if svc.Attributes.ClusterExternalAddresses.Len() > 0 {
					// Fetch external IPs from all clusters
					svc.Attributes.ClusterExternalAddresses.ForEach(func(c cluster.ID, externalIPs []string) {
						foundExternal.InsertAll(externalIPs...)
					})
				} else if corev1.ServiceType(svc.Attributes.Type) == corev1.ServiceTypeLoadBalancer {
					if !foundPending.Contains(g) {

	istioService.Attributes.NodeLocal = nodeLocal
	if len(svc.Spec.ExternalIPs) > 0 {
		if istioService.Attributes.ClusterExternalAddresses == nil {
			istioService.Attributes.ClusterExternalAddresses = &model.AddressMap{}
		}
		istioService.Attributes.ClusterExternalAddresses.AddAddressesFor(clusterID, svc.Spec.ExternalIPs)
	}

	return istioService
}

      targetPort: 80
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
    annotations: {}
    loadBalancerIP: ""
    loadBalancerSourceRanges: []
    externalTrafficPolicy: ""
    externalIPs: []
    ipFamilyPolicy: ""
    ipFamilies: []
    ## Whether to automatically allocate NodePorts (only for LoadBalancers).
    # allocateLoadBalancerNodePorts: false

  resources:
    requests:
      cpu: 100m

func ExternallyAccessible(service *v1.Service) bool {
	return service.Spec.Type == v1.ServiceTypeLoadBalancer ||
		service.Spec.Type == v1.ServiceTypeNodePort ||
		(service.Spec.Type == v1.ServiceTypeClusterIP && len(service.Spec.ExternalIPs) > 0)
}

// ExternalPolicyLocal checks if service is externally accessible and has ETP = Local.
func ExternalPolicyLocal(service *v1.Service) bool {
	if !ExternallyAccessible(service) {
		return false
	}

func ExternallyAccessible(service *api.Service) bool {
	return service.Spec.Type == api.ServiceTypeLoadBalancer ||
		service.Spec.Type == api.ServiceTypeNodePort ||
		(service.Spec.Type == api.ServiceTypeClusterIP && len(service.Spec.ExternalIPs) > 0)
}

// RequestsOnlyLocalTraffic checks if service requests OnlyLocal traffic.
func RequestsOnlyLocalTraffic(service *api.Service) bool {
	if service.Spec.Type != api.ServiceTypeLoadBalancer &&

                type: array
              serviceExternalIPs:
                description: ServiceExternalIPs are the CIDR blocks for Kubernetes
                  Service External IPs. Kubernetes Service ExternalIPs will only be
                  advertised if they are within one of these blocks.
                items:
                  description: ServiceExternalIPBlock represents a single allowed

KUBE-NODE-PORT  all  --  0.0.0.0/0            0.0.0.0/0            match-set KUBE-NODE-PORT-TCP dst
```

**5. Service with externalIPs specified**

For service with `externalIPs` specified, IPVS proxier will install IPTABLES with match of ipset `KUBE-EXTERNAL-IP`,
Suppose we have service with `externalIPs` specified, IPTABLES rules should look like what is shown below.

```shell
Chain PREROUTING (policy ACCEPT)

// node, and the first IP is used as the `.status.HostIP` for all pods on the node.
func GetNodeHostIPs(node *v1.Node) ([]net.IP, error) {
	// Re-sort the addresses with InternalIPs first and then ExternalIPs
	allIPs := make([]net.IP, 0, len(node.Status.Addresses))
	for _, addr := range node.Status.Addresses {
		if addr.Type == v1.NodeInternalIP {
			ip := netutils.ParseIPSloppy(addr.Address)
			if ip != nil {

.Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }} nodePort: {{ .Values.consoleService.nodePort }} {{- else }} targetPort: {{ .Values.consoleService.port }} {{- end}} {{- if .Values.consoleService.externalIPs }} externalIPs: {{- range $i , $ip := .Values.consoleService.externalIPs }} - {{ $ip }} {{- end }} {{- end }} selector: app: {{ template "minio.name" . }} release: {{ .Release.Name }} minio/templates/deployment.yaml {{- if eq .Values.mode "standalone" }} {{ $scheme := "http" }} {{-...

## ref: http://kubernetes.io/docs/user-guide/services/
##
service:
  type: ClusterIP
  clusterIP: ~
  port: "9000"
  nodePort: 32000
  loadBalancerIP: ~
  externalIPs: []
  annotations: {}

  ## service.loadBalancerSourceRanges Addresses that are allowed when service is LoadBalancer