@mark1russell7/kind 0.4.1 → 0.5.0

package/README.md

@@ -90,6 +90,9 @@ The tests read three real records of `/1` (`test/records/`): a cell that holds,
   - `listener_modified` counts each update of a listener, and `listener_in_place_updated` counts each update of its filter chains only.
   - Each change of the counters gives an `lds` line with the start of the poll before it. The first line of a poller has no poll before it, thus it is no update (`updatesOf`).
 - **The injector of each node** is the image of the harness, in the PID namespace of the node. `crictl` on the node gives the PID of a container, and `nsenter -n` enters the network namespace of its pod. The injector of the harness then applies its rules there.
+  - From 0.5.0, the target `servers` puts a rule in the namespace of each replica, with each client pod as a peer. A REJECT resets only the sender of the segment that it matches, thus the rule goes where the segments of the clients arrive.
+  - The rules of all replicas commit at one instant on CLOCK_MONOTONIC (`--at`, 700 ms after the start). Thus no client meets one replica with the rule and another without it. The clear uses the PIDs of the fault again, thus the heal comes soon after its hold.
+  - The lab reads the tables of each replica with their counters (`tables`): the nat table after the fault, and the filter table before the clear. A `tables` line in the record shows if the rule matched the clients beside the rules of istio-cni.
 - **The watcher** is a container on the network of the cluster. It watches the pods, the EndpointSlices and the events through the API, and it follows the log of each pod of the cell.
   - From 0.3.0, it also follows the sidecar of Istio (`istio-proxy`), and a pod line gives the state of the sidecar (`sc`). Each line of the sidecar becomes a `proxy` line, stamped at its arrival. Its own stamps are of the wall clock, thus no band reads them.
   - The access line of a call that succeeded at its first try is only counted, in a `proxy-ok` line each second. The record keeps each failure, each retry and each local reply, with its response flags and its upstream host.
@@ -118,15 +121,22 @@ A declaration that can be null changes the type `KindCell`. That is a breaking c
 
 From 0.3.0, a cell can name a mesh (`mesh`): Istio 1.31.3 in its cluster. This is the template `T15`, the lifecycle of T07 through two mesh hops.
 
-- **The field.** `mesh.flavor` is the install: `sidecar` is istiod only. `mesh.mode` is the data plane of the pods of the cell. The flavor `ambient` comes in step 3 of the plan, and the lab refuses it until then.
+- **The field.** `mesh.flavor` is the install: `sidecar` is istiod only, and `ambient` is istiod, istio-cni and ztunnel. `mesh.mode` is the data plane of the pods of the cell.
 - **The cluster.** The cells of one kube-proxy mode, one node count and one mesh flavor share a cluster. `shardOf` keeps them together, and in each mode the cells with no mesh come first.
-- **The install.** `installMesh` writes the IstioOperator of the flavor (`istioOperator`), and `istioctl install` applies it with the kubeconfig of the cluster. Then the lab waits for istiod.
+- **The install.** `installMesh` writes the IstioOperator of the flavor (`istioOperator`), and `istioctl install` applies it with the kubeconfig of the cluster. Then the lab waits for each workload of the flavor (`MESH_WORKLOADS`). A failed install gives the pods of istio-system and the log of istio-cni in its error.
 - **The values.** The profile is `minimal`, because the profile `default` also has an ingress gateway. The pod of istiod requests 256 MiB, with one replica and no autoscaler. The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
 - **The images.** `ISTIO_IMAGES` pins istiod and the proxy by the digest of their index on Docker Hub. The lab pulls each one by its digest and tags it with that digest (`localPin`). Then `kind load` puts it on each node.
 - **No pull.** Each image is a full reference, thus the charts use it as it is. The init container of the injector gets the image of the proxy too. `imagePullPolicy` is `Never`, thus an image that the lab did not load fails the install.
 - **The namespace.** In the sidecar mode, the namespace of the cell has the label `istio-injection=enabled` (`namespaceObject`). The injector then puts a native sidecar in each pod: an init container that runs beside the app, because each kubelet is at least 1.33.
 - **The probes.** The injector changes the gRPC probe of grpc-go into an HTTP probe of pilot-agent. Then pilot-agent sends the gRPC check to the app, with the service of the probe.
 
+From 0.5.0, the lab installs the flavor `ambient` too:
+
+- **The values.** The profile is `ambient`: istiod, istio-cni and ztunnel on each node, and no gateway. `ISTIO_IMAGES` also pins istio-cni and ztunnel, and `MESH_IMAGES` gives the images of each flavor. The chart of ztunnel reads only its own `imagePullPolicy`, thus the operator sets it to `Never` there too.
+- **The namespace.** In the ambient mode, the namespace of the cell has the label `istio.io/dataplane-mode=ambient`. Then istio-cni redirects the traffic of each pod to ztunnel in the network namespace of the pod. A pod has no sidecar.
+- **The kernel.** istio-cni writes iptables rules in each pod and on each node. Thus `kind.yml` loads their modules first, and an ambient cell waits when one does not load.
+- **The log of ztunnel.** For a cell in the ambient mode, the watcher follows each ztunnel pod in istio-system (`followsZtunnel`). Each line of its log becomes a `ztunnel` line, stamped at its arrival, and each ztunnel pod is a `ztunnel-pod` line. No band reads them.
+
 A new member of the union `Template` breaks a reader that switches on it. That is a breaking change before 1.0.0, thus the version is 0.3.0. The record format stays `/2`, with the optional field `mesh`. A judge before 0.3.0 cannot read a record of T15.
