Istio断路器异常：流量仍路由至已缩容的不健康服务

问题根源 #

VirtualService的权重是静态配置，不会自动感知子集的后端实例数量；Outlier Detection仅针对有实例但健康状态异常的场景，当子集无副本时无法触发自动剔除，导致流量仍被路由到v2子集，出现no healthy upstream错误。

解决办法 #

1. 启用重试策略，失败自动 fallback 到健康实例 #

取消VirtualService中注释的重试配置，让Envoy在路由到v2失败时自动重试到v1：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-virtual-service
spec:
  hosts:
  - "*"
  gateways:
    - nginx-gateway
  http:
    - route:
      - destination:
          host: nginx-service
          subset: v1
          port: 
            number: 80
        weight: 50
      - destination:
          host: nginx-service
          subset: v2
          port: 
            number: 80
        weight: 50
    retries:
      attempts: 3
      perTryTimeout: 1s
      # 包含连接失败、5xx错误等场景
      retryOn: "5xx,connect-failure,refused-stream"
    timeout: 3s

2. 给子集配置健康检查，自动剔除无实例/不健康后端 #

修改DestinationRule，为每个子集添加HTTP健康检查，Istio会自动标记无实例的子集为不可用，不再路由流量：

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: nginx-load-balancer
spec:
  host: nginx-service
  trafficPolicy:
    connectionPool:
      http:
        http1MaxPendingRequests: 1
        maxRequestsPerConnection: 1
      tcp:
        maxConnections: 1
    outlierDetection:
        baseEjectionTime: 60s
        consecutive5xxErrors: 1
        interval: 2s
        maxEjectionPercent: 100
  subsets:
  - name: v1
    labels:
      version: "1"
    trafficPolicy:
      healthCheck:
        http:
          path: /
          port: 80
          interval: 5s
          timeout: 2s
          unhealthyThreshold: 2
          healthyThreshold: 2
  - name: v2
    labels:
      version: "2"
    trafficPolicy:
      healthCheck:
        http:
          path: /
          port: 80
          interval: 5s
          timeout: 2s
          unhealthyThreshold: 2
          healthyThreshold: 2

3. 手动调整VirtualService权重（临时方案） #

当v2副本缩容至0时，直接将v2的权重设为0，所有流量路由到v1：

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: nginx-virtual-service
spec:
  hosts:
  - "*"
  gateways:
    - nginx-gateway
  http:
    - route:
      - destination:
          host: nginx-service
          subset: v1
          port: 
            number: 80
        weight: 100
      - destination:
          host: nginx-service
          subset: v2
          port: 
            number: 80
        weight: 0

4. 验证Istio端点状态 #

执行以下命令查看Sidecar的端点列表，确认v2的端点是否被移除：

istioctl pc endpoints <你的Sidecar Pod名称> -o yaml

如果v2端点仍存在，可重启Sidecar Pod或Istiod服务刷新缓存：

# 重启Sidecar
kubectl rollout restart deployment <你的应用Deployment名称>
# 重启Istiod（如果使用默认安装）
kubectl rollout restart deployment istiod -n istio-system

内容的提问来源于stack exchange，提问作者Debugger