}, {
			JumpChain: string(kubeMarkMasqChain), MatchSet: "",
		}},
	}
	checkIptables(t, ipt, epIpt)
}

func addTestPort(array []v1.ServicePort, name string, protocol v1.Protocol, port, nodeport int32, targetPort int) []v1.ServicePort {
	svcPort := v1.ServicePort{
		Name:       name,
		Protocol:   protocol,
		Port:       port,
		NodePort:   nodeport,
		TargetPort: intstr.FromInt32(int32(targetPort)),
	}

) (*object.K8sObject, error) {
	var basePorts []*v1.ServicePort
	bps, _, err := unstructured.NestedSlice(oo.Unstructured(), "spec", "ports")
	if err != nil {
		return nil, err
	}
	bby, err := json.Marshal(bps)
	if err != nil {
		return nil, err
	}
	if err = json.Unmarshal(bby, &basePorts); err != nil {
		return nil, err
	}
	overlayPorts := make([]*v1.ServicePort, 0, len(msvc.GetPorts()))

    },
    "proxy_init": {
      "image": "proxyv2"
    },
    "remotePilotAddress": "",
    "sds": {
      "token": {
        "aud": "istio-ca"
      }
    },
    "sts": {
      "servicePort": 0
    },
    "tag": "latest",
    "variant": ""
  },
  "istio_cni": {
    "chained": true,
    "enabled": false,
    "provider": "default"
  },
  "pilot": {
    "cni": {

					WorkloadType:      workloadapi.WorkloadType_POD,
					WorkloadName:      "name1",
					Services: map[string]*workloadapi.PortList{
						"ns1/se.istio.io": {
							Ports: []*workloadapi.Port{
								{
									ServicePort: 80,
									TargetPort:  8081, // port is overridden by inlined WE port
								},
							},
						},
					},
					ClusterId: testC,
				},
			},
		},
	}})

    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
  {{- if .Values.global.sts.servicePort }}
    - --stsPort={{ .Values.global.sts.servicePort }}
  {{- end }}
  {{- if .Values.global.logAsJson }}
    - --log_as_json
  {{- end }}
  {{- if .Values.global.proxy.lifecycle }}
    lifecycle:

				Labels: map[string]string{
					label.TopologyNetwork.Name: "network-1",
				},
			},
			Spec: corev1.ServiceSpec{
				Type:  corev1.ServiceTypeLoadBalancer,
				Ports: []corev1.ServicePort{{Port: 15443, Protocol: corev1.ProtocolTCP}},
			},
			Status: corev1.ServiceStatus{
				LoadBalancer: corev1.LoadBalancerStatus{Ingress: []corev1.LoadBalancerIngress{{IP: "3.3.3.3"}}},
			},

  gateways:
  - gw-{{ .To.ServiceName }}
  http:
  - route:
    - destination:
        host: "{{ .To.ClusterLocalFQDN }}"
        port:

		Hostname: host.Name("test1"),
	}
	s.MemRegistry.AddService(svc)
	if _, err := ads.Wait(time.Second*10, watchAll...); err != nil {
		t.Fatal(err)
	}
	i := &model.ServiceInstance{
		Service:     svc,
		ServicePort: svc.Ports[0],
		Endpoint: &model.IstioEndpoint{
			Address:        "1.2.3.4",
			ServiceAccount: "spiffe://td1/ns/def/sa/def",
			HealthStatus:   model.UnHealthy,
		},
	}
	s.MemRegistry.AddInstance(i)

				},
			},
		},
	}

	serviceConfig := corev1.Service{
		ObjectMeta: metav1.ObjectMeta{
			Namespace: "mock",
			Name:      "bar",
		},
		Spec: corev1.ServiceSpec{
			Ports: []corev1.ServicePort{
				{
					Name: "http",
					Port: 8080,
				},
			},
		},
	}

	controller, client := newFakeController()
	ingress := clienttest.NewWriter[*net.Ingress](t, client)

//
//   - An indication of whether the service has any endpoints reachable from anywhere in the
//     cluster. (This may be true even if allReachableEndpoints is empty.)
func CategorizeEndpoints(endpoints []Endpoint, svcInfo ServicePort, nodeLabels map[string]string) (clusterEndpoints, localEndpoints, allReachableEndpoints []Endpoint, hasAnyEndpoints bool) {
	var useTopology, useServingTerminatingEndpoints bool

	if svcInfo.UsesClusterEndpoints() {