@mark1russell7/kind 0.3.0 → 0.4.1

package/build/{judge-DWF4QdZ8.d.ts → judge-DMuI3aDn.d.ts}

@@ -117,9 +117,10 @@ type Stack = "service" | "grpc";
  * - `app-stall` blocks the event loop of one replica.
  * - `rollout` is a rolling update while Redis is down.
  * - `cpu-throttle` sets `cpu.max` in the cgroup of one replica.
+ * - `authorization-policy` applies an AuthorizationPolicy of Istio that denies the clients, for the hold (T15).
  * - `none` injects nothing: a calibration measures the path itself.
  */
-type TriggerKind = "pod-deletion" | "rolling-update" | "node-drain" | "scale-in" | "crash" | "liveness-restart" | "freeze-process" | "rst" | "blackhole" | "peer-gone-without-close" | "app-stall" | "rollout" | "cpu-throttle";
+type TriggerKind = "pod-deletion" | "rolling-update" | "node-drain" | "scale-in" | "crash" | "liveness-restart" | "freeze-process" | "rst" | "blackhole" | "peer-gone-without-close" | "app-stall" | "rollout" | "cpu-throttle" | "authorization-policy";
 /**
  * A trigger is its kind and the settings of its fault. The parameter `A` is the form of an amount:
  * a quantity in the format `/2`, a number in the format `/1`.
@@ -135,6 +136,12 @@ interface Trigger<A = Quantity> {
     readonly quota: A;
     readonly period: A;
   } | undefined;
+  /**
+   * This name is the service account that an AuthorizationPolicy denies (`authorization-policy`). The
+   * default is `default`, the account of the clients. An account that no pod has changes the policy,
+   * and denies no call.
+   */
+  readonly account?: string | undefined;
 }
 /** A kubelet probe is the period, the failure threshold and the timeout of one probe of the pod. */
 interface KubeletProbe {
@@ -211,8 +218,9 @@ interface Band<A = Quantity> {
  * - `intake`: the stop of the intake of the target pod, as its service records it.
  * - `fault`: the commit of the fault, as the injector or the agent stamps it.
  * - `resume`: the end of a pause of kube-proxy, as the agent stamps it.
+ * - `heal`: the start of the first act that ends the fault, for example the delete of a policy.
  */
-type Reference = "deletion" | "intake" | "fault" | "resume";
+type Reference = "deletion" | "intake" | "fault" | "resume" | "heal";
 /**
  * A reset reuse is how a reset fails a later connection on the same port. A reset from the server
  * leaves the conntrack entry of its flow in CLOSE, with the NAT to that server, for `life`. A SYN on
@@ -273,6 +281,8 @@ type Prediction<A = Quantity> = {
    * earlier drop only closes the window earlier.
    */
   readonly propagation?: Band<A> | undefined;
+  /** These outcomes are the only failures that the window permits. A failure with another outcome fails the run. Without them, each outcome but `ok` can fail. */
+  readonly outcomes?: readonly string[] | undefined;
   readonly why: string;
 } | {
   readonly kind: "removal";
@@ -596,6 +606,10 @@ interface RunFacts<A = Quantity> {
    * run with a deletion after its start, with the stamps of its intake and of its deletion.
    */
   readonly deletions?: readonly Deleted[] | undefined;
+  /** These are the first LDS updates of the sidecar of each server pod after the fault, by pod (`updatesOf`). */
+  readonly updates?: Readonly<Record<string, Propagated<A> | null>> | undefined;
+  /** These are the first LDS updates of the sidecar of each server pod after the heal, by pod. */
+  readonly healUpdates?: Readonly<Record<string, Propagated<A> | null>> | undefined;
 }
 /** A deleted replica is a replica of a run that got a deletion. It gives its pod, and the stamps of its intake (or null) and of its deletion. */
 interface Deleted {
@@ -666,6 +680,14 @@ declare const propagationSource: (cell: Pick<KindCell, "mesh">) => PropagationSo
  * The source `eds` gives the poll of the client sidecar of each node.
  */
 declare const propagationOf: (run: KindRun, from: number | null, ip?: string | undefined, source?: PropagationSource) => Record<string, Propagated | null>;
+/**
+ * This function gives the first LDS update of the sidecar of each server pod after the stamp `from`.
+ * The update came between the poll before (`after`) and the poll that saw it (`by`), after `from`.
+ * A poller gives a line at each change of its counters. Thus a line after `from` with a poll before
+ * it is an update, when its count `mod` is above the count before `from`. The first line of a poller
+ * has no poll before it (`prev` is null), and it is no update.
+ */
+declare const updatesOf: (run: Pick<KindRun, "lines">, from: number | null) => Record<string, Propagated | null>;
 /**
  * This function gives each replica of a run that got a deletion after the start of the run, in the
  * sequence of the deletions. A rolling update deletes each old replica in turn.
@@ -809,12 +831,17 @@ declare const cellsTable: (judged: readonly Judged[]) => string;
  * This function gives the propagation of each calibration, by node. It is the time from the
  * deletion to the poll of the rules of each node without the pod. It also gives the time to the
  * EndpointSlice and to the stop of the intake.
+ *
+ * For a policy of Istio, the propagation is the LDS update of each server sidecar after the apply,
