=== kubectl apply -f manifest.yaml === pod/client created deployment.apps/echo created service/echo created deployment.apps/egw-a created service/egw-a created gateway.networking.istio.io/egw-a-gw created virtualservice.networking.istio.io/egw-a-route created deployment.apps/egw-b created service/egw-b created gateway.networking.istio.io/egw-b-gw created virtualservice.networking.istio.io/egw-b-route created deployment.apps/multi-ip-backend created service/multi-ip-target created serviceentry.networking.istio.io/leaky-nack-demo created === kubectl -n istio-vt-t03 wait --for=condition=Available deploy/egw-a deploy/egw-b deploy/multi-ip-backend --timeout=120s === deployment.apps/egw-a condition met deployment.apps/egw-b condition met deployment.apps/multi-ip-backend condition met === also wait for echo and client === deployment.apps/echo condition met pod/client condition met === pod status === NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES client 2/2 Running 0 9s 10.255.126.4 k8s-worker2 echo-5767bbcc56-hrgr8 2/2 Running 0 9s 10.255.194.108 k8s-worker1 egw-a-6bd86d85c7-4vg86 1/1 Running 0 9s 10.255.126.7 k8s-worker2 egw-b-754b8c75b-rjqgr 1/1 Running 0 9s 10.255.194.109 k8s-worker1 multi-ip-backend-74c779cb74-dxckh 1/1 Running 0 9s 10.255.159.156 k8s-master1 multi-ip-backend-74c779cb74-rbznt 1/1 Running 0 9s 10.255.126.5 k8s-worker2 === CMD1: kubectl -n istio-vt-t03 exec deploy/egw-a -c istio-proxy -- curl baseline (egw-a self) === egwA_baseline=000 command terminated with exit code 35 === CMD2: client -> egw-a baseline === via_egwA_baseline=000 command terminated with exit code 35 === CMD3: client -> egw-b baseline === via_egwB_baseline=000 command terminated with exit code 35 === CMD4: istioctl proxy-status baseline === NAME CLUSTER ISTIOD VERSION SUBSCRIBED TYPES egw-a-6bd86d85c7-4vg86.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) egw-b-754b8c75b-rjqgr.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) === CMD5: endpoints multi-ip-target === 10.255.126.5 10.255.159.156 === NOTE: initial baseline attempts (CMD1-3) returned 000/exit35 (connection reset) ~9s after apply; retried after ~19s total and succeeded. Treated as transient xDS propagation delay (environmental), retried once per protocol. === === CMD1 (retry): egw-a self curl === egwA_baseline=000 command terminated with exit code 35 === CMD2 (retry): client -> egw-a baseline === via_egwA_baseline=200 === CMD3 (retry): client -> egw-b baseline === via_egwB_baseline=200 === CMD4: istioctl proxy-status baseline === NAME CLUSTER ISTIOD VERSION SUBSCRIBED TYPES egw-a-6bd86d85c7-4vg86.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) egw-b-754b8c75b-rjqgr.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) === CMD5: endpoints multi-ip-target (confirm 2 A records expected) === 10.255.126.5 10.255.159.156 === CMD6: sleep 15 (let leaky-nack-demo SE propagate / DNS records settle) === slept 15s === CMD7: istioctl proxy-status after leaky-nack-demo (check CDS column) === NAME CLUSTER ISTIOD VERSION SUBSCRIBED TYPES egw-a-6bd86d85c7-4vg86.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) egw-b-754b8c75b-rjqgr.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) === full proxy-status line detail for egw-a/egw-b (columns) === NAME CLUSTER ISTIOD VERSION SUBSCRIBED TYPES egw-a-6bd86d85c7-4vg86.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) egw-b-754b8c75b-rjqgr.