<p>I am trying to enable a deployment in the gateway namespace to send metrics to an external service at <code>engine-report.apollodata.com</code></p>

<p>I have written the following service entry and virtual service rules, as per the <a href="https://istio.io/docs/tasks/traffic-management/egress/" rel="nofollow noreferrer">Istio documentation</a> yet no traffic is able to access the endpoint.</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: apollo-engine-ext
  namespace: {{ .Release.Namespace }}
  labels:
      chart: {{ .Chart.Name }}
      release: {{ .Release.Name }}
      heritage: {{ .Release.Service }}
spec:
  hosts:
  - '*.apollodata.com'
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: apollo-engine-ext
  namespace: {{ .Release.Namespace }}
  labels:
      chart: {{ .Chart.Name }}
      release: {{ .Release.Name }}
      heritage: {{ .Release.Service }}
spec:
  hosts:
  - '*.apollodata.com'
  tls:
  - match:
    - port: 443
      sni_hosts:
      - '*.apollodata.com'
    route:
    - destination:
        host: '*.apollodata.com'
        port:
          number: 443
      weight: 100
</code></pre>

<p>What might be causing this issue</p>

<p>I think the problem is that you are using DNS resolution in a ServiceEntry with a wildcard host. According to the <a href="https://istio.io/docs/reference/config/istio.networking.v1alpha3/#ServiceEntry-Resolution" rel="nofollow noreferrer">documentation</a>, if there are no endpoints in the ServiceEntry the DNS resolution will only work if the host is not a wildcard.</p>

<p>If the endpoints are DNS resolvable by the application, then it should work if you set the resolution to NONE.</p>
