k8s.io/kubernetes@v1.29.3/pkg/registry/core/service/storage/storage_test.go (about)

     1  /*
     2  Copyright 2015 The Kubernetes Authors.
     3  
     4  Licensed under the Apache License, Version 2.0 (the "License");
     5  you may not use this file except in compliance with the License.
     6  You may obtain a copy of the License at
     7  
     8      http://www.apache.org/licenses/LICENSE-2.0
     9  
    10  Unless required by applicable law or agreed to in writing, software
    11  distributed under the License is distributed on an "AS IS" BASIS,
    12  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    13  See the License for the specific language governing permissions and
    14  limitations under the License.
    15  */
    16  
    17  package storage
    18  
    19  import (
    20  	"context"
    21  	"fmt"
    22  	"net"
    23  	"reflect"
    24  	stdruntime "runtime"
    25  	"strings"
    26  	"testing"
    27  
    28  	"github.com/google/go-cmp/cmp"
    29  	"github.com/google/go-cmp/cmp/cmpopts"
    30  	"k8s.io/apimachinery/pkg/api/errors"
    31  	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
    32  	"k8s.io/apimachinery/pkg/fields"
    33  	"k8s.io/apimachinery/pkg/labels"
    34  	"k8s.io/apimachinery/pkg/runtime"
    35  	"k8s.io/apimachinery/pkg/runtime/schema"
    36  	"k8s.io/apimachinery/pkg/util/intstr"
    37  	machineryutilnet "k8s.io/apimachinery/pkg/util/net"
    38  	genericapirequest "k8s.io/apiserver/pkg/endpoints/request"
    39  	"k8s.io/apiserver/pkg/registry/generic"
    40  	genericregistrytest "k8s.io/apiserver/pkg/registry/generic/testing"
    41  	"k8s.io/apiserver/pkg/registry/rest"
    42  	etcd3testing "k8s.io/apiserver/pkg/storage/etcd3/testing"
    43  	utilfeature "k8s.io/apiserver/pkg/util/feature"
    44  	featuregatetesting "k8s.io/component-base/featuregate/testing"
    45  	epstest "k8s.io/kubernetes/pkg/api/endpoints/testing"
    46  	svctest "k8s.io/kubernetes/pkg/api/service/testing"
    47  	api "k8s.io/kubernetes/pkg/apis/core"
    48  	"k8s.io/kubernetes/pkg/features"
    49  	endpointstore "k8s.io/kubernetes/pkg/registry/core/endpoint/storage"
    50  	podstore "k8s.io/kubernetes/pkg/registry/core/pod/storage"
    51  	"k8s.io/kubernetes/pkg/registry/core/service/ipallocator"
    52  	"k8s.io/kubernetes/pkg/registry/core/service/portallocator"
    53  	"k8s.io/kubernetes/pkg/registry/registrytest"
    54  	netutils "k8s.io/utils/net"
    55  )
    56  
    57  // Most tests will use this to create a registry to run tests against.
    58  func newStorage(t *testing.T, ipFamilies []api.IPFamily) (*wrapperRESTForTests, *StatusREST, *etcd3testing.EtcdTestServer) {
    59  	return newStorageWithPods(t, ipFamilies, nil, nil)
    60  }
    61  
    62  func newStorageWithPods(t *testing.T, ipFamilies []api.IPFamily, pods []api.Pod, endpoints []*api.Endpoints) (*wrapperRESTForTests, *StatusREST, *etcd3testing.EtcdTestServer) {
    63  	etcdStorage, server := registrytest.NewEtcdStorage(t, "")
    64  	restOptions := generic.RESTOptions{
    65  		StorageConfig:           etcdStorage.ForResource(schema.GroupResource{Resource: "services"}),
    66  		Decorator:               generic.UndecoratedStorage,
    67  		DeleteCollectionWorkers: 1,
    68  		ResourcePrefix:          "services",
    69  	}
    70  
    71  	ipAllocs := map[api.IPFamily]ipallocator.Interface{}
    72  	for _, fam := range ipFamilies {
    73  		switch fam {
    74  		case api.IPv4Protocol:
    75  			_, cidr, _ := netutils.ParseCIDRSloppy("10.0.0.0/16")
    76  			ipAllocs[fam] = makeIPAllocator(cidr)
    77  		case api.IPv6Protocol:
    78  			_, cidr, _ := netutils.ParseCIDRSloppy("2000::/108")
    79  			ipAllocs[fam] = makeIPAllocator(cidr)
    80  		default:
    81  			t.Fatalf("Unknown IPFamily: %v", fam)
    82  		}
    83  	}
    84  
    85  	portAlloc := makePortAllocator(*(machineryutilnet.ParsePortRangeOrDie("30000-32767")))
    86  
    87  	// Not all tests will specify pods and endpoints.
    88  	podStorage, err := podstore.NewStorage(generic.RESTOptions{
    89  		StorageConfig:           etcdStorage,
    90  		Decorator:               generic.UndecoratedStorage,
    91  		DeleteCollectionWorkers: 3,
    92  		ResourcePrefix:          "pods",
    93  	}, nil, nil, nil)
    94  	if err != nil {
    95  		t.Fatalf("unexpected error from REST storage: %v", err)
    96  	}
    97  	if pods != nil && len(pods) > 0 {
    98  		ctx := genericapirequest.NewDefaultContext()
    99  		for ix := range pods {
   100  			key, _ := podStorage.Pod.KeyFunc(ctx, pods[ix].Name)
   101  			if err := podStorage.Pod.Storage.Create(ctx, key, &pods[ix], nil, 0, false); err != nil {
   102  				t.Fatalf("Couldn't create pod: %v", err)
   103  			}
   104  		}
   105  	}
   106  
   107  	endpointsStorage, err := endpointstore.NewREST(generic.RESTOptions{
   108  		StorageConfig:  etcdStorage,
   109  		Decorator:      generic.UndecoratedStorage,
   110  		ResourcePrefix: "endpoints",
   111  	})
   112  	if err != nil {
   113  		t.Fatalf("unexpected error from REST storage: %v", err)
   114  	}
   115  	if endpoints != nil && len(endpoints) > 0 {
   116  		ctx := genericapirequest.NewDefaultContext()
   117  		for ix := range endpoints {
   118  			key, _ := endpointsStorage.KeyFunc(ctx, endpoints[ix].Name)
   119  			if err := endpointsStorage.Store.Storage.Create(ctx, key, endpoints[ix], nil, 0, false); err != nil {
   120  				t.Fatalf("Couldn't create endpoint: %v", err)
   121  			}
   122  		}
   123  	}
   124  
   125  	serviceStorage, statusStorage, _, err := NewREST(restOptions, ipFamilies[0], ipAllocs, portAlloc, endpointsStorage, podStorage.Pod, nil)
   126  	if err != nil {
   127  		t.Fatalf("unexpected error from REST storage: %v", err)
   128  	}
   129  	return &wrapperRESTForTests{serviceStorage}, statusStorage, server
   130  }
   131  
   132  func makeIPAllocator(cidr *net.IPNet) ipallocator.Interface {
   133  	al, err := ipallocator.NewInMemory(cidr)
   134  	if err != nil {
   135  		panic(fmt.Sprintf("error creating IP allocator: %v", err))
   136  	}
   137  	return al
   138  }
   139  
   140  func makePortAllocator(ports machineryutilnet.PortRange) portallocator.Interface {
   141  	al, err := portallocator.NewInMemory(ports)
   142  	if err != nil {
   143  		panic(fmt.Sprintf("error creating port allocator: %v", err))
   144  	}
   145  	return al
   146  }
   147  
   148  // wrapperRESTForTests is a *trivial* wrapper for the real REST, which allows us to do
   149  // things that are specifically to enhance test safety.
   150  type wrapperRESTForTests struct {
   151  	*REST
   152  }
   153  
   154  func (f *wrapperRESTForTests) Create(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions) (runtime.Object, error) {
   155  	// Making a DeepCopy here ensures that any in-place mutations of the input
   156  	// are not going to propagate to verification code, which used to happen
   157  	// resulting in tests that passed when they shouldn't have.
   158  	obj = obj.DeepCopyObject()
   159  	return f.REST.Create(ctx, obj, createValidation, options)
   160  }
   161  
   162  //
   163  // Generic registry tests
   164  //
   165  
   166  // This is used in generic registry tests.
   167  func validService() *api.Service {
   168  	return svctest.MakeService("foo",
   169  		svctest.SetClusterIPs(api.ClusterIPNone),
   170  		svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   171  		svctest.SetIPFamilies(api.IPv4Protocol))
   172  }
   173  
   174  func TestGenericCreate(t *testing.T) {
   175  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   176  	defer server.Terminate(t)
   177  	defer storage.Store.DestroyFunc()
   178  	test := genericregistrytest.New(t, storage.Store)
   179  	svc := validService()
   180  	svc.ObjectMeta = metav1.ObjectMeta{} // because genericregistrytest
   181  	test.TestCreate(
   182  		// valid
   183  		svc,
   184  		// invalid
   185  		&api.Service{
   186  			Spec: api.ServiceSpec{},
   187  		},
   188  	)
   189  }
   190  
   191  func TestGenericUpdate(t *testing.T) {
   192  	clusterInternalTrafficPolicy := api.ServiceInternalTrafficPolicyCluster
   193  
   194  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   195  	defer server.Terminate(t)
   196  	defer storage.Store.DestroyFunc()
   197  	test := genericregistrytest.New(t, storage.Store).AllowCreateOnUpdate()
   198  	test.TestUpdate(
   199  		// valid
   200  		validService(),
   201  		// updateFunc
   202  		func(obj runtime.Object) runtime.Object {
   203  			object := obj.(*api.Service)
   204  			object.Spec = api.ServiceSpec{
   205  				Selector:        map[string]string{"bar": "baz2"},
   206  				ClusterIP:       api.ClusterIPNone,
   207  				ClusterIPs:      []string{api.ClusterIPNone},
   208  				SessionAffinity: api.ServiceAffinityNone,
   209  				Type:            api.ServiceTypeClusterIP,
   210  				Ports: []api.ServicePort{{
   211  					Port:       6502,
   212  					Protocol:   api.ProtocolTCP,
   213  					TargetPort: intstr.FromInt32(6502),
   214  				}},
   215  				InternalTrafficPolicy: &clusterInternalTrafficPolicy,
   216  			}
   217  			return object
   218  		},
   219  	)
   220  }
   221  
   222  func TestGenericDelete(t *testing.T) {
   223  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   224  	defer server.Terminate(t)
   225  	defer storage.Store.DestroyFunc()
   226  	test := genericregistrytest.New(t, storage.Store).AllowCreateOnUpdate().ReturnDeletedObject()
   227  	test.TestDelete(validService())
   228  }
   229  
   230  func TestGenericGet(t *testing.T) {
   231  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   232  	defer server.Terminate(t)
   233  	defer storage.Store.DestroyFunc()
   234  	test := genericregistrytest.New(t, storage.Store).AllowCreateOnUpdate()
   235  	test.TestGet(validService())
   236  }
   237  
   238  func TestGenericList(t *testing.T) {
   239  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   240  	defer server.Terminate(t)
   241  	defer storage.Store.DestroyFunc()
   242  	test := genericregistrytest.New(t, storage.Store).AllowCreateOnUpdate()
   243  	test.TestList(validService())
   244  }
   245  
   246  func TestGenericWatch(t *testing.T) {
   247  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   248  	defer server.Terminate(t)
   249  	defer storage.Store.DestroyFunc()
   250  	test := genericregistrytest.New(t, storage.Store)
   251  	test.TestWatch(
   252  		validService(),
   253  		// matching labels
   254  		[]labels.Set{},
   255  		// not matching labels
   256  		[]labels.Set{
   257  			{"foo": "bar"},
   258  		},
   259  		// matching fields
   260  		[]fields.Set{
   261  			{"metadata.name": "foo"},
   262  		},
   263  		// not matching fields
   264  		[]fields.Set{
   265  			{"metadata.name": "bar"},
   266  		},
   267  	)
   268  }
   269  
   270  func TestGenericShortNames(t *testing.T) {
   271  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   272  	defer server.Terminate(t)
   273  	defer storage.Store.DestroyFunc()
   274  	expected := []string{"svc"}
   275  	registrytest.AssertShortNames(t, storage, expected)
   276  }
   277  
   278  func TestGenericCategories(t *testing.T) {
   279  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
   280  	defer server.Terminate(t)
   281  	defer storage.Store.DestroyFunc()
   282  	expected := []string{"all"}
   283  	registrytest.AssertCategories(t, storage, expected)
   284  }
   285  
   286  //
   287  // Tests of internal functions
   288  //
   289  
   290  func TestNormalizeClusterIPs(t *testing.T) {
   291  	makeServiceWithClusterIp := func(clusterIP string, clusterIPs []string) *api.Service {
   292  		return &api.Service{
   293  			Spec: api.ServiceSpec{
   294  				ClusterIP:  clusterIP,
   295  				ClusterIPs: clusterIPs,
   296  			},
   297  		}
   298  	}
   299  
   300  	testCases := []struct {
   301  		name               string
   302  		oldService         *api.Service
   303  		newService         *api.Service
   304  		expectedClusterIP  string
   305  		expectedClusterIPs []string
   306  	}{{
   307  		name:               "new - only clusterip used",
   308  		oldService:         nil,
   309  		newService:         makeServiceWithClusterIp("10.0.0.10", nil),
   310  		expectedClusterIP:  "10.0.0.10",
   311  		expectedClusterIPs: []string{"10.0.0.10"},
   312  	}, {
   313  		name:               "new - only clusterips used",
   314  		oldService:         nil,
   315  		newService:         makeServiceWithClusterIp("", []string{"10.0.0.10"}),
   316  		expectedClusterIP:  "", // this is a validation issue, and validation will catch it
   317  		expectedClusterIPs: []string{"10.0.0.10"},
   318  	}, {
   319  		name:               "new - both used",
   320  		oldService:         nil,
   321  		newService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   322  		expectedClusterIP:  "10.0.0.10",
   323  		expectedClusterIPs: []string{"10.0.0.10"},
   324  	}, {
   325  		name:               "update - no change",
   326  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   327  		newService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   328  		expectedClusterIP:  "10.0.0.10",
   329  		expectedClusterIPs: []string{"10.0.0.10"},
   330  	}, {
   331  		name:               "update - malformed change",
   332  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   333  		newService:         makeServiceWithClusterIp("10.0.0.11", []string{"10.0.0.11"}),
   334  		expectedClusterIP:  "10.0.0.11",
   335  		expectedClusterIPs: []string{"10.0.0.11"},
   336  	}, {
   337  		name:               "update - malformed change on secondary ip",
   338  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10", "2000::1"}),
   339  		newService:         makeServiceWithClusterIp("10.0.0.11", []string{"10.0.0.11", "3000::1"}),
   340  		expectedClusterIP:  "10.0.0.11",
   341  		expectedClusterIPs: []string{"10.0.0.11", "3000::1"},
   342  	}, {
   343  		name:               "update - upgrade",
   344  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   345  		newService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10", "2000::1"}),
   346  		expectedClusterIP:  "10.0.0.10",
   347  		expectedClusterIPs: []string{"10.0.0.10", "2000::1"},
   348  	}, {
   349  		name:               "update - downgrade",
   350  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10", "2000::1"}),
   351  		newService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   352  		expectedClusterIP:  "10.0.0.10",
   353  		expectedClusterIPs: []string{"10.0.0.10"},
   354  	}, {
   355  		name:               "update - user cleared cluster IP",
   356  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   357  		newService:         makeServiceWithClusterIp("", []string{"10.0.0.10"}),
   358  		expectedClusterIP:  "",
   359  		expectedClusterIPs: nil,
   360  	}, {
   361  		name:               "update - user cleared clusterIPs", // *MUST* REMAIN FOR OLD CLIENTS
   362  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   363  		newService:         makeServiceWithClusterIp("10.0.0.10", nil),
   364  		expectedClusterIP:  "10.0.0.10",
   365  		expectedClusterIPs: []string{"10.0.0.10"},
   366  	}, {
   367  		name:               "update - user cleared both",
   368  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   369  		newService:         makeServiceWithClusterIp("", nil),
   370  		expectedClusterIP:  "",
   371  		expectedClusterIPs: nil,
   372  	}, {
   373  		name:               "update - user cleared ClusterIP but changed clusterIPs",
   374  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   375  		newService:         makeServiceWithClusterIp("", []string{"10.0.0.11"}),
   376  		expectedClusterIP:  "", /* validation catches this */
   377  		expectedClusterIPs: []string{"10.0.0.11"},
   378  	}, {
   379  		name:               "update - user cleared ClusterIPs but changed ClusterIP",
   380  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10", "2000::1"}),
   381  		newService:         makeServiceWithClusterIp("10.0.0.11", nil),
   382  		expectedClusterIP:  "10.0.0.11",
   383  		expectedClusterIPs: nil,
   384  	}, {
   385  		name:               "update - user changed from None to ClusterIP",
   386  		oldService:         makeServiceWithClusterIp("None", []string{"None"}),
   387  		newService:         makeServiceWithClusterIp("10.0.0.10", []string{"None"}),
   388  		expectedClusterIP:  "10.0.0.10",
   389  		expectedClusterIPs: []string{"10.0.0.10"},
   390  	}, {
   391  		name:               "update - user changed from ClusterIP to None",
   392  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10"}),
   393  		newService:         makeServiceWithClusterIp("None", []string{"10.0.0.10"}),
   394  		expectedClusterIP:  "None",
   395  		expectedClusterIPs: []string{"None"},
   396  	}, {
   397  		name:               "update - user changed from ClusterIP to None and changed ClusterIPs in a dual stack (new client making a mistake)",
   398  		oldService:         makeServiceWithClusterIp("10.0.0.10", []string{"10.0.0.10", "2000::1"}),
   399  		newService:         makeServiceWithClusterIp("None", []string{"10.0.0.11", "2000::1"}),
   400  		expectedClusterIP:  "None",
   401  		expectedClusterIPs: []string{"10.0.0.11", "2000::1"},
   402  	}}
   403  
   404  	for _, tc := range testCases {
   405  		t.Run(tc.name, func(t *testing.T) {
   406  			normalizeClusterIPs(After{tc.newService}, Before{tc.oldService})
   407  
   408  			if tc.newService == nil {
   409  				t.Fatalf("unexpected new service to be nil")
   410  			}
   411  
   412  			if tc.newService.Spec.ClusterIP != tc.expectedClusterIP {
   413  				t.Fatalf("expected clusterIP [%v] got [%v]", tc.expectedClusterIP, tc.newService.Spec.ClusterIP)
   414  			}
   415  
   416  			if len(tc.newService.Spec.ClusterIPs) != len(tc.expectedClusterIPs) {
   417  				t.Fatalf("expected  clusterIPs %v got %v", tc.expectedClusterIPs, tc.newService.Spec.ClusterIPs)
   418  			}
   419  
   420  			for idx, clusterIP := range tc.newService.Spec.ClusterIPs {
   421  				if clusterIP != tc.expectedClusterIPs[idx] {
   422  					t.Fatalf("expected clusterIP [%v] at index[%v] got [%v]", tc.expectedClusterIPs[idx], idx, tc.newService.Spec.ClusterIPs[idx])
   423  
   424  				}
   425  			}
   426  		})
   427  	}
   428  }
   429  
   430  func TestPatchAllocatedValues(t *testing.T) {
   431  	testCases := []struct {
   432  		name                    string
   433  		before                  *api.Service
   434  		update                  *api.Service
   435  		expectSameClusterIPs    bool
   436  		expectReducedClusterIPs bool
   437  		expectSameNodePort      bool
   438  		expectSameHCNP          bool
   439  	}{{
   440  		name: "all_patched",
   441  		before: svctest.MakeService("foo",
   442  			svctest.SetTypeLoadBalancer,
   443  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
   444  			svctest.SetClusterIPs("10.0.0.93", "2000::76"),
   445  			svctest.SetUniqueNodePorts,
   446  			svctest.SetHealthCheckNodePort(31234)),
   447  		update: svctest.MakeService("foo",
   448  			svctest.SetTypeLoadBalancer,
   449  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
   450  		expectSameClusterIPs: true,
   451  		expectSameNodePort:   true,
   452  		expectSameHCNP:       true,
   453  	}, {
   454  		name: "IPs_patched",
   455  		before: svctest.MakeService("foo",
   456  			svctest.SetTypeClusterIP,
   457  			svctest.SetClusterIPs("10.0.0.93", "2000::76"),
   458  			// these are not valid, but prove the test
   459  			svctest.SetUniqueNodePorts,
   460  			svctest.SetHealthCheckNodePort(31234)),
   461  		update: svctest.MakeService("foo",
   462  			svctest.SetTypeClusterIP),
   463  		expectSameClusterIPs: true,
   464  	}, {
   465  		name: "NPs_patched",
   466  		before: svctest.MakeService("foo",
   467  			svctest.SetTypeNodePort,
   468  			svctest.SetClusterIPs("10.0.0.93", "2000::76"),
   469  			svctest.SetUniqueNodePorts,
   470  			// this is not valid, but proves the test
   471  			svctest.SetHealthCheckNodePort(31234)),
   472  		update: svctest.MakeService("foo",
   473  			svctest.SetTypeNodePort,
   474  			svctest.SetClusterIPs("10.0.0.93", "2000::76")),
   475  		expectSameClusterIPs: true,
   476  		expectSameNodePort:   true,
   477  	}, {
   478  		name: "HCNP_patched",
   479  		before: svctest.MakeService("foo",
   480  			svctest.SetTypeLoadBalancer,
   481  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
   482  			svctest.SetClusterIPs("10.0.0.93", "2000::76"),
   483  			svctest.SetUniqueNodePorts,
   484  			svctest.SetHealthCheckNodePort(31234)),
   485  		update: svctest.MakeService("foo",
   486  			svctest.SetTypeLoadBalancer,
   487  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
   488  			svctest.SetClusterIPs("10.0.0.93", "2000::76"),
   489  			svctest.SetUniqueNodePorts),
   490  		expectSameClusterIPs: true,
   491  		expectSameNodePort:   true,
   492  		expectSameHCNP:       true,
   493  	}, {
   494  		name: "nothing_patched",
   495  		before: svctest.MakeService("foo",
   496  			svctest.SetTypeExternalName,
   497  			// these are not valid, but prove the test
   498  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
   499  			svctest.SetClusterIPs("10.0.0.93", "2000::76"),
   500  			svctest.SetUniqueNodePorts,
   501  			svctest.SetHealthCheckNodePort(31234)),
   502  		update: svctest.MakeService("foo",
   503  			svctest.SetTypeExternalName,
   504  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
   505  	}}
   506  
   507  	for _, tc := range testCases {
   508  		t.Run(tc.name, func(t *testing.T) {
   509  			update := tc.update.DeepCopy()
   510  			patchAllocatedValues(After{update}, Before{tc.before})
   511  
   512  			beforeIP := tc.before.Spec.ClusterIP
   513  			updateIP := update.Spec.ClusterIP
   514  			if tc.expectSameClusterIPs || tc.expectReducedClusterIPs {
   515  				if beforeIP != updateIP {
   516  					t.Errorf("expected clusterIP to be patched: %q != %q", beforeIP, updateIP)
   517  				}
   518  			} else if beforeIP == updateIP {
   519  				t.Errorf("expected clusterIP to not be patched: %q == %q", beforeIP, updateIP)
   520  			}
   521  
   522  			beforeIPs := tc.before.Spec.ClusterIPs
   523  			updateIPs := update.Spec.ClusterIPs
   524  			if tc.expectSameClusterIPs {
   525  				if !cmp.Equal(beforeIPs, updateIPs) {
   526  					t.Errorf("expected clusterIPs to be patched: %q != %q", beforeIPs, updateIPs)
   527  				}
   528  			} else if tc.expectReducedClusterIPs {
   529  				if len(updateIPs) != 1 || beforeIPs[0] != updateIPs[0] {
   530  					t.Errorf("expected clusterIPs to be trim-patched: %q -> %q", beforeIPs, updateIPs)
   531  				}
   532  			} else if cmp.Equal(beforeIPs, updateIPs) {
   533  				t.Errorf("expected clusterIPs to not be patched: %q == %q", beforeIPs, updateIPs)
   534  			}
   535  			if b, u := tc.before.Spec.Ports[0].NodePort, update.Spec.Ports[0].NodePort; tc.expectSameNodePort && b != u {
   536  				t.Errorf("expected nodePort to be patched: %d != %d", b, u)
   537  			} else if !tc.expectSameNodePort && b == u {
   538  				t.Errorf("expected nodePort to not be patched: %d == %d", b, u)
   539  			}
   540  
   541  			if b, u := tc.before.Spec.HealthCheckNodePort, update.Spec.HealthCheckNodePort; tc.expectSameHCNP && b != u {
   542  				t.Errorf("expected healthCheckNodePort to be patched: %d != %d", b, u)
   543  			} else if !tc.expectSameHCNP && b == u {
   544  				t.Errorf("expected healthCheckNodePort to not be patched: %d == %d", b, u)
   545  			}
   546  		})
   547  	}
   548  }
   549  
   550  func TestServiceDefaultOnRead(t *testing.T) {
   551  	// Helper makes a mostly-valid ServiceList.  Test-cases can tweak it as needed.
   552  	makeServiceList := func(tweaks ...svctest.Tweak) *api.ServiceList {
   553  		svc := svctest.MakeService("foo", tweaks...)
   554  		list := &api.ServiceList{
   555  			Items: []api.Service{*svc},
   556  		}
   557  		return list
   558  	}
   559  
   560  	testCases := []struct {
   561  		name   string
   562  		input  runtime.Object
   563  		expect runtime.Object
   564  	}{{
   565  		name:  "single v4",
   566  		input: svctest.MakeService("foo", svctest.SetClusterIPs("10.0.0.1")),
   567  		expect: svctest.MakeService("foo", svctest.SetClusterIPs("10.0.0.1"),
   568  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   569  			svctest.SetIPFamilies(api.IPv4Protocol)),
   570  	}, {
   571  		name:  "single v6",
   572  		input: svctest.MakeService("foo", svctest.SetClusterIPs("2000::1")),
   573  		expect: svctest.MakeService("foo", svctest.SetClusterIPs("2000::1"),
   574  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   575  			svctest.SetIPFamilies(api.IPv6Protocol)),
   576  	}, {
   577  		name:  "missing clusterIPs v4",
   578  		input: svctest.MakeService("foo", svctest.SetClusterIP("10.0.0.1")),
   579  		expect: svctest.MakeService("foo", svctest.SetClusterIPs("10.0.0.1"),
   580  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   581  			svctest.SetIPFamilies(api.IPv4Protocol)),
   582  	}, {
   583  		name:  "missing clusterIPs v6",
   584  		input: svctest.MakeService("foo", svctest.SetClusterIP("2000::1")),
   585  		expect: svctest.MakeService("foo", svctest.SetClusterIPs("2000::1"),
   586  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   587  			svctest.SetIPFamilies(api.IPv6Protocol)),
   588  	}, {
   589  		name:  "list v4",
   590  		input: makeServiceList(svctest.SetClusterIPs("10.0.0.1")),
   591  		expect: makeServiceList(svctest.SetClusterIPs("10.0.0.1"),
   592  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   593  			svctest.SetIPFamilies(api.IPv4Protocol)),
   594  	}, {
   595  		name:  "list missing clusterIPs v4",
   596  		input: makeServiceList(svctest.SetClusterIP("10.0.0.1")),
   597  		expect: makeServiceList(svctest.SetClusterIPs("10.0.0.1"),
   598  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   599  			svctest.SetIPFamilies(api.IPv4Protocol)),
   600  	}, {
   601  		name:   "external name",
   602  		input:  makeServiceList(svctest.SetTypeExternalName, svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyCluster)),
   603  		expect: makeServiceList(svctest.SetTypeExternalName),
   604  	}, {
   605  		name:  "dual v4v6",
   606  		input: svctest.MakeService("foo", svctest.SetClusterIPs("10.0.0.1", "2000::1")),
   607  		expect: svctest.MakeService("foo", svctest.SetClusterIPs("10.0.0.1", "2000::1"),
   608  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
   609  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
   610  	}, {
   611  		name:  "dual v6v4",
   612  		input: svctest.MakeService("foo", svctest.SetClusterIPs("2000::1", "10.0.0.1")),
   613  		expect: svctest.MakeService("foo", svctest.SetClusterIPs("2000::1", "10.0.0.1"),
   614  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
   615  			svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
   616  	}, {
   617  		name:  "headless",
   618  		input: svctest.MakeService("foo", svctest.SetHeadless),
   619  		expect: svctest.MakeService("foo", svctest.SetHeadless,
   620  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   621  			svctest.SetIPFamilies(api.IPv4Protocol)),
   622  	}, {
   623  		name: "headless selectorless",
   624  		input: svctest.MakeService("foo", svctest.SetHeadless,
   625  			svctest.SetSelector(map[string]string{})),
   626  		expect: svctest.MakeService("foo", svctest.SetHeadless,
   627  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
   628  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
   629  	}, {
   630  		name: "headless selectorless pre-set",
   631  		input: svctest.MakeService("foo", svctest.SetHeadless,
   632  			svctest.SetSelector(map[string]string{}),
   633  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   634  			svctest.SetIPFamilies(api.IPv6Protocol)),
   635  		expect: svctest.MakeService("foo", svctest.SetHeadless,
   636  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
   637  			svctest.SetIPFamilies(api.IPv6Protocol)),
   638  	}, {
   639  		name:  "not Service or ServiceList",
   640  		input: &api.Pod{},
   641  	}}
   642  
   643  	for _, tc := range testCases {
   644  		t.Run(tc.name, func(t *testing.T) {
   645  			storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
   646  			defer server.Terminate(t)
   647  			defer storage.Store.DestroyFunc()
   648  
   649  			tmp := tc.input.DeepCopyObject()
   650  			storage.defaultOnRead(tmp)
   651  
   652  			svc, ok := tmp.(*api.Service)
   653  			if !ok {
   654  				list, ok := tmp.(*api.ServiceList)
   655  				if !ok {
   656  					return
   657  				}
   658  				svc = &list.Items[0]
   659  			}
   660  
   661  			exp, ok := tc.expect.(*api.Service)
   662  			if !ok {
   663  				list, ok := tc.expect.(*api.ServiceList)
   664  				if !ok {
   665  					return
   666  				}
   667  				exp = &list.Items[0]
   668  			}
   669  
   670  			// Verify fields we know are affected
   671  			if want, got := exp.Spec.ClusterIP, svc.Spec.ClusterIP; want != got {
   672  				t.Errorf("clusterIP: expected %v, got %v", want, got)
   673  			}
   674  			if want, got := exp.Spec.ClusterIPs, svc.Spec.ClusterIPs; !reflect.DeepEqual(want, got) {
   675  				t.Errorf("clusterIPs: expected %v, got %v", want, got)
   676  			}
   677  			if want, got := fmtIPFamilyPolicy(exp.Spec.IPFamilyPolicy), fmtIPFamilyPolicy(svc.Spec.IPFamilyPolicy); want != got {
   678  				t.Errorf("ipFamilyPolicy: expected %v, got %v", want, got)
   679  			}
   680  			if want, got := exp.Spec.IPFamilies, svc.Spec.IPFamilies; !reflect.DeepEqual(want, got) {
   681  				t.Errorf("ipFamilies: expected %v, got %v", want, got)
   682  			}
   683  			if want, got := fmtInternalTrafficPolicy(exp.Spec.InternalTrafficPolicy), fmtInternalTrafficPolicy(svc.Spec.InternalTrafficPolicy); want != got {
   684  				t.Errorf("internalTrafficPolicy: expected %v, got %v", want, got)
   685  			}
   686  		})
   687  	}
   688  }
   689  
   690  //
   691  // Scaffolding for create-update-delete tests.  Many tests can and should be
   692  // written in terms of this.
   693  //
   694  
   695  type cudTestCase struct {
   696  	name         string
   697  	line         string // if not empty, will be logged with errors, use line() to set
   698  	create       svcTestCase
   699  	beforeUpdate func(t *testing.T, storage *wrapperRESTForTests)
   700  	update       svcTestCase
   701  }
   702  
   703  type svcTestCase struct {
   704  	svc         *api.Service
   705  	expectError bool
   706  
   707  	// We could calculate these by looking at the Service, but that's a
   708  	// vector for test bugs and more importantly it makes the test cases less
   709  	// self-documenting.
   710  	expectClusterIPs          bool
   711  	expectStackDowngrade      bool
   712  	expectHeadless            bool
   713  	expectNodePorts           bool
   714  	expectHealthCheckNodePort bool
   715  
   716  	// Additional proofs, provided by the tests which use this.
   717  	prove []svcTestProof
   718  }
   719  
   720  type svcTestProof func(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service)
   721  
   722  // Most tests will call this.
   723  func helpTestCreateUpdateDelete(t *testing.T, testCases []cudTestCase) {
   724  	t.Helper()
   725  	helpTestCreateUpdateDeleteWithFamilies(t, testCases, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
   726  }
   727  
   728  func helpTestCreateUpdateDeleteWithFamilies(t *testing.T, testCases []cudTestCase, ipFamilies []api.IPFamily) {
   729  	// NOTE: do not call t.Helper() here.  It's more useful for errors to be
   730  	// attributed to lines in this function than the caller of it.
   731  
   732  	storage, _, server := newStorage(t, ipFamilies)
   733  	defer server.Terminate(t)
   734  	defer storage.Store.DestroyFunc()
   735  
   736  	for _, tc := range testCases {
   737  		name := tc.name
   738  		if tc.line != "" {
   739  			name += "__@L" + tc.line
   740  		}
   741  		t.Run(name, func(t *testing.T) {
   742  			ctx := genericapirequest.NewDefaultContext()
   743  
   744  			// Create the object as specified and check the results.
   745  			obj, err := storage.Create(ctx, tc.create.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
   746  			if tc.create.expectError && err != nil {
   747  				return
   748  			}
   749  			if err != nil {
   750  				t.Fatalf("unexpected error creating service: %v", err)
   751  			}
   752  			defer storage.Delete(ctx, tc.create.svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{}) // in case
   753  			if tc.create.expectError && err == nil {
   754  				t.Fatalf("unexpected success creating service")
   755  			}
   756  			createdSvc := obj.(*api.Service)
   757  			if !verifyEquiv(t, "create", &tc.create, createdSvc) {
   758  				return
   759  			}
   760  			verifyExpectations(t, storage, tc.create, tc.create.svc, createdSvc)
   761  			lastSvc := createdSvc
   762  
   763  			// The update phase is optional.
   764  			if tc.update.svc != nil {
   765  				// Allow callers to do something between create and update.
   766  				if tc.beforeUpdate != nil {
   767  					tc.beforeUpdate(t, storage)
   768  				}
   769  
   770  				// Update the object to the new state and check the results.
