<p>I run <code>istio</code> on <code>Kubernetes</code>. I want to know how the envoy sidecar works. For example, after sidecar is injected into the pod, the original container cannot access the outer network without <code>EgressRule</code>. How does it work?</p>

<p>All the traffic inside the pod is captured by <a href="https://en.wikipedia.org/wiki/Iptables" rel="noreferrer">iptables commands</a> and directed to the sidecar proxy. Then the sidecar proxy performs routing, according to routing tables it receives from Istio Pilot (a part of the <a href="https://blog.envoyproxy.io/service-mesh-data-plane-vs-control-plane-2774e720f7fc" rel="noreferrer">Istio Control Plane</a>). The routing tables are based on the Kubernetes services and on the Istio <a href="https://istio.io/docs/reference/config/istio.routing.v1alpha1.html#RouteRule" rel="noreferrer">RouteRules</a>. Since Istio cannot know anything about the external services, it cannot route the traffic to the external services without an <a href="https://istio.io/docs/reference/config/istio.routing.v1alpha1.html#EgressRule" rel="noreferrer">EgressRule</a> defined. <code>EgressRules</code> define the routing tables for the external services.</p>
