diff --git a/api/envoy/api/v2/cds.proto b/api/envoy/api/v2/cds.proto index bfdd3c9bc69a..18bc9b7c7ced 100644 --- a/api/envoy/api/v2/cds.proto +++ b/api/envoy/api/v2/cds.proto @@ -541,7 +541,8 @@ message Cluster { google.protobuf.UInt64Value min_cluster_size = 2; // If set to true, Envoy will not consider any hosts when the cluster is in panic mode. - // Instead, the cluster will fail all requests as if all hosts are unhealthy. + // Instead, the cluster will fail all requests as if all hosts are unhealthy. This can help + // avoid potentially overwhelming a failing service. bool fail_traffic_on_panic = 3; } // Configuration for :ref:`locality weighted load balancing diff --git a/docs/root/intro/arch_overview/upstream/load_balancing/panic_threshold.rst b/docs/root/intro/arch_overview/upstream/load_balancing/panic_threshold.rst index e3222e7307c8..92b1b717f99e 100644 --- a/docs/root/intro/arch_overview/upstream/load_balancing/panic_threshold.rst +++ b/docs/root/intro/arch_overview/upstream/load_balancing/panic_threshold.rst @@ -15,6 +15,8 @@ cluster as load increases. There are two modes Envoy can choose from when in a panic state: traffic will either be sent to all hosts, or will be sent to no hosts (and therefore will always fail). This is configured in the :ref:`cluster configuration `. +Choosing to fail traffic during panic scenarios can help avoid overwhelming potentially failing +upstream services. Panic thresholds work in conjunction with priorities. If the number of available hosts in a given priority goes down, Envoy will try to shift some traffic to lower priorities. If it succeeds in