   771  				obj, created, err := storage.Update(ctx, tc.update.svc.Name,
   772  					rest.DefaultUpdatedObjectInfo(tc.update.svc), rest.ValidateAllObjectFunc,
   773  					rest.ValidateAllObjectUpdateFunc, false, &metav1.UpdateOptions{})
   774  				if tc.update.expectError && err != nil {
   775  					return
   776  				}
   777  				if err != nil {
   778  					t.Fatalf("unexpected error updating service: %v", err)
   779  				}
   780  				if tc.update.expectError && err == nil {
   781  					t.Fatalf("unexpected success updating service")
   782  				}
   783  				if created {
   784  					t.Fatalf("unexpected create-on-update")
   785  				}
   786  				updatedSvc := obj.(*api.Service)
   787  				if !verifyEquiv(t, "update", &tc.update, updatedSvc) {
   788  					return
   789  				}
   790  				verifyExpectations(t, storage, tc.update, createdSvc, updatedSvc)
   791  				lastSvc = updatedSvc
   792  			}
   793  
   794  			// Delete the object and check the results.
   795  			_, _, err = storage.Delete(ctx, tc.create.svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{})
   796  			if err != nil {
   797  				t.Fatalf("unexpected error deleting service: %v", err)
   798  			}
   799  			verifyExpectations(t, storage, svcTestCase{ /* all false */ }, lastSvc, nil)
   800  		})
   801  	}
   802  }
   803  
   804  // line returns the line number of the caller, if possible.  This is useful in
   805  // tests with a large number of cases - when something goes wrong you can find
   806  // which case more easily.
   807  func line() string {
   808  	_, _, line, ok := stdruntime.Caller(1)
   809  	var s string
   810  	if ok {
   811  		s = fmt.Sprintf("%d", line)
   812  	} else {
   813  		s = "<??>"
   814  	}
   815  	return s
   816  }
   817  
   818  // This makes the test-helpers testable.
   819  type testingTInterface interface {
   820  	Helper()
   821  	Errorf(format string, args ...interface{})
   822  }
   823  
   824  type fakeTestingT struct {
   825  	t *testing.T
   826  }
   827  
   828  func (f fakeTestingT) Helper() {}
   829  
   830  func (f fakeTestingT) Errorf(format string, args ...interface{}) {}
   831  
   832  func verifyEquiv(t testingTInterface, call string, tc *svcTestCase, got *api.Service) bool {
   833  	t.Helper()
   834  
   835  	// For when we compare objects.
   836  	options := []cmp.Option{
   837  		// These are system-assigned values, we don't need to compare them.
   838  		cmpopts.IgnoreFields(api.Service{}, "UID", "ResourceVersion", "CreationTimestamp"),
   839  		// Treat nil slices and empty slices as the same (e.g. clusterIPs).
   840  		cmpopts.EquateEmpty(),
   841  	}
   842  
   843  	// For allocated fields, we want to be able to compare cleanly whether the
   844  	// input specified values or not.
   845  	want := tc.svc.DeepCopy()
   846  	if tc.expectClusterIPs || tc.expectHeadless {
   847  		if want.Spec.ClusterIP == "" {
   848  			want.Spec.ClusterIP = got.Spec.ClusterIP
   849  		}
   850  		if want.Spec.IPFamilyPolicy == nil {
   851  			want.Spec.IPFamilyPolicy = got.Spec.IPFamilyPolicy
   852  		}
   853  		if tc.expectStackDowngrade && len(want.Spec.ClusterIPs) > len(got.Spec.ClusterIPs) {
   854  			want.Spec.ClusterIPs = want.Spec.ClusterIPs[0:1]
   855  		} else if len(got.Spec.ClusterIPs) > len(want.Spec.ClusterIPs) {
   856  			want.Spec.ClusterIPs = append(want.Spec.ClusterIPs, got.Spec.ClusterIPs[len(want.Spec.ClusterIPs):]...)
   857  		}
   858  		if tc.expectStackDowngrade && len(want.Spec.IPFamilies) > len(got.Spec.ClusterIPs) {
   859  			want.Spec.IPFamilies = want.Spec.IPFamilies[0:1]
   860  		} else if len(got.Spec.IPFamilies) > len(want.Spec.IPFamilies) {
   861  			want.Spec.IPFamilies = append(want.Spec.IPFamilies, got.Spec.IPFamilies[len(want.Spec.IPFamilies):]...)
   862  		}
   863  	}
   864  
   865  	if tc.expectNodePorts {
   866  		for i := range want.Spec.Ports {
   867  			p := &want.Spec.Ports[i]
   868  			if p.NodePort == 0 {
   869  				p.NodePort = got.Spec.Ports[i].NodePort
   870  			}
   871  		}
   872  	}
   873  	if tc.expectHealthCheckNodePort {
   874  		if want.Spec.HealthCheckNodePort == 0 {
   875  			want.Spec.HealthCheckNodePort = got.Spec.HealthCheckNodePort
   876  		}
   877  	}
   878  
   879  	if !cmp.Equal(want, got, options...) {
   880  		t.Errorf("unexpected result from %s:\n%s", call, cmp.Diff(want, got, options...))
   881  		return false
   882  	}
   883  	return true
   884  }
   885  
   886  // Quis custodiet ipsos custodes?
   887  func TestVerifyEquiv(t *testing.T) {
   888  	testCases := []struct {
   889  		name   string
   890  		input  svcTestCase
   891  		output *api.Service
   892  		expect bool
   893  	}{{
   894  		name: "ExternalName",
   895  		input: svcTestCase{
   896  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
   897  		},
   898  		output: svctest.MakeService("foo", svctest.SetTypeExternalName),
   899  		expect: true,
   900  	}, {
   901  		name: "ClusterIPs_unspecified",
   902  		input: svcTestCase{
   903  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
   904  			expectClusterIPs: true,
   905  		},
   906  		output: svctest.MakeService("foo", svctest.SetTypeClusterIP, svctest.SetClusterIPs("10.0.0.1", "2000:1")),
   907  		expect: true,
   908  	}, {
   909  		name: "ClusterIPs_specified",
   910  		input: svcTestCase{
   911  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP, svctest.SetClusterIPs("10.0.0.1", "2000:1")),
   912  			expectClusterIPs: true,
   913  		},
   914  		output: svctest.MakeService("foo", svctest.SetTypeClusterIP, svctest.SetClusterIPs("10.0.0.1", "2000:1")),
   915  		expect: true,
   916  	}, {
   917  		name: "ClusterIPs_wrong",
   918  		input: svcTestCase{
   919  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP, svctest.SetClusterIPs("10.0.0.0", "2000:0")),
   920  			expectClusterIPs: true,
   921  		},
   922  		output: svctest.MakeService("foo", svctest.SetTypeClusterIP, svctest.SetClusterIPs("10.0.0.1", "2000:1")),
   923  		expect: false,
   924  	}, {
   925  		name: "ClusterIPs_partial",
   926  		input: svcTestCase{
   927  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP, svctest.SetClusterIPs("10.0.0.1")),
   928  			expectClusterIPs: true,
   929  		},
   930  		output: svctest.MakeService("foo", svctest.SetTypeClusterIP, svctest.SetClusterIPs("10.0.0.1", "2000:1")),
   931  		expect: true,
   932  	}, {
   933  		name: "NodePort_unspecified",
   934  		input: svcTestCase{
   935  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
   936  			expectClusterIPs: true,
   937  			expectNodePorts:  true,
   938  		},
   939  		output: svctest.MakeService("foo", svctest.SetTypeNodePort, svctest.SetUniqueNodePorts),
   940  		expect: true,
   941  	}, {
   942  		name: "NodePort_specified",
   943  		input: svcTestCase{
   944  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort, svctest.SetNodePorts(93)),
   945  			expectClusterIPs: true,
   946  			expectNodePorts:  true,
   947  		},
   948  		output: svctest.MakeService("foo", svctest.SetTypeNodePort, svctest.SetNodePorts(93)),
   949  		expect: true,
   950  	}, {
   951  		name: "NodePort_wrong",
   952  		input: svcTestCase{
   953  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort, svctest.SetNodePorts(93)),
   954  			expectClusterIPs: true,
   955  			expectNodePorts:  true,
   956  		},
   957  		output: svctest.MakeService("foo", svctest.SetTypeNodePort, svctest.SetNodePorts(76)),
   958  		expect: false,
   959  	}, {
   960  		name: "NodePort_partial",
   961  		input: svcTestCase{
   962  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
   963  				svctest.SetPorts(
   964  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
   965  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
   966  				svctest.SetNodePorts(93)),
   967  			expectClusterIPs: true,
   968  			expectNodePorts:  true,
   969  		},
   970  		output: svctest.MakeService("foo", svctest.SetTypeNodePort,
   971  			svctest.SetPorts(
   972  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
   973  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
   974  			svctest.SetNodePorts(93, 76)),
   975  		expect: true,
   976  	}, {
   977  		name: "HealthCheckNodePort_unspecified",
   978  		input: svcTestCase{
   979  			svc: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
   980  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
   981  			expectClusterIPs:          true,
   982  			expectNodePorts:           true,
   983  			expectHealthCheckNodePort: true,
   984  		},
   985  		output: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
   986  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
   987  			svctest.SetHealthCheckNodePort(93)),
   988  		expect: true,
   989  	}, {
   990  		name: "HealthCheckNodePort_specified",
   991  		input: svcTestCase{
   992  			svc: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
   993  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
   994  				svctest.SetHealthCheckNodePort(93)),
   995  			expectClusterIPs:          true,
   996  			expectNodePorts:           true,
   997  			expectHealthCheckNodePort: true,
   998  		},
   999  		output: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  1000  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  1001  			svctest.SetHealthCheckNodePort(93)),
  1002  		expect: true,
  1003  	}, {
  1004  		name: "HealthCheckNodePort_wrong",
  1005  		input: svcTestCase{
  1006  			svc: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  1007  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  1008  				svctest.SetHealthCheckNodePort(93)),
  1009  			expectClusterIPs:          true,
  1010  			expectNodePorts:           true,
  1011  			expectHealthCheckNodePort: true,
  1012  		},
  1013  		output: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  1014  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  1015  			svctest.SetHealthCheckNodePort(76)),
  1016  		expect: false,
  1017  	}}
  1018  
  1019  	for _, tc := range testCases {
  1020  		t.Run(tc.name, func(t *testing.T) {
  1021  			result := verifyEquiv(fakeTestingT{t}, "test", &tc.input, tc.output)
  1022  			if result != tc.expect {
  1023  				t.Errorf("expected %v, got %v", tc.expect, result)
  1024  			}
  1025  		})
  1026  	}
  1027  }
  1028  
  1029  func verifyExpectations(t *testing.T, storage *wrapperRESTForTests, tc svcTestCase, before, after *api.Service) {
  1030  	t.Helper()
  1031  
  1032  	if tc.expectClusterIPs {
  1033  		proveClusterIPsAllocated(t, storage, before, after)
  1034  	} else if tc.expectHeadless {
  1035  		proveHeadless(t, storage, before, after)
  1036  	} else {
  1037  		proveClusterIPsDeallocated(t, storage, before, after)
  1038  	}
  1039  	if tc.expectNodePorts {
  1040  		proveNodePortsAllocated(t, storage, before, after)
  1041  	} else {
  1042  		proveNodePortsDeallocated(t, storage, before, after)
  1043  	}
  1044  	if tc.expectHealthCheckNodePort {
  1045  		proveHealthCheckNodePortAllocated(t, storage, before, after)
  1046  	} else {
  1047  		proveHealthCheckNodePortDeallocated(t, storage, before, after)
  1048  	}
  1049  
  1050  	for _, p := range tc.prove {
  1051  		p(t, storage, before, after)
  1052  	}
  1053  }
  1054  
  1055  func callName(before, after *api.Service) string {
  1056  	if before == nil && after != nil {
  1057  		return "create"
  1058  	}
  1059  	if before != nil && after != nil {
  1060  		return "update"
  1061  	}
  1062  	if before != nil && after == nil {
  1063  		return "delete"
  1064  	}
  1065  	panic("this test is broken: before and after are both nil")
  1066  }
  1067  
  1068  func ipIsAllocated(t *testing.T, alloc ipallocator.Interface, ipstr string) bool {
  1069  	t.Helper()
  1070  	ip := netutils.ParseIPSloppy(ipstr)
  1071  	if ip == nil {
  1072  		t.Errorf("error parsing IP %q", ipstr)
  1073  		return false
  1074  	}
  1075  	return alloc.Has(ip)
  1076  }
  1077  
  1078  func portIsAllocated(t *testing.T, alloc portallocator.Interface, port int32) bool {
  1079  	t.Helper()
  1080  	if port == 0 {
  1081  		t.Errorf("port is 0")
  1082  		return false
  1083  	}
  1084  	return alloc.Has(int(port))
  1085  }
  1086  
  1087  func proveClusterIPsAllocated(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  1088  	t.Helper()
  1089  
  1090  	if sing, plur := after.Spec.ClusterIP, after.Spec.ClusterIPs[0]; sing != plur {
  1091  		t.Errorf("%s: expected clusterIP == clusterIPs[0]: %q != %q", callName(before, after), sing, plur)
  1092  	}
  1093  
  1094  	for _, clip := range after.Spec.ClusterIPs {
  1095  		if !ipIsAllocated(t, storage.alloc.serviceIPAllocatorsByFamily[familyOf(clip)], clip) {
  1096  			t.Errorf("%s: expected clusterIP to be allocated: %q", callName(before, after), clip)
  1097  		}
  1098  	}
  1099  
  1100  	if lc, lf := len(after.Spec.ClusterIPs), len(after.Spec.IPFamilies); lc != lf {
  1101  		t.Errorf("%s: expected same number of clusterIPs and ipFamilies: %d != %d", callName(before, after), lc, lf)
  1102  	}
  1103  
  1104  	for i, fam := range after.Spec.IPFamilies {
  1105  		if want, got := fam, familyOf(after.Spec.ClusterIPs[i]); want != got {
  1106  			t.Errorf("%s: clusterIP is the wrong IP family: want %s, got %s", callName(before, after), want, got)
  1107  		}
  1108  	}
  1109  
  1110  	if after.Spec.IPFamilyPolicy == nil {
  1111  		t.Errorf("%s: expected ipFamilyPolicy to be set", callName(before, after))
  1112  	} else {
  1113  		pol := *after.Spec.IPFamilyPolicy
  1114  		fams := len(after.Spec.IPFamilies)
  1115  		clus := 1
  1116  		if storage.secondaryIPFamily != "" {
  1117  			clus = 2
  1118  		}
  1119  		if pol == api.IPFamilyPolicySingleStack && fams != 1 {
  1120  			t.Errorf("%s: expected 1 ipFamily, got %d", callName(before, after), fams)
  1121  		} else if pol == api.IPFamilyPolicyRequireDualStack && fams != 2 {
  1122  			t.Errorf("%s: expected 2 ipFamilies, got %d", callName(before, after), fams)
  1123  		} else if pol == api.IPFamilyPolicyPreferDualStack && fams != clus {
  1124  			t.Errorf("%s: expected %d ipFamilies, got %d", callName(before, after), clus, fams)
  1125  		}
  1126  	}
  1127  
  1128  	if before != nil {
  1129  		if before.Spec.ClusterIP != "" {
  1130  			if want, got := before.Spec.ClusterIP, after.Spec.ClusterIP; want != got {
  1131  				t.Errorf("%s: wrong clusterIP: wanted %q, got %q", callName(before, after), want, got)
  1132  			}
  1133  		}
  1134  		min := func(x, y int) int {
  1135  			if x < y {
  1136  				return x
  1137  			}
  1138  			return y
  1139  		}
  1140  		for i := 0; i < min(len(before.Spec.ClusterIPs), len(after.Spec.ClusterIPs)); i++ {
  1141  			if want, got := before.Spec.ClusterIPs[i], after.Spec.ClusterIPs[i]; want != got {
  1142  				t.Errorf("%s: wrong clusterIPs[%d]: wanted %q, got %q", callName(before, after), i, want, got)
  1143  			}
  1144  		}
  1145  		for i := 0; i < min(len(before.Spec.IPFamilies), len(after.Spec.IPFamilies)); i++ {
  1146  			if want, got := before.Spec.IPFamilies[i], after.Spec.IPFamilies[i]; want != got {
  1147  				t.Errorf("%s: wrong ipFamilies[%d]: wanted %q, got %q", callName(before, after), i, want, got)
  1148  			}
  1149  		}
  1150  	}
  1151  }
  1152  
  1153  func proveClusterIPsDeallocated(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  1154  	t.Helper()
  1155  
  1156  	if after != nil && after.Spec.ClusterIP != api.ClusterIPNone {
  1157  		if after.Spec.ClusterIP != "" {
  1158  			t.Errorf("%s: expected clusterIP to be unset: %q", callName(before, after), after.Spec.ClusterIP)
  1159  		}
  1160  		if len(after.Spec.ClusterIPs) != 0 {
  1161  			t.Errorf("%s: expected clusterIPs to be unset: %q", callName(before, after), after.Spec.ClusterIPs)
  1162  		}
  1163  	}
  1164  
  1165  	if before != nil && before.Spec.ClusterIP != api.ClusterIPNone {
  1166  		for _, clip := range before.Spec.ClusterIPs {
  1167  			if ipIsAllocated(t, storage.alloc.serviceIPAllocatorsByFamily[familyOf(clip)], clip) {
  1168  				t.Errorf("%s: expected clusterIP to be deallocated: %q", callName(before, after), clip)
  1169  			}
  1170  		}
  1171  	}
  1172  }
  1173  
  1174  func proveHeadless(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  1175  	t.Helper()
  1176  
  1177  	if sing, plur := after.Spec.ClusterIP, after.Spec.ClusterIPs[0]; sing != plur {
  1178  		t.Errorf("%s: expected clusterIP == clusterIPs[0]: %q != %q", callName(before, after), sing, plur)
  1179  	}
  1180  	if len(after.Spec.ClusterIPs) != 1 || after.Spec.ClusterIPs[0] != api.ClusterIPNone {
  1181  		t.Errorf("%s: expected clusterIPs to be [%q]: %q", callName(before, after), api.ClusterIPNone, after.Spec.ClusterIPs)
  1182  	}
  1183  }
  1184  
  1185  func proveNodePortsAllocated(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  1186  	t.Helper()
  1187  
  1188  	for _, p := range after.Spec.Ports {
  1189  		if !portIsAllocated(t, storage.alloc.serviceNodePorts, p.NodePort) {
  1190  			t.Errorf("%s: expected nodePort to be allocated: %d", callName(before, after), p.NodePort)
  1191  		}
  1192  	}
  1193  }
  1194  
  1195  func proveNodePortsDeallocated(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  1196  	t.Helper()
  1197  
  1198  	if after != nil {
  1199  		for _, p := range after.Spec.Ports {
  1200  			if p.NodePort != 0 {
  1201  				t.Errorf("%s: expected nodePort to be unset: %d", callName(before, after), p.NodePort)
  1202  			}
  1203  		}
  1204  	}
  1205  
  1206  	if before != nil {
  1207  		for _, p := range before.Spec.Ports {
  1208  			if p.NodePort != 0 && portIsAllocated(t, storage.alloc.serviceNodePorts, p.NodePort) {
  1209  				t.Errorf("%s: expected nodePort to be deallocated: %d", callName(before, after), p.NodePort)
  1210  			}
  1211  		}
  1212  	}
  1213  }
  1214  
  1215  func proveHealthCheckNodePortAllocated(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  1216  	t.Helper()
  1217  
  1218  	if !portIsAllocated(t, storage.alloc.serviceNodePorts, after.Spec.HealthCheckNodePort) {
  1219  		t.Errorf("%s: expected healthCheckNodePort to be allocated: %d", callName(before, after), after.Spec.HealthCheckNodePort)
  1220  	}
  1221  }
  1222  
  1223  func proveHealthCheckNodePortDeallocated(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  1224  	t.Helper()
  1225  
  1226  	if after != nil {
  1227  		if after.Spec.HealthCheckNodePort != 0 {
  1228  			t.Errorf("%s: expected healthCheckNodePort to be unset: %d", callName(before, after), after.Spec.HealthCheckNodePort)
  1229  		}
  1230  	}
  1231  
  1232  	if before != nil {
  1233  		if before.Spec.HealthCheckNodePort != 0 && portIsAllocated(t, storage.alloc.serviceNodePorts, before.Spec.HealthCheckNodePort) {
  1234  			t.Errorf("%s: expected healthCheckNodePort to be deallocated: %d", callName(before, after), before.Spec.HealthCheckNodePort)
  1235  		}
  1236  	}
  1237  }
  1238  
  1239  //
  1240  // functional tests of the registry
  1241  //
  1242  
  1243  func fmtIPFamilyPolicy(pol *api.IPFamilyPolicy) string {
  1244  	if pol == nil {
  1245  		return "<nil>"
  1246  	}
  1247  	return string(*pol)
  1248  }
  1249  
  1250  func fmtInternalTrafficPolicy(pol *api.ServiceInternalTrafficPolicy) string {
  1251  	if pol == nil {
  1252  		return "<nil>"
  1253  	}
  1254  	return string(*pol)
  1255  }
  1256  
  1257  func fmtIPFamilies(fams []api.IPFamily) string {
  1258  	if fams == nil {
  1259  		return "[]"
  1260  	}
  1261  	return fmt.Sprintf("%v", fams)
  1262  }
  1263  
  1264  // Prove that create ignores IP and IPFamily stuff when type is ExternalName.
  1265  func TestCreateIgnoresIPsForExternalName(t *testing.T) {
  1266  	type testCase struct {
  1267  		name        string
  1268  		svc         *api.Service
  1269  		expectError bool
  1270  	}
  1271  	// These cases were chosen from the full gamut to ensure all "interesting"
  1272  	// cases are covered.
  1273  	testCases := []struct {
  1274  		name            string
  1275  		clusterFamilies []api.IPFamily
  1276  		cases           []testCase
  1277  	}{{
  1278  		name:            "singlestack:v6",
  1279  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  1280  		cases: []testCase{{
  1281  			name: "Policy:unset_Families:unset",
  1282  			svc:  svctest.MakeService("foo"),
  1283  		}, {
  1284  			name: "Policy:SingleStack_Families:v6",
  1285  			svc: svctest.MakeService("foo",
  1286  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1287  				svctest.SetIPFamilies(api.IPv6Protocol)),
  1288  			expectError: true,
  1289  		}, {
  1290  			name: "Policy:PreferDualStack_Families:v4v6",
  1291  			svc: svctest.MakeService("foo",
  1292  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1293  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1294  			expectError: true,
  1295  		}, {
  1296  			name: "Policy:RequireDualStack_Families:v6v4",
  1297  			svc: svctest.MakeService("foo",
  1298  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1299  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1300  			expectError: true,
  1301  		}},
  1302  	}, {
  1303  		name:            "dualstack:v6v4",
  1304  		clusterFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  1305  		cases: []testCase{{
  1306  			name: "Policy:unset_Families:unset",
  1307  			svc:  svctest.MakeService("foo"),
  1308  		}, {
  1309  			name: "Policy:SingleStack_Families:v6",
  1310  			svc: svctest.MakeService("foo",
  1311  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1312  				svctest.SetIPFamilies(api.IPv6Protocol)),
  1313  			expectError: true,
  1314  		}, {
  1315  			name: "Policy:PreferDualStack_Families:v6v4",
  1316  			svc: svctest.MakeService("foo",
  1317  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1318  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1319  			expectError: true,
  1320  		}, {
  1321  			name: "Policy:RequireDualStack_Families:v4v6",
  1322  			svc: svctest.MakeService("foo",
  1323  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1324  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1325  			expectError: true,
  1326  		}},
  1327  	}}
  1328  
  1329  	for _, otc := range testCases {
  1330  		t.Run(otc.name, func(t *testing.T) {
  1331  			storage, _, server := newStorage(t, otc.clusterFamilies)
  1332  			defer server.Terminate(t)
  1333  			defer storage.Store.DestroyFunc()
  1334  
  1335  			for _, itc := range otc.cases {
  1336  				t.Run(itc.name, func(t *testing.T) {
  1337  					// This test is ONLY ExternalName services.
  1338  					itc.svc.Spec.Type = api.ServiceTypeExternalName
  1339  					itc.svc.Spec.ExternalName = "example.com"
  1340  
  1341  					ctx := genericapirequest.NewDefaultContext()
  1342  					createdObj, err := storage.Create(ctx, itc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  1343  					if itc.expectError && err != nil {
  1344  						return
  1345  					}
  1346  					if err != nil {
  1347  						t.Fatalf("unexpected error creating service: %v", err)
  1348  					}
  1349  					defer storage.Delete(ctx, itc.svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{})
  1350  					if itc.expectError && err == nil {
  1351  						t.Fatalf("unexpected success creating service")
  1352  					}
  1353  					createdSvc := createdObj.(*api.Service)
  1354  
  1355  					if want, got := fmtIPFamilyPolicy(nil), fmtIPFamilyPolicy(createdSvc.Spec.IPFamilyPolicy); want != got {
  1356  						t.Errorf("wrong IPFamilyPolicy: want %s, got %s", want, got)
  1357  					}
  1358  					if want, got := fmtIPFamilies(nil), fmtIPFamilies(createdSvc.Spec.IPFamilies); want != got {
  1359  						t.Errorf("wrong IPFamilies: want %s, got %s", want, got)
  1360  					}
  1361  					if len(createdSvc.Spec.ClusterIP) != 0 {
  1362  						t.Errorf("expected no clusterIP, got %q", createdSvc.Spec.ClusterIP)
  1363  					}
  1364  					if len(createdSvc.Spec.ClusterIPs) != 0 {
  1365  						t.Errorf("expected no clusterIPs, got %q", createdSvc.Spec.ClusterIPs)
  1366  					}
  1367  				})
  1368  			}
  1369  		})
  1370  	}
  1371  }
  1372  
  1373  // Prove that create initializes clusterIPs from clusterIP.  This simplifies
  1374  // later tests to not need to re-prove this.
  1375  func TestCreateInitClusterIPsFromClusterIP(t *testing.T) {
  1376  	testCases := []struct {
  1377  		name            string
  1378  		clusterFamilies []api.IPFamily
  1379  		svc             *api.Service
  1380  	}{{
  1381  		name:            "singlestack:v4_clusterip:unset",
  1382  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  1383  		svc:             svctest.MakeService("foo"),
  1384  	}, {
  1385  		name:            "singlestack:v4_clusterip:set",
  1386  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  1387  		svc: svctest.MakeService("foo",
  1388  			svctest.SetClusterIP("10.0.0.1")),
  1389  	}, {
  1390  		name:            "singlestack:v6_clusterip:unset",
  1391  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  1392  		svc:             svctest.MakeService("foo"),
  1393  	}, {
  1394  		name:            "singlestack:v6_clusterip:set",
  1395  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  1396  		svc: svctest.MakeService("foo",
  1397  			svctest.SetClusterIP("2000::1")),
  1398  	}, {
  1399  		name:            "dualstack:v4v6_clusterip:unset",
  1400  		clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  1401  		svc:             svctest.MakeService("foo"),
  1402  	}, {
  1403  		name:            "dualstack:v4v6_clusterip:set",
  1404  		clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  1405  		svc: svctest.MakeService("foo",
  1406  			svctest.SetClusterIP("10.0.0.1")),
  1407  	}, {
  1408  		name:            "dualstack:v6v4_clusterip:unset",
  1409  		clusterFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  1410  		svc:             svctest.MakeService("foo"),
  1411  	}, {
  1412  		name:            "dualstack:v6v4_clusterip:set",
  1413  		clusterFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  1414  		svc: svctest.MakeService("foo",
  1415  			svctest.SetClusterIP("2000::1")),
  1416  	}}
  1417  
  1418  	for _, tc := range testCases {
  1419  		t.Run(tc.name, func(t *testing.T) {
  1420  			storage, _, server := newStorage(t, tc.clusterFamilies)
  1421  			defer server.Terminate(t)
  1422  			defer storage.Store.DestroyFunc()
  1423  
  1424  			ctx := genericapirequest.NewDefaultContext()
  1425  			createdObj, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  1426  			if err != nil {
  1427  				t.Fatalf("unexpected error creating service: %v", err)
  1428  			}
  1429  			createdSvc := createdObj.(*api.Service)
  1430  
  1431  			if createdSvc.Spec.ClusterIP == "" {
  1432  				t.Errorf("expected ClusterIP to be set")
  1433  
  1434  			}
  1435  			if tc.svc.Spec.ClusterIP != "" {
  1436  				if want, got := tc.svc.Spec.ClusterIP, createdSvc.Spec.ClusterIP; want != got {
  1437  					t.Errorf("wrong ClusterIP: want %s, got %s", want, got)
  1438  				}
  1439  			}
  1440  			if len(createdSvc.Spec.ClusterIPs) == 0 {
  1441  				t.Errorf("expected ClusterIPs to be set")
  1442  			}
  1443  			if want, got := createdSvc.Spec.ClusterIP, createdSvc.Spec.ClusterIPs[0]; want != got {
  1444  				t.Errorf("wrong ClusterIPs[0]: want %s, got %s", want, got)
  1445  			}
  1446  		})
  1447  	}
  1448  }
  1449  
  1450  // Prove that create initializes IPFamily fields correctly.
  1451  func TestCreateInitIPFields(t *testing.T) {
  1452  	type testCase struct {
  1453  		name           string
  1454  		line           string
  1455  		svc            *api.Service
  1456  		expectError    bool
  1457  		expectPolicy   api.IPFamilyPolicy
  1458  		expectFamilies []api.IPFamily
  1459  		expectHeadless bool
  1460  	}
  1461  	// These cases were chosen from the full gamut to ensure all "interesting"
  1462  	// cases are covered.
