `intake`: the stop of the intake of the target pod, as its service records it.
  * - `fault`: the commit of the fault, as the injector or the agent stamps it.
  * - `resume`: the end of a pause of kube-proxy, as the agent stamps it.
+ * - `heal`: the start of the first act that ends the fault, for example the delete of a policy.
  */
-type Reference = "deletion" | "intake" | "fault" | "resume";
+type Reference = "deletion" | "intake" | "fault" | "resume" | "heal";
 /**
  * A reset reuse is how a reset fails a later connection on the same port. A reset from the server
  * leaves the conntrack entry of its flow in CLOSE, with the NAT to that server, for `life`. A SYN on
@@ -247,12 +273,16 @@ type Prediction<A = Quantity> = {
   readonly each?: boolean | undefined;
   /**
    * This band is the propagation that the window assumes. It starts at the deletion of the replica
-   * of a window. It ends at the first poll of the rules of each node without that replica. The
-   * judge holds each such poll to `hi` ± δ, and it does not test a window without the band. A
-   * later poll agrees with the law, but the band is short, thus its cell is `extend` (D-EXTEND).
-   * An earlier drop only closes the window earlier.
+   * of a window. It ends at the first poll of each node without that replica. That poll is of the
+   * rules, or of the client sidecar in a sidecar mesh (`propagationSource`).
+   *
+   * The judge holds each poll to `hi` ± δ, and it does not test a window without the band. A later
+   * poll agrees with the law, but the band is short, thus its cell is `extend` (D-EXTEND). An
+   * earlier drop only closes the window earlier.
    */
   readonly propagation?: Band<A> | undefined;
+  /** These outcomes are the only failures that the window permits. A failure with another outcome fails the run. Without them, each outcome but `ok` can fail. */
+  readonly outcomes?: readonly string[] | undefined;
   readonly why: string;
 } | {
   readonly kind: "removal";
@@ -328,6 +358,8 @@ interface KindCell<A = Quantity> {
   readonly template: Template;
   /** This stack is the server and the clients of the cell. Without it, the cell has the service (`service`). */
   readonly stack?: Stack | undefined;
+  /** This mesh is the Istio of the cell (T15). Without it, the cell has no mesh. */
+  readonly mesh?: Mesh | undefined;
   /** This text names a system of the plan that the cell replaces with the service of this repository, or null. */
   readonly substitutes: string | null;
   readonly mode: KubeProxyMode;
@@ -436,13 +468,24 @@ interface SliceLine {
   readonly svc: string | null;
   readonly eps: readonly Endpoint[];
 }
-/** A rules line is the backends of the Service in the rules of one node, after a change. `prev` is the start of the poll before it. */
+/**
+ * A rules line is the backends of the Service in the rules of one node, after a change. `prev` is the
+ * start of the poll before it. An EDS line has the same fields (`ev` is `eds`). It gives the healthy
+ * hosts of the server cluster in the Envoy of the client sidecar on the node.
+ */
 interface RulesLine {
   readonly t: number;
   readonly prev: number | null;
   readonly node: string;
   readonly b: readonly string[];
 }
+/**
+ * A propagation source is the poll whose lines give the backends of each node:
+ * - `rules`: the rules of kube-proxy in the namespaces of the node.
+ * - `eds`: the hosts of the server cluster in the Envoy of the client sidecar on the node. In a sidecar
+ *   mesh, the client sidecar picks the backend of each call, thus kube-proxy is not on the path.
+ */
+type PropagationSource = "rules" | "eds";
 /** A record line is one transition of a machine of the service, with its own stamp `at`. */
 interface RecordLine {
   readonly t: number;
@@ -458,7 +501,7 @@ interface RecordLine {
 declare const requestsOf: (lines: readonly Line[]) => Request[];
 declare const podsOf: (lines: readonly Line[]) => PodLine[];
 declare const slicesOf: (lines: readonly Line[], svc: string) => SliceLine[];
-declare const rulesOf: (lines: readonly Line[]) => RulesLine[];
+declare const rulesOf: (lines: readonly Line[], source?: PropagationSource) => RulesLine[];
 declare const recordsOf: (lines: readonly Line[]) => RecordLine[];
 /** This function gives the requests that did not succeed, in sequence of their start. */
 declare const failuresOf: (lines: readonly Line[]) => Request[];
@@ -494,8 +537,9 @@ declare const signalOf: (lines: readonly Line[], pod: string, after: number) =>
 /**
  * This function gives when the rules of a node stopped the selection of a backend: the first poll
