// TODO: Policy binding via VIP+Host is inapplicable for direct pod access.
	if svc == nil {
		return buildSidecarInboundHTTPRouteConfig(lb, cc)
	}
	vss := getConfigsForHost(lb.node.ConfigNamespace, svc.Hostname, lb.node.SidecarScope.EgressListeners[0].VirtualServices())
	if len(vss) == 0 {
		return buildSidecarInboundHTTPRouteConfig(lb, cc)
	}
	if len(vss) > 1 {

	var svcConfigs []config.Config
	if opts.service != nil {
		// Do not filter namespace for now.
		// TODO(https://github.com/istio/istio/issues/46146) we may need to, or something more sophisticated
		svcConfigs = getConfigsForHost("", opts.service.Hostname, virtualServices)
	} else {
		svcConfigs = virtualServices
	}

	out = append(out, buildSidecarOutboundTLSFilterChainOpts(opts.proxy, opts.push, opts.cidr, opts.service,