  1463  	testCases := []struct {
  1464  		name            string
  1465  		clusterFamilies []api.IPFamily
  1466  		cases           []testCase
  1467  	}{
  1468  		{
  1469  			name:            "singlestack:v4",
  1470  			clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  1471  			cases: []testCase{
  1472  				//----------------------------------------
  1473  				// singlestack:v4 ClusterIPs:unset
  1474  				//----------------------------------------
  1475  				{
  1476  					name:           "ClusterIPs:unset_Policy:unset_Families:unset",
  1477  					line:           line(),
  1478  					svc:            svctest.MakeService("foo"),
  1479  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1480  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1481  				}, {
  1482  					name: "ClusterIPs:unset_Policy:unset_Families:v4",
  1483  					line: line(),
  1484  					svc: svctest.MakeService("foo",
  1485  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1486  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1487  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1488  				}, {
  1489  					name: "ClusterIPs:unset_Policy:unset_Families:v6",
  1490  					line: line(),
  1491  					svc: svctest.MakeService("foo",
  1492  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1493  					expectError: true,
  1494  				}, {
  1495  					name: "ClusterIPs:unset_Policy:unset_Families:v4v6",
  1496  					line: line(),
  1497  					svc: svctest.MakeService("foo",
  1498  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1499  					expectError: true,
  1500  				}, {
  1501  					name: "ClusterIPs:unset_Policy:unset_Families:v6v4",
  1502  					line: line(),
  1503  					svc: svctest.MakeService("foo",
  1504  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1505  					expectError: true,
  1506  				}, {
  1507  					name: "ClusterIPs:unset_Policy:SingleStack_Families:unset",
  1508  					line: line(),
  1509  					svc: svctest.MakeService("foo",
  1510  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  1511  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1512  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1513  				}, {
  1514  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4",
  1515  					line: line(),
  1516  					svc: svctest.MakeService("foo",
  1517  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1518  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1519  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1520  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1521  				}, {
  1522  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6",
  1523  					line: line(),
  1524  					svc: svctest.MakeService("foo",
  1525  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1526  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1527  					expectError: true,
  1528  				}, {
  1529  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4v6",
  1530  					line: line(),
  1531  					svc: svctest.MakeService("foo",
  1532  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1533  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1534  					expectError: true,
  1535  				}, {
  1536  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6v4",
  1537  					line: line(),
  1538  					svc: svctest.MakeService("foo",
  1539  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1540  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1541  					expectError: true,
  1542  				}, {
  1543  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:unset",
  1544  					line: line(),
  1545  					svc: svctest.MakeService("foo",
  1546  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  1547  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  1548  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1549  				}, {
  1550  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4",
  1551  					line: line(),
  1552  					svc: svctest.MakeService("foo",
  1553  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1554  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1555  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  1556  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1557  				}, {
  1558  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6",
  1559  					line: line(),
  1560  					svc: svctest.MakeService("foo",
  1561  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1562  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1563  					expectError: true,
  1564  				}, {
  1565  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4v6",
  1566  					line: line(),
  1567  					svc: svctest.MakeService("foo",
  1568  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1569  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1570  					expectError: true,
  1571  				}, {
  1572  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6v4",
  1573  					line: line(),
  1574  					svc: svctest.MakeService("foo",
  1575  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1576  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1577  					expectError: true,
  1578  				}, {
  1579  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:unset",
  1580  					line: line(),
  1581  					svc: svctest.MakeService("foo",
  1582  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  1583  					expectError: true,
  1584  				}, {
  1585  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4",
  1586  					line: line(),
  1587  					svc: svctest.MakeService("foo",
  1588  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1589  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1590  					expectError: true,
  1591  				}, {
  1592  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6",
  1593  					line: line(),
  1594  					svc: svctest.MakeService("foo",
  1595  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1596  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1597  					expectError: true,
  1598  				}, {
  1599  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4v6",
  1600  					line: line(),
  1601  					svc: svctest.MakeService("foo",
  1602  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1603  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1604  					expectError: true,
  1605  				}, {
  1606  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6v4",
  1607  					line: line(),
  1608  					svc: svctest.MakeService("foo",
  1609  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1610  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1611  					expectError: true,
  1612  				},
  1613  				//----------------------------------------
  1614  				// singlestack:v4 ClusterIPs:v4
  1615  				//----------------------------------------
  1616  				{
  1617  					name: "ClusterIPs:v4_Policy:unset_Families:unset",
  1618  					line: line(),
  1619  					svc: svctest.MakeService("foo",
  1620  						svctest.SetClusterIPs("10.0.0.1")),
  1621  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1622  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1623  				}, {
  1624  					name: "ClusterIPs:v4_Policy:unset_Families:v4",
  1625  					line: line(),
  1626  					svc: svctest.MakeService("foo",
  1627  						svctest.SetClusterIPs("10.0.0.1"),
  1628  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1629  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1630  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1631  				}, {
  1632  					name: "ClusterIPs:v4_Policy:unset_Families:v6",
  1633  					line: line(),
  1634  					svc: svctest.MakeService("foo",
  1635  						svctest.SetClusterIPs("10.0.0.1"),
  1636  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1637  					expectError: true,
  1638  				}, {
  1639  					name: "ClusterIPs:v4_Policy:unset_Families:v4v6",
  1640  					line: line(),
  1641  					svc: svctest.MakeService("foo",
  1642  						svctest.SetClusterIPs("10.0.0.1"),
  1643  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1644  					expectError: true,
  1645  				}, {
  1646  					name: "ClusterIPs:v4_Policy:unset_Families:v6v4",
  1647  					line: line(),
  1648  					svc: svctest.MakeService("foo",
  1649  						svctest.SetClusterIPs("10.0.0.1"),
  1650  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1651  					expectError: true,
  1652  				}, {
  1653  					name: "ClusterIPs:v4_Policy:SingleStack_Families:unset",
  1654  					line: line(),
  1655  					svc: svctest.MakeService("foo",
  1656  						svctest.SetClusterIPs("10.0.0.1"),
  1657  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  1658  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1659  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1660  				}, {
  1661  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v4",
  1662  					line: line(),
  1663  					svc: svctest.MakeService("foo",
  1664  						svctest.SetClusterIPs("10.0.0.1"),
  1665  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1666  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1667  					expectPolicy:   api.IPFamilyPolicySingleStack,
  1668  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1669  				}, {
  1670  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v6",
  1671  					line: line(),
  1672  					svc: svctest.MakeService("foo",
  1673  						svctest.SetClusterIPs("10.0.0.1"),
  1674  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1675  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1676  					expectError: true,
  1677  				}, {
  1678  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v4v6",
  1679  					line: line(),
  1680  					svc: svctest.MakeService("foo",
  1681  						svctest.SetClusterIPs("10.0.0.1"),
  1682  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1683  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1684  					expectError: true,
  1685  				}, {
  1686  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v6v4",
  1687  					line: line(),
  1688  					svc: svctest.MakeService("foo",
  1689  						svctest.SetClusterIPs("10.0.0.1"),
  1690  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1691  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1692  					expectError: true,
  1693  				}, {
  1694  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:unset",
  1695  					line: line(),
  1696  					svc: svctest.MakeService("foo",
  1697  						svctest.SetClusterIPs("10.0.0.1"),
  1698  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  1699  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  1700  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1701  				}, {
  1702  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v4",
  1703  					line: line(),
  1704  					svc: svctest.MakeService("foo",
  1705  						svctest.SetClusterIPs("10.0.0.1"),
  1706  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1707  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1708  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  1709  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  1710  				}, {
  1711  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v6",
  1712  					line: line(),
  1713  					svc: svctest.MakeService("foo",
  1714  						svctest.SetClusterIPs("10.0.0.1"),
  1715  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1716  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1717  					expectError: true,
  1718  				}, {
  1719  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v4v6",
  1720  					line: line(),
  1721  					svc: svctest.MakeService("foo",
  1722  						svctest.SetClusterIPs("10.0.0.1"),
  1723  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1724  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1725  					expectError: true,
  1726  				}, {
  1727  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v6v4",
  1728  					line: line(),
  1729  					svc: svctest.MakeService("foo",
  1730  						svctest.SetClusterIPs("10.0.0.1"),
  1731  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1732  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1733  					expectError: true,
  1734  				}, {
  1735  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:unset",
  1736  					line: line(),
  1737  					svc: svctest.MakeService("foo",
  1738  						svctest.SetClusterIPs("10.0.0.1"),
  1739  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  1740  					expectError: true,
  1741  				}, {
  1742  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v4",
  1743  					line: line(),
  1744  					svc: svctest.MakeService("foo",
  1745  						svctest.SetClusterIPs("10.0.0.1"),
  1746  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1747  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1748  					expectError: true,
  1749  				}, {
  1750  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v6",
  1751  					line: line(),
  1752  					svc: svctest.MakeService("foo",
  1753  						svctest.SetClusterIPs("10.0.0.1"),
  1754  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1755  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1756  					expectError: true,
  1757  				}, {
  1758  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v4v6",
  1759  					line: line(),
  1760  					svc: svctest.MakeService("foo",
  1761  						svctest.SetClusterIPs("10.0.0.1"),
  1762  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1763  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1764  					expectError: true,
  1765  				}, {
  1766  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v6v4",
  1767  					line: line(),
  1768  					svc: svctest.MakeService("foo",
  1769  						svctest.SetClusterIPs("10.0.0.1"),
  1770  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1771  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1772  					expectError: true,
  1773  				},
  1774  				//----------------------------------------
  1775  				// singlestack:v4 ClusterIPs:v4v6
  1776  				//----------------------------------------
  1777  				{
  1778  					name: "ClusterIPs:v4v6_Policy:unset_Families:unset",
  1779  					line: line(),
  1780  					svc: svctest.MakeService("foo",
  1781  						svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  1782  					expectError: true,
  1783  				}, {
  1784  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4",
  1785  					line: line(),
  1786  					svc: svctest.MakeService("foo",
  1787  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1788  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1789  					expectError: true,
  1790  				}, {
  1791  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6",
  1792  					line: line(),
  1793  					svc: svctest.MakeService("foo",
  1794  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1795  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1796  					expectError: true,
  1797  				}, {
  1798  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4v6",
  1799  					line: line(),
  1800  					svc: svctest.MakeService("foo",
  1801  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1802  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1803  					expectError: true,
  1804  				}, {
  1805  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6v4",
  1806  					line: line(),
  1807  					svc: svctest.MakeService("foo",
  1808  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1809  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1810  					expectError: true,
  1811  				}, {
  1812  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:unset",
  1813  					line: line(),
  1814  					svc: svctest.MakeService("foo",
  1815  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1816  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  1817  					expectError: true,
  1818  				}, {
  1819  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4",
  1820  					line: line(),
  1821  					svc: svctest.MakeService("foo",
  1822  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1823  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1824  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1825  					expectError: true,
  1826  				}, {
  1827  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6",
  1828  					line: line(),
  1829  					svc: svctest.MakeService("foo",
  1830  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1831  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1832  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1833  					expectError: true,
  1834  				}, {
  1835  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4v6",
  1836  					line: line(),
  1837  					svc: svctest.MakeService("foo",
  1838  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1839  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1840  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1841  					expectError: true,
  1842  				}, {
  1843  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6v4",
  1844  					line: line(),
  1845  					svc: svctest.MakeService("foo",
  1846  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1847  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1848  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1849  					expectError: true,
  1850  				}, {
  1851  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:unset",
  1852  					line: line(),
  1853  					svc: svctest.MakeService("foo",
  1854  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1855  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  1856  					expectError: true,
  1857  				}, {
  1858  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4",
  1859  					line: line(),
  1860  					svc: svctest.MakeService("foo",
  1861  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1862  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1863  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1864  					expectError: true,
  1865  				}, {
  1866  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6",
  1867  					line: line(),
  1868  					svc: svctest.MakeService("foo",
  1869  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1870  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1871  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1872  					expectError: true,
  1873  				}, {
  1874  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4v6",
  1875  					line: line(),
  1876  					svc: svctest.MakeService("foo",
  1877  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1878  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1879  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1880  					expectError: true,
  1881  				}, {
  1882  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6v4",
  1883  					line: line(),
  1884  					svc: svctest.MakeService("foo",
  1885  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1886  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  1887  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1888  					expectError: true,
  1889  				}, {
  1890  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:unset",
  1891  					line: line(),
  1892  					svc: svctest.MakeService("foo",
  1893  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1894  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  1895  					expectError: true,
  1896  				}, {
  1897  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4",
  1898  					line: line(),
  1899  					svc: svctest.MakeService("foo",
  1900  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1901  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1902  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1903  					expectError: true,
  1904  				}, {
  1905  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6",
  1906  					line: line(),
  1907  					svc: svctest.MakeService("foo",
  1908  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1909  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1910  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1911  					expectError: true,
  1912  				}, {
  1913  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4v6",
  1914  					line: line(),
  1915  					svc: svctest.MakeService("foo",
  1916  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1917  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1918  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1919  					expectError: true,
  1920  				}, {
  1921  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6v4",
  1922  					line: line(),
  1923  					svc: svctest.MakeService("foo",
  1924  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  1925  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  1926  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1927  					expectError: true,
  1928  				},
  1929  				//----------------------------------------
  1930  				// singlestack:v4 ClusterIPs:v6v4
  1931  				//----------------------------------------
  1932  				{
  1933  					name: "ClusterIPs:v6v4_Policy:unset_Families:unset",
  1934  					line: line(),
  1935  					svc: svctest.MakeService("foo",
  1936  						svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  1937  					expectError: true,
  1938  				}, {
  1939  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4",
  1940  					line: line(),
  1941  					svc: svctest.MakeService("foo",
  1942  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1943  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1944  					expectError: true,
  1945  				}, {
  1946  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6",
  1947  					line: line(),
  1948  					svc: svctest.MakeService("foo",
  1949  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1950  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1951  					expectError: true,
  1952  				}, {
  1953  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4v6",
  1954  					line: line(),
  1955  					svc: svctest.MakeService("foo",
  1956  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1957  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1958  					expectError: true,
  1959  				}, {
  1960  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6v4",
  1961  					line: line(),
  1962  					svc: svctest.MakeService("foo",
  1963  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1964  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  1965  					expectError: true,
  1966  				}, {
  1967  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:unset",
  1968  					line: line(),
  1969  					svc: svctest.MakeService("foo",
  1970  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1971  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  1972  					expectError: true,
  1973  				}, {
  1974  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4",
  1975  					line: line(),
  1976  					svc: svctest.MakeService("foo",
  1977  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1978  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1979  						svctest.SetIPFamilies(api.IPv4Protocol)),
  1980  					expectError: true,
  1981  				}, {
  1982  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6",
  1983  					line: line(),
  1984  					svc: svctest.MakeService("foo",
  1985  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1986  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1987  						svctest.SetIPFamilies(api.IPv6Protocol)),
  1988  					expectError: true,
  1989  				}, {
  1990  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4v6",
  1991  					line: line(),
  1992  					svc: svctest.MakeService("foo",
  1993  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  1994  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  1995  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  1996  					expectError: true,
  1997  				}, {
  1998  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6v4",
  1999  					line: line(),
  2000  					svc: svctest.MakeService("foo",
  2001  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2002  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2003  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2004  					expectError: true,
  2005  				}, {
  2006  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:unset",
  2007  					line: line(),
  2008  					svc: svctest.MakeService("foo",
  2009  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2010  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  2011  					expectError: true,
  2012  				}, {
  2013  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4",
  2014  					line: line(),
  2015  					svc: svctest.MakeService("foo",
  2016  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2017  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2018  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2019  					expectError: true,
  2020  				}, {
  2021  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6",
  2022  					line: line(),
  2023  					svc: svctest.MakeService("foo",
  2024  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2025  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2026  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2027  					expectError: true,
  2028  				}, {
  2029  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4v6",
  2030  					line: line(),
  2031  					svc: svctest.MakeService("foo",
  2032  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2033  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2034  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2035  					expectError: true,
  2036  				}, {
  2037  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6v4",
  2038  					line: line(),
  2039  					svc: svctest.MakeService("foo",
  2040  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2041  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2042  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2043  					expectError: true,
  2044  				}, {
  2045  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:unset",
  2046  					line: line(),
  2047  					svc: svctest.MakeService("foo",
  2048  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2049  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  2050  					expectError: true,
  2051  				}, {
  2052  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4",
  2053  					line: line(),
  2054  					svc: svctest.MakeService("foo",
  2055  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2056  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2057  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2058  					expectError: true,
  2059  				}, {
  2060  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6",
  2061  					line: line(),
  2062  					svc: svctest.MakeService("foo",
  2063  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2064  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2065  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2066  					expectError: true,
  2067  				}, {
  2068  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4v6",
  2069  					line: line(),
  2070  					svc: svctest.MakeService("foo",
  2071  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2072  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2073  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2074  					expectError: true,
  2075  				}, {
  2076  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6v4",
  2077  					line: line(),
  2078  					svc: svctest.MakeService("foo",
  2079  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2080  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2081  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2082  					expectError: true,
  2083  				},
  2084  				//----------------------------------------
  2085  				// singlestack:v4 Headless
  2086  				//----------------------------------------
  2087  				{
  2088  					name: "Headless_Policy:unset_Families:unset",
  2089  					line: line(),
  2090  					svc: svctest.MakeService("foo",
  2091  						svctest.SetHeadless),
  2092  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2093  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2094  					expectHeadless: true,
  2095  				}, {
  2096  					name: "Headless_Policy:unset_Families:v4",
  2097  					line: line(),
  2098  					svc: svctest.MakeService("foo",
  2099  						svctest.SetHeadless,
  2100  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2101  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2102  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2103  					expectHeadless: true,
  2104  				}, {
  2105  					name: "Headless_Policy:unset_Families:v6",
  2106  					line: line(),
  2107  					svc: svctest.MakeService("foo",
  2108  						svctest.SetHeadless,
  2109  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2110  					expectError: true,
  2111  				}, {
  2112  					name: "Headless_Policy:unset_Families:v4v6",
  2113  					line: line(),
  2114  					svc: svctest.MakeService("foo",
  2115  						svctest.SetHeadless,
  2116  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2117  					expectError: true,
  2118  				}, {
  2119  					name: "Headless_Policy:unset_Families:v6v4",
  2120  					line: line(),
  2121  					svc: svctest.MakeService("foo",
  2122  						svctest.SetHeadless,
  2123  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2124  					expectError: true,
  2125  				}, {
  2126  					name: "Headless_Policy:SingleStack_Families:unset",
  2127  					line: line(),
  2128  					svc: svctest.MakeService("foo",
  2129  						svctest.SetHeadless,
  2130  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  2131  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2132  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2133  					expectHeadless: true,
  2134  				}, {
  2135  					name: "Headless_Policy:SingleStack_Families:v4",
  2136  					line: line(),
  2137  					svc: svctest.MakeService("foo",
  2138  						svctest.SetHeadless,
  2139  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2140  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2141  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2142  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2143  					expectHeadless: true,
  2144  				}, {
  2145  					name: "Headless_Policy:SingleStack_Families:v6",
  2146  					line: line(),
  2147  					svc: svctest.MakeService("foo",
  2148  						svctest.SetHeadless,
  2149  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2150  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2151  					expectError: true,
  2152  				}, {
  2153  					name: "Headless_Policy:SingleStack_Families:v4v6",
  2154  					line: line(),
  2155  					svc: svctest.MakeService("foo",
  2156  						svctest.SetHeadless,
  2157  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2158  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2159  					expectError: true,
  2160  				}, {
  2161  					name: "Headless_Policy:SingleStack_Families:v6v4",
  2162  					line: line(),
  2163  					svc: svctest.MakeService("foo",
  2164  						svctest.SetHeadless,
  2165  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2166  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2167  					expectError: true,
  2168  				}, {
  2169  					name: "Headless_Policy:PreferDualStack_Families:unset",
  2170  					line: line(),
  2171  					svc: svctest.MakeService("foo",
  2172  						svctest.SetHeadless,
  2173  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  2174  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2175  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2176  					expectHeadless: true,
  2177  				}, {
  2178  					name: "Headless_Policy:PreferDualStack_Families:v4",
  2179  					line: line(),
  2180  					svc: svctest.MakeService("foo",
  2181  						svctest.SetHeadless,
  2182  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2183  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2184  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2185  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2186  					expectHeadless: true,
  2187  				}, {
  2188  					name: "Headless_Policy:PreferDualStack_Families:v6",
  2189  					line: line(),
  2190  					svc: svctest.MakeService("foo",
  2191  						svctest.SetHeadless,
  2192  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2193  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2194  					expectError: true,
  2195  				}, {
  2196  					name: "Headless_Policy:PreferDualStack_Families:v4v6",
  2197  					line: line(),
  2198  					svc: svctest.MakeService("foo",
  2199  						svctest.SetHeadless,
  2200  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2201  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2202  					expectError: true,
  2203  				}, {
  2204  					name: "Headless_Policy:PreferDualStack_Families:v6v4",
  2205  					line: line(),
  2206  					svc: svctest.MakeService("foo",
  2207  						svctest.SetHeadless,
  2208  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2209  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2210  					expectError: true,
  2211  				}, {
  2212  					name: "Headless_Policy:RequireDualStack_Families:unset",
  2213  					line: line(),
  2214  					svc: svctest.MakeService("foo",
  2215  						svctest.SetHeadless,
  2216  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  2217  					expectError: true,
  2218  				}, {
  2219  					name: "Headless_Policy:RequireDualStack_Families:v4",
  2220  					line: line(),
  2221  					svc: svctest.MakeService("foo",
  2222  						svctest.SetHeadless,
  2223  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2224  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2225  					expectError: true,
  2226  				}, {
  2227  					name: "Headless_Policy:RequireDualStack_Families:v6",
  2228  					line: line(),
  2229  					svc: svctest.MakeService("foo",
  2230  						svctest.SetHeadless,
  2231  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2232  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2233  					expectError: true,
  2234  				}, {
  2235  					name: "Headless_Policy:RequireDualStack_Families:v4v6",
  2236  					line: line(),
  2237  					svc: svctest.MakeService("foo",
  2238  						svctest.SetHeadless,
  2239  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2240  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2241  					expectError: true,
  2242  				}, {
  2243  					name: "Headless_Policy:RequireDualStack_Families:v6v4",
  2244  					line: line(),
  2245  					svc: svctest.MakeService("foo",
  2246  						svctest.SetHeadless,
  2247  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2248  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2249  					expectError: true,
  2250  				},
  2251  				//----------------------------------------
  2252  				// singlestack:v4 HeadlessSelectorless
  2253  				//----------------------------------------
  2254  				{
  2255  					name: "HeadlessSelectorless_Policy:unset_Families:unset",
  2256  					line: line(),
  2257  					svc: svctest.MakeService("foo",
  2258  						svctest.SetHeadless,
  2259  						svctest.SetSelector(nil)),
  2260  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2261  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2262  					expectHeadless: true,
  2263  				}, {
  2264  					name: "HeadlessSelectorless_Policy:unset_Families:v4",
  2265  					line: line(),
  2266  					svc: svctest.MakeService("foo",
  2267  						svctest.SetHeadless,
  2268  						svctest.SetSelector(nil),
  2269  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2270  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2271  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2272  					expectHeadless: true,
  2273  				}, {
  2274  					name: "HeadlessSelectorless_Policy:unset_Families:v6",
  2275  					line: line(),
  2276  					svc: svctest.MakeService("foo",
  2277  						svctest.SetHeadless,
  2278  						svctest.SetSelector(nil),
  2279  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2280  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2281  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  2282  					expectHeadless: true,
  2283  				}, {
  2284  					name: "HeadlessSelectorless_Policy:unset_Families:v4v6",
  2285  					line: line(),
  2286  					svc: svctest.MakeService("foo",
  2287  						svctest.SetHeadless,
  2288  						svctest.SetSelector(nil),
  2289  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2290  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2291  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2292  					expectHeadless: true,
  2293  				}, {
  2294  					name: "HeadlessSelectorless_Policy:unset_Families:v6v4",
  2295  					line: line(),
  2296  					svc: svctest.MakeService("foo",
  2297  						svctest.SetHeadless,
  2298  						svctest.SetSelector(nil),
  2299  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2300  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2301  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  2302  					expectHeadless: true,
  2303  				}, {
  2304  					name: "HeadlessSelectorless_Policy:SingleStack_Families:unset",
  2305  					line: line(),
  2306  					svc: svctest.MakeService("foo",
  2307  						svctest.SetHeadless,
  2308  						svctest.SetSelector(nil),
  2309  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  2310  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2311  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2312  					expectHeadless: true,
  2313  				}, {
  2314  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4",
  2315  					line: line(),
  2316  					svc: svctest.MakeService("foo",
  2317  						svctest.SetHeadless,
  2318  						svctest.SetSelector(nil),
  2319  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2320  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2321  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2322  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  2323  					expectHeadless: true,
  2324  				}, {
  2325  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6",
  2326  					line: line(),
  2327  					svc: svctest.MakeService("foo",
  2328  						svctest.SetHeadless,
  2329  						svctest.SetSelector(nil),
  2330  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2331  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2332  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2333  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2334  					expectHeadless: true,
  2335  				}, {
  2336  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4v6",
  2337  					line: line(),
  2338  					svc: svctest.MakeService("foo",
  2339  						svctest.SetHeadless,
  2340  						svctest.SetSelector(nil),
  2341  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2342  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2343  					expectError: true,
  2344  				}, {
  2345  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6v4",
  2346  					line: line(),
  2347  					svc: svctest.MakeService("foo",
  2348  						svctest.SetHeadless,
  2349  						svctest.SetSelector(nil),
  2350  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2351  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2352  					expectError: true,
  2353  				}, {
  2354  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:unset",
  2355  					line: line(),
  2356  					svc: svctest.MakeService("foo",
  2357  						svctest.SetHeadless,
  2358  						svctest.SetSelector(nil),
  2359  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  2360  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2361  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2362  					expectHeadless: true,
  2363  				}, {
  2364  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4",
  2365  					line: line(),
  2366  					svc: svctest.MakeService("foo",
  2367  						svctest.SetHeadless,
  2368  						svctest.SetSelector(nil),
  2369  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2370  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2371  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2372  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2373  					expectHeadless: true,
  2374  				}, {
  2375  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6",
  2376  					line: line(),
  2377  					svc: svctest.MakeService("foo",
  2378  						svctest.SetHeadless,
  2379  						svctest.SetSelector(nil),
  2380  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2381  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2382  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2383  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  2384  					expectHeadless: true,
  2385  				}, {
  2386  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4v6",
  2387  					line: line(),
  2388  					svc: svctest.MakeService("foo",
  2389  						svctest.SetHeadless,
  2390  						svctest.SetSelector(nil),
  2391  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2392  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2393  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2394  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2395  					expectHeadless: true,
  2396  				}, {
  2397  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6v4",
  2398  					line: line(),
  2399  					svc: svctest.MakeService("foo",
  2400  						svctest.SetHeadless,
  2401  						svctest.SetSelector(nil),
  2402  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2403  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2404  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2405  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  2406  					expectHeadless: true,
  2407  				}, {
  2408  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:unset",
  2409  					line: line(),
  2410  					svc: svctest.MakeService("foo",
  2411  						svctest.SetHeadless,
  2412  						svctest.SetSelector(nil),
  2413  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  2414  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2415  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2416  					expectHeadless: true,
  2417  				}, {
  2418  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4",
  2419  					line: line(),
  2420  					svc: svctest.MakeService("foo",
  2421  						svctest.SetHeadless,
  2422  						svctest.SetSelector(nil),
  2423  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2424  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2425  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2426  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2427  					expectHeadless: true,
  2428  				}, {
  2429  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6",
  2430  					line: line(),
  2431  					svc: svctest.MakeService("foo",
  2432  						svctest.SetHeadless,
  2433  						svctest.SetSelector(nil),
  2434  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2435  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2436  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2437  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  2438  					expectHeadless: true,
  2439  				}, {
  2440  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4v6",
  2441  					line: line(),
  2442  					svc: svctest.MakeService("foo",
  2443  						svctest.SetHeadless,
  2444  						svctest.SetSelector(nil),
  2445  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2446  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2447  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2448  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  2449  					expectHeadless: true,
  2450  				}, {
  2451  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6v4",
  2452  					line: line(),
  2453  					svc: svctest.MakeService("foo",
  2454  						svctest.SetHeadless,
  2455  						svctest.SetSelector(nil),
  2456  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2457  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2458  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  2459  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  2460  					expectHeadless: true,
  2461  				},
  2462  			},
  2463  		}, {
  2464  			name:            "singlestack:v6",
  2465  			clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  2466  			cases: []testCase{
  2467  				//----------------------------------------
  2468  				// singlestack:v6 ClusterIPs:unset
  2469  				//----------------------------------------
  2470  				{
  2471  					name:           "ClusterIPs:unset_Policy:unset_Families:unset",
  2472  					line:           line(),
  2473  					svc:            svctest.MakeService("foo"),
  2474  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2475  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2476  				}, {
  2477  					name: "ClusterIPs:unset_Policy:unset_Families:v4",
  2478  					line: line(),
  2479  					svc: svctest.MakeService("foo",
  2480  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2481  					expectError: true,
  2482  				}, {
  2483  					name: "ClusterIPs:unset_Policy:unset_Families:v6",
  2484  					line: line(),
  2485  					svc: svctest.MakeService("foo",
  2486  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2487  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2488  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2489  				}, {
  2490  					name: "ClusterIPs:unset_Policy:unset_Families:v4v6",
  2491  					line: line(),
  2492  					svc: svctest.MakeService("foo",
  2493  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2494  					expectError: true,
  2495  				}, {
  2496  					name: "ClusterIPs:unset_Policy:unset_Families:v6v4",
  2497  					line: line(),
  2498  					svc: svctest.MakeService("foo",
  2499  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2500  					expectError: true,
  2501  				}, {
  2502  					name: "ClusterIPs:unset_Policy:SingleStack_Families:unset",
  2503  					line: line(),
  2504  					svc: svctest.MakeService("foo",
  2505  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  2506  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2507  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2508  				}, {
  2509  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4",
  2510  					line: line(),
  2511  					svc: svctest.MakeService("foo",
  2512  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2513  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2514  					expectError: true,
  2515  				}, {
  2516  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6",
  2517  					line: line(),
  2518  					svc: svctest.MakeService("foo",
  2519  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2520  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2521  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2522  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2523  				}, {
  2524  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4v6",
  2525  					line: line(),
  2526  					svc: svctest.MakeService("foo",
  2527  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2528  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2529  					expectError: true,
  2530  				}, {
  2531  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6v4",
  2532  					line: line(),
  2533  					svc: svctest.MakeService("foo",
  2534  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2535  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2536  					expectError: true,
  2537  				}, {
  2538  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:unset",
  2539  					line: line(),
  2540  					svc: svctest.MakeService("foo",
  2541  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  2542  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2543  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2544  				}, {
  2545  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4",
  2546  					line: line(),
  2547  					svc: svctest.MakeService("foo",
  2548  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2549  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2550  					expectError: true,
  2551  				}, {
  2552  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6",
  2553  					line: line(),
  2554  					svc: svctest.MakeService("foo",
  2555  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2556  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2557  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2558  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2559  				}, {
  2560  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4v6",
  2561  					line: line(),
  2562  					svc: svctest.MakeService("foo",
  2563  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2564  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2565  					expectError: true,
  2566  				}, {
  2567  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6v4",
  2568  					line: line(),
  2569  					svc: svctest.MakeService("foo",
  2570  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2571  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2572  					expectError: true,
  2573  				}, {
  2574  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:unset",
  2575  					line: line(),
  2576  					svc: svctest.MakeService("foo",
  2577  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  2578  					expectError: true,
  2579  				}, {
  2580  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4",
  2581  					line: line(),
  2582  					svc: svctest.MakeService("foo",
  2583  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2584  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2585  					expectError: true,
  2586  				}, {
  2587  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6",
  2588  					line: line(),
  2589  					svc: svctest.MakeService("foo",
  2590  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2591  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2592  					expectError: true,
  2593  				}, {
  2594  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4v6",
  2595  					line: line(),
  2596  					svc: svctest.MakeService("foo",
  2597  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2598  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2599  					expectError: true,
  2600  				}, {
  2601  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6v4",
  2602  					line: line(),
  2603  					svc: svctest.MakeService("foo",
  2604  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2605  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2606  					expectError: true,
  2607  				},
  2608  				//----------------------------------------
  2609  				// singlestack:v6 ClusterIPs:v6
  2610  				//----------------------------------------
  2611  				{
  2612  					name: "ClusterIPs:v6_Policy:unset_Families:unset",
  2613  					line: line(),
  2614  					svc: svctest.MakeService("foo",
  2615  						svctest.SetClusterIPs("2000::1")),
  2616  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2617  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2618  				}, {
  2619  					name: "ClusterIPs:v6_Policy:unset_Families:v4",
  2620  					line: line(),
  2621  					svc: svctest.MakeService("foo",
  2622  						svctest.SetClusterIPs("2000::1"),
  2623  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2624  					expectError: true,
  2625  				}, {
  2626  					name: "ClusterIPs:v6_Policy:unset_Families:v6",
  2627  					line: line(),
  2628  					svc: svctest.MakeService("foo",
  2629  						svctest.SetClusterIPs("2000::1"),
  2630  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2631  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2632  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2633  				}, {
  2634  					name: "ClusterIPs:v6_Policy:unset_Families:v4v6",
  2635  					line: line(),
  2636  					svc: svctest.MakeService("foo",
  2637  						svctest.SetClusterIPs("2000::1"),
  2638  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2639  					expectError: true,
  2640  				}, {
  2641  					name: "ClusterIPs:v6_Policy:unset_Families:v6v4",
  2642  					line: line(),
  2643  					svc: svctest.MakeService("foo",
  2644  						svctest.SetClusterIPs("2000::1"),
  2645  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2646  					expectError: true,
  2647  				}, {
  2648  					name: "ClusterIPs:v6_Policy:SingleStack_Families:unset",
  2649  					line: line(),
  2650  					svc: svctest.MakeService("foo",
  2651  						svctest.SetClusterIPs("2000::1"),
  2652  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  2653  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2654  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2655  				}, {
  2656  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v4",
  2657  					line: line(),
  2658  					svc: svctest.MakeService("foo",
  2659  						svctest.SetClusterIPs("2000::1"),
  2660  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2661  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2662  					expectError: true,
  2663  				}, {
  2664  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v6",
  2665  					line: line(),
  2666  					svc: svctest.MakeService("foo",
  2667  						svctest.SetClusterIPs("2000::1"),
  2668  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2669  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2670  					expectPolicy:   api.IPFamilyPolicySingleStack,
  2671  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2672  				}, {
  2673  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v4v6",
  2674  					line: line(),
  2675  					svc: svctest.MakeService("foo",
  2676  						svctest.SetClusterIPs("2000::1"),
  2677  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2678  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2679  					expectError: true,
  2680  				}, {
  2681  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v6v4",
  2682  					line: line(),
  2683  					svc: svctest.MakeService("foo",
  2684  						svctest.SetClusterIPs("2000::1"),
  2685  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2686  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2687  					expectError: true,
  2688  				}, {
  2689  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:unset",
  2690  					line: line(),
  2691  					svc: svctest.MakeService("foo",
  2692  						svctest.SetClusterIPs("2000::1"),
