[nutanix@harbor ~]$ kubectl logs carts-88b4ddf98-p5gqh -c istio-proxy -n demo
2026-01-30T14:08:29.823282Z info FLAG: --concurrency="0"
2026-01-30T14:08:29.823327Z info FLAG: --domain="demo.svc.cluster.local"
2026-01-30T14:08:29.823332Z info FLAG: --help="false"
2026-01-30T14:08:29.823335Z info FLAG: --log_as_json="false"
2026-01-30T14:08:29.823337Z info FLAG: --log_caller=""
2026-01-30T14:08:29.823339Z info FLAG: --log_output_level="default:info"
2026-01-30T14:08:29.823341Z info FLAG: --log_rotate=""
2026-01-30T14:08:29.823344Z info FLAG: --log_rotate_max_age="30"
2026-01-30T14:08:29.823346Z info FLAG: --log_rotate_max_backups="1000"
2026-01-30T14:08:29.823348Z info FLAG: --log_rotate_max_size="104857600"
2026-01-30T14:08:29.823350Z info FLAG: --log_stacktrace_level="default:none"
2026-01-30T14:08:29.823356Z info FLAG: --log_target="[stdout]"
2026-01-30T14:08:29.823358Z info FLAG: --meshConfig="./etc/istio/config/mesh"
2026-01-30T14:08:29.823361Z info FLAG: --outlierLogPath=""
2026-01-30T14:08:29.823363Z info FLAG: --profiling="true"
2026-01-30T14:08:29.823365Z info FLAG: --proxyComponentLogLevel="misc:error"
2026-01-30T14:08:29.823368Z info FLAG: --proxyLogLevel="warning"
2026-01-30T14:08:29.823370Z info FLAG: --serviceCluster="istio-proxy"
2026-01-30T14:08:29.823372Z info FLAG: --stsPort="0"
2026-01-30T14:08:29.823375Z info FLAG: --templateFile=""
2026-01-30T14:08:29.823378Z info FLAG: --tokenManagerPlugin=""
2026-01-30T14:08:29.823387Z info FLAG: --vklog="0"
2026-01-30T14:08:29.823392Z info Version 1.23.6-6a112a28410654328342c68f82da48920e34f062-Clean
2026-01-30T14:08:29.823398Z info Set max file descriptors (ulimit -n) to: 1048576
2026-01-30T14:08:29.823719Z info Proxy role ips=[192.168.2.124] type=sidecar id=carts-88b4ddf98-p5gqh.demo domain=demo.svc.cluster.local
2026-01-30T14:08:29.823783Z info Apply proxy config from env {"discoveryAddress":"istiod-istio-helm.istio-helm-system.svc:15012","tracing":{"zipkin":{"address":"jaeger-jaeger-operator-jaeger-collector.istio-system.svc.cluster.local:9411"},"sampling":100}}
2026-01-30T14:08:29.825955Z info cpu limit detected as 2, setting concurrency
2026-01-30T14:08:29.827354Z info Effective config: binaryPath: /usr/local/bin/envoy
concurrency: 2
configPath: ./etc/istio/proxy
controlPlaneAuthPolicy: MUTUAL_TLS
discoveryAddress: istiod-istio-helm.istio-helm-system.svc:15012
drainDuration: 45s
proxyAdminPort: 15000
serviceCluster: istio-proxy
statNameLength: 189
statusPort: 15020
terminationDrainDuration: 5s
tracing:
sampling: 100
zipkin:
address: jaeger-jaeger-operator-jaeger-collector.istio-system.svc.cluster.local:9411
2026-01-30T14:08:29.827376Z info JWT policy is third-party-jwt
2026-01-30T14:08:29.827380Z info using credential fetcher of JWT type in cluster.local trust domain
2026-01-30T14:08:30.028797Z info Opening status port 15020
2026-01-30T14:08:30.028831Z info Starting default Istio SDS Server
2026-01-30T14:08:30.028850Z info CA Endpoint istiod-istio-helm.istio-helm-system.svc:15012, provider Citadel
2026-01-30T14:08:30.028879Z info Using CA istiod-istio-helm.istio-helm-system.svc:15012 cert with certs: var/run/secrets/istio/root-cert.pem
2026-01-30T14:08:30.029620Z info xdsproxy Initializing with upstream address "istiod-istio-helm.istio-helm-system.svc:15012" and cluster "Kubernetes"
2026-01-30T14:08:30.031212Z info Pilot SAN: [istiod-istio-helm.istio-helm-system.svc]
2026-01-30T14:08:30.033350Z info sds Starting SDS grpc server
2026-01-30T14:08:30.033374Z info sds Starting SDS server for workload certificates, will listen on "var/run/secrets/workload-spiffe-uds/socket"
2026-01-30T14:08:30.033503Z info starting Http service at 127.0.0.1:15004
2026-01-30T14:08:30.035641Z info Starting proxy agent
2026-01-30T14:08:30.035691Z info Envoy command: [-c etc/istio/proxy/envoy-rev.json --drain-time-s 45 --drain-strategy immediate --local-address-ip-version v4 --file-flush-interval-msec 1000 --disable-hot-restart --allow-unknown-static-fields -l warning --component-log-level misc:error --concurrency 2]
2026-01-30T14:08:30.112678Z warning envoy main external/envoy/source/server/server.cc:936 There is no configured limit to the number of allowed active downstream connections. Configure a limit in `envoy.resource_monitors.downstream_connections` resource monitor. thread=14
2026-01-30T14:08:30.114850Z warning envoy main external/envoy/source/server/server.cc:843 Usage of the deprecated runtime key overload.global_downstream_max_connections, consider switching to `envoy.resource_monitors.downstream_connections` instead.This runtime key will be removed in future. thread=14
2026-01-30T14:08:30.123541Z info xdsproxy connected to delta upstream XDS server: istiod-istio-helm.istio-helm-system.svc:15012 id=1
2026-01-30T14:08:30.156633Z info cache generated new workload certificate resourceName=default latency=126.712884ms ttl=23h59m59.843374146s
2026-01-30T14:08:30.156685Z info cache Root cert has changed, start rotating root cert
2026-01-30T14:08:30.156825Z info cache returned workload trust anchor from cache ttl=23h59m59.843176367s
2026-01-30T14:08:30.192919Z info ads ADS: new connection for node:1
2026-01-30T14:08:30.193043Z info cache returned workload certificate from cache ttl=23h59m59.806958673s
2026-01-30T14:08:30.193482Z info ads ADS: new connection for node:2
2026-01-30T14:08:30.193672Z info cache returned workload trust anchor from cache ttl=23h59m59.806329146s
2026-01-30T14:08:31.182561Z info Readiness succeeded in 1.360041593s
2026-01-30T14:08:31.183121Z info Envoy proxy is ready