=== CMD: kubectl apply -f client-echo.yaml && kubectl -n istio-vt-t71-r2 wait --for=condition=Ready pod/client --timeout=90s && kubectl -n istio-vt-t71-r2 rollout status deploy/echo === pod/client created deployment.apps/echo created service/echo created pod/client condition met deployment "echo" successfully rolled out === CMD: kubectl -n istio-vt-t71-r2 scale deploy/echo --replicas=0 === deployment.apps/echo scaled === CMD: sleep 5 === NAME READY STATUS RESTARTS AGE client 2/2 Running 0 17s echo-5767bbcc56-v4tj8 2/2 Terminating 0 17s === CMD (CORRECTED per harness-notes.md: SHORT name, not homelab.local FQDN): kubectl -n istio-vt-t71-r2 exec client -c curl -- curl -s -o /dev/null -w 'uh_trigger=%{http_code} ' http://echo/ === uh_trigger=503 === CMD: kubectl -n istio-vt-t71-r2 logs client -c istio-proxy --since=20s | grep '"UH"' | tail -2 === === NOTE: original spec grep pattern '"UH"' (quoted) does not match because the access log flags field is NOT quoted in this log format; re-grepping without quotes for the actual evidence: === === CMD: kubectl -n istio-vt-t71-r2 logs client -c istio-proxy --since=30s | grep ' UH ' | tail -2 === [2026-07-05T02:58:10.506Z] "GET / HTTP/1.1" 503 UH no_healthy_upstream - "-" 0 19 0 - "-" "curl/8.14.1" "f90efbd6-0f5c-4ce2-9e58-9c580b410dde" "echo" "-" outbound|80||echo.istio-vt-t71-r2.svc.cluster.local - 10.250.179.152:80 10.255.194.126:35838 - default === CMD: kubectl -n istio-vt-t71-r2 scale deploy/echo --replicas=1 && kubectl -n istio-vt-t71-r2 rollout status deploy/echo --timeout=60s === deployment.apps/echo scaled Waiting for deployment "echo" rollout to finish: 0 of 1 updated replicas are available... deployment "echo" successfully rolled out === CMD (CORRECTED per harness-notes.md: DR host = svc.cluster.local, not svc.homelab.local): kubectl apply -f echo-uo-repro.yaml === destinationrule.networking.istio.io/echo-uo-repro created === CMD: sleep 5 === === DIAGNOSTIC (read-only, confirms corrected DR host matches mesh service): istioctl analyze -n istio-vt-t71-r2 === Info [IST0135] (Pod istio-vt-t71-r2/client) Annotation "sidecar.istio.io/inject" has been deprecated in favor of the "sidecar.istio.io/inject" label and may not work in future Istio versions. Info [IST0135] (Pod istio-vt-t71-r2/echo-5767bbcc56-v69nz) Annotation "sidecar.istio.io/inject" has been deprecated in favor of the "sidecar.istio.io/inject" label and may not work in future Istio versions. === DIAGNOSTIC (read-only): confirm connectionPool circuit breaker attached to the correct EDS cluster === === CMD: istioctl proxy-config cluster client.istio-vt-t71-r2 --fqdn echo.istio-vt-t71-r2.svc.cluster.local -o json === "circuitBreakers": { "thresholds": [ { "maxConnections": 1, "maxPendingRequests": 1, "maxRequests": 4294967295, "maxRetries": 4294967295 } ] }, "commonLbConfig": {}, "metadata": { "filterMetadata": { "istio": { "config": "/apis/networking.istio.io/v1/namespaces/istio-vt-t71-r2/destination-rule/echo-uo-repro", "services": [ -- "circuitBreakers": { "thresholds": [ { "maxConnections": 1, "maxPendingRequests": 1, "maxRequests": 4294967295, "maxRetries": 4294967295 } ] }, "commonLbConfig": {}, "metadata": { "filterMetadata": { "istio": { "config": "/apis/networking.istio.io/v1/namespaces/istio-vt-t71-r2/destination-rule/echo-uo-repro", "services": [ === CMD (CORRECTED per harness-notes.md: SHORT name): kubectl -n istio-vt-t71-r2 exec client -c curl -- sh -c 'for i in $(seq 1 30); do curl -s -o /dev/null -w "%{http_code} " --max-time 5 http://echo/ & done; wait' === 503 503 503 503 200 200 200 200 200 503 200 200 200 200 503 200 200 200 503 200 200 200 200 503 503 503 200 200 200 200 === CMD: kubectl -n istio-vt-t71-r2 logs client -c istio-proxy --since=15s | grep '"UO"' | tail -2 (original spec pattern, quoted) === (above: original quoted grep - expect no match, same quoting artifact as step 1) === CMD (corrected grep, unquoted flag field): kubectl -n istio-vt-t71-r2 logs client -c istio-proxy --since=15s | grep ' UO' | tail -5 === [2026-07-05T02:59:11.648Z] "GET / HTTP/1.1" 503 UO upstream_reset_before_response_started{overflow} - "-" 0 81 0 - "-" "curl/8.14.1" "3db5d867-f401-46dd-9d19-06666c0dd4a4" "echo" "-" outbound|80||echo.istio-vt-t71-r2.svc.cluster.local - 10.250.179.152:80 10.255.194.126:41392 - default [2026-07-05T02:59:11.658Z] "GET / HTTP/1.1" 503 UO upstream_reset_before_response_started{overflow} - "-" 0 81 0 - "-" "curl/8.14.1" "4dcf9c51-5e1f-418d-8c8e-bbd036fabc1a" "echo" "-" outbound|80||echo.istio-vt-t71-r2.svc.cluster.local - 10.250.179.152:80 10.255.194.126:41444 - default [2026-07-05T02:59:11.670Z] "GET / HTTP/1.1" 503 UO upstream_reset_before_response_started{overflow} - "-" 0 81 0 - "-" "curl/8.14.1" "6d7d8b1b-645b-4b49-bda0-8547f2122aec" "echo" "-" outbound|80||echo.istio-vt-t71-r2.svc.cluster.local - 10.250.179.152:80 10.255.194.126:41488 - default [2026-07-05T02:59:11.670Z] "GET / HTTP/1.1" 503 UO upstream_reset_before_response_started{overflow} - "-" 0 81 0 - "-" "curl/8.14.1" "d95f2800-55fa-4bfe-95cf-33d3f7544d71" "echo" "-" outbound|80||echo.istio-vt-t71-r2.svc.cluster.local - 10.250.179.152:80 10.255.194.126:41504 - default [2026-07-05T02:59:11.672Z] "GET / HTTP/1.1" 503 UO upstream_reset_before_response_started{overflow} - "-" 0 81 0 - "-" "curl/8.14.1" "0df564c2-2ce0-4ba5-b9b5-8fa09c4c21cf" "echo" "-" outbound|80||echo.istio-vt-t71-r2.svc.cluster.local - 10.250.179.152:80 10.255.194.126:41512 - default === full response-flag / status tally for flood-test window (30 concurrent requests) === === SUMMARY === Step 1 (replicas=0): 503, flag=UH (no_healthy_upstream), cluster=outbound|80||echo.istio-vt-t71-r2.svc.cluster.local (correct EDS cluster, matched via corrected SHORT-name request + DR/registry host fix). Step 2 (connectionPool maxConnections=1/http1MaxPendingRequests=1, 30 concurrent, corrected DR host=svc.cluster.local): mixed 200/503; 503s carry flag=UO (upstream_reset_before_response_started{overflow}), same EDS cluster. Conclusion: same 503 status code, different response flags (UH vs UO) depending on which pipeline gate failed - endpoint selection (no healthy upstream) vs connection-pool/circuit-breaker overflow. This matches pass_criteria. === corrected status/flag tally (previous awk attempt produced no output; simpler grep works): === 20 " 200 - 10 " 503 UO