Limit traffic to a external service

Networking
1

I have Kubernetes with Istio installed.

I am trying to limit external traffic to a host (for example checkip.amazonaws.com). This will be applied to all services in a namespace (konta in the example). All the pods already have sidecar proxy injected.

I used the following configuration but with no success.

apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
  name: quotahandler
  namespace: konta
spec:
  compiledAdapter: memquota
  params:
    quotas:
    - name: requestcountquota.instance.konta
      maxAmount: 5
      validDuration: 60s
      rateLimitAlgorithm: ROLLING_WINDOW
---
apiVersion: config.istio.io/v1alpha2
kind: instance
metadata:
  name: requestcountquota
  namespace: konta
spec:
  compiledTemplate: quota
  params:
    dimensions:
      #source: "unknown"
      source: request.headers["x-forwarded-for"] | "unknown"
      #destination: 
      #destination: destination.labels["app"] | destination.service.name | "unknown"
      #destinationVersion: destination.labels["version"] | "unknown"
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpec
metadata:
  name: request-count
  namespace: konta
spec:
  rules:
  - quotas:
    - charge: 1
      quota: requestcountquota
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpecBinding
metadata:
  name: request-count
  namespace: konta
spec:
  quotaSpecs:
  - name: request-count
    namespace: konta
  services:
    - service: '*'  # Uncomment this to bind *all* services to request-count
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: quota
  namespace: konta
spec:
  # quota only applies if you are not logged in.
  # match: match(request.headers["cookie"], "user=*") == false
  match: match(destination.service.host, "checkip.amazonaws.com") == true 
  actions:
  - handler: quotahandler
    instances:
    - requestcountquota

I am testing with a simple curl pod.

kubectl run -i --tty get-ip-address --image=dwdraju/alpine-curl-jq --restart=Never -n konta

and

curl checkip.amazonaws.com