<p>I have a k8s cluster with latest istio installed.  I also have the outbound traffic policy set to only allow k8s services and things defined by service entries.  I have read <a href="https://istio.io/latest/docs/tasks/traffic-management/egress/http-proxy/" rel="nofollow noreferrer">https://istio.io/latest/docs/tasks/traffic-management/egress/http-proxy/</a> and implemented it.  But I only want to allow some traffic to the proxy.  To be specific, I want allow traffic to <code>https://www.amazon.com</code> when the environment variable <code>HTTPS_PROXY</code> is set to my proxy, but not to <code>https://www.google.com</code>.  I don't want to rely on the proxy owner to keep the most restrictive allowlist of urls.  I am pretty sure I could achieve this using the CIDR range for the ips for <code>amazon.com</code>, but I don't want to be responsible for trying to keep track of amazon's ip addresses.  Is there a way to achieve this using any combination of <code>virtualservices</code>, <code>egressgateway</code>, <code>detinationrule</code>, and <code>serviceentry</code>?  So far all of the many attempts to achieve such results have failed.  The most promising, I thought, was a <code>virtualservice</code> that used an <code>HTTPRoute</code> to match traffic based on the header.  The problem seemed to be that the <code>HTTPRoute</code> never seems to be used.  I tried with an <code>HTTPRoute</code> and a <code>TCPRoute</code> at the same time since the <code>serviceentry</code> needs to be <code>TCP</code> for the proxy traffic to open a tunnel (seems likely that only one set of routing rules can be applied at a time, but I tried anyway).  I know in the above documentation it says that istio is blind to the destination of proxied traffic, but it should be able to see the headers and potentially make routing decisions based on them.  I have seen other questions asking similar questions, but no real answers and none asking exactly what I'm asking.  I'll paste an example below of what I hoped would work, but did not (allows all traffic -- doesn't seem to apply the http rule -- probably because there is no serviceentry for proxy with http protocol --- tcp tunnel needed for proxy to work).</p>
<pre><code>---
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: proxy
spec:
  hosts:
  - some-external-proxy.com
  ports:
  - number: 3128
    name: tcp
    protocol: TCP
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
    - port:
        number: 3128
        name: proxy-tcp
        protocol: HTTP
      hosts:
        - &quot;some-external-proxy.com&quot;
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: dr-for-proxy
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
    - name: proxy-se
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: direct-amazon-through-egressgateway
spec:
  hosts:
    - &quot;some-external-proxy.com&quot;
  gateways:
    - mesh
    - istio-egressgateway
  http:
    - match:
        - gateways:
            - mesh
          headers:
            authority:
              exact: &quot;www.amazon.com&quot;
      route:
        - destination:
            host: istio-egressgateway.istio-system.svc.cluster.local
            subset: proxy-se
            port:
              number: 3128
    - match:
        - gateways:
            - istio-egressgateway
          headers:
            authority:
              exact: &quot;www.amazon.com&quot;
      route:
        - destination:
            host: &quot;some-external-proxy.com&quot;
            port:
              number: 3128
          weight: 100
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: direct-proxy-through-egressgateway
spec:
  hosts:
    - &quot;some-external-proxy.com&quot;
  gateways:
    - mesh
    - istio-egressgateway
  tcp:
    - match:
        - gateways:
            - mesh
          port: 3128
      route:
        - destination:
            host: istio-egressgateway.istio-system.svc.cluster.local
            subset: proxy-se
            port:
              number: 3128
    - match:
        - gateways:
            - istio-egressgateway
          port: 3128
      route:
        - destination:
            host: &quot;some-external-proxy.com&quot;
            port:
              number: 3128
          weight: 100
</code></pre>
<p>My current solution is to use a separate proxy, route traffic to that proxy and add my own whitelist to it to only allow traffic to amazon, then forward that traffic on to the external proxy.  (FYI, I have tried some things in conjunction with <code>networkpolicies</code>, but of course that only operates at layer 3/4, so I'd be back to CIDR blocks instead of url filtering)
I've been stuck on this for quite some time, it seems possible to do what I want, but I can't seem to get the configuration correct.  I'd greatly appreciate any assistance.  Thanks.</p>

Mark_Eng
<p>I think I found the solution for this.  I haven't actually tested it yet, I am building my stack with this change now.  I'll test and if it works I'll update the comments and mark this solved.  Bottom line: I set the <code>HTTPS_PROXY</code> variable to use a different port, created a port rule in the <code>ServiceEntry</code> for that port, then in the <code>VirtualService</code> match the traffic on that port and route it to the <code>EgressGateway</code> and change to the true proxy port (3128 usually).  Then a TCP rule (since there is still a TCP service entry for that port/proxy service) matching the traffic from the <code>EgressGateway</code> and routing it to the proxy on the TCP port (3128).</p>
<p>Example (substitute the <code>ServiceEntry</code> and <code>VirtualServices</code> with below -- keep the other things):</p>
<pre><code>---
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: proxy
spec:
  hosts:
  - some-external-proxy.com
  ports:
  - number: 3128
    name: tcp
    protocol: TCP
  - number: 3134
    name: http
    protocol: HTTP
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: direct-proxy-through-egressgateway
spec:
  hosts:
    - &quot;some-external-proxy.com&quot;
  gateways:
    - mesh
    - istio-egressgateway
  http:
    - match:
        - gateways:
            - mesh
          headers:
            authority:
              exact: &quot;www.amazon.com&quot;
          port: 3134
      route:
        - destination:
            host: istio-egressgateway.istio-system.svc.cluster.local
            subset: proxy-se
            port:
              number: 3128
  tcp:
    - match:
        - gateways:
            - istio-egressgateway
          port: 3128
      route:
        - destination:
            host: &quot;some-external-proxy.com&quot;
            port:
              number: 3128
          weight: 100
</code></pre>