+ * by node (`updatesOf`). Then `heal` is the update after the delete of the policy. `slice` and
+ * `intake` are null.
  */
 declare const calibrationOf: (judged: Judged) => {
   readonly nodes: Readonly<Record<string, TimeSpread | null>>;
   readonly all: TimeSpread | null;
   readonly slice: TimeSpread | null;
   readonly intake: TimeSpread | null;
+  readonly heal?: TimeSpread | null | undefined;
 };
 //#endregion
 //#region src/schema.d.ts
@@ -849,5 +876,5 @@ declare const quantileOf: (sorted: readonly number[], p: number) => number;
  */
 declare const medianInterval: (sorted: readonly number[]) => [number, number];
 //#endregion
-export { Endpoint as $, ResetReuse as $t, TriggerV1 as A, CLIENT as At, RunCheck as B, Band as Bt, KindCellResult as C, signalOf as Ct, PredictionV1 as D, slicesOf as Dt, LoadSample as E, sliceEmptyOf as Et, KIND_NOISE as F, SERVER as Ft, judgeKind as G, Mesh as Gt, checkRun as H, KindCell as Ht, KindDecision as I, bandOf as It, propagationOf as J, PodSettings as Jt, observationAfter as K, MeshFlavor as Kt, KindVerdict as L, seconds as Lt, upgrade as M, LOG_LABEL as Mt, upgradeCell as N, PORT as Nt, RunCheckV1 as O, stoppingOf as Ot, Deleted as P, REDIS as Pt, unitOf as Q, Replica as Qt, LAST_SLACK as R, secondsOf as Rt, KindCellRecordV1 as S, rulesOf as St, KindVerdictV1 as T, sliceDropOf as Tt, deletionsOf as U, KindRun as Ut, RunFacts as V, Declaration as Vt, factsOf as W, KubeletProbe as Wt, referenceOf as X, RedisDeclaration as Xt, propagationSource as Y, Prediction as Yt, reusesReset as Z, Reference as Zt, ClusterManifest as _, scenario as _n, podsAt as _t, STAGES as a, KUBE_PROXY_MODES as an, RulesLine as at, FORMAT_V1 as b, requestsOf as bt, readRecord as c, KubeProxyMode as cn, byClients as ct, calibrationOf as d, cidrOverlap as dn, dropOf as dt, Stack as en, Line as et, cellsTable as f, cidrRange as fn, emptyOf as ft, BandV1 as g, nodeNames as gn, outcomesOf as gt, timeSpread as h, kubeProxyPatch as hn, kernelCounts as ht, quantileOf as i, Workload as in, Request as it, judge as j, HEALTH_PORT as jt, RunFactsV1 as k, transitionOf as kt, Judged as l, NODE_IMAGES as ln, byNode as lt, predictionText as m, kindConfig as mn, intakeOf as mt, medianInterval as n, Trigger as nn, PropagationSource as nt, kindCellRecordSchema as o, KindConfig as on, SliceLine as ot, medianText as p, goDuration as pn, failuresOf as pt, observationEnd as q, MeshMode as qt, middle as r, TriggerKind as rn, RecordLine as rt, kindCellRecordV1Schema as s, KindScenario as sn, backendsAt as st, RELATIVE as t, Template as tn, PodLine as tt, TimeSpread as u, NodeImage as un, deletionOf as ut, EnvironmentManifest as v, scenarioProblems as vn, podsOf as vt, KindCellV1 as w, signalsOf as wt, KindCellRecord as x, restartsAt as xt, FORMAT as y, recordsOf as yt, Propagated as z, showBand as zt };
-//# sourceMappingURL=judge-DWF4QdZ8.d.ts.map
+export { updatesOf as $, Replica as $t, TriggerV1 as A, transitionOf as At, RunCheck as B, showBand as Bt, KindCellResult as C, rulesOf as Ct, PredictionV1 as D, sliceEmptyOf as Dt, LoadSample as E, sliceDropOf as Et, KIND_NOISE as F, REDIS as Ft, judgeKind as G, KubeletProbe as Gt, checkRun as H, Declaration as Ht, KindDecision as I, SERVER as It, propagationOf as J, MeshMode as Jt, observationAfter as K, Mesh as Kt, KindVerdict as L, bandOf as Lt, upgrade as M, HEALTH_PORT as Mt, upgradeCell as N, LOG_LABEL as Nt, RunCheckV1 as O, slicesOf as Ot, Deleted as P, PORT as Pt, unitOf as Q, Reference as Qt, LAST_SLACK as R, seconds as Rt, KindCellRecordV1 as S, restartsAt as St, KindVerdictV1 as T, signalsOf as Tt, deletionsOf as U, KindCell as Ut, RunFacts as V, Band as Vt, factsOf as W, KindRun as Wt, referenceOf as X, Prediction as Xt, propagationSource as Y, PodSettings as Yt, reusesReset as Z, RedisDeclaration as Zt, ClusterManifest as _, nodeNames as _n, outcomesOf as _t, STAGES as a, Workload as an, Request as at, FORMAT_V1 as b, recordsOf as bt, readRecord as c, KindScenario as cn, backendsAt as ct, calibrationOf as d, NodeImage as dn, deletionOf as dt, ResetReuse as en, Endpoint as et, cellsTable as f, cidrOverlap as fn, dropOf as ft, BandV1 as g, kubeProxyPatch as gn, kernelCounts as gt, timeSpread as h, kindConfig as hn, intakeOf as ht, quantileOf as i, TriggerKind as in, RecordLine as it, judge as j, CLIENT as jt, RunFactsV1 as k, stoppingOf as kt, Judged as l, KubeProxyMode as ln, byClients as lt, predictionText as m, goDuration as mn, failuresOf as mt, medianInterval as n, Template as nn, PodLine as nt, kindCellRecordSchema as o, KUBE_PROXY_MODES as on, RulesLine as ot, medianText as p, cidrRange as pn, emptyOf as pt, observationEnd as q, MeshFlavor as qt, middle as r, Trigger as rn, PropagationSource as rt, kindCellRecordV1Schema as s, KindConfig as sn, SliceLine as st, RELATIVE as t, Stack as tn, Line as tt, TimeSpread as u, NODE_IMAGES as un, byNode as ut, EnvironmentManifest as v, scenario as vn, podsAt as vt, KindCellV1 as w, signalOf as wt, KindCellRecord as x, requestsOf as xt, FORMAT as y, scenarioProblems as yn, podsOf as yt, Propagated as z, secondsOf as zt };
+//# sourceMappingURL=judge-DMuI3aDn.d.ts.map

