Istio externalName + egress gateway tls origination host is not replaced - kubernetes

Question

I am trying to configure egress gateway with tls origination using service type ExternalName.
I followed this example: https://istio.io/latest/docs/tasks/traffic-management/egress/egress-tls-origination/
But I am having Host problems with the request because of the SNI, I have to change the host because of the SSL from example-test to example.com, I tried to set header host and rewrite authority on virtual service but didn't work, and now I am trying to use envoy filter but I got nothing so far:
curl example-test
cause a 502 and 400 on the istio-proxy:
GET / HTTP/1.1" 502 UPE upstream_reset_before_response_started{protocol_error} - "-" 0 87 6 - "-" "curl/7.75.0" "example.com" outbound|80|example-test|egressgateway-internal.istio-system.svc.cluster.local service_entry_match
Gateway:
HTTP/1.1" 400 DPE http1.codec_error - "-" 0 11 0 - "-" "-" "-" "-" "-" - - example.com -
Destination rule configuration:
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: egressgateway-for-example
spec:
host: egressgateway-internal.istio-system.svc.cluster.local
subsets:
- name: example-test
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
portLevelSettings:
- port:
number: 80
tls:
mode: ISTIO_MUTUAL
sni: 'example.com'
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: originate-tls-for-example
spec:
host: 'example.com'
trafficPolicy:
loadBalancer:
simple: ROUND_ROBIN
portLevelSettings:
- port:
number: 443
tls:
mode:
sni: 'example.com'
Service Entry and service type externalName configuration:
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
name: example-test
spec:
hosts:
- 'example.com'
ports:
- number: 80
name: http-port
protocol: HTTP
- number: 443
name: https-port
protocol: HTTPS
resolution: DNS
location: MESH_EXTERNAL
---
kind: Service
apiVersion: v1
metadata:
name: example-test
namespace: default
spec:
type: ExternalName
externalName: example.com
ports:
- protocol: TCP
port: 443
targetPort: 443
name: tcp
Virtual service ( I tried the rewrite on destination to authority and set Host to example.com and did not work)
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: direct-example-through-egress-gateway
spec:
hosts:
- 'example.com'
gateways:
- egressgateway-internal
- mesh
http:
- name: "service_entry_match"
match:
- gateways:
- mesh
route:
- destination:
host: egressgateway-internal.istio-system.svc.cluster.local
subset: example-test
port:
number: 80
weight: 100
- name: "tls_destination"
match:
- gateways:
- egressgateway-internal
port: 80
route:
- destination:
host: 'example.com'
port:
number: 443
weight: 100
And the gateway:
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: egressgateway-internal
namespace: istio-system
spec:
selector:
istio: egressgateway-internal
servers:
- port:
number: 80
name: https-port-for-tls-origination
protocol: HTTPS
hosts:
- 'example.com'
tls:
mode: ISTIO_MUTUAL
Envoy filter:
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: test-add-example-host
namespace: default
spec:
configPatches:
- applyTo: HTTP_FILTER
match:
context: SIDECAR_OUTBOUND
listener:
portNumber: 80
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
subFilter:
name: "envoy.filters.http.router"
patch:
operation: INSERT_BEFORE
value:
name: envoy.lua
typed_config:
"#type": "type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua"
inlineCode: |
function envoy_on_request(request_handle)
if (request_handle:headers():get("Host") == "example-test")
then
request_handle:logInfo("[INFO] Add Host to request...")
request_handle:headers():replace(":authority",'example.com')
else
request_handle:logInfo("[INFO]debug..")
end
end