VirtualService route to a destination host declared in ServiceEntry not working

Hello,
I’m trying to write a VirtualService that shall direct traffic to a specific destination host following a regex. That specific destination is not a service inside the Mesh but a host that I declared with a ServiceEntry (MESH_EXTERNAL). The documentation clearly says that this should be possible :
“The name of a service from the service registry. Service names are looked up from the platform’s service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by ServiceEntry . Traffic forwarded to destinations that are not found in either of the two, will be dropped.” (https://istio.io/docs/reference/config/networking/virtual-service/#Destination)

However I can not make it work. When choosing a service inside the mesh, the VirtualService correctly direct traffic to the pods, and when I try to put an host I only get 503 (UC).

My version of Istio is 1.4.3 and I configured it with REGISTRY_ONLY Outbound policy.

Here are the two files for VirtualService and ServiceEntry.

---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-svc-https
  namespace: ns
spec:
  hosts:
  - myhost.com
  - www.myhost.com
  ports:
  - number: 443
    name: https
    protocol: TLS
  exportTo: 
  - "."
  resolution: DNS
  location: MESH_EXTERNAL

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  labels:
    app: docs-app
  name: docs-app
  namespace: ns
spec:
  gateways:
  - istio-system/ingress-gateway
  hosts:
  - docs-app.com
  http:
  - match:
    - uri:
        regex: ^\/(downloads|releases)\/.*
    route:
    - destination:
        host: myhost.com
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: docs-app.ns.svc.cluster.local
        port:
          number: 9090

Thanks for your answers.

1 Like