 
 ## The image
@@ -156,7 +166,7 @@ The lab image (`image/`) holds the service of a cell on `@mark1russell7/service`
 | `crash` | SIGKILL of the process of the service, from the node |
 | `liveness-restart` | the flag file that fails the liveness check of the first replica |
 | `freeze-process` | SIGSTOP and SIGCONT: of kube-proxy on one node across a deletion (T07), or of Redis (T18) |
-| `rst`, `blackhole` | the injector of the harness in the namespace of Redis, with each replica as a peer |
+| `rst`, `blackhole` | the injector of the harness in the namespace of Redis, with each replica as a peer. In T15, the injector in the namespace of each replica, with each client pod as a peer (the target `servers`) |
 | `peer-gone-without-close` | a black hole on Redis, then no Redis pod: its namespace goes away with its rules |
 | `app-stall` | the event loop of the first replica blocked |
 | `rollout` | no Redis pod, then a rolling update |
@@ -209,6 +219,8 @@ From 0.4.0, a window can count from the heal (`heal`), the first act that ends t
 - A denial after the window, before the last update after the delete and one more call, is a `tail`. A denied call has no pod, because the sidecar answers it. Thus the judge reads the last update of each server sidecar.
 - `calibrationOf` gives the updates after the apply by node, and the updates after the delete (`heal`).
 
+A new member of the union `Target`, `servers`, breaks a reader that switches on it. `KindLab` also has a new method, `tables`, which each implementation must have. Each is a breaking change before 1.0.0, thus the version is 0.5.0. The record format stays `/2`: the lines `tables`, `ztunnel` and `ztunnel-pod` are new lines of a run.
+
 A new member of the union `TriggerKind` breaks a reader that switches on it. That is a breaking change before 1.0.0, thus the version is 0.4.0. The record format stays `/2`, with the optional fields `account`, `outcomes`, `updates` and `healUpdates`, and the reference `heal`.
 
 A preStop sleep that is longer than the grace is a command in the container (`sh -c "sleep 60"`). The API server refuses a sleep action that is longer than the grace.

package/build/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as updatesOf, $t as Replica, A as TriggerV1, At as transitionOf, B as RunCheck, Bt as showBand, C as KindCellResult, Ct as rulesOf, D as PredictionV1, Dt as sliceEmptyOf, E as LoadSample, Et as sliceDropOf, F as KIND_NOISE, Ft as REDIS, G as judgeKind, Gt as KubeletProbe, H as checkRun, Ht as Declaration, I as KindDecision, It as SERVER, J as propagationOf, Jt as MeshMode, K as observationAfter, Kt as Mesh, L as KindVerdict, Lt as bandOf, M as upgrade, Mt as HEALTH_PORT, N as upgradeCell, Nt as LOG_LABEL, O as RunCheckV1, Ot as slicesOf, P as Deleted, Pt as PORT, Q as unitOf, Qt as Reference, R as LAST_SLACK, Rt as seconds, S as KindCellRecordV1, St as restartsAt, T as KindVerdictV1, Tt as signalsOf, U as deletionsOf, Ut as KindCell, V as RunFacts, Vt as Band, W as factsOf, Wt as KindRun, X as referenceOf, Xt as Prediction, Y as propagationSource, Yt as PodSettings, Z as reusesReset, Zt as RedisDeclaration, _ as ClusterManifest, _n as nodeNames, _t as outcomesOf, a as STAGES, an as Workload, at as Request, b as FORMAT_V1, bt as recordsOf, c as readRecord, cn as KindScenario, ct as backendsAt, d as calibrationOf, dn as NodeImage, dt as deletionOf, en as ResetReuse, et as Endpoint, f as cellsTable, fn as cidrOverlap, ft as dropOf, g as BandV1, gn as kubeProxyPatch, gt as kernelCounts, h as timeSpread, hn as kindConfig, ht as intakeOf, i as quantileOf, in as TriggerKind, it as RecordLine, j as judge, jt as CLIENT, k as RunFactsV1, kt as stoppingOf, l as Judged, ln as KubeProxyMode, lt as byClients, m as predictionText, mn as goDuration, mt as failuresOf, n as medianInterval, nn as Template, nt as PodLine, o as kindCellRecordSchema, on as KUBE_PROXY_MODES, ot as RulesLine, p as medianText, pn as cidrRange, pt as emptyOf, q as observationEnd, qt as MeshFlavor, r as middle, rn as Trigger, rt as PropagationSource, s as kindCellRecordV1Schema, sn as KindConfig, st as SliceLine, t as RELATIVE, tn as Stack, tt as Line, u as TimeSpread, un as NODE_IMAGES, ut as byNode, v as EnvironmentManifest, vn as scenario, vt as podsAt, w as KindCellV1, wt as signalOf, x as KindCellRecord, xt as requestsOf, y as FORMAT, yn as scenarioProblems, yt as podsOf, z as Propagated, zt as secondsOf } from "./judge-DMuI3aDn.js";
+import { $ as updatesOf, $t as Replica, A as TriggerV1, At as transitionOf, B as RunCheck, Bt as showBand, C as KindCellResult, Ct as rulesOf, D as PredictionV1, Dt as sliceEmptyOf, E as LoadSample, Et as sliceDropOf, F as KIND_NOISE, Ft as REDIS, G as judgeKind, Gt as KubeletProbe, H as checkRun, Ht as Declaration, I as KindDecision, It as SERVER, J as propagationOf, Jt as MeshMode, K as observationAfter, Kt as Mesh, L as KindVerdict, Lt as bandOf, M as upgrade, Mt as HEALTH_PORT, N as upgradeCell, Nt as LOG_LABEL, O as RunCheckV1, Ot as slicesOf, P as Deleted, Pt as PORT, Q as unitOf, Qt as Reference, R as LAST_SLACK, Rt as seconds, S as KindCellRecordV1, St as restartsAt, T as KindVerdictV1, Tt as signalsOf, U as deletionsOf, Ut as KindCell, V as RunFacts, Vt as Band, W as factsOf, Wt as KindRun, X as referenceOf, Xt as Prediction, Y as propagationSource, Yt as PodSettings, Z as reusesReset, Zt as RedisDeclaration, _ as ClusterManifest, _n as nodeNames, _t as outcomesOf, a as STAGES, an as Workload, at as Request, b as