  2693  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  2694  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2695  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2696  				}, {
  2697  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v4",
  2698  					line: line(),
  2699  					svc: svctest.MakeService("foo",
  2700  						svctest.SetClusterIPs("2000::1"),
  2701  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2702  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2703  					expectError: true,
  2704  				}, {
  2705  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v6",
  2706  					line: line(),
  2707  					svc: svctest.MakeService("foo",
  2708  						svctest.SetClusterIPs("2000::1"),
  2709  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2710  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2711  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  2712  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  2713  				}, {
  2714  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v4v6",
  2715  					line: line(),
  2716  					svc: svctest.MakeService("foo",
  2717  						svctest.SetClusterIPs("2000::1"),
  2718  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2719  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2720  					expectError: true,
  2721  				}, {
  2722  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v6v4",
  2723  					line: line(),
  2724  					svc: svctest.MakeService("foo",
  2725  						svctest.SetClusterIPs("2000::1"),
  2726  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2727  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2728  					expectError: true,
  2729  				}, {
  2730  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:unset",
  2731  					line: line(),
  2732  					svc: svctest.MakeService("foo",
  2733  						svctest.SetClusterIPs("2000::1"),
  2734  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  2735  					expectError: true,
  2736  				}, {
  2737  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v4",
  2738  					line: line(),
  2739  					svc: svctest.MakeService("foo",
  2740  						svctest.SetClusterIPs("2000::1"),
  2741  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2742  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2743  					expectError: true,
  2744  				}, {
  2745  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v6",
  2746  					line: line(),
  2747  					svc: svctest.MakeService("foo",
  2748  						svctest.SetClusterIPs("2000::1"),
  2749  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2750  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2751  					expectError: true,
  2752  				}, {
  2753  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v4v6",
  2754  					line: line(),
  2755  					svc: svctest.MakeService("foo",
  2756  						svctest.SetClusterIPs("2000::1"),
  2757  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2758  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2759  					expectError: true,
  2760  				}, {
  2761  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v6v4",
  2762  					line: line(),
  2763  					svc: svctest.MakeService("foo",
  2764  						svctest.SetClusterIPs("2000::1"),
  2765  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2766  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2767  					expectError: true,
  2768  				},
  2769  				//----------------------------------------
  2770  				// singlestack:v6 ClusterIPs:v4v6
  2771  				//----------------------------------------
  2772  				{
  2773  					name: "ClusterIPs:v4v6_Policy:unset_Families:unset",
  2774  					line: line(),
  2775  					svc: svctest.MakeService("foo",
  2776  						svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  2777  					expectError: true,
  2778  				}, {
  2779  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4",
  2780  					line: line(),
  2781  					svc: svctest.MakeService("foo",
  2782  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2783  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2784  					expectError: true,
  2785  				}, {
  2786  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6",
  2787  					line: line(),
  2788  					svc: svctest.MakeService("foo",
  2789  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2790  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2791  					expectError: true,
  2792  				}, {
  2793  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4v6",
  2794  					line: line(),
  2795  					svc: svctest.MakeService("foo",
  2796  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2797  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2798  					expectError: true,
  2799  				}, {
  2800  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6v4",
  2801  					line: line(),
  2802  					svc: svctest.MakeService("foo",
  2803  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2804  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2805  					expectError: true,
  2806  				}, {
  2807  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:unset",
  2808  					line: line(),
  2809  					svc: svctest.MakeService("foo",
  2810  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2811  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  2812  					expectError: true,
  2813  				}, {
  2814  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4",
  2815  					line: line(),
  2816  					svc: svctest.MakeService("foo",
  2817  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2818  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2819  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2820  					expectError: true,
  2821  				}, {
  2822  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6",
  2823  					line: line(),
  2824  					svc: svctest.MakeService("foo",
  2825  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2826  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2827  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2828  					expectError: true,
  2829  				}, {
  2830  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4v6",
  2831  					line: line(),
  2832  					svc: svctest.MakeService("foo",
  2833  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2834  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2835  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2836  					expectError: true,
  2837  				}, {
  2838  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6v4",
  2839  					line: line(),
  2840  					svc: svctest.MakeService("foo",
  2841  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2842  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2843  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2844  					expectError: true,
  2845  				}, {
  2846  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:unset",
  2847  					line: line(),
  2848  					svc: svctest.MakeService("foo",
  2849  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2850  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  2851  					expectError: true,
  2852  				}, {
  2853  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4",
  2854  					line: line(),
  2855  					svc: svctest.MakeService("foo",
  2856  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2857  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2858  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2859  					expectError: true,
  2860  				}, {
  2861  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6",
  2862  					line: line(),
  2863  					svc: svctest.MakeService("foo",
  2864  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2865  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2866  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2867  					expectError: true,
  2868  				}, {
  2869  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4v6",
  2870  					line: line(),
  2871  					svc: svctest.MakeService("foo",
  2872  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2873  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2874  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2875  					expectError: true,
  2876  				}, {
  2877  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6v4",
  2878  					line: line(),
  2879  					svc: svctest.MakeService("foo",
  2880  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2881  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  2882  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2883  					expectError: true,
  2884  				}, {
  2885  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:unset",
  2886  					line: line(),
  2887  					svc: svctest.MakeService("foo",
  2888  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2889  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  2890  					expectError: true,
  2891  				}, {
  2892  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4",
  2893  					line: line(),
  2894  					svc: svctest.MakeService("foo",
  2895  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2896  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2897  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2898  					expectError: true,
  2899  				}, {
  2900  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6",
  2901  					line: line(),
  2902  					svc: svctest.MakeService("foo",
  2903  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2904  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2905  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2906  					expectError: true,
  2907  				}, {
  2908  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4v6",
  2909  					line: line(),
  2910  					svc: svctest.MakeService("foo",
  2911  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2912  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2913  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2914  					expectError: true,
  2915  				}, {
  2916  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6v4",
  2917  					line: line(),
  2918  					svc: svctest.MakeService("foo",
  2919  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  2920  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  2921  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2922  					expectError: true,
  2923  				},
  2924  				//----------------------------------------
  2925  				// singlestack:v6 ClusterIPs:v6v4
  2926  				//----------------------------------------
  2927  				{
  2928  					name: "ClusterIPs:v6v4_Policy:unset_Families:unset",
  2929  					line: line(),
  2930  					svc: svctest.MakeService("foo",
  2931  						svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  2932  					expectError: true,
  2933  				}, {
  2934  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4",
  2935  					line: line(),
  2936  					svc: svctest.MakeService("foo",
  2937  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2938  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2939  					expectError: true,
  2940  				}, {
  2941  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6",
  2942  					line: line(),
  2943  					svc: svctest.MakeService("foo",
  2944  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2945  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2946  					expectError: true,
  2947  				}, {
  2948  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4v6",
  2949  					line: line(),
  2950  					svc: svctest.MakeService("foo",
  2951  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2952  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2953  					expectError: true,
  2954  				}, {
  2955  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6v4",
  2956  					line: line(),
  2957  					svc: svctest.MakeService("foo",
  2958  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2959  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2960  					expectError: true,
  2961  				}, {
  2962  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:unset",
  2963  					line: line(),
  2964  					svc: svctest.MakeService("foo",
  2965  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2966  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  2967  					expectError: true,
  2968  				}, {
  2969  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4",
  2970  					line: line(),
  2971  					svc: svctest.MakeService("foo",
  2972  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2973  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2974  						svctest.SetIPFamilies(api.IPv4Protocol)),
  2975  					expectError: true,
  2976  				}, {
  2977  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6",
  2978  					line: line(),
  2979  					svc: svctest.MakeService("foo",
  2980  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2981  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2982  						svctest.SetIPFamilies(api.IPv6Protocol)),
  2983  					expectError: true,
  2984  				}, {
  2985  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4v6",
  2986  					line: line(),
  2987  					svc: svctest.MakeService("foo",
  2988  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2989  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2990  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  2991  					expectError: true,
  2992  				}, {
  2993  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6v4",
  2994  					line: line(),
  2995  					svc: svctest.MakeService("foo",
  2996  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  2997  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  2998  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  2999  					expectError: true,
  3000  				}, {
  3001  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:unset",
  3002  					line: line(),
  3003  					svc: svctest.MakeService("foo",
  3004  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3005  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  3006  					expectError: true,
  3007  				}, {
  3008  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4",
  3009  					line: line(),
  3010  					svc: svctest.MakeService("foo",
  3011  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3012  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3013  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3014  					expectError: true,
  3015  				}, {
  3016  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6",
  3017  					line: line(),
  3018  					svc: svctest.MakeService("foo",
  3019  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3020  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3021  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3022  					expectError: true,
  3023  				}, {
  3024  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4v6",
  3025  					line: line(),
  3026  					svc: svctest.MakeService("foo",
  3027  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3028  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3029  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3030  					expectError: true,
  3031  				}, {
  3032  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6v4",
  3033  					line: line(),
  3034  					svc: svctest.MakeService("foo",
  3035  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3036  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3037  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3038  					expectError: true,
  3039  				}, {
  3040  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:unset",
  3041  					line: line(),
  3042  					svc: svctest.MakeService("foo",
  3043  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3044  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  3045  					expectError: true,
  3046  				}, {
  3047  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4",
  3048  					line: line(),
  3049  					svc: svctest.MakeService("foo",
  3050  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3051  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3052  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3053  					expectError: true,
  3054  				}, {
  3055  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6",
  3056  					line: line(),
  3057  					svc: svctest.MakeService("foo",
  3058  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3059  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3060  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3061  					expectError: true,
  3062  				}, {
  3063  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4v6",
  3064  					line: line(),
  3065  					svc: svctest.MakeService("foo",
  3066  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3067  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3068  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3069  					expectError: true,
  3070  				}, {
  3071  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6v4",
  3072  					line: line(),
  3073  					svc: svctest.MakeService("foo",
  3074  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  3075  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3076  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3077  					expectError: true,
  3078  				},
  3079  				//----------------------------------------
  3080  				// singlestack:v6 Headless
  3081  				//----------------------------------------
  3082  				{
  3083  					name: "Headless_Policy:unset_Families:unset",
  3084  					line: line(),
  3085  					svc: svctest.MakeService("foo",
  3086  						svctest.SetHeadless),
  3087  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3088  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3089  					expectHeadless: true,
  3090  				}, {
  3091  					name: "Headless_Policy:unset_Families:v4",
  3092  					line: line(),
  3093  					svc: svctest.MakeService("foo",
  3094  						svctest.SetHeadless,
  3095  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3096  					expectError: true,
  3097  				}, {
  3098  					name: "Headless_Policy:unset_Families:v6",
  3099  					line: line(),
  3100  					svc: svctest.MakeService("foo",
  3101  						svctest.SetHeadless,
  3102  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3103  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3104  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3105  					expectHeadless: true,
  3106  				}, {
  3107  					name: "Headless_Policy:unset_Families:v4v6",
  3108  					line: line(),
  3109  					svc: svctest.MakeService("foo",
  3110  						svctest.SetHeadless,
  3111  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3112  					expectError: true,
  3113  				}, {
  3114  					name: "Headless_Policy:unset_Families:v6v4",
  3115  					line: line(),
  3116  					svc: svctest.MakeService("foo",
  3117  						svctest.SetHeadless,
  3118  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3119  					expectError: true,
  3120  				}, {
  3121  					name: "Headless_Policy:SingleStack_Families:unset",
  3122  					line: line(),
  3123  					svc: svctest.MakeService("foo",
  3124  						svctest.SetHeadless,
  3125  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  3126  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3127  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3128  					expectHeadless: true,
  3129  				}, {
  3130  					name: "Headless_Policy:SingleStack_Families:v4",
  3131  					line: line(),
  3132  					svc: svctest.MakeService("foo",
  3133  						svctest.SetHeadless,
  3134  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3135  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3136  					expectError: true,
  3137  				}, {
  3138  					name: "Headless_Policy:SingleStack_Families:v6",
  3139  					line: line(),
  3140  					svc: svctest.MakeService("foo",
  3141  						svctest.SetHeadless,
  3142  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3143  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3144  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3145  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3146  					expectHeadless: true,
  3147  				}, {
  3148  					name: "Headless_Policy:SingleStack_Families:v4v6",
  3149  					line: line(),
  3150  					svc: svctest.MakeService("foo",
  3151  						svctest.SetHeadless,
  3152  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3153  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3154  					expectError: true,
  3155  				}, {
  3156  					name: "Headless_Policy:SingleStack_Families:v6v4",
  3157  					line: line(),
  3158  					svc: svctest.MakeService("foo",
  3159  						svctest.SetHeadless,
  3160  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3161  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3162  					expectError: true,
  3163  				}, {
  3164  					name: "Headless_Policy:PreferDualStack_Families:unset",
  3165  					line: line(),
  3166  					svc: svctest.MakeService("foo",
  3167  						svctest.SetHeadless,
  3168  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  3169  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3170  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3171  					expectHeadless: true,
  3172  				}, {
  3173  					name: "Headless_Policy:PreferDualStack_Families:v4",
  3174  					line: line(),
  3175  					svc: svctest.MakeService("foo",
  3176  						svctest.SetHeadless,
  3177  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3178  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3179  					expectError: true,
  3180  				}, {
  3181  					name: "Headless_Policy:PreferDualStack_Families:v6",
  3182  					line: line(),
  3183  					svc: svctest.MakeService("foo",
  3184  						svctest.SetHeadless,
  3185  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3186  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3187  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3188  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3189  					expectHeadless: true,
  3190  				}, {
  3191  					name: "Headless_Policy:PreferDualStack_Families:v4v6",
  3192  					line: line(),
  3193  					svc: svctest.MakeService("foo",
  3194  						svctest.SetHeadless,
  3195  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3196  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3197  					expectError: true,
  3198  				}, {
  3199  					name: "Headless_Policy:PreferDualStack_Families:v6v4",
  3200  					line: line(),
  3201  					svc: svctest.MakeService("foo",
  3202  						svctest.SetHeadless,
  3203  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3204  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3205  					expectError: true,
  3206  				}, {
  3207  					name: "Headless_Policy:RequireDualStack_Families:unset",
  3208  					line: line(),
  3209  					svc: svctest.MakeService("foo",
  3210  						svctest.SetHeadless,
  3211  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  3212  					expectError: true,
  3213  				}, {
  3214  					name: "Headless_Policy:RequireDualStack_Families:v4",
  3215  					line: line(),
  3216  					svc: svctest.MakeService("foo",
  3217  						svctest.SetHeadless,
  3218  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3219  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3220  					expectError: true,
  3221  				}, {
  3222  					name: "Headless_Policy:RequireDualStack_Families:v6",
  3223  					line: line(),
  3224  					svc: svctest.MakeService("foo",
  3225  						svctest.SetHeadless,
  3226  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3227  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3228  					expectError: true,
  3229  				}, {
  3230  					name: "Headless_Policy:RequireDualStack_Families:v4v6",
  3231  					line: line(),
  3232  					svc: svctest.MakeService("foo",
  3233  						svctest.SetHeadless,
  3234  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3235  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3236  					expectError: true,
  3237  				}, {
  3238  					name: "Headless_Policy:RequireDualStack_Families:v6v4",
  3239  					line: line(),
  3240  					svc: svctest.MakeService("foo",
  3241  						svctest.SetHeadless,
  3242  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3243  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3244  					expectError: true,
  3245  				},
  3246  				//----------------------------------------
  3247  				// singlestack:v6 HeadlessSelectorless
  3248  				//----------------------------------------
  3249  				{
  3250  					name: "HeadlessSelectorless_Policy:unset_Families:unset",
  3251  					line: line(),
  3252  					svc: svctest.MakeService("foo",
  3253  						svctest.SetHeadless,
  3254  						svctest.SetSelector(nil)),
  3255  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3256  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3257  					expectHeadless: true,
  3258  				}, {
  3259  					name: "HeadlessSelectorless_Policy:unset_Families:v4",
  3260  					line: line(),
  3261  					svc: svctest.MakeService("foo",
  3262  						svctest.SetHeadless,
  3263  						svctest.SetSelector(nil),
  3264  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3265  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3266  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3267  					expectHeadless: true,
  3268  				}, {
  3269  					name: "HeadlessSelectorless_Policy:unset_Families:v6",
  3270  					line: line(),
  3271  					svc: svctest.MakeService("foo",
  3272  						svctest.SetHeadless,
  3273  						svctest.SetSelector(nil),
  3274  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3275  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3276  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3277  					expectHeadless: true,
  3278  				}, {
  3279  					name: "HeadlessSelectorless_Policy:unset_Families:v4v6",
  3280  					line: line(),
  3281  					svc: svctest.MakeService("foo",
  3282  						svctest.SetHeadless,
  3283  						svctest.SetSelector(nil),
  3284  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3285  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3286  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3287  					expectHeadless: true,
  3288  				}, {
  3289  					name: "HeadlessSelectorless_Policy:unset_Families:v6v4",
  3290  					line: line(),
  3291  					svc: svctest.MakeService("foo",
  3292  						svctest.SetHeadless,
  3293  						svctest.SetSelector(nil),
  3294  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3295  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3296  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3297  					expectHeadless: true,
  3298  				}, {
  3299  					name: "HeadlessSelectorless_Policy:SingleStack_Families:unset",
  3300  					line: line(),
  3301  					svc: svctest.MakeService("foo",
  3302  						svctest.SetHeadless,
  3303  						svctest.SetSelector(nil),
  3304  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  3305  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3306  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3307  					expectHeadless: true,
  3308  				}, {
  3309  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4",
  3310  					line: line(),
  3311  					svc: svctest.MakeService("foo",
  3312  						svctest.SetHeadless,
  3313  						svctest.SetSelector(nil),
  3314  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3315  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3316  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3317  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3318  					expectHeadless: true,
  3319  				}, {
  3320  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6",
  3321  					line: line(),
  3322  					svc: svctest.MakeService("foo",
  3323  						svctest.SetHeadless,
  3324  						svctest.SetSelector(nil),
  3325  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3326  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3327  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3328  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3329  					expectHeadless: true,
  3330  				}, {
  3331  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4v6",
  3332  					line: line(),
  3333  					svc: svctest.MakeService("foo",
  3334  						svctest.SetHeadless,
  3335  						svctest.SetSelector(nil),
  3336  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3337  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3338  					expectError: true,
  3339  				}, {
  3340  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6v4",
  3341  					line: line(),
  3342  					svc: svctest.MakeService("foo",
  3343  						svctest.SetHeadless,
  3344  						svctest.SetSelector(nil),
  3345  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3346  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3347  					expectError: true,
  3348  				}, {
  3349  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:unset",
  3350  					line: line(),
  3351  					svc: svctest.MakeService("foo",
  3352  						svctest.SetHeadless,
  3353  						svctest.SetSelector(nil),
  3354  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  3355  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3356  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3357  					expectHeadless: true,
  3358  				}, {
  3359  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4",
  3360  					line: line(),
  3361  					svc: svctest.MakeService("foo",
  3362  						svctest.SetHeadless,
  3363  						svctest.SetSelector(nil),
  3364  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3365  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3366  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3367  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3368  					expectHeadless: true,
  3369  				}, {
  3370  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6",
  3371  					line: line(),
  3372  					svc: svctest.MakeService("foo",
  3373  						svctest.SetHeadless,
  3374  						svctest.SetSelector(nil),
  3375  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3376  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3377  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3378  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3379  					expectHeadless: true,
  3380  				}, {
  3381  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4v6",
  3382  					line: line(),
  3383  					svc: svctest.MakeService("foo",
  3384  						svctest.SetHeadless,
  3385  						svctest.SetSelector(nil),
  3386  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3387  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3388  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3389  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3390  					expectHeadless: true,
  3391  				}, {
  3392  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6v4",
  3393  					line: line(),
  3394  					svc: svctest.MakeService("foo",
  3395  						svctest.SetHeadless,
  3396  						svctest.SetSelector(nil),
  3397  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3398  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3399  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3400  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3401  					expectHeadless: true,
  3402  				}, {
  3403  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:unset",
  3404  					line: line(),
  3405  					svc: svctest.MakeService("foo",
  3406  						svctest.SetHeadless,
  3407  						svctest.SetSelector(nil),
  3408  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  3409  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3410  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3411  					expectHeadless: true,
  3412  				}, {
  3413  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4",
  3414  					line: line(),
  3415  					svc: svctest.MakeService("foo",
  3416  						svctest.SetHeadless,
  3417  						svctest.SetSelector(nil),
  3418  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3419  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3420  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3421  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3422  					expectHeadless: true,
  3423  				}, {
  3424  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6",
  3425  					line: line(),
  3426  					svc: svctest.MakeService("foo",
  3427  						svctest.SetHeadless,
  3428  						svctest.SetSelector(nil),
  3429  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3430  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3431  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3432  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3433  					expectHeadless: true,
  3434  				}, {
  3435  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4v6",
  3436  					line: line(),
  3437  					svc: svctest.MakeService("foo",
  3438  						svctest.SetHeadless,
  3439  						svctest.SetSelector(nil),
  3440  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3441  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3442  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3443  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3444  					expectHeadless: true,
  3445  				}, {
  3446  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6v4",
  3447  					line: line(),
  3448  					svc: svctest.MakeService("foo",
  3449  						svctest.SetHeadless,
  3450  						svctest.SetSelector(nil),
  3451  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3452  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3453  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3454  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3455  					expectHeadless: true,
  3456  				},
  3457  			},
  3458  		}, {
  3459  			name:            "dualstack:v4v6",
  3460  			clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3461  			cases: []testCase{
  3462  				//----------------------------------------
  3463  				// dualstack:v4v6 ClusterIPs:unset
  3464  				//----------------------------------------
  3465  				{
  3466  					name:           "ClusterIPs:unset_Policy:unset_Families:unset",
  3467  					line:           line(),
  3468  					svc:            svctest.MakeService("foo"),
  3469  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3470  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3471  				}, {
  3472  					name: "ClusterIPs:unset_Policy:unset_Families:v4",
  3473  					line: line(),
  3474  					svc: svctest.MakeService("foo",
  3475  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3476  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3477  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3478  				}, {
  3479  					name: "ClusterIPs:unset_Policy:unset_Families:v6",
  3480  					line: line(),
  3481  					svc: svctest.MakeService("foo",
  3482  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3483  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3484  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3485  				}, {
  3486  					name: "ClusterIPs:unset_Policy:unset_Families:v4v6",
  3487  					line: line(),
  3488  					svc: svctest.MakeService("foo",
  3489  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3490  					expectError: true,
  3491  				}, {
  3492  					name: "ClusterIPs:unset_Policy:unset_Families:v6v4",
  3493  					line: line(),
  3494  					svc: svctest.MakeService("foo",
  3495  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3496  					expectError: true,
  3497  				}, {
  3498  					name: "ClusterIPs:unset_Policy:SingleStack_Families:unset",
  3499  					line: line(),
  3500  					svc: svctest.MakeService("foo",
  3501  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  3502  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3503  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3504  				}, {
  3505  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4",
  3506  					line: line(),
  3507  					svc: svctest.MakeService("foo",
  3508  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3509  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3510  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3511  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3512  				}, {
  3513  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6",
  3514  					line: line(),
  3515  					svc: svctest.MakeService("foo",
  3516  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3517  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3518  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3519  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3520  				}, {
  3521  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4v6",
  3522  					line: line(),
  3523  					svc: svctest.MakeService("foo",
  3524  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3525  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3526  					expectError: true,
  3527  				}, {
  3528  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6v4",
  3529  					line: line(),
  3530  					svc: svctest.MakeService("foo",
  3531  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3532  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3533  					expectError: true,
  3534  				}, {
  3535  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:unset",
  3536  					line: line(),
  3537  					svc: svctest.MakeService("foo",
  3538  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  3539  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3540  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3541  				}, {
  3542  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4",
  3543  					line: line(),
  3544  					svc: svctest.MakeService("foo",
  3545  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3546  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3547  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3548  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3549  				}, {
  3550  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6",
  3551  					line: line(),
  3552  					svc: svctest.MakeService("foo",
  3553  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3554  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3555  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3556  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3557  				}, {
  3558  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4v6",
  3559  					line: line(),
  3560  					svc: svctest.MakeService("foo",
  3561  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3562  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3563  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3564  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3565  				}, {
  3566  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6v4",
  3567  					line: line(),
  3568  					svc: svctest.MakeService("foo",
  3569  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3570  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3571  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3572  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3573  				}, {
  3574  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:unset",
  3575  					line: line(),
  3576  					svc: svctest.MakeService("foo",
  3577  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  3578  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3579  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3580  				}, {
  3581  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4",
  3582  					line: line(),
  3583  					svc: svctest.MakeService("foo",
  3584  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3585  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3586  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3587  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3588  				}, {
  3589  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6",
  3590  					line: line(),
  3591  					svc: svctest.MakeService("foo",
  3592  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3593  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3594  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3595  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3596  				}, {
  3597  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4v6",
  3598  					line: line(),
  3599  					svc: svctest.MakeService("foo",
  3600  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3601  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3602  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3603  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3604  				}, {
  3605  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6v4",
  3606  					line: line(),
  3607  					svc: svctest.MakeService("foo",
  3608  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3609  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3610  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3611  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3612  				},
  3613  				//----------------------------------------
  3614  				// dualstack:v4v6 ClusterIPs:v4
  3615  				//----------------------------------------
  3616  				{
  3617  					name: "ClusterIPs:v4_Policy:unset_Families:unset",
  3618  					line: line(),
  3619  					svc: svctest.MakeService("foo",
  3620  						svctest.SetClusterIPs("10.0.0.1")),
  3621  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3622  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3623  				}, {
  3624  					name: "ClusterIPs:v4_Policy:unset_Families:v4",
  3625  					line: line(),
  3626  					svc: svctest.MakeService("foo",
  3627  						svctest.SetClusterIPs("10.0.0.1"),
  3628  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3629  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3630  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3631  				}, {
  3632  					name: "ClusterIPs:v4_Policy:unset_Families:v6",
  3633  					line: line(),
  3634  					svc: svctest.MakeService("foo",
  3635  						svctest.SetClusterIPs("10.0.0.1"),
  3636  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3637  					expectError: true,
  3638  				}, {
  3639  					name: "ClusterIPs:v4_Policy:unset_Families:v4v6",
  3640  					line: line(),
  3641  					svc: svctest.MakeService("foo",
  3642  						svctest.SetClusterIPs("10.0.0.1"),
  3643  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3644  					expectError: true,
  3645  				}, {
  3646  					name: "ClusterIPs:v4_Policy:unset_Families:v6v4",
  3647  					line: line(),
  3648  					svc: svctest.MakeService("foo",
  3649  						svctest.SetClusterIPs("10.0.0.1"),
  3650  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3651  					expectError: true,
  3652  				}, {
  3653  					name: "ClusterIPs:v4_Policy:SingleStack_Families:unset",
  3654  					line: line(),
  3655  					svc: svctest.MakeService("foo",
  3656  						svctest.SetClusterIPs("10.0.0.1"),
  3657  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  3658  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3659  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3660  				}, {
  3661  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v4",
  3662  					line: line(),
  3663  					svc: svctest.MakeService("foo",
  3664  						svctest.SetClusterIPs("10.0.0.1"),
  3665  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3666  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3667  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3668  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  3669  				}, {
  3670  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v6",
  3671  					line: line(),
  3672  					svc: svctest.MakeService("foo",
  3673  						svctest.SetClusterIPs("10.0.0.1"),
  3674  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3675  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3676  					expectError: true,
  3677  				}, {
  3678  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v4v6",
  3679  					line: line(),
  3680  					svc: svctest.MakeService("foo",
  3681  						svctest.SetClusterIPs("10.0.0.1"),
  3682  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3683  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3684  					expectError: true,
  3685  				}, {
  3686  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v6v4",
  3687  					line: line(),
  3688  					svc: svctest.MakeService("foo",
  3689  						svctest.SetClusterIPs("10.0.0.1"),
  3690  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3691  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3692  					expectError: true,
  3693  				}, {
  3694  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:unset",
  3695  					line: line(),
  3696  					svc: svctest.MakeService("foo",
  3697  						svctest.SetClusterIPs("10.0.0.1"),
  3698  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  3699  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3700  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3701  				}, {
  3702  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v4",
  3703  					line: line(),
  3704  					svc: svctest.MakeService("foo",
  3705  						svctest.SetClusterIPs("10.0.0.1"),
  3706  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3707  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3708  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3709  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3710  				}, {
  3711  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v6",
  3712  					line: line(),
  3713  					svc: svctest.MakeService("foo",
  3714  						svctest.SetClusterIPs("10.0.0.1"),
  3715  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3716  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3717  					expectError: true,
  3718  				}, {
  3719  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v4v6",
  3720  					line: line(),
  3721  					svc: svctest.MakeService("foo",
  3722  						svctest.SetClusterIPs("10.0.0.1"),
  3723  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3724  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3725  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3726  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3727  				}, {
  3728  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v6v4",
  3729  					line: line(),
  3730  					svc: svctest.MakeService("foo",
  3731  						svctest.SetClusterIPs("10.0.0.1"),
  3732  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3733  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3734  					expectError: true,
  3735  				}, {
  3736  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:unset",
  3737  					line: line(),
  3738  					svc: svctest.MakeService("foo",
  3739  						svctest.SetClusterIPs("10.0.0.1"),
  3740  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  3741  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3742  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3743  				}, {
  3744  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v4",
  3745  					line: line(),
  3746  					svc: svctest.MakeService("foo",
  3747  						svctest.SetClusterIPs("10.0.0.1"),
  3748  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3749  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3750  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3751  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3752  				}, {
  3753  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v6",
  3754  					line: line(),
  3755  					svc: svctest.MakeService("foo",
  3756  						svctest.SetClusterIPs("10.0.0.1"),
  3757  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3758  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3759  					expectError: true,
  3760  				}, {
  3761  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v4v6",
  3762  					line: line(),
  3763  					svc: svctest.MakeService("foo",
  3764  						svctest.SetClusterIPs("10.0.0.1"),
  3765  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3766  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3767  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3768  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  3769  				}, {
  3770  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v6v4",
  3771  					line: line(),
  3772  					svc: svctest.MakeService("foo",
  3773  						svctest.SetClusterIPs("10.0.0.1"),
  3774  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3775  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3776  					expectError: true,
  3777  				},
  3778  				//----------------------------------------
  3779  				// dualstack:v4v6 ClusterIPs:v6
  3780  				//----------------------------------------
  3781  				{
  3782  					name: "ClusterIPs:v6_Policy:unset_Families:unset",
  3783  					line: line(),
  3784  					svc: svctest.MakeService("foo",
  3785  						svctest.SetClusterIPs("2000::1")),
  3786  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3787  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3788  				}, {
  3789  					name: "ClusterIPs:v6_Policy:unset_Families:v4",
  3790  					line: line(),
  3791  					svc: svctest.MakeService("foo",
  3792  						svctest.SetClusterIPs("2000::1"),
  3793  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3794  					expectError: true,
  3795  				}, {
  3796  					name: "ClusterIPs:v6_Policy:unset_Families:v6",
  3797  					line: line(),
  3798  					svc: svctest.MakeService("foo",
  3799  						svctest.SetClusterIPs("2000::1"),
  3800  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3801  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3802  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3803  				}, {
  3804  					name: "ClusterIPs:v6_Policy:unset_Families:v4v6",
  3805  					line: line(),
  3806  					svc: svctest.MakeService("foo",
  3807  						svctest.SetClusterIPs("2000::1"),
  3808  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3809  					expectError: true,
  3810  				}, {
  3811  					name: "ClusterIPs:v6_Policy:unset_Families:v6v4",
  3812  					line: line(),
  3813  					svc: svctest.MakeService("foo",
  3814  						svctest.SetClusterIPs("2000::1"),
  3815  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3816  					expectError: true,
  3817  				}, {
  3818  					name: "ClusterIPs:v6_Policy:SingleStack_Families:unset",
  3819  					line: line(),
  3820  					svc: svctest.MakeService("foo",
  3821  						svctest.SetClusterIPs("2000::1"),
  3822  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  3823  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3824  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3825  				}, {
  3826  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v4",
  3827  					line: line(),
  3828  					svc: svctest.MakeService("foo",
  3829  						svctest.SetClusterIPs("2000::1"),
  3830  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3831  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3832  					expectError: true,
  3833  				}, {
  3834  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v6",
  3835  					line: line(),
  3836  					svc: svctest.MakeService("foo",
  3837  						svctest.SetClusterIPs("2000::1"),
  3838  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3839  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3840  					expectPolicy:   api.IPFamilyPolicySingleStack,
  3841  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  3842  				}, {
  3843  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v4v6",
  3844  					line: line(),
  3845  					svc: svctest.MakeService("foo",
  3846  						svctest.SetClusterIPs("2000::1"),
  3847  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3848  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3849  					expectError: true,
  3850  				}, {
  3851  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v6v4",
  3852  					line: line(),
  3853  					svc: svctest.MakeService("foo",
  3854  						svctest.SetClusterIPs("2000::1"),
  3855  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3856  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3857  					expectError: true,
  3858  				}, {
  3859  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:unset",
  3860  					line: line(),
  3861  					svc: svctest.MakeService("foo",
  3862  						svctest.SetClusterIPs("2000::1"),
  3863  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  3864  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3865  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3866  				}, {
  3867  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v4",
  3868  					line: line(),
  3869  					svc: svctest.MakeService("foo",
  3870  						svctest.SetClusterIPs("2000::1"),
  3871  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3872  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3873  					expectError: true,
  3874  				}, {
  3875  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v6",
  3876  					line: line(),
  3877  					svc: svctest.MakeService("foo",
  3878  						svctest.SetClusterIPs("2000::1"),
  3879  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3880  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3881  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3882  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3883  				}, {
  3884  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v4v6",
  3885  					line: line(),
  3886  					svc: svctest.MakeService("foo",
  3887  						svctest.SetClusterIPs("2000::1"),
  3888  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3889  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3890  					expectError: true,
  3891  				}, {
  3892  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v6v4",
  3893  					line: line(),
  3894  					svc: svctest.MakeService("foo",
  3895  						svctest.SetClusterIPs("2000::1"),
  3896  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  3897  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3898  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  3899  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3900  				}, {
  3901  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:unset",
  3902  					line: line(),
  3903  					svc: svctest.MakeService("foo",
  3904  						svctest.SetClusterIPs("2000::1"),
