Integrating VMs into Istio Service Mesh: WorkloadEntry, WorkloadGroup, and Smart DNS

WorkloadEntry

WorkloadEntry describes non‑Pod endpoints, allowing VMs to join the mesh as first‑class citizens and enabling mutual TLS configuration.

apiVersion: networking.istio.io/v1alpha3
kind: WorkloadEntry
metadata:
  name: vm1
  namespace: ns1
spec:
  address: 1.1.1.1
  labels:
    app: foo
    instance-id: vm-78ad2
    class: vm
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: svc1
  namespace: ns1
spec:
  hosts:
  - svc1.internal.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: STATIC
  workloadSelector:
    labels:
      app: foo

This creates a WorkloadEntry with labels and an address, and a ServiceEntry that selects endpoints with the matching label, allowing the VM to be treated like a Pod.

VM Auto‑Registration

WorkloadGroup is used for automatic registration of WorkloadEntry resources, which is useful when VM services need to scale automatically.

Enable auto‑registration when installing istiod:

$ istioctl install --set values.pilot.env.PILOT_ENABLE_WORKLOAD_ENTRY_AUTOREGISTRATION=true

Deploy an east‑west gateway so that the VM sidecar can communicate with istiod.

Create a WorkloadGroup:

apiVersion: networking.istio.io/v1alpha3
kind: WorkloadGroup
metadata:
  name: python-http
  namespace: vm
spec:
  metadata:
    annotations: {}
    labels:
      app: python-http
  template:
    ports: {}
    serviceAccount: my-vm

When each VM starts the python-http instance, a WorkloadEntry is automatically created with the VM's IP and metadata. A corresponding ServiceEntry can then select this WorkloadEntry, enabling other mesh services to reach the VM via the ServiceEntry hosts.

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: vm-workload-svc
  namespace: vm
spec:
  hosts:
  - vmservice.example.com
  location: MESH_INTERNAL
  ports:
  - number: 80
    name: http
    protocol: HTTP
    targetPort: 9090
  resolution: STATIC
  workloadSelector:
    labels:
      app: python-http

Smart DNS

Even with VM auto‑registration, hostname‑based access to mesh services is not possible without a DNS solution. Istio 1.8 introduces a DNS proxy sidecar that caches endpoints from the mesh and ServiceEntry resources. Iptables rules redirect DNS queries to the sidecar; if the name is cached, the sidecar returns the result, otherwise it forwards the request to the system DNS.

Smart DNS is disabled by default and can be enabled during Istio installation:

--set meshConfig.defaultConfig.proxyMetadata.ISTIO_META_DNS_CAPTURE=true

Summary

When a VM connects to the Istio control plane through an east‑west gateway, Istio creates the appropriate WorkloadEntry resources, enabling the VM sidecar to resolve all mesh services via the smart DNS proxy. Consequently, services running on VMs can access Kubernetes services such as httpbin.default.svc.cluster.local using standard hostnames.