Use route-level circuit breaking

How route-level circuit breaking works

Standard Istio circuit breaking uses two settings in the trafficPolicy field of a destination rule:

• ConnectionPoolSettings -- Limits the maximum number of connections, pending requests, and requests per connection to a service. Excess requests are queued, timed out, or retried.

• OutlierDetection -- Periodically scans upstream hosts and ejects unhealthy ones from the load balancing pool based on consecutive errors.

The following example shows a standard Istio destination rule with circuit breaking settings. For more information, see Destination Rule.

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin
spec:
  host: httpbin
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 1
      http:
        http1MaxPendingRequests: 1
        maxRequestsPerConnection: 1
    outlierDetection:
      consecutive5xxErrors: 1
      interval: 1s
      baseEjectionTime: 3m
      maxEjectionPercent: 100

This approach has two limitations:

1. Circuit breaking applies at the service level, not individual APIs or routes.

2. Circuit breaking takes effect only after routing has occurred.

ASM overcomes both limitations through the ASMCircuitBreaker CustomResourceDefinition (CRD). On the data plane, ASM extends the Envoy filter chain with com.aliyun.break filter to evaluate circuit breaking rules *before* the request is routed to the upstream service. On the control plane, the ASMCircuitBreaker CRD provides a declarative interface -- no need to manage the underlying Envoy configuration directly.

Route-level circuit breaking supports both HTTP and gRPC protocols.

Prerequisites

Before you begin, make sure that you have:

• An ASM instance of Enterprise Edition or Ultimate Edition, V1.13.4 or later. See Create an ASM instance

• A cluster added to the ASM instance. See Add a cluster to an ASM instance

• An ingress gateway deployed in the ASM instance. See Create an ingress gateway

• The Bookinfo and HTTPBin services deployed. See Deploy an application in an ASM instance

• kubectl connected to the ASM instance. See Use kubectl on the control plane to access Istio resources

• An Istio gateway and virtual service configured. See Manage Istio gateways and Manage virtual services

• The hey load testing tool installed

• The configuration files for this tutorial downloaded

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - bf2.example.com
    port:
      name: http
      number: 80
      protocol: http

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: bookinfo
  namespace: default
spec:
  gateways:
  - bookinfo-gateway
  hosts:
  - bf2.example.com
  http:
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    name: productpage-route-name1
    route:
    - destination:
        host: productpage
        port:
          number: 9080
  - match:
    - uri:
        prefix: /httpbin
    name: httpbin-route-name1
    rewrite:
      uri: /
    route:
    - destination:
        host: httpbin.foo.svc.cluster.local
        port:
          number: 80

Scenario overview

This tutorial demonstrates route-level circuit breaking with two services behind the same ingress gateway:

• Bookinfo (default namespace) -- serves the /productpage route

• HTTPBin (foo namespace) -- serves the /httpbin route

A circuit breaking rule targets only httpbin-route-name1. When HTTPBin triggers circuit breaking, requests to /httpbin receive a custom error response. Requests to /productpage continue normally, proving that route-level circuit breaking isolates failures to individual routes.

ASMCircuitBreaker field reference

The ASMCircuitBreaker CRD defines circuit breaking rules per route. The following example targets the nginx-route-name1 route on the bf2.example.com:80 virtual host:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMCircuitBreaker
metadata:
  name: ingressgateway
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway
  isGateway: true
  configs:
    - match:
        vhost:
          name: "bf2.example.com"
          port: 80
          route:
            name_match: nginx-route-name1
      breaker_config:
        slow_request_rt: 0.1s
        break_duration: 90s
        window_size: 10s
        max_slow_requests: 10
        min_request_amount: 3
        error_percent:
          value: 60
        custom_response:
          header_to_add:
            x-envoy-circuitbreak: "true"
          body: "hello, break!"
          status_code: 499

For all available fields, see Description of ASMCircuitBreaker fields.

Configure and verify a circuit breaking rule

Create a circuit breaking rule for the httpbin-route-name1 route on the bf2.example.com:80 virtual host, then verify that it triggers correctly and affects only the targeted route.

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMCircuitBreaker
metadata:
  name: ingressgateway
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway
  isGateway: true
  configs:
    - match:
        vhost:
          name: "bf2.example.com"
          port: 80
          route:
            name_match: httpbin-route-name1
      breaker_config:
        slow_request_rt: 0.1s
        break_duration: 90s
        window_size: 10s
        max_slow_requests: 10
        min_request_amount: 3
        error_percent:
          value: 60
        custom_response:
          header_to_add:
            x-envoy-overload: "true"
          body: "hello, break!"
          status_code: 499

kubectl apply -f asmcircuitbreaker-test-gw.yaml

curl -H 'host: bf2.example.com' http://${ASM_GATEWAY_IP}/httpbin/delay/1 -v

curl -H 'host: bf2.example.com' http://${ASM_GATEWAY_IP}/httpbin/status/500 -v

curl -H 'host: bf2.example.com' http://${ASM_GATEWAY_IP}/productpage -v

What to read next

• Description of ASMCircuitBreaker fields

• Manage virtual services

• Destination Rule (Istio documentation)