  3905  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  3906  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3907  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3908  				}, {
  3909  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v4",
  3910  					line: line(),
  3911  					svc: svctest.MakeService("foo",
  3912  						svctest.SetClusterIPs("2000::1"),
  3913  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3914  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3915  					expectError: true,
  3916  				}, {
  3917  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v6",
  3918  					line: line(),
  3919  					svc: svctest.MakeService("foo",
  3920  						svctest.SetClusterIPs("2000::1"),
  3921  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3922  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3923  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3924  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3925  				}, {
  3926  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v4v6",
  3927  					line: line(),
  3928  					svc: svctest.MakeService("foo",
  3929  						svctest.SetClusterIPs("2000::1"),
  3930  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3931  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3932  					expectError: true,
  3933  				}, {
  3934  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v6v4",
  3935  					line: line(),
  3936  					svc: svctest.MakeService("foo",
  3937  						svctest.SetClusterIPs("2000::1"),
  3938  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  3939  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3940  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  3941  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  3942  				},
  3943  				//----------------------------------------
  3944  				// dualstack:v4v6 ClusterIPs:v4v6
  3945  				//----------------------------------------
  3946  				{
  3947  					name: "ClusterIPs:v4v6_Policy:unset_Families:unset",
  3948  					line: line(),
  3949  					svc: svctest.MakeService("foo",
  3950  						svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  3951  					expectError: true,
  3952  				}, {
  3953  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4",
  3954  					line: line(),
  3955  					svc: svctest.MakeService("foo",
  3956  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  3957  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3958  					expectError: true,
  3959  				}, {
  3960  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6",
  3961  					line: line(),
  3962  					svc: svctest.MakeService("foo",
  3963  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  3964  						svctest.SetIPFamilies(api.IPv6Protocol)),
  3965  					expectError: true,
  3966  				}, {
  3967  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4v6",
  3968  					line: line(),
  3969  					svc: svctest.MakeService("foo",
  3970  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  3971  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  3972  					expectError: true,
  3973  				}, {
  3974  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6v4",
  3975  					line: line(),
  3976  					svc: svctest.MakeService("foo",
  3977  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  3978  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  3979  					expectError: true,
  3980  				}, {
  3981  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:unset",
  3982  					line: line(),
  3983  					svc: svctest.MakeService("foo",
  3984  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  3985  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  3986  					expectError: true,
  3987  				}, {
  3988  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4",
  3989  					line: line(),
  3990  					svc: svctest.MakeService("foo",
  3991  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  3992  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  3993  						svctest.SetIPFamilies(api.IPv4Protocol)),
  3994  					expectError: true,
  3995  				}, {
  3996  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6",
  3997  					line: line(),
  3998  					svc: svctest.MakeService("foo",
  3999  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4000  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4001  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4002  					expectError: true,
  4003  				}, {
  4004  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4v6",
  4005  					line: line(),
  4006  					svc: svctest.MakeService("foo",
  4007  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4008  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4009  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4010  					expectError: true,
  4011  				}, {
  4012  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6v4",
  4013  					line: line(),
  4014  					svc: svctest.MakeService("foo",
  4015  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4016  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4017  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4018  					expectError: true,
  4019  				}, {
  4020  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:unset",
  4021  					line: line(),
  4022  					svc: svctest.MakeService("foo",
  4023  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4024  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  4025  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4026  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4027  				}, {
  4028  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4",
  4029  					line: line(),
  4030  					svc: svctest.MakeService("foo",
  4031  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4032  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4033  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4034  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4035  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4036  				}, {
  4037  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6",
  4038  					line: line(),
  4039  					svc: svctest.MakeService("foo",
  4040  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4041  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4042  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4043  					expectError: true,
  4044  				}, {
  4045  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4v6",
  4046  					line: line(),
  4047  					svc: svctest.MakeService("foo",
  4048  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4049  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4050  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4051  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4052  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4053  				}, {
  4054  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6v4",
  4055  					line: line(),
  4056  					svc: svctest.MakeService("foo",
  4057  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4058  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4059  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4060  					expectError: true,
  4061  				}, {
  4062  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:unset",
  4063  					line: line(),
  4064  					svc: svctest.MakeService("foo",
  4065  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4066  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  4067  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4068  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4069  				}, {
  4070  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4",
  4071  					line: line(),
  4072  					svc: svctest.MakeService("foo",
  4073  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4074  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4075  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4076  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4077  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4078  				}, {
  4079  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6",
  4080  					line: line(),
  4081  					svc: svctest.MakeService("foo",
  4082  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4083  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4084  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4085  					expectError: true,
  4086  				}, {
  4087  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4v6",
  4088  					line: line(),
  4089  					svc: svctest.MakeService("foo",
  4090  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4091  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4092  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4093  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4094  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4095  				}, {
  4096  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6v4",
  4097  					line: line(),
  4098  					svc: svctest.MakeService("foo",
  4099  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  4100  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4101  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4102  					expectError: true,
  4103  				},
  4104  				//----------------------------------------
  4105  				// dualstack:v4v6 ClusterIPs:v6v4
  4106  				//----------------------------------------
  4107  				{
  4108  					name: "ClusterIPs:v6v4_Policy:unset_Families:unset",
  4109  					line: line(),
  4110  					svc: svctest.MakeService("foo",
  4111  						svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  4112  					expectError: true,
  4113  				}, {
  4114  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4",
  4115  					line: line(),
  4116  					svc: svctest.MakeService("foo",
  4117  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4118  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4119  					expectError: true,
  4120  				}, {
  4121  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6",
  4122  					line: line(),
  4123  					svc: svctest.MakeService("foo",
  4124  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4125  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4126  					expectError: true,
  4127  				}, {
  4128  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4v6",
  4129  					line: line(),
  4130  					svc: svctest.MakeService("foo",
  4131  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4132  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4133  					expectError: true,
  4134  				}, {
  4135  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6v4",
  4136  					line: line(),
  4137  					svc: svctest.MakeService("foo",
  4138  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4139  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4140  					expectError: true,
  4141  				}, {
  4142  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:unset",
  4143  					line: line(),
  4144  					svc: svctest.MakeService("foo",
  4145  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4146  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  4147  					expectError: true,
  4148  				}, {
  4149  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4",
  4150  					line: line(),
  4151  					svc: svctest.MakeService("foo",
  4152  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4153  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4154  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4155  					expectError: true,
  4156  				}, {
  4157  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6",
  4158  					line: line(),
  4159  					svc: svctest.MakeService("foo",
  4160  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4161  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4162  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4163  					expectError: true,
  4164  				}, {
  4165  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4v6",
  4166  					line: line(),
  4167  					svc: svctest.MakeService("foo",
  4168  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4169  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4170  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4171  					expectError: true,
  4172  				}, {
  4173  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6v4",
  4174  					line: line(),
  4175  					svc: svctest.MakeService("foo",
  4176  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4177  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4178  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4179  					expectError: true,
  4180  				}, {
  4181  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:unset",
  4182  					line: line(),
  4183  					svc: svctest.MakeService("foo",
  4184  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4185  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  4186  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4187  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4188  				}, {
  4189  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4",
  4190  					line: line(),
  4191  					svc: svctest.MakeService("foo",
  4192  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4193  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4194  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4195  					expectError: true,
  4196  				}, {
  4197  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6",
  4198  					line: line(),
  4199  					svc: svctest.MakeService("foo",
  4200  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4201  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4202  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4203  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4204  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4205  				}, {
  4206  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4v6",
  4207  					line: line(),
  4208  					svc: svctest.MakeService("foo",
  4209  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4210  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4211  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4212  					expectError: true,
  4213  				}, {
  4214  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6v4",
  4215  					line: line(),
  4216  					svc: svctest.MakeService("foo",
  4217  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4218  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4219  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4220  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4221  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4222  				}, {
  4223  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:unset",
  4224  					line: line(),
  4225  					svc: svctest.MakeService("foo",
  4226  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4227  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  4228  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4229  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4230  				}, {
  4231  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4",
  4232  					line: line(),
  4233  					svc: svctest.MakeService("foo",
  4234  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4235  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4236  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4237  					expectError: true,
  4238  				}, {
  4239  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6",
  4240  					line: line(),
  4241  					svc: svctest.MakeService("foo",
  4242  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4243  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4244  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4245  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4246  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4247  				}, {
  4248  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4v6",
  4249  					line: line(),
  4250  					svc: svctest.MakeService("foo",
  4251  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4252  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4253  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4254  					expectError: true,
  4255  				}, {
  4256  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6v4",
  4257  					line: line(),
  4258  					svc: svctest.MakeService("foo",
  4259  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  4260  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4261  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4262  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4263  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4264  				},
  4265  				//----------------------------------------
  4266  				// dualstack:v4v6 Headless
  4267  				//----------------------------------------
  4268  				{
  4269  					name: "Headless_Policy:unset_Families:unset",
  4270  					line: line(),
  4271  					svc: svctest.MakeService("foo",
  4272  						svctest.SetHeadless),
  4273  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4274  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4275  					expectHeadless: true,
  4276  				}, {
  4277  					name: "Headless_Policy:unset_Families:v4",
  4278  					line: line(),
  4279  					svc: svctest.MakeService("foo",
  4280  						svctest.SetHeadless,
  4281  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4282  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4283  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4284  					expectHeadless: true,
  4285  				}, {
  4286  					name: "Headless_Policy:unset_Families:v6",
  4287  					line: line(),
  4288  					svc: svctest.MakeService("foo",
  4289  						svctest.SetHeadless,
  4290  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4291  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4292  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4293  					expectHeadless: true,
  4294  				}, {
  4295  					name: "Headless_Policy:unset_Families:v4v6",
  4296  					line: line(),
  4297  					svc: svctest.MakeService("foo",
  4298  						svctest.SetHeadless,
  4299  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4300  					expectError: true,
  4301  				}, {
  4302  					name: "Headless_Policy:unset_Families:v6v4",
  4303  					line: line(),
  4304  					svc: svctest.MakeService("foo",
  4305  						svctest.SetHeadless,
  4306  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4307  					expectError: true,
  4308  				}, {
  4309  					name: "Headless_Policy:SingleStack_Families:unset",
  4310  					line: line(),
  4311  					svc: svctest.MakeService("foo",
  4312  						svctest.SetHeadless,
  4313  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  4314  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4315  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4316  					expectHeadless: true,
  4317  				}, {
  4318  					name: "Headless_Policy:SingleStack_Families:v4",
  4319  					line: line(),
  4320  					svc: svctest.MakeService("foo",
  4321  						svctest.SetHeadless,
  4322  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4323  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4324  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4325  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4326  					expectHeadless: true,
  4327  				}, {
  4328  					name: "Headless_Policy:SingleStack_Families:v6",
  4329  					line: line(),
  4330  					svc: svctest.MakeService("foo",
  4331  						svctest.SetHeadless,
  4332  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4333  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4334  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4335  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4336  					expectHeadless: true,
  4337  				}, {
  4338  					name: "Headless_Policy:SingleStack_Families:v4v6",
  4339  					line: line(),
  4340  					svc: svctest.MakeService("foo",
  4341  						svctest.SetHeadless,
  4342  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4343  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4344  					expectError: true,
  4345  				}, {
  4346  					name: "Headless_Policy:SingleStack_Families:v6v4",
  4347  					line: line(),
  4348  					svc: svctest.MakeService("foo",
  4349  						svctest.SetHeadless,
  4350  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4351  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4352  					expectError: true,
  4353  				}, {
  4354  					name: "Headless_Policy:PreferDualStack_Families:unset",
  4355  					line: line(),
  4356  					svc: svctest.MakeService("foo",
  4357  						svctest.SetHeadless,
  4358  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  4359  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4360  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4361  					expectHeadless: true,
  4362  				}, {
  4363  					name: "Headless_Policy:PreferDualStack_Families:v4",
  4364  					line: line(),
  4365  					svc: svctest.MakeService("foo",
  4366  						svctest.SetHeadless,
  4367  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4368  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4369  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4370  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4371  					expectHeadless: true,
  4372  				}, {
  4373  					name: "Headless_Policy:PreferDualStack_Families:v6",
  4374  					line: line(),
  4375  					svc: svctest.MakeService("foo",
  4376  						svctest.SetHeadless,
  4377  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4378  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4379  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4380  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4381  					expectHeadless: true,
  4382  				}, {
  4383  					name: "Headless_Policy:PreferDualStack_Families:v4v6",
  4384  					line: line(),
  4385  					svc: svctest.MakeService("foo",
  4386  						svctest.SetHeadless,
  4387  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4388  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4389  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4390  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4391  					expectHeadless: true,
  4392  				}, {
  4393  					name: "Headless_Policy:PreferDualStack_Families:v6v4",
  4394  					line: line(),
  4395  					svc: svctest.MakeService("foo",
  4396  						svctest.SetHeadless,
  4397  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4398  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4399  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4400  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4401  					expectHeadless: true,
  4402  				}, {
  4403  					name: "Headless_Policy:RequireDualStack_Families:unset",
  4404  					line: line(),
  4405  					svc: svctest.MakeService("foo",
  4406  						svctest.SetHeadless,
  4407  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  4408  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4409  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4410  					expectHeadless: true,
  4411  				}, {
  4412  					name: "Headless_Policy:RequireDualStack_Families:v4",
  4413  					line: line(),
  4414  					svc: svctest.MakeService("foo",
  4415  						svctest.SetHeadless,
  4416  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4417  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4418  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4419  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4420  					expectHeadless: true,
  4421  				}, {
  4422  					name: "Headless_Policy:RequireDualStack_Families:v6",
  4423  					line: line(),
  4424  					svc: svctest.MakeService("foo",
  4425  						svctest.SetHeadless,
  4426  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4427  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4428  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4429  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4430  					expectHeadless: true,
  4431  				}, {
  4432  					name: "Headless_Policy:RequireDualStack_Families:v4v6",
  4433  					line: line(),
  4434  					svc: svctest.MakeService("foo",
  4435  						svctest.SetHeadless,
  4436  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4437  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4438  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4439  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4440  					expectHeadless: true,
  4441  				}, {
  4442  					name: "Headless_Policy:RequireDualStack_Families:v6v4",
  4443  					line: line(),
  4444  					svc: svctest.MakeService("foo",
  4445  						svctest.SetHeadless,
  4446  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4447  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4448  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4449  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4450  					expectHeadless: true,
  4451  				},
  4452  				//----------------------------------------
  4453  				// dualstack:v4v6 HeadlessSelectorless
  4454  				//----------------------------------------
  4455  				{
  4456  					name: "HeadlessSelectorless_Policy:unset_Families:unset",
  4457  					line: line(),
  4458  					svc: svctest.MakeService("foo",
  4459  						svctest.SetHeadless,
  4460  						svctest.SetSelector(nil)),
  4461  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4462  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4463  					expectHeadless: true,
  4464  				}, {
  4465  					name: "HeadlessSelectorless_Policy:unset_Families:v4",
  4466  					line: line(),
  4467  					svc: svctest.MakeService("foo",
  4468  						svctest.SetHeadless,
  4469  						svctest.SetSelector(nil),
  4470  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4471  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4472  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4473  					expectHeadless: true,
  4474  				}, {
  4475  					name: "HeadlessSelectorless_Policy:unset_Families:v6",
  4476  					line: line(),
  4477  					svc: svctest.MakeService("foo",
  4478  						svctest.SetHeadless,
  4479  						svctest.SetSelector(nil),
  4480  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4481  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4482  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4483  					expectHeadless: true,
  4484  				}, {
  4485  					name: "HeadlessSelectorless_Policy:unset_Families:v4v6",
  4486  					line: line(),
  4487  					svc: svctest.MakeService("foo",
  4488  						svctest.SetHeadless,
  4489  						svctest.SetSelector(nil),
  4490  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4491  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4492  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4493  					expectHeadless: true,
  4494  				}, {
  4495  					name: "HeadlessSelectorless_Policy:unset_Families:v6v4",
  4496  					line: line(),
  4497  					svc: svctest.MakeService("foo",
  4498  						svctest.SetHeadless,
  4499  						svctest.SetSelector(nil),
  4500  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4501  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4502  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4503  					expectHeadless: true,
  4504  				}, {
  4505  					name: "HeadlessSelectorless_Policy:SingleStack_Families:unset",
  4506  					line: line(),
  4507  					svc: svctest.MakeService("foo",
  4508  						svctest.SetHeadless,
  4509  						svctest.SetSelector(nil),
  4510  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  4511  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4512  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4513  					expectHeadless: true,
  4514  				}, {
  4515  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4",
  4516  					line: line(),
  4517  					svc: svctest.MakeService("foo",
  4518  						svctest.SetHeadless,
  4519  						svctest.SetSelector(nil),
  4520  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4521  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4522  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4523  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4524  					expectHeadless: true,
  4525  				}, {
  4526  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6",
  4527  					line: line(),
  4528  					svc: svctest.MakeService("foo",
  4529  						svctest.SetHeadless,
  4530  						svctest.SetSelector(nil),
  4531  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4532  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4533  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4534  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4535  					expectHeadless: true,
  4536  				}, {
  4537  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4v6",
  4538  					line: line(),
  4539  					svc: svctest.MakeService("foo",
  4540  						svctest.SetHeadless,
  4541  						svctest.SetSelector(nil),
  4542  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4543  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4544  					expectError: true,
  4545  				}, {
  4546  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6v4",
  4547  					line: line(),
  4548  					svc: svctest.MakeService("foo",
  4549  						svctest.SetHeadless,
  4550  						svctest.SetSelector(nil),
  4551  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4552  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4553  					expectError: true,
  4554  				}, {
  4555  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:unset",
  4556  					line: line(),
  4557  					svc: svctest.MakeService("foo",
  4558  						svctest.SetHeadless,
  4559  						svctest.SetSelector(nil),
  4560  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  4561  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4562  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4563  					expectHeadless: true,
  4564  				}, {
  4565  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4",
  4566  					line: line(),
  4567  					svc: svctest.MakeService("foo",
  4568  						svctest.SetHeadless,
  4569  						svctest.SetSelector(nil),
  4570  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4571  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4572  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4573  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4574  					expectHeadless: true,
  4575  				}, {
  4576  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6",
  4577  					line: line(),
  4578  					svc: svctest.MakeService("foo",
  4579  						svctest.SetHeadless,
  4580  						svctest.SetSelector(nil),
  4581  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4582  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4583  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4584  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4585  					expectHeadless: true,
  4586  				}, {
  4587  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4v6",
  4588  					line: line(),
  4589  					svc: svctest.MakeService("foo",
  4590  						svctest.SetHeadless,
  4591  						svctest.SetSelector(nil),
  4592  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4593  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4594  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4595  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4596  					expectHeadless: true,
  4597  				}, {
  4598  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6v4",
  4599  					line: line(),
  4600  					svc: svctest.MakeService("foo",
  4601  						svctest.SetHeadless,
  4602  						svctest.SetSelector(nil),
  4603  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4604  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4605  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4606  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4607  					expectHeadless: true,
  4608  				}, {
  4609  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:unset",
  4610  					line: line(),
  4611  					svc: svctest.MakeService("foo",
  4612  						svctest.SetHeadless,
  4613  						svctest.SetSelector(nil),
  4614  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  4615  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4616  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4617  					expectHeadless: true,
  4618  				}, {
  4619  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4",
  4620  					line: line(),
  4621  					svc: svctest.MakeService("foo",
  4622  						svctest.SetHeadless,
  4623  						svctest.SetSelector(nil),
  4624  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4625  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4626  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4627  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4628  					expectHeadless: true,
  4629  				}, {
  4630  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6",
  4631  					line: line(),
  4632  					svc: svctest.MakeService("foo",
  4633  						svctest.SetHeadless,
  4634  						svctest.SetSelector(nil),
  4635  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4636  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4637  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4638  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4639  					expectHeadless: true,
  4640  				}, {
  4641  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4v6",
  4642  					line: line(),
  4643  					svc: svctest.MakeService("foo",
  4644  						svctest.SetHeadless,
  4645  						svctest.SetSelector(nil),
  4646  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4647  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4648  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4649  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4650  					expectHeadless: true,
  4651  				}, {
  4652  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6v4",
  4653  					line: line(),
  4654  					svc: svctest.MakeService("foo",
  4655  						svctest.SetHeadless,
  4656  						svctest.SetSelector(nil),
  4657  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4658  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4659  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4660  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4661  					expectHeadless: true,
  4662  				},
  4663  			},
  4664  		}, {
  4665  			name:            "dualstack:v6v4",
  4666  			clusterFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4667  			cases: []testCase{
  4668  				//----------------------------------------
  4669  				// dualstack:v6v4 ClusterIPs:unset
  4670  				//----------------------------------------
  4671  				{
  4672  					name:           "ClusterIPs:unset_Policy:unset_Families:unset",
  4673  					line:           line(),
  4674  					svc:            svctest.MakeService("foo"),
  4675  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4676  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4677  				}, {
  4678  					name: "ClusterIPs:unset_Policy:unset_Families:v4",
  4679  					line: line(),
  4680  					svc: svctest.MakeService("foo",
  4681  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4682  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4683  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4684  				}, {
  4685  					name: "ClusterIPs:unset_Policy:unset_Families:v6",
  4686  					line: line(),
  4687  					svc: svctest.MakeService("foo",
  4688  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4689  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4690  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4691  				}, {
  4692  					name: "ClusterIPs:unset_Policy:unset_Families:v4v6",
  4693  					line: line(),
  4694  					svc: svctest.MakeService("foo",
  4695  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4696  					expectError: true,
  4697  				}, {
  4698  					name: "ClusterIPs:unset_Policy:unset_Families:v6v4",
  4699  					line: line(),
  4700  					svc: svctest.MakeService("foo",
  4701  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4702  					expectError: true,
  4703  				}, {
  4704  					name: "ClusterIPs:unset_Policy:SingleStack_Families:unset",
  4705  					line: line(),
  4706  					svc: svctest.MakeService("foo",
  4707  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  4708  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4709  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4710  				}, {
  4711  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4",
  4712  					line: line(),
  4713  					svc: svctest.MakeService("foo",
  4714  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4715  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4716  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4717  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4718  				}, {
  4719  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6",
  4720  					line: line(),
  4721  					svc: svctest.MakeService("foo",
  4722  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4723  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4724  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4725  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4726  				}, {
  4727  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v4v6",
  4728  					line: line(),
  4729  					svc: svctest.MakeService("foo",
  4730  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4731  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4732  					expectError: true,
  4733  				}, {
  4734  					name: "ClusterIPs:unset_Policy:SingleStack_Families:v6v4",
  4735  					line: line(),
  4736  					svc: svctest.MakeService("foo",
  4737  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4738  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4739  					expectError: true,
  4740  				}, {
  4741  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:unset",
  4742  					line: line(),
  4743  					svc: svctest.MakeService("foo",
  4744  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  4745  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4746  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4747  				}, {
  4748  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4",
  4749  					line: line(),
  4750  					svc: svctest.MakeService("foo",
  4751  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4752  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4753  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4754  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4755  				}, {
  4756  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6",
  4757  					line: line(),
  4758  					svc: svctest.MakeService("foo",
  4759  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4760  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4761  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4762  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4763  				}, {
  4764  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v4v6",
  4765  					line: line(),
  4766  					svc: svctest.MakeService("foo",
  4767  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4768  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4769  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4770  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4771  				}, {
  4772  					name: "ClusterIPs:unset_Policy:PreferDualStack_Families:v6v4",
  4773  					line: line(),
  4774  					svc: svctest.MakeService("foo",
  4775  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4776  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4777  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4778  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4779  				}, {
  4780  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:unset",
  4781  					line: line(),
  4782  					svc: svctest.MakeService("foo",
  4783  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  4784  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4785  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4786  				}, {
  4787  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4",
  4788  					line: line(),
  4789  					svc: svctest.MakeService("foo",
  4790  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4791  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4792  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4793  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4794  				}, {
  4795  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6",
  4796  					line: line(),
  4797  					svc: svctest.MakeService("foo",
  4798  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4799  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4800  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4801  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4802  				}, {
  4803  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v4v6",
  4804  					line: line(),
  4805  					svc: svctest.MakeService("foo",
  4806  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4807  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4808  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4809  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4810  				}, {
  4811  					name: "ClusterIPs:unset_Policy:RequireDualStack_Families:v6v4",
  4812  					line: line(),
  4813  					svc: svctest.MakeService("foo",
  4814  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4815  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4816  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4817  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  4818  				},
  4819  				//----------------------------------------
  4820  				// dualstack:v6v4 ClusterIPs:v4
  4821  				//----------------------------------------
  4822  				{
  4823  					name: "ClusterIPs:v4_Policy:unset_Families:unset",
  4824  					line: line(),
  4825  					svc: svctest.MakeService("foo",
  4826  						svctest.SetClusterIPs("10.0.0.1")),
  4827  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4828  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4829  				}, {
  4830  					name: "ClusterIPs:v4_Policy:unset_Families:v4",
  4831  					line: line(),
  4832  					svc: svctest.MakeService("foo",
  4833  						svctest.SetClusterIPs("10.0.0.1"),
  4834  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4835  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4836  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4837  				}, {
  4838  					name: "ClusterIPs:v4_Policy:unset_Families:v6",
  4839  					line: line(),
  4840  					svc: svctest.MakeService("foo",
  4841  						svctest.SetClusterIPs("10.0.0.1"),
  4842  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4843  					expectError: true,
  4844  				}, {
  4845  					name: "ClusterIPs:v4_Policy:unset_Families:v4v6",
  4846  					line: line(),
  4847  					svc: svctest.MakeService("foo",
  4848  						svctest.SetClusterIPs("10.0.0.1"),
  4849  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4850  					expectError: true,
  4851  				}, {
  4852  					name: "ClusterIPs:v4_Policy:unset_Families:v6v4",
  4853  					line: line(),
  4854  					svc: svctest.MakeService("foo",
  4855  						svctest.SetClusterIPs("10.0.0.1"),
  4856  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4857  					expectError: true,
  4858  				}, {
  4859  					name: "ClusterIPs:v4_Policy:SingleStack_Families:unset",
  4860  					line: line(),
  4861  					svc: svctest.MakeService("foo",
  4862  						svctest.SetClusterIPs("10.0.0.1"),
  4863  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  4864  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4865  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4866  				}, {
  4867  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v4",
  4868  					line: line(),
  4869  					svc: svctest.MakeService("foo",
  4870  						svctest.SetClusterIPs("10.0.0.1"),
  4871  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4872  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4873  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4874  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  4875  				}, {
  4876  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v6",
  4877  					line: line(),
  4878  					svc: svctest.MakeService("foo",
  4879  						svctest.SetClusterIPs("10.0.0.1"),
  4880  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4881  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4882  					expectError: true,
  4883  				}, {
  4884  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v4v6",
  4885  					line: line(),
  4886  					svc: svctest.MakeService("foo",
  4887  						svctest.SetClusterIPs("10.0.0.1"),
  4888  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4889  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4890  					expectError: true,
  4891  				}, {
  4892  					name: "ClusterIPs:v4_Policy:SingleStack_Families:v6v4",
  4893  					line: line(),
  4894  					svc: svctest.MakeService("foo",
  4895  						svctest.SetClusterIPs("10.0.0.1"),
  4896  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  4897  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4898  					expectError: true,
  4899  				}, {
  4900  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:unset",
  4901  					line: line(),
  4902  					svc: svctest.MakeService("foo",
  4903  						svctest.SetClusterIPs("10.0.0.1"),
  4904  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  4905  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4906  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4907  				}, {
  4908  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v4",
  4909  					line: line(),
  4910  					svc: svctest.MakeService("foo",
  4911  						svctest.SetClusterIPs("10.0.0.1"),
  4912  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4913  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4914  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4915  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4916  				}, {
  4917  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v6",
  4918  					line: line(),
  4919  					svc: svctest.MakeService("foo",
  4920  						svctest.SetClusterIPs("10.0.0.1"),
  4921  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4922  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4923  					expectError: true,
  4924  				}, {
  4925  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v4v6",
  4926  					line: line(),
  4927  					svc: svctest.MakeService("foo",
  4928  						svctest.SetClusterIPs("10.0.0.1"),
  4929  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4930  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4931  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  4932  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4933  				}, {
  4934  					name: "ClusterIPs:v4_Policy:PreferDualStack_Families:v6v4",
  4935  					line: line(),
  4936  					svc: svctest.MakeService("foo",
  4937  						svctest.SetClusterIPs("10.0.0.1"),
  4938  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  4939  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4940  					expectError: true,
  4941  				}, {
  4942  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:unset",
  4943  					line: line(),
  4944  					svc: svctest.MakeService("foo",
  4945  						svctest.SetClusterIPs("10.0.0.1"),
  4946  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  4947  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4948  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4949  				}, {
  4950  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v4",
  4951  					line: line(),
  4952  					svc: svctest.MakeService("foo",
  4953  						svctest.SetClusterIPs("10.0.0.1"),
  4954  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4955  						svctest.SetIPFamilies(api.IPv4Protocol)),
  4956  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4957  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4958  				}, {
  4959  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v6",
  4960  					line: line(),
  4961  					svc: svctest.MakeService("foo",
  4962  						svctest.SetClusterIPs("10.0.0.1"),
  4963  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4964  						svctest.SetIPFamilies(api.IPv6Protocol)),
  4965  					expectError: true,
  4966  				}, {
  4967  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v4v6",
  4968  					line: line(),
  4969  					svc: svctest.MakeService("foo",
  4970  						svctest.SetClusterIPs("10.0.0.1"),
  4971  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4972  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  4973  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  4974  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  4975  				}, {
  4976  					name: "ClusterIPs:v4_Policy:RequireDualStack_Families:v6v4",
  4977  					line: line(),
  4978  					svc: svctest.MakeService("foo",
  4979  						svctest.SetClusterIPs("10.0.0.1"),
  4980  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  4981  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  4982  					expectError: true,
  4983  				},
  4984  				//----------------------------------------
  4985  				// dualstack:v6v4 ClusterIPs:v6
  4986  				//----------------------------------------
  4987  				{
  4988  					name: "ClusterIPs:v6_Policy:unset_Families:unset",
  4989  					line: line(),
  4990  					svc: svctest.MakeService("foo",
  4991  						svctest.SetClusterIPs("2000::1")),
  4992  					expectPolicy:   api.IPFamilyPolicySingleStack,
  4993  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  4994  				}, {
  4995  					name: "ClusterIPs:v6_Policy:unset_Families:v4",
  4996  					line: line(),
  4997  					svc: svctest.MakeService("foo",
  4998  						svctest.SetClusterIPs("2000::1"),
  4999  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5000  					expectError: true,
  5001  				}, {
  5002  					name: "ClusterIPs:v6_Policy:unset_Families:v6",
  5003  					line: line(),
  5004  					svc: svctest.MakeService("foo",
  5005  						svctest.SetClusterIPs("2000::1"),
  5006  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5007  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5008  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5009  				}, {
  5010  					name: "ClusterIPs:v6_Policy:unset_Families:v4v6",
  5011  					line: line(),
  5012  					svc: svctest.MakeService("foo",
  5013  						svctest.SetClusterIPs("2000::1"),
  5014  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5015  					expectError: true,
  5016  				}, {
  5017  					name: "ClusterIPs:v6_Policy:unset_Families:v6v4",
  5018  					line: line(),
  5019  					svc: svctest.MakeService("foo",
  5020  						svctest.SetClusterIPs("2000::1"),
  5021  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5022  					expectError: true,
  5023  				}, {
  5024  					name: "ClusterIPs:v6_Policy:SingleStack_Families:unset",
  5025  					line: line(),
  5026  					svc: svctest.MakeService("foo",
  5027  						svctest.SetClusterIPs("2000::1"),
  5028  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  5029  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5030  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5031  				}, {
  5032  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v4",
  5033  					line: line(),
  5034  					svc: svctest.MakeService("foo",
  5035  						svctest.SetClusterIPs("2000::1"),
  5036  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5037  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5038  					expectError: true,
  5039  				}, {
  5040  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v6",
  5041  					line: line(),
  5042  					svc: svctest.MakeService("foo",
  5043  						svctest.SetClusterIPs("2000::1"),
  5044  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5045  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5046  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5047  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5048  				}, {
  5049  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v4v6",
  5050  					line: line(),
  5051  					svc: svctest.MakeService("foo",
  5052  						svctest.SetClusterIPs("2000::1"),
  5053  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5054  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5055  					expectError: true,
  5056  				}, {
  5057  					name: "ClusterIPs:v6_Policy:SingleStack_Families:v6v4",
  5058  					line: line(),
  5059  					svc: svctest.MakeService("foo",
  5060  						svctest.SetClusterIPs("2000::1"),
  5061  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5062  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5063  					expectError: true,
  5064  				}, {
  5065  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:unset",
  5066  					line: line(),
  5067  					svc: svctest.MakeService("foo",
  5068  						svctest.SetClusterIPs("2000::1"),
  5069  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  5070  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5071  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5072  				}, {
  5073  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v4",
  5074  					line: line(),
  5075  					svc: svctest.MakeService("foo",
  5076  						svctest.SetClusterIPs("2000::1"),
  5077  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5078  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5079  					expectError: true,
  5080  				}, {
  5081  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v6",
  5082  					line: line(),
  5083  					svc: svctest.MakeService("foo",
  5084  						svctest.SetClusterIPs("2000::1"),
  5085  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5086  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5087  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5088  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5089  				}, {
  5090  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v4v6",
  5091  					line: line(),
  5092  					svc: svctest.MakeService("foo",
  5093  						svctest.SetClusterIPs("2000::1"),
  5094  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5095  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5096  					expectError: true,
  5097  				}, {
