Skip to content
LaceLace

Global state

Global state answers reachability questions from the cluster’s networking resources: which Networks and Services a Network can reach, which can reach it, and what is bound to it. lace describe computes this against the API server, so run it from anywhere with a kubeconfig — no pod exec needed.

Describe a Network

Section titled “Describe a Network”

lace describe network <name|id> resolves a Network by name, or by its numeric ID, and prints its full reachability topology:

Terminal window
lace describe network default

The output covers:

  • Spec — ID, type, IPv4/IPv6 subnets, external prefixes, and whether the Network is anonymous.
  • Reachable networks (outbound) — the Networks pods here can reach, including the Network itself when it routes to its own pods.
  • Networks that can reach it (inbound) — the reverse direction.
  • Bound services — Services bound to this Network, with their ClusterIPs.
  • Reachable services — Services reachable from here, whether by an explicit ServiceRoutingPolicy or by living on a reachable Network.
  • Bound pods — the NetworkEndpoints on this Network, with their addresses and resolved segment.

Use --apiserver-address <addr> to point at a specific API server; it defaults to $APISERVER_ADDRESS.

This is the place to confirm intent: that a Network peers with the ones you expect and no others, and that the Services and pods you expect to be reachable actually are. To then confirm a node programmed that intent, cross-check the routing, delivery, and policy maps in Node state.