=== $ kubectl create namespace istio-vt-t53 ===
namespace/istio-vt-t53 created

=== $ kubectl label namespace istio-vt-t53 istio-injection=enabled ===
namespace/istio-vt-t53 labeled
=== $ kubectl apply -f manifest.yaml ===
pod/client created
deployment.apps/subset-echo-v1 created
service/subset-echo created
destinationrule.networking.istio.io/subset-echo-dr created
virtualservice.networking.istio.io/subset-echo-vs created

=== $ kubectl -n istio-vt-t53 wait --for=condition=Ready pod/client --timeout=90s ===
pod/client condition met

=== $ kubectl -n istio-vt-t53 wait --for=condition=available deploy/subset-echo-v1 --timeout=60s ===
deployment.apps/subset-echo-v1 condition met
=== $ kubectl -n istio-vt-t53 get pods -o wide ===
NAME                              READY   STATUS    RESTARTS   AGE   IP              NODE          NOMINATED NODE   READINESS GATES
client                            2/2     Running   0          11s   10.255.194.84   k8s-worker1   <none>           <none>
subset-echo-v1-6df5786f87-2wwkh   2/2     Running   0          10s   10.255.126.32   k8s-worker2   <none>           <none>
=== $ sleep 5 ===
(slept 5s for config propagation)
=== $ istioctl proxy-config cluster client.istio-vt-t53 --fqdn subset-echo.istio-vt-t53.svc.homelab.local -o json | jq '.[] | {name, tcpKeepalive: .upstreamConnectionOptions.tcpKeepalive, maxConn: .circuitBreakers.thresholds[0].maxConnections}' ===
--- stderr ---

=== ENVIRONMENTAL CORRECTION NOTE ===
harness-notes.md says cluster DNS domain = homelab.local and instructs all manifests to use *.svc.homelab.local.
Empirically this is WRONG for DestinationRule/VirtualService host matching in THIS cluster:
istiod runs with explicit --domain cluster.local (see istiod deploy args below), independent of kubeadm clusterDomain/CoreDNS.
istioctl analyze confirmed 'Referenced host not found' / DR host 'does not match any services in the mesh' when using svc.homelab.local.
All pre-existing DestinationRules in the cluster (mesh-test, istio-vt-t55) already use svc.cluster.local.
=> Corrected manifest.yaml DestinationRule/VirtualService host to subset-echo.istio-vt-t53.svc.cluster.local so the test can actually execute.

=== $ kubectl -n istio-system get deploy istiod -o jsonpath={.spec.template.spec.containers[0].args} ===
["discovery","--monitoringAddr=:15014","--log_output_level=default:info","--domain","cluster.local","--keepaliveMaxServerConnectionAge","30m"]

=== $ istioctl analyze -n istio-vt-t53 (BEFORE fix, host=svc.homelab.local) ===
Error [IST0101] (VirtualService istio-vt-t53/subset-echo-vs) Referenced host not found: "subset-echo.istio-vt-t53.svc.homelab.local"
Warning [IST0174] (DestinationRule istio-vt-t53/subset-echo-dr) The host subset-echo.istio-vt-t53.svc.homelab.local defined in the DestinationRule does not match any services in the mesh.

=== $ kubectl apply -f manifest.yaml (re-apply after host correction to svc.cluster.local) ===
pod/client configured
deployment.apps/subset-echo-v1 unchanged
service/subset-echo unchanged
destinationrule.networking.istio.io/subset-echo-dr configured
virtualservice.networking.istio.io/subset-echo-vs configured

=== $ istioctl analyze -n istio-vt-t53 (AFTER fix) ===
Info [IST0135] (Pod istio-vt-t53/client) Annotation "sidecar.istio.io/inject" has been deprecated in favor of the "sidecar.istio.io/inject" label and may not work in future Istio versions.
Info [IST0135] (Pod istio-vt-t53/subset-echo-v1-6df5786f87-2wwkh) Annotation "sidecar.istio.io/inject" has been deprecated in favor of the "sidecar.istio.io/inject" label and may not work in future Istio versions.

=== $ sleep 5 (post-fix propagation) ===
(slept 5s)

=== $ istioctl proxy-config cluster client.istio-vt-t53 --fqdn subset-echo.istio-vt-t53.svc.cluster.local -o json | jq '.[] | {name, tcpKeepalive: .upstreamConnectionOptions.tcpKeepalive, maxConn: .circuitBreakers.thresholds[0].maxConnections}' ===
{
  "name": "outbound|80||subset-echo.istio-vt-t53.svc.cluster.local",
  "tcpKeepalive": {
    "keepaliveProbes": 4,
    "keepaliveTime": 90,
    "keepaliveInterval": 10
  },
  "maxConn": 4294967295
}
{
  "name": "outbound|80|v1|subset-echo.istio-vt-t53.svc.cluster.local",
  "tcpKeepalive": null,
  "maxConn": 33
}

=== supplementary: full cluster list (names only) for this fqdn, to confirm no other subset clusters exist ===
outbound|80||subset-echo.istio-vt-t53.svc.cluster.local
outbound|80|v1|subset-echo.istio-vt-t53.svc.cluster.local