  5098  					name: "ClusterIPs:v6_Policy:PreferDualStack_Families:v6v4",
  5099  					line: line(),
  5100  					svc: svctest.MakeService("foo",
  5101  						svctest.SetClusterIPs("2000::1"),
  5102  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5103  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5104  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5105  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5106  				}, {
  5107  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:unset",
  5108  					line: line(),
  5109  					svc: svctest.MakeService("foo",
  5110  						svctest.SetClusterIPs("2000::1"),
  5111  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  5112  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5113  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5114  				}, {
  5115  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v4",
  5116  					line: line(),
  5117  					svc: svctest.MakeService("foo",
  5118  						svctest.SetClusterIPs("2000::1"),
  5119  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5120  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5121  					expectError: true,
  5122  				}, {
  5123  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v6",
  5124  					line: line(),
  5125  					svc: svctest.MakeService("foo",
  5126  						svctest.SetClusterIPs("2000::1"),
  5127  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5128  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5129  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5130  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5131  				}, {
  5132  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v4v6",
  5133  					line: line(),
  5134  					svc: svctest.MakeService("foo",
  5135  						svctest.SetClusterIPs("2000::1"),
  5136  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5137  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5138  					expectError: true,
  5139  				}, {
  5140  					name: "ClusterIPs:v6_Policy:RequireDualStack_Families:v6v4",
  5141  					line: line(),
  5142  					svc: svctest.MakeService("foo",
  5143  						svctest.SetClusterIPs("2000::1"),
  5144  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5145  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5146  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5147  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5148  				},
  5149  				//----------------------------------------
  5150  				// dualstack:v6v4 ClusterIPs:v4v6
  5151  				//----------------------------------------
  5152  				{
  5153  					name: "ClusterIPs:v4v6_Policy:unset_Families:unset",
  5154  					line: line(),
  5155  					svc: svctest.MakeService("foo",
  5156  						svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  5157  					expectError: true,
  5158  				}, {
  5159  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4",
  5160  					line: line(),
  5161  					svc: svctest.MakeService("foo",
  5162  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5163  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5164  					expectError: true,
  5165  				}, {
  5166  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6",
  5167  					line: line(),
  5168  					svc: svctest.MakeService("foo",
  5169  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5170  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5171  					expectError: true,
  5172  				}, {
  5173  					name: "ClusterIPs:v4v6_Policy:unset_Families:v4v6",
  5174  					line: line(),
  5175  					svc: svctest.MakeService("foo",
  5176  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5177  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5178  					expectError: true,
  5179  				}, {
  5180  					name: "ClusterIPs:v4v6_Policy:unset_Families:v6v4",
  5181  					line: line(),
  5182  					svc: svctest.MakeService("foo",
  5183  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5184  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5185  					expectError: true,
  5186  				}, {
  5187  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:unset",
  5188  					line: line(),
  5189  					svc: svctest.MakeService("foo",
  5190  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5191  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  5192  					expectError: true,
  5193  				}, {
  5194  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4",
  5195  					line: line(),
  5196  					svc: svctest.MakeService("foo",
  5197  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5198  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5199  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5200  					expectError: true,
  5201  				}, {
  5202  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6",
  5203  					line: line(),
  5204  					svc: svctest.MakeService("foo",
  5205  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5206  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5207  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5208  					expectError: true,
  5209  				}, {
  5210  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v4v6",
  5211  					line: line(),
  5212  					svc: svctest.MakeService("foo",
  5213  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5214  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5215  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5216  					expectError: true,
  5217  				}, {
  5218  					name: "ClusterIPs:v4v6_Policy:SingleStack_Families:v6v4",
  5219  					line: line(),
  5220  					svc: svctest.MakeService("foo",
  5221  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5222  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5223  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5224  					expectError: true,
  5225  				}, {
  5226  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:unset",
  5227  					line: line(),
  5228  					svc: svctest.MakeService("foo",
  5229  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5230  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  5231  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5232  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5233  				}, {
  5234  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4",
  5235  					line: line(),
  5236  					svc: svctest.MakeService("foo",
  5237  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5238  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5239  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5240  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5241  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5242  				}, {
  5243  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6",
  5244  					line: line(),
  5245  					svc: svctest.MakeService("foo",
  5246  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5247  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5248  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5249  					expectError: true,
  5250  				}, {
  5251  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v4v6",
  5252  					line: line(),
  5253  					svc: svctest.MakeService("foo",
  5254  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5255  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5256  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5257  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5258  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5259  				}, {
  5260  					name: "ClusterIPs:v4v6_Policy:PreferDualStack_Families:v6v4",
  5261  					line: line(),
  5262  					svc: svctest.MakeService("foo",
  5263  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5264  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5265  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5266  					expectError: true,
  5267  				}, {
  5268  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:unset",
  5269  					line: line(),
  5270  					svc: svctest.MakeService("foo",
  5271  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5272  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  5273  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5274  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5275  				}, {
  5276  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4",
  5277  					line: line(),
  5278  					svc: svctest.MakeService("foo",
  5279  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5280  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5281  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5282  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5283  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5284  				}, {
  5285  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6",
  5286  					line: line(),
  5287  					svc: svctest.MakeService("foo",
  5288  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5289  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5290  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5291  					expectError: true,
  5292  				}, {
  5293  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v4v6",
  5294  					line: line(),
  5295  					svc: svctest.MakeService("foo",
  5296  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5297  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5298  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5299  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5300  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5301  				}, {
  5302  					name: "ClusterIPs:v4v6_Policy:RequireDualStack_Families:v6v4",
  5303  					line: line(),
  5304  					svc: svctest.MakeService("foo",
  5305  						svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  5306  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5307  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5308  					expectError: true,
  5309  				},
  5310  				//----------------------------------------
  5311  				// dualstack:v6v4 ClusterIPs:v6v4
  5312  				//----------------------------------------
  5313  				{
  5314  					name: "ClusterIPs:v6v4_Policy:unset_Families:unset",
  5315  					line: line(),
  5316  					svc: svctest.MakeService("foo",
  5317  						svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  5318  					expectError: true,
  5319  				}, {
  5320  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4",
  5321  					line: line(),
  5322  					svc: svctest.MakeService("foo",
  5323  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5324  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5325  					expectError: true,
  5326  				}, {
  5327  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6",
  5328  					line: line(),
  5329  					svc: svctest.MakeService("foo",
  5330  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5331  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5332  					expectError: true,
  5333  				}, {
  5334  					name: "ClusterIPs:v6v4_Policy:unset_Families:v4v6",
  5335  					line: line(),
  5336  					svc: svctest.MakeService("foo",
  5337  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5338  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5339  					expectError: true,
  5340  				}, {
  5341  					name: "ClusterIPs:v6v4_Policy:unset_Families:v6v4",
  5342  					line: line(),
  5343  					svc: svctest.MakeService("foo",
  5344  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5345  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5346  					expectError: true,
  5347  				}, {
  5348  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:unset",
  5349  					line: line(),
  5350  					svc: svctest.MakeService("foo",
  5351  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5352  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  5353  					expectError: true,
  5354  				}, {
  5355  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4",
  5356  					line: line(),
  5357  					svc: svctest.MakeService("foo",
  5358  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5359  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5360  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5361  					expectError: true,
  5362  				}, {
  5363  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6",
  5364  					line: line(),
  5365  					svc: svctest.MakeService("foo",
  5366  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5367  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5368  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5369  					expectError: true,
  5370  				}, {
  5371  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v4v6",
  5372  					line: line(),
  5373  					svc: svctest.MakeService("foo",
  5374  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5375  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5376  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5377  					expectError: true,
  5378  				}, {
  5379  					name: "ClusterIPs:v6v4_Policy:SingleStack_Families:v6v4",
  5380  					line: line(),
  5381  					svc: svctest.MakeService("foo",
  5382  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5383  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5384  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5385  					expectError: true,
  5386  				}, {
  5387  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:unset",
  5388  					line: line(),
  5389  					svc: svctest.MakeService("foo",
  5390  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5391  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  5392  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5393  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5394  				}, {
  5395  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4",
  5396  					line: line(),
  5397  					svc: svctest.MakeService("foo",
  5398  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5399  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5400  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5401  					expectError: true,
  5402  				}, {
  5403  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6",
  5404  					line: line(),
  5405  					svc: svctest.MakeService("foo",
  5406  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5407  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5408  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5409  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5410  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5411  				}, {
  5412  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v4v6",
  5413  					line: line(),
  5414  					svc: svctest.MakeService("foo",
  5415  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5416  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5417  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5418  					expectError: true,
  5419  				}, {
  5420  					name: "ClusterIPs:v6v4_Policy:PreferDualStack_Families:v6v4",
  5421  					line: line(),
  5422  					svc: svctest.MakeService("foo",
  5423  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5424  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5425  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5426  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5427  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5428  				}, {
  5429  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:unset",
  5430  					line: line(),
  5431  					svc: svctest.MakeService("foo",
  5432  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5433  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  5434  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5435  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5436  				}, {
  5437  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4",
  5438  					line: line(),
  5439  					svc: svctest.MakeService("foo",
  5440  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5441  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5442  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5443  					expectError: true,
  5444  				}, {
  5445  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6",
  5446  					line: line(),
  5447  					svc: svctest.MakeService("foo",
  5448  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5449  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5450  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5451  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5452  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5453  				}, {
  5454  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v4v6",
  5455  					line: line(),
  5456  					svc: svctest.MakeService("foo",
  5457  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5458  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5459  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5460  					expectError: true,
  5461  				}, {
  5462  					name: "ClusterIPs:v6v4_Policy:RequireDualStack_Families:v6v4",
  5463  					line: line(),
  5464  					svc: svctest.MakeService("foo",
  5465  						svctest.SetClusterIPs("2000::1", "10.0.0.1"),
  5466  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5467  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5468  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5469  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5470  				},
  5471  				//----------------------------------------
  5472  				// dualstack:v6v4 Headless
  5473  				//----------------------------------------
  5474  				{
  5475  					name: "Headless_Policy:unset_Families:unset",
  5476  					line: line(),
  5477  					svc: svctest.MakeService("foo",
  5478  						svctest.SetHeadless),
  5479  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5480  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5481  					expectHeadless: true,
  5482  				}, {
  5483  					name: "Headless_Policy:unset_Families:v4",
  5484  					line: line(),
  5485  					svc: svctest.MakeService("foo",
  5486  						svctest.SetHeadless,
  5487  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5488  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5489  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  5490  					expectHeadless: true,
  5491  				}, {
  5492  					name: "Headless_Policy:unset_Families:v6",
  5493  					line: line(),
  5494  					svc: svctest.MakeService("foo",
  5495  						svctest.SetHeadless,
  5496  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5497  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5498  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5499  					expectHeadless: true,
  5500  				}, {
  5501  					name: "Headless_Policy:unset_Families:v4v6",
  5502  					line: line(),
  5503  					svc: svctest.MakeService("foo",
  5504  						svctest.SetHeadless,
  5505  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5506  					expectError: true,
  5507  				}, {
  5508  					name: "Headless_Policy:unset_Families:v6v4",
  5509  					line: line(),
  5510  					svc: svctest.MakeService("foo",
  5511  						svctest.SetHeadless,
  5512  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5513  					expectError: true,
  5514  				}, {
  5515  					name: "Headless_Policy:SingleStack_Families:unset",
  5516  					line: line(),
  5517  					svc: svctest.MakeService("foo",
  5518  						svctest.SetHeadless,
  5519  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  5520  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5521  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5522  					expectHeadless: true,
  5523  				}, {
  5524  					name: "Headless_Policy:SingleStack_Families:v4",
  5525  					line: line(),
  5526  					svc: svctest.MakeService("foo",
  5527  						svctest.SetHeadless,
  5528  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5529  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5530  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5531  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  5532  					expectHeadless: true,
  5533  				}, {
  5534  					name: "Headless_Policy:SingleStack_Families:v6",
  5535  					line: line(),
  5536  					svc: svctest.MakeService("foo",
  5537  						svctest.SetHeadless,
  5538  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5539  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5540  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5541  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5542  					expectHeadless: true,
  5543  				}, {
  5544  					name: "Headless_Policy:SingleStack_Families:v4v6",
  5545  					line: line(),
  5546  					svc: svctest.MakeService("foo",
  5547  						svctest.SetHeadless,
  5548  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5549  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5550  					expectError: true,
  5551  				}, {
  5552  					name: "Headless_Policy:SingleStack_Families:v6v4",
  5553  					line: line(),
  5554  					svc: svctest.MakeService("foo",
  5555  						svctest.SetHeadless,
  5556  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5557  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5558  					expectError: true,
  5559  				}, {
  5560  					name: "Headless_Policy:PreferDualStack_Families:unset",
  5561  					line: line(),
  5562  					svc: svctest.MakeService("foo",
  5563  						svctest.SetHeadless,
  5564  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  5565  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5566  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5567  					expectHeadless: true,
  5568  				}, {
  5569  					name: "Headless_Policy:PreferDualStack_Families:v4",
  5570  					line: line(),
  5571  					svc: svctest.MakeService("foo",
  5572  						svctest.SetHeadless,
  5573  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5574  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5575  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5576  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5577  					expectHeadless: true,
  5578  				}, {
  5579  					name: "Headless_Policy:PreferDualStack_Families:v6",
  5580  					line: line(),
  5581  					svc: svctest.MakeService("foo",
  5582  						svctest.SetHeadless,
  5583  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5584  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5585  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5586  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5587  					expectHeadless: true,
  5588  				}, {
  5589  					name: "Headless_Policy:PreferDualStack_Families:v4v6",
  5590  					line: line(),
  5591  					svc: svctest.MakeService("foo",
  5592  						svctest.SetHeadless,
  5593  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5594  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5595  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5596  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5597  					expectHeadless: true,
  5598  				}, {
  5599  					name: "Headless_Policy:PreferDualStack_Families:v6v4",
  5600  					line: line(),
  5601  					svc: svctest.MakeService("foo",
  5602  						svctest.SetHeadless,
  5603  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5604  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5605  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5606  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5607  					expectHeadless: true,
  5608  				}, {
  5609  					name: "Headless_Policy:RequireDualStack_Families:unset",
  5610  					line: line(),
  5611  					svc: svctest.MakeService("foo",
  5612  						svctest.SetHeadless,
  5613  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  5614  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5615  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5616  					expectHeadless: true,
  5617  				}, {
  5618  					name: "Headless_Policy:RequireDualStack_Families:v4",
  5619  					line: line(),
  5620  					svc: svctest.MakeService("foo",
  5621  						svctest.SetHeadless,
  5622  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5623  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5624  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5625  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5626  					expectHeadless: true,
  5627  				}, {
  5628  					name: "Headless_Policy:RequireDualStack_Families:v6",
  5629  					line: line(),
  5630  					svc: svctest.MakeService("foo",
  5631  						svctest.SetHeadless,
  5632  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5633  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5634  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5635  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5636  					expectHeadless: true,
  5637  				}, {
  5638  					name: "Headless_Policy:RequireDualStack_Families:v4v6",
  5639  					line: line(),
  5640  					svc: svctest.MakeService("foo",
  5641  						svctest.SetHeadless,
  5642  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5643  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5644  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5645  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5646  					expectHeadless: true,
  5647  				}, {
  5648  					name: "Headless_Policy:RequireDualStack_Families:v6v4",
  5649  					line: line(),
  5650  					svc: svctest.MakeService("foo",
  5651  						svctest.SetHeadless,
  5652  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5653  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5654  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5655  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5656  					expectHeadless: true,
  5657  				},
  5658  				//----------------------------------------
  5659  				// dualstack:v6v4 HeadlessSelectorless
  5660  				//----------------------------------------
  5661  				{
  5662  					name: "HeadlessSelectorless_Policy:unset_Families:unset",
  5663  					line: line(),
  5664  					svc: svctest.MakeService("foo",
  5665  						svctest.SetHeadless,
  5666  						svctest.SetSelector(nil)),
  5667  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5668  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5669  					expectHeadless: true,
  5670  				}, {
  5671  					name: "HeadlessSelectorless_Policy:unset_Families:v4",
  5672  					line: line(),
  5673  					svc: svctest.MakeService("foo",
  5674  						svctest.SetHeadless,
  5675  						svctest.SetSelector(nil),
  5676  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5677  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5678  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5679  					expectHeadless: true,
  5680  				}, {
  5681  					name: "HeadlessSelectorless_Policy:unset_Families:v6",
  5682  					line: line(),
  5683  					svc: svctest.MakeService("foo",
  5684  						svctest.SetHeadless,
  5685  						svctest.SetSelector(nil),
  5686  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5687  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5688  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5689  					expectHeadless: true,
  5690  				}, {
  5691  					name: "HeadlessSelectorless_Policy:unset_Families:v4v6",
  5692  					line: line(),
  5693  					svc: svctest.MakeService("foo",
  5694  						svctest.SetHeadless,
  5695  						svctest.SetSelector(nil),
  5696  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5697  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5698  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5699  					expectHeadless: true,
  5700  				}, {
  5701  					name: "HeadlessSelectorless_Policy:unset_Families:v6v4",
  5702  					line: line(),
  5703  					svc: svctest.MakeService("foo",
  5704  						svctest.SetHeadless,
  5705  						svctest.SetSelector(nil),
  5706  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5707  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5708  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5709  					expectHeadless: true,
  5710  				}, {
  5711  					name: "HeadlessSelectorless_Policy:SingleStack_Families:unset",
  5712  					line: line(),
  5713  					svc: svctest.MakeService("foo",
  5714  						svctest.SetHeadless,
  5715  						svctest.SetSelector(nil),
  5716  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  5717  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5718  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5719  					expectHeadless: true,
  5720  				}, {
  5721  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4",
  5722  					line: line(),
  5723  					svc: svctest.MakeService("foo",
  5724  						svctest.SetHeadless,
  5725  						svctest.SetSelector(nil),
  5726  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5727  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5728  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5729  					expectFamilies: []api.IPFamily{api.IPv4Protocol},
  5730  					expectHeadless: true,
  5731  				}, {
  5732  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6",
  5733  					line: line(),
  5734  					svc: svctest.MakeService("foo",
  5735  						svctest.SetHeadless,
  5736  						svctest.SetSelector(nil),
  5737  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5738  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5739  					expectPolicy:   api.IPFamilyPolicySingleStack,
  5740  					expectFamilies: []api.IPFamily{api.IPv6Protocol},
  5741  					expectHeadless: true,
  5742  				}, {
  5743  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v4v6",
  5744  					line: line(),
  5745  					svc: svctest.MakeService("foo",
  5746  						svctest.SetHeadless,
  5747  						svctest.SetSelector(nil),
  5748  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5749  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5750  					expectError: true,
  5751  				}, {
  5752  					name: "HeadlessSelectorless_Policy:SingleStack_Families:v6v4",
  5753  					line: line(),
  5754  					svc: svctest.MakeService("foo",
  5755  						svctest.SetHeadless,
  5756  						svctest.SetSelector(nil),
  5757  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  5758  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5759  					expectError: true,
  5760  				}, {
  5761  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:unset",
  5762  					line: line(),
  5763  					svc: svctest.MakeService("foo",
  5764  						svctest.SetHeadless,
  5765  						svctest.SetSelector(nil),
  5766  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  5767  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5768  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5769  					expectHeadless: true,
  5770  				}, {
  5771  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4",
  5772  					line: line(),
  5773  					svc: svctest.MakeService("foo",
  5774  						svctest.SetHeadless,
  5775  						svctest.SetSelector(nil),
  5776  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5777  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5778  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5779  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5780  					expectHeadless: true,
  5781  				}, {
  5782  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6",
  5783  					line: line(),
  5784  					svc: svctest.MakeService("foo",
  5785  						svctest.SetHeadless,
  5786  						svctest.SetSelector(nil),
  5787  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5788  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5789  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5790  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5791  					expectHeadless: true,
  5792  				}, {
  5793  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v4v6",
  5794  					line: line(),
  5795  					svc: svctest.MakeService("foo",
  5796  						svctest.SetHeadless,
  5797  						svctest.SetSelector(nil),
  5798  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5799  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5800  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5801  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5802  					expectHeadless: true,
  5803  				}, {
  5804  					name: "HeadlessSelectorless_Policy:PreferDualStack_Families:v6v4",
  5805  					line: line(),
  5806  					svc: svctest.MakeService("foo",
  5807  						svctest.SetHeadless,
  5808  						svctest.SetSelector(nil),
  5809  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  5810  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5811  					expectPolicy:   api.IPFamilyPolicyPreferDualStack,
  5812  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5813  					expectHeadless: true,
  5814  				}, {
  5815  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:unset",
  5816  					line: line(),
  5817  					svc: svctest.MakeService("foo",
  5818  						svctest.SetHeadless,
  5819  						svctest.SetSelector(nil),
  5820  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  5821  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5822  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5823  					expectHeadless: true,
  5824  				}, {
  5825  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4",
  5826  					line: line(),
  5827  					svc: svctest.MakeService("foo",
  5828  						svctest.SetHeadless,
  5829  						svctest.SetSelector(nil),
  5830  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5831  						svctest.SetIPFamilies(api.IPv4Protocol)),
  5832  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5833  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5834  					expectHeadless: true,
  5835  				}, {
  5836  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6",
  5837  					line: line(),
  5838  					svc: svctest.MakeService("foo",
  5839  						svctest.SetHeadless,
  5840  						svctest.SetSelector(nil),
  5841  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5842  						svctest.SetIPFamilies(api.IPv6Protocol)),
  5843  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5844  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5845  					expectHeadless: true,
  5846  				}, {
  5847  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v4v6",
  5848  					line: line(),
  5849  					svc: svctest.MakeService("foo",
  5850  						svctest.SetHeadless,
  5851  						svctest.SetSelector(nil),
  5852  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5853  						svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5854  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5855  					expectFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5856  					expectHeadless: true,
  5857  				}, {
  5858  					name: "HeadlessSelectorless_Policy:RequireDualStack_Families:v6v4",
  5859  					line: line(),
  5860  					svc: svctest.MakeService("foo",
  5861  						svctest.SetHeadless,
  5862  						svctest.SetSelector(nil),
  5863  						svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  5864  						svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  5865  					expectPolicy:   api.IPFamilyPolicyRequireDualStack,
  5866  					expectFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  5867  					expectHeadless: true,
  5868  				},
  5869  			},
  5870  		},
  5871  	}
  5872  
  5873  	for _, otc := range testCases {
  5874  		t.Run(otc.name, func(t *testing.T) {
  5875  
  5876  			// Do this in the outer loop for performance.
  5877  			storage, _, server := newStorage(t, otc.clusterFamilies)
  5878  			defer server.Terminate(t)
  5879  			defer storage.Store.DestroyFunc()
  5880  
  5881  			for _, itc := range otc.cases {
  5882  				t.Run(itc.name+"__@L"+itc.line, func(t *testing.T) {
  5883  					ctx := genericapirequest.NewDefaultContext()
  5884  					createdObj, err := storage.Create(ctx, itc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  5885  					if itc.expectError && err != nil {
  5886  						return
  5887  					}
  5888  					if err != nil {
  5889  						t.Fatalf("unexpected error creating service: %v", err)
  5890  					}
  5891  					defer storage.Delete(ctx, itc.svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{})
  5892  					if itc.expectError && err == nil {
  5893  						t.Fatalf("unexpected success creating service")
  5894  					}
  5895  					createdSvc := createdObj.(*api.Service)
  5896  
  5897  					if want, got := fmtIPFamilyPolicy(&itc.expectPolicy), fmtIPFamilyPolicy(createdSvc.Spec.IPFamilyPolicy); want != got {
  5898  						t.Errorf("wrong IPFamilyPolicy: want %s, got %s", want, got)
  5899  					}
  5900  					if want, got := fmtIPFamilies(itc.expectFamilies), fmtIPFamilies(createdSvc.Spec.IPFamilies); want != got {
  5901  						t.Errorf("wrong IPFamilies: want %s, got %s", want, got)
  5902  					}
  5903  					if itc.expectHeadless {
  5904  						proveHeadless(t, storage, nil, createdSvc)
  5905  						return
  5906  					}
  5907  					proveClusterIPsAllocated(t, storage, nil, createdSvc)
  5908  				})
  5909  			}
  5910  		})
  5911  	}
  5912  }
  5913  
  5914  // There are enough corner-cases that it's useful to have a test that asserts
  5915  // the errors.  Some of these are in other tests, but this is clearer.
  5916  func TestCreateInvalidClusterIPInputs(t *testing.T) {
  5917  	testCases := []struct {
  5918  		name     string
  5919  		families []api.IPFamily
  5920  		svc      *api.Service
  5921  		expect   []string
  5922  	}{{
  5923  		name:     "bad_ipFamilyPolicy",
  5924  		families: []api.IPFamily{api.IPv4Protocol},
  5925  		svc: svctest.MakeService("foo",
  5926  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicy("garbage"))),
  5927  		expect: []string{"Unsupported value"},
  5928  	}, {
  5929  		name:     "requiredual_ipFamilyPolicy_on_singlestack",
  5930  		families: []api.IPFamily{api.IPv4Protocol},
  5931  		svc: svctest.MakeService("foo",
  5932  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  5933  		expect: []string{"cluster is not configured for dual-stack"},
  5934  	}, {
  5935  		name:     "bad_ipFamilies_0_value",
  5936  		families: []api.IPFamily{api.IPv4Protocol},
  5937  		svc: svctest.MakeService("foo",
  5938  			svctest.SetIPFamilies(api.IPFamily("garbage"))),
  5939  		expect: []string{"Unsupported value"},
  5940  	}, {
  5941  		name:     "bad_ipFamilies_1_value",
  5942  		families: []api.IPFamily{api.IPv4Protocol},
  5943  		svc: svctest.MakeService("foo",
  5944  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPFamily("garbage"))),
  5945  		expect: []string{"Unsupported value"},
  5946  	}, {
  5947  		name:     "bad_ipFamilies_2_value",
  5948  		families: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5949  		svc: svctest.MakeService("foo",
  5950  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol, api.IPFamily("garbage"))),
  5951  		expect: []string{"Unsupported value"},
  5952  	}, {
  5953  		name:     "wrong_ipFamily",
  5954  		families: []api.IPFamily{api.IPv4Protocol},
  5955  		svc: svctest.MakeService("foo",
  5956  			svctest.SetIPFamilies(api.IPv6Protocol)),
  5957  		expect: []string{"not configured on this cluster"},
  5958  	}, {
  5959  		name:     "too_many_ipFamilies_on_singlestack",
  5960  		families: []api.IPFamily{api.IPv4Protocol},
  5961  		svc: svctest.MakeService("foo",
  5962  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  5963  		expect: []string{"when multiple IP families are specified"},
  5964  	}, {
  5965  		name:     "dup_ipFamily_singlestack",
  5966  		families: []api.IPFamily{api.IPv4Protocol},
  5967  		svc: svctest.MakeService("foo",
  5968  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPv4Protocol)),
  5969  		expect: []string{"Duplicate value"},
  5970  	}, {
  5971  		name:     "dup_ipFamily_dualstack",
  5972  		families: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  5973  		svc: svctest.MakeService("foo",
  5974  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol, api.IPv6Protocol)),
  5975  		expect: []string{"Duplicate value"},
  5976  	}, {
  5977  		name:     "bad_IP",
  5978  		families: []api.IPFamily{api.IPv4Protocol},
  5979  		svc: svctest.MakeService("foo",
  5980  			svctest.SetClusterIPs("garbage")),
  5981  		expect: []string{"must be a valid IP"},
  5982  	}, {
  5983  		name:     "IP_wrong_family",
  5984  		families: []api.IPFamily{api.IPv4Protocol},
  5985  		svc: svctest.MakeService("foo",
  5986  			svctest.SetClusterIPs("2000::1")),
  5987  		expect: []string{"not configured on this cluster"},
  5988  	}, {
  5989  		name:     "IP_doesnt_match_family",
  5990  		families: []api.IPFamily{api.IPv4Protocol},
  5991  		svc: svctest.MakeService("foo",
  5992  			svctest.SetIPFamilies(api.IPv4Protocol),
  5993  			svctest.SetClusterIPs("2000::1")),
  5994  		expect: []string{"expected an IPv4 value as indicated"},
  5995  	}, {
  5996  		name:     "too_many_IPs_singlestack",
  5997  		families: []api.IPFamily{api.IPv4Protocol},
  5998  		svc: svctest.MakeService("foo",
  5999  			svctest.SetClusterIPs("10.0.0.1", "10.0.0.2")),
  6000  		expect: []string{"no more than one IP for each IP family"},
  6001  	}, {
  6002  		name:     "too_many_IPs_dualstack",
  6003  		families: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  6004  		svc: svctest.MakeService("foo",
  6005  			svctest.SetClusterIPs("10.0.0.1", "2000::1", "10.0.0.2")),
  6006  		expect: []string{"only hold up to 2 values"},
  6007  	}, {
  6008  		name:     "dup_IPs",
  6009  		families: []api.IPFamily{api.IPv4Protocol},
  6010  		svc: svctest.MakeService("foo",
  6011  			svctest.SetClusterIPs("10.0.0.1", "10.0.0.1")),
  6012  		expect: []string{"no more than one IP for each IP family"},
  6013  	}, {
  6014  		name:     "empty_IP",
  6015  		families: []api.IPFamily{api.IPv4Protocol},
  6016  		svc: svctest.MakeService("foo",
  6017  			svctest.SetClusterIPs("")),
  6018  		expect: []string{"must be empty when", "must be a valid IP"},
  6019  	}, {
  6020  		name:     "None_IP_1",
  6021  		families: []api.IPFamily{api.IPv4Protocol},
  6022  		svc: svctest.MakeService("foo",
  6023  			svctest.SetClusterIPs("10.0.0.1", "None")),
  6024  		expect: []string{"must be a valid IP"},
  6025  	}}
  6026  
  6027  	for _, tc := range testCases {
  6028  		t.Run(tc.name, func(t *testing.T) {
  6029  			storage, _, server := newStorage(t, tc.families)
  6030  			defer server.Terminate(t)
  6031  			defer storage.Store.DestroyFunc()
  6032  
  6033  			ctx := genericapirequest.NewDefaultContext()
  6034  			_, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6035  			if err == nil {
  6036  				t.Fatalf("unexpected success creating service")
  6037  			}
  6038  			for _, s := range tc.expect {
  6039  				if !strings.Contains(err.Error(), s) {
  6040  					t.Errorf("expected to find %q in the error:\n  %s", s, err.Error())
  6041  				}
  6042  			}
  6043  		})
  6044  	}
  6045  }
  6046  
  6047  func TestCreateDeleteReuse(t *testing.T) {
  6048  	testCases := []struct {
  6049  		name string
  6050  		svc  *api.Service
  6051  	}{{
  6052  		name: "v4",
  6053  		svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
  6054  			svctest.SetIPFamilies(api.IPv4Protocol)),
  6055  	}, {
  6056  		name: "v6",
  6057  		svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
  6058  			svctest.SetIPFamilies(api.IPv6Protocol)),
  6059  	}, {
  6060  		name: "v4v6",
  6061  		svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
  6062  			svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  6063  			svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  6064  	}}
  6065  
  6066  	for _, tc := range testCases {
  6067  		t.Run(tc.name, func(t *testing.T) {
  6068  			storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
  6069  			defer server.Terminate(t)
  6070  			defer storage.Store.DestroyFunc()
  6071  
  6072  			ctx := genericapirequest.NewDefaultContext()
  6073  
  6074  			// Create it
  6075  			createdObj, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6076  			if err != nil {
  6077  				t.Fatalf("unexpected error creating service: %v", err)
  6078  			}
  6079  			createdSvc := createdObj.(*api.Service)
  6080  
  6081  			// Ensure IPs and ports were allocated
  6082  			proveClusterIPsAllocated(t, storage, tc.svc, createdSvc)
  6083  			proveNodePortsAllocated(t, storage, tc.svc, createdSvc)
  6084  
  6085  			// Delete it
  6086  			_, _, err = storage.Delete(ctx, tc.svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{})
  6087  			if err != nil {
  6088  				t.Fatalf("unexpected error creating service: %v", err)
  6089  			}
  6090  
  6091  			// Ensure IPs and ports were deallocated
  6092  			proveClusterIPsDeallocated(t, storage, createdSvc, nil)
  6093  			proveNodePortsDeallocated(t, storage, createdSvc, nil)
  6094  
  6095  			// Force the same IPs and ports
  6096  			svc2 := tc.svc.DeepCopy()
  6097  			svc2.Name += "2"
  6098  			svc2.Spec.ClusterIP = createdSvc.Spec.ClusterIP
  6099  			svc2.Spec.ClusterIPs = createdSvc.Spec.ClusterIPs
  6100  			svc2.Spec.Ports = createdSvc.Spec.Ports
  6101  
  6102  			// Create again
  6103  			_, err = storage.Create(ctx, svc2, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6104  			if err != nil {
  6105  				t.Fatalf("unexpected error creating service: %v", err)
  6106  			}
  6107  
  6108  			// Ensure IPs and ports were allocated
  6109  			proveClusterIPsAllocated(t, storage, svc2, createdSvc)
  6110  			proveNodePortsAllocated(t, storage, svc2, createdSvc)
  6111  		})
  6112  	}
  6113  }
  6114  
  6115  func TestCreateInitNodePorts(t *testing.T) {
  6116  	testCases := []struct {
  6117  		name            string
  6118  		svc             *api.Service
  6119  		expectError     bool
  6120  		expectNodePorts bool
  6121  	}{{
  6122  		name:            "type:ExternalName",
  6123  		svc:             svctest.MakeService("foo"),
  6124  		expectNodePorts: false,
  6125  	}, {
  6126  		name: "type:ExternalName_with_NodePorts",
  6127  		svc: svctest.MakeService("foo",
  6128  			svctest.SetUniqueNodePorts),
  6129  		expectError: true,
  6130  	}, {
  6131  		name:            "type:ClusterIP",
  6132  		svc:             svctest.MakeService("foo"),
  6133  		expectNodePorts: false,
  6134  	}, {
  6135  		name: "type:ClusterIP_with_NodePorts",
  6136  		svc: svctest.MakeService("foo",
  6137  			svctest.SetUniqueNodePorts),
  6138  		expectError: true,
  6139  	}, {
  6140  		name: "type:NodePort_single_port_unspecified",
  6141  		svc: svctest.MakeService("foo",
  6142  			svctest.SetTypeNodePort),
  6143  		expectNodePorts: true,
  6144  	}, {
  6145  		name: "type:NodePort_single_port_specified",
  6146  		svc: svctest.MakeService("foo",
  6147  			svctest.SetTypeNodePort, svctest.SetUniqueNodePorts),
  6148  		expectNodePorts: true,
  6149  	}, {
  6150  		name: "type:NodePort_multiport_unspecified",
  6151  		svc: svctest.MakeService("foo",
  6152  			svctest.SetTypeNodePort,
  6153  			svctest.SetPorts(
  6154  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6155  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
  6156  		expectNodePorts: true,
  6157  	}, {
  6158  		name: "type:NodePort_multiport_specified",
  6159  		svc: svctest.MakeService("foo",
  6160  			svctest.SetTypeNodePort,
  6161  			svctest.SetPorts(
  6162  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6163  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
  6164  			svctest.SetUniqueNodePorts),
  6165  		expectNodePorts: true,
  6166  	}, {
  6167  		name: "type:NodePort_multiport_same",
  6168  		svc: svctest.MakeService("foo",
  6169  			svctest.SetTypeNodePort,
  6170  			svctest.SetPorts(
  6171  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6172  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
  6173  			svctest.SetNodePorts(30080, 30080)),
  6174  		expectError: true,
  6175  	}, {
  6176  		name: "type:NodePort_multiport_multiproto_unspecified",
  6177  		svc: svctest.MakeService("foo",
  6178  			svctest.SetTypeNodePort,
  6179  			svctest.SetPorts(
  6180  				svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP),
  6181  				svctest.MakeServicePort("q", 53, intstr.FromInt32(53), api.ProtocolUDP))),
  6182  		expectNodePorts: true,
  6183  	}, {
  6184  		name: "type:NodePort_multiport_multiproto_specified",
  6185  		svc: svctest.MakeService("foo",
  6186  			svctest.SetTypeNodePort,
  6187  			svctest.SetPorts(
  6188  				svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP),
  6189  				svctest.MakeServicePort("q", 53, intstr.FromInt32(53), api.ProtocolUDP)),
  6190  			svctest.SetUniqueNodePorts),
  6191  		expectNodePorts: true,
  6192  	}, {
  6193  		name: "type:NodePort_multiport_multiproto_same",
  6194  		svc: svctest.MakeService("foo",
  6195  			svctest.SetTypeNodePort,
  6196  			svctest.SetPorts(
  6197  				svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP),
  6198  				svctest.MakeServicePort("q", 53, intstr.FromInt32(53), api.ProtocolUDP)),
  6199  			svctest.SetNodePorts(30053, 30053)),
  6200  		expectNodePorts: true,
  6201  	}, {
  6202  		name: "type:NodePort_multiport_multiproto_conflict",
  6203  		svc: svctest.MakeService("foo",
  6204  			svctest.SetTypeNodePort,
  6205  			svctest.SetPorts(
  6206  				svctest.MakeServicePort("p", 93, intstr.FromInt32(93), api.ProtocolTCP),
  6207  				svctest.MakeServicePort("q", 76, intstr.FromInt32(76), api.ProtocolUDP)),
  6208  			svctest.SetNodePorts(30093, 30093)),
  6209  		expectError: true,
  6210  	}, {
  6211  		name: "type:LoadBalancer_single_port_unspecified:on_alloc:false",
  6212  		svc: svctest.MakeService("foo",
  6213  			svctest.SetTypeLoadBalancer,
  6214  			svctest.SetAllocateLoadBalancerNodePorts(false)),
  6215  		expectNodePorts: false,
  6216  	}, {
  6217  		name: "type:LoadBalancer_single_port_unspecified:on_alloc:true",
  6218  		svc: svctest.MakeService("foo",
  6219  			svctest.SetTypeLoadBalancer,
  6220  			svctest.SetAllocateLoadBalancerNodePorts(true)),
  6221  		expectNodePorts: true,
  6222  	}, {
  6223  		name: "type:LoadBalancer_single_port_specified:on_alloc:false",
  6224  		svc: svctest.MakeService("foo",
  6225  			svctest.SetTypeLoadBalancer,
  6226  			svctest.SetUniqueNodePorts,
  6227  			svctest.SetAllocateLoadBalancerNodePorts(false)),
  6228  		expectNodePorts: true,
  6229  	}, {
  6230  		name: "type:LoadBalancer_single_port_specified:on_alloc:true",
  6231  		svc: svctest.MakeService("foo",
  6232  			svctest.SetTypeLoadBalancer,
  6233  			svctest.SetUniqueNodePorts,
  6234  			svctest.SetAllocateLoadBalancerNodePorts(true)),
  6235  		expectNodePorts: true,
  6236  	}, {
  6237  		name: "type:LoadBalancer_multiport_unspecified:on_alloc:false",
  6238  		svc: svctest.MakeService("foo",
  6239  			svctest.SetTypeLoadBalancer,
  6240  			svctest.SetPorts(
  6241  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6242  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
  6243  			svctest.SetAllocateLoadBalancerNodePorts(false)),
  6244  		expectNodePorts: false,
  6245  	}, {
  6246  		name: "type:LoadBalancer_multiport_unspecified:on_alloc:true",
  6247  		svc: svctest.MakeService("foo",
  6248  			svctest.SetTypeLoadBalancer,
  6249  			svctest.SetPorts(
  6250  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6251  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
  6252  			svctest.SetAllocateLoadBalancerNodePorts(true)),
  6253  		expectNodePorts: true,
  6254  	}, {
  6255  		name: "type:LoadBalancer_multiport_specified:on_alloc:false",
  6256  		svc: svctest.MakeService("foo",
  6257  			svctest.SetTypeLoadBalancer,
  6258  			svctest.SetPorts(
  6259  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6260  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
  6261  			svctest.SetUniqueNodePorts,
  6262  			svctest.SetAllocateLoadBalancerNodePorts(false)),
  6263  		expectNodePorts: true,
  6264  	}, {
  6265  		name: "type:LoadBalancer_multiport_specified:on_alloc:true",
  6266  		svc: svctest.MakeService("foo",
  6267  			svctest.SetTypeLoadBalancer,
  6268  			svctest.SetPorts(
  6269  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6270  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
  6271  			svctest.SetUniqueNodePorts,
  6272  			svctest.SetAllocateLoadBalancerNodePorts(true)),
  6273  		expectNodePorts: true,
  6274  	}, {
  6275  		name: "type:LoadBalancer_multiport_same",
  6276  		svc: svctest.MakeService("foo",
  6277  			svctest.SetTypeLoadBalancer,
  6278  			svctest.SetPorts(
  6279  				svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
  6280  				svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP)),
  6281  			svctest.SetNodePorts(30080, 30080)),
  6282  		expectError: true,
  6283  	}, {
  6284  		name: "type:LoadBalancer_multiport_multiproto_unspecified",
  6285  		svc: svctest.MakeService("foo",
  6286  			svctest.SetTypeLoadBalancer,
  6287  			svctest.SetPorts(
  6288  				svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP),
  6289  				svctest.MakeServicePort("q", 53, intstr.FromInt32(53), api.ProtocolUDP))),
  6290  		expectNodePorts: true,
  6291  	}, {
  6292  		name: "type:LoadBalancer_multiport_multiproto_specified",
  6293  		svc: svctest.MakeService("foo",
  6294  			svctest.SetTypeLoadBalancer,
  6295  			svctest.SetPorts(
  6296  				svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP),
  6297  				svctest.MakeServicePort("q", 53, intstr.FromInt32(53), api.ProtocolUDP)),
  6298  			svctest.SetUniqueNodePorts),
  6299  		expectNodePorts: true,
  6300  	}, {
  6301  		name: "type:LoadBalancer_multiport_multiproto_same",
  6302  		svc: svctest.MakeService("foo",
  6303  			svctest.SetTypeLoadBalancer,
  6304  			svctest.SetPorts(
  6305  				svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP),
  6306  				svctest.MakeServicePort("q", 53, intstr.FromInt32(53), api.ProtocolUDP)),
  6307  			svctest.SetNodePorts(30053, 30053)),
  6308  		expectNodePorts: true,
  6309  	}, {
  6310  		name: "type:LoadBalancer_multiport_multiproto_conflict",
  6311  		svc: svctest.MakeService("foo",
  6312  			svctest.SetTypeLoadBalancer,
  6313  			svctest.SetPorts(
  6314  				svctest.MakeServicePort("p", 93, intstr.FromInt32(93), api.ProtocolTCP),
  6315  				svctest.MakeServicePort("q", 76, intstr.FromInt32(76), api.ProtocolUDP)),
  6316  			svctest.SetNodePorts(30093, 30093)),
  6317  		expectError: true,
  6318  	}}
  6319  
  6320  	// Do this in the outer scope for performance.
