TIS0201 - Multiple DestinationRule Objects for Same Host-Subset Combination

Multiple DestinationRule objects exist for the same host-subset combination.

Recommendation: Avoid Overlapping DestinationRule Configurations

To ensure consistent routing behavior, avoid overlapping configurations in multiple DestinationRule objects. Either combine the settings into a single rule or use distinct subsets for different configurations.

Examples

1. Two DestinationRule Objects Targeting the Same Host and Subset

   First DestinationRule:

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: destination-rule-1
     namespace: example-namespace
   spec:
     host: "my-service.example-namespace.svc.cluster.local"
     subsets:
     - name: v1
       labels:
         version: v1
     trafficPolicy:
       loadBalancer:
         simple: ROUND_ROBIN

   Second DestinationRule:

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: destination-rule-2
     namespace: example-namespace
   spec:
     host: "my-service.example-namespace.svc.cluster.local"
     subsets:
     - name: v1
       labels:
         version: v1
     trafficPolicy:
       loadBalancer:
         simple: LEAST_CONN

   Explanation: Both DestinationRule objects define subsets for the same host, my-service.example-namespace.svc.cluster.local, and the same subset (v1). This overlap can cause unpredictable routing behavior, as Istio may be unable to resolve which rule should be applied.

2. Conflicting DestinationRule Subsets

   First DestinationRule:

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: rule-1
     namespace: example-namespace
   spec:
     host: "my-service"
     subsets:
     - name: blue
       labels:
         env: blue
     trafficPolicy:
       connectionPool:
         http:
           maxRequestsPerConnection: 100

   Second DestinationRule:

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: rule-2
     namespace: example-namespace
   spec:
     host: "my-service"
     subsets:
     - name: blue
       labels:
         env: blue
     trafficPolicy:
       connectionPool:
         http:
           maxRequestsPerConnection: 200

   Explanation: Both rules define different traffic policies for the same subset (blue). This results in conflicting settings for maxRequestsPerConnection, leading to inconsistent routing and connection pool behavior.

Recommendation

Combine the settings into a single DestinationRule or split the subsets to avoid overlap, ensuring consistent routing behavior.

1. Combine DestinationRule Settings

   Combine both DestinationRule configurations into a single DestinationRule to avoid conflicts and ensure consistent behavior.

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: combined-destination-rule
     namespace: example-namespace
   spec:
     host: "my-service.example-namespace.svc.cluster.local"
     subsets:
     - name: v1
       labels:
         version: v1
     trafficPolicy:
       loadBalancer:
         simple: LEAST_CONN

2. Split Subsets to Avoid Overlapping

   Ensure that subsets are uniquely defined across DestinationRule objects to prevent overlap.

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: rule-1
     namespace: example-namespace
   spec:
     host: "my-service"
     subsets:
     - name: blue
       labels:
         env: blue
     trafficPolicy:
       connectionPool:
         http:
           maxRequestsPerConnection: 100

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: rule-2
     namespace: example-namespace
   spec:
     host: "my-service"
     subsets:
     - name: green
       labels:
         env: green
     trafficPolicy:
       connectionPool:
         http:
           maxRequestsPerConnection: 200