Yesterday's post about the recent GitHub outage mentioned a detail that was overlooked: the misconfigured autoscaling policy on the service with the saturated Istio sidecar. The policy watched host service load but not sidecar limits, causing it to fail to auto scale correctly.

Autoscaling adjusts resources based on current load. While CPU utilization is a common metric, services can become saturated even with low CPU usage. For example, thread-per-request models can experience saturation when downstream latency causes all threads to block on I/O, as happened to Slack in 2021.

The GitHub writeup suggests the autoscaling policy only accounted for service-level load, ignoring the Istio sidecar. This highlights the component substitution fallacy identified by David Woods - focusing solely on fixing individual components rather than understanding system interactions. The outage involved multiple interacting factors: changing traffic patterns, autoscaling policy, Istio sidecar saturation, retry logic, HAProxy node saturation, and authentication traffic.