  * after a time without it. The change came after `prev`, the poll before it, and at the latest at `t`.
+ * The source `eds` gives the same for the client sidecar of the node.
  */
-declare const dropOf: (lines: readonly Line[], node: string, backend: string, after: number) => RulesLine | null;
+declare const dropOf: (lines: readonly Line[], node: string, backend: string, after: number, source?: PropagationSource) => RulesLine | null;
 /** This function gives when the rules of a node had no backend of the Service, after a time. */
 declare const emptyOf: (lines: readonly Line[], node: string, after: number) => RulesLine | null;
 /** This function gives when an EndpointSlice of the Service first had no ready endpoint, after a time. */
@@ -562,6 +606,10 @@ interface RunFacts<A = Quantity> {
    * run with a deletion after its start, with the stamps of its intake and of its deletion.
    */
   readonly deletions?: readonly Deleted[] | undefined;
+  /** These are the first LDS updates of the sidecar of each server pod after the fault, by pod (`updatesOf`). */
+  readonly updates?: Readonly<Record<string, Propagated<A> | null>> | undefined;
+  /** These are the first LDS updates of the sidecar of each server pod after the heal, by pod. */
+  readonly healUpdates?: Readonly<Record<string, Propagated<A> | null>> | undefined;
 }
 /** A deleted replica is a replica of a run that got a deletion. It gives its pod, and the stamps of its intake (or null) and of its deletion. */
 interface Deleted {
@@ -619,12 +667,27 @@ declare const reusesReset: (request: Request, requests: readonly Request[], reus
  * The references `deletion` and `intake` are those of the target, or of the replica `pod`.
  */
 declare const referenceOf: (run: Pick<KindRun, "start" | "acts" | "target" | "lines">, from: Reference, pod?: string | undefined) => number | null;
+/**
+ * This function gives the source of the propagation of a cell. In a sidecar mesh, the client sidecar
+ * picks the backend of each call from its endpoints (EDS), thus the source is `eds`. Each other cell
+ * goes through the rules of kube-proxy (`rules`).
+ */
+declare const propagationSource: (cell: Pick<KindCell, "mesh">) => PropagationSource;
 /**
  * This function gives the propagation of each node for the target of a run, or for the replica of
  * the address `ip`. It is the time from its deletion (or its crash) to the first poll of the rules
  * of the node without it. The change came between the poll before (`after`) and that poll (`by`).
+ * The source `eds` gives the poll of the client sidecar of each node.
+ */
+declare const propagationOf: (run: KindRun, from: number | null, ip?: string | undefined, source?: PropagationSource) => Record<string, Propagated | null>;
+/**
+ * This function gives the first LDS update of the sidecar of each server pod after the stamp `from`.
+ * The update came between the poll before (`after`) and the poll that saw it (`by`), after `from`.
+ * A poller gives a line at each change of its counters. Thus a line after `from` with a poll before
+ * it is an update, when its count `mod` is above the count before `from`. The first line of a poller
+ * has no poll before it (`prev` is null), and it is no update.
  */
-declare const propagationOf: (run: KindRun, from: number | null, ip?: string | undefined) => Record<string, Propagated | null>;
+declare const updatesOf: (run: Pick<KindRun, "lines">, from: number | null) => Record<string, Propagated | null>;
 /**
  * This function gives each replica of a run that got a deletion after the start of the run, in the
  * sequence of the deletions. A rolling update deletes each old replica in turn.
@@ -768,12 +831,17 @@ declare const cellsTable: (judged: readonly Judged[]) => string;
  * This function gives the propagation of each calibration, by node. It is the time from the
  * deletion to the poll of the rules of each node without the pod. It also gives the time to the
  * EndpointSlice and to the stop of the intake.
+ *
+ * For a policy of Istio, the propagation is the LDS update of each server sidecar after the apply,
+ * by node (`updatesOf`). Then `heal` is the update after the delete of the policy. `slice` and
+ * `intake` are null.
  */
 declare const calibrationOf: (judged: Judged) => {
   readonly nodes: Readonly<Record<string, TimeSpread | null>>;
   readonly all: TimeSpread | null;
   readonly slice: TimeSpread | null;
   readonly intake: TimeSpread | null;
+  readonly heal?: TimeSpread | null | undefined;
 };
 //#endregion
 //#region src/schema.d.ts
