<p>I have kubernetes cluster with installed Istio. I have two pods, for example, sleep1 and sleep2 (containers with installed curl). I want to configure istio to permit traffic from sleep1 to www.google.com and forbid traffic from sleep2 to www.google.com.</p>

<p>So, I created ServiceEntry:</p>

<pre><code>---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: google
spec:
  hosts: 
  - www.google.com
  - google.com
  ports: 
  - name: http-port
    protocol: HTTP
    number: 80
  resolution: DNS
</code></pre>

<p>Gateway</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http-port
      protocol: HTTP
    hosts:
    - "*"
</code></pre>

<p>two virtualServices (mesh->egress, egress->google)</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-to-egress
spec:
  hosts: 
  - www.google.com
  - google.com
  gateways:
  - mesh
  http:
  - match:
    - gateways:
      - mesh
      port: 80
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        port:
          number: 80
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: egress-to-google-int
spec:
  hosts: 
  - www.google.com
  - google.com
  gateways:
  - istio-egressgateway
  http:
  - match: 
    - gateways:
      - istio-egressgateway
      port: 80
    route:
    - destination:
        host: google.com
        port:
          number: 80
      weight: 100
</code></pre>

<p>As result, I can curl google from both pods. </p>

<p>And the question again: can i permit traffic from sleep1 to www.google.com and forbid traffic from sleep2 to www.google.com? I know that this is possible to do with kubernetes NetworkPolicy and black/white lists (<a href="https://istio.io/docs/tasks/policy-enforcement/denial-and-list/" rel="nofollow noreferrer">https://istio.io/docs/tasks/policy-enforcement/denial-and-list/</a>), but both methods are forbids (permits) traffic to specific ips or maybe I missed something?</p>

<p>You can create different service accounts for <code>sleep1</code> and <code>sleep2</code>. Then you <a href="https://istio.io/docs/tasks/security/authz-http/#enforcing-service-level-access-control" rel="nofollow noreferrer">create an RBAC policy</a> to limit access to the <code>istio-egressgateway</code> policy, so <code>sleep2</code> will not be able to access any egress traffic through the egress gateway. This should work with forbidding any egress traffic from the cluster, that does not originate from the egress gateway. See <a href="https://istio.io/docs/tasks/traffic-management/egress/egress-gateway/#additional-security-considerations" rel="nofollow noreferrer">https://istio.io/docs/tasks/traffic-management/egress/egress-gateway/#additional-security-considerations</a>.</p>

<p>If you want to allow <code>sleep2</code> access other services, but not <code>www.google.com</code>, you can use Mixer rules and handlers, see <a href="https://istio.io/blog/2018/egress-monitoring-access-control/#access-control-by-mixer-policy-checks-part-2" rel="nofollow noreferrer">this blog post</a>. It shows how to allow a certain URL path to a specific service account.</p>