package/build/judge.d.ts

@@ -1,2 +1,2 @@
-import { $ as Endpoint, $t as ResetReuse, A as TriggerV1, At as CLIENT, B as RunCheck, Bt as Band, C as KindCellResult, Ct as signalOf, D as PredictionV1, Dt as slicesOf, E as LoadSample, Et as sliceEmptyOf, F as KIND_NOISE, Ft as SERVER, G as judgeKind, Gt as Mesh, H as checkRun, Ht as KindCell, I as KindDecision, It as bandOf, J as propagationOf, Jt as PodSettings, K as observationAfter, Kt as MeshFlavor, L as KindVerdict, Lt as seconds, M as upgrade, Mt as LOG_LABEL, N as upgradeCell, Nt as PORT, O as RunCheckV1, Ot as stoppingOf, P as Deleted, Pt as REDIS, Q as unitOf, Qt as Replica, R as LAST_SLACK, Rt as secondsOf, S as KindCellRecordV1, St as rulesOf, T as KindVerdictV1, Tt as sliceDropOf, U as deletionsOf, Ut as KindRun, V as RunFacts, Vt as Declaration, W as factsOf, Wt as KubeletProbe, X as referenceOf, Xt as RedisDeclaration, Y as propagationSource, Yt as Prediction, Z as reusesReset, Zt as Reference, _ as ClusterManifest, _t as podsAt, a as STAGES, at as RulesLine, b as FORMAT_V1, bt as requestsOf, c as readRecord, cn as KubeProxyMode, ct as byClients, d as calibrationOf, dt as dropOf, en as Stack, et as Line, f as cellsTable, ft as emptyOf, g as BandV1, gt as outcomesOf, h as timeSpread, ht as kernelCounts, i as quantileOf, in as Workload, it as Request, j as judge, jt as HEALTH_PORT, k as RunFactsV1, kt as transitionOf, l as Judged, lt as byNode, m as predictionText, mt as intakeOf, n as medianInterval, nn as Trigger, nt as PropagationSource, o as kindCellRecordSchema, ot as SliceLine, p as medianText, pt as failuresOf, q as observationEnd, qt as MeshMode, r as middle, rn as TriggerKind, rt as RecordLine, s as kindCellRecordV1Schema, st as backendsAt, t as RELATIVE, tn as Template, tt as PodLine, u as TimeSpread, ut as deletionOf, v as EnvironmentManifest, vt as podsOf, w as KindCellV1, wt as signalsOf, x as KindCellRecord, xt as restartsAt, y as FORMAT, yt as recordsOf, z as Propagated, zt as showBand } from "./judge-DWF4QdZ8.js";
-export { type Band, type BandV1, CLIENT, type ClusterManifest, type Declaration, type Deleted, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, HEALTH_PORT, type Judged, KIND_NOISE, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindDecision, type KindRun, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, Line, type LoadSample, type Mesh, type MeshFlavor, type MeshMode, PORT, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, SERVER, STAGES, SliceLine, type Stack, type Template, type TimeSpread, type Trigger, type TriggerKind, type TriggerV1, type Workload, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, intakeOf, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, medianInterval, medianText, middle, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartsAt, reusesReset, rulesOf, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stoppingOf, timeSpread, transitionOf, unitOf, upgrade, upgradeCell };