@@ -808,5 +876,5 @@ declare const quantileOf: (sorted: readonly number[], p: number) => number;
  */
 declare const medianInterval: (sorted: readonly number[]) => [number, number];
 //#endregion
-export { Line as $, Workload as $t, TriggerV1 as A, LOG_LABEL as At, RunCheck as B, KindCell as Bt, KindCellResult as C, sliceDropOf as Ct, PredictionV1 as D, transitionOf as Dt, LoadSample as E, stoppingOf as Et, KIND_NOISE as F, seconds as Ft, judgeKind as G, RedisDeclaration as Gt, checkRun as H, KubeletProbe as Ht, KindDecision as I, secondsOf as It, propagationOf as J, ResetReuse as Jt, observationAfter as K, Reference as Kt, KindVerdict as L, showBand as Lt, upgrade as M, REDIS as Mt, upgradeCell as N, SERVER as Nt, RunCheckV1 as O, CLIENT as Ot, Deleted as P, bandOf as Pt, Endpoint as Q, TriggerKind as Qt, LAST_SLACK as R, Band as Rt, KindCellRecordV1 as S, signalsOf as St, KindVerdictV1 as T, slicesOf as Tt, deletionsOf as U, PodSettings as Ut, RunFacts as V, KindRun as Vt, factsOf as W, Prediction as Wt, reusesReset as X, Template as Xt, referenceOf as Y, Stack as Yt, unitOf as Z, Trigger as Zt, ClusterManifest as _, recordsOf as _t, STAGES as a, NodeImage as an, backendsAt as at, FORMAT_V1 as b, rulesOf as bt, readRecord as c, goDuration as cn, deletionOf as ct, calibrationOf as d, nodeNames as dn, failuresOf as dt, KUBE_PROXY_MODES as en, PodLine as et, cellsTable as f, scenario as fn, intakeOf as ft, BandV1 as g, podsOf as gt, timeSpread as h, podsAt as ht, quantileOf as i, NODE_IMAGES as in, SliceLine as it, judge as j, PORT as jt, RunFactsV1 as k, HEALTH_PORT as kt, Judged as l, kindConfig as ln, dropOf as lt, predictionText as m, outcomesOf as mt, medianInterval as n, KindScenario as nn, Request as nt, kindCellRecordSchema as o, cidrOverlap as on, byClients as ot, medianText as p, scenarioProblems as pn, kernelCounts as pt, observationEnd as q, Replica as qt, middle as r, KubeProxyMode as rn, RulesLine as rt, kindCellRecordV1Schema as s, cidrRange as sn, byNode as st, RELATIVE as t, KindConfig as tn, RecordLine as tt, TimeSpread as u, kubeProxyPatch as un, emptyOf as ut, EnvironmentManifest as v, requestsOf as vt, KindCellV1 as w, sliceEmptyOf as wt, KindCellRecord as x, signalOf as xt, FORMAT as y, restartsAt as yt, Propagated as z, Declaration as zt };
-//# sourceMappingURL=judge-CctoUEo8.d.ts.map
+export { updatesOf as $, Replica as $t, TriggerV1 as A, transitionOf as At, RunCheck as B, showBand as Bt, KindCellResult as C, rulesOf as Ct, PredictionV1 as D, sliceEmptyOf as Dt, LoadSample as E, sliceDropOf as Et, KIND_NOISE as F, REDIS as Ft, judgeKind as G, KubeletProbe as Gt, checkRun as H, Declaration as Ht, KindDecision as I, SERVER as It, propagationOf as J, MeshMode as Jt, observationAfter as K, Mesh as Kt, KindVerdict as L, bandOf as Lt, upgrade as M, HEALTH_PORT as Mt, upgradeCell as N, LOG_LABEL as Nt, RunCheckV1 as O, slicesOf as Ot, Deleted as P, PORT as Pt, unitOf as Q, Reference as Qt, LAST_SLACK as R, seconds as Rt, KindCellRecordV1 as S, restartsAt as St, KindVerdictV1 as T, signalsOf as Tt, deletionsOf as U, KindCell as Ut, RunFacts as V, Band as Vt, factsOf as W, KindRun as Wt, referenceOf as X, Prediction as Xt, propagationSource as Y, PodSettings as Yt, reusesReset as Z, RedisDeclaration as Zt, ClusterManifest as _, nodeNames as _n, outcomesOf as _t, STAGES as a, Workload as an, Request as at, FORMAT_V1 as b, recordsOf as bt, readRecord as c, KindScenario as cn, backendsAt as ct, calibrationOf as d, NodeImage as dn, deletionOf as dt, ResetReuse as en, Endpoint as et, cellsTable as f, cidrOverlap as fn, dropOf as ft, BandV1 as g, kubeProxyPatch as gn, kernelCounts as gt, timeSpread as h, kindConfig as hn, intakeOf as ht, quantileOf as i, TriggerKind as in, RecordLine as it, judge as j, CLIENT as jt, RunFactsV1 as k, stoppingOf as kt, Judged as l, KubeProxyMode as ln, byClients as lt, predictionText as m, goDuration as mn, failuresOf as mt, medianInterval as n, Template as nn, PodLine as nt, kindCellRecordSchema as o, KUBE_PROXY_MODES as on, RulesLine as ot, medianText as p, cidrRange as pn, emptyOf as pt, observationEnd as q, MeshFlavor as qt, middle as r, Trigger as rn, PropagationSource as rt, kindCellRecordV1Schema as s, KindConfig as sn, SliceLine as st, RELATIVE as t, Stack as tn, Line as tt, TimeSpread as u, NODE_IMAGES as un, byNode as ut, EnvironmentManifest as v, scenario as vn, podsAt as vt, KindCellV1 as w, signalOf as wt, KindCellRecord as x, requestsOf as xt, FORMAT as y, scenarioProblems as yn, podsOf as yt, Propagated as z, secondsOf as zt };
+//# sourceMappingURL=judge-DMuI3aDn.d.ts.map

