I setup health checking. When I fail some hosts, Envoy starts routing to all of them again. Why?

This feature is known as the load balancer panic threshold. It is used to prevent cascading failure when upstream hosts start failing health checks in large numbers.