=== kubectl apply -f manifest.yaml ===
pod/client created
deployment.apps/echo created
service/echo created
serviceaccount/gwauthz-caller-a created
serviceaccount/gwauthz-caller-b created
pod/caller-a created
pod/caller-b created
authorizationpolicy.security.istio.io/allow-only-caller-a created

=== kubectl -n istio-vt-t76-r2 wait --for=condition=Ready pod/client pod/caller-a pod/caller-b --timeout=120s ===
pod/client condition met
pod/caller-a condition met
pod/caller-b condition met

=== kubectl -n istio-vt-t76-r2 rollout status deployment/echo --timeout=120s ===
deployment "echo" successfully rolled out

=== kubectl -n istio-vt-t76-r2 get pods -o wide ===
NAME                    READY   STATUS    RESTARTS   AGE   IP               NODE          NOMINATED NODE   READINESS GATES
caller-a                2/2     Running   0          3s    10.255.126.3     k8s-worker2   <none>           <none>
caller-b                2/2     Running   0          3s    10.255.159.140   k8s-master1   <none>           <none>
client                  2/2     Running   0          3s    10.255.126.21    k8s-worker2   <none>           <none>
echo-5767bbcc56-bz7zg   2/2     Running   0          3s    10.255.194.69    k8s-worker1   <none>           <none>

=== sleep 5 (allow AuthorizationPolicy to propagate to sidecars) ===
slept 5s

=== kubectl -n istio-vt-t76-r2 exec caller-a -c curl -- curl -s -o /dev/null -w 'caller_a=%{http_code}\n' http://echo.istio-vt-t76-r2/ ===
caller_a=200

=== kubectl -n istio-vt-t76-r2 exec caller-b -c curl -- curl -s -o /dev/null -w 'caller_b=%{http_code}\n' http://echo.istio-vt-t76-r2/ ===
caller_b=403

=== RETRY (protocol: confirm reproducibility) ===
=== kubectl -n istio-vt-t76-r2 exec caller-a -c curl -- curl -s -o /dev/null -w 'caller_a_retry=%{http_code}\n' http://echo.istio-vt-t76-r2/ ===
caller_a_retry=200

=== kubectl -n istio-vt-t76-r2 exec caller-b -c curl -- curl -s -o /dev/null -w 'caller_b_retry=%{http_code}\n' http://echo.istio-vt-t76-r2/ ===
caller_b_retry=403

=== SUPPORTING DIAGNOSTIC: confirm short-name Host matches an Envoy outbound vhost (not PassthroughCluster) ===
=== kubectl -n istio-vt-t76-r2 exec caller-a -c curl -- curl -s -o /dev/null -w 'HTTP %{http_code} via %{remote_ip}\n' -v http://echo.istio-vt-t76-r2/ 2>&1 | tail -25 ===
* Host echo.istio-vt-t76-r2:80 was resolved.
* IPv6: (none)
* IPv4: 10.250.40.214
*   Trying 10.250.40.214:80...
* Connected to echo.istio-vt-t76-r2 (10.250.40.214) port 80
* using HTTP/1.x
> GET / HTTP/1.1
> Host: echo.istio-vt-t76-r2
> User-Agent: curl/8.14.1
> Accept: */*
> 
* Request completely sent off
HTTP 200 via 10.250.40.214
< HTTP/1.1 200 OK
< x-powered-by: Express
< content-type: application/json; charset=utf-8
< content-length: 770
< etag: W/"302-TWAVv3SCtYsOeycBaD7u+W9b2kw"
< date: Sun, 05 Jul 2026 02:58:15 GMT
< x-envoy-upstream-service-time: 4
< server: envoy
< 
{ [770 bytes data]
* Connection #0 to host echo.istio-vt-t76-r2 left intact

=== kubectl -n istio-vt-t76-r2 logs deploy/echo -c istio-proxy --tail=10 ===
2026-07-05T02:58:07.698985Z	info	cache	generated new workload certificate	resourceName=default latency=213.936382ms ttl=23h59m59.301028483s
2026-07-05T02:58:07.699022Z	info	cache	Root cert has changed, start rotating root cert
2026-07-05T02:58:07.699050Z	info	cache	returned workload trust anchor from cache	ttl=23h59m59.300950487s
2026-07-05T02:58:07.720002Z	info	ads	ADS: new connection for node:1
2026-07-05T02:58:07.720068Z	info	cache	returned workload certificate from cache	ttl=23h59m59.27993443s
2026-07-05T02:58:07.720425Z	info	ads	ADS: new connection for node:2
2026-07-05T02:58:07.720502Z	info	cache	returned workload trust anchor from cache	ttl=23h59m59.279498611s
2026-07-05T02:58:08.524220Z	info	Readiness succeeded in 1.254084025s
2026-07-05T02:58:08.524538Z	info	Envoy proxy is ready
[2026-07-05T02:58:15.054Z] "GET / HTTP/1.1" 200 - via_upstream - "-" 0 770 17 15 "-" "curl/8.14.1" "10e0cb64-7af2-482c-b6d3-2113c2c6685c" "echo.istio-vt-t76-r2" "10.255.194.69:8080" inbound|8080|| 127.0.0.6:58815 10.255.194.69:8080 10.255.126.3:52468 outbound_.80_._.echo.istio-vt-t76-r2.svc.cluster.local default

=== SUMMARY ===
See result.txt caller_a / caller_b lines above for pass/fail against pass_criteria (caller_a=200, caller_b=403).
=== cleanup: deleting namespace istio-vt-t76-r2 (--wait=false) ===
namespace "istio-vt-t76-r2" deleted