<p>We have a cluster with Istio, but there is this one condition, I can't find how to fulfill.</p>

<p>We need one of the services to have certain restrictions within the mesh as well, and to talk to one external endpoint. Through <code>Sidecar</code> object, I should be able to set the restrictions internally, but I don't know how to restrict to one external endpoint.</p>

<p>I can set the external endpoint in the <code>Sidecar</code> object as well, but I have to create a <code>ServiceEntry</code> anyways, in which case all the services can talk to that external endpoint.</p>

<p>It seems that what I need is to set a <code>ServiceEntry</code> for one specific service, but this is not possible. Is there any other way to achieve this?</p>

<p>I asked this <a href="https://github.com/istio/istio/issues/24019" rel="nofollow noreferrer">question on GitHub</a>; to Istio team, and the only way to achieve this is putting the service in a different namespace, and make the <code>ServiceEntry</code> to apply to the workloads only in that namespace through <code>exportTo</code> parameter.</p>

<p>The <code>ServiceEntry</code> would look like this:</p>

<pre><code>apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: se-demo
spec:
  exportTo:
  - .                 # with ".", we are saying the ServiceEntry to only apply to the workloads in the same namespace.
  hosts:
  - www.google.com
  location: MESH_EXTERNAL
  ports:
  - name: https
    number: 443
    protocol: HTTPS
  resolution: DNS
</code></pre>
