@mark1russell7/kind 0.4.0 → 0.5.0

package/README.md

@@ -90,6 +90,9 @@ The tests read three real records of `/1` (`test/records/`): a cell that holds,
   - `listener_modified` counts each update of a listener, and `listener_in_place_updated` counts each update of its filter chains only.
   - Each change of the counters gives an `lds` line with the start of the poll before it. The first line of a poller has no poll before it, thus it is no update (`updatesOf`).
 - **The injector of each node** is the image of the harness, in the PID namespace of the node. `crictl` on the node gives the PID of a container, and `nsenter -n` enters the network namespace of its pod. The injector of the harness then applies its rules there.
+  - From 0.5.0, the target `servers` puts a rule in the namespace of each replica, with each client pod as a peer. A REJECT resets only the sender of the segment that it matches, thus the rule goes where the segments of the clients arrive.
+  - The rules of all replicas commit at one instant on CLOCK_MONOTONIC (`--at`, 700 ms after the start). Thus no client meets one replica with the rule and another without it. The clear uses the PIDs of the fault again, thus the heal comes soon after its hold.
+  - The lab reads the tables of each replica with their counters (`tables`): the nat table after the fault, and the filter table before the clear. A `tables` line in the record shows if the rule matched the clients beside the rules of istio-cni.
 - **The watcher** is a container on the network of the cluster. It watches the pods, the EndpointSlices and the events through the API, and it follows the log of each pod of the cell.
   - From 0.3.0, it also follows the sidecar of Istio (`istio-proxy`), and a pod line gives the state of the sidecar (`sc`). Each line of the sidecar becomes a `proxy` line, stamped at its arrival. Its own stamps are of the wall clock, thus no band reads them.
   - The access line of a call that succeeded at its first try is only counted, in a `proxy-ok` line each second. The record keeps each failure, each retry and each local reply, with its response flags and its upstream host.
@@ -118,15 +121,22 @@ A declaration that can be null changes the type `KindCell`. That is a breaking c
 
 From 0.3.0, a cell can name a mesh (`mesh`): Istio 1.31.3 in its cluster. This is the template `T15`, the lifecycle of T07 through two mesh hops.
 
-- **The field.** `mesh.flavor` is the install: `sidecar` is istiod only. `mesh.mode` is the data plane of the pods of the cell. The flavor `ambient` comes in step 3 of the plan, and the lab refuses it until then.
+- **The field.** `mesh.flavor` is the install: `sidecar` is istiod only, and `ambient` is istiod, istio-cni and ztunnel. `mesh.mode` is the data plane of the pods of the cell.
 - **The cluster.** The cells of one kube-proxy mode, one node count and one mesh flavor share a cluster. `shardOf` keeps them together, and in each mode the cells with no mesh come first.
-- **The install.** `installMesh` writes the IstioOperator of the flavor (`istioOperator`), and `istioctl install` applies it with the kubeconfig of the cluster. Then the lab waits for istiod.
+- **The install.** `installMesh` writes the IstioOperator of the flavor (`istioOperator`), and `istioctl install` applies it with the kubeconfig of the cluster. Then the lab waits for each workload of the flavor (`MESH_WORKLOADS`). A failed install gives the pods of istio-system and the log of istio-cni in its error.
 - **The values.** The profile is `minimal`, because the profile `default` also has an ingress gateway. The pod of istiod requests 256 MiB, with one replica and no autoscaler. The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
 - **The images.** `ISTIO_IMAGES` pins istiod and the proxy by the digest of their index on Docker Hub. The lab pulls each one by its digest and tags it with that digest (`localPin`). Then `kind load` puts it on each node.
 - **No pull.** Each image is a full reference, thus the charts use it as it is. The init container of the injector gets the image of the proxy too. `imagePullPolicy` is `Never`, thus an image that the lab did not load fails the install.
 - **The namespace.** In the sidecar mode, the namespace of the cell has the label `istio-injection=enabled` (`namespaceObject`). The injector then puts a native sidecar in each pod: an init container that runs beside the app, because each kubelet is at least 1.33.
 - **The probes.** The injector changes the gRPC probe of grpc-go into an HTTP probe of pilot-agent. Then pilot-agent sends the gRPC check to the app, with the service of the probe.
 
