ingressPortListSet := sets.New[int]()
	sidecarScope := lb.node.SidecarScope
	if sidecarScope.HasIngressListener() {
		ingressPortListSet = getSidecarIngressPortList(lb.node)
	}
	for _, i := range lb.node.ServiceTargets {
		bindToPort := getBindToPort(networking.CaptureMode_DEFAULT, lb.node)
		// Skip ports we cannot bind to
		if !lb.node.CanBindToPort(bindToPort, i.Port.TargetPort) {

	instances := map[string][]model.ServiceTarget{}
	for _, con := range s.Clients() {
		con.proxy.RLock()
		if con.proxy != nil {
			instances[con.proxy.ID] = con.proxy.ServiceTargets
		}
		con.proxy.RUnlock()
	}
	writeJSON(w, instances, req)
}

func (s *DiscoveryServer) networkz(w http.ResponseWriter, req *http.Request) {
	if s.Env == nil || s.Env.NetworkManager == nil {

		gateways          []config.Config
		virtualServices   []config.Config
		expectedListeners []string
	}{
		{
			"targetPort overrides service port",
			&pilot_model.Proxy{
				ServiceTargets: []pilot_model.ServiceTarget{
					{
						Service: &pilot_model.Service{
							Hostname: "test",
						},
						Port: pilot_model.ServiceInstancePort{
							ServicePort: &pilot_model.Port{

func (c *Controller) isControllerForProxy(proxy *model.Proxy) bool {
	return proxy.Metadata.ClusterID == "" || proxy.Metadata.ClusterID == c.Cluster()
}

// GetProxyServiceTargetsFromMetadata retrieves ServiceTargets using proxy Metadata rather than
// from the Pod. This allows retrieving Instances immediately, regardless of delays in Kubernetes.
// If the proxy doesn't have enough metadata, an error is returned