+import { $ as updatesOf, $t as Replica, A as TriggerV1, At as transitionOf, B as RunCheck, Bt as showBand, C as KindCellResult, Ct as rulesOf, D as PredictionV1, Dt as sliceEmptyOf, E as LoadSample, Et as sliceDropOf, F as KIND_NOISE, Ft as REDIS, G as judgeKind, Gt as KubeletProbe, H as checkRun, Ht as Declaration, I as KindDecision, It as SERVER, J as propagationOf, Jt as MeshMode, K as observationAfter, Kt as Mesh, L as KindVerdict, Lt as bandOf, M as upgrade, Mt as HEALTH_PORT, N as upgradeCell, Nt as LOG_LABEL, O as RunCheckV1, Ot as slicesOf, P as Deleted, Pt as PORT, Q as unitOf, Qt as Reference, R as LAST_SLACK, Rt as seconds, S as KindCellRecordV1, St as restartsAt, T as KindVerdictV1, Tt as signalsOf, U as deletionsOf, Ut as KindCell, V as RunFacts, Vt as Band, W as factsOf, Wt as KindRun, X as referenceOf, Xt as Prediction, Y as propagationSource, Yt as PodSettings, Z as reusesReset, Zt as RedisDeclaration, _ as ClusterManifest, _t as outcomesOf, a as STAGES, an as Workload, at as Request, b as FORMAT_V1, bt as recordsOf, c as readRecord, ct as backendsAt, d as calibrationOf, dt as deletionOf, en as ResetReuse, et as Endpoint, f as cellsTable, ft as dropOf, g as BandV1, gt as kernelCounts, h as timeSpread, ht as intakeOf, i as quantileOf, in as TriggerKind, it as RecordLine, j as judge, jt as CLIENT, k as RunFactsV1, kt as stoppingOf, l as Judged, ln as KubeProxyMode, lt as byClients, m as predictionText, mt as failuresOf, n as medianInterval, nn as Template, nt as PodLine, o as kindCellRecordSchema, ot as RulesLine, p as medianText, pt as emptyOf, q as observationEnd, qt as MeshFlavor, r as middle, rn as Trigger, rt as PropagationSource, s as kindCellRecordV1Schema, st as SliceLine, t as RELATIVE, tn as Stack, tt as Line, u as TimeSpread, ut as byNode, v as EnvironmentManifest, vt as podsAt, w as KindCellV1, wt as signalOf, x as KindCellRecord, xt as requestsOf, y as FORMAT, yt as podsOf, z as Propagated, zt as secondsOf } from "./judge-DMuI3aDn.js";
+export { type Band, type BandV1, CLIENT, type ClusterManifest, type Declaration, type Deleted, Endpoint, type EnvironmentManifest, FORMAT, FORMAT_V1, HEALTH_PORT, type Judged, KIND_NOISE, type KindCell, type KindCellRecord, type KindCellRecordV1, type KindCellResult, type KindCellV1, type KindDecision, type KindRun, type KindVerdict, type KindVerdictV1, type KubeProxyMode, type KubeletProbe, LAST_SLACK, LOG_LABEL, Line, type LoadSample, type Mesh, type MeshFlavor, type MeshMode, PORT, PodLine, type PodSettings, type Prediction, type PredictionV1, type Propagated, PropagationSource, REDIS, RELATIVE, RecordLine, type RedisDeclaration, type Reference, type Replica, Request, type ResetReuse, RulesLine, type RunCheck, type RunCheckV1, type RunFacts, type RunFactsV1, SERVER, STAGES, SliceLine, type Stack, type Template, type TimeSpread, type Trigger, type TriggerKind, type TriggerV1, type Workload, backendsAt, bandOf, byClients, byNode, calibrationOf, cellsTable, checkRun, deletionOf, deletionsOf, dropOf, emptyOf, factsOf, failuresOf, intakeOf, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, medianInterval, medianText, middle, observationAfter, observationEnd, outcomesOf, podsAt, podsOf, predictionText, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, referenceOf, requestsOf, restartsAt, reusesReset, rulesOf, seconds, secondsOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stoppingOf, timeSpread, transitionOf, unitOf, updatesOf, upgrade, upgradeCell };

