What's the issue?
The Standard Metrics reference documents the response_flags label only for Envoy:
Response Flags (response_flags): Additional details about the response or connection from proxy. In case of Envoy, see %RESPONSE_FLAGS% in Envoy Access Log.
In ambient mode, ztunnel (Rust, not Envoy) emits its own distinct set of response_flags values on the L4 TCP metrics such as istio_tcp_connections_closed_total. response_flags is an exported metric label that operators scrape and alert on, so these are user-facing, observable values rather than internal details. They are defined in src/proxy/metrics.rs, and none of them are Envoy flags:
| value |
meaning |
- |
none |
DENY |
authorization policy denied |
CONNECT |
connection failure |
TLS_FAILURE |
TLS failure |
H2_HANDSHAKE_FAILURE |
HTTP/2 handshake failure |
NETWORK_POLICY |
network policy error |
IDENTITY_ERROR |
identity error |
None of these values appear anywhere in the current docs, and Envoy's %RESPONSE_FLAGS% list (which the docs point to) does not contain them, so there is no way to interpret ztunnel's L4 metrics from the documentation. This matters for diagnosing ambient incidents from metrics: a strict-mTLS denial, for example, surfaces only as istio_tcp_connections_closed_total{response_flags="DENY"} and appears in no L7 request metric, but nothing in the docs indicates that.
Proposed fix
At minimum, a note that ztunnel emits its own response_flags values distinct from Envoy's, with a pointer to where they are defined. Ideally, a short table like the one above, alongside the Envoy note in the Standard Metrics reference or in the ztunnel troubleshooting guide.
Would an addition like this be welcome? I am happy to open the PR.
What's the issue?
The Standard Metrics reference documents the
response_flagslabel only for Envoy:In ambient mode, ztunnel (Rust, not Envoy) emits its own distinct set of
response_flagsvalues on the L4 TCP metrics such asistio_tcp_connections_closed_total.response_flagsis an exported metric label that operators scrape and alert on, so these are user-facing, observable values rather than internal details. They are defined insrc/proxy/metrics.rs, and none of them are Envoy flags:-DENYCONNECTTLS_FAILUREH2_HANDSHAKE_FAILURENETWORK_POLICYIDENTITY_ERRORNone of these values appear anywhere in the current docs, and Envoy's
%RESPONSE_FLAGS%list (which the docs point to) does not contain them, so there is no way to interpret ztunnel's L4 metrics from the documentation. This matters for diagnosing ambient incidents from metrics: a strict-mTLS denial, for example, surfaces only asistio_tcp_connections_closed_total{response_flags="DENY"}and appears in no L7 request metric, but nothing in the docs indicates that.Proposed fix
At minimum, a note that ztunnel emits its own
response_flagsvalues distinct from Envoy's, with a pointer to where they are defined. Ideally, a short table like the one above, alongside the Envoy note in the Standard Metrics reference or in the ztunnel troubleshooting guide.Would an addition like this be welcome? I am happy to open the PR.