}

// GetProxyServiceTargetsFromMetadata retrieves ServiceTargets using proxy Metadata rather than
// from the Pod. This allows retrieving Instances immediately, regardless of delays in Kubernetes.
// If the proxy doesn't have enough metadata, an error is returned
func (c *Controller) GetProxyServiceTargetsFromMetadata(proxy *model.Proxy) ([]model.ServiceTarget, error) {
	if len(proxy.Labels) == 0 {
		return nil, nil
	}

	ingressPortListSet := sets.New[int]()
	sidecarScope := lb.node.SidecarScope
	if sidecarScope.HasIngressListener() {
		ingressPortListSet = getSidecarIngressPortList(lb.node)
	}
	for _, i := range lb.node.ServiceTargets {
		bindToPort := getBindToPort(networking.CaptureMode_DEFAULT, lb.node)
		// Skip ports we cannot bind to
		if !lb.node.CanBindToPort(bindToPort, i.Port.TargetPort) {

	return nil
}

func (s *DiscoveryServer) instancesz(w http.ResponseWriter, req *http.Request) {
	instances := map[string][]model.ServiceTarget{}
	for _, con := range s.Clients() {
		con.proxy.RLock()
		if con.proxy != nil {
			instances[con.proxy.ID] = con.proxy.ServiceTargets
		}
		con.proxy.RUnlock()
	}
	writeJSON(w, instances, req)
}

		gateways          []config.Config
		virtualServices   []config.Config
		expectedListeners []string
	}{
		{
			"targetPort overrides service port",
			&pilot_model.Proxy{
				ServiceTargets: []pilot_model.ServiceTarget{
					{
						Service: &pilot_model.Service{
							Hostname: "test",
						},
						Port: pilot_model.ServiceInstancePort{
							ServicePort: &pilot_model.Port{
								Port: 80,

		IsWaypoint: false,
	}
	sampleWaypoint := WorkloadPolicyMatcher{
		Namespace: "default",
		WorkloadLabels: labels.Instance{
			constants.GatewayNameLabel: "sample-waypoint",
		},
		IsWaypoint: true,
	}
	serviceTarget := WorkloadPolicyMatcher{
		Namespace: "default",
		WorkloadLabels: labels.Instance{
			"app":                      "my-app",
			constants.GatewayNameLabel: "sample-waypoint",
		},
		IsWaypoint: true,

// 'in' services.
func (sd *ServiceDiscovery) GetProxyServiceTargets(node *model.Proxy) []model.ServiceTarget {
	sd.mutex.Lock()
	defer sd.mutex.Unlock()
	if sd.WantGetProxyServiceTargets != nil {
		return sd.WantGetProxyServiceTargets
	}
	out := make([]model.ServiceTarget, 0)
	for _, ip := range node.IPAddresses {
		si, found := sd.ip2instance[ip]
		if found {

	return !r.Cluster().Equals(nodeClusterID)
}

// GetProxyServiceTargets lists service instances co-located with a given proxy
func (c *Controller) GetProxyServiceTargets(node *model.Proxy) []model.ServiceTarget {
	out := make([]model.ServiceTarget, 0)
	nodeClusterID := nodeClusterID(node)
	for _, r := range c.GetRegistries() {
		if skipSearchingRegistryForProxy(nodeClusterID, r) {

			ClusterID:      clusterID,
			Labels: map[string]string{
				"app":                      "prod-app",
				label.SecurityTlsMode.Name: "mutual",
			},
		},
	})

	expected := model.ServiceTarget{
		Service: &model.Service{
			Hostname: "svc1.nsa.svc.company.com",
			ClusterVIPs: model.AddressMap{
				Addresses: map[cluster.ID][]string{clusterID: {"10.0.0.1"}},
			},
			DefaultAddress:  "10.0.0.1",

		name      string
		direction model.TrafficDirection
		cluster   *cluster.Cluster
		svcInsts  []model.ServiceTarget
		service   *model.Service
		want      *core.Metadata
	}{
		{
			name:      "no cluster",
			direction: model.TrafficDirectionInbound,
			cluster:   nil,
			svcInsts: []model.ServiceTarget{
				{
					Service: &model.Service{
						Attributes: model.ServiceAttributes{

				},
			},
		},
	}
	svc := &Service{
		Attributes: ServiceAttributes{
			Labels: map[string]string{},
		},
	}
	gatewayServiceTargets := []ServiceTarget{
		{
			Service: svc,
			Port: ServiceInstancePort{
				ServicePort: &Port{Port: 80},
				TargetPort:  80,
			},
		},
		{
			Service: svc,
			Port: ServiceInstancePort{