Alibaba Cloud Service Mesh:Dynamic subset routing

Create the DestinationRule

Apply the following DestinationRule to group endpoints by stage and version. For more information, see Manage destination rules.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: helloworld
  namespace: default
spec:
  host: helloworld.default.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      dynamicSubset:
        subsetSelectors:
          - keys:
              - stage
              - version

ASM reads the stage and version labels from each endpoint and produces the following subsets:

Create the VirtualService

Apply the following VirtualService to map HTTP headers to dynamic subset keys. For more information, see Manage virtual services.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: helloworld
  namespace: default
spec:
  hosts:
    - helloworld.default.svc.cluster.local
  http:
    - headerToDynamicSubsetKey:
        - header: x-version        # Map the x-version header to the "version" grouping key
          key: version
          defaultValue: v3          # Fall back to v3 if the header is absent
        - header: x-stage           # Map the x-stage header to the "stage" grouping key
          key: stage
          defaultValue: prod        # Fall back to prod if the header is absent
      name: default
      route:
        - destination:
            host: helloworld.default.svc.cluster.local
            port:
              number: 8000

This VirtualService establishes two mappings:

• x-version header to version grouping key. Default: v3 when the header is absent.

• x-stage header to stage grouping key. Default: prod when the header is absent.

Verify the routing

Send a request targeting the dev environment, version v1:

kubectl exec -it deploy/sleep -c sleep -- curl -H 'x-stage: dev' -H 'x-version: v1' helloworld:8000

Expected output:

Welcome to helloworld stage: dev, version: v1, ip: 192.168.0.5

The request reaches the pod where stage=dev and version=v1, confirming that dynamic subset routing works correctly.

NO_FALLBACK

NO_FALLBACK is the default behavior. Requests that match no subset return an error. Set it explicitly to make the fail-fast intent clear.

Apply the following DestinationRule. For more information, see Manage destination rules.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: helloworld
  namespace: default
spec:
  host: helloworld.default.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      dynamicSubset:
        subsetSelectors:
          - fallbackPolicy: NO_FALLBACK
            keys:
              - stage
              - version

Verify:

kubectl exec -it deploy/sleep -c sleep -- curl -H 'x-stage: prod' -H 'x-version: v1' helloworld:8000

Expected output:

no healthy upstream

ANY_ENDPOINT

When no subset matches, requests route to any available endpoint regardless of labels.

Apply the following DestinationRule. For more information, see Manage destination rules.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: helloworld
  namespace: default
spec:
  host: helloworld.default.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      dynamicSubset:
        subsetSelectors:
          - fallbackPolicy: ANY_ENDPOINT
            keys:
              - stage
              - version

Verify by sending two requests. Each may land on a different pod:

# First request
kubectl exec -it deploy/sleep -c sleep -- curl -H 'x-stage: prod' helloworld:8000

Example output:

Welcome to helloworld stage: prod, version: v2, ip: 192.168.0.103

# Second request -- targets a non-existent subset
kubectl exec -it deploy/sleep -c sleep -- curl -H 'x-stage: prod' -H 'x-version: v1' helloworld:8000

Example output:

Welcome to helloworld stage: dev, version: v2, ip: 192.168.0.1

Because no prod/v1 subset exists, the request falls back to a random endpoint.

DEFAULT_SUBSET

When no subset matches, requests route to the subset defined in defaultSubset. This is the recommended policy for production workloads because unmatched requests land on a known-good version rather than failing or scattering randomly.

Apply the following DestinationRule. In this example, defaultSubset points to stage=prod, version=v3. For more information, see Manage destination rules.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: helloworld
  namespace: default
spec:
  host: helloworld.default.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      dynamicSubset:
        defaultSubset:
          stage: prod
          version: v3
        subsetSelectors:
          - fallbackPolicy: DEFAULT_SUBSET
            keys:
              - stage
              - version

Verify by sending two requests to the non-existent prod/v1 subset:

kubectl exec -it deploy/sleep -c sleep -- curl -H 'x-stage: prod' -H 'x-version: v1' helloworld:8000

Expected output:

Welcome to helloworld stage: prod, version: v3, ip: 192.168.0.6

kubectl exec -it deploy/sleep -c sleep -- curl -H 'x-stage: prod' -H 'x-version: v1' helloworld:8000

Expected output:

Welcome to helloworld stage: prod, version: v3, ip: 192.168.0.104

Both requests land on the prod/v3 default subset. The two different IPs (192.168.0.6 and 192.168.0.104) reflect load balancing across the two prod-v3 replicas.

Create the DestinationRule

Apply the following DestinationRule to group pods by IP address. For more information, see Manage destination rules.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: helloworld
  namespace: default
spec:
  host: helloworld.default.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      dynamicSubset:
        defaultSubset:
          stage: prod
          version: v3
        subsetSelectors:
          - keys:
              - '%ip%'

Create the VirtualService

Map the x-ip header to the %ip% key so that the header value specifies the target pod IP. For more information, see Manage virtual services.

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: helloworld
  namespace: default
spec:
  hosts:
    - helloworld.default.svc.cluster.local
  http:
    - headerToDynamicSubsetKey:
        - header: x-ip
          key: '%ip%'
      name: default
      route:
        - destination:
            host: helloworld.default.svc.cluster.local
            port:
              number: 8000

Verify the routing

Send multiple requests targeting pod IP 192.168.0.6:

kubectl exec -it deploy/sleep -c sleep -- curl -H 'x-ip: 192.168.0.6' helloworld:8000

Expected output (consistent across repeated calls):

Welcome to helloworld stage: prod, version: v3, ip: 192.168.0.6

Every request lands on the same pod, confirming IP-based pinning.

VirtualService

DestinationRule

ASM extends the trafficPolicy structure with the dynamicSubset field.

Built-in workload attributes