Envoy Sidecar Memory Explosion
criticalEnvoy sidecar proxies consuming 2GB+ memory per pod, causing OOMKills and degraded service performance. This occurs when Istio pushes massive configurations to sidecars in large clusters or with poorly scoped routing rules.
Monitor istio_go_memstats_heap_allocated_size and istio_mesh_agent_go_memstats_heap_objects for sidecar containers. If memory usage exceeds 1GB per sidecar or grows continuously without stabilizing, configuration scope is too broad. Check for high values in istio_pilot_xds_eds_instances indicating too many endpoints being tracked.
Implement Sidecar resources to limit configuration scope per namespace. Configure egress hosts to only include services the application actually communicates with. Review VirtualService and DestinationRule configurations to remove unused routes. Scale down sidecar memory requests if possible after scoping, or increase limits temporarily while fixing configuration.