package/build/judge.js

@@ -1 +1 @@
-export { tt as CLIENT, u as FORMAT, d as FORMAT_V1, nt as HEALTH_PORT, h as KIND_NOISE, g as LAST_SLACK, rt as LOG_LABEL, it as PORT, at as REDIS, O as RELATIVE, ot as SERVER, t as STAGES, M as backendsAt, st as bandOf, N as byClients, P as byNode, a as calibrationOf, o as cellsTable, _ as checkRun, F as deletionOf, v as deletionsOf, I as dropOf, L as emptyOf, y as factsOf, R as failuresOf, z as intakeOf, f as judge, b as judgeKind, B as kernelCounts, n as kindCellRecordSchema, r as kindCellRecordV1Schema, k as medianInterval, s as medianText, A as middle, x as observationAfter, S as observationEnd, V as outcomesOf, H as podsAt, U as podsOf, c as predictionText, C as propagationOf, w as propagationSource, j as quantileOf, i as readRecord, W as recordsOf, T as referenceOf, G as requestsOf, K as restartsAt, E as reusesReset, q as rulesOf, ct as seconds, lt as secondsOf, ut as showBand, J as signalOf, Y as signalsOf, X as sliceDropOf, Z as sliceEmptyOf, Q as slicesOf, $ as stoppingOf, l as timeSpread, et as transitionOf, D as unitOf, p as upgrade, m as upgradeCell } from "./judge-CRMYoEOw.js";
+export { nt as CLIENT, u as FORMAT, d as FORMAT_V1, rt as HEALTH_PORT, h as KIND_NOISE, g as LAST_SLACK, it as LOG_LABEL, at as PORT, ot as REDIS, k as RELATIVE, st as SERVER, t as STAGES, N as backendsAt, ct as bandOf, P as byClients, F as byNode, a as calibrationOf, o as cellsTable, _ as checkRun, I as deletionOf, v as deletionsOf, L as dropOf, R as emptyOf, y as factsOf, z as failuresOf, B as intakeOf, f as judge, b as judgeKind, V as kernelCounts, n as kindCellRecordSchema, r as kindCellRecordV1Schema, A as medianInterval, s as medianText, j as middle, x as observationAfter, S as observationEnd, H as outcomesOf, U as podsAt, W as podsOf, c as predictionText, C as propagationOf, w as propagationSource, M as quantileOf, i as readRecord, G as recordsOf, T as referenceOf, K as requestsOf, q as restartsAt, E as reusesReset, J as rulesOf, lt as seconds, ut as secondsOf, dt as showBand, Y as signalOf, X as signalsOf, Z as sliceDropOf, Q as sliceEmptyOf, $ as slicesOf, et as stoppingOf, l as timeSpread, tt as transitionOf, D as unitOf, O as updatesOf, p as upgrade, m as upgradeCell } from "./judge-Bkbs7VVG.js";

