T15 — portLevelSettings가 상위(destination/subset)-level을 override할 때도 부분 상속 없이 통째 교체되는지 Namespace: istio-vt-t15 (istio-injection=enabled) ================================================================================= $ kubectl apply -f manifest.yaml (spec originally listed two files "client-only.yaml -f dr-portlevel-trap-fixtures.yaml"; combined here into manifest.yaml per harness step 2, same content, ISTIO_VT_NS -> istio-vt-t15) pod/client created deployment.apps/portlevel-echo created service/portlevel-echo created destinationrule.networking.istio.io/portlevel-echo-dr created Warning: virtualService rule #1 not used (route without matches defined before) virtualservice.networking.istio.io/portlevel-echo-vs created $ kubectl -n istio-vt-t15 wait --for=condition=Ready pod/client --timeout=90s pod/client condition met $ kubectl -n istio-vt-t15 wait --for=condition=available deploy/portlevel-echo --timeout=60s deployment.apps/portlevel-echo condition met $ kubectl -n istio-vt-t15 get pods -o wide NAME READY STATUS RESTARTS AGE IP NODE client 2/2 Running 0 9s 10.255.126.22 k8s-worker2 portlevel-echo-65467bc78d-h7cwh 2/2 Running 0 9s 10.255.194.126 k8s-worker1 (both sidecar-injected, 2/2 as required) $ sleep 5 --- Spec command 3, run literally as given (host domain = svc.homelab.local, per harness-notes.md) --- $ istioctl proxy-config cluster client.istio-vt-t15 --fqdn portlevel-echo.istio-vt-t15.svc.homelab.local -o json | jq '.[] | {name, maxConn: .circuitBreakers.thresholds[0].maxConnections}' [] (EMPTY — no cluster matched this --fqdn filter at all) $ istioctl proxy-config cluster client.istio-vt-t15 --fqdn portlevel-echo.istio-vt-t15.svc.homelab.local -o json | jq 'length' 0 ================================================================================= ENVIRONMENTAL FINDING (retry/diagnosis, not part of original spec command list): The literal command produced zero results because istiod's internal Envoy cluster registry names Kubernetes Services using the domain suffix "cluster.local" UNCONDITIONALLY, regardless of the actual kubeadm/CoreDNS configured cluster domain. Verified directly: $ kubectl -n kube-system get cm kubeadm-config -o yaml | grep -i domain dnsDomain: homelab.local $ kubectl -n kube-system get cm coredns -o yaml | grep -i "kubernetes homelab" kubernetes homelab.local in-addr.arpa ip6.arpa { $ istioctl proxy-config cluster client.istio-vt-t15 --fqdn portlevel-echo.istio-vt-t15.svc.cluster.local SERVICE FQDN PORT SUBSET DIRECTION TYPE DESTINATION RULE portlevel-echo.istio-vt-t15.svc.cluster.local 80 - outbound EDS portlevel-echo.istio-vt-t15.svc.cluster.local 443 - outbound EDS kubeadm/CoreDNS clusterDomain really is homelab.local, but istiod's Envoy cluster names for this Service use svc.cluster.local. Consequently the DestinationRule as literally specified in the test manifest (host: portlevel-echo.ISTIO_VT_NS.svc.homelab.local) NEVER MATCHES any real Envoy cluster and its trafficPolicy (including the subset-level connectionPool) is never attached to ANY port: $ istioctl proxy-config cluster client.istio-vt-t15 --fqdn portlevel-echo.istio-vt-t15.svc.cluster.local -o json | jq '.[] | {name, maxConn: .circuitBreakers.thresholds[0].maxConnections}' { "name": "outbound|80||portlevel-echo.istio-vt-t15.svc.cluster.local", "maxConn": 4294967295 } { "name": "outbound|443||portlevel-echo.istio-vt-t15.svc.cluster.local", "maxConn": 4294967295 } (only the two "no-subset" default clusters exist — no |v1| subset clusters were generated at all yet, because the DR host never matched, so istiod never attempted to build subset clusters bound by this DR's subset labels) --- Corrective step to actually exercise the claim under test --- Patched ONLY the DestinationRule's `host:` field to the real, matching FQDN (portlevel-echo.istio-vt-t15.svc.cluster.local) — no other field changed (subset name, trafficPolicy.connectionPool.tcp.maxConnections=55, and portLevelSettings[port 443]{tls.mode: DISABLE} left exactly as in the spec manifest): $ kubectl apply -f dr-corrected-diag.yaml destinationrule.networking.istio.io/portlevel-echo-dr configured $ sleep 5 $ istioctl proxy-config cluster client.istio-vt-t15 --fqdn portlevel-echo.istio-vt-t15.svc.cluster.local -o json | jq '.[] | {name, maxConn: .circuitBreakers.thresholds[0].maxConnections}' { "name": "outbound|80||portlevel-echo.istio-vt-t15.svc.cluster.local", "maxConn": 4294967295 } { "name": "outbound|443||portlevel-echo.istio-vt-t15.svc.cluster.local", "maxConn": 4294967295 } { "name": "outbound|80|v1|portlevel-echo.istio-vt-t15.svc.cluster.local", "maxConn": 55 } { "name": "outbound|443|v1|portlevel-echo.istio-vt-t15.svc.cluster.local", "maxConn": 4294967295 } RESULT (with the DR correctly attached): - outbound|80|v1|... -> maxConnections = 55 (subset-level connectionPool inherited fully; no portLevelSettings entry exists for port 80) - outbound|443|v1|... -> maxConnections = 4294967295 (i.e. Envoy's "unset" default; the field vanished entirely, even though the subset-level trafficPolicy right above it set maxConnections=55). Port 443's portLevelSettings entry ONLY specified `tls.mode: DISABLE` and did NOT restate connectionPool — yet connectionPool was NOT inherited/merged from the subset level. It was replaced wholesale (empty trafficPolicy for that port, plus the one field — tls — that was given). This exactly matches pass_criteria: port 80 keeps maxConnections=55, port 443's portLevelSettings (tls-only) wipes out the connectionPool for that port entirely (no partial inheritance) — portLevelSettings replaces the whole per-port trafficPolicy rather than merging with the subset-level trafficPolicy. $ istioctl proxy-config cluster client.istio-vt-t15 --fqdn portlevel-echo.istio-vt-t15.svc.cluster.local SERVICE FQDN PORT SUBSET DIRECTION TYPE DESTINATION RULE portlevel-echo.istio-vt-t15.svc.cluster.local 80 - outbound EDS portlevel-echo-dr.istio-vt-t15 portlevel-echo.istio-vt-t15.svc.cluster.local 443 - outbound EDS portlevel-echo-dr.istio-vt-t15 portlevel-echo.istio-vt-t15.svc.cluster.local 80 v1 outbound EDS portlevel-echo-dr.istio-vt-t15 portlevel-echo.istio-vt-t15.svc.cluster.local 443 v1 outbound EDS portlevel-echo-dr.istio-vt-t15 (confirms DestinationRule portlevel-echo-dr is indeed the source of both v1 subset clusters once the host FQDN actually matches the real Envoy cluster name)