curr config.Config,
	services []*model.Service,
) (map[configKey][]*model.ServiceInstance, []*model.ServiceInstance) {
	currentServiceEntry := curr.Spec.(*networking.ServiceEntry)
	var serviceInstances []*model.ServiceInstance
	serviceInstancesByConfig := map[configKey][]*model.ServiceInstance{}
	// for service entry with labels
	if currentServiceEntry.WorkloadSelector != nil {

	// Create service instances
	serviceInstances := make([]*model.ServiceInstance, 0, 20)
	number, err := f.GetInt()
	if err != nil {
		return 0
	}
	// We allow a maximum of 20 service instances
	numberOfS := number % 20
	for i := 0; i < numberOfS; i++ {
		si, err := NewSI(f)
		if err != nil {
			return 0
		}
		serviceInstances = append(serviceInstances, si)
	}

	// Create services

2020-06-29T23:37:27.287957Z...

		}
		if len(sd.serviceInstances.instances[key]) != 0 {
			t.Fatalf("service instances store `instances` memory leak, expect 0, got %d", len(sd.serviceInstances.instances[key]))
		}
		if len(sd.serviceInstances.instancesBySE[namespacedName]) != 0 {
			t.Fatalf("service instances store `instancesBySE` memory leak, expect 0, got %d", len(sd.serviceInstances.instancesBySE[namespacedName]))
		}

This is composed of two controllers - one driven from core Kubernetes types ("Kube Controller") and one by Istio types ("ServiceEntry controller").

```mermaid
graph TD
    subgraph Kube Controller
        s(Services)
        e(Endpoints)
        p(Pods)
        ksi(ServiceInstances)
        kwi(WorkloadInstances)
        s-->ksi
        e-->ksi

	instancePlainText := &ServiceInstance{
		Endpoint: &IstioEndpoint{
			Address:      "192.168.1.2",
			EndpointPort: 1000000,
			TLSMode:      DisabledTLSModeLabel,
		},
	}

	cases := []struct {
		name              string
		serviceNamespace  string
		servicePort       int
		serviceResolution Resolution
		serviceInstances  []*ServiceInstance
		wanted            MutualTLSMode
	}{

		Metadata:    &model.NodeMetadata{Namespace: "nsa", ClusterID: clusterID},
	}
	serviceInstances := controller.GetProxyServiceTargets(svcNode)

	if len(serviceInstances) != 1 {
		t.Fatalf("GetProxyServiceTargets() expected 1 instance, got %d", len(serviceInstances))
	}

	hostname := kube.ServiceHostname("svc1", "nsa", defaultFakeDomainSuffix)
	if serviceInstances[0].Service.Hostname != hostname {

2020-06-29T23:37:27.287957Z...

// TODO: parse response, check if data captured matches what we expect.
// TODO: use this in integration tests.
// TODO: refine the output
// TODO: dump the ServiceInstances as well
func testEdsz(t *testing.T, s *xdsfake.FakeDiscoveryServer, proxyID string) {
	req, err := http.NewRequest(http.MethodGet, "/debug/edsz?proxyID="+proxyID, nil)
	if err != nil {
		t.Fatal(err)
	}

			TargetPort:  e.Endpoint.EndpointPort,
		},
	}
}

// DeepCopy creates a copy of ServiceInstance.
func (instance *ServiceInstance) DeepCopy() *ServiceInstance {
	return &ServiceInstance{
		Service:  instance.Service.DeepCopy(),
		Endpoint: instance.Endpoint.DeepCopy(),
		ServicePort: &Port{
			Name:     instance.ServicePort.Name,
			Port:     instance.ServicePort.Port,
			Protocol: instance.ServicePort.Protocol,
		},