package/image/Dockerfile

@@ -14,5 +14,5 @@ RUN for name in quantity algebra service; do \
       && tar -xzf /tmp/workspace/mark1russell7-$name-*.tgz -C "node_modules/@mark1russell7/$name" --strip-components=1; \
     done \
  && rm -rf /tmp/workspace
-COPY app.mjs client.mjs client-grpc.mjs agent.mjs watch.mjs compose.ts backends.ts conntrack.ts drops.ts eds.ts ./
+COPY app.mjs client.mjs client-grpc.mjs agent.mjs watch.mjs compose.ts backends.ts conntrack.ts drops.ts eds.ts lds.ts ./
 CMD ["node", "app.mjs"]

package/image/agent.mjs

@@ -11,10 +11,14 @@
 //                              second it reads the counters of dropped packets of the node and
 //                              of each client pod, and prints each one that grew (`drops`).
 //                              As /tmp/eds.json asks, it starts the EDS poller of each client pod
-//                              of the node, and stops it when the file goes
+//                              of the node, and stops it when the file goes. /tmp/lds.json does the
+//                              same for the LDS poller of each server pod
 //   node agent.mjs eds JSON    the EDS poller: in the network namespace of a client pod (nsenter -n),
 //                              it reads /clusters of the Envoy of the sidecar each `every` ms, and
 //                              prints the hosts of the server cluster at each change (`eds`)
+//   node agent.mjs lds JSON    the LDS poller: in the network namespace of a server pod, it reads
+//                              the counters of the listener manager of the sidecar each `every` ms,
+//                              and prints them at each change (`lds`)
 //   node agent.mjs act JSON    does one act and prints its stamps on CLOCK_MONOTONIC
 //
 // The acts: signal (a signal to a PID), pause (SIGSTOP, then SIGCONT after ms), write (a file, for
@@ -26,6 +30,7 @@ import { backendsOf } from "./backends.ts";
 import { entriesOf, flowsOf, staleOf, stalledOf } from "./conntrack.ts";
 import { devOf, grownOf, snmpOf, softnetOf, unresolvedOf } from "./drops.ts";
 import { clusterFilter, hostsOf } from "./eds.ts";
+import { LDS_FILTER, listenerCountsOf } from "./lds.ts";
 
 const now = () => Number(process.hrtime.bigint()) / 1e6;
 const node = process.env.NODE_NAME ?? "";
@@ -261,12 +266,15 @@ const serve = async () => {
 };
 
 /**
- * the EDS pollers of the node: /tmp/eds.json gives the server cluster, the interval and each client
- * pod of the node with a PID in it. The agent starts one poller for each pod in the network
- * namespace of that PID, and stops each one when the file changes or goes. nsenter -n keeps the
- * mount namespace of the agent, thus the poller is this file, and its clock is the one of the VM
+ * the pollers of the sidecars of the node, of one kind: `eds` or `lds`. /tmp/<kind>.json gives the
+ * interval and each pod of the node with a PID in it, and for `eds` the server cluster. The agent
+ * starts one poller for each pod in the network namespace of that PID, and stops each one when the
+ * file changes or goes. nsenter -n keeps the mount namespace of the agent, thus the poller is this
+ * file, and its clock is the one of the VM. The EDS pollers read the client pods, and the LDS
+ * pollers read the server pods
  */
-const pollers = async () => {
+const pollers = async (kind) => {
+  const file = `/tmp/${kind}.json`;
   let config = null;
   let children = [];
   const stop = () => {
@@ -277,10 +285,10 @@ const pollers = async () => {
     let text = null;
     let spec = null;
     try {
-      text = existsSync("/tmp/eds.json") ? readFileSync("/tmp/eds.json", "utf8") : null;
+      text = existsSync(file) ? readFileSync(file, "utf8") : null;
       spec = text === null ? null : JSON.parse(text);
     } catch (error) {
-      say({ ev: "eds-fail", t: now(), why: String(error?.message ?? error).slice(0, 300) });
+      say({ ev: `${kind}-fail`, t: now(), why: String(error?.message ?? error).slice(0, 300) });
       text = config;
     }
     if (text !== config) {
@@ -288,15 +296,15 @@ const pollers = async () => {
       config = text;
       if (spec !== null) {
         for (const { pod, pid } of spec.pods) {
-          const argv = ["-t", String(pid), "-n", "--", process.execPath, process.argv[1], "eds", JSON.stringify({ cluster: spec.cluster, every: spec.every, pod })];
+          const argv = ["-t", String(pid), "-n", "--", process.execPath, process.argv[1], kind, JSON.stringify({ cluster: spec.cluster, every: spec.every, pod })];
           const child = spawn("nsenter", argv, { stdio: ["ignore", "inherit", "inherit"] });
           child.on("exit", (code, signal) => {
-            if (signal !== "SIGKILL") say({ ev: "eds-exit", t: now(), pod, code, signal });
+            if (signal !== "SIGKILL") say({ ev: `${kind}-exit`, t: now(), pod, code, signal });
           });
-          child.on("error", (error) => say({ ev: "eds-fail", t: now(), pod, why: String(error?.message ?? error).slice(0, 300) }));
+          child.on("error", (error) => say({ ev: `${kind}-fail`, t: now(), pod, why: String(error?.message ?? error).slice(0, 300) }));
           children.push(child);
         }
-        say({ ev: "eds-start", t: now(), cluster: spec.cluster, every: spec.every, pods: spec.pods.map((each) => each.pod) });
+        say({ ev: `${kind}-start`, t: now(), ...(spec.cluster === undefined ? {} : { cluster: spec.cluster }), every: spec.every, pods: spec.pods.map((each) => each.pod) });
       }
     }
     await sleep(250);
@@ -304,13 +312,12 @@ const pollers = async () => {
 };
 