+From 0.5.0, the lab installs the flavor `ambient` too:
+
+- **The values.** The profile is `ambient`: istiod, istio-cni and ztunnel on each node, and no gateway. `ISTIO_IMAGES` also pins istio-cni and ztunnel, and `MESH_IMAGES` gives the images of each flavor. The chart of ztunnel reads only its own `imagePullPolicy`, thus the operator sets it to `Never` there too.
+- **The namespace.** In the ambient mode, the namespace of the cell has the label `istio.io/dataplane-mode=ambient`. Then istio-cni redirects the traffic of each pod to ztunnel in the network namespace of the pod. A pod has no sidecar.
+- **The kernel.** istio-cni writes iptables rules in each pod and on each node. Thus `kind.yml` loads their modules first, and an ambient cell waits when one does not load.
+- **The log of ztunnel.** For a cell in the ambient mode, the watcher follows each ztunnel pod in istio-system (`followsZtunnel`). Each line of its log becomes a `ztunnel` line, stamped at its arrival, and each ztunnel pod is a `ztunnel-pod` line. No band reads them.
+
 A new member of the union `Template` breaks a reader that switches on it. That is a breaking change before 1.0.0, thus the version is 0.3.0. The record format stays `/2`, with the optional field `mesh`. A judge before 0.3.0 cannot read a record of T15.
 
 ## The image
@@ -156,7 +166,7 @@ The lab image (`image/`) holds the service of a cell on `@mark1russell7/service`
 | `crash` | SIGKILL of the process of the service, from the node |
 | `liveness-restart` | the flag file that fails the liveness check of the first replica |
 | `freeze-process` | SIGSTOP and SIGCONT: of kube-proxy on one node across a deletion (T07), or of Redis (T18) |
-| `rst`, `blackhole` | the injector of the harness in the namespace of Redis, with each replica as a peer |
+| `rst`, `blackhole` | the injector of the harness in the namespace of Redis, with each replica as a peer. In T15, the injector in the namespace of each replica, with each client pod as a peer (the target `servers`) |
 | `peer-gone-without-close` | a black hole on Redis, then no Redis pod: its namespace goes away with its rules |
 | `app-stall` | the event loop of the first replica blocked |
 | `rollout` | no Redis pod, then a rolling update |
@@ -209,6 +219,8 @@ From 0.4.0, a window can count from the heal (`heal`), the first act that ends t
 - A denial after the window, before the last update after the delete and one more call, is a `tail`. A denied call has no pod, because the sidecar answers it. Thus the judge reads the last update of each server sidecar.
 - `calibrationOf` gives the updates after the apply by node, and the updates after the delete (`heal`).
 
+A new member of the union `Target`, `servers`, breaks a reader that switches on it. `KindLab` also has a new method, `tables`, which each implementation must have. Each is a breaking change before 1.0.0, thus the version is 0.5.0. The record format stays `/2`: the lines `tables`, `ztunnel` and `ztunnel-pod` are new lines of a run.
+
 A new member of the union `TriggerKind` breaks a reader that switches on it. That is a breaking change before 1.0.0, thus the version is 0.4.0. The record format stays `/2`, with the optional fields `account`, `outcomes`, `updates` and `healUpdates`, and the reference `heal`.
 
 A preStop sleep that is longer than the grace is a command in the container (`sh -c "sleep 60"`). The API server refuses a sleep action that is longer than the grace.