FORMAT_V1, bt as recordsOf, c as readRecord, cn as KindScenario, ct as backendsAt, d as calibrationOf, dn as NodeImage, dt as deletionOf, en as ResetReuse, et as Endpoint, f as cellsTable, fn as cidrOverlap, ft as dropOf, g as BandV1, gn as kubeProxyPatch, gt as kernelCounts, h as timeSpread, hn as kindConfig, ht as intakeOf, i as quantileOf, in as TriggerKind, it as RecordLine, j as judge, jt as CLIENT, k as RunFactsV1, kt as stoppingOf, l as Judged, ln as KubeProxyMode, lt as byClients, m as predictionText, mn as goDuration, mt as failuresOf, n as medianInterval, nn as Template, nt as PodLine, o as kindCellRecordSchema, on as KUBE_PROXY_MODES, ot as RulesLine, p as medianText, pn as cidrRange, pt as emptyOf, q as observationEnd, qt as MeshFlavor, r as middle, rn as Trigger, rt as PropagationSource, s as kindCellRecordV1Schema, sn as KindConfig, st as SliceLine, t as RELATIVE, tn as Stack, tt as Line, u as TimeSpread, un as NODE_IMAGES, ut as byNode, v as EnvironmentManifest, vn as scenario, vt as podsAt, w as KindCellV1, wt as signalOf, x as KindCellRecord, xt as requestsOf, y as FORMAT, yn as scenarioProblems, yt as podsOf, z as Propagated, zt as secondsOf } from "./judge-BS9pk96o.js";
 import { Quantity } from "@mark1russell7/quantity";
 import { CheckFn, Finding, HealthServer, Poll, Rule, Scenario, ServiceBuilder, ServiceDescription, Stage, Timing, TransportImpl, Verdict } from "@mark1russell7/service";
 import { RedisClient } from "@mark1russell7/service/redis";
@@ -111,8 +111,11 @@ export declare const hostsOf: (text: string, cluster: string) => ClusterHosts;
  * - `server` is the first replica of the service, in the sequence of its name.
  * - `redis` is the Redis pod.
  * - `kube-proxy` is kube-proxy on the first worker.
+ * - `servers` is each replica of the service. Only the injector takes it: a rule in the network
+ *   namespace of each replica, with each client pod as a peer. A REJECT resets only the sender of
+ *   the segment that it matches, thus the rule goes where the segments of the clients arrive.
  */
-type Target = "server" | "redis" | "kube-proxy";
+type Target = "server" | "redis" | "kube-proxy" | "servers";
 /** A step is one act of a fault, in the sequence of the plan. */
 type Step = {
   readonly do: "kubectl";
@@ -200,15 +203,20 @@ export declare const labImage: () => Promise<string>;
 /** This version is the release of Istio of the lab: the tag of istioctl and of each image. */
 export declare const ISTIO_VERSION = "1.31.3";
 /**
- * These are the images of the flavor `sidecar`, pinned by the digest of their index on Docker Hub
- * (read on 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by
- * its digest, tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls
- * from a registry.
+ * These are the images of Istio, pinned by the digest of their index on Docker Hub (read on
+ * 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by its digest,
+ * tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls from a
+ * registry. The flavor `sidecar` needs istiod and the proxy. The flavor `ambient` also needs
+ * istio-cni and ztunnel (`MESH_IMAGES`).
  */
 export declare const ISTIO_IMAGES: {
   readonly pilot: string;
   readonly proxy: string;
+  readonly cni: string;
+  readonly ztunnel: string;
 };
+/** These are the images that each flavor installs, by their names in `ISTIO_IMAGES`. */
+export declare const MESH_IMAGES: Readonly<Record<MeshFlavor, ReadonlyArray<keyof typeof ISTIO_IMAGES>>>;
 /**
  * This format is the JSON access log of each sidecar. Each field is a command of the formatter of
  * Envoy v1.39.4. The fields give the status, the response flags and their details, and the gRPC
@@ -217,10 +225,12 @@ export declare const ISTIO_IMAGES: {
  * (`image/watch.mjs`).
  */
 export declare const ACCESS_LOG_FORMAT: Readonly<Record<string, string>>;
-/** These are the local tags of the images, after the pull by digest. */
+/** These are the local tags of the images, after the pull by digest. The flavor `ambient` needs `cni` and `ztunnel`. */
 interface MeshImages {
   readonly pilot: string;
   readonly proxy: string;
+  readonly cni?: string | undefined;
+  readonly ztunnel?: string | undefined;
 }
 /**
  * This function gives the IstioOperator of a flavor. The values that are not the defaults of Istio:
@@ -232,12 +242,21 @@ interface MeshImages {
  *   reports the whole runner, and no cell scales istiod.
  * - The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
  *
- * The flavor `ambient` comes in a later step, thus it is refused.
+ * The flavor `ambient` has the profile `ambient`: istiod, istio-cni and ztunnel, and no gateway
+ * (manifests/profiles/ambient.yaml of Istio 1.31.3). Its two other images are full references too
+ * (templates/daemonset.yaml of the chart of istio-cni, lines 93–96, and of ztunnel, lines 65–68).
+ * The chart of istio-cni takes the pull policy of `global`. The template of ztunnel reads only its own
+ * `imagePullPolicy`, thus the operator sets it there too.
  */
 export declare const istioOperator: (flavor: MeshFlavor, images: MeshImages) => Record<string, unknown>;
+/** These are the workloads of each flavor in istio-system that the install waits for. */
+export declare const MESH_WORKLOADS: Readonly<Record<MeshFlavor, readonly string[]>>;
 /**
  * This function installs the mesh of a flavor in a cluster with `istioctl install` and the operator
- * of the flavor. Then it waits for istiod. The kubeconfig of the cluster goes to istioctl.