 /**
- * one EDS poller. The admin endpoint of the sidecar is 127.0.0.1:15000 in the namespace of the pod
- * (envoy_bootstrap.json of Istio 1.31.3). The filter of /clusters keeps the server cluster only
- * (clusters_handler.cc of Envoy v1.39.4). A line comes at each change of its hosts, with the start of
- * the poll before it (`prev`), as a rules line. Each second, a line `eds-alive` counts the polls
+ * one poll loop of the admin endpoint of a sidecar, 127.0.0.1:15000 in the namespace of the pod
+ * (envoy_bootstrap.json of Istio 1.31.3), each `every` ms. `read` gives the state of one answer, and
+ * a line comes at each change of that state, with the start of the poll before it (`prev`), as a rules
+ * line. Each second, a line `<kind>-alive` counts the polls
  */
-const eds = async ({ cluster, every, pod }) => {
-  const url = `http://127.0.0.1:15000/clusters?filter=${encodeURIComponent(clusterFilter(cluster))}`;
+const poll = async (kind, url, every, pod, read) => {
   let last = null;
   let previous = null;
   let failure = null;
@@ -326,22 +333,22 @@ const eds = async ({ cluster, every, pod }) => {
       polls += 1;
       spent += took;
       if (!response.ok) throw new Error(`the admin endpoint answered ${response.status}: ${text.slice(0, 200)}`);
-      const { b, u } = hostsOf(text, cluster);
-      const key = JSON.stringify([b, u]);
+      const state = read(text);
+      const key = JSON.stringify(state);
       if (key !== last) {
-        say({ ev: "eds", t, prev: previous, pod, took: Math.round(took * 1000) / 1000, b, ...(Object.keys(u).length === 0 ? {} : { u }) });
+        say({ ev: kind, t, prev: previous, pod, took: Math.round(took * 1000) / 1000, ...state });
         last = key;
       }
       failure = null;
     } catch (error) {
       // each failure once, until a poll succeeds
       const why = String(error?.message ?? error).slice(0, 300);
-      if (why !== failure) say({ ev: "eds-fail", t, pod, why });
+      if (why !== failure) say({ ev: `${kind}-fail`, t, pod, why });
       failure = why;
     }
     previous = t;
     if (t - beat >= 1000) {
-      say({ ev: "eds-alive", t, pod, polls, ms: polls === 0 ? 0 : Math.round((spent / polls) * 100) / 100 });
+      say({ ev: `${kind}-alive`, t, pod, polls, ms: polls === 0 ? 0 : Math.round((spent / polls) * 100) / 100 });
       beat = t;
       polls = 0;
       spent = 0;
@@ -351,6 +358,27 @@ const eds = async ({ cluster, every, pod }) => {
   }
 };
 
