DestinationRule is a resource that adds additional routing policies after routing happens to a Service, for example say that you have the following service:

apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: default
spec:
  selector:
    app: my-service
  ports:
    - name: http
      protocol: TCP
      port: 80

This Service can route to multiple resources, it picks up any pod which contains label app: my-service, which means you can have, for example, different versions of the same service running in parallel using one deployment for each.

Now, with a DestinationRule you can add additional routing policies on top of that, a subset means part of your pods which you can identify through labels, for example:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-service-ab
spec:
  host: my-service.default.svc.cluster.local
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
  subsets:
  - name: a-test
    labels:
      version: v3
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN

This DestinationRule uses a round robin load balancing policy for all traffic going to a subset named a-test that is composed of endpoints (e.g., pods) with labels (version:v3). This can be useful for scenarios such as A/B testing, or to keep multiple versions of you service running in parallel.

Also, you can specify custom TrafficPolicies for a subset that will override TrafficPolicies defined at a Service level.