=== T84 execution log === Sun Jul 5 09:38:23 AM KST 2026 $ kubectl apply -f manifest.yaml (already applied above, workloads Ready 2/2) NAME READY STATUS RESTARTS AGE client 2/2 Running 0 18s echo-5767bbcc56-nx8rc 2/2 Running 0 18s $ kubectl -n istio-system port-forward deploy/istiod 15014:15014 & PF pid=1307340 Forwarding from 127.0.0.1:15014 -> 15014 Forwarding from [::1]:15014 -> 15014 $ BEFORE=$(curl -s localhost:15014/metrics | awk '/^pilot_xds_pushes\{/{s+=$NF} END{print s+0}') BEFORE=44829 --- raw pilot_xds_pushes lines (before) --- pilot_xds_pushes{type="cds"} 9722 pilot_xds_pushes{type="eds"} 17188 pilot_xds_pushes{type="istio.io/debug/config_dump"} 11 pilot_xds_pushes{type="istio.io/debug/syncz"} 27 pilot_xds_pushes{type="lds"} 9656 pilot_xds_pushes{type="rds"} 7963 pilot_xds_pushes{type="sds"} 262 $ for i in $(seq 1 10); do kubectl annotate virtualservice echo-debounce-test -n istio-vt-t84 test-burst="$i" --overwrite; done virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated $ sleep 3 (slept 3s) $ AFTER=$(curl -s localhost:15014/metrics | awk '/^pilot_xds_pushes\{/{s+=$NF} END{print s+0}') AFTER=44862 --- raw pilot_xds_pushes lines (after) --- pilot_xds_pushes{type="cds"} 9734 pilot_xds_pushes{type="eds"} 17188 pilot_xds_pushes{type="istio.io/debug/config_dump"} 11 pilot_xds_pushes{type="istio.io/debug/syncz"} 27 pilot_xds_pushes{type="lds"} 9668 pilot_xds_pushes{type="rds"} 7972 pilot_xds_pushes{type="sds"} 262 $ echo before=$BEFORE after=$AFTER delta=$((AFTER-BEFORE)) before=44829 after=44862 delta=33 === supplemental diagnostics (not in spec, for judging ambiguous delta) === $ pilot_xds (connected proxies gauge) $ pilot_push_triggers (per-event trigger counter, if present) pilot_push_triggers{type="config"} 5854 pilot_push_triggers{type="endpoint"} 17086 pilot_push_triggers{type="headlessendpoint"} 77 pilot_push_triggers{type="networks"} 104 pilot_push_triggers{type="proxy"} 242 pilot_push_triggers{type="secret"} 4124 pilot_push_triggers{type="service"} 6524 $ pilot_debounce related metrics # HELP pilot_debounce_time Delay in seconds between the first config enters debouncing and the merged push request is pushed into the push queue (includes pushcontext_init_seconds). # TYPE pilot_debounce_time histogram pilot_debounce_time_bucket{le="0.01"} 0 pilot_debounce_time_bucket{le="0.1"} 0 pilot_debounce_time_bucket{le="1"} 696 pilot_debounce_time_bucket{le="3"} 696 pilot_debounce_time_bucket{le="5"} 696 pilot_debounce_time_bucket{le="10"} 696 pilot_debounce_time_bucket{le="20"} 696 pilot_debounce_time_bucket{le="30"} 696 pilot_debounce_time_bucket{le="+Inf"} 696 pilot_debounce_time_sum 86.45786586999998 pilot_debounce_time_count 696 $ pilot_proxy_convergence_time_count (push cycle completions) pilot_proxy_convergence_time_bucket{le="0.1"} 15400 pilot_proxy_convergence_time_bucket{le="0.5"} 15790 pilot_proxy_convergence_time_bucket{le="1"} 15790 pilot_proxy_convergence_time_bucket{le="3"} 15790 pilot_proxy_convergence_time_bucket{le="5"} 15790 pilot_proxy_convergence_time_bucket{le="10"} 15790 pilot_proxy_convergence_time_bucket{le="20"} 15790 pilot_proxy_convergence_time_bucket{le="30"} 15790 pilot_proxy_convergence_time_bucket{le="+Inf"} 15790 pilot_proxy_convergence_time_sum 303.19545117800055 pilot_proxy_convergence_time_count 15790 === supplemental burst #2: measure pilot_debounce_time_count delta directly (more precise signal than pilot_xds_pushes, which fans out by connected-proxy x xds-type) === BEFORE2 pilot_debounce_time_count=696 virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated virtualservice.networking.istio.io/echo-debounce-test annotated burst wall time: .485212357 seconds for 10 annotate calls AFTER2 pilot_debounce_time_count=697 delta_debounce_events=1 === supplemental: mesh-wide connected proxy count (explains pilot_xds_pushes fanout multiplier) === NAME CLUSTER ISTIOD VERSION SUBSCRIBED TYPES client.istio-verify Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) client.istio-vt-t84 Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) echo-5767bbcc56-nx8rc.istio-vt-t84 Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) echo-5c967b5ff-ksk8c.istio-verify Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) egw-mtls-5c55556b78-mrfgw.egress-mtls Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) egw-pt-858c44c57d-wwh2l.egress-pt Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) fortio-7b8b646bf9-7phzf.dns-lab Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) httpbin-5bc4578794-7kkfb.mesh-test Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) istio-egressgateway-84d48f5f74-dnjf6.istio-system Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) istio-ingressgateway-778767f96d-wmjm5.istio-system Kubernetes istiod-797b447c94-cv7ns 1.30.0 5 (CDS,LDS,EDS,RDS,SDS) netshoot-7fbd9f9bf4-2c7cc.dns-lab Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) sleep-74bf579c94-tjfrt.mesh-test Kubernetes istiod-797b447c94-cv7ns 1.30.0 4 (CDS,LDS,EDS,RDS) connected proxy count: 12 === analysis note === pilot_xds_pushes delta(33) for burst1 decomposes as cds+12, lds+12, rds+9. istioctl proxy-status shows 12 mesh-wide connected proxies, of which 9 subscribe to RDS (3 gateways subscribe to only CDS/LDS/EDS, no RDS). This exactly matches the fan-out of a SINGLE merged push cycle to all subscribed proxies -- NOT 10 separate push cycles (which would be a much larger/different number). burst2 directly confirms via pilot_debounce_time_count: 10 near-simultaneous annotates (0.485s wall time for the whole loop, i.e. ~48ms apart, well under the 100ms default debounce quiet window) yielded a debounce-cycle counter delta of exactly 1 -- i.e. all 10 config-change events were coalesced into a single push.