+ * of the flavor. Then it waits for each workload of the flavor. The kubeconfig of the cluster goes to
+ * istioctl. When the install fails, the error has the pods of istio-system and the last lines of the
+ * log of istio-cni. Thus the log of the job shows the cause, for example a module that the kernel of
+ * the runner does not have.
  */
 export declare const installMesh: (cluster: Cluster, flavor: MeshFlavor, images: MeshImages) => Promise<void>;
 /** This function gives the key of the mesh of a cell for its cluster: its flavor, or `none`. */
@@ -248,6 +267,8 @@ export declare const serverCluster: (namespace: string) => string;
 export declare const EDS_EVERY: Quantity;
 /** This time is the interval of the LDS poll of each server sidecar, the same as the poll of EDS. */
 export declare const LDS_EVERY: Quantity;
+/** This function tells if the watcher follows the log of each ztunnel for a cell: a cell in ambient mode. */
+export declare const followsZtunnel: (cell: Pick<KindCell, "mesh">) => boolean;
 /** This function tells if the lab polls the LDS updates of the server sidecars of a cell: a policy in a sidecar mesh. */
 export declare const pollsListeners: (cell: Pick<KindCell, "mesh" | "trigger">) => boolean;
 //#endregion
@@ -292,7 +313,14 @@ interface KindLab {
   take(): Line[];
   /** This method adds a listener of each line, and gives the function that removes it. */
   listen(listener: (line: Line) => void): () => void;
-  watch(namespaces: readonly string[]): Promise<void>;
+  /**
+   * This method starts the watcher of the API on the namespaces. With `ztunnel`, it also follows the
+   * log of each ztunnel in istio-system: lines `ztunnel-pod` and `ztunnel`, which no tracker of the
+   * cell reads.
+   */
+  watch(namespaces: readonly string[], options?: {
+    readonly ztunnel?: boolean | undefined;
+  }): Promise<void>;
   probe(netns: readonly number[]): Promise<void>;
   stopProbe(): Promise<void>;
   /** This method asks each agent to poll the backends of a Service in the rules of its node, `every` apart, or to stop with null. */
@@ -312,6 +340,12 @@ interface KindLab {
   lds(spec: LdsSpec | null): Promise<void>;
   act(node: string, spec: Readonly<Record<string, unknown>>): Promise<Stamp>;
   inject(node: string, pid: number, args: readonly string[]): Promise<Stamp>;
+  /**
+   * This method gives the rules of one table of iptables in the network namespace of a PID, with
+   * their counters (`iptables-save -c`). The injector reads them. The method also adds them to the
+   * lines as a line `tables`: evidence of which rules matched.
+   */
+  tables(node: string, pid: number, table: string): Promise<string>;
   now(): Promise<number>;
   pidOf(node: string, namespace: string, pod: string, container: string): Promise<number>;
   netnsOf(node: string, pid: number): Promise<number>;
@@ -370,6 +404,8 @@ export declare const namespaceOf: (cell: Pick<KindCell, "name">) => string;
 /**
  * This function gives the Namespace object of a cell. In the sidecar mode of a mesh, the label
  * `istio-injection=enabled` makes the injector of Istio put a sidecar in each pod of the namespace.
+ * In the ambient mode, the label `istio.io/dataplane-mode=ambient` makes istio-cni redirect the
+ * traffic of each pod to ztunnel. The listeners of ztunnel are in the network namespace of the pod.
  */
 export declare const namespaceObject: (cell: Pick<KindCell, "mesh">, namespace: string) => Record<string, unknown>;
 /**

package/build/index.js

@@ -295,6 +295,22 @@ const writeWhole = (path, bytes, executable) => {
 	if (executable) chmodSync(partial, 493);
 	renameSync(partial, path);
 };
+/** These are the waits in ms before the second and the third try of a download. A runner can fail to connect for a moment. */
+const DOWNLOAD_WAITS = [2e3, 8e3];
+/**
+* This function gives the bytes of a URL. It tries again after each wait when the connection fails or
+* the answer is a 5xx. It refuses each other answer that is not ok at once.
+*/
+const download = async (url, waits = DOWNLOAD_WAITS) => {
+	for (let attempt = 0;; attempt++) {
+		const response = await fetch(url, { redirect: "follow" }).catch((error) => error instanceof Error ? error : new Error(String(error)));
+		if (response instanceof Response && response.ok) return new Uint8Array(await response.arrayBuffer());
+		const failure = response instanceof Response ? /* @__PURE__ */ new Error(`the download of ${url} answered ${response.status}`) : response;
+		const wait = waits[attempt];
+		if (response instanceof Response && response.status < 500 || wait === void 0) throw failure;
+		await new Promise((resolve) => setTimeout(resolve, wait));
+	}
+};
 /**
 * This function gives the path of a tool, after a download when the cache does not have it. It
 * refuses bytes whose sha256 is not the pinned value, from the cache or from the download. For a
@@ -314,9 +330,7 @@ const ensureTool = async (tool, key = platformKey(), cache = cacheFolder()) => {
 		if (found !== asset.sha256) throw new Error(`${kept} has the sha256 ${found}, not the pinned ${asset.sha256}`);
 		if (tool.entry === void 0) return path;
 	} else {
-		const response = await fetch(asset.url, { redirect: "follow" });
-		if (!response.ok) throw new Error(`the download of ${asset.url} answered ${response.status}`);
-		bytes = new Uint8Array(await response.arrayBuffer());
+		bytes = await download(asset.url);
 		const found = sha256(bytes);
 		if (found !== asset.sha256) throw new Error(`${asset.url} has the sha256 ${found}, not the pinned ${asset.sha256}`);
 		writeWhole(kept, bytes, executable && tool.entry === void 0);
@@ -642,6 +656,12 @@ const policyObject = (account) => ({
 		rules: [{ from: [{ source: { principals: [`cluster.local/ns/{namespace}/sa/${account}`] } }] }]
 	}
 });
+/**
+* This function gives the target of a reset or a black hole of a cell. In T07 and T18 it is Redis,
+* with the replicas as peers. In T15 the fault is on the mesh leg between the client pods and the
+* replicas. It is a rule in each replica, with the client pods as peers.
