There are three kinds of configuration for external services: HTTP, TLS and TCP.

In many cases, not all the parts of a microservices-based application reside in a service mesh or ingress. Sometimes, the microservices-based applications use functionality provided by legacy systems that reside outside the mesh.

You would like to migrate these systems to the service mesh gradually. Until these systems are migrated, they must be accessed by the applications inside the mesh. In other cases, the applications use web services provided by third parties.

This is one nice example to understand : https://istio.io/blog/2018/egress-https/