argo-rollouts: 503 Service Unavailable when canary release with istio traffic manage

# Source: demo/templates/rollout.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: demo-rollout-deploy
spec:
  replicas: 1
  strategy:
    rollingUpdate:
      maxSurge: 100%
      maxUnavailable: 0
    type: RollingUpdate
  selector:
    matchLabels:
      app: demo
      release: demo
      app.kubernetes.io/name: demo
      app.kubernetes.io/instance: demo
  template:
    metadata:
      annotations:
        checksum/config: 819666c3c37d0b9a43595609f9bf286d3810e9e129472fdf6cb60cbacae6e1d3
      labels:
        app: demo
        release: demo
        app.kubernetes.io/name: demo
        app.kubernetes.io/instance: demo
    spec:
      imagePullSecrets:
        - name: lilith-image
      serviceAccountName: demo
      containers:
        - name: demo
          env:
            - name: LC_ALL
              value: en_US.utf-8
            - name: LANG
              value: en_US.utf-8
          securityContext:
            {}
          image: "demo:v1"
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
              containerPort: 5000
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /api/live
              port: 5000
          readinessProbe:
            httpGet:
              path: /api/ready
              port: 5000
          resources:
            limits:
              cpu: "1"
              memory: 256Mi
            requests:
              cpu: "1"
              memory: 256Mi
          volumeMounts:
            - mountPath: /app/anti_fraud_server/configs/
              name: demo
      volumes:
        - name: demo
          configMap:
              name: demo
  minReadySeconds: 10
  revisionHistoryLimit: 3
  progressDeadlineSeconds: 600
  strategy:
    canary:
      canaryService: demo-canary-svc
      stableService: demo-prod-svc
      maxUnavailable: 0
      maxSurge: 25%
      steps:
      - pause: {}
      - setWeight: 0
      - pause: {}
      - setWeight: 50
      - pause: {}
      - setWeight: 100
      trafficRouting:
        istio:
          virtualService: 
            name: demo
            routes:
            - demo-vpc
            - demo-public-debug

when I apply my rollout to k8s, a New ReplicaSet created, with istio vsvc traffic 100% to demo-prod-svc

503 Service Unavailable occurred for about 1s in client side.

in this state, no new pods created, demo-prod-svc has no changes.