func toVirtualServer(svc *libipvs.Service) (*VirtualServer, error) {
	if svc == nil {
		return nil, errors.New("ipvs svc should not be empty")
	}
	vs := &VirtualServer{
		Address:   svc.Address,
		Port:      svc.Port,
		Scheduler: svc.SchedName,
		Protocol:  protocolToString(Protocol(svc.Protocol)),
		Timeout:   svc.Timeout,
	}

	namespace := ep.GetNamespace()
	svc := esc.c.services.Get(name, namespace)
	if svc == nil || svc.Spec.ClusterIP != corev1.ClusterIPNone || svc.Spec.Type == corev1.ServiceTypeExternalName {
		return
	}

	configs := []types.NamespacedName{}
	pureHTTP := true
	for _, modelSvc := range esc.c.servicesForNamespacedName(config.NamespacedName(svc)) {
		// skip push if it is not exported

        rewrite: /replacement
    route:
    - destination:
        host: httpbin.default.svc.domain.suffix
        port:
          number: 80
  - mirrors:
    - destination:
        host: httpbin-mirror.default.svc.domain.suffix
        port:
          number: 80
    - destination:
        host: httpbin-second.default.svc.domain.suffix
        port:
          number: 80
    name: default.mirror.0
    route:

    internal.istio.io/parents: TCPRoute/allowed-my-svc.istio-system
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: allowed-my-svc-tcp-0-istio-autogenerated-k8s-gateway
  namespace: istio-system
spec:
  gateways:
  - istio-system/gateway-istio-autogenerated-k8s-gateway-my-svc
  hosts:
  - '*'
  tcp:
  - route:
    - destination:
        host: my-svc.service.svc.domain.suffix
        port:

				return err
			}

			matchingServices := make([]corev1.Service, 0, len(svcs.Items))
			for _, svc := range svcs.Items {
				if len(svc.Spec.Selector) > 0 {
					svcSelector := klabels.SelectorFromSet(svc.Spec.Selector)
					if svcSelector.Matches(podLabels) {
						matchingServices = append(matchingServices, svc)
					}
				}
			}
			// Validate Istio's "Service association" requirement

subjectAltName = @alt_names
[alt_names]
URI = spiffe://cluster.local/ns/istio-system/sa/istio-pilot-service-account
DNS.1 = istiod.istio-system
DNS.2 = istiod.istio-system.svc
DNS.3 = istio-pilot.istio-system
DNS.4 = istio-pilot.istio-system.svc
DNS.5 = localhost
EOF


cat > "${WD}/mountedcerts-server.conf" <<EOF
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]

		annotations[api.AnnotationLoadBalancerSourceRangesKey] = v
		svc := api.Service{}
		svc.Annotations = annotations
		_, err := GetLoadBalancerSourceRanges(&svc)
		if err == nil {
			t.Errorf("Expected error parsing: %q", v)
		}
		svc = api.Service{}
		svc.Spec.LoadBalancerSourceRanges = strings.Split(v, ",")
		_, err = GetLoadBalancerSourceRanges(&svc)
		if err == nil {
			t.Errorf("Expected error parsing: %q", v)
		}
	}

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: eastwestgateway-istio.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:

    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: fake
    message: Resource programmed, assigned to service(s) istio-ingressgateway.istio-system.svc.domain.suffix:34000
      and istio-ingressgateway.istio-system.svc.domain.suffix:34001
    reason: Programmed
    status: "True"
    type: Programmed
  listeners:
  - attachedRoutes: 1
    conditions:
    - lastTransitionTime: fake

		}
	}
	// convert to EndpointIndex
	index := model.NewEndpointIndex(model.NewXdsCache())
	for shardKey, testEps := range shards.Shards {
		svc, _ := index.GetOrCreateEndpointShard("example.ns.svc.cluster.local", "ns")
		svc.Lock()
		svc.Shards[shardKey] = testEps
		svc.Unlock()
	}
	return index