package/build/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as updatesOf, $t as Replica, A as TriggerV1, At as transitionOf, B as RunCheck, Bt as showBand, C as KindCellResult, Ct as rulesOf, D as PredictionV1, Dt as sliceEmptyOf, E as LoadSample, Et as sliceDropOf, F as KIND_NOISE, Ft as REDIS, G as judgeKind, Gt as KubeletProbe, H as checkRun, Ht as Declaration, I as KindDecision, It as SERVER, J as propagationOf, Jt as MeshMode, K as observationAfter, Kt as Mesh, L as KindVerdict, Lt as bandOf, M as upgrade, Mt as HEALTH_PORT, N as upgradeCell, Nt as LOG_LABEL, O as RunCheckV1, Ot as slicesOf, P as Deleted, Pt as PORT, Q as unitOf, Qt as Reference, R as LAST_SLACK, Rt as seconds, S as KindCellRecordV1, St as restartsAt, T as KindVerdictV1, Tt as signalsOf, U as deletionsOf, Ut as KindCell, V as RunFacts, Vt as Band, W as factsOf, Wt as KindRun, X as referenceOf, Xt as Prediction, Y as propagationSource, Yt as PodSettings, Z as reusesReset, Zt as RedisDeclaration, _ as ClusterManifest, _n as nodeNames, _t as outcomesOf, a as STAGES, an as Workload, at as Request, b as FORMAT_V1, bt as recordsOf, c as readRecord, cn as KindScenario, ct as backendsAt, d as calibrationOf, dn as NodeImage, dt as deletionOf, en as ResetReuse, et as Endpoint, f as cellsTable, fn as cidrOverlap, ft as dropOf, g as BandV1, gn as kubeProxyPatch, gt as kernelCounts, h as timeSpread, hn as kindConfig, ht as intakeOf, i as quantileOf, in as TriggerKind, it as RecordLine, j as judge, jt as CLIENT, k as RunFactsV1, kt as stoppingOf, l as Judged, ln as KubeProxyMode, lt as byClients, m as predictionText, mn as goDuration, mt as failuresOf, n as medianInterval, nn as Template, nt as PodLine, o as kindCellRecordSchema, on as KUBE_PROXY_MODES, ot as RulesLine, p as medianText, pn as cidrRange, pt as emptyOf, q as observationEnd, qt as MeshFlavor, r as middle, rn as Trigger, rt as PropagationSource, s as kindCellRecordV1Schema, sn as KindConfig, st as SliceLine, t as RELATIVE, tn as Stack, tt as Line, u as TimeSpread, un as NODE_IMAGES, ut as byNode, v as EnvironmentManifest, vn as scenario, vt as podsAt, w as KindCellV1, wt as signalOf, x as KindCellRecord, xt as requestsOf, y as FORMAT, yn as scenarioProblems, yt as podsOf, z as Propagated, zt as secondsOf } from "./judge-DMuI3aDn.js";
+import { $ as updatesOf, $t as Replica, A as TriggerV1, At as transitionOf, B as RunCheck, Bt as showBand, C as KindCellResult, Ct as rulesOf, D as PredictionV1, Dt as sliceEmptyOf, E as LoadSample, Et as sliceDropOf, F as KIND_NOISE, Ft as REDIS, G as judgeKind, Gt as KubeletProbe, H as checkRun, Ht as Declaration, I as KindDecision, It as SERVER, J as propagationOf, Jt as MeshMode, K as observationAfter, Kt as Mesh, L as KindVerdict, Lt as bandOf, M as upgrade, Mt as HEALTH_PORT, N as upgradeCell, Nt as LOG_LABEL, O as RunCheckV1, Ot as slicesOf, P as Deleted, Pt as PORT, Q as unitOf, Qt as Reference, R as LAST_SLACK, Rt as seconds, S as KindCellRecordV1, St as restartsAt, T as KindVerdictV1, Tt as signalsOf, U as deletionsOf, Ut as KindCell, V as RunFacts, Vt as Band, W as factsOf, Wt as KindRun, X as referenceOf, Xt as Prediction, Y as propagationSource, Yt as PodSettings, Z as reusesReset, Zt as RedisDeclaration, _ as ClusterManifest, _n as nodeNames, _t as outcomesOf, a as STAGES, an as Workload, at as Request, b as FORMAT_V1, bt as recordsOf, c as readRecord, cn as KindScenario, ct as backendsAt, d as calibrationOf, dn as NodeImage, dt as deletionOf, en as ResetReuse, et as Endpoint, f as cellsTable, fn as cidrOverlap, ft as dropOf, g as BandV1, gn as kubeProxyPatch, gt as kernelCounts, h as timeSpread, hn as kindConfig, ht as intakeOf, i as quantileOf, in as TriggerKind, it as RecordLine, j as judge, jt as CLIENT, k as RunFactsV1, kt as stoppingOf, l as Judged, ln as KubeProxyMode, lt as byClients, m as predictionText, mn as goDuration, mt as failuresOf, n as medianInterval, nn as Template, nt as PodLine, o as kindCellRecordSchema, on as KUBE_PROXY_MODES, ot as RulesLine, p as medianText, pn as cidrRange, pt as emptyOf, q as observationEnd, qt as MeshFlavor, r as middle, rn as Trigger, rt as PropagationSource, s as kindCellRecordV1Schema, sn as KindConfig, st as SliceLine, t as RELATIVE, tn as Stack, tt as Line, u as TimeSpread, un as NODE_IMAGES, ut as byNode, v as EnvironmentManifest, vn as scenario, vt as podsAt, w as KindCellV1, wt as signalOf, x as KindCellRecord, xt as requestsOf, y as FORMAT, yn as scenarioProblems, yt as podsOf, z as Propagated, zt as secondsOf } from "./judge-BS9pk96o.js";