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) === NOTE: istioctl proxy-status default table (1.30.0) does not show per-type SYNCED/STALE column for full mesh listing; using -o json genericXdsConfigs[].configStatus instead for CDS status === --- node: egw-a-6bd86d85c7-4vg86.istio-vt-t03 Cluster SYNCED 2026-07-04T22:35:43.319854469Z ClusterLoadAssignment SYNCED 2026-07-04T22:36:06.677249051Z Listener SYNCED 2026-07-04T22:35:43.381085338Z --- node: egw-b-754b8c75b-rjqgr.istio-vt-t03 Cluster SYNCED 2026-07-04T22:35:43.322151442Z ClusterLoadAssignment SYNCED 2026-07-04T22:36:06.676138426Z Listener SYNCED 2026-07-04T22:35:43.396935692Z === CMD8: istioctl proxy-config cluster deploy/egw-a --fqdn multi-ip-target (check cluster type) === [ { "name": "outbound|80||multi-ip-target.istio-vt-t03.svc.homelab.local", "altStatName": "outbound|80||multi-ip-target.istio-vt-t03.svc.homelab.local;", "type": "LOGICAL_DNS", "connectTimeout": "10s", "lbPolicy": "LEAST_REQUEST", "loadAssignment": { "clusterName": "outbound|80||multi-ip-target.istio-vt-t03.svc.homelab.local", "endpoints": [ { "locality": {}, "lbEndpoints": [ { "endpoint": { "address": { "socketAddress": { "address": "multi-ip-target.istio-vt-t03.svc.homelab.local", "portValue": 80 } } }, "metadata": { "filterMetadata": { "istio": { "workload": "leaky-nack-demo;istio-vt-t03;leaky-nack-demo;;Kubernetes" } } }, "loadBalancingWeight": 1 } ], "loadBalancingWeight": 1 } ] }, "circuitBreakers": { "thresholds": [ { "maxConnections": 4294967295, "maxPendingRequests": 4294967295, "maxRequests": 4294967295, "maxRetries": 4294967295 } ] }, "dnsRefreshRate": "60s", "dnsJitter": "0.100s", "respectDnsTtl": true, "dnsLookupFamily": "V4_ONLY", "typedDnsResolverConfig": { "name": "envoy.network.dns_resolver.cares", "typedConfig": { "@type": "type.googleapis.com/envoy.extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig", "udpMaxQueries": 100 } }, "commonLbConfig": {}, "metadata": { "filterMetadata": { "istio": { "external": true, "services": [ { "host": "multi-ip-target.istio-vt-t03.svc.homelab.local", "name": "multi-ip-target.istio-vt-t03.svc.homelab.local", "namespace": "istio-vt-t03" } ] } } }, "filters": [ { "name": "istio.metadata_exchange", "typedConfig": { "@type": "type.googleapis.com/udpa.type.v1.TypedStruct", "typeUrl": "type.googleapis.com/envoy.tcp.metadataexchange.config.MetadataExchange", "value": { "enable_discovery": true, "protocol": "istio-peer-exchange" } } } ] } ] TYPES: ['LOGICAL_DNS'] === CMD9: istiod logs grep for multi-ip-target/logical_dns/rejected/nack (since 3m) === (exit code: 0) === also check for leaky-nack-demo mentions and any error/warn level lines in istiod logs (broader net) === 2026-07-04T22:35:38.788625Z info delta CDS: PUSH for node:client.istio-vt-t03 resources:5 removed:0 size:2.6kB cached:2/2 2026-07-04T22:35:38.791290Z info delta LDS: PUSH for node:client.istio-vt-t03 resources:38 removed:0 size:84.1kB 2026-07-04T22:35:38.801297Z info delta RDS: PUSH for node:client.istio-vt-t03 resources:11 removed:0 size:16.7kB cached:10/11 2026-07-04T22:35:38.788909Z info delta CDS: PUSH for node:egw-b-754b8c75b-rjqgr.istio-vt-t03 resources:3 removed:0 size:1.9kB cached:2/2 2026-07-04T22:35:38.803314Z info delta LDS: PUSH for node:egw-b-754b8c75b-rjqgr.istio-vt-t03 resources:1 removed:0 size:1.8kB 2026-07-04T22:35:38.788780Z info delta CDS: PUSH for node:egw-a-6bd86d85c7-4vg86.istio-vt-t03 resources:3 removed:0 size:1.9kB cached:2/2 