ServiceEntry and VirtualService for CloudEndpoint result in 503

1

hi. i’m trying to create ServiceEntry + VirtualService for CloudRun endpoint.
i have the following:

    apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: cloudrun-routes
    spec:
      hosts:
      - "*"
      gateways:
      - istiogateway
      http:
      - name: "my-cloud-run"
        match:
        - uri:
            prefix: /my-cloud-run/
        rewrite:
          uri: /
        route:
        - destination:
            host: <my-public-endpoint-for-cloud-run>
            port:
              number: 443

and:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: my-cloud-run
spec:
  hosts:
  - <my-public-endpoint-for-cloud-run>
  location: MESH_EXTERNAL
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS

and when using this i get 503 Upstream connect error or disconnect/reset before headers. reset reason: connection termination.
what am i doing wrong?