Demo 1 Service Entries

This guide shows how to use Istio ServiceEntry to control outbound traffic from the mesh and how to route mesh-originating egress through an Istio Egress Gateway. Follow the steps below to:

Install Istio with outboundTrafficPolicy = REGISTRY_ONLY.
Observe behavior before and after automatic sidecar injection.
Create a ServiceEntry allowing egress to www.wikipedia.org.
Configure an Egress Gateway + DestinationRule + VirtualService to force mesh traffic through the egress gateway.
Verify traffic and inspect egress gateway logs.

Prerequisites:

kubectl configured with a cluster
Permissions to install Istio and create resources
istioctl available (instructions below)

1) Install Istio (set outboundTrafficPolicy to REGISTRY_ONLY)

Download the desired Istio release and add istioctl to your PATH:

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.18.2 sh -
export PATH=$PWD/istio-1.18.2/bin:$PATH
which istioctl
# e.g. /root/istio-1.18.2/bin/istioctl

Dump the demo profile to a file, edit it, and change the mesh config to REGISTRY_ONLY:

istioctl profile dump demo -o yaml > demo.yaml
vim demo.yaml

Update meshConfig.outboundTrafficPolicy.mode inside demo.yaml:

meshConfig:
  outboundTrafficPolicy:
    mode: REGISTRY_ONLY
  accessLogFile: /dev/stdout
  defaultConfig:
    proxyMetadata: {}
  enablePrometheusMerge: true

Install Istio using the modified profile:

istioctl install -f demo.yaml

Verify Istio system pods are running:

kubectl get pods -n istio-system

Be aware: REGISTRY_ONLY blocks outbound traffic to external services unless they’re registered with Istio (for example, via a ServiceEntry). Use ServiceEntry to explicitly allow specific external hosts when using this policy.

2) Create a test pod (nginx) and test connectivity before injection

Run a simple test pod. Note: the official nginx image may not include curl. If curl is missing, use a curl-enabled image (for example, curlimages/curl) or install curl in the pod. Create and exec into the pod:

kubectl run test --image=nginx --restart=Never
kubectl exec -ti test -- /bin/sh

From inside the container, test outbound access to Wikipedia (fetch headers only):

curl --head -L http://www.wikipedia.org

If the pod is not Istio-injected, you should see an HTTP 301 redirect and then 200 headers:

HTTP/1.1 301 Moved Permanently
location: https://www.wikipedia.org
server: HAProxy

HTTP/2 200
server: ATS/9.2.9
content-type: text/html
...

Exit the pod shell:

exit

3) Enable automatic sidecar injection for the namespace and re-run the test

Label the default namespace for Istio automatic sidecar injection, then recreate the test pod:

kubectl label namespace default istio-injection=enabled
kubectl delete pod test
kubectl run test --image=nginx --restart=Never
kubectl get pods
# test should show 2/2 when the sidecar is injected
kubectl exec -ti test -- /bin/sh
curl --head -L http://www.wikipedia.org

With outboundTrafficPolicy = REGISTRY_ONLY and no ServiceEntry, the sidecar will block the external request. The sidecar returns a 502 Bad Gateway:

HTTP/1.1 502 Bad Gateway
date: ...
server: envoy

Exit the pod shell:

exit

Labeling a namespace with istio-injection=enabled enables automatic sidecar injection for new pods in that namespace. Existing pods must be recreated to receive a sidecar.

4) Create a ServiceEntry for www.wikipedia.org to allow egress

Create a ServiceEntry in the same namespace as the test pod (default) to register www.wikipedia.org with Istio so sidecars can allow and route traffic. service_entry.yaml

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: wikipedia-egress
spec:
  hosts:
  - www.wikipedia.org
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL

Apply the ServiceEntry:

kubectl apply -f service_entry.yaml
kubectl get serviceentries.networking.istio.io
# Should show wikipedia-egress in default namespace

Exec into the test pod and retry the curl. With the ServiceEntry present, you should see 301 → 200 responses:

kubectl exec -ti test -- /bin/sh
curl --head -L http://www.wikipedia.org
# expect 301 -> 200 responses
exit

5) Configure an Egress Gateway, DestinationRule, and VirtualService

To route mesh-originating traffic through an Istio egress gateway, create three resources:

Gateway that selects the egress gateway pod (selector must match egress pod labels).
DestinationRule pointing to the egress gateway service/subset.
VirtualService that routes mesh traffic to the egress gateway and configures how the egress gateway forwards to the external host.