+*/
+const linkOf = (cell) => cell.template === "T15" ? "servers" : "redis";
 /** This function gives the fault plan of a cell. */
 const planOf = (cell) => {
 	const ns = ["-n", "{namespace}"];
@@ -794,13 +814,13 @@ const planOf = (cell) => {
 		case "rst": return {
 			inject: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "rst"
 			}],
 			hold: needs(trigger.hold, "a hold"),
 			heal: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "clear-rst"
 			}],
 			restore: []
@@ -808,13 +828,13 @@ const planOf = (cell) => {
 		case "blackhole": return {
 			inject: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "blackhole"
 			}],
 			hold: needs(trigger.hold, "a hold"),
 			heal: [{
 				do: "inject",
-				target: "redis",
+				target: linkOf(cell),
 				action: "clear"
 			}],
 			restore: []
@@ -1078,14 +1098,27 @@ const labImage = () => {
 /** This version is the release of Istio of the lab: the tag of istioctl and of each image. */
 const ISTIO_VERSION = "1.31.3";
 /**
-* These are the images of the flavor `sidecar`, pinned by the digest of their index on Docker Hub
-* (read on 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by
-* its digest, tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls
-* from a registry.
+* These are the images of Istio, pinned by the digest of their index on Docker Hub (read on
+* 2026-10-24). `gcr.io/istio-release` has no final tag of 1.31. The lab pulls each one by its digest,
+* tags it with that digest (`localPin`), and loads it into each node. Thus no node pulls from a
+* registry. The flavor `sidecar` needs istiod and the proxy. The flavor `ambient` also needs
+* istio-cni and ztunnel (`MESH_IMAGES`).
 */
 const ISTIO_IMAGES = {
 	pilot: "istio/pilot:1.31.3@sha256:6ad1e816c4d4767ba3f30a6286a96d121851ddb23d33e20736758acb5f3f4ea9",
-	proxy: "istio/proxyv2:1.31.3@sha256:eb74eacea98d3fb1e239ea84016085155478586a554158676b9b67d960151084"
+	proxy: "istio/proxyv2:1.31.3@sha256:eb74eacea98d3fb1e239ea84016085155478586a554158676b9b67d960151084",
+	cni: "istio/install-cni:1.31.3@sha256:e98782038634ef4fadaf78b53dd8fa4134fda3d65838ead5fc1edef245451c0f",
+	ztunnel: "istio/ztunnel:1.31.3@sha256:2c27371b3139ecbf4f5a017354bd540889482441712e88cd8e654ead5a3eb5b2"
+};
+/** These are the images that each flavor installs, by their names in `ISTIO_IMAGES`. */
+const MESH_IMAGES = {
+	sidecar: ["pilot", "proxy"],
+	ambient: [
+		"pilot",
+		"proxy",
+		"cni",
+		"ztunnel"
+	]
 };
 /**
 * This format is the JSON access log of each sidecar. Each field is a command of the formatter of
@@ -1119,10 +1152,15 @@ const ACCESS_LOG_FORMAT = {
 *   reports the whole runner, and no cell scales istiod.
 * - The access log of each sidecar goes to its output as JSON (`ACCESS_LOG_FORMAT`).
 *
-* The flavor `ambient` comes in a later step, thus it is refused.
+* The flavor `ambient` has the profile `ambient`: istiod, istio-cni and ztunnel, and no gateway
+* (manifests/profiles/ambient.yaml of Istio 1.31.3). Its two other images are full references too
+* (templates/daemonset.yaml of the chart of istio-cni, lines 93–96, and of ztunnel, lines 65–68).
+* The chart of istio-cni takes the pull policy of `global`. The template of ztunnel reads only its own
+* `imagePullPolicy`, thus the operator sets it there too.
 */
 const istioOperator = (flavor, images) => {
-	if (flavor !== "sidecar") throw new Error(`the lab installs the mesh flavor sidecar only, not ${flavor}`);
+	const ambient = flavor === "ambient";
+	if (ambient && (images.cni === void 0 || images.ztunnel === void 0)) throw new Error("the flavor ambient needs the images of istio-cni and ztunnel");
 	return {
 		apiVersion: "install.istio.io/v1alpha1",
 		kind: "IstioOperator",
@@ -1131,7 +1169,7 @@ const istioOperator = (flavor, images) => {
 			namespace: "istio-system"
 		},
 		spec: {
-			profile: "minimal",
+			profile: ambient ? "ambient" : "minimal",
 			hub: "docker.io/istio",
 			tag: ISTIO_VERSION,
 			meshConfig: {
@@ -1153,37 +1191,77 @@ const istioOperator = (flavor, images) => {
 						cpu: "500m",
 						memory: "256Mi"
 					} }
-				}
+				},
+				...ambient ? {
+					cni: { image: images.cni },
+					ztunnel: {
+						image: images.ztunnel,
+						imagePullPolicy: "Never"
+					}
+				} : {}
 			}
 		}
 	};
 };
+/** These are the workloads of each flavor in istio-system that the install waits for. */
+const MESH_WORKLOADS = {
+	sidecar: ["deployment/istiod"],
+	ambient: [
+		"deployment/istiod",
+		"daemonset/istio-cni-node",
+		"daemonset/ztunnel"
+	]
+};
 /**
 * This function installs the mesh of a flavor in a cluster with `istioctl install` and the operator
-* of the flavor. Then it waits for istiod. The kubeconfig of the cluster goes to istioctl.
