<p>Istio allows you to route a http request in a <code>VirtualService</code> to an external host provided a <code>ServiceEntry</code> exists. For example: </p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 80
</code></pre>

<p>However this only allows for a HTTP endpoint - how do I configure the external endpoint to be TLS/HTTPS?</p>

Alex Turner
<p>This took me hours to work out - so worth sharing I feel. </p>

<p>In order to terminate this service as a TLS, a <code>Destination Rule</code> is required. My final config:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin-ext
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.domain.co
  gateways:
  - public-gateway.istio-system.svc.cluster.local
  - mesh
  http:
  - match:
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 443
      host: httpbin.domain.co
    - gateways:
      - public-gateway.istio-system.svc.cluster.local
      port: 80
      host: httpbin.domain.co
    route:
    - destination:
        host: httpbin.org
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin-org
spec:
  host: httpbin.org
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE 
</code></pre>
