svc.Spec.Type = "NodePort"
			svc.Spec.ClusterIP = "172.30.0.43"
			svc.Spec.Ports = []v1.ServicePort{{
				Name:     "p80",
				Port:     80,
				Protocol: v1.ProtocolTCP,
				NodePort: 3003,
			}}
		}),
		// create ExternalIP service
		makeTestService("ns4", "svc4", func(svc *v1.Service) {
			svc.Spec.Type = "NodePort"
			svc.Spec.ClusterIP = "172.30.0.44"

			},
		},
		[]*model.Service{svc1, svc2, svc3},
		2,
		meshWatcher,
		fx,
		controller,
	)

	// permit all discovery namespaces by omitting discovery selectors (1 create event should trigger for the nsC service)
	updateMeshConfig(
		&meshconfig.MeshConfig{
			DiscoverySelectors: []*meshconfig.LabelSelector{},
		},
		[]*model.Service{svc1, svc2, svc3, svc4},
		1,
		meshWatcher,
		fx,

				-A KUBE-SERVICES -m comment --comment "ns3/svc3 blah" svc3 line 2
				-A KUBE-SERVICES -m comment --comment ns3/svc3 svc3 line 3
				-A KUBE-SERVICES -m comment --comment ns4/svc4 svc4 line 1
				-A KUBE-SERVICES -m comment --comment "ns4/svc4:p80 cluster IP" svc4 line 2
				-A KUBE-SERVICES -m comment --comment "ns4/svc4 blah" svc4 line 3
				COMMIT
				`),
		},
		{

		add rule ip kube-proxy service-4AT6LBPK-ns3/svc3/tcp/p80 numgen random mod 1 vmap { 0 : goto endpoint-UEIP74TE-ns3/svc3/tcp/p80__10.180.0.3/80 }
		add rule ip kube-proxy external-4AT6LBPK-ns3/svc3/tcp/p80 jump mark-for-masquerade
		add rule ip kube-proxy external-4AT6LBPK-ns3/svc3/tcp/p80 goto service-4AT6LBPK-ns3/svc3/tcp/p80

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc1"}, spCacheInefficient)
	expectNumEndpointsAndSlices(t, c, 2, 13, 30)

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc2"}, spCacheEfficient)
	expectNumEndpointsAndSlices(t, c, 4, 15, 110)

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc3"}, spCacheInefficient)
	expectNumEndpointsAndSlices(t, c, 6, 28, 140)

        prefix: /
    name: allowed-2.http.3
    route:
    - destination:
        host: svc2.allowed-2.svc.domain.suffix
        port:
          number: 80
  - match:
    - uri:
        prefix: /
    name: allowed-2.http.2
    route:
    - destination:
        host: svc3.allowed-2.svc.domain.suffix
        port:
          number: 80
  - match:
    - uri:
        regex: /foo((\/).*)?
    name: allowed-1.http.1

  type: ExternalName
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc2
  namespace: nginx-ns2
spec:
  externalName: nginx.example.com
  ports:
  - port: 443
    protocol: TCP
    targetPort: 443
  type: ExternalName
--- 
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc3
  namespace: nginx-ns3
spec:
  externalName: nginx.example.com
  ports:
  - name: tcp

        value: /foo
      headers:
      - name: my-header
        value: some-value
        type: Exact
    backendRefs:
    - name: svc1
      port: 80
  - matches:
    - path:
        type: RegularExpression
        value: /foo((\/).*)?
    backendRefs:
    - name: svc2
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http
  namespace: allowed-2
spec:

        value: /
    backendRefs:
    - name: svc3
      port: 80
  - matches:
    - method: PATCH
      path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: svc2
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http
  namespace: default
spec:
  parentRefs:
  - name: gateway

		},
		{
			proxyNs:   "test2",
			wantHosts: []string{"svc2", "svc3", "svc4", "svc4", "svc4"},
		},
		{
			proxyNs:   "ns1",
			wantHosts: []string{"svc1", "svc2", "svc3", "svc4", "svc4", "svc4"},
		},
		{
			proxyNs:   "random",
			wantHosts: []string{"svc3", "svc4", "svc4", "svc4"},
		},
	}
	for _, tt := range cases {