Istio Circuit Breaker who trips it?

Question

I am currently doing research on the service mesh Istio in version 1.6. The data plane (Envoy proxies) are configured by the controle plane.

1. When I configure a Circuit Breaker by creating a Destination rule and the circuit breaker opens, does the client side sidecar proxy already return the 503 or the server side sidecar proxy?
2. Does the client side sidecar proxy route the request to another available instance of the service automatically or does it simply return the 503 to the application container?

Thanks in advance!

Answer 1

1. In the log entries, you can inspect them to figure out both end of the connection that was stopped by the circuit breaker. IP addresses of both sides of the connection are present in the log message from the istio-proxy container.

  {
  insertId: "..."
  labels: {
    k8s-pod/app: "circuitbreaker-jdwa8424"
    k8s-pod/pod-template-hash: "..."
  }
  logName: ".../logs/stdout"
  receiveTimestamp: "2020-06-09T05:59:30.209882320Z"
  resource: {
    labels: {
      cluster_name: "..."
      container_name: "istio-proxy"
      location: "..."
      namespace_name: "circuit"
      pod_name: "circuit-service-a31cb334d-66qeq"
      project_id: "..."
    }
    type: "k8s_container"
  }
  severity: "INFO"
  textPayload: "[2020-06-09T05:59:27.854Z] UO 0 0 0 "-" - - 172.207.3.243:443 10.1.13.216:36774 "
  timestamp: "2020-06-09TT05:59:28.071001549Z"
  }

The message is coming from istio-proxy container which runs Envoy that was affected by CircuitBreaker policy that request was sent to. Also there is the IP address of both the source and destination of the connection that was interrupted.

2. It will return 503. There is option to configure retries, however I did not test its synergy with CircuitBreaker and if the retry actually will go to different pod if previous returned an error.

Also take a look at the most detailed explanation of CircuitBreaker I managed to find.

Hope it helps.