Thanks for the thorough explanation and the detailed reproduction steps! From what you described, it sounds like the delayed ejection after subsequent 504 errors might be related to how Envoy handles host ejection cooldowns or resets the error count after hosts return online.

In Envoy’s outlier detection, the first ejection behavior often differs from subsequent ones because of internal state resets or timing intervals like baseEjectionTime and interval. The fact that more than the configured consecutiveGatewayErrors are needed for later ejections could be due to those timing nuances or how errors are aggregated.

I’d recommend checking Envoy’s GitHub issues or mailing list for similar reported behaviors to see if this is an acknowledged quirk or bug. Also, experimenting with tweaking baseEjectionTime or interval might help confirm if timing parameters affect this behavior.