package/build/judge.d.ts

@@ -1,2 +1,2 @@
-import { $ as Line, $t as Workload, A as TriggerV1, At as LOG_LABEL, B as RunCheck, Bt as KindCell, C as KindCellResult, Ct as sliceDropOf, D as PredictionV1, Dt as transitionOf, E as LoadSample, Et as stoppingOf, F as KIND_NOISE, Ft as seconds, G as judgeKind, Gt as RedisDeclaration, H as checkRun, Ht as KubeletProbe, I as KindDecision, It as secondsOf, J as propagationOf, Jt as ResetReuse, K as observationAfter, Kt as Reference, L as KindVerdict, Lt as showBand, M as upgrade, Mt as REDIS, N as upgradeCell, Nt as SERVER, O as RunCheckV1, Ot as CLIENT, P as Deleted, Pt as bandOf, Q as Endpoint, Qt as TriggerKind, R as LAST_SLACK, Rt as Band, S as KindCellRecordV1, St as signalsOf, T as KindVerdictV1, Tt as slicesOf, U as deletionsOf, Ut as PodSettings, V as RunFacts, Vt as KindRun, W as factsOf, Wt as Prediction, X as reusesReset, Xt as Template, Y as referenceOf, Yt as Stack, Z as unitOf, Zt as Trigger, _ as ClusterManifest, _t as recordsOf, a as STAGES, at as backendsAt, b as FORMAT_V1, bt as rulesOf, c as readRecord, ct as deletionOf, d as calibrationOf, dt as failuresOf, et as PodLine, f as cellsTable, ft as intakeOf, g as BandV1, gt as podsOf, h as timeSpread, ht as podsAt, i as quantileOf, it as SliceLine, j as judge, jt as PORT, k as RunFactsV1, kt as HEALTH_PORT, l as Judged, lt as dropOf, m as predictionText, mt as outcomesOf, n as medianInterval, nt as Request, o as kindCellRecordSchema, ot as byClients, p as medianText, pt as kernelCounts, q as observationEnd, qt as Replica, r as middle, rn as KubeProxyMode, rt as RulesLine, s as kindCellRecordV1Schema, st as byNode, t as RELATIVE, tt as RecordLine, u as TimeSpread, ut as emptyOf, v as EnvironmentManifest, vt as requestsOf, w as KindCellV1, wt as sliceEmptyOf, x as KindCellRecord, xt as signalOf, y as FORMAT, yt as restartsAt, z as Propagated, zt as Declaration } from "./judge-CctoUEo8.js";
-export { type Band, type BandV1, CLIENT, type ClusterManifest, type Declaration, type Deleted, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, HEALTH_PORT, type Judged, KIND_NOISE, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindDecision, type KindRun, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, Line, type LoadSample, PORT, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, SERVER, STAGES, SliceLine, type Stack, type Template, type TimeSpread, type Trigger, type TriggerKind, type TriggerV1, type Workload, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, intakeOf, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, medianInterval, medianText, middle, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartsAt, reusesReset, rulesOf, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stoppingOf, timeSpread, transitionOf, unitOf, upgrade, upgradeCell };
+import { $ as updatesOf, $t as Replica, A as TriggerV1, At as transitionOf, B as RunCheck, Bt as showBand, C as KindCellResult, Ct as rulesOf, D as PredictionV1, Dt as sliceEmptyOf, E as LoadSample, Et as sliceDropOf, F as KIND_NOISE, Ft as REDIS, G as judgeKind, Gt as KubeletProbe, H as checkRun, Ht as Declaration, I as KindDecision, It as SERVER, J as propagationOf, Jt as MeshMode, K as observationAfter, Kt as Mesh, L as KindVerdict, Lt as bandOf, M as upgrade, Mt as HEALTH_PORT, N as upgradeCell, Nt as LOG_LABEL, O as RunCheckV1, Ot as slicesOf, P as Deleted, Pt as PORT, Q as unitOf, Qt as Reference, R as LAST_SLACK, Rt as seconds, S as KindCellRecordV1, St as restartsAt, T as KindVerdictV1, Tt as signalsOf, U as deletionsOf, Ut as KindCell, V as RunFacts, Vt as Band, W as factsOf, Wt as KindRun, X as referenceOf, Xt as Prediction, Y as propagationSource, Yt as PodSettings, Z as reusesReset, Zt as RedisDeclaration, _ as ClusterManifest, _t as outcomesOf, a as STAGES, an as Workload, at as Request, b as FORMAT_V1, bt as recordsOf, c as readRecord, ct as backendsAt, d as calibrationOf, dt as deletionOf, en as ResetReuse, et as Endpoint, f as cellsTable, ft as dropOf, g as BandV1, gt as kernelCounts, h as timeSpread, ht as intakeOf, i as quantileOf, in as TriggerKind, it as RecordLine, j as judge, jt as CLIENT, k as RunFactsV1, kt as stoppingOf, l as Judged, ln as KubeProxyMode, lt as byClients, m as predictionText, mt as failuresOf, n as medianInterval, nn as Template, nt as PodLine, o as kindCellRecordSchema, ot as RulesLine, p as medianText, pt as emptyOf, q as observationEnd, qt as MeshFlavor, r as middle, rn as Trigger, rt as PropagationSource, s as kindCellRecordV1Schema, st as SliceLine, t as RELATIVE, tn as Stack, tt as Line, u as TimeSpread, ut as byNode, v as EnvironmentManifest, vt as podsAt, w as KindCellV1, wt as signalOf, x as KindCellRecord, xt as requestsOf, y as FORMAT, yt as podsOf, z as Propagated, zt as secondsOf } from "./judge-DMuI3aDn.js";
+export { type Band, type BandV1, CLIENT, type ClusterManifest, type Declaration, type Deleted, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, HEALTH_PORT, type Judged, KIND_NOISE, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindDecision, type KindRun, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, Line, type LoadSample, type Mesh, type MeshFlavor, type MeshMode, PORT, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, SERVER, STAGES, SliceLine, type Stack, type Template, type TimeSpread, type Trigger, type TriggerKind, type TriggerV1, type Workload, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, intakeOf, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, medianInterval, medianText, middle, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartsAt, reusesReset, rulesOf, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stoppingOf, timeSpread, transitionOf, unitOf, updatesOf, upgrade, upgradeCell };

