<p>In Istio, I was wondering why VirtualService and DestinationRule are separated into two separate config files? AFAICT, the DestinationRule defines the subset and the VirtualService routes to the subset. Obviously, they both do more than just that, but my question is, what could have been the design thought behind separating the two. Why couldn't we have defined the subset in the VirtualService yaml itself?</p>

<p>A follow-on question is: Why is the circuit-breaker rules configured in the destination rule, while the timeouts and retries are configured in the VirtualService? Again, I guess, I am unable to comprehend the reasoning behind this design decision. If that is clear, both questions may be answered simultaneously. Any help in understanding this conceptually will be much appreciated. </p>

<p>They were designed to provide a clear separation of routing from post-routing behaviors.</p>

<p>A VirtualService is used to describe the mapping (route rules) from one or more user-addressable destinations (hosts) to the actual destination workloads (services) inside the mesh.</p>

<p>A DestainationRule then defines the set of policies to be applied to a request after VirtualService routing has occurred. They are intended to be authored by service owners, describing the circuit breakers, load balancer settings, TLS settings, etc.</p>

<p>An overview of how they work is <a href="https://istio.io/docs/concepts/traffic-management/#rule-configuration" rel="nofollow noreferrer">here</a>.</p>
