DevOps · Flashcard
Under mesh-wide mTLS, adding a DestinationRule starts returning 503s. What is the usual cause?
- AIts traffic policy defaults TLS to DISABLE, so the client now sends plaintext
- BIts subsets carry no matching labels, so the client has nowhere to send traffic
- CIts connection-pool limit trips before the first request has time to complete
- DIt picks a locality load-balancer setting the cluster cannot resolve
Why this is the answer
A DestinationRule with a trafficPolicy but no tls block leaves the mode at DISABLE, so the client sidecar sends plaintext to a server that expects mTLS and the connection fails — the fix is tls: mode: ISTIO_MUTUAL. Label-less subsets fail differently, with no healthy upstream; connection-pool limits produce UO overflow flags; and an unusable locality setting falls back rather than returning 503.
Official docs