Confirm the egress gateway pod and labels:

kubectl get pods -n istio-system --show-labels
# Look for egress gateway pod labels, e.g. istio=egressgateway or app=istio-egressgateway

Create the Gateway selecting the egress gateway (selector must match labels): gateway.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - www.wikipedia.org

Apply the Gateway:

kubectl apply -f gateway.yaml
kubectl get gateways.networking.istio.io

Create a DestinationRule that points traffic to the egress gateway service from the default namespace: destinationrule.yaml

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-wikipedia
  namespace: default
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
    - name: wikipedia

Apply the DestinationRule:

kubectl apply -f destinationrule.yaml
kubectl get destinationrules.networking.istio.io

Now create the VirtualService that handles two routing phases:

mesh-originating requests: match gateways: [mesh] and route to the egress gateway service subset.
gateway-handled requests: match gateways: [istio-egressgateway] and forward to the external host.

virtualservice.yaml

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: wikipedia-egress-gateway
spec:
  hosts:
    - www.wikipedia.org
  gateways:
    - istio-egressgateway
    - mesh
  http:
    - match:
        - gateways:
            - mesh
          port: 80
      route:
        - destination:
            host: istio-egressgateway.istio-system.svc.cluster.local
            subset: wikipedia
            port:
              number: 80
          weight: 100
    - match:
        - gateways:
            - istio-egressgateway
          port: 80
      route:
        - destination:
            host: www.wikipedia.org
            port:
              number: 80
          weight: 100

Apply the VirtualService:

kubectl apply -f virtualservice.yaml
kubectl get virtualservices.networking.istio.io
# Should list wikipedia-egress-gateway with gateways ["istio-egressgateway","mesh"]

6) Verify traffic flows through the egress gateway and tail logs

Tail logs from the egress gateway deployment in one terminal (replace resource if different):

kubectl logs -f -n istio-system deployment/istio-egressgateway

In another terminal, exec into the test pod and perform the request:

kubectl exec -ti test -- /bin/sh
curl --head -L http://www.wikipedia.org
exit

Expected results:

The test pod still sees the normal 301 → 200 responses.
Egress gateway logs include the forwarded request. Example Envoy log snippet:

"HEAD / HTTP/2" 301 - via_upstream ... "www.wikipedia.org" "208.80.153.224:80" outbound|80||www.wikipedia.org ...

Important: To force mesh-originating traffic through an Istio egress gateway, the VirtualService must include the mesh gateway in gateways and have a match for gateways: [mesh]. Without this, sidecar proxies are not instructed to route to the egress gateway and traffic may go directly to the Internet or be blocked by REGISTRY_ONLY.

7) Example: VirtualService without mesh vs with mesh

VirtualService that only lists the egress gateway (no mesh) — this handles requests arriving at the egress gateway but does not instruct pods inside the mesh to send requests to the gateway:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: wikipedia-egress-gateway-no-mesh
spec:
  hosts:
    - www.wikipedia.org
  gateways:
    - istio-egressgateway
  http:
    - match:
        - gateways:
            - istio-egressgateway
          port: 80
      route:
        - destination:
            host: www.wikipedia.org
            port:
              number: 80
          weight: 100

The VirtualService shown in step 5 (the virtualservice.yaml) includes mesh and explicitly routes mesh-originating traffic to the egress gateway before the gateway forwards it to the external host.