package/build/judge.js

@@ -1 +1 @@
-export { et as CLIENT, u as FORMAT, d as FORMAT_V1, tt as HEALTH_PORT, h as KIND_NOISE, g as LAST_SLACK, nt as LOG_LABEL, rt as PORT, it as REDIS, D as RELATIVE, at as SERVER, t as STAGES, j as backendsAt, ot as bandOf, M as byClients, N as byNode, a as calibrationOf, o as cellsTable, _ as checkRun, P as deletionOf, v as deletionsOf, F as dropOf, I as emptyOf, y as factsOf, L as failuresOf, R as intakeOf, f as judge, b as judgeKind, z as kernelCounts, n as kindCellRecordSchema, r as kindCellRecordV1Schema, O as medianInterval, s as medianText, k as middle, x as observationAfter, S as observationEnd, B as outcomesOf, V as podsAt, H as podsOf, c as predictionText, C as propagationOf, A as quantileOf, i as readRecord, U as recordsOf, w as referenceOf, W as requestsOf, G as restartsAt, T as reusesReset, K as rulesOf, st as seconds, ct as secondsOf, lt as showBand, q as signalOf, J as signalsOf, Y as sliceDropOf, X as sliceEmptyOf, Z as slicesOf, Q as stoppingOf, l as timeSpread, $ as transitionOf, E as unitOf, p as upgrade, m as upgradeCell } from "./judge-B3CHoiTW.js";
+export { nt as CLIENT, u as FORMAT, d as FORMAT_V1, rt as HEALTH_PORT, h as KIND_NOISE, g as LAST_SLACK, it as LOG_LABEL, at as PORT, ot as REDIS, k as RELATIVE, st as SERVER, t as STAGES, N as backendsAt, ct as bandOf, P as byClients, F as byNode, a as calibrationOf, o as cellsTable, _ as checkRun, I as deletionOf, v as deletionsOf, L as dropOf, R as emptyOf, y as factsOf, z as failuresOf, B as intakeOf, f as judge, b as judgeKind, V as kernelCounts, n as kindCellRecordSchema, r as kindCellRecordV1Schema, A as medianInterval, s as medianText, j as middle, x as observationAfter, S as observationEnd, H as outcomesOf, U as podsAt, W as podsOf, c as predictionText, C as propagationOf, w as propagationSource, M as quantileOf, i as readRecord, G as recordsOf, T as referenceOf, K as requestsOf, q as restartsAt, E as reusesReset, J as rulesOf, lt as seconds, ut as secondsOf, dt as showBand, Y as signalOf, X as signalsOf, Z as sliceDropOf, Q as sliceEmptyOf, $ as slicesOf, et as stoppingOf, l as timeSpread, tt as transitionOf, D as unitOf, O as updatesOf, p as upgrade, m as upgradeCell } from "./judge-Bkbs7VVG.js";

package/image/Dockerfile

@@ -14,5 +14,5 @@ RUN for name in quantity algebra service; do \
       && tar -xzf /tmp/workspace/mark1russell7-$name-*.tgz -C "node_modules/@mark1russell7/$name" --strip-components=1; \
     done \
  && rm -rf /tmp/workspace
-COPY app.mjs client.mjs client-grpc.mjs agent.mjs watch.mjs compose.ts backends.ts conntrack.ts drops.ts ./
+COPY app.mjs client.mjs client-grpc.mjs agent.mjs watch.mjs compose.ts backends.ts conntrack.ts drops.ts eds.ts lds.ts ./
 CMD ["node", "app.mjs"]

package/image/agent.mjs

@@ -9,17 +9,28 @@
 //                              handshake that stopped for a second (`stalled`). Each line
 //                              `rules-alive` also counts the reads of the table (`ct`). Each
 //                              second it reads the counters of dropped packets of the node and
-//                              of each client pod, and prints each one that grew (`drops`)
+//                              of each client pod, and prints each one that grew (`drops`).
+//                              As /tmp/eds.json asks, it starts the EDS poller of each client pod
+//                              of the node, and stops it when the file goes. /tmp/lds.json does the
+//                              same for the LDS poller of each server pod
+//   node agent.mjs eds JSON    the EDS poller: in the network namespace of a client pod (nsenter -n),
+//                              it reads /clusters of the Envoy of the sidecar each `every` ms, and
+//                              prints the hosts of the server cluster at each change (`eds`)
+//   node agent.mjs lds JSON    the LDS poller: in the network namespace of a server pod, it reads
+//                              the counters of the listener manager of the sidecar each `every` ms,
+//                              and prints them at each change (`lds`)
 //   node agent.mjs act JSON    does one act and prints its stamps on CLOCK_MONOTONIC
 //
 // The acts: signal (a signal to a PID), pause (SIGSTOP, then SIGCONT after ms), write (a file, for
 // example cpu.max or a flag file in the root of a container), remove (a file), stall (the stall
 // seam of the app: the ms in /tmp/lab-stall, then SIGUSR2), and now.
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { backendsOf } from "./backends.ts";
 import { entriesOf, flowsOf, staleOf, stalledOf } from "./conntrack.ts";
 import { devOf, grownOf, snmpOf, softnetOf, unresolvedOf } from "./drops.ts";
+import { clusterFilter, hostsOf } from "./eds.ts";
+import { LDS_FILTER, listenerCountsOf } from "./lds.ts";
 
 const now = () => Number(process.hrtime.bigint()) / 1e6;
 const node = process.env.NODE_NAME ?? "";
@@ -254,6 +265,120 @@ const serve = async () => {
   }
 };
 
