Istio-通过自定义群集内部域访问外部服务

Question

我正在尝试设置服务条目以通过集群内的www.google.com域访问default.google.global外部服务：

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: google-svc-entry
spec:
  hosts:
  - default.google.global
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  endpoints:
  - address: google.com
    ports:
      https: 443
  resolution: DNS
  location: MESH_EXTERNAL

当我尝试使用default.google.global域从Pod内部访问它时，它无法建立连接：

> kubectl exec --namespace=sample -it <SOURCE_POD> -- curl -vvv https://default.google.global/


*   Trying 240.0.0.3...
* TCP_NODELAY set
* Connected to default.google.global (240.0.0.3) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to default.google.global:443
* stopped the pause stream!
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to default.google.global:443
command terminated with exit code 35

我可能会缺少什么-我什至会以正确的方式进行操作？就像我说的那样-我的愿望是通过集群内部的自定义域名访问外部服务。