+/**
+ * one EDS poller. The filter of /clusters keeps the server cluster only (clusters_handler.cc of Envoy
+ * v1.39.4). A line `eds` gives the healthy hosts (`b`), and each other host with its flags (`u`)
+ */
+const eds = ({ cluster, every, pod }) =>
+  poll("eds", `http://127.0.0.1:15000/clusters?filter=${encodeURIComponent(clusterFilter(cluster))}`, every, pod, (text) => {
+    const { b, u } = hostsOf(text, cluster);
+    return { b, ...(Object.keys(u).length === 0 ? {} : { u }) };
+  });
+
+/**
+ * one LDS poller, in a server pod. The filter of /stats keeps the two counters of the listener
+ * manager. A line `lds` gives each update of a listener (`mod`) and each update in place (`inPlace`)
+ */
+const lds = ({ every, pod }) =>
+  poll("lds", `http://127.0.0.1:15000/stats?filter=${encodeURIComponent(LDS_FILTER)}`, every, pod, (text) => {
+    const counts = listenerCountsOf(text);
+    if (counts === null) throw new Error(`the stats have no listener_modified: ${text.slice(0, 200)}`);
+    return counts;
+  });
+
 const act = async (spec) => {
   const t0 = now();
   if (spec.op === "now") return { t0, t1: t0 };
@@ -389,10 +417,13 @@ const act = async (spec) => {
 const [mode, arg] = process.argv.slice(2);
 if (mode === "serve") {
   say({ ev: "agent", what: "start", t: now() });
-  void pollers();
+  void pollers("eds");
+  void pollers("lds");
   await serve();
 } else if (mode === "eds") {
   await eds(JSON.parse(arg));
+} else if (mode === "lds") {
+  await lds(JSON.parse(arg));
 } else if (mode === "act") {
   const spec = JSON.parse(arg);
   try {

package/image/client-grpc.mjs

@@ -64,6 +64,8 @@ const outcomeOf = (error) => {
   if (/ECONNRESET|EPIPE/.test(text)) return "reset";
   if (/EHOSTUNREACH|ENETUNREACH/.test(text)) return "unreachable";
   if (error.code === grpc.status.DEADLINE_EXCEEDED) return "timeout";
+  // the local reply 403 of an RBAC deny of a sidecar of Istio gives PERMISSION_DENIED (status.cc of Envoy v1.39.4, lines 14–15)
+  if (error.code === grpc.status.PERMISSION_DENIED) return "denied";
   return "error";
 };
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package",
   "name": "@mark1russell7/kind",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Kubernetes in Docker as a lab for connection timers: a kind cluster from a scenario, faults in the namespaces of its pods, observations on the one monotonic clock of the VM, and predictions from the ordering law. Its judge entry reads and judges a raw record without Docker.",
   "keywords": [
     "kubernetes",
@@ -56,6 +56,7 @@
     "src/conntrack.ts",
     "src/drops.ts",
     "src/eds.ts",
+    "src/lds.ts",
     "README.md",
     "LICENSE"
   ],
@@ -63,7 +64,7 @@
     "node": ">=22.19"
   },
   "dependencies": {
-    "@mark1russell7/harness": "^0.12.2",
+    "@mark1russell7/harness": "^0.12.3",
     "@mark1russell7/quantity": "^0.2.0",
     "@mark1russell7/service": "^0.5.8",
     "testcontainers": "12.2.0"

package/src/lds.ts

@@ -0,0 +1,31 @@
+// This module has no imports: the agent of the lab image imports it as it is.
+
+/**
+ * This filter of RE2 selects the two counters of the listener manager of Envoy that an update of LDS
+ * moves (`/stats?filter=`, `source/server/admin/stats_params.cc` of Envoy v1.39.4). An update of a
+ * listener counts `listener_modified`. An update in place, of its filter chains only, also counts
+ * `listener_in_place_updated` (`listener_manager_impl.cc:644`, `:692`).
+ */
+export const LDS_FILTER = "^listener_manager\\.listener_(in_place_updated|modified)$";
+
+/** The listener counts are the two counters of LDS of one sidecar: each update (`mod`), and each update in place (`inPlace`). */
+export interface ListenerCounts {
+  readonly mod: number;
+  readonly inPlace: number;
+}
+
+/**
+ * This function gives the listener counts of the text of `/stats`, one `name: value` on each line
+ * (`stats_render.cc:15`). It gives null when the text has no counter `listener_modified`.
+ */
+export const listenerCountsOf = (text: string): ListenerCounts | null => {
+  let mod: number | null = null;
+  let inPlace = 0;
+  for (const line of text.split("\n")) {
+    const match = /^listener_manager\.listener_(in_place_updated|modified): (\d+)$/.exec(line.trim());
+    if (match === null) continue;
+    if (match[1] === "modified") mod = Number(match[2]);
+    else inPlace = Number(match[2]);
+  }
+  return mod === null ? null : { mod, inPlace };
+};