gw-09 — Verification
One command
cd gw-09-kubernetes-networking && bash scripts/verify.sh
What the tests prove
| Test | Invariant |
|---|---|
TestDrainRaceDropsWithoutReadiness | exiting before readiness fails drops Σ(delay)×rps requests during EndpointSlice propagation |
TestDrainNoDropWithReadinessFirst | fail-readiness-first + adequate grace → zero drops |
TestDrainGraceTooShort | a too-short grace SIGKILLs mid-propagation and drops (the gw-05 high-density-node hazard) |
TestConntrackExhaustionUnderChurn | 1000 new flows into a 100-slot table → 900 drops |
TestConntrackOkWithKeepAlive | reusing one flow → zero conntrack drops |
TestConntrackReuseSlot | a reused flow takes one slot; a third distinct flow at Max=2 is dropped |
TestEndpointSliceSharding | endpoints shard into ≤N-per-slice (scalability over monolithic Endpoints) |
All under -race.
What "green" does NOT guarantee
- Simulations, not a real cluster. They model the mechanics
deterministically; the real-cluster exercises (GUIDE §4, analysis.md)
validate against an actual
kind/k3dsetup. - No live packet path. Tracing veth/iptables/IPVS/eBPF and the CNI wiring is hands-on cluster work (CONCEPTS §3, analysis.md).
- No NRI/OCI runtime customization here — that's the gw-12 migration enabler.