title: Istio Service Entry Not Working
body: <p><strong>What Version of Istio and Kubernetes are you using, where did you get Istio from, Installation details</strong></p>
  
  <pre><code>istioctl version
  Version: 0.8.0
  GitRevision: 6f9f420f0c7119ff4fa6a1966a6f6d89b1b4db84
  User: root@48d5ddfd72da
  Hub: docker.io/istio
  GolangVersion: go1.10.1
  BuildStatus: Clean
  
  
  kubectl version
  Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.7", GitCommit:"dd5e1a2978fd0b97d9b78e1564398aeea7e7fe92", GitTreeState:"clean", BuildDate:"2018-04-19T00:05:56Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}
  Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.1", GitCommit:"3a1c9449a956b6026f075fa3134ff92f7d55f812", GitTreeState:"clean", BuildDate:"2018-01-04T11:40:06Z", GoVersion:"go1.9.2", Compiler
  </code></pre>
  
  <p><strong>Is Istio Auth enabled or not ?</strong>
  Auth is not enabled, I used istio-demo.yaml to install istio</p>
  
  <p><strong>What happened</strong>:
  I tried to use the external example (ServiceEntry):</p>
  
  <pre><code>cat &lt;&lt;EOF | istioctl create -f -
  apiVersion: networking.istio.io/v1alpha3
  kind: ServiceEntry
  metadata:
    name: httpbin-ext
  spec:
    hosts:
    - httpbin.org
    ports:
    - number: 80
      name: http
      protocol: HTTP
  EOF
  
  cat &lt;&lt;EOF | istioctl create -f -
  apiVersion: networking.istio.io/v1alpha3
  kind: ServiceEntry
  metadata:
    name: google-ext
  spec:
    hosts:
    - www.google.com
    ports:
    - number: 443
      name: https
      protocol: HTTPS
  EOF
  </code></pre>
  
  <p><strong>I keep getting errors when I try to curl from the sleep pod:</strong></p>
  
  <pre><code>root@sleep-6ccf857cc6-b9jh4:/#  curl http://httpbin.org/headers -I
  HTTP/1.1 503 Service Unavailable
  content-length: 19
  content-type: text/plain
  date: Thu, 14 Jun 2018 10:40:20 GMT
  server: envoy
  
  root@sleep-6ccf857cc6-b9jh4:/# curl -I https://www.google.com
  curl: (35) Unknown SSL protocol error in connection to www.google.com:443
  </code></pre>
  
  <p><strong>Some log output from the istio proxy sidecar of the sleep pod:</strong></p>
  
  <pre><code>[2018-06-14 11:00:39.419][14][info][upstream] external/envoy/source/server/lds_api.cc:60] lds: add/update listener 'tcp_0.0.0.0_443'
  [2018-06-14T11:00:37.373Z] "HEAD /headers HTTP/1.1" 503 UH 0 19 0 - "-" "curl/7.35.0" "d06828ed-7fd6-9383-adad-170177b00427" "httpbin.org" "-"
  [2018-06-14 11:01:40.298][14][info][upstream] external/envoy/source/common/upstream/cluster_manager_impl.cc:388] add/update cluster out.www.google.com|https starting warming
  [2018-06-14 11:01:40.299][14][info][upstream] external/envoy/source/common/upstream/cluster_manager_impl.cc:395] warming cluster out.www.google.com|https complete
  </code></pre>