 import { Quantity } from "@mark1russell7/quantity";
 import { CheckFn, Finding, HealthServer, Poll, Rule, Scenario, ServiceBuilder, ServiceDescription, Stage, Timing, TransportImpl, Verdict } from "@mark1russell7/service";
 import { RedisClient } from "@mark1russell7/service/redis";
@@ -111,8 +111,11 @@ export declare const hostsOf: (text: string, cluster: string) => ClusterHosts;
  * - `server` is the first replica of the service, in the sequence of its name.
  * - `redis` is the Redis pod.
  * - `kube-proxy` is kube-proxy on the first worker.
+ * - `servers` is each replica of the service. Only the injector takes it: a rule in the network
+ *   namespace of each replica, with each client pod as a peer. A REJECT resets only the sender of
+ *   the segment that it matches, thus the rule goes where the segments of the clients arrive.
  */
-type Target = "server" | "redis" | "kube-proxy";
+type Target = "server" | "redis" | "kube-proxy" | "servers";
 /** A step is one act of a fault, in the sequence of the plan. */
 type Step = {
   readonly do: "kubectl";
@@ -184,7 +187,11 @@ export declare const deletes: (cell: KindCell) => boolean;
  * Then it copies the files of the image.
  */
 export declare const stageLabImage: () => string;
-/** This function builds the lab image one time for each process, and gives its tag. Docker keeps its layers between builds. */
+/**
+ * This function builds the lab image one time for each process, and gives its tag. Docker keeps its
+ * layers between builds. A build that fails leaves the cache. Thus a later call builds again after a
+ * fault of Docker or of the network.
+ */
 export declare const labImage: () => Promise<string>;
 //#endregion
 //#region src/istio.d.ts
@@ -196,15 +203,20 @@ export declare const labImage: () => Promise<string>;
 /** This version is the release of Istio of the lab: the tag of istioctl and of each image. */
 export declare const ISTIO_VERSION = "1.31.3";
 /**
- * These are the images of the flavor `sidecar`, pinned by the digest of their index on Docker Hub
- * (read on 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by
- * its digest, tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls
- * from a registry.
+ * These are the images of Istio, pinned by the digest of their index on Docker Hub (read on
+ * 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by its digest,
+ * tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls from a
+ * registry. The flavor `sidecar` needs istiod and the proxy. The flavor `ambient` also needs
+ * istio-cni and ztunnel (`MESH_IMAGES`).
  */
 export declare const ISTIO_IMAGES: {
   readonly pilot: string;
   readonly proxy: string;
+  readonly cni: string;
+  readonly ztunnel: string;
 };
+/** These are the images that each flavor installs, by their names in `ISTIO_IMAGES`. */
+export declare const MESH_IMAGES: Readonly<Record<MeshFlavor, ReadonlyArray<keyof typeof ISTIO_IMAGES>>>;
 /**
  * This format is the JSON access log of each sidecar. Each field is a command of the formatter of
  * Envoy v1.39.4. The fields give the status, the response flags and their details, and the gRPC
@@ -213,10 +225,12 @@ export declare const ISTIO_IMAGES: {
  * (`image/watch.mjs`).
  */
 export declare const ACCESS_LOG_FORMAT: Readonly<Record<string, string>>;
-/** These are the local tags of the images, after the pull by digest. */
+/** These are the local tags of the images, after the pull by digest. The flavor `ambient` needs `cni` and `ztunnel`. */
 interface MeshImages {
   readonly pilot: string;
   readonly proxy: string;
+  readonly cni?: string | undefined;
+  readonly ztunnel?: string | undefined;
 }
 /**
  * This function gives the IstioOperator of a flavor. The values that are not the defaults of Istio:
@@ -228,12 +242,21 @@ interface MeshImages {
  *   reports the whole runner, and no cell scales istiod.
  * - The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
  *
- * The flavor `ambient` comes in a later step, thus it is refused.
+ * The flavor `ambient` has the profile `ambient`: istiod, istio-cni and ztunnel, and no gateway
