<p>We are using Istio with <code>outboundTrafficPolicy.mode</code> set to <code>REGISTRY_ONLY</code>. We whitelist a number of domains using <code>ServiceEntries</code> and a <code>Sidecar</code> configuration, and these all work fine.</p>
<p>However, trying to whitelist an IP address and use HTTPS does not work. Here is the <code>ServiceEntry</code> we are using:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  labels:
    app: test
  name: test-external-deps
  namespace: realistic-doubles
spec:
  addresses:
    - 54.xx.xx.xx
  endpoints:
    - address: 54.xx.xx.xx
  exportTo:
    - .
  hosts:
    - fakehost3.internal
  location: MESH_EXTERNAL
  ports:
    - name: https
      number: 8443
      protocol: TLS
  resolution: STATIC
</code></pre>
<p>When we curl this IP outside Istio, we get a response back fine. But in the mesh, we get:</p>
<pre><code>root@trading-api-99f85fdbc-vskdg:/app# curl -v -k https://54.xx.xx.xx:8443
* Expire in 0 ms for 6 (transfer 0x561ea5c1ff50)
*   Trying 54.xx.xx.xx...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x561ea5c1ff50)
* Connected to 54.xx.xx.xx (54.xx.xx.xx) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 54.xx.xx.xx:8443
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to 54.xx.xx.xx:8443
</code></pre>
<p>The envoy access logs show this, which seems to be consistent with other requests that get blocked:</p>
<pre><code>[2020-07-21T17:27:43.240Z] &quot;- - -&quot; 0 UH &quot;-&quot; &quot;-&quot; 0 0 0 - &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; &quot;-&quot; - - 54.xx.xx.xx:8443 10.xx.xx.xx:48738 - -
</code></pre>
<p>How do we whitelist this external IP so it won't be blocked by Envoy?</p>

Jesse Bye
<p>I found out what I was missing. Adding a <code>ServiceEntry</code> alone was not sufficient. I also needed to update the <code>Sidecar</code> config to list the fake hostname, like so:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: test
  namespace: realistic-doubles
  labels:
    app: test
spec:
  workloadSelector:
    labels:
      app.kubernetes.io/name: test
  egress:
    - hosts:
        - &quot;./fakehost3.internal&quot;
</code></pre>
<p>After adding that, I am able to resolve the static IP from my pod just fine!</p>
