TIS0203 - No Matching Labels Found for Subset in Any Host

No matching labels found for this subset in any host.

Recommendation: Ensure Subset Labels Match the Workloads

To make sure subsets are effective, verify that the labels specified in DestinationRule subsets match the labels of workloads associated with the specified host. Correct any mismatches, deploy workloads with appropriate labels, or remove redundant entries.

Examples

1. DestinationRule Subset with Non-Matching Labels

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: non-matching-subset
     namespace: example-namespace
   spec:
     host: "my-service.example-namespace.svc.cluster.local"
     subsets:
     - name: version-mismatch
       labels:
         version: v2

   Explanation: The DestinationRule defines a subset named version-mismatch that references the label version: v2. If no workloads associated with my-service have this label, the subset configuration is ineffective and does not match any pods.

2. Subset with Incorrect Labels

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: incorrect-label-subset
     namespace: example-namespace
   spec:
     host: "another-service.example-namespace.svc.cluster.local"
     subsets:
     - name: env-mismatch
       labels:
         env: staging

   Explanation: The subset named env-mismatch is configured with the label env: staging, but if no workloads of another-service have this label, the subset will not apply to any workloads, leading to ineffective routing.

Recommendation

Ensure the host points to a valid service in this namespace or use an FQDN for other namespaces, or deploy the missing service to the mesh. If the hostname is the same as used elsewhere in the DestinationRule, consider removing the duplicate host entry. Verify that the labels match a workload with the intended service.

1. Update Labels to Match Existing Workloads

   Ensure that the subset labels match labels of workloads associated with the specified service.

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: matching-subset
     namespace: example-namespace
   spec:
     host: "my-service.example-namespace.svc.cluster.local"
     subsets:
     - name: version-match
       labels:
         version: v1

2. Deploy Workloads with Correct Labels

   Deploy or update the workloads to include labels that match the subset configuration.

   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: my-service
     namespace: example-namespace
     labels:
       version: v2
   spec:
     replicas: 1
     selector:
       matchLabels:
         version: v2
     template:
       metadata:
         labels:
           version: v2
       spec:
         containers:
         - name: my-container
           image: my-image

3. Remove Duplicate Host Entries

   If multiple DestinationRule objects define subsets for the same host without adding value, consider removing redundant entries to avoid configuration issues.

   apiVersion: networking.istio.io/v1beta1
   kind: DestinationRule
   metadata:
     name: combined-rule
     namespace: example-namespace
   spec:
     host: "my-service.example-namespace.svc.cluster.local"
     subsets:
     - name: version-v1
       labels:
         version: v1
     - name: version-v2
       labels:
         version: v2