+ * (manifests/profiles/ambient.yaml of Istio 1.31.3). Its two other images are full references too
+ * (templates/daemonset.yaml of the chart of istio-cni, lines 93–96, and of ztunnel, lines 65–68).
+ * The chart of istio-cni takes the pull policy of `global`. The template of ztunnel reads only its own
+ * `imagePullPolicy`, thus the operator sets it there too.
  */
 export declare const istioOperator: (flavor: MeshFlavor, images: MeshImages) => Record<string, unknown>;
+/** These are the workloads of each flavor in istio-system that the install waits for. */
+export declare const MESH_WORKLOADS: Readonly<Record<MeshFlavor, readonly string[]>>;
 /**
  * This function installs the mesh of a flavor in a cluster with `istioctl install` and the operator
- * of the flavor. Then it waits for istiod. The kubeconfig of the cluster goes to istioctl.
+ * of the flavor. Then it waits for each workload of the flavor. The kubeconfig of the cluster goes to
+ * istioctl. When the install fails, the error has the pods of istio-system and the last lines of the
+ * log of istio-cni. Thus the log of the job shows the cause, for example a module that the kernel of
+ * the runner does not have.
  */
 export declare const installMesh: (cluster: Cluster, flavor: MeshFlavor, images: MeshImages) => Promise<void>;
 /** This function gives the key of the mesh of a cell for its cluster: its flavor, or `none`. */
@@ -244,6 +267,8 @@ export declare const serverCluster: (namespace: string) => string;
 export declare const EDS_EVERY: Quantity;
 /** This time is the interval of the LDS poll of each server sidecar, the same as the poll of EDS. */
 export declare const LDS_EVERY: Quantity;
+/** This function tells if the watcher follows the log of each ztunnel for a cell: a cell in ambient mode. */
+export declare const followsZtunnel: (cell: Pick<KindCell, "mesh">) => boolean;
 /** This function tells if the lab polls the LDS updates of the server sidecars of a cell: a policy in a sidecar mesh. */
 export declare const pollsListeners: (cell: Pick<KindCell, "mesh" | "trigger">) => boolean;
 //#endregion
@@ -288,7 +313,14 @@ interface KindLab {
   take(): Line[];
   /** This method adds a listener of each line, and gives the function that removes it. */
   listen(listener: (line: Line) => void): () => void;
-  watch(namespaces: readonly string[]): Promise<void>;
+  /**
+   * This method starts the watcher of the API on the namespaces. With `ztunnel`, it also follows the
+   * log of each ztunnel in istio-system: lines `ztunnel-pod` and `ztunnel`, which no tracker of the
+   * cell reads.
+   */
+  watch(namespaces: readonly string[], options?: {
+    readonly ztunnel?: boolean | undefined;
+  }): Promise<void>;
   probe(netns: readonly number[]): Promise<void>;
   stopProbe(): Promise<void>;
   /** This method asks each agent to poll the backends of a Service in the rules of its node, `every` apart, or to stop with null. */
@@ -308,6 +340,12 @@ interface KindLab {
   lds(spec: LdsSpec | null): Promise<void>;
   act(node: string, spec: Readonly<Record<string, unknown>>): Promise<Stamp>;
   inject(node: string, pid: number, args: readonly string[]): Promise<Stamp>;
+  /**
+   * This method gives the rules of one table of iptables in the network namespace of a PID, with
+   * their counters (`iptables-save -c`). The injector reads them. The method also adds them to the
+   * lines as a line `tables`: evidence of which rules matched.
+   */
+  tables(node: string, pid: number, table: string): Promise<string>;
   now(): Promise<number>;
   pidOf(node: string, namespace: string, pod: string, container: string): Promise<number>;
   netnsOf(node: string, pid: number): Promise<number>;
@@ -366,6 +404,8 @@ export declare const namespaceOf: (cell: Pick<KindCell, "name">) => string;
 /**
  * This function gives the Namespace object of a cell. In the sidecar mode of a mesh, the label
  * `istio-injection=enabled` makes the injector of Istio put a sidecar in each pod of the namespace.
+ * In the ambient mode, the label `istio.io/dataplane-mode=ambient` makes istio-cni redirect the
+ * traffic of each pod to ztunnel. The listeners of ztunnel are in the network namespace of the pod.
  */
 export declare const namespaceObject: (cell: Pick<KindCell, "mesh">, namespace: string) => Record<string, unknown>;
 /**