Use a service entry to register an external service with the service mesh, covering port conflicts, protocol specifications, and access control. - Alibaba Cloud Service Mesh

A service entry adds an external service to the service mesh's internal service registry. It describes properties of the service, such as its domain name, ports, protocols, and endpoints, which allows services within the mesh to access it. This topic describes how to create, modify, and delete a service entry.

Usage notes

To prevent port conflicts with the sidecar, do not use the following Envoy-reserved ports when you create a service entry:

Port	Protocol	Used by	Description
15000	TCP	Envoy	Envoy admin port.
15001	TCP	Envoy	Port for outbound traffic from Envoy.
15006	TCP	Envoy	Port for inbound traffic to Envoy.
15020	HTTP	Envoy	Port for merged Prometheus telemetry from the Istio proxy, Envoy, and the application.
15021	HTTP	Envoy	Port for health checks.
15090	HTTP	Envoy	Port for Envoy Prometheus telemetry.

You must follow these conventions when you name ports in a service entry:

Protocol	Port name	Port name with a suffix
HTTP	http	http-<suffix>
HTTP2	http2	http2-<suffix>
HTTPS	https	https-<suffix>
TLS	tls	tls-<suffix>
gRPC	grpc	grpc-<suffix>
TCP	tcp	tcp-<suffix>
UDP	UDP	udp-<suffix>
Mongo	mongo	mongo-<suffix>
MySQL	mysql	mysql-<suffix>
Redis	redis	redis-<suffix>

Note the following requirements when you use the HTTP, HTTPS, TLS, and TCP protocols:

When you use the HTTP, HTTPS, or TLS protocol, you must specify the hosts in the service entry.

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: aliyun
spec:
  hosts:
  - www.aliyun.com
  - aliyun.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL

When you use the TCP protocol, you must specify the IP address ranges in the service entry.

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: mysql-external
spec:
  hosts:
  - mysql-01.foo.bar
  addresses:
  - 10.0.0.5/32
  - 10.0.0.6/32
  ports:
  - name: tcp
    number: 3306
    protocol: tcp
  location: MESH_EXTERNAL

If multiple external services use the same TCP port, you must specify a unique IP address for each service.

External service 1

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-svc-1
  namespace: default
spec:
  hosts:
  - fqdna.fqdn.com
  addresses:
  - 10.0.0.0
  location: MESH_EXTERNAL
  ports:
  - name: TCP
    number: 3306
    protocol: TCP
  resolution: DNS

External service 2

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: external-svc-2
  namespace: default
spec:
  hosts:
  - fqdnb.fqdn.com
  addresses:
  - 10.1.0.0
  location: MESH_EXTERNAL
  ports:
  - name: TCP
    number: 3306
    protocol: TCP
  resolution: DNS

By default, a service entry makes an external service accessible from all namespaces. To restrict access to the namespace where the service entry is created, add the exportTo parameter and set its value to ".".

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: aliyun
spec:
  hosts:
  - www.aliyun.com
  exportTo:
  - "."
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS
  location: MESH_EXTERNAL

We recommend that you use DNS resolution. With DNS resolution, the proxy performs a DNS query for the specified host and directs traffic to the resolved IP address, ignoring the original destination IP.
```
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: aliyun
spec:
  hosts:
  - '*.aliyun.com'
  addresses:
   - 192.168.0.0
   - 172.16.0.0
  location: MESH_EXTERNAL
  ports:
  - number: 443
    protocol: https
    name: https
  resolution: DNS
```
resolution: Set this parameter to DNS to use DNS resolution. Set it to NONE to bypass DNS resolution.

Create a service entry

Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.
On the Mesh Management page, click the name of the ASM instance. In the left-side navigation pane, choose Cluster & Workload Management > External Service(ServiceEntry). On the page that appears, click Create from YAML.
On the Create page, select a Namespaces and a Scenario Template, modify the configuration in the YAML editor as needed, and then click Create.
For more information about the fields, see and Service Entry.

Modify a service entry

On the mesh details page, in the left-side navigation pane, choose Cluster & Workload Management (Data Plane) > External Service(ServiceEntry).
On the External Service(ServiceEntry) page, find the service entry that you want to modify and click View YAML in the Actions column.
In the Edit dialog box, modify the service entry configuration and click OK.

Delete a service entry

On the mesh details page, in the left-side navigation pane, choose Cluster & Workload Management (Data Plane) > External Service(ServiceEntry).
On the External Service(ServiceEntry) page, find the service entry that you want to delete and click Delete in the Actions column.
In the Confirm dialog box, click OK.