apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: istio-vt-t51
  labels:
    app: client
  annotations:
    sidecar.istio.io/inject: "true"
spec:
  containers:
  - name: curl
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: good-mixed
  namespace: istio-vt-t51
  labels:
    app: mixed-echo
    health: good
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mixed-echo
      health: good
  template:
    metadata:
      labels:
        app: mixed-echo
        health: good
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - name: echo
        image: hashicorp/http-echo:0.2.3
        args: ["-text=good-ok", "-listen=:5678"]
        ports:
        - containerPort: 5678
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bad-mixed
  namespace: istio-vt-t51
  labels:
    app: mixed-echo
    health: bad
spec:
  replicas: 1
  selector:
    matchLabels:
      app: mixed-echo
      health: bad
  template:
    metadata:
      labels:
        app: mixed-echo
        health: bad
      annotations:
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - name: nginx
        image: nginx:1.27-alpine
        ports:
        - containerPort: 5678
        command: ["sh", "-c", "echo 'server { listen 5678; location / { return 503; } }' > /etc/nginx/conf.d/default.conf && nginx -g 'daemon off;'"]
---
apiVersion: v1
kind: Service
metadata:
  name: mixed-echo
  namespace: istio-vt-t51
spec:
  selector:
    app: mixed-echo
  ports:
  - name: http
    port: 80
    targetPort: 5678
---
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: mixed-echo-outlier
  namespace: istio-vt-t51
spec:
  # NOTE: spec-mandated svc.homelab.local does NOT match Istio's internally
  # generated Service hostname (which uses svc.cluster.local regardless of
  # kubeadm clusterDomain=homelab.local in this cluster). Using homelab.local
  # here left outlier_detection completely unattached to the outbound cluster
  # (verified via /config_dump) and caused all traffic to that Host header to
  # fall through the ALLOW_ANY wildcard vhost to PassthroughCluster instead of
  # the named "mixed-echo" cluster. Corrected to the Istio-internal hostname
  # so the DestinationRule actually binds to the traffic being tested.
  host: mixed-echo.istio-vt-t51.svc.cluster.local
  trafficPolicy:
    outlierDetection:
      consecutive5xxErrors: 1
      interval: 2s
      baseEjectionTime: 10s
      maxEjectionPercent: 50