+/**
+ * the pollers of the sidecars of the node, of one kind: `eds` or `lds`. /tmp/<kind>.json gives the
+ * interval and each pod of the node with a PID in it, and for `eds` the server cluster. The agent
+ * starts one poller for each pod in the network namespace of that PID, and stops each one when the
+ * file changes or goes. nsenter -n keeps the mount namespace of the agent, thus the poller is this
+ * file, and its clock is the one of the VM. The EDS pollers read the client pods, and the LDS
+ * pollers read the server pods
+ */
+const pollers = async (kind) => {
+  const file = `/tmp/${kind}.json`;
+  let config = null;
+  let children = [];
+  const stop = () => {
+    for (const child of children) child.kill("SIGKILL");
+    children = [];
+  };
+  for (;;) {
+    let text = null;
+    let spec = null;
+    try {
+      text = existsSync(file) ? readFileSync(file, "utf8") : null;
+      spec = text === null ? null : JSON.parse(text);
+    } catch (error) {
+      say({ ev: `${kind}-fail`, t: now(), why: String(error?.message ?? error).slice(0, 300) });
+      text = config;
+    }
+    if (text !== config) {
+      stop();
+      config = text;
+      if (spec !== null) {
+        for (const { pod, pid } of spec.pods) {
+          const argv = ["-t", String(pid), "-n", "--", process.execPath, process.argv[1], kind, JSON.stringify({ cluster: spec.cluster, every: spec.every, pod })];
+          const child = spawn("nsenter", argv, { stdio: ["ignore", "inherit", "inherit"] });
+          child.on("exit", (code, signal) => {
+            if (signal !== "SIGKILL") say({ ev: `${kind}-exit`, t: now(), pod, code, signal });
+          });
+          child.on("error", (error) => say({ ev: `${kind}-fail`, t: now(), pod, why: String(error?.message ?? error).slice(0, 300) }));
+          children.push(child);
+        }
+        say({ ev: `${kind}-start`, t: now(), ...(spec.cluster === undefined ? {} : { cluster: spec.cluster }), every: spec.every, pods: spec.pods.map((each) => each.pod) });
+      }
+    }
+    await sleep(250);
+  }
+};
+
+/**
+ * one poll loop of the admin endpoint of a sidecar, 127.0.0.1:15000 in the namespace of the pod
+ * (envoy_bootstrap.json of Istio 1.31.3), each `every` ms. `read` gives the state of one answer, and
+ * a line comes at each change of that state, with the start of the poll before it (`prev`), as a rules
+ * line. Each second, a line `<kind>-alive` counts the polls
+ */
+const poll = async (kind, url, every, pod, read) => {
+  let last = null;
+  let previous = null;
+  let failure = null;
+  let polls = 0;
+  let spent = 0;
+  let beat = now();
+  for (;;) {
+    const t = now();
+    try {
+      const response = await fetch(url, { signal: AbortSignal.timeout(1000) });
+      const text = await response.text();
+      const took = now() - t;
+      polls += 1;
+      spent += took;
+      if (!response.ok) throw new Error(`the admin endpoint answered ${response.status}: ${text.slice(0, 200)}`);
+      const state = read(text);
+      const key = JSON.stringify(state);
+      if (key !== last) {
+        say({ ev: kind, t, prev: previous, pod, took: Math.round(took * 1000) / 1000, ...state });
+        last = key;
+      }
+      failure = null;
+    } catch (error) {
+      // each failure once, until a poll succeeds
+      const why = String(error?.message ?? error).slice(0, 300);
+      if (why !== failure) say({ ev: `${kind}-fail`, t, pod, why });
+      failure = why;
+    }
+    previous = t;
+    if (t - beat >= 1000) {
+      say({ ev: `${kind}-alive`, t, pod, polls, ms: polls === 0 ? 0 : Math.round((spent / polls) * 100) / 100 });
+      beat = t;
+      polls = 0;
+      spent = 0;
+    }
+    const wait = every - (now() - t);
+    if (wait > 0) await sleep(wait);
+  }
+};
+
+/**
+ * one EDS poller. The filter of /clusters keeps the server cluster only (clusters_handler.cc of Envoy
+ * v1.39.4). A line `eds` gives the healthy hosts (`b`), and each other host with its flags (`u`)
+ */
+const eds = ({ cluster, every, pod }) =>
+  poll("eds", `http://127.0.0.1:15000/clusters?filter=${encodeURIComponent(clusterFilter(cluster))}`, every, pod, (text) => {
+    const { b, u } = hostsOf(text, cluster);
+    return { b, ...(Object.keys(u).length === 0 ? {} : { u }) };
+  });
+
+/**
+ * one LDS poller, in a server pod. The filter of /stats keeps the two counters of the listener
+ * manager. A line `lds` gives each update of a listener (`mod`) and each update in place (`inPlace`)
+ */
+const lds = ({ every, pod }) =>
+  poll("lds", `http://127.0.0.1:15000/stats?filter=${encodeURIComponent(LDS_FILTER)}`, every, pod, (text) => {
+    const counts = listenerCountsOf(text);
+    if (counts === null) throw new Error(`the stats have no listener_modified: ${text.slice(0, 200)}`);
+    return counts;
+  });
+
 const act = async (spec) => {
   const t0 = now();
   if (spec.op === "now") return { t0, t1: t0 };
@@ -292,7 +417,13 @@ const act = async (spec) => {
 const [mode, arg] = process.argv.slice(2);
 if (mode === "serve") {
   say({ ev: "agent", what: "start", t: now() });
+  void pollers("eds");
+  void pollers("lds");
   await serve();
+} else if (mode === "eds") {
+  await eds(JSON.parse(arg));
+} else if (mode === "lds") {
+  await lds(JSON.parse(arg));
 } else if (mode === "act") {
   const spec = JSON.parse(arg);
   try {