  6321  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
  6322  	defer server.Terminate(t)
  6323  	defer storage.Store.DestroyFunc()
  6324  
  6325  	for _, tc := range testCases {
  6326  		t.Run(tc.name, func(t *testing.T) {
  6327  			ctx := genericapirequest.NewDefaultContext()
  6328  			createdObj, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6329  			if tc.expectError && err != nil {
  6330  				return
  6331  			}
  6332  			if err != nil {
  6333  				t.Fatalf("unexpected error creating service: %v", err)
  6334  			}
  6335  			defer storage.Delete(ctx, tc.svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{})
  6336  			if tc.expectError && err == nil {
  6337  				t.Fatalf("unexpected success creating service")
  6338  			}
  6339  			createdSvc := createdObj.(*api.Service)
  6340  
  6341  			// Produce a map of port index to nodeport value, excluding zero.
  6342  			ports := map[int]*api.ServicePort{}
  6343  			for i := range createdSvc.Spec.Ports {
  6344  				p := &createdSvc.Spec.Ports[i]
  6345  				if p.NodePort != 0 {
  6346  					ports[i] = p
  6347  				}
  6348  			}
  6349  
  6350  			if tc.expectNodePorts && len(ports) == 0 {
  6351  				t.Fatalf("expected NodePorts to be allocated, found none")
  6352  			}
  6353  			if !tc.expectNodePorts && len(ports) > 0 {
  6354  				t.Fatalf("expected NodePorts to not be allocated, found %v", ports)
  6355  			}
  6356  			if !tc.expectNodePorts {
  6357  				return
  6358  			}
  6359  
  6360  			// Make sure we got the right number of allocations
  6361  			if want, got := len(ports), len(tc.svc.Spec.Ports); want != got {
  6362  				t.Fatalf("expected %d NodePorts, found %d", want, got)
  6363  			}
  6364  
  6365  			// Make sure they are all allocated
  6366  			for _, p := range ports {
  6367  				if !portIsAllocated(t, storage.alloc.serviceNodePorts, p.NodePort) {
  6368  					t.Errorf("expected port to be allocated: %v", p)
  6369  				}
  6370  			}
  6371  
  6372  			// Make sure we got any specific allocations
  6373  			for i, p := range tc.svc.Spec.Ports {
  6374  				if p.NodePort != 0 {
  6375  					if ports[i].NodePort != p.NodePort {
  6376  						t.Errorf("expected Ports[%d].NodePort to be %d, got %d", i, p.NodePort, ports[i].NodePort)
  6377  					}
  6378  					// Remove requested ports from the set
  6379  					delete(ports, i)
  6380  				}
  6381  			}
  6382  
  6383  			// Make sure any allocated ports are unique
  6384  			seen := map[int32]int32{}
  6385  			for i, p := range ports {
  6386  				// We allow the same NodePort for different protocols of the
  6387  				// same Port.
  6388  				if prev, found := seen[p.NodePort]; found && prev != p.Port {
  6389  					t.Errorf("found non-unique allocation in Ports[%d].NodePort: %d -> %d", i, p.NodePort, p.Port)
  6390  				}
  6391  				seen[p.NodePort] = p.Port
  6392  			}
  6393  		})
  6394  	}
  6395  }
  6396  
  6397  // Prove that create skips allocations for Headless services.
  6398  func TestCreateSkipsAllocationsForHeadless(t *testing.T) {
  6399  	testCases := []struct {
  6400  		name            string
  6401  		clusterFamilies []api.IPFamily
  6402  		svc             *api.Service
  6403  		expectError     bool
  6404  	}{{
  6405  		name:            "singlestack:v4",
  6406  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6407  		svc:             svctest.MakeService("foo"),
  6408  	}, {
  6409  		name:            "singlestack:v6",
  6410  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  6411  		svc:             svctest.MakeService("foo"),
  6412  	}, {
  6413  		name:            "dualstack:v4v6",
  6414  		clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  6415  		svc:             svctest.MakeService("foo"),
  6416  	}, {
  6417  		name:            "dualstack:v6v4",
  6418  		clusterFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  6419  		svc:             svctest.MakeService("foo"),
  6420  	}, {
  6421  		name:            "singlestack:v4_type:NodePort",
  6422  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6423  		svc:             svctest.MakeService("foo", svctest.SetTypeNodePort),
  6424  		expectError:     true,
  6425  	}, {
  6426  		name:            "singlestack:v6_type:LoadBalancer",
  6427  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  6428  		svc:             svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
  6429  		expectError:     true,
  6430  	}}
  6431  
  6432  	for _, tc := range testCases {
  6433  		t.Run(tc.name, func(t *testing.T) {
  6434  			storage, _, server := newStorage(t, tc.clusterFamilies)
  6435  			defer server.Terminate(t)
  6436  			defer storage.Store.DestroyFunc()
  6437  
  6438  			// This test is ONLY headless services.
  6439  			tc.svc.Spec.ClusterIP = api.ClusterIPNone
  6440  
  6441  			ctx := genericapirequest.NewDefaultContext()
  6442  			createdObj, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6443  			if tc.expectError && err != nil {
  6444  				return
  6445  			}
  6446  			if err != nil {
  6447  				t.Fatalf("unexpected error creating service: %v", err)
  6448  			}
  6449  			if tc.expectError && err == nil {
  6450  				t.Fatalf("unexpected success creating service")
  6451  			}
  6452  			createdSvc := createdObj.(*api.Service)
  6453  
  6454  			if createdSvc.Spec.ClusterIP != "None" {
  6455  				t.Errorf("expected clusterIP \"None\", got %q", createdSvc.Spec.ClusterIP)
  6456  			}
  6457  			if !reflect.DeepEqual(createdSvc.Spec.ClusterIPs, []string{"None"}) {
  6458  				t.Errorf("expected clusterIPs [\"None\"], got %q", createdSvc.Spec.ClusterIPs)
  6459  			}
  6460  		})
  6461  	}
  6462  }
  6463  
  6464  // Prove that a dry-run create doesn't actually allocate IPs or ports.
  6465  func TestCreateDryRun(t *testing.T) {
  6466  	testCases := []struct {
  6467  		name            string
  6468  		clusterFamilies []api.IPFamily
  6469  		svc             *api.Service
  6470  	}{{
  6471  		name:            "singlestack:v4_clusterip:unset",
  6472  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6473  		svc:             svctest.MakeService("foo"),
  6474  	}, {
  6475  		name:            "singlestack:v4_clusterip:set",
  6476  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6477  		svc:             svctest.MakeService("foo", svctest.SetClusterIPs("10.0.0.1")),
  6478  	}, {
  6479  		name:            "singlestack:v6_clusterip:unset",
  6480  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  6481  		svc:             svctest.MakeService("foo"),
  6482  	}, {
  6483  		name:            "singlestack:v6_clusterip:set",
  6484  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  6485  		svc:             svctest.MakeService("foo", svctest.SetClusterIPs("2000::1")),
  6486  	}, {
  6487  		name:            "dualstack:v4v6_clusterip:unset",
  6488  		clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  6489  		svc:             svctest.MakeService("foo", svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  6490  	}, {
  6491  		name:            "dualstack:v4v6_clusterip:set",
  6492  		clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  6493  		svc:             svctest.MakeService("foo", svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack), svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  6494  	}, {
  6495  		name:            "singlestack:v4_type:NodePort_nodeport:unset",
  6496  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6497  		svc:             svctest.MakeService("foo", svctest.SetTypeNodePort),
  6498  	}, {
  6499  		name:            "singlestack:v4_type:LoadBalancer_nodePort:set",
  6500  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6501  		svc:             svctest.MakeService("foo", svctest.SetTypeLoadBalancer, svctest.SetUniqueNodePorts),
  6502  	}}
  6503  
  6504  	for _, tc := range testCases {
  6505  		t.Run(tc.name, func(t *testing.T) {
  6506  			storage, _, server := newStorage(t, tc.clusterFamilies)
  6507  			defer server.Terminate(t)
  6508  			defer storage.Store.DestroyFunc()
  6509  
  6510  			ctx := genericapirequest.NewDefaultContext()
  6511  			createdObj, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{DryRun: []string{metav1.DryRunAll}})
  6512  			if err != nil {
  6513  				t.Fatalf("unexpected error creating service: %v", err)
  6514  			}
  6515  			createdSvc := createdObj.(*api.Service)
  6516  
  6517  			// Ensure IPs were assigned
  6518  			if netutils.ParseIPSloppy(createdSvc.Spec.ClusterIP) == nil {
  6519  				t.Errorf("expected valid clusterIP: %q", createdSvc.Spec.ClusterIP)
  6520  			}
  6521  			for _, ip := range createdSvc.Spec.ClusterIPs {
  6522  				if netutils.ParseIPSloppy(ip) == nil {
  6523  					t.Errorf("expected valid clusterIP: %q", createdSvc.Spec.ClusterIP)
  6524  				}
  6525  			}
  6526  
  6527  			// Ensure the allocators are clean.
  6528  			proveClusterIPsDeallocated(t, storage, createdSvc, nil)
  6529  			if tc.svc.Spec.Type != api.ServiceTypeClusterIP {
  6530  				proveNodePortsDeallocated(t, storage, createdSvc, nil)
  6531  			}
  6532  		})
  6533  	}
  6534  }
  6535  
  6536  func TestDeleteWithFinalizer(t *testing.T) {
  6537  	svcName := "foo"
  6538  
  6539  	storage, _, server := newStorage(t, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
  6540  	defer server.Terminate(t)
  6541  	defer storage.Store.DestroyFunc()
  6542  
  6543  	// This will allocate cluster IPs, NodePort, and HealthCheckNodePort.
  6544  	svc := svctest.MakeService(svcName, svctest.SetTypeLoadBalancer,
  6545  		svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6546  		func(s *api.Service) {
  6547  			s.Finalizers = []string{"example.com/test"}
  6548  		})
  6549  
  6550  	ctx := genericapirequest.NewDefaultContext()
  6551  
  6552  	// Create it with finalizer.
  6553  	obj, err := storage.Create(ctx, svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6554  	if err != nil {
  6555  		t.Fatalf("unexpected error creating service: %v", err)
  6556  	}
  6557  	createdSvc := obj.(*api.Service)
  6558  
  6559  	// Prove everything was allocated.
  6560  	obj, err = storage.Get(ctx, svcName, &metav1.GetOptions{})
  6561  	if err != nil {
  6562  		t.Fatalf("unexpected error getting service: %v", err)
  6563  	}
  6564  	if !cmp.Equal(createdSvc, obj) {
  6565  		t.Errorf("expected the result of Create() and Get() to match: %v", cmp.Diff(createdSvc, obj))
  6566  	}
  6567  	proveClusterIPsAllocated(t, storage, svc, createdSvc)
  6568  	proveNodePortsAllocated(t, storage, svc, createdSvc)
  6569  	proveHealthCheckNodePortAllocated(t, storage, svc, createdSvc)
  6570  
  6571  	// Try to delete it, but it should be blocked by the finalizer.
  6572  	obj, deleted, err := storage.Delete(ctx, svcName, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{})
  6573  	if err != nil {
  6574  		t.Fatalf("unexpected error deleting service: %v", err)
  6575  	}
  6576  	if deleted {
  6577  		t.Fatalf("expected service to not be deleted")
  6578  	}
  6579  	deletedSvc := obj.(*api.Service)
  6580  
  6581  	// Prove everything is still allocated.
  6582  	_, err = storage.Get(ctx, svcName, &metav1.GetOptions{})
  6583  	if err != nil {
  6584  		t.Fatalf("unexpected error getting service: %v", err)
  6585  	}
  6586  	proveClusterIPsAllocated(t, storage, svc, createdSvc)
  6587  	proveNodePortsAllocated(t, storage, svc, createdSvc)
  6588  	proveHealthCheckNodePortAllocated(t, storage, svc, createdSvc)
  6589  
  6590  	// Clear the finalizer - should delete.
  6591  	deletedSvc.Finalizers = nil
  6592  	_, _, err = storage.Update(ctx, svcName,
  6593  		rest.DefaultUpdatedObjectInfo(deletedSvc), rest.ValidateAllObjectFunc,
  6594  		rest.ValidateAllObjectUpdateFunc, false, &metav1.UpdateOptions{})
  6595  	if err != nil {
  6596  		t.Fatalf("unexpected error updating service: %v", err)
  6597  	}
  6598  
  6599  	// Prove everything is deallocated.
  6600  	_, err = storage.Get(ctx, svcName, &metav1.GetOptions{})
  6601  	if err == nil {
  6602  		t.Fatalf("unexpected success getting service")
  6603  	}
  6604  	proveClusterIPsDeallocated(t, storage, createdSvc, nil)
  6605  	proveNodePortsDeallocated(t, storage, createdSvc, nil)
  6606  	proveHealthCheckNodePortDeallocated(t, storage, createdSvc, nil)
  6607  }
  6608  
  6609  // Prove that a dry-run delete doesn't actually deallocate IPs or ports.
  6610  func TestDeleteDryRun(t *testing.T) {
  6611  	testCases := []struct {
  6612  		name string
  6613  		svc  *api.Service
  6614  	}{
  6615  		{
  6616  			name: "v4",
  6617  			svc: svctest.MakeService("foo",
  6618  				svctest.SetTypeLoadBalancer,
  6619  				svctest.SetIPFamilies(api.IPv4Protocol),
  6620  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6621  		},
  6622  		{
  6623  			name: "v4v6",
  6624  			svc: svctest.MakeService("foo",
  6625  				svctest.SetTypeLoadBalancer,
  6626  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  6627  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  6628  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6629  		}}
  6630  
  6631  	for _, tc := range testCases {
  6632  		t.Run(tc.name, func(t *testing.T) {
  6633  
  6634  			storage, _, server := newStorage(t, tc.svc.Spec.IPFamilies)
  6635  			defer server.Terminate(t)
  6636  			defer storage.Store.DestroyFunc()
  6637  
  6638  			ctx := genericapirequest.NewDefaultContext()
  6639  			createdObj, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6640  			if err != nil {
  6641  				t.Fatalf("unexpected error creating service: %v", err)
  6642  			}
  6643  			createdSvc := createdObj.(*api.Service)
  6644  
  6645  			// Ensure IPs and ports were allocated
  6646  			proveClusterIPsAllocated(t, storage, tc.svc, createdSvc)
  6647  			proveNodePortsAllocated(t, storage, tc.svc, createdSvc)
  6648  			proveHealthCheckNodePortAllocated(t, storage, tc.svc, createdSvc)
  6649  
  6650  			_, _, err = storage.Delete(ctx, tc.svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{DryRun: []string{metav1.DryRunAll}})
  6651  			if err != nil {
  6652  				t.Fatalf("unexpected error deleting service: %v", err)
  6653  			}
  6654  
  6655  			// Ensure they are still allocated.
  6656  			proveClusterIPsAllocated(t, storage, tc.svc, createdSvc)
  6657  			proveNodePortsAllocated(t, storage, tc.svc, createdSvc)
  6658  			proveHealthCheckNodePortAllocated(t, storage, tc.svc, createdSvc)
  6659  		})
  6660  	}
  6661  }
  6662  
  6663  // Prove that a dry-run update doesn't actually allocate or deallocate IPs or ports.
  6664  func TestUpdateDryRun(t *testing.T) {
  6665  	testCases := []struct {
  6666  		name            string
  6667  		clusterFamilies []api.IPFamily
  6668  		svc             *api.Service
  6669  		update          *api.Service
  6670  		verifyDryAllocs bool
  6671  	}{{
  6672  		name:            "singlestack:v4_NoAllocs-Allocs",
  6673  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6674  		svc:             svctest.MakeService("foo", svctest.SetTypeExternalName),
  6675  		update: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6676  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6677  		verifyDryAllocs: true, // make sure values were not allocated.
  6678  	}, {
  6679  		name:            "singlestack:v4_Allocs-NoAllocs",
  6680  		clusterFamilies: []api.IPFamily{api.IPv4Protocol},
  6681  		svc: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6682  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6683  		update:          svctest.MakeService("foo", svctest.SetTypeExternalName),
  6684  		verifyDryAllocs: false, // make sure values were not released.
  6685  	}, {
  6686  		name:            "singlestack:v6_NoAllocs-Allocs",
  6687  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  6688  		svc:             svctest.MakeService("foo", svctest.SetTypeExternalName),
  6689  		update: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6690  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6691  		verifyDryAllocs: true, // make sure values were not allocated.
  6692  	}, {
  6693  		name:            "singlestack:v6_Allocs-NoAllocs",
  6694  		clusterFamilies: []api.IPFamily{api.IPv6Protocol},
  6695  		svc: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6696  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6697  		update:          svctest.MakeService("foo", svctest.SetTypeExternalName),
  6698  		verifyDryAllocs: false, // make sure values were not released.
  6699  	}, {
  6700  		name:            "dualstack:v4v6_NoAllocs-Allocs",
  6701  		clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  6702  		svc:             svctest.MakeService("foo", svctest.SetTypeExternalName),
  6703  		update: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6704  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6705  		verifyDryAllocs: true, // make sure values were not allocated.
  6706  	}, {
  6707  		name:            "dualstack:v4v6_Allocs-NoAllocs",
  6708  		clusterFamilies: []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol},
  6709  		svc: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6710  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6711  		update:          svctest.MakeService("foo", svctest.SetTypeExternalName),
  6712  		verifyDryAllocs: false, // make sure values were not released.
  6713  	}, {
  6714  		name:            "dualstack:v6v4_NoAllocs-Allocs",
  6715  		clusterFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  6716  		svc:             svctest.MakeService("foo", svctest.SetTypeExternalName),
  6717  		update: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6718  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6719  		verifyDryAllocs: true, // make sure values were not allocated.
  6720  	}, {
  6721  		name:            "dualstack:v6v4_Allocs-NoAllocs",
  6722  		clusterFamilies: []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol},
  6723  		svc: svctest.MakeService("foo", svctest.SetTypeLoadBalancer,
  6724  			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6725  		update:          svctest.MakeService("foo", svctest.SetTypeExternalName),
  6726  		verifyDryAllocs: false, // make sure values were not released.
  6727  	}}
  6728  
  6729  	for _, tc := range testCases {
  6730  		t.Run(tc.name, func(t *testing.T) {
  6731  			storage, _, server := newStorage(t, tc.clusterFamilies)
  6732  			defer server.Terminate(t)
  6733  			defer storage.Store.DestroyFunc()
  6734  
  6735  			ctx := genericapirequest.NewDefaultContext()
  6736  			obj, err := storage.Create(ctx, tc.svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
  6737  			if err != nil {
  6738  				t.Fatalf("unexpected error creating service: %v", err)
  6739  			}
  6740  			createdSvc := obj.(*api.Service)
  6741  
  6742  			if tc.verifyDryAllocs {
  6743  				// Dry allocs means no allocs on create.  Ensure values were
  6744  				// NOT allocated.
  6745  				proveClusterIPsDeallocated(t, storage, nil, createdSvc)
  6746  			} else {
  6747  				// Ensure IPs were allocated
  6748  				proveClusterIPsAllocated(t, storage, nil, createdSvc)
  6749  			}
  6750  
  6751  			// Update the object to the new state and check the results.
  6752  			obj, _, err = storage.Update(ctx, tc.update.Name,
  6753  				rest.DefaultUpdatedObjectInfo(tc.update), rest.ValidateAllObjectFunc,
  6754  				rest.ValidateAllObjectUpdateFunc, false, &metav1.UpdateOptions{DryRun: []string{metav1.DryRunAll}})
  6755  			if err != nil {
  6756  				t.Fatalf("unexpected error updating service: %v", err)
  6757  			}
  6758  			updatedSvc := obj.(*api.Service)
  6759  
  6760  			if tc.verifyDryAllocs {
  6761  				// Dry allocs means the values are assigned but not
  6762  				// allocated.
  6763  				if netutils.ParseIPSloppy(updatedSvc.Spec.ClusterIP) == nil {
  6764  					t.Errorf("expected valid clusterIP: %q", updatedSvc.Spec.ClusterIP)
  6765  				}
  6766  				for _, ip := range updatedSvc.Spec.ClusterIPs {
  6767  					if netutils.ParseIPSloppy(ip) == nil {
  6768  						t.Errorf("expected valid clusterIP: %q", updatedSvc.Spec.ClusterIP)
  6769  					}
  6770  				}
  6771  				for i, fam := range updatedSvc.Spec.IPFamilies {
  6772  					if ipIsAllocated(t, storage.alloc.serviceIPAllocatorsByFamily[fam], updatedSvc.Spec.ClusterIPs[i]) {
  6773  						t.Errorf("expected IP to not be allocated: %q", updatedSvc.Spec.ClusterIPs[i])
  6774  					}
  6775  				}
  6776  
  6777  				for _, p := range updatedSvc.Spec.Ports {
  6778  					if p.NodePort == 0 {
  6779  						t.Errorf("expected nodePort to be assigned: %d", p.NodePort)
  6780  					}
  6781  					if portIsAllocated(t, storage.alloc.serviceNodePorts, p.NodePort) {
  6782  						t.Errorf("expected nodePort to not be allocated: %d", p.NodePort)
  6783  					}
  6784  				}
  6785  
  6786  				if updatedSvc.Spec.HealthCheckNodePort == 0 {
  6787  					t.Errorf("expected HCNP to be assigned: %d", updatedSvc.Spec.HealthCheckNodePort)
  6788  				}
  6789  				if portIsAllocated(t, storage.alloc.serviceNodePorts, updatedSvc.Spec.HealthCheckNodePort) {
  6790  					t.Errorf("expected HCNP to not be allocated: %d", updatedSvc.Spec.HealthCheckNodePort)
  6791  				}
  6792  			} else {
  6793  				// Ensure IPs were unassigned but not deallocated.
  6794  				if updatedSvc.Spec.ClusterIP != "" {
  6795  					t.Errorf("expected clusterIP to be unset: %q", updatedSvc.Spec.ClusterIP)
  6796  				}
  6797  				if len(updatedSvc.Spec.ClusterIPs) != 0 {
  6798  					t.Errorf("expected clusterIPs to be unset: %q", updatedSvc.Spec.ClusterIPs)
  6799  				}
  6800  				for i, fam := range createdSvc.Spec.IPFamilies {
  6801  					if !ipIsAllocated(t, storage.alloc.serviceIPAllocatorsByFamily[fam], createdSvc.Spec.ClusterIPs[i]) {
  6802  						t.Errorf("expected IP to still be allocated: %q", createdSvc.Spec.ClusterIPs[i])
  6803  					}
  6804  				}
  6805  
  6806  				for _, p := range updatedSvc.Spec.Ports {
  6807  					if p.NodePort != 0 {
  6808  						t.Errorf("expected nodePort to be unset: %d", p.NodePort)
  6809  					}
  6810  				}
  6811  				for _, p := range createdSvc.Spec.Ports {
  6812  					if !portIsAllocated(t, storage.alloc.serviceNodePorts, p.NodePort) {
  6813  						t.Errorf("expected nodePort to still be allocated: %d", p.NodePort)
  6814  					}
  6815  				}
  6816  
  6817  				if updatedSvc.Spec.HealthCheckNodePort != 0 {
  6818  					t.Errorf("expected HCNP to be unset: %d", updatedSvc.Spec.HealthCheckNodePort)
  6819  				}
  6820  				if !portIsAllocated(t, storage.alloc.serviceNodePorts, createdSvc.Spec.HealthCheckNodePort) {
  6821  					t.Errorf("expected HCNP to still be allocated: %d", createdSvc.Spec.HealthCheckNodePort)
  6822  				}
  6823  			}
  6824  		})
  6825  	}
  6826  }
  6827  
  6828  func TestUpdatePatchAllocatedValues(t *testing.T) {
  6829  	prove := func(proofs ...svcTestProof) []svcTestProof {
  6830  		return proofs
  6831  	}
  6832  	proveClusterIP := func(idx int, ip string) svcTestProof {
  6833  		return func(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  6834  			if want, got := ip, after.Spec.ClusterIPs[idx]; want != got {
  6835  				t.Errorf("wrong ClusterIPs[%d]: want %q, got %q", idx, want, got)
  6836  			}
  6837  		}
  6838  	}
  6839  	proveNodePort := func(idx int, port int32) svcTestProof {
  6840  		return func(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  6841  			got := after.Spec.Ports[idx].NodePort
  6842  			if port > 0 && got != port {
  6843  				t.Errorf("wrong Ports[%d].NodePort: want %d, got %d", idx, port, got)
  6844  			} else if port < 0 && got == -port {
  6845  				t.Errorf("wrong Ports[%d].NodePort: wanted anything but %d", idx, got)
  6846  			}
  6847  		}
  6848  	}
  6849  	proveHCNP := func(port int32) svcTestProof {
  6850  		return func(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  6851  			got := after.Spec.HealthCheckNodePort
  6852  			if port > 0 && got != port {
  6853  				t.Errorf("wrong HealthCheckNodePort: want %d, got %d", port, got)
  6854  			} else if port < 0 && got == -port {
  6855  				t.Errorf("wrong HealthCheckNodePort: wanted anything but %d", got)
  6856  			}
  6857  		}
  6858  	}
  6859  
  6860  	// each create needs clusterIP, NodePort, and HealthCheckNodePort allocated
  6861  	// each update needs clusterIP, NodePort, and/or HealthCheckNodePort blank
  6862  	testCases := []cudTestCase{{
  6863  		name: "single-ip_single-port",
  6864  		create: svcTestCase{
  6865  			svc: svctest.MakeService("foo",
  6866  				svctest.SetTypeLoadBalancer,
  6867  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6868  				svctest.SetClusterIPs("10.0.0.1"),
  6869  				svctest.SetNodePorts(30093),
  6870  				svctest.SetHealthCheckNodePort(30118)),
  6871  			expectClusterIPs:          true,
  6872  			expectNodePorts:           true,
  6873  			expectHealthCheckNodePort: true,
  6874  		},
  6875  		update: svcTestCase{
  6876  			svc: svctest.MakeService("foo",
  6877  				svctest.SetTypeLoadBalancer,
  6878  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
  6879  			expectClusterIPs:          true,
  6880  			expectNodePorts:           true,
  6881  			expectHealthCheckNodePort: true,
  6882  			prove: prove(
  6883  				proveClusterIP(0, "10.0.0.1"),
  6884  				proveNodePort(0, 30093),
  6885  				proveHCNP(30118)),
  6886  		},
  6887  	}, {
  6888  		name: "multi-ip_multi-port",
  6889  		create: svcTestCase{
  6890  			svc: svctest.MakeService("foo",
  6891  				svctest.SetTypeLoadBalancer,
  6892  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6893  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  6894  				svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  6895  				svctest.SetPorts(
  6896  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  6897  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  6898  				svctest.SetNodePorts(30093, 30076),
  6899  				svctest.SetHealthCheckNodePort(30118)),
  6900  			expectClusterIPs:          true,
  6901  			expectNodePorts:           true,
  6902  			expectHealthCheckNodePort: true,
  6903  		},
  6904  		update: svcTestCase{
  6905  			svc: svctest.MakeService("foo",
  6906  				svctest.SetTypeLoadBalancer,
  6907  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6908  				svctest.SetPorts(
  6909  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  6910  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP))),
  6911  			expectClusterIPs:          true,
  6912  			expectNodePorts:           true,
  6913  			expectHealthCheckNodePort: true,
  6914  			prove: prove(
  6915  				proveClusterIP(0, "10.0.0.1"),
  6916  				proveClusterIP(1, "2000::1"),
  6917  				proveNodePort(0, 30093),
  6918  				proveNodePort(1, 30076),
  6919  				proveHCNP(30118)),
  6920  		},
  6921  	}, {
  6922  		name: "multi-ip_partial",
  6923  		create: svcTestCase{
  6924  			svc: svctest.MakeService("foo",
  6925  				svctest.SetTypeLoadBalancer,
  6926  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6927  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  6928  				svctest.SetClusterIPs("10.0.0.1", "2000::1"),
  6929  				svctest.SetPorts(
  6930  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  6931  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  6932  				svctest.SetNodePorts(30093, 30076),
  6933  				svctest.SetHealthCheckNodePort(30118)),
  6934  			expectClusterIPs:          true,
  6935  			expectNodePorts:           true,
  6936  			expectHealthCheckNodePort: true,
  6937  		},
  6938  		update: svcTestCase{
  6939  			svc: svctest.MakeService("foo",
  6940  				svctest.SetTypeLoadBalancer,
  6941  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6942  				svctest.SetClusterIPs("10.0.0.1")),
  6943  			expectError: true,
  6944  		},
  6945  	}, {
  6946  		name: "multi-port_partial",
  6947  		create: svcTestCase{
  6948  			svc: svctest.MakeService("foo",
  6949  				svctest.SetTypeLoadBalancer,
  6950  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6951  				svctest.SetPorts(
  6952  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  6953  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  6954  				svctest.SetNodePorts(30093, 30076),
  6955  				svctest.SetHealthCheckNodePort(30118)),
  6956  			expectClusterIPs:          true,
  6957  			expectNodePorts:           true,
  6958  			expectHealthCheckNodePort: true,
  6959  		},
  6960  		update: svcTestCase{
  6961  			svc: svctest.MakeService("foo",
  6962  				svctest.SetTypeLoadBalancer,
  6963  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6964  				svctest.SetPorts(
  6965  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  6966  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  6967  				svctest.SetNodePorts(30093, 0)), // provide just 1 value
  6968  			expectClusterIPs:          true,
  6969  			expectNodePorts:           true,
  6970  			expectHealthCheckNodePort: true,
  6971  			prove: prove(
  6972  				proveNodePort(0, 30093),
  6973  				proveNodePort(1, 30076),
  6974  				proveHCNP(30118)),
  6975  		},
  6976  	}, {
  6977  		name: "swap-ports",
  6978  		create: svcTestCase{
  6979  			svc: svctest.MakeService("foo",
  6980  				svctest.SetTypeLoadBalancer,
  6981  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6982  				svctest.SetPorts(
  6983  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  6984  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  6985  				svctest.SetNodePorts(30093, 30076),
  6986  				svctest.SetHealthCheckNodePort(30118)),
  6987  			expectClusterIPs:          true,
  6988  			expectNodePorts:           true,
  6989  			expectHealthCheckNodePort: true,
  6990  		},
  6991  		update: svcTestCase{
  6992  			svc: svctest.MakeService("foo",
  6993  				svctest.SetTypeLoadBalancer,
  6994  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  6995  				svctest.SetPorts(
  6996  					// swapped from above
  6997  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP),
  6998  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP))),
  6999  			expectClusterIPs:          true,
  7000  			expectNodePorts:           true,
  7001  			expectHealthCheckNodePort: true,
  7002  			prove: prove(
  7003  				proveNodePort(0, 30076),
  7004  				proveNodePort(1, 30093),
  7005  				proveHCNP(30118)),
  7006  		},
  7007  	}, {
  7008  		name: "partial-swap-ports",
  7009  		create: svcTestCase{
  7010  			svc: svctest.MakeService("foo",
  7011  				svctest.SetTypeLoadBalancer,
  7012  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7013  				svctest.SetPorts(
  7014  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7015  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7016  				svctest.SetNodePorts(30093, 30076),
  7017  				svctest.SetHealthCheckNodePort(30118)),
  7018  			expectClusterIPs:          true,
  7019  			expectNodePorts:           true,
  7020  			expectHealthCheckNodePort: true,
  7021  		},
  7022  		update: svcTestCase{
  7023  			svc: svctest.MakeService("foo",
  7024  				svctest.SetTypeLoadBalancer,
  7025  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7026  				svctest.SetPorts(
  7027  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7028  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7029  				svctest.SetNodePorts(30076, 0), // set [0] to [1]'s value, omit [1]
  7030  				svctest.SetHealthCheckNodePort(30118)),
  7031  			expectClusterIPs:          true,
  7032  			expectNodePorts:           true,
  7033  			expectHealthCheckNodePort: true,
  7034  			prove: prove(
  7035  				proveNodePort(0, 30076),
  7036  				proveNodePort(1, -30076),
  7037  				proveHCNP(30118)),
  7038  		},
  7039  	}, {
  7040  		name: "swap-port-with-hcnp",
  7041  		create: svcTestCase{
  7042  			svc: svctest.MakeService("foo",
  7043  				svctest.SetTypeLoadBalancer,
  7044  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7045  				svctest.SetPorts(
  7046  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7047  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7048  				svctest.SetNodePorts(30093, 30076),
  7049  				svctest.SetHealthCheckNodePort(30118)),
  7050  			expectClusterIPs:          true,
  7051  			expectNodePorts:           true,
  7052  			expectHealthCheckNodePort: true,
  7053  		},
  7054  		update: svcTestCase{
  7055  			svc: svctest.MakeService("foo",
  7056  				svctest.SetTypeLoadBalancer,
  7057  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7058  				svctest.SetPorts(
  7059  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7060  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7061  				svctest.SetNodePorts(30076, 30118)), // set [0] to HCNP's value
  7062  			expectError: true,
  7063  		},
  7064  	}, {
  7065  		name: "partial-swap-port-with-hcnp",
  7066  		create: svcTestCase{
  7067  			svc: svctest.MakeService("foo",
  7068  				svctest.SetTypeLoadBalancer,
  7069  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7070  				svctest.SetPorts(
  7071  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7072  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7073  				svctest.SetNodePorts(30093, 30076),
  7074  				svctest.SetHealthCheckNodePort(30118)),
  7075  			expectClusterIPs:          true,
  7076  			expectNodePorts:           true,
  7077  			expectHealthCheckNodePort: true,
  7078  		},
  7079  		update: svcTestCase{
  7080  			svc: svctest.MakeService("foo",
  7081  				svctest.SetTypeLoadBalancer,
  7082  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7083  				svctest.SetPorts(
  7084  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7085  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7086  				svctest.SetNodePorts(30118, 0)), // set [0] to HCNP's value, omit [1]
  7087  			expectError: true,
  7088  		},
  7089  	}, {
  7090  		name: "update-hcnp",
  7091  		create: svcTestCase{
  7092  			svc: svctest.MakeService("foo",
  7093  				svctest.SetTypeLoadBalancer,
  7094  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7095  				svctest.SetPorts(
  7096  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7097  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7098  				svctest.SetNodePorts(30093, 30076),
  7099  				svctest.SetHealthCheckNodePort(30118)),
  7100  			expectClusterIPs:          true,
  7101  			expectNodePorts:           true,
  7102  			expectHealthCheckNodePort: true,
  7103  		},
  7104  		update: svcTestCase{
  7105  			svc: svctest.MakeService("foo",
  7106  				svctest.SetTypeLoadBalancer,
  7107  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
  7108  				svctest.SetPorts(
  7109  					svctest.MakeServicePort("p", 867, intstr.FromInt32(867), api.ProtocolTCP),
  7110  					svctest.MakeServicePort("q", 5309, intstr.FromInt32(5309), api.ProtocolTCP)),
  7111  				svctest.SetNodePorts(30093, 30076),
  7112  				svctest.SetHealthCheckNodePort(30111)),
  7113  			expectError: true,
  7114  		},
  7115  	}}
  7116  
  7117  	helpTestCreateUpdateDelete(t, testCases)
  7118  }
  7119  
  7120  // Proves that updates from single-stack work.
