cases := []struct {
			name     string
			p        *model.Proxy
			cfg      []config.Config
			services []*model.Service
		}{
			{
				name:     "simple",
				p:        p,
				services: []*model.Service{svc},
			},
			{
				name:     "sidecar with service",
				p:        p,
				services: []*model.Service{svc},
				cfg:      []config.Config{sidecarConfig},
			},
			{
				name:     "sidecar",

}

type Address_Service struct {
	// Service represents a service - a group of workloads that can be accessed together.
	Service *Service `protobuf:"bytes,2,opt,name=service,proto3,oneof"`
}

func (*Address_Workload) isAddress_Type() {}

func (*Address_Service) isAddress_Type() {}

// Service represents a service - a group of workloads that can be accessed together.

			},
			expectErrsOnFields: []string{},
		},
		// invalid use cases
		"backend with no service": {
			tweakIngress: func(ing *networking.Ingress) {
				ing.Spec.DefaultBackend.Service.Name = ""
			},
			expectErrsOnFields: []string{
				"spec.defaultBackend.service.name",
			},
		},
		"invalid path type": {
			tweakIngress: func(ing *networking.Ingress) {

  name: metallb-system:controller
rules:
- apiGroups:
  - ""
  resources:
  - services
  - namespaces
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - nodes
  verbs:
  - list
- apiGroups:
  - ""
  resources:
  - services/status
  verbs:
  - update
- apiGroups:
  - ""
  resources:
  - events

* Federation service controller is one key component of federation controller manager, it watches federation service, creates/updates services to all registered clusters, and update DNS records to global DNS server. ([#26034](https://github.com/kubernetes/kubernetes/pull/26034), [@mfanjie](https://github.com/mfanjie))

      --kubelet-client-key="${CERT_DIR}/client-kube-apiserver.key" \
      --service-account-key-file="${SERVICE_ACCOUNT_KEY}" \
      --service-account-lookup="${SERVICE_ACCOUNT_LOOKUP}" \
      --service-account-issuer="https://kubernetes.default.svc" \
      --service-account-jwks-uri="https://kubernetes.default.svc/openid/v1/jwks" \
      --service-account-signing-key-file="${SERVICE_ACCOUNT_KEY}" \

	s.assertEvent(t, s.podXdsName("pod3"))
	s.clearEvents()

	// Now add a service that will select pods with label "a".
	s.addService(t, "svc1",
		map[string]string{},
		map[string]string{},
		[]int32{80}, map[string]string{"app": "a"}, "10.0.0.1")
	s.assertEvent(t, s.podXdsName("pod1"), s.podXdsName("pod2"), s.svcXdsName("svc1"))

	// Services should appear with workloads when we get all resources.

						"Destination":  dst.Config().Service,
						"Source":       src.Config().Service,
						"Namespace":    apps.Namespace.Name(),
						"WaypointName": dst.Config().ServiceWaypointProxy,
					}, `
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy-waypoint
spec:
  targetRefs:
  # affects Waypoints
  - kind: Service
    group: core
    name: "{{ .Destination }}"

	var ik config.GroupVersionKind
	var ns string
	// Currently supported types are Gateway, Service, and ServiceEntry
	if kind == gvk.KubernetesGateway.Kind && group == gvk.KubernetesGateway.Group {
		ik = gvk.KubernetesGateway
	} else if kind == gvk.Service.Kind && group == gvk.Service.Group {
		ik = gvk.Service
	} else if kind == gvk.ServiceEntry.Kind && group == gvk.ServiceEntry.Group {
		ik = gvk.ServiceEntry
	} else {

			t.Fatalf("Unexpected virtualService, got %s, expected %s", config.Name, expectedVS[i])
		}
	}
}

func buildHTTPService(hostname string, v visibility.Instance, ip, namespace string, ports ...int) *Service {
	service := &Service{
		CreationTime:   time.Now(),
		Hostname:       host.Name(hostname),
		DefaultAddress: ip,
		Resolution:     DNSLB,
		Attributes: ServiceAttributes{
			ServiceRegistry: provider.Kubernetes,