} else {
				warnings = append(warnings, fmt.Sprintf("hostname %q not found", g))
			}
			foundUnusable = true
			continue
		}
		svcKey := svc.Key()
		for port := range ports {
			instances := gc.ps.ServiceEndpointsByPort(svc, port, nil)
			if len(instances) > 0 {
				foundInternal.Insert(fmt.Sprintf("%s:%d", g, port))
				foundInternalIP.InsertAll(svc.GetAddresses(&model.Proxy{Metadata: &model.NodeMetadata{ClusterID: gc.cluster}})...)

			// IP allocation logic for service entry was unable to allocate an IP.
			if svc.Resolution == model.Passthrough && len(svc.Ports) > 0 {
				for _, instance := range cfg.Push.ServiceEndpointsByPort(svc, svc.Ports[0].Port, nil) {
					// empty addresses are possible here
					if !netutil.IsValidIPAddress(instance.Address) {
						continue
					}

// Used for CDS (ClusterLoadAssignment constructed elsewhere).
func (b *EndpointBuilder) FromServiceEndpoints() []*endpoint.LocalityLbEndpoints {
	if b == nil {
		return nil
	}
	svcEps := b.push.ServiceEndpointsByPort(b.service, b.port, b.subsetLabels)
	// don't use the pre-computed endpoints for CDS to preserve previous behavior
	return ExtractEnvoyEndpoints(b.generate(svcEps))
}

		return serviceMTLSMode
	}

	// Fallback to permissive.
	return MTLSPermissive
}

// ServiceEndpointsByPort returns the cached instances by port if it exists.
func (ps *PushContext) ServiceEndpointsByPort(svc *Service, port int, labels labels.Instance) []*IstioEndpoint {
	var out []*IstioEndpoint

					if bind.Primary() == "" && service.Resolution == model.Passthrough &&
						saddress == constants.UnspecifiedIP && (servicePort.Protocol.IsTCP() || servicePort.Protocol.IsUnsupported()) {
						instances := push.ServiceEndpointsByPort(service, servicePort.Port, nil)
						if service.Attributes.ServiceRegistry != provider.Kubernetes && len(instances) == 0 && service.Attributes.LabelSelectors == nil {