  7121  func TestUpdateIPsFromSingleStack(t *testing.T) {
  7122  	prove := func(proofs ...svcTestProof) []svcTestProof {
  7123  		return proofs
  7124  	}
  7125  	proveNumFamilies := func(n int) svcTestProof {
  7126  		return func(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  7127  			t.Helper()
  7128  			if got := len(after.Spec.IPFamilies); got != n {
  7129  				t.Errorf("wrong number of ipFamilies: expected %d, got %d", n, got)
  7130  			}
  7131  		}
  7132  	}
  7133  
  7134  	// Single-stack cases as control.
  7135  	testCasesV4 := []cudTestCase{{
  7136  		name: "single-single",
  7137  		line: line(),
  7138  		create: svcTestCase{
  7139  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7140  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  7141  			expectClusterIPs: true,
  7142  			prove:            prove(proveNumFamilies(1)),
  7143  		},
  7144  		update: svcTestCase{
  7145  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7146  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7147  				svctest.SetSelector(map[string]string{"k2": "v2"})),
  7148  			expectClusterIPs: true,
  7149  			prove:            prove(proveNumFamilies(1)),
  7150  		},
  7151  	}, {
  7152  		name: "single-dual",
  7153  		line: line(),
  7154  		create: svcTestCase{
  7155  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7156  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  7157  			expectClusterIPs: true,
  7158  			prove:            prove(proveNumFamilies(1)),
  7159  		},
  7160  		update: svcTestCase{
  7161  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7162  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7163  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  7164  			expectError: true,
  7165  		},
  7166  	}, {
  7167  		name: "single-dual_policy",
  7168  		line: line(),
  7169  		create: svcTestCase{
  7170  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7171  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  7172  			expectClusterIPs: true,
  7173  			prove:            prove(proveNumFamilies(1)),
  7174  		},
  7175  		update: svcTestCase{
  7176  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7177  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  7178  			expectError: true,
  7179  		},
  7180  	}, {
  7181  		name: "single-dual_families",
  7182  		line: line(),
  7183  		create: svcTestCase{
  7184  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7185  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  7186  			expectClusterIPs: true,
  7187  			prove:            prove(proveNumFamilies(1)),
  7188  		},
  7189  		update: svcTestCase{
  7190  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7191  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  7192  			expectError: true,
  7193  		},
  7194  	}}
  7195  
  7196  	t.Run("singlestack:v4", func(t *testing.T) {
  7197  		helpTestCreateUpdateDeleteWithFamilies(t, testCasesV4, []api.IPFamily{api.IPv4Protocol})
  7198  	})
  7199  
  7200  	// Dual-stack v4,v6 cases: Covers the full matrix of:
  7201  	//    policy={nil, single, prefer, require}
  7202  	//    families={nil, single, dual}
  7203  	//    ips={nil, single, dual}
  7204  	testCasesV4V6 := []cudTestCase{{
  7205  		name: "policy:nil_families:nil_ips:nil",
  7206  		line: line(),
  7207  		create: svcTestCase{
  7208  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7209  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7210  				svctest.SetClusterIPs("10.0.0.1")),
  7211  			expectClusterIPs: true,
  7212  			prove:            prove(proveNumFamilies(1)),
  7213  		},
  7214  		update: svcTestCase{
  7215  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7216  				svctest.SetSelector(map[string]string{"k2": "v2"})),
  7217  			expectClusterIPs: true,
  7218  			prove:            prove(proveNumFamilies(1)),
  7219  		},
  7220  	}, {
  7221  		name: "policy:nil_families:nil_ips:single",
  7222  		line: line(),
  7223  		create: svcTestCase{
  7224  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7225  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7226  				svctest.SetClusterIPs("10.0.0.1")),
  7227  			expectClusterIPs: true,
  7228  			prove:            prove(proveNumFamilies(1)),
  7229  		},
  7230  		update: svcTestCase{
  7231  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7232  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7233  				svctest.SetClusterIPs("10.0.0.1")),
  7234  			expectClusterIPs: true,
  7235  			prove:            prove(proveNumFamilies(1)),
  7236  		},
  7237  	}, {
  7238  		name: "policy:nil_families:nil_ips:dual",
  7239  		line: line(),
  7240  		create: svcTestCase{
  7241  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7242  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7243  				svctest.SetClusterIPs("10.0.0.1")),
  7244  			expectClusterIPs: true,
  7245  			prove:            prove(proveNumFamilies(1)),
  7246  		},
  7247  		update: svcTestCase{
  7248  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7249  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7250  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7251  			expectError: true,
  7252  		},
  7253  	}, {
  7254  		name: "policy:nil_families:single_ips:nil",
  7255  		line: line(),
  7256  		create: svcTestCase{
  7257  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7258  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7259  				svctest.SetClusterIPs("10.0.0.1")),
  7260  			expectClusterIPs: true,
  7261  			prove:            prove(proveNumFamilies(1)),
  7262  		},
  7263  		update: svcTestCase{
  7264  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7265  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7266  				svctest.SetIPFamilies(api.IPv4Protocol)),
  7267  			expectClusterIPs: true,
  7268  			prove:            prove(proveNumFamilies(1)),
  7269  		},
  7270  	}, {
  7271  		name: "policy:nil_families:single_ips:single",
  7272  		line: line(),
  7273  		create: svcTestCase{
  7274  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7275  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7276  				svctest.SetClusterIPs("10.0.0.1")),
  7277  			expectClusterIPs: true,
  7278  			prove:            prove(proveNumFamilies(1)),
  7279  		},
  7280  		update: svcTestCase{
  7281  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7282  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7283  				svctest.SetIPFamilies(api.IPv4Protocol),
  7284  				svctest.SetClusterIPs("10.0.0.1")),
  7285  			expectClusterIPs: true,
  7286  			prove:            prove(proveNumFamilies(1)),
  7287  		},
  7288  	}, {
  7289  		name: "policy:nil_families:single_ips:dual",
  7290  		line: line(),
  7291  		create: svcTestCase{
  7292  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7293  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7294  				svctest.SetClusterIPs("10.0.0.1")),
  7295  			expectClusterIPs: true,
  7296  			prove:            prove(proveNumFamilies(1)),
  7297  		},
  7298  		update: svcTestCase{
  7299  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7300  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7301  				svctest.SetIPFamilies(api.IPv4Protocol),
  7302  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7303  			expectError: true,
  7304  		},
  7305  	}, {
  7306  		name: "policy:nil_families:dual_ips:nil",
  7307  		line: line(),
  7308  		create: svcTestCase{
  7309  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7310  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7311  				svctest.SetClusterIPs("10.0.0.1")),
  7312  			expectClusterIPs: true,
  7313  			prove:            prove(proveNumFamilies(1)),
  7314  		},
  7315  		update: svcTestCase{
  7316  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7317  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7318  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  7319  			expectError: true,
  7320  		},
  7321  	}, {
  7322  		name: "policy:nil_families:dual_ips:single",
  7323  		line: line(),
  7324  		create: svcTestCase{
  7325  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7326  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7327  				svctest.SetClusterIPs("10.0.0.1")),
  7328  			expectClusterIPs: true,
  7329  		},
  7330  		update: svcTestCase{
  7331  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7332  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7333  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7334  				svctest.SetClusterIPs("10.0.0.1")),
  7335  			expectError: true,
  7336  		},
  7337  	}, {
  7338  		name: "policy:nil_families:dual_ips:dual",
  7339  		line: line(),
  7340  		create: svcTestCase{
  7341  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7342  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7343  				svctest.SetClusterIPs("10.0.0.1")),
  7344  			expectClusterIPs: true,
  7345  			prove:            prove(proveNumFamilies(1)),
  7346  		},
  7347  		update: svcTestCase{
  7348  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7349  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7350  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7351  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7352  			expectError: true,
  7353  		},
  7354  	}, {
  7355  		name: "policy:single_families:nil_ips:nil",
  7356  		line: line(),
  7357  		create: svcTestCase{
  7358  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7359  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7360  				svctest.SetClusterIPs("10.0.0.1")),
  7361  			expectClusterIPs: true,
  7362  			prove:            prove(proveNumFamilies(1)),
  7363  		},
  7364  		update: svcTestCase{
  7365  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7366  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7367  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  7368  			expectClusterIPs: true,
  7369  			prove:            prove(proveNumFamilies(1)),
  7370  		},
  7371  	}, {
  7372  		name: "policy:single_families:nil_ips:single",
  7373  		line: line(),
  7374  		create: svcTestCase{
  7375  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7376  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7377  				svctest.SetClusterIPs("10.0.0.1")),
  7378  			expectClusterIPs: true,
  7379  			prove:            prove(proveNumFamilies(1)),
  7380  		},
  7381  		update: svcTestCase{
  7382  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7383  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7384  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7385  				svctest.SetClusterIPs("10.0.0.1")),
  7386  			expectClusterIPs: true,
  7387  			prove:            prove(proveNumFamilies(1)),
  7388  		},
  7389  	}, {
  7390  		name: "policy:single_families:nil_ips:dual",
  7391  		line: line(),
  7392  		create: svcTestCase{
  7393  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7394  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7395  				svctest.SetClusterIPs("10.0.0.1")),
  7396  			expectClusterIPs: true,
  7397  			prove:            prove(proveNumFamilies(1)),
  7398  		},
  7399  		update: svcTestCase{
  7400  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7401  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7402  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7403  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7404  			expectError: true,
  7405  		},
  7406  	}, {
  7407  		name: "policy:single_families:single_ips:nil",
  7408  		line: line(),
  7409  		create: svcTestCase{
  7410  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7411  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7412  				svctest.SetClusterIPs("10.0.0.1")),
  7413  			expectClusterIPs: true,
  7414  			prove:            prove(proveNumFamilies(1)),
  7415  		},
  7416  		update: svcTestCase{
  7417  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7418  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7419  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7420  				svctest.SetIPFamilies(api.IPv4Protocol)),
  7421  			expectClusterIPs: true,
  7422  			prove:            prove(proveNumFamilies(1)),
  7423  		},
  7424  	}, {
  7425  		name: "policy:single_families:single_ips:single",
  7426  		line: line(),
  7427  		create: svcTestCase{
  7428  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7429  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7430  				svctest.SetClusterIPs("10.0.0.1")),
  7431  			expectClusterIPs: true,
  7432  			prove:            prove(proveNumFamilies(1)),
  7433  		},
  7434  		update: svcTestCase{
  7435  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7436  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7437  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7438  				svctest.SetIPFamilies(api.IPv4Protocol),
  7439  				svctest.SetClusterIPs("10.0.0.1")),
  7440  			expectClusterIPs: true,
  7441  			prove:            prove(proveNumFamilies(1)),
  7442  		},
  7443  	}, {
  7444  		name: "policy:single_families:single_ips:dual",
  7445  		line: line(),
  7446  		create: svcTestCase{
  7447  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7448  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7449  				svctest.SetClusterIPs("10.0.0.1")),
  7450  			expectClusterIPs: true,
  7451  			prove:            prove(proveNumFamilies(1)),
  7452  		},
  7453  		update: svcTestCase{
  7454  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7455  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7456  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7457  				svctest.SetIPFamilies(api.IPv4Protocol),
  7458  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7459  			expectError: true,
  7460  		},
  7461  	}, {
  7462  		name: "policy:single_families:dual_ips:nil",
  7463  		line: line(),
  7464  		create: svcTestCase{
  7465  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7466  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7467  				svctest.SetClusterIPs("10.0.0.1")),
  7468  			expectClusterIPs: true,
  7469  			prove:            prove(proveNumFamilies(1)),
  7470  		},
  7471  		update: svcTestCase{
  7472  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7473  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7474  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7475  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  7476  			expectError: true,
  7477  		},
  7478  	}, {
  7479  		name: "policy:single_families:dual_ips:single",
  7480  		line: line(),
  7481  		create: svcTestCase{
  7482  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7483  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7484  				svctest.SetClusterIPs("10.0.0.1")),
  7485  			expectClusterIPs: true,
  7486  			prove:            prove(proveNumFamilies(1)),
  7487  		},
  7488  		update: svcTestCase{
  7489  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7490  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7491  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7492  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7493  				svctest.SetClusterIPs("10.0.0.1")),
  7494  			expectError: true,
  7495  		},
  7496  	}, {
  7497  		name: "policy:single_families:dual_ips:dual",
  7498  		line: line(),
  7499  		create: svcTestCase{
  7500  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7501  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7502  				svctest.SetClusterIPs("10.0.0.1")),
  7503  			expectClusterIPs: true,
  7504  			prove:            prove(proveNumFamilies(1)),
  7505  		},
  7506  		update: svcTestCase{
  7507  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7508  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7509  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7510  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7511  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7512  			expectError: true,
  7513  		},
  7514  	}, {
  7515  		name: "policy:prefer_families:nil_ips:nil",
  7516  		line: line(),
  7517  		create: svcTestCase{
  7518  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7519  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7520  				svctest.SetClusterIPs("10.0.0.1")),
  7521  			expectClusterIPs: true,
  7522  			prove:            prove(proveNumFamilies(1)),
  7523  		},
  7524  		update: svcTestCase{
  7525  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7526  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7527  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  7528  			expectClusterIPs: true,
  7529  			prove:            prove(proveNumFamilies(2)),
  7530  		},
  7531  	}, {
  7532  		name: "policy:prefer_families:nil_ips:single",
  7533  		line: line(),
  7534  		create: svcTestCase{
  7535  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7536  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7537  				svctest.SetClusterIPs("10.0.0.1")),
  7538  			expectClusterIPs: true,
  7539  			prove:            prove(proveNumFamilies(1)),
  7540  		},
  7541  		update: svcTestCase{
  7542  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7543  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7544  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7545  				svctest.SetClusterIPs("10.0.0.1")),
  7546  			expectClusterIPs: true,
  7547  			prove:            prove(proveNumFamilies(2)),
  7548  		},
  7549  	}, {
  7550  		name: "policy:prefer_families:nil_ips:dual",
  7551  		line: line(),
  7552  		create: svcTestCase{
  7553  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7554  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7555  				svctest.SetClusterIPs("10.0.0.1")),
  7556  			expectClusterIPs: true,
  7557  			prove:            prove(proveNumFamilies(1)),
  7558  		},
  7559  		update: svcTestCase{
  7560  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7561  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7562  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7563  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7564  			expectClusterIPs: true,
  7565  			prove:            prove(proveNumFamilies(2)),
  7566  		},
  7567  	}, {
  7568  		name: "policy:prefer_families:single_ips:nil",
  7569  		line: line(),
  7570  		create: svcTestCase{
  7571  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7572  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7573  				svctest.SetClusterIPs("10.0.0.1")),
  7574  			expectClusterIPs: true,
  7575  			prove:            prove(proveNumFamilies(1)),
  7576  		},
  7577  		update: svcTestCase{
  7578  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7579  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7580  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7581  				svctest.SetIPFamilies(api.IPv4Protocol)),
  7582  			expectClusterIPs: true,
  7583  			prove:            prove(proveNumFamilies(2)),
  7584  		},
  7585  	}, {
  7586  		name: "policy:prefer_families:single_ips:single",
  7587  		line: line(),
  7588  		create: svcTestCase{
  7589  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7590  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7591  				svctest.SetClusterIPs("10.0.0.1")),
  7592  			expectClusterIPs: true,
  7593  			prove:            prove(proveNumFamilies(1)),
  7594  		},
  7595  		update: svcTestCase{
  7596  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7597  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7598  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7599  				svctest.SetIPFamilies(api.IPv4Protocol),
  7600  				svctest.SetClusterIPs("10.0.0.1")),
  7601  			expectClusterIPs: true,
  7602  			prove:            prove(proveNumFamilies(2)),
  7603  		},
  7604  	}, {
  7605  		name: "policy:prefer_families:single_ips:dual",
  7606  		line: line(),
  7607  		create: svcTestCase{
  7608  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7609  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7610  				svctest.SetClusterIPs("10.0.0.1")),
  7611  			expectClusterIPs: true,
  7612  			prove:            prove(proveNumFamilies(1)),
  7613  		},
  7614  		update: svcTestCase{
  7615  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7616  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7617  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7618  				svctest.SetIPFamilies(api.IPv4Protocol),
  7619  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7620  			expectClusterIPs: true,
  7621  			prove:            prove(proveNumFamilies(2)),
  7622  		},
  7623  	}, {
  7624  		name: "policy:prefer_families:dual_ips:nil",
  7625  		line: line(),
  7626  		create: svcTestCase{
  7627  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7628  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7629  				svctest.SetClusterIPs("10.0.0.1")),
  7630  			expectClusterIPs: true,
  7631  			prove:            prove(proveNumFamilies(1)),
  7632  		},
  7633  		update: svcTestCase{
  7634  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7635  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7636  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7637  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  7638  			expectClusterIPs: true,
  7639  			prove:            prove(proveNumFamilies(2)),
  7640  		},
  7641  	}, {
  7642  		name: "policy:prefer_families:dual_ips:single",
  7643  		line: line(),
  7644  		create: svcTestCase{
  7645  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7646  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7647  				svctest.SetClusterIPs("10.0.0.1")),
  7648  			expectClusterIPs: true,
  7649  			prove:            prove(proveNumFamilies(1)),
  7650  		},
  7651  		update: svcTestCase{
  7652  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7653  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7654  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7655  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7656  				svctest.SetClusterIPs("10.0.0.1")),
  7657  			expectClusterIPs: true,
  7658  			prove:            prove(proveNumFamilies(2)),
  7659  		},
  7660  	}, {
  7661  		name: "policy:prefer_families:dual_ips:dual",
  7662  		line: line(),
  7663  		create: svcTestCase{
  7664  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7665  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7666  				svctest.SetClusterIPs("10.0.0.1")),
  7667  			expectClusterIPs: true,
  7668  			prove:            prove(proveNumFamilies(1)),
  7669  		},
  7670  		update: svcTestCase{
  7671  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7672  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7673  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  7674  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7675  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7676  			expectClusterIPs: true,
  7677  			prove:            prove(proveNumFamilies(2)),
  7678  		},
  7679  	}, {
  7680  		name: "policy:require_families:nil_ips:nil",
  7681  		line: line(),
  7682  		create: svcTestCase{
  7683  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7684  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7685  				svctest.SetClusterIPs("10.0.0.1")),
  7686  			expectClusterIPs: true,
  7687  			prove:            prove(proveNumFamilies(1)),
  7688  		},
  7689  		update: svcTestCase{
  7690  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7691  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7692  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  7693  			expectClusterIPs: true,
  7694  			prove:            prove(proveNumFamilies(2)),
  7695  		},
  7696  	}, {
  7697  		name: "policy:require_families:nil_ips:single",
  7698  		line: line(),
  7699  		create: svcTestCase{
  7700  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7701  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7702  				svctest.SetClusterIPs("10.0.0.1")),
  7703  			expectClusterIPs: true,
  7704  			prove:            prove(proveNumFamilies(1)),
  7705  		},
  7706  		update: svcTestCase{
  7707  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7708  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7709  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7710  				svctest.SetClusterIPs("10.0.0.1")),
  7711  			expectClusterIPs: true,
  7712  			prove:            prove(proveNumFamilies(2)),
  7713  		},
  7714  	}, {
  7715  		name: "policy:require_families:nil_ips:dual",
  7716  		line: line(),
  7717  		create: svcTestCase{
  7718  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7719  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7720  				svctest.SetClusterIPs("10.0.0.1")),
  7721  			expectClusterIPs: true,
  7722  			prove:            prove(proveNumFamilies(1)),
  7723  		},
  7724  		update: svcTestCase{
  7725  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7726  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7727  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7728  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7729  			expectClusterIPs: true,
  7730  			prove:            prove(proveNumFamilies(2)),
  7731  		},
  7732  	}, {
  7733  		name: "policy:require_families:single_ips:nil",
  7734  		line: line(),
  7735  		create: svcTestCase{
  7736  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7737  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7738  				svctest.SetClusterIPs("10.0.0.1")),
  7739  			expectClusterIPs: true,
  7740  			prove:            prove(proveNumFamilies(1)),
  7741  		},
  7742  		update: svcTestCase{
  7743  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7744  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7745  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7746  				svctest.SetIPFamilies(api.IPv4Protocol)),
  7747  			expectClusterIPs: true,
  7748  			prove:            prove(proveNumFamilies(2)),
  7749  		},
  7750  	}, {
  7751  		name: "policy:require_families:single_ips:single",
  7752  		line: line(),
  7753  		create: svcTestCase{
  7754  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7755  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7756  				svctest.SetClusterIPs("10.0.0.1")),
  7757  			expectClusterIPs: true,
  7758  			prove:            prove(proveNumFamilies(1)),
  7759  		},
  7760  		update: svcTestCase{
  7761  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7762  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7763  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7764  				svctest.SetIPFamilies(api.IPv4Protocol),
  7765  				svctest.SetClusterIPs("10.0.0.1")),
  7766  			expectClusterIPs: true,
  7767  			prove:            prove(proveNumFamilies(2)),
  7768  		},
  7769  	}, {
  7770  		name: "policy:require_families:single_ips:dual",
  7771  		line: line(),
  7772  		create: svcTestCase{
  7773  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7774  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7775  				svctest.SetClusterIPs("10.0.0.1")),
  7776  			expectClusterIPs: true,
  7777  			prove:            prove(proveNumFamilies(1)),
  7778  		},
  7779  		update: svcTestCase{
  7780  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7781  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7782  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7783  				svctest.SetIPFamilies(api.IPv4Protocol),
  7784  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7785  			expectClusterIPs: true,
  7786  			prove:            prove(proveNumFamilies(2)),
  7787  		},
  7788  	}, {
  7789  		name: "policy:require_families:dual_ips:nil",
  7790  		line: line(),
  7791  		create: svcTestCase{
  7792  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7793  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7794  				svctest.SetClusterIPs("10.0.0.1")),
  7795  			expectClusterIPs: true,
  7796  			prove:            prove(proveNumFamilies(1)),
  7797  		},
  7798  		update: svcTestCase{
  7799  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7800  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7801  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7802  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  7803  			expectClusterIPs: true,
  7804  			prove:            prove(proveNumFamilies(2)),
  7805  		},
  7806  	}, {
  7807  		name: "policy:require_families:dual_ips:single",
  7808  		line: line(),
  7809  		create: svcTestCase{
  7810  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7811  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7812  				svctest.SetClusterIPs("10.0.0.1")),
  7813  			expectClusterIPs: true,
  7814  			prove:            prove(proveNumFamilies(1)),
  7815  		},
  7816  		update: svcTestCase{
  7817  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7818  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7819  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7820  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7821  				svctest.SetClusterIPs("10.0.0.1")),
  7822  			expectClusterIPs: true,
  7823  			prove:            prove(proveNumFamilies(2)),
  7824  		},
  7825  	}, {
  7826  		name: "policy:require_families:dual_ips:dual",
  7827  		line: line(),
  7828  		create: svcTestCase{
  7829  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7830  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7831  				svctest.SetClusterIPs("10.0.0.1")),
  7832  			expectClusterIPs: true,
  7833  			prove:            prove(proveNumFamilies(1)),
  7834  		},
  7835  		update: svcTestCase{
  7836  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7837  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7838  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7839  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7840  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7841  			expectClusterIPs: true,
  7842  			prove:            prove(proveNumFamilies(2)),
  7843  		},
  7844  	}, {
  7845  		name: "single-dual_wrong_order_families",
  7846  		line: line(),
  7847  		create: svcTestCase{
  7848  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7849  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7850  				svctest.SetClusterIPs("10.0.0.1")),
  7851  			expectClusterIPs: true,
  7852  			prove:            prove(proveNumFamilies(1)),
  7853  		},
  7854  		update: svcTestCase{
  7855  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7856  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7857  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  7858  			expectError: true,
  7859  		},
  7860  	}, {
  7861  		name: "single-dual_wrong_order_ips",
  7862  		line: line(),
  7863  		create: svcTestCase{
  7864  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7865  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7866  				svctest.SetClusterIPs("10.0.0.1")),
  7867  			expectClusterIPs: true,
  7868  			prove:            prove(proveNumFamilies(1)),
  7869  		},
  7870  		update: svcTestCase{
  7871  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7872  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7873  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  7874  			expectError: true,
  7875  		},
  7876  	}, {
  7877  		name: "single-dual_ip_in_use",
  7878  		line: line(),
  7879  		create: svcTestCase{
  7880  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7881  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7882  				svctest.SetClusterIPs("10.0.0.1")),
  7883  			expectClusterIPs: true,
  7884  			prove:            prove(proveNumFamilies(1)),
  7885  		},
  7886  		beforeUpdate: func(t *testing.T, storage *wrapperRESTForTests) {
  7887  			alloc := storage.alloc.serviceIPAllocatorsByFamily[api.IPv6Protocol]
  7888  			ip := "2000::1"
  7889  			if err := alloc.Allocate(netutils.ParseIPSloppy(ip)); err != nil {
  7890  				t.Fatalf("test is incorrect, unable to preallocate IP %q: %v", ip, err)
  7891  			}
  7892  		},
  7893  		update: svcTestCase{
  7894  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7895  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7896  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  7897  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  7898  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  7899  			expectError: true,
  7900  		},
  7901  	}}
  7902  
  7903  	t.Run("dualstack:v4v6", func(t *testing.T) {
  7904  		helpTestCreateUpdateDeleteWithFamilies(t, testCasesV4V6, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
  7905  	})
  7906  
  7907  	// Dual-stack v6,v4 cases: Covers the full matrix of:
  7908  	//    policy={nil, single, prefer, require}
  7909  	//    families={nil, single, dual}
  7910  	//    ips={nil, single, dual}
  7911  	testCasesV6V4 := []cudTestCase{{
  7912  		name: "policy:nil_families:nil_ips:nil",
  7913  		line: line(),
  7914  		create: svcTestCase{
  7915  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7916  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7917  				svctest.SetClusterIPs("2000::1")),
  7918  			expectClusterIPs: true,
  7919  			prove:            prove(proveNumFamilies(1)),
  7920  		},
  7921  		update: svcTestCase{
  7922  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7923  				svctest.SetSelector(map[string]string{"k2": "v2"})),
  7924  			expectClusterIPs: true,
  7925  			prove:            prove(proveNumFamilies(1)),
  7926  		},
  7927  	}, {
  7928  		name: "policy:nil_families:nil_ips:single",
  7929  		line: line(),
  7930  		create: svcTestCase{
  7931  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7932  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7933  				svctest.SetClusterIPs("2000::1")),
  7934  			expectClusterIPs: true,
  7935  			prove:            prove(proveNumFamilies(1)),
  7936  		},
  7937  		update: svcTestCase{
  7938  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7939  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7940  				svctest.SetClusterIPs("2000::1")),
  7941  			expectClusterIPs: true,
  7942  			prove:            prove(proveNumFamilies(1)),
  7943  		},
  7944  	}, {
  7945  		name: "policy:nil_families:nil_ips:dual",
  7946  		line: line(),
  7947  		create: svcTestCase{
  7948  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7949  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7950  				svctest.SetClusterIPs("2000::1")),
  7951  			expectClusterIPs: true,
  7952  			prove:            prove(proveNumFamilies(1)),
  7953  		},
  7954  		update: svcTestCase{
  7955  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7956  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7957  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  7958  			expectError: true,
  7959  		},
  7960  	}, {
  7961  		name: "policy:nil_families:single_ips:nil",
  7962  		line: line(),
  7963  		create: svcTestCase{
  7964  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7965  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7966  				svctest.SetClusterIPs("2000::1")),
  7967  			expectClusterIPs: true,
  7968  			prove:            prove(proveNumFamilies(1)),
  7969  		},
  7970  		update: svcTestCase{
  7971  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7972  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7973  				svctest.SetIPFamilies(api.IPv6Protocol)),
  7974  			expectClusterIPs: true,
  7975  			prove:            prove(proveNumFamilies(1)),
  7976  		},
  7977  	}, {
  7978  		name: "policy:nil_families:single_ips:single",
  7979  		line: line(),
  7980  		create: svcTestCase{
  7981  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7982  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  7983  				svctest.SetClusterIPs("2000::1")),
  7984  			expectClusterIPs: true,
  7985  			prove:            prove(proveNumFamilies(1)),
  7986  		},
  7987  		update: svcTestCase{
  7988  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  7989  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  7990  				svctest.SetIPFamilies(api.IPv6Protocol),
  7991  				svctest.SetClusterIPs("2000::1")),
  7992  			expectClusterIPs: true,
  7993  			prove:            prove(proveNumFamilies(1)),
  7994  		},
  7995  	}, {
  7996  		name: "policy:nil_families:single_ips:dual",
  7997  		line: line(),
  7998  		create: svcTestCase{
  7999  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8000  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8001  				svctest.SetClusterIPs("2000::1")),
  8002  			expectClusterIPs: true,
  8003  			prove:            prove(proveNumFamilies(1)),
  8004  		},
  8005  		update: svcTestCase{
  8006  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8007  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8008  				svctest.SetIPFamilies(api.IPv6Protocol),
  8009  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8010  			expectError: true,
  8011  		},
  8012  	}, {
  8013  		name: "policy:nil_families:dual_ips:nil",
  8014  		line: line(),
  8015  		create: svcTestCase{
  8016  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8017  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8018  				svctest.SetClusterIPs("2000::1")),
  8019  			expectClusterIPs: true,
  8020  			prove:            prove(proveNumFamilies(1)),
  8021  		},
  8022  		update: svcTestCase{
  8023  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8024  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8025  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  8026  			expectError: true,
  8027  		},
  8028  	}, {
  8029  		name: "policy:nil_families:dual_ips:single",
  8030  		line: line(),
  8031  		create: svcTestCase{
  8032  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8033  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8034  				svctest.SetClusterIPs("2000::1")),
  8035  			expectClusterIPs: true,
  8036  			prove:            prove(proveNumFamilies(1)),
  8037  		},
  8038  		update: svcTestCase{
  8039  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8040  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8041  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8042  				svctest.SetClusterIPs("2000::1")),
  8043  			expectError: true,
  8044  		},
  8045  	}, {
  8046  		name: "policy:nil_families:dual_ips:dual",
  8047  		line: line(),
  8048  		create: svcTestCase{
  8049  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8050  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8051  				svctest.SetClusterIPs("2000::1")),
  8052  			expectClusterIPs: true,
  8053  			prove:            prove(proveNumFamilies(1)),
  8054  		},
  8055  		update: svcTestCase{
  8056  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8057  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8058  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8059  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8060  			expectError: true,
  8061  		},
  8062  	}, {
  8063  		name: "policy:single_families:nil_ips:nil",
  8064  		line: line(),
  8065  		create: svcTestCase{
  8066  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8067  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8068  				svctest.SetClusterIPs("2000::1")),
  8069  			expectClusterIPs: true,
  8070  			prove:            prove(proveNumFamilies(1)),
  8071  		},
  8072  		update: svcTestCase{
  8073  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8074  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8075  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  8076  			expectClusterIPs: true,
  8077  			prove:            prove(proveNumFamilies(1)),
  8078  		},
  8079  	}, {
  8080  		name: "policy:single_families:nil_ips:single",
  8081  		line: line(),
  8082  		create: svcTestCase{
  8083  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8084  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8085  				svctest.SetClusterIPs("2000::1")),
  8086  			expectClusterIPs: true,
  8087  			prove:            prove(proveNumFamilies(1)),
  8088  		},
  8089  		update: svcTestCase{
  8090  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8091  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8092  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8093  				svctest.SetClusterIPs("2000::1")),
  8094  			expectClusterIPs: true,
  8095  			prove:            prove(proveNumFamilies(1)),
  8096  		},
  8097  	}, {
  8098  		name: "policy:single_families:nil_ips:dual",
  8099  		line: line(),
  8100  		create: svcTestCase{
  8101  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8102  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8103  				svctest.SetClusterIPs("2000::1")),
  8104  			expectClusterIPs: true,
  8105  			prove:            prove(proveNumFamilies(1)),
  8106  		},
  8107  		update: svcTestCase{
  8108  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8109  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8110  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8111  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8112  			expectError: true,
  8113  		},
  8114  	}, {
  8115  		name: "policy:single_families:single_ips:nil",
  8116  		line: line(),
  8117  		create: svcTestCase{
  8118  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8119  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8120  				svctest.SetClusterIPs("2000::1")),
  8121  			expectClusterIPs: true,
  8122  			prove:            prove(proveNumFamilies(1)),
  8123  		},
  8124  		update: svcTestCase{
  8125  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8126  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8127  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8128  				svctest.SetIPFamilies(api.IPv6Protocol)),
  8129  			expectClusterIPs: true,
  8130  			prove:            prove(proveNumFamilies(1)),
  8131  		},
  8132  	}, {
  8133  		name: "policy:single_families:single_ips:single",
  8134  		line: line(),
  8135  		create: svcTestCase{
  8136  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8137  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8138  				svctest.SetClusterIPs("2000::1")),
  8139  			expectClusterIPs: true,
  8140  			prove:            prove(proveNumFamilies(1)),
  8141  		},
  8142  		update: svcTestCase{
  8143  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8144  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8145  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8146  				svctest.SetIPFamilies(api.IPv6Protocol),
  8147  				svctest.SetClusterIPs("2000::1")),
  8148  			expectClusterIPs: true,
  8149  			prove:            prove(proveNumFamilies(1)),
  8150  		},
  8151  	}, {
  8152  		name: "policy:single_families:single_ips:dual",
  8153  		line: line(),
  8154  		create: svcTestCase{
  8155  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8156  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8157  				svctest.SetClusterIPs("2000::1")),
  8158  			expectClusterIPs: true,
  8159  			prove:            prove(proveNumFamilies(1)),
  8160  		},
  8161  		update: svcTestCase{
  8162  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8163  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8164  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8165  				svctest.SetIPFamilies(api.IPv6Protocol),
  8166  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8167  			expectError: true,
  8168  		},
  8169  	}, {
  8170  		name: "policy:single_families:dual_ips:nil",
  8171  		line: line(),
  8172  		create: svcTestCase{
  8173  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8174  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8175  				svctest.SetClusterIPs("2000::1")),
  8176  			expectClusterