=== T72: NR (NoRouteFound) flag verification ===

$ kubectl apply -f manifest.yaml
pod/client created
deployment.apps/echo created
service/echo created
virtualservice.networking.istio.io/echo-narrow-match created

$ kubectl -n istio-vt-t72 wait --for=condition=Ready pod/client --timeout=90s
pod/client condition met

$ kubectl -n istio-vt-t72 rollout status deployment/echo --timeout=90s
deployment "echo" successfully rolled out

$ kubectl -n istio-vt-t72 get pods -o wide
NAME                    READY   STATUS    RESTARTS   AGE   IP               NODE          NOMINATED NODE   READINESS GATES
client                  2/2     Running   0          8s    10.255.194.125   k8s-worker1   <none>           <none>
echo-5767bbcc56-bwtm6   2/2     Running   0          8s    10.255.194.122   k8s-worker1   <none>           <none>

$ sleep 5
(slept 5s)

$ kubectl -n istio-vt-t72 exec client -c curl -- curl -s -o /dev/null -w 'no_match=%{http_code}
' http://echo.istio-vt-t72.svc.homelab.local/some-other-path
no_match=404

$ kubectl -n istio-vt-t72 logs client -c istio-proxy --since=10s | grep '"NR"' | tail -2
(exit code: 0)

NOTE: spec grep pattern '"NR"' (with literal quotes) matched nothing because
the default TEXT access log format does not quote the response-flags field.
Re-checking with corrected pattern to confirm the flag is actually present:

$ kubectl -n istio-vt-t72 logs client -c istio-proxy --since=30s | grep -E '404 NR '
[2026-07-04T23:41:20.380Z] "GET /some-other-path HTTP/1.1" 404 NR route_not_found - "-" 0 0 0 - "-" "curl/8.14.1" "fd9c2f72-0a5b-4600-8ce7-b18a0e55a7a4" "echo.istio-vt-t72.svc.homelab.local" "-" - - 10.250.146.152:80 10.255.194.125:54378 - -

Full raw access log line for reference:
[2026-07-04T23:41:20.380Z] "GET /some-other-path HTTP/1.1" 404 NR route_not_found - "-" 0 0 0 - "-" "curl/8.14.1" "fd9c2f72-0a5b-4600-8ce7-b18a0e55a7a4" "echo.istio-vt-t72.svc.homelab.local" "-" - - 10.250.146.152:80 10.255.194.125:54378 - -