cluster/agent                                                       cluster/agent                         -        -          -               STATIC     
cluster/inbound-vip|8000|http|httpbin.default.svc.cluster.local     httpbin.default.svc.cluster.local     8000     http       inbound-vip     EDS        
cluster/prometheus_stats                                            cluster/prometheus_stats              -        -          -               STATIC     

	fs.StringVar(&o.config.Winkernel.SourceVip, "source-vip", o.config.Winkernel.SourceVip, "The IP address of the source VIP for non-DSR.")
	fs.StringVar(&o.config.Winkernel.NetworkName, "network-name", o.config.Winkernel.NetworkName, "The name of the cluster network.")
	fs.BoolVar(&o.config.Winkernel.EnableDSR, "enable-dsr", o.config.Winkernel.EnableDSR, "If true make kube-proxy apply DSR policies for service VIP")

			HboneMtlsPort: 15008,
		}
	}
	return nil
}

func (a *index) toNetworkAddress(vip string) (*workloadapi.NetworkAddress, error) {
	ip, err := netip.ParseAddr(vip)
	if err != nil {
		return nil, fmt.Errorf("parse %v: %v", vip, err)
	}
	return &workloadapi.NetworkAddress{
		Network: a.Network(vip, make(labels.Instance, 0)).String(),
		Address: ip.AsSlice(),
	}, nil
}

		if c.TransportSocket != nil && c.TransportSocketMatches != nil {
			log.Errorf("invalid cluster, multiple matches: %v", c.Name)
		}
	}
	return clusters
}

// `inbound-vip||hostname|port`. EDS routing to the internal listener for each pod in the VIP.
func (cb *ClusterBuilder) buildWaypointInboundVIPCluster(proxy *model.Proxy, svc *model.Service, port model.Port, subset string) *clusterWrapper {

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/networking/core"
	"istio.io/istio/pilot/pkg/util/protoconv"
)

// BuildHTTPRoutes supports per-VIP routes, as used by GRPC.
// This mode is indicated by using names containing full host:port instead of just port.
// Returns true of the request is of this type.

// resources (with delta updates), or on-demand and only get responses for specifically subscribed resources.
//
// Incoming requests may be for VIP or Pod IP addresses. However, all responses are Workload resources, which are pod based.
// This means subscribing to a VIP may end up pushing many resources of different name than the request.

			return r
		}
		if r := cmp.Compare(a.Name, b.Name); r != 0 {
			return r
		}
		return cmp.Compare(a.Hostname, b.Hostname)
	})
	fmt.Fprintln(w, "NAMESPACE\tSERVICE NAME\tSERVICE VIP\tWAYPOINT")

	for _, svc := range svcs {
		var ip string
		if len(svc.Addresses) > 0 {
			_, ip, _ = strings.Cut(svc.Addresses[0], "/")
		}
		waypoint := serviceWaypointName(svc, zDump.Services)

package model

import (
	"testing"

	"istio.io/istio/pkg/config/labels"
	"istio.io/istio/pkg/config/protocol"
)

var service1 = &Service{
	Hostname:       "one.service.com",
	DefaultAddress: "192.168.3.1", // VIP
	Ports: PortList{
		&Port{Name: "http", Port: 81, Protocol: protocol.HTTP},
		&Port{Name: "http-alt", Port: 8081, Protocol: protocol.HTTP},
	},
}

func TestServiceInstanceValidate(t *testing.T) {

	for _, s := range d.Services {
		var ip string
		if len(s.Addresses) != 0 {
			_, ip, _ = strings.Cut(s.Addresses[0], "/")
		}
		if ip == "" {
			// fallback to None when a service does not have a VIP
			ip = "None"
		}
		serviceNames[ip] = s.Hostname
	}
	for _, s := range d.Workloads {
		var ip string
		if len(s.WorkloadIPs) != 0 {
			ip = s.WorkloadIPs[0]
		}
		if ip == "" {