Skip to main content
Mapagam

Implementing Service Entries

1. Registering External Services

Field Description Example
host Hostname or IP address of the external service api.example.com
ports List of ports exposed by the service [80, 443]
location Indicates whether the service is within or outside the mesh EXTERNAL
resolution How the service is resolved (DNS, STATIC, NONE) DNS

Example: Registering an External Service

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
  - api.example.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS

2. Configuring Service Entry Hosts

Property Value Description
hosts ["reviews.example.com"] List of hostnames or IP addresses to be included in the service entry
addresses ["172.20.0.1"] IP addresses associated with the service entry (optional)
ports [{number: 80, name: "http", protocol: "HTTP"}] Port definitions for the service entry

Example: Basic Service Entry with Hosts

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: reviews-service
spec:
  hosts:
  - reviews.example.com
  addresses:
  - 172.20.0.1
  ports:
  - number: 80
    name: http
    protocol: HTTP

3. Setting Service Entry Ports

Property Values Description
ports [{number} port, string name, string protocol}] Array of port definitions for the service entry. Each port includes a numeric port, optional name, and protocol.

Example: Defining Service Entry Ports

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-service
spec:
  hosts:
  - api.example.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  - number: 80
    name: http
    protocol: HTTP

4. Implementing Service Entry Resolution

Property Description Values Notes
resolution Specifies how the service entry is resolved DNS, STATIC, CLIENT_IP Default is DNS for external services
hosts List of hostnames for the service entry Array of strings Must match DNS names or IP addresses
ports Port definitions for the service entry Array of port objects Each object includes number, name, and protocol
location Location of the service entry in the mesh CLUSTER_LOCAL, EXTERNAL Controls whether the service is internal or external to the mesh

Example: Service Entry with DNS Resolution

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
  - api.example.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: EXTERNAL

Example: Service Entry with Static Resolution

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: internal-db
spec:
  hosts:
  - db.internal.svc.cluster.local
  ports:
  - number: 5432
    name: postgres
    protocol: TCP
  resolution: STATIC
  location: CLUSTER_LOCAL
Note: When using STATIC resolution, the IP addresses must be known at configuration time.
Warning: CLIENT_IP resolution is not supported in all service mesh implementations.

5. Configuring Service Entry Endpoints

Field Description Example
host Hostname or IP address of the service entry api.example.com
ports List of ports exposed by the service entry 
[
  {
    "number": 80,
    "name": "http",
    "protocol": "HTTP"
  }
]
location Location of the service entry (MESH_EXTERNAL or MESH_INTERNAL) MESH_EXTERNAL
resolution How the service entry is resolved (DNS, STATIC, or NONE) DNS

Example: Configuring Service Entry Endpoints

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
  - api.example.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  location: MESH_EXTERNAL
  resolution: DNS

6. Managing Service Entry Location

Property Description Values Notes
location Defines where the service entry is applied in the mesh cluster.local, external Default is cluster.local for internal services
scope Indicates whether the service entry is accessible within or outside the mesh mesh, external Used to control visibility of service entries

Example: Service Entry with Location Configuration

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  location: external
  hosts:
  - api.example.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
Note: Setting location: external allows the service entry to be used for services outside the mesh, such as third-party APIs or cloud services.

7. Implementing Egress Traffic Control

Egress traffic control in service meshes allows you to manage and restrict outbound traffic from services within the mesh. This is crucial for security, compliance, and network policy enforcement.

Property Description Values Notes
egress.host Specifies the destination host for egress traffic api.example.com Must be a valid DNS name or IP address
egress.port Port to which egress traffic is directed 443 Commonly 80 (HTTP) or 443 (HTTPS)
egress.protocol Protocol used for egress traffic HTTP, TCP, HTTPS Must match the service's protocol

Example: Egress Traffic Policy

apiVersion: networking.istio.io/v1beta1
kind: EgressPolicy
metadata:
  name: external-api-policy
spec:
  host: api.example.com
  port: 443
  protocol: HTTPS
Note: Egress policies are typically applied at the namespace or service level to control traffic flow to external services.

8. Configuring External Service Security

Property Description Values Notes
host Hostname or IP address of the external service api.example.com Must be resolvable from the mesh
port Port number for the external service 443 Commonly 80 or 443 for HTTPS
tls.mode Transport Layer Security mode DISABLED, ISTIO_MUTUAL, CLIENT_CERT ISTIO_MUTUAL is recommended for secure communication
tls.certificate Path to certificate file (if using CLIENT_CERT) /etc/certs/client.crt Required if tls.mode is CLIENT_CERT
tls.key Path to private key file (if using CLIENT_CERT) /etc/certs/client.key Required if tls.mode is CLIENT_CERT
tls.caBundle Path to CA bundle for verifying server certificate /etc/certs/ca.crt Used when tls.mode is CLIENT_CERT or ISTIO_MUTUAL

Example: Service Entry with TLS Configuration

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
  - api.example.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS
  tls:
    mode: ISTIO_MUTUAL
Note: When using ISTIO_MUTUAL, Istio will handle the TLS handshake between services in the mesh, ensuring mutual authentication and encryption.

9. Managing Service Entry Workload Selectors

Property Description Values Notes
workloadSelector Defines the workload selector for the service entry object Used to match workloads to the service entry

Example: Defining Workload Selector

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: example-service-entry
spec:
  hosts:
  - example.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  workloadSelector:
    labels:
      app: frontend
      version: v1
Note: The workloadSelector property allows you to define which workloads should be associated with this service entry, enabling fine-grained control over traffic routing.

10. Troubleshooting Service Entry Issues

Issue Potential Cause Solution
Service Entry not resolving Incorrect FQDN or missing DNS configuration Verify the FQDN matches the service name. Ensure DNS is configured to resolve the domain.
Traffic not routing correctly Incorrect port or protocol mismatch Check that the ports and protocols in the ServiceEntry match those used by the service.
Service Entry not applied Namespace mismatch or missing permissions Confirm the ServiceEntry is in the correct namespace and that the user has necessary permissions.
Timeouts or connection errors Service not reachable or misconfigured Validate that the service is up and accessible from the mesh. Check for network policies or firewalls.

Example: Debugging Service Entry

kubectl get serviceentry -n <namespace>
kubectl describe serviceentry <service-entry-name> -n <namespace>
Note: Use istioctl proxy-config to inspect the configuration on a specific proxy instance.
Warning: Ensure that the ServiceEntry does not conflict with existing services in the mesh.

11. Implementing Service Entry for Cloud Services

Field Description Example
host Hostname or IP address of the cloud service api.example.com
ports Port definitions for the service 
[
  {
    "number": 443,
    "name": "https",
    "protocol": "HTTP"
  }
]
location Location of the service (e.g., EXTERNAL) EXTERNAL
resolution How the service is resolved (e.g., DNS, STATIC) DNS

Example: Service Entry for External API

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-api
spec:
  hosts:
  - api.example.com
  ports:
  - number: 443
    name: https
    protocol: HTTP
  location: EXTERNAL
  resolution: DNS
Note: Ensure that the service entry is created in the same namespace as the workload or in a namespace with appropriate permissions.

12. Managing Service Entry Updates

Field Description Example
name Unique identifier for the service entry service-entry-1
host Hostname or IP address of the service api.example.com
ports List of ports exposed by the service 
[
  {
    "number": 80,
    "name": "http",
    "protocol": "HTTP"
  }
]
location Location of the service (MESH_EXTERNAL or MESH_INTERNAL) MESH_EXTERNAL
resolution Resolution method (DNS, STATIC, or NONE) DNS

Example: Update Service Entry with New Port

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: api-service
spec:
  hosts:
  - api.example.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS
Note: Updates to ServiceEntry resources are propagated asynchronously across the mesh. Changes may take some time to reflect in all proxies.

Was this article helpful?

Related Cheat Sheets