Endpoint discovery: a successful update is still a delayed view

DNS can return a virtual service address, several workload addresses, or an external load balancer, depending on the deployment. A proxy receiving one virtual address may not learn the individual backends hidden behind it. Envoy v1.40.0 also supports Endpoint Discovery Service, where a management server supplies explicit endpoints and associated metadata. Those mechanisms answer related questions through different state and update paths. Determine which component resolves the name, which chooses a concrete endpoint, and whether the application or proxy caches the result.

Envoy's strict DNS mode treats resolved addresses as an explicit host set, while logical DNS uses DNS results to establish connections without treating every result change as a complete replacement of active upstreams. Their connection-draining behavior therefore differs. A DNS TTL alone is not a universal bound on how long an existing connection can reach a backend: resolver refresh policy, failed lookups, connection reuse, and discovery mode matter. Pin the mode and version before proposing a TTL change as a fix for stale routing.

An xDS client can acknowledge an accepted response or reject a response that fails validation. Resource versions and nonces help distinguish configuration state from a particular response exchange. Acceptance by one proxy does not prove that every proxy has received the same resources, that a new upstream is reachable, or that the application is serving the intended data. Related listeners, routes, clusters, endpoints, and secrets have dependencies and warming behavior. Inspect the actual resource types and their accepted versus pending state rather than treating one green connection indicator as complete synchronization.

Readiness, active health checking, passive failure observations, and discovery membership provide different evidence. A Kubernetes readiness change can influence advertised endpoints after propagation; it does not immediately close every already-established stream. An active probe exercises its configured path, which may be less demanding than real requests. A discovered address can also be unreachable from one zone but reachable from another. Explain which layer excludes an endpoint and which existing connections remain usable before concluding that an old discovery view must always fail or always remain safe.

For a controlled endpoint rollout, record when membership changed, when each proxy accepted the relevant configuration, and when requests stopped using the old destination. Separate new connection selection from existing-stream continuation. A failed update can leave previously accepted configuration active, while TTL-bearing resources or process restarts introduce additional lifetimes. Test removal, addition, empty results, rejected configuration, and a disconnected management stream. A safe test environment can reveal which stale-state behavior the chosen implementation actually provides without extrapolating one mode's behavior to every mesh.

The Markov lab is a deliberately separate stale-view analogy. Reset, set p=0.10 and q=0.40, predict stale probabilities 0.10 after one transition and 0.15 after two, then Step twice. Each Step advances one transition. Its stationary stale probability is 0.20. Separately Reset, set p=0.40 and q=0.10, predict stationary stale probability 0.80, then Play or Step. These exact matrix probabilities are not sampled network events or a model of xDS resource dependencies. Use them to ask how refresh opportunity competes with change rate, then return to measured propagation evidence.