[setup] creating namespace istio-vt-t17-r2 with istio-injection=enabled
namespace/istio-vt-t17-r2 created
namespace/istio-vt-t17-r2 labeled
[apply] client + echo workloads
pod/client created
deployment.apps/echo created
service/echo created
pod/client condition met
deployment "echo" successfully rolled out
NAME                    READY   STATUS    RESTARTS   AGE   IP               NODE          NOMINATED NODE   READINESS GATES
client                  2/2     Running   0          3s    10.255.194.127   k8s-worker1   <none>           <none>
echo-5767bbcc56-n58b4   2/2     Running   0          3s    10.255.126.30    k8s-worker2   <none>           <none>

=== Phase 0: ALLOW_ANY, no ServiceEntry registered at all (target: httpbin.org) ===
0
unregistered=200
unregistered_curl_exit=0
1
(0 above means no match yet, expected pre-Phase1)
--- full istio_requests_total lines matching httpbin (Phase 0 diagnostic) ---
istio_requests_total{reporter="source",source_workload="client",source_canonical_service="client",source_canonical_revision="latest",source_workload_namespace="istio-vt-t17-r2",source_principal="unknown",source_app="client",source_version="",source_cluster="Kubernetes",destination_workload="unknown",destination_workload_namespace="unknown",destination_principal="unknown",destination_app="unknown",destination_version="unknown",destination_service="httpbin.org",destination_canonical_service="unknown",destination_canonical_revision="latest",destination_service_name="PassthroughCluster",destination_service_namespace="unknown",destination_cluster="unknown",request_protocol="http",response_code="200",grpc_response_status="",response_flags="-",connection_security_policy="unknown"} 1

=== Phase 1: register protocol: HTTP correctly (httpbin.org:80) ===
serviceentry.networking.istio.io/httpbin-http-correct-se created
registered_http=200
registered_http_curl_exit=0
1
2
--- full istio_requests_total lines matching httpbin (Phase 1 diagnostic) ---
istio_requests_total{reporter="source",source_workload="client",source_canonical_service="client",source_canonical_revision="latest",source_workload_namespace="istio-vt-t17-r2",source_principal="unknown",source_app="client",source_version="",source_cluster="Kubernetes",destination_workload="httpbin-http-correct-se",destination_workload_namespace="istio-vt-t17-r2",destination_principal="unknown",destination_app="unknown",destination_version="unknown",destination_service="httpbin.org",destination_canonical_service="httpbin-http-correct-se",destination_canonical_revision="latest",destination_service_name="httpbin.org",destination_service_namespace="istio-vt-t17-r2",destination_cluster="Kubernetes",request_protocol="http",response_code="200",grpc_response_status="",response_flags="-",connection_security_policy="unknown"} 1
istio_requests_total{reporter="source",source_workload="client",source_canonical_service="client",source_canonical_revision="latest",source_workload_namespace="istio-vt-t17-r2",source_principal="unknown",source_app="client",source_version="",source_cluster="Kubernetes",destination_workload="unknown",destination_workload_namespace="unknown",destination_principal="unknown",destination_app="unknown",destination_version="unknown",destination_service="httpbin.org",destination_canonical_service="unknown",destination_canonical_revision="latest",destination_service_name="PassthroughCluster",destination_service_namespace="unknown",destination_cluster="unknown",request_protocol="http",response_code="200",grpc_response_status="",response_flags="-",connection_security_policy="unknown"} 1
serviceentry.networking.istio.io "httpbin-http-correct-se" deleted from istio-vt-t17-r2 namespace

=== Phase 2: misdeclare the SAME plaintext port as protocol: TLS (httpbin.org:80) ===
serviceentry.networking.istio.io/httpbin-tls-misdeclared-se created
--- 0.0.0.0_80 outbound listener filter chains (diagnostic) ---
{
  "name": "0.0.0.0_80",
  "filterChains": [
    {
      "filterChainMatch": {
        "transportProtocol": "raw_buffer",
        "applicationProtocols": [
          "http/1.1",
          "h2c"
        ]
      },
      "filters": [
        "envoy.filters.network.http_connection_manager"
      ]
    },
    {
      "filterChainMatch": {
        "serverNames": [
          "httpbin.org"
        ]
      },
      "filters": [
        "istio.stats",
        "envoy.filters.network.tcp_proxy"
      ]
    }
  ]
}
* Host httpbin.org:80 was resolved.
* IPv6: (none)
* IPv4: 32.196.65.112, 44.194.226.209, 3.225.138.231, 52.206.154.42, 98.94.191.213, 54.165.231.236, 3.225.230.69, 100.59.144.143
*   Trying 32.196.65.112:80...
* Connected to httpbin.org (32.196.65.112) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: httpbin.org
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
< HTTP/1.1 200 OK
< date: Sun, 05 Jul 2026 03:03:56 GMT
< content-type: text/html; charset=utf-8
< content-length: 9593
< server: envoy
< access-control-allow-origin: *
< access-control-allow-credentials: true
< x-envoy-upstream-service-time: 383
< 
{ [1428 bytes data]
misdeclared_tls=200
* Connection #0 to host httpbin.org left intact
exit=0

[done] see result.txt in this directory for this run's captured raw output.
[cleanup] deleting namespace istio-vt-t17-r2
namespace "istio-vt-t17-r2" deleted