+* of the flavor. Then it waits for each workload of the flavor. The kubeconfig of the cluster goes to
+* istioctl. When the install fails, the error has the pods of istio-system and the last lines of the
+* log of istio-cni. Thus the log of the job shows the cause, for example a module that the kernel of
+* the runner does not have.
 */
 const installMesh = async (cluster, flavor, images) => {
 	const istioctl = await ensureTool(ISTIOCTL);
 	const file = join(cluster.dir, `istio-${flavor}.json`);
 	writeFileSync(file, `${JSON.stringify(istioOperator(flavor, images), null, 2)}\n`);
-	await command(istioctl, [
-		"install",
-		"--kubeconfig",
-		cluster.kubeconfig,
-		"-y",
-		"-f",
-		file,
-		"--readiness-timeout",
-		"10m0s"
-	], { timeout: 9e5 });
-	await cluster.kubectl([
-		"-n",
-		"istio-system",
-		"rollout",
-		"status",
-		"deployment/istiod",
-		"--timeout=300s"
-	]);
+	try {
+		await command(istioctl, [
+			"install",
+			"--kubeconfig",
+			cluster.kubeconfig,
+			"-y",
+			"-f",
+			file,
+			"--readiness-timeout",
+			"10m0s"
+		], { timeout: 9e5 });
+		for (const workload of MESH_WORKLOADS[flavor]) await cluster.kubectl([
+			"-n",
+			"istio-system",
+			"rollout",
+			"status",
+			workload,
+			"--timeout=300s"
+		]);
+	} catch (error) {
+		const state = async (args) => (await cluster.kubectl([
+			"-n",
+			"istio-system",
+			...args
+		]).catch((why) => String(why))).slice(-4e3);
+		const pods = await state([
+			"get",
+			"pods",
+			"-o",
+			"wide"
+		]);
+		const cni = flavor === "ambient" ? `\nthe log of istio-cni:\n${await state([
+			"logs",
+			"daemonset/istio-cni-node",
+			"--tail=60",
+			"--all-containers"
+		])}` : "";
+		throw new Error(`the install of Istio ${flavor} failed: ${String(error)}\nthe pods of istio-system:\n${pods}${cni}`);
+	}
 };
 /** This function gives the key of the mesh of a cell for its cluster: its flavor, or `none`. */
 const meshKey = (cell) => cell.mesh?.flavor ?? "none";
@@ -1199,6 +1277,8 @@ const LDS_EVERY = {
 	value: 50,
 	unit: "ms"
 };
+/** This function tells if the watcher follows the log of each ztunnel for a cell: a cell in ambient mode. */
+const followsZtunnel = (cell) => cell.mesh?.mode === "ambient";
 /** This function tells if the lab polls the LDS updates of the server sidecars of a cell: a policy in a sidecar mesh. */
 const pollsListeners = (cell) => cell.mesh?.mode === "sidecar" && cell.trigger.kind === "authorization-policy";
 //#endregion
@@ -1386,12 +1466,13 @@ const openKindLab = async (cluster, image) => {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
 		},
-		async watch(namespaces) {
+		async watch(namespaces, options) {
 			if (watcher !== null) await watcher.stop({ timeout: 0 }).catch(() => void 0);
 			const kube = await cluster.credentials();
 			watcher = await new GenericContainer(image).withNetworkMode(cluster.network).withEnvironment({
 				KUBE: JSON.stringify(kube),
-				NAMESPACES: namespaces.join(",")
+				NAMESPACES: namespaces.join(","),
+				ZTUNNEL: options?.ztunnel === true ? "1" : "0"
 			}).withCommand(["node", "watch.mjs"]).withLogConsumer(consume((line) => push(line))).start();
 		},
 		async probe(netns) {
@@ -1514,6 +1595,28 @@ const openKindLab = async (cluster, image) => {
 			});
 			return stamp;
 		},
+		async tables(node, pid, table) {
+			const t = await lab.now();
+			const text = await output(sidecarOf(node).injector, [
+				"nsenter",
+				"-t",
+				String(pid),
+				"-n",
+				"iptables-save",
+				"-c",
+				"-t",
+				table
+			]);
+			push({
+				ev: "tables",
+				t,
+				node,
+				pid,
+				table,
+				text: text.slice(0, 8e3)
+			});
+			return text;
+		},
 		async now() {
 			return (await lab.act(firstNode, { op: "now" })).t0;
 		},
@@ -1600,16 +1703,23 @@ const whole = (amount, what) => {
 };
 /** This function gives the namespace of a cell: `lab-` and 10 digits of the sha256 of its name. */
 const namespaceOf = (cell) => `lab-${createHash("sha256").update(cell.name).digest("hex").slice(0, 10)}`;
+/** These are the labels of the namespace of each mode of a mesh. */
+const MESH_LABELS = {
+	sidecar: { "istio-injection": "enabled" },
+	ambient: { "istio.io/dataplane-mode": "ambient" }
+};
 /**
 * This function gives the Namespace object of a cell. In the sidecar mode of a mesh, the label
 * `istio-injection=enabled` makes the injector of Istio put a sidecar in each pod of the namespace.
+* In the ambient mode, the label `istio.io/dataplane-mode=ambient` makes istio-cni redirect the
+* traffic of each pod to ztunnel. The listeners of ztunnel are in the network namespace of the pod.