2026-07-04T22:35:38.794628Z info delta CDS: PUSH for node:echo-5767bbcc56-hrgr8.istio-vt-t03 resources:7 removed:0 size:3.1kB cached:2/2 2026-07-04T22:35:38.852434Z info delta LDS: PUSH for node:echo-5767bbcc56-hrgr8.istio-vt-t03 resources:38 removed:0 size:94.2kB 2026-07-04T22:35:38.853421Z info delta RDS: PUSH for node:echo-5767bbcc56-hrgr8.istio-vt-t03 resources:11 removed:0 size:16.7kB cached:11/11 2026-07-04T22:35:38.853595Z info delta LDS: PUSH for node:egw-a-6bd86d85c7-4vg86.istio-vt-t03 resources:1 removed:0 size:1.8kB 2026-07-04T22:35:43.329092Z info delta CDS: PUSH for node:echo-5767bbcc56-hrgr8.istio-vt-t03 resources:6 removed:0 size:2.5kB cached:1/1 2026-07-04T22:35:43.329704Z info delta EDS: PUSH for node:echo-5767bbcc56-hrgr8.istio-vt-t03 resources:48 removed:0 size:10.1kB empty:0 cached:48/48 2026-07-04T22:35:43.336470Z info delta LDS: PUSH for node:echo-5767bbcc56-hrgr8.istio-vt-t03 resources:38 removed:0 size:94.2kB 2026-07-04T22:35:43.346149Z info delta RDS: PUSH for node:echo-5767bbcc56-hrgr8.istio-vt-t03 resources:11 removed:0 size:16.2kB cached:0/11 2026-07-04T22:35:43.319856Z info delta CDS: PUSH for node:egw-a-6bd86d85c7-4vg86.istio-vt-t03 resources:2 removed:0 size:1.3kB cached:1/1 2026-07-04T22:35:43.319690Z info delta CDS: PUSH for node:client.istio-vt-t03 resources:4 removed:0 size:2.0kB cached:1/1 2026-07-04T22:35:43.379018Z info delta EDS: PUSH for node:client.istio-vt-t03 resources:48 removed:0 size:10.1kB empty:0 cached:48/48 2026-07-04T22:35:43.380905Z info delta EDS: PUSH for node:egw-a-6bd86d85c7-4vg86.istio-vt-t03 resources:49 removed:0 size:10.4kB empty:0 cached:49/49 2026-07-04T22:35:43.381088Z info delta LDS: PUSH for node:egw-a-6bd86d85c7-4vg86.istio-vt-t03 resources:1 removed:0 size:1.8kB 2026-07-04T22:35:43.382207Z info delta LDS: PUSH for node:client.istio-vt-t03 resources:38 removed:0 size:84.1kB 2026-07-04T22:35:43.387202Z info delta RDS: PUSH for node:client.istio-vt-t03 resources:11 removed:0 size:16.2kB cached:6/11 2026-07-04T22:35:43.322154Z info delta CDS: PUSH for node:egw-b-754b8c75b-rjqgr.istio-vt-t03 resources:2 removed:0 size:1.3kB cached:1/1 2026-07-04T22:35:43.396811Z info delta EDS: PUSH for node:egw-b-754b8c75b-rjqgr.istio-vt-t03 resources:49 removed:0 size:10.4kB empty:0 cached:49/49 2026-07-04T22:35:43.396938Z info delta LDS: PUSH for node:egw-b-754b8c75b-rjqgr.istio-vt-t03 resources:1 removed:0 size:1.8kB === CMD10: client -> egw-a during (alleged) nack window === via_egwA_during_nack=200 === CMD11: client -> egw-b during (alleged) nack window === via_egwB_during_nack=200 === CMD12: patch leaky-nack-demo exportTo=['.'] === serviceentry.networking.istio.io/leaky-nack-demo patched === CMD13: sleep 10 === slept 10s === CMD14: istioctl proxy-status after scoping fix (table) === NAME CLUSTER ISTIOD VERSION SUBSCRIBED TYPES egw-a-6bd86d85c7-4vg86.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) egw-b-754b8c75b-rjqgr.istio-vt-t03 Kubernetes istiod-797b447c94-cv7ns 1.30.0 3 (CDS,LDS,EDS) === CMD14b: json configStatus after scoping fix === --- node: egw-a-6bd86d85c7-4vg86.istio-vt-t03 Cluster SYNCED 2026-07-04T22:38:22.327537199Z ClusterLoadAssignment SYNCED 2026-07-04T22:38:07.448838929Z Listener SYNCED 2026-07-04T22:38:22.327629552Z --- node: egw-b-754b8c75b-rjqgr.istio-vt-t03 Cluster SYNCED 2026-07-04T22:38:22.310718827Z ClusterLoadAssignment SYNCED 2026-07-04T22:38:07.441986993Z Listener SYNCED 2026-07-04T22:38:22.310787175Z