package/image/client-grpc.mjs

@@ -64,6 +64,8 @@ const outcomeOf = (error) => {
   if (/ECONNRESET|EPIPE/.test(text)) return "reset";
   if (/EHOSTUNREACH|ENETUNREACH/.test(text)) return "unreachable";
   if (error.code === grpc.status.DEADLINE_EXCEEDED) return "timeout";
+  // the local reply 403 of an RBAC deny of a sidecar of Istio gives PERMISSION_DENIED (status.cc of Envoy v1.39.4, lines 14–15)
+  if (error.code === grpc.status.PERMISSION_DENIED) return "denied";
   return "error";
 };
 

package/image/watch.mjs

@@ -3,6 +3,13 @@
 // EndpointSlices and the events of one namespace through the API, and it follows the log of each
 // pod with the label lab.systems/log=1. A log line is JSON with its own stamp, and the watcher
 // passes it on as it is.
+//
+// The sidecar of Istio (the container istio-proxy) is a native sidecar: an init container that
+// runs beside the app. The watcher follows it too. Its lines are the access log of Envoy (JSON, a
+// stamp of the wall clock) and the text of pilot-agent. Each one becomes a line `proxy` with the
+// stamp of its arrival: evidence, not a time that a band reads. An access line of a call that
+// succeeded at its first attempt is only counted (`proxy-ok`, each second), thus the record keeps
+// the failures, the retries and the local replies.
 import https from "node:https";
 
 const kube = JSON.parse(process.env.KUBE ?? "{}");
@@ -75,6 +82,38 @@ const stateOf = (state) => {
   return "none";
 };
 
+/** the container of the sidecar of Istio */
+const PROXY = "istio-proxy";
+/** the access lines of each sidecar that the watcher only counted, by pod, since the last count */
+const counted = new Map();
+setInterval(() => {
+  const t = now();
+  for (const [pod, n] of counted) say({ ev: "proxy-ok", t, p: pod, n });
+  counted.clear();
+}, 1000);
+
+/** an access line of Envoy that tells nothing more than its call: status 200, no flag, gRPC status 0, one attempt */
+const plain = (log) =>
+  String(log.code) === "200" && (log.flags === "-" || log.flags === "" || log.flags === undefined) && String(log.grpc) === "0" && Number(log.attempts ?? 1) <= 1;
+
+/** a line of the sidecar: an access line of Envoy as JSON, or a text line of pilot-agent */
+const proxyLine = (pod, text) => {
+  if (text.startsWith("{")) {
+    try {
+      const log = JSON.parse(text);
+      if (plain(log)) {
+        counted.set(pod, (counted.get(pod) ?? 0) + 1);
+        return;
+      }
+      say({ ev: "proxy", t: now(), p: pod, log });
+      return;
+    } catch {
+      // a line that is not whole JSON is text
+    }
+  }
+  say({ ev: "proxy", t: now(), p: pod, text: text.slice(0, 500) });
+};
+
 const following = new Set();
 const follow = (ns, pod, container, id) => {
   const key = `${ns}/${pod}/${container}/${id}`;
@@ -84,7 +123,8 @@ const follow = (ns, pod, container, id) => {
     `/api/v1/namespaces/${ns}/pods/${pod}/log`,
     { container, follow: "true" },
     (text) => {
-      if (text.startsWith("{")) pending.push(`${text}\n`);
+      if (container === PROXY) proxyLine(pod, text);
+      else if (text.startsWith("{")) pending.push(`${text}\n`);
       else say({ ev: "text", t: now(), p: pod, text: text.slice(0, 500) });
     },
     false,
@@ -109,6 +149,10 @@ for (const ns of namespaces) {
       last: stateOf(status.lastState),
       id: status.containerID ?? null,
     }));
+    // the native sidecar of Istio is a running init container: its state, apart from the containers
+    const sidecars = (pod.status?.initContainerStatuses ?? [])
+      .filter((status) => status.name === PROXY)
+      .map((status) => ({ n: status.name, r: status.ready, rc: status.restartCount, st: stateOf(status.state), id: status.containerID ?? null }));
     say({
       ev: "pod",
       t,
@@ -121,11 +165,13 @@ for (const ns of namespaces) {
       ready,
       phase: pod.status?.phase ?? null,
       cs: containers,
+      ...(sidecars.length === 0 ? {} : { sc: sidecars }),
       labels: pod.metadata.labels ?? {},
     });
-    if (event.type !== "DELETED" && pod.metadata.labels?.["lab.systems/log"] === "1")
-      for (const status of pod.status?.containerStatuses ?? [])
-        if (status.state?.running && status.containerID) follow(ns, pod.metadata.name, status.name, status.containerID);
+    if (event.type !== "DELETED" && pod.metadata.labels?.["lab.systems/log"] === "1") {
+      const running = [...(pod.status?.containerStatuses ?? []), ...(pod.status?.initContainerStatuses ?? []).filter((status) => status.name === PROXY)];
+      for (const status of running) if (status.state?.running && status.containerID) follow(ns, pod.metadata.name, status.name, status.containerID);
+    }
     return pod.metadata.resourceVersion;
   });
   stream(`/apis/discovery.k8s.io/v1/namespaces/${ns}/endpointslices`, { watch: "1", allowWatchBookmarks: "true" }, (text, t) => {