 */
 const namespaceObject = (cell, namespace) => ({
 	apiVersion: "v1",
 	kind: "Namespace",
 	metadata: {
 		name: namespace,
-		...cell.mesh?.mode === "sidecar" ? { labels: { "istio-injection": "enabled" } } : {}
+		...cell.mesh === void 0 ? {} : { labels: { ...MESH_LABELS[cell.mesh.mode] } }
 	}
 });
 /**
@@ -2296,7 +2406,7 @@ const quiet = async (ctx, ours) => {
 */
 const deploy = async (lab, cluster, cell, namespace, images) => {
 	await cluster.apply([namespaceObject(cell, namespace)]);
-	await lab.watch([namespace]);
+	await lab.watch([namespace], { ztunnel: followsZtunnel(cell) });
 	if (hasRedis(cell)) {
 		await cluster.apply(redisObjects(namespace, images.redis));
 		await cluster.kubectl([
@@ -2432,12 +2542,62 @@ const replicasOf = (ctx) => {
 	}));
 	return stackOf(ctx.cell) === "grpc" ? byClients(replicas, ctx.tracker.answers) : replicas;
 };
+/**
+* This time is how long before the commit of its rules the lab starts the injector in each replica.
+* It is more than the execs of one node before its commit: a read of its tables and the injector.
+*/
+const INJECT_LEAD_MS = 700;
+/**
+* This function puts the rules of an action in the network namespace of each replica, with each
+* client pod as a peer: the target `servers`. The rules of all replicas commit at one instant on
+* CLOCK_MONOTONIC (`--at`). Thus no client meets one replica with the rule and one without it. The
+* replicas of one node go one after the other, and the nodes at the same time.
+*
+* The fault finds the PID of each replica, and the clear uses it again: thus the heal comes soon
+* after its hold. Before the commit of a clear, the lab reads the filter table of each replica. Its
+* counters show if the rule matched the clients beside the rules of istio-cni. After the commit of a
+* fault, the lab reads the nat table, with the redirect of istio-cni. The stamp is the first commit
+* and the last end.
+*/
+const injectServers = async (ctx, action, replicas) => {
+	const clients = [...ctx.tracker.pods.values()].filter((pod) => pod.labels["app"] === "client" && !pod.del && pod.ip !== null).map((pod) => pod.ip).sort();
+	if (clients.length === 0 || replicas.length === 0) throw new Error(`the injector needs clients and replicas: ${clients.length} clients, ${replicas.length} replicas`);
+	const clear = action.startsWith("clear");
+	const byNode = /* @__PURE__ */ new Map();
+	for (const replica of replicas) {
+		const pid = (clear ? ctx.pids.get(replica.pod) : void 0) ?? await ctx.lab.pidOf(replica.node, ctx.namespace, replica.pod, "app");
+		ctx.pids.set(replica.pod, pid);
+		byNode.set(replica.node, [...byNode.get(replica.node) ?? [], pid]);
+	}
+	const at = await ctx.lab.now() + INJECT_LEAD_MS;
+	const args = [
+		action,
+		clients.join(","),
+		"--at",
+		String(Math.round(at * 1e6))
+	];
+	const stamps = await Promise.all([...byNode].map(async ([node, pids]) => {
+		const out = [];
+		for (const pid of pids) {
+			if (clear) await ctx.lab.tables(node, pid, "filter");
+			out.push(await ctx.lab.inject(node, pid, args));
+		}
+		return out;
+	}));
+	if (!clear) for (const [node, pids] of byNode) for (const pid of pids) await ctx.lab.tables(node, pid, "nat");
+	const all = stamps.flat();
+	return {
+		t0: Math.min(...all.map((stamp) => stamp.t0)),
+		t1: Math.max(...all.map((stamp) => stamp.t1))
+	};
+};
 /** This function does one step of a fault plan. It gives the stamp of its act, or null for an act without a stamp. */
 const doStep = async (ctx, step, replicas, background) => {
 	const { lab, cluster, namespace } = ctx;
 	const target = replicas[0];
 	const fill = (args) => args.map((arg) => arg.replaceAll("{namespace}", namespace).replaceAll(POD, target.pod).replaceAll(NODE, target.node).replaceAll(VERSION, String(ctx.version)));
 	const where = async (which) => {
+		if (which === "servers") throw new Error("the target servers is a target of the injector only");
 		if (which === "server") return {
 			node: target.node,
 			pid: await lab.pidOf(target.node, namespace, target.pod, "app"),
@@ -2511,6 +2671,7 @@ const doStep = async (ctx, step, replicas, background) => {
 			};
 		}
 		case "inject": {
+			if (step.target === "servers") return injectServers(ctx, step.action, replicas);
 			const at = await where(step.target);
 			let first = null;
 			for (const replica of replicas) {
@@ -2777,14 +2938,19 @@ const runKindCells = async (cells, options) => {
 		kind: "shipped",
 		name: "grpc-go"
 	}) : void 0;
+	const flavors = new Set(cells.flatMap((cell) => cell.mesh === void 0 ? [] : [cell.mesh.flavor]));
+	const pinned = /* @__PURE__ */ new Map();
+	for (const name of new Set([...flavors].flatMap((flavor) => MESH_IMAGES[flavor]))) pinned.set(name, await localPin(ISTIO_IMAGES[name]));
 	const images = {
 		lab: image,
 		redis: redisImage,
 		grpc: grpcImage,
-		mesh: cells.some((cell) => cell.mesh !== void 0) ? {
-			pilot: await localPin(ISTIO_IMAGES.pilot),
-			proxy: await localPin(ISTIO_IMAGES.proxy)
-		} : void 0
+		mesh: flavors.size === 0 ? void 0 : {
+			pilot: pinned.get("pilot"),
+			proxy: pinned.get("proxy"),
+			cni: pinned.get("cni"),
+			ztunnel: pinned.get("ztunnel")
+		}
 	};
 	const groups = /* @__PURE__ */ new Map();
