}
    ],
    "selector": {
      "selectorKey": "selectorValue"
    },
    "clusterIP": "clusterIPValue",
    "clusterIPs": [
      "clusterIPsValue"
    ],
    "type": "typeValue",
    "externalIPs": [
      "externalIPsValue"
    ],
    "sessionAffinity": "sessionAffinityValue",
    "loadBalancerIP": "loadBalancerIPValue",
    "loadBalancerSourceRanges": [
      "loadBalancerSourceRangesValue"
    ],

		Spec: api.ServiceSpec{
			Type: api.ServiceTypeClusterIP,
		},
	})
	checkExternallyAccessible(true, &api.Service{
		Spec: api.ServiceSpec{
			Type:        api.ServiceTypeClusterIP,
			ExternalIPs: []string{"1.2.3.4"},
		},
	})
	checkExternallyAccessible(true, &api.Service{
		Spec: api.ServiceSpec{
			Type: api.ServiceTypeLoadBalancer,
		},
	})
	checkExternallyAccessible(true, &api.Service{

				if svc.Attributes.ClusterExternalAddresses.Len() > 0 {
					// Fetch external IPs from all clusters
					svc.Attributes.ClusterExternalAddresses.ForEach(func(c cluster.ID, externalIPs []string) {
						foundExternal.InsertAll(externalIPs...)
					})
				} else if corev1.ServiceType(svc.Attributes.Type) == corev1.ServiceTypeLoadBalancer {
					if !foundPending.Contains(g) {

	istioService.Attributes.NodeLocal = nodeLocal
	if len(svc.Spec.ExternalIPs) > 0 {
		if istioService.Attributes.ClusterExternalAddresses == nil {
			istioService.Attributes.ClusterExternalAddresses = &model.AddressMap{}
		}
		istioService.Attributes.ClusterExternalAddresses.AddAddressesFor(clusterID, svc.Spec.ExternalIPs)
	}

	return istioService
}

      targetPort: 80
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
    annotations: {}
    loadBalancerIP: ""
    loadBalancerSourceRanges: []
    externalTrafficPolicy: ""
    externalIPs: []
    ipFamilyPolicy: ""
    ipFamilies: []
    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
    # allocateLoadBalancerNodePorts: false

  resources:
    requests:
      cpu: 100m

func ExternallyAccessible(service *v1.Service) bool {
	return service.Spec.Type == v1.ServiceTypeLoadBalancer ||
		service.Spec.Type == v1.ServiceTypeNodePort ||
		(service.Spec.Type == v1.ServiceTypeClusterIP && len(service.Spec.ExternalIPs) > 0)
}

// ExternalPolicyLocal checks if service is externally accessible and has ETP = Local.
func ExternalPolicyLocal(service *v1.Service) bool {
	if !ExternallyAccessible(service) {
		return false
	}

func ExternallyAccessible(service *api.Service) bool {
	return service.Spec.Type == api.ServiceTypeLoadBalancer ||
		service.Spec.Type == api.ServiceTypeNodePort ||
		(service.Spec.Type == api.ServiceTypeClusterIP && len(service.Spec.ExternalIPs) > 0)
}

// RequestsOnlyLocalTraffic checks if service requests OnlyLocal traffic.
func RequestsOnlyLocalTraffic(service *api.Service) bool {
	if service.Spec.Type != api.ServiceTypeLoadBalancer &&

	svc := &v1.Service{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "cleanup-test",
			Namespace: "test",
		},
		Spec: v1.ServiceSpec{
			ClusterIP:   testClusterIP,
			ExternalIPs: []string{testExternalIP},
			Ports: []v1.ServicePort{
				{
					Name:     "dns-tcp",
					Port:     testPort,
					Protocol: v1.ProtocolTCP,
				},
				{
					Name:     "dns-udp",
					Port:     testPort,

		if ip != nil {
			// Since ip is parsed ok, GetIPFamilyFromIP will never return v1.IPFamilyUnknown
			ipFamily := GetIPFamilyFromIP(ip)
			ipFamilyMap[ipFamily] = append(ipFamilyMap[ipFamily], ip)
		} else {
			// ExternalIPs may not be validated by the api-server.
			// Specifically empty strings validation, which yields into a lot
			// of bad error logs.
			if len(strings.TrimSpace(ipStr)) != 0 {

		for _, ip := range svc.Status.LoadBalancer.Ingress {
			if ip.IP == "" {
				addrs = append(addrs, ip.Hostname)
			} else {
				addrs = append(addrs, ip.IP)
			}
		}

		addrs = append(addrs, svc.Spec.ExternalIPs...)
		return addrs
	}

	// get all pods acting as ingress gateways
	igSelector := getIngressGatewaySelector(ingressSelector, ingressService)