}
			}
		}

		allHostsValid := true
		for _, virtualHost := range virtualService.Hosts {
			if err := agent.ValidateWildcardDomain(virtualHost); err != nil {
				if !netutil.IsValidIPAddress(virtualHost) {
					errs = AppendValidation(errs, err)
					allHostsValid = false
				}
			} else if appliesToMesh && virtualHost == "*" {

			} else if len(ingress.Spec.ExternalIPs) > 0 {
				ingressIP = ingress.Spec.ExternalIPs[0]
			}
			// TODO: add case where the load balancer is a DNS name
		}
	}

	var hosts string
	if netutil.IsValidIPAddress(ingressIP) {
		hosts = fmt.Sprintf("%s %s\n", ingressIP, IstiodHost(istioNamespace, revision))
	} else {

		// 2. ep.Address can be uds when EndpointPort = 0
		if ep.Address != "" && ep.EndpointPort != 0 && !netutil.IsValidIPAddress(ep.Address) {
			return false
		}
		// filter out endpoints that don't match the subset
		if !b.subsetLabels.SubsetOf(ep.Labels) {
			return false
		}
		return true
	})

							// as service entries could have NONE resolution with label selectors for workload
							// entries (which could technically have hostnames).
							if !netutil.IsValidIPAddress(instance.Address) {
								continue
							}
							// Skip build outbound listener to the node itself,
							// as when app access itself by pod ip will not flow through this listener.