# External Services

By default, Istio-enabled services are unable to access services and URLs outside the cluster. Pods use <i>iptables</i> to transparently redirect all outbound traffic to the sidecar proxy, which only handles intra-cluster destinations.

See [the Egress Task](https://istio.io/docs/tasks/traffic-management/egress/) for
information on configuring Istio to contact external services.

			core.TrafficDirection_INBOUND,
			ListenerProtocolTCP,
		},
		{
			"Inbound unknown to Auto",
			protocol.Unsupported,
			core.TrafficDirection_INBOUND,
			ListenerProtocolAuto,
		},
		{
			"Outbound unknown to Auto",
			protocol.Unsupported,
			core.TrafficDirection_OUTBOUND,
			ListenerProtocolAuto,
		},
		{
			"UDP to UDP",
			protocol.UDP,
			core.TrafficDirection_INBOUND,
			ListenerProtocolUnknown,

	"bytes"
	"fmt"
	"io"
	"net/http"
	"strings"

	"istio.io/istio/pkg/log"
)

// DrainListeners drains inbound listeners of Envoy so that inflight requests
// can gracefully finish and even continue making outbound calls as needed.
func DrainListeners(adminPort uint32, inboundonly bool, skipExit bool) error {
	var drainURL string
	if inboundonly {
		drainURL = "drain_listeners?inboundonly&graceful"
	} else {

		ads.RequestResponseAck(t, &discovery.DiscoveryRequest{TypeUrl: v3.ListenerType})
		ads.RequestResponseAck(t, &discovery.DiscoveryRequest{
			TypeUrl:       v3.EndpointType,
			ResourceNames: []string{"outbound|9080||app2.default.svc.cluster.local"},
		})
		ads.RequestResponseAck(t, &discovery.DiscoveryRequest{
			TypeUrl:       v3.RouteType,
			ResourceNames: []string{"80", "8080"},
		})

	packetsReceivedErrorsQuery    = "\\Network Adapter(*)\\Packets Received Errors"
	packetsOutboundDiscardedQuery = "\\Network Adapter(*)\\Packets Outbound Discarded"
	packetsOutboundErrorsQuery    = "\\Network Adapter(*)\\Packets Outbound Errors"
)

// networkCounter contains the counters for network adapters.
type networkCounter struct {
	packetsReceivedPerSecondCounter perfCounter

			clusterName := clusterName(dest, port)
			// Ensure that we have an outbound configuration for the target port.
			err := validator.NotExists("{.configs[*].dynamicActiveClusters[?(@.cluster.Name == '%s')]}", clusterName).Check()
			if err != nil {
				return false, err
			}
		}

		return true, nil
	}

	workloads, _ := c.Workloads()
	// Wait for the outbound config to be received by each workload from Pilot.

// which can be called for both outbound and inbound cluster, but only connection pool will be applied to inbound cluster.
func (cb *ClusterBuilder) applyTrafficPolicy(opts buildClusterOpts) {
	connectionPool, outlierDetection, loadBalancer, tls, proxyProtocol := selectTrafficPolicyComponents(opts.policy)
	// Connection pool settings are applicable for both inbound and outbound clusters.
	if connectionPool == nil {

$ adb shell setprop log.tag.okhttp.Http2 DEBUG
$ adb shell setprop log.tag.okhttp.TaskRunner DEBUG
$ adb logcat '*:E' 'okhttp.Http2:D' 'okhttp.TaskRunner:D'
```

### HTTP/2 Frame Logging

This logs inbound (`<<`) and outbound (`>>`) frames for HTTP/2 connections.

```
[2020-01-01 00:00:00] >> CONNECTION 505249202a20485454502f322e300d0a0d0a534d0d0a0d0a
[2020-01-01 00:00:00] >> 0x00000000     6 SETTINGS

var deltaConfigTypes = sets.New(kind.ServiceEntry.String(), kind.DestinationRule.String())

// BuildClusters returns the list of clusters for the given proxy. This is the CDS output
// For outbound: Cluster for each service/subset hostname or cidr with SNI set to service hostname
// Cluster type based on resolution
// For inbound (sidecar only): Cluster for each inbound endpoint port and for each service port

	"istio.io/istio/pkg/jwt"
	"istio.io/istio/pkg/util/sets"
)

var (
	// HTTP10 will add "accept_http_10" to http outbound listeners. Can also be set only for specific sidecars via meta.
	HTTP10 = env.Register(
		"PILOT_HTTP10",
		false,
		"Enables the use of HTTP 1.0 in the outbound HTTP listeners, to support legacy applications.",
	).Get()

	ScopeGatewayToNamespace = env.Register(
		"PILOT_SCOPE_GATEWAY_TO_NAMESPACE",