package/package.json

@@ -1,12 +1,13 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@mark1russell7/kind",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "description": "Kubernetes in Docker as a lab for connection timers: a kind cluster from a scenario, faults in the namespaces of its pods, observations on the one monotonic clock of the VM, and predictions from the ordering law. Its judge entry reads and judges a raw record without Docker.",
   "keywords": [
     "kubernetes",
     "kind",
     "kube-proxy",
+    "istio",
     "endpoints",
     "readiness",
     "graceful-shutdown",
@@ -54,6 +55,8 @@
     "src/backends.ts",
     "src/conntrack.ts",
     "src/drops.ts",
+    "src/eds.ts",
+    "src/lds.ts",
     "README.md",
     "LICENSE"
   ],

package/src/eds.ts

@@ -0,0 +1,40 @@
+// The hosts of one cluster in the Envoy of a sidecar, from the text of its admin endpoint
+// `/clusters`. The agent of the lab image reads it with Node, thus this module imports nothing.
+
+/**
+ * These are the hosts of a cluster: the healthy ones (`b`, in sequence), and each other host with its
+ * health flags (`u`). Each host is `ip:port`.
+ */
+export interface ClusterHosts {
+  readonly b: readonly string[];
+  readonly u: Readonly<Record<string, string>>;
+}
+
+/**
+ * This function gives the name of the outbound cluster of a Service port in a sidecar of Istio:
+ * `outbound|<port>||<service>.<namespace>.svc.cluster.local`.
+ */
+export const outboundCluster = (service: string, namespace: string, port: number): string => `outbound|${port}||${service}.${namespace}.svc.cluster.local`;
+
+/** This function gives the filter of `/clusters` that selects one cluster: a regular expression of RE2 with anchors. */
+export const clusterFilter = (cluster: string): string => `^${cluster.replace(/[.|\\^$*+?()[\]{}]/g, (c) => `\\${c}`)}$`;
+
+/**
+ * This function gives the hosts of a cluster from the text of `/clusters`. Each host of the text has
+ * a line `<cluster>::<ip:port>::health_flags::<flags>`. The flags are `healthy`, or the names of the
+ * flags that the host has (`clusters_handler.cc` and `host_utility.cc` of Envoy v1.39.4).
+ */
+export const hostsOf = (text: string, cluster: string): ClusterHosts => {
+  const healthy: string[] = [];
+  const other: Record<string, string> = {};
+  const prefix = `${cluster}::`;
+  for (const line of text.split("\n")) {
+    if (!line.startsWith(prefix)) continue;
+    const parts = line.slice(prefix.length).split("::");
+    if (parts.length !== 3 || parts[1] !== "health_flags") continue;
+    const [host, , flags] = parts as [string, string, string];
+    if (flags.trim() === "healthy") healthy.push(host);
+    else other[host] = flags.trim();
+  }
+  return { b: healthy.sort(), u: other };
+};

package/src/lds.ts

@@ -0,0 +1,31 @@
+// This module has no imports: the agent of the lab image imports it as it is.
+
+/**
+ * This filter of RE2 selects the two counters of the listener manager of Envoy that an update of LDS
+ * moves (`/stats?filter=`, `source/server/admin/stats_params.cc` of Envoy v1.39.4). An update of a
+ * listener counts `listener_modified`. An update in place, of its filter chains only, also counts
+ * `listener_in_place_updated` (`listener_manager_impl.cc:644`, `:692`).
+ */
+export const LDS_FILTER = "^listener_manager\\.listener_(in_place_updated|modified)$";
+
+/** The listener counts are the two counters of LDS of one sidecar: each update (`mod`), and each update in place (`inPlace`). */
+export interface ListenerCounts {
+  readonly mod: number;
+  readonly inPlace: number;
+}
+
+/**
+ * This function gives the listener counts of the text of `/stats`, one `name: value` on each line
+ * (`stats_render.cc:15`). It gives null when the text has no counter `listener_modified`.
+ */
+export const listenerCountsOf = (text: string): ListenerCounts | null => {
+  let mod: number | null = null;
+  let inPlace = 0;
+  for (const line of text.split("\n")) {
+    const match = /^listener_manager\.listener_(in_place_updated|modified): (\d+)$/.exec(line.trim());
+    if (match === null) continue;
+    if (match[1] === "modified") mod = Number(match[2]);
+    else inPlace = Number(match[2]);
+  }
+  return mod === null ? null : { mod, inPlace };
+};