8) Notes, exam tips, and quick reference

ServiceEntry registers external services (DNS hosts, IPs, ranges) with Istio so sidecars will allow and route egress traffic when outbound policy is REGISTRY_ONLY.
Egress gateway pattern typically uses three resources:
- Gateway: selects the egress proxy pod.
- DestinationRule: targets the egress gateway service/subset.
- VirtualService: routes mesh traffic to the gateway and gateway traffic to the external host.
For exams and real-world tasks: keep templates handy and update hosts, ports, resolution, and namespaces quickly.
Many orgs do not send all Internet traffic through an egress gateway, but doing so enables centralized monitoring, policy enforcement, and security controls.

Resources quick reference:

Resource	Purpose	Example location
ServiceEntry	Register external host(s) so sidecars permit egress	`default` namespace
Gateway	Selects egress gateway pod and defines server/host	`istio-system` (egressgateway)
DestinationRule	Directs traffic to egress gateway service/subset	`default` (targets `istio-egressgateway.istio-system.svc.cluster.local`)
VirtualService	Routes mesh -> egress gateway, and gateway -> external host	`default` namespace

9) Useful ServiceEntry examples

ServiceEntry for multiple HTTPS external hosts:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-svc-https
spec:
  hosts:
    - api.dropboxapi.com
    - www.googleapis.com
    - api.facebook.com
  location: MESH_EXTERNAL
  ports:
    - number: 443
      name: https
      protocol: TLS
  resolution: DNS

ServiceEntry for external cluster with static endpoints:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-svc-mongocluster
spec:
  hosts:
    - mymongodb.somedomain
  addresses:
    - 192.192.192.192/24
  ports:
    - number: 27018
      name: mongod
      protocol: MONGO
  location: MESH_INTERNAL
  resolution: STATIC
  endpoints:
    - address: 2.2.2.2
    - address: 3.3.3.3

Wildcard host ServiceEntry:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-svc-wildcard-example
spec:
  hosts:
    - "*.bar.com"
  location: MESH_EXTERNAL
  ports:
    - number: 80
      name: http
      protocol: HTTP
  resolution: NONE

That wraps up ServiceEntry and egress gateway basics. Practice creating these manifests and verifying behavior by tailing egress gateway logs and testing from pods both with and without sidecar injection. Links and references:

Introduction

Installation & Configuration

Traffic Management

Securing Workloads

Troubleshooting

Conclusion

Demo 1 Service Entries

1) Install Istio (set outboundTrafficPolicy to REGISTRY_ONLY)

2) Create a test pod (nginx) and test connectivity before injection

3) Enable automatic sidecar injection for the namespace and re-run the test

4) Create a ServiceEntry for www.wikipedia.org to allow egress

5) Configure an Egress Gateway, DestinationRule, and VirtualService

6) Verify traffic flows through the egress gateway and tail logs

7) Example: VirtualService without mesh vs with mesh

8) Notes, exam tips, and quick reference

9) Useful ServiceEntry examples

Watch Video

Practice Lab

​1) Install Istio (set outboundTrafficPolicy to REGISTRY_ONLY)

​2) Create a test pod (nginx) and test connectivity before injection

​3) Enable automatic sidecar injection for the namespace and re-run the test

​4) Create a ServiceEntry for www.wikipedia.org to allow egress

​5) Configure an Egress Gateway, DestinationRule, and VirtualService

​6) Verify traffic flows through the egress gateway and tail logs

​7) Example: VirtualService without mesh vs with mesh

​8) Notes, exam tips, and quick reference

​9) Useful ServiceEntry examples

Watch Video

Practice Lab

1) Install Istio (set outboundTrafficPolicy to REGISTRY_ONLY)

2) Create a test pod (nginx) and test connectivity before injection

3) Enable automatic sidecar injection for the namespace and re-run the test

4) Create a ServiceEntry for www.wikipedia.org to allow egress

5) Configure an Egress Gateway, DestinationRule, and VirtualService

6) Verify traffic flows through the egress gateway and tail logs

7) Example: VirtualService without mesh vs with mesh

8) Notes, exam tips, and quick reference

9) Useful ServiceEntry examples