If a host in a cluster starts returning 5xx the host will only be ejected once.
If the host still returns 5xx after base_ejection_time_ms the host will not be ejected again until it has served a non 5xx response: https://github.com/lyft/envoy/blob/master/source/common/upstream/outlier_detection_impl.cc#L57

Should the consecutive_5xx_ counter be reset on ejection or set to (detector->config().consecutive5xx() -1) (leaving the circuit breaker in an half-open state) ?

I believe this is what they are seeing in istio/old_pilot_repo#1054