<p>What are the key benefits of using <code>ServiceEntry</code> when I can simply create <code>Service</code>(and if this service is a set of external IPs then define <code>Endpoints</code> instead of <code>selector</code>). In which cases I can't rely on <code>Service</code>?</p>

<p>I would say key benefits are mentioned in the <a href="https://istio.io/docs/concepts/traffic-management/#service-entries" rel="nofollow noreferrer">documentation</a>, you can configure the traffic route, define retry, timeouts, fault injection etc.</p>

<blockquote>
  <p>A service entry describes the properties of a service (<strong>DNS name, VIPs, ports, protocols, endpoints</strong>). These services could be external to the mesh (e.g., web APIs) or mesh-internal services that are not part of the platform’s service registry (e.g., a set of VMs talking to services in Kubernetes).</p>
</blockquote>

<hr>

<blockquote>
  <p><strong>You use a <a href="https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry" rel="nofollow noreferrer">service entry</a> to add an entry to the service registry that Istio maintains internally.</strong> <strong>After you add the service entry, the Envoy proxies can send traffic to the service as if it was a service in your mesh.</strong> Configuring service entries allows you to manage traffic for services running outside of the mesh, including the following tasks:</p>
</blockquote>

<ul>
<li><strong>Redirect and forward traffic for external destinations, such as APIs
consumed from the web, or traffic to services in legacy
infrastructure.</strong></li>
<li><strong>Define <a href="https://istio.io/docs/concepts/traffic-management/#retries" rel="nofollow noreferrer">retry</a>, <a href="https://istio.io/docs/concepts/traffic-management/#timeouts" rel="nofollow noreferrer">timeout</a>, and <a href="https://istio.io/docs/concepts/traffic-management/#fault-injection" rel="nofollow noreferrer">fault injection</a> policies for external
destinations.</strong></li>
<li><strong>Run a mesh service in a Virtual Machine (VM) by <a href="https://istio.io/docs/examples/virtual-machines/" rel="nofollow noreferrer">adding VMs to your
mesh.</a></strong></li>
<li><strong>Logically add services from a different cluster to the mesh to
configure a <a href="https://istio.io/docs/setup/install/multicluster/gateways/#configure-the-example-services" rel="nofollow noreferrer">multicluster Istio mesh</a> on Kubernetes.</strong></li>
</ul>

<blockquote>
  <p>You don’t need to add a service entry for every external service that you want your mesh services to use. By default, Istio configures the Envoy proxies to passthrough requests to unknown services. However, you can’t use Istio features to control the traffic to destinations that aren’t registered in the mesh.</p>
  
  <p>The following example mesh-external service entry adds the ext-svc.example.com external dependency to Istio’s service registry:</p>
</blockquote>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: svc-entry
spec:
  hosts:
  - ext-svc.example.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS
</code></pre>

<blockquote>
  <p>You specify the external resource using the hosts field. You can qualify it fully or use a wildcard prefixed domain name.</p>
  
  <p><strong>You can configure virtual services and destination rules to control traffic to a service entry in a more granular way, in the same way you configure traffic for any other service in the mesh.</strong> For example, the following destination rule configures the traffic route to use mutual TLS to secure the connection to the ext-svc.example.com external service that we configured using the service entry:</p>
</blockquote>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ext-res-dr
spec:
  host: ext-svc.example.com
  trafficPolicy:
    tls:
      mode: MUTUAL
      clientCertificate: /etc/certs/myclientcert.pem
      privateKey: /etc/certs/client_private_key.pem
      caCertificates: /etc/certs/rootcacerts.pem
</code></pre>

<blockquote>
  <p>See the <a href="https://istio.io/docs/reference/config/networking/service-entry/" rel="nofollow noreferrer">Service Entry reference</a> for more possible configuration options.</p>
</blockquote>
