<p>I have one question regarding ServiceEntry in Istio.
As I can see in the guides it says that we can use <a href="https://istio.io/latest/docs/reference/config/networking/sidecar/#WorkloadSelector" rel="nofollow noreferrer">workloadSelector</a> to select one or more Kubernetes pods of the MESH_INTERNAL to direct traffic into them.
That means that we can route traffic directly to a kuberneted pod without the usage of a kubernetes service?</p>
<p>Let's say for example that meshservice1 wants to call meshservice2.</p>
<p>The below are the labels of meshservice2 pods.</p>
<pre><code>kind: Pod
  labels:
    app.name: meshservice2
  name: meshservice2
</code></pre>
<p>and below is its service-entry</p>
<pre><code>kind: ServiceEntry
metadata:
  labels:
    app.name: meshservice2
spec:
  hosts:
    - meshservice2.test
  location: MESH_INTERNAL
  ports:
    - name: http
      number: 80
      protocol: HTTP
  resolution: STATIC
  workloadSelector:
    labels:
      app.name: meshservice2
</code></pre>
<p>Is the above two enough to call meshservice2.test succesfully from meshservice1 pods without the definition of a kubernetes svc for memservice2?</p>
<p>I tried it that way, it connects to the other service but I receive 503 response code.
When I add a kubernetes svc for meshservice2 evrything works as expected.</p>
<p>I am just wondering if I can safely discard kubernetes svc from my app for mesh internal calls.</p>

<p>I don't think that is how it works. meshservice1 sidecar needs to know where to contact meshservice2, it's used Kubernetes service to get the latest endpoint IP of meshservice2 itself.</p>
<p>alternatively, you can use spec.endpoints, but you need to update everytime Pod IP is change.</p>
