When istio ServiceEntry with resolution "DNS" update istio's routing map?

[dhguswns23]

I'm struggling with configuring Istio service mesh, especially domain resolving which are accessible by only internal services.

My question is, when does a ServiceEntry with the resolution field set to "DNS" resolve the hosts field values and apply them to the Istio routing table?

For example, when does the "mine.ops.hm-net" domain get resolved as "mine-ops-service"?

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: internal-service-entry
spec:
  hosts:
    - "mine.ops.hm-net"
  ports:
  - name: http
    number: 80
    protocol: HTTP
  location: MESH_INTERNAL
  resolution: DNS
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: mine-ops-vs
  namespace: mine-ops
spec:
    hosts:
    - mine.ops.hm-net
    gateways:
      - mesh
    http:
    - route:
        - destination:
            host: mine-ops-service
            port:
              number: 80

Possible scenarios I can imagine are:

• When the ServiceEntry is first registered or updated.
• Whenever DNS resolving is needed (whenever a pod requests a new domain that isn't present in the Istio routing table).
• Istio has its own lifecycle to update the DNS routing table.

I'm curious about this because a ServiceEntry with a wildcard host (such as *.ops.hm-net) fails to resolve.

It would make sense if the ServiceEntry updates the Istio routing table only when it's registered (first scenario) because there's no way to know the endpoint address with *.opt.hm-net.

I've read Istio's official DNS proxying and ServiceEntry docs several times, but there's no mention of my question.

Thank you for reading!

[howardjohn]

DNS is done asynchronously (and continuously, when TTL expires) when the SE is created

[dhguswns23]

Thank you for answer! So you mean "first scenario" is the answer?

[howardjohn]

Yes, but it also happens continuously even if the SE doesn't change

[dhguswns23]

Thank you :) You save my day.