 	for (const cell of cells) groups.set(clusterKey(cell), [...groups.get(clusterKey(cell)) ?? [], cell]);
@@ -2805,7 +2971,11 @@ const runKindCells = async (cells, options) => {
 				if (grpcImage !== void 0 && group.some((cell) => stackOf(cell) === "grpc")) await cluster.load(grpcImage);
 				if (mesh !== void 0) {
 					if (images.mesh === void 0) throw new Error(`${group[0].name}: the run has no images of Istio`);
-					for (const each of [images.mesh.pilot, images.mesh.proxy]) await cluster.load(each);
+					for (const name of MESH_IMAGES[mesh.flavor]) {
+						const each = images.mesh[name];
+						if (each === void 0) throw new Error(`${group[0].name}: the run has no image ${name} of Istio`);
+						await cluster.load(each);
+					}
 					const began = Date.now();
 					await installMesh(cluster, mesh.flavor, images.mesh);
 					options.log(`  Istio ${mesh.flavor} installed in ${Math.round((Date.now() - began) / 100) / 10} s`);
@@ -2844,7 +3014,8 @@ const runKindCells = async (cells, options) => {
 							version: 1,
 							probed: "",
 							listened: "",
-							expected: cell.pod.replicas
+							expected: cell.pod.replicas,
+							pids: /* @__PURE__ */ new Map()
 						};
 						const share = Math.ceil(cell.runs / environments) - (env < cell.runs % environments || cell.runs % environments === 0 ? 0 : 1);
 						const runs = [await runOnce(ctx, env, -1, true, ours)];
@@ -2863,10 +3034,7 @@ const runKindCells = async (cells, options) => {
 								lab: image,
 								redis: redisImage,
 								...stackOf(cell) === "grpc" ? { grpc: grpcImage } : {},
-								...cell.mesh === void 0 ? {} : {
-									"istio-pilot": ISTIO_IMAGES.pilot,
-									"istio-proxy": ISTIO_IMAGES.proxy
-								}
+								...cell.mesh === void 0 ? {} : Object.fromEntries(MESH_IMAGES[cell.mesh.flavor].map((name) => [`istio-${name}`, ISTIO_IMAGES[name]]))
 							}
 						});
 						entry.loads.push(...loads);
@@ -2963,6 +3131,6 @@ const shardOf = (cells, index, count) => {
 	return out;
 };
 //#endregion
-export { ACCESS_LOG_FORMAT, CLIENT, CLIENT_ACCOUNT, CONTROLLER, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HEALTH_PORT, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, LAST_SLACK, LDS_EVERY, LDS_FILTER, LOG_LABEL, NODE_IMAGES, O04, O09, O10, O16, POLICY, PORT, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, STAGES, WATCHDOG, backendsAt, backendsOf, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, checkRun, cidrOverlap, cidrRange, clientObjects, clusterFilter, compose, createCluster, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dropOf, emptyOf, ensureTool, estimatedTime, factsOf, failuresOf, goDuration, hostsOf, installMesh, intakeAfter, intakeOf, istioOperator, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeletBand, labImage, latchBand, lintCell, listenerCountsOf, localPin, medianInterval, medianText, meshKey, middle, namespaceObject, namespaceOf, nodeNames, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, pausedWindow, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestsOf, restartBand, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sha256, shardOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stackOf, stageLabImage, stallRemovalBand, stoppingOf, tarEntry, timeSpread, toolPath, transitionOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, writeResult };
+export { ACCESS_LOG_FORMAT, CLIENT, CLIENT_ACCOUNT, CONTROLLER, DOCUMENTED, DRAIN_RULES, EDS_EVERY, FLAG_CHECK, FORMAT, FORMAT_V1, HEALTH_PORT, ISTIOCTL, ISTIO_IMAGES, ISTIO_VERSION, KEPT_KERNEL, KIND, KIND_NOISE, KUBECTL, KUBE_PROXY_MODES, LAST_SLACK, LDS_EVERY, LDS_FILTER, LOG_LABEL, MESH_IMAGES, MESH_WORKLOADS, NODE_IMAGES, O04, O09, O10, O16, POLICY, PORT, REDIS, REDIS_IMAGE, RELATIVE, ROUTE, RULES_EVERY, SERVER, STAGES, WATCHDOG, backendsAt, backendsOf, bandOf, byClients, byNode, cacheFolder, calibrationOf, capOf, cellsTable, checkRun, cidrOverlap, cidrRange, clientObjects, clusterFilter, compose, createCluster, deletes, deletionOf, deletionWindow, deletionsOf, describeCell, dropOf, emptyOf, ensureTool, estimatedTime, factsOf, failuresOf, followsZtunnel, goDuration, hostsOf, installMesh, intakeAfter, intakeOf, istioOperator, judge, judgeKind, kernelCounts, kindCellRecordSchema, kindCellRecordV1Schema, kindConfig, kubeProxyPatch, kubeletBand, labImage, latchBand, lintCell, listenerCountsOf, localPin, medianInterval, medianText, meshKey, middle, namespaceObject, namespaceOf, nodeNames, observationAfter, observationEnd, openKindLab, outboundCluster, outcomesOf, pausedWindow, planOf, platformKey, podsAt, podsOf, policyObject, pollsListeners, predictionText, probeOf, propagationOf, propagationSource, quantileOf, readRecord, recordsOf, redisObjects, referenceOf, removalBand, requestsOf, restartBand, restartsAt, reusesReset, rulesOf, runKindCells, scenario, scenarioOf, scenarioProblems, seconds, secondsOf, serverCluster, serverObjects, sha256, shardOf, showBand, signalOf, signalsOf, sliceDropOf, sliceEmptyOf, slicesOf, stackOf, stageLabImage, stallRemovalBand, stoppingOf, tarEntry, timeSpread, toolPath, transitionOf, unitOf, updatesOf, upgrade, upgradeCell, verdictsOf, writeResult };
 
 //# sourceMappingURL=index.js.map