<p>I am unable to get circuit breaking configuration to work on my elb through egress config.</p>

<p><strong>ELB</strong>
elb has success rate of 25% (75% 500 error &amp; 25% with status 200),
the elb has 4 instances, only 1 returns a successful response, other instances are configured to returns 500 error for testing purpose. </p>

<p><strong>Setup</strong></p>

<ul>
<li><p>k8s: v1.7.4</p></li>
<li><p>istio: 0.5.0</p></li>
<li>env: k8s on aws</li>
</ul>

<p><strong>Egress rule</strong></p>

<pre><code>apiVersion: config.istio.io/v1alpha2
kind: EgressRule
metadata:
  name: elb-egress-rule
spec:
  destination:
    service: xxxx.us-east-1.elb.amazonaws.com
  ports:
    - port: 80
      protocol: http
</code></pre>

<p><strong>Destination Policy</strong></p>

<pre><code>kind: DestinationPolicy
metadata:
  name: elb-circuit-breaker
spec:
  destination:
    service: xxxx.us-east-1.elb.amazonaws.com
  loadBalancing:
    name: RANDOM
  circuitBreaker:
    simpleCb:
      maxConnections: 100
      httpMaxPendingRequests: 100
      sleepWindow: 3m
      httpDetectionInterval: 1s
      httpMaxEjectionPercent: 100
      httpConsecutiveErrors: 3
      httpMaxRequestsPerConnection: 10
</code></pre>

<p><strong>Route rules:</strong> not set</p>

<p><strong>Testing</strong></p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: sleep
  labels:
    app: sleep
spec:
  ports:
  - port: 80
    name: http
  selector:
    app: sleep
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: sleep
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: sleep
    spec:
      containers:
      - name: sleep
        image: tutum/curl
        command: ["/bin/sleep","infinity"]
        imagePullPolicy: IfNotPresent
</code></pre>

<p>.</p>

<pre><code>export SOURCE_POD=$(kubectl get pod -l app=sleep -o jsonpath={.items..metadata.name})
    kubectl exec -it $SOURCE_POD -c sleep bash
</code></pre>

<p>Sending requests in parallel from the pod</p>

<pre><code>#!/bin/sh
set -m # Enable Job Control
for i in `seq 100`; do # start 100 jobs in parallel
  curl xxxx.us-east-1.elb.amazonaws.com &amp;
done
</code></pre>

<p><strong>Response</strong>
<a href="https://i.stack.imgur.com/zQXmT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zQXmT.png" alt="enter image description here"></a></p>

<p>Currently, Istio considers an <code>Egress Rule</code> to designate a single host. This single host will not be ejected due to the load balancer's panic threshold of Envoy (the sidecar proxy implementation of Istio). The default panic threshold of Envoy is 50%. This means that at least two hosts are required for one host to be ejected, so the single host of an <code>Egress Rule</code> will not be ejected.</p>

<p>This practically means that <code>httpConsecutiveErrors</code> does not effect the external services. This lack of functionality should be partially resolved with <code>External Services</code> of Istio that will replace the <code>Egress Rules</code>.</p>

<p>See documentation of the Istio <code>External Services</code> backed by multiple endpoints -<a href="https://github.com/istio/api/blob/master/routing/v1alpha2/external_service.proto#L113" rel="nofollow noreferrer">https://github.com/istio/api/blob/master/routing/v1alpha2/external_service.proto#L113</a></p>
