<p>I have installed ISTIO with the below configuration</p>
<pre><code>cat &lt;&lt; EOF | kubectl apply -f -
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio-control-plane
spec:
  # Use the default profile as the base
  # More details at: https://istio.io/docs/setup/additional-setup/config-profiles/
  profile: default
  # Enable the addons that we will want to use
  addonComponents:
    grafana:
      enabled: true
    prometheus:
      enabled: true
    tracing:
      enabled: true
    kiali:
      enabled: true
  values:
    global:
      # Ensure that the Istio pods are only scheduled to run on Linux nodes
      defaultNodeSelector:
        beta.kubernetes.io/os: linux
    kiali:
      dashboard:
        auth:
          strategy: anonymous
  components:
    egressGateways:
    - name: istio-egressgateway
      enabled: true
  meshConfig:
    accessLogFile: /dev/stdout
    outboundTrafficPolicy:
      mode: REGISTRY_ONLY
EOF
</code></pre>
<p>and have configured the Egress Gateway, Destination Rule &amp; Virtual Service as shown below</p>
<pre><code>cat &lt;&lt; EOF | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: akv2k8s-test
  labels:
    istio-injection: enabled
    azure-key-vault-env-injection: enabled
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: cnn
  namespace: akv2k8s-test
spec:
  hosts:
  - edition.cnn.com
  ports:
  - number: 80
    name: http-port
    protocol: HTTP
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-egressgateway
  namespace: akv2k8s-test
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - edition.cnn.com
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-cnn
  namespace: akv2k8s-test
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
  - name: cnn
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-cnn-through-egress-gateway
  namespace: akv2k8s-test
spec:
  hosts:
  - edition.cnn.com
  gateways:
  - istio-egressgateway
  - mesh
  http:
  - match:
    - gateways:
      - mesh
      port: 80
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        subset: cnn
        port:
          number: 80
      weight: 100
  - match:
    - gateways:
      - istio-egressgateway
      port: 80
    route:
    - destination:
        host: edition.cnn.com
        port:
          number: 80
      weight: 100
EOF
</code></pre>
<p>it is working perfectly fine</p>
<pre><code>kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.7/samples/sleep/sleep.yaml -n akv2k8s-test
export SOURCE_POD=$(kubectl get pod -l app=sleep -n akv2k8s-test -o jsonpath={.items..metadata.name})
kubectl exec &quot;$SOURCE_POD&quot; -n akv2k8s-test -c sleep -- curl -sL -o /dev/null -D - http://edition.cnn.com/politics
kubectl logs -l istio=egressgateway -c istio-proxy -n istio-system | tail
</code></pre>
<p><a href="https://i.stack.imgur.com/BvXYS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BvXYS.png" alt="enter image description here" /></a></p>
<p>however I could not understand the control flow. For example, the below diagram show the control flow of Ingress Gateway</p>
<p><a href="https://i.stack.imgur.com/1zCpz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/1zCpz.png" alt="enter image description here" /></a></p>
<p>Can you please let me know the control flow of ISTIO Egress? or What happens when the deployed application try to access the external service? Does follow the flow : POD -&gt; Proxy -&gt; Virtual Service -&gt; Destination Rule -&gt; Gateway -&gt; External Service?</p>

One Developer
<p>Yes, Your guess was right on point.</p>
<p>The flow is POD &gt; envoy proxy &gt; Gateway &gt; Eternal Service</p>
<p>When traffic is being sent out from the application container, it is intercepted by envoy proxy sidecar and envoy filter is applied.</p>
<p>The envoy filter chain is generated from <code>VirtualService</code> and <code>DestinationRule</code> objects it can be inspected using <a href="https://istio.io/latest/docs/ops/diagnostic-tools/proxy-cmd/#deep-dive-into-envoy-configuration" rel="nofollow noreferrer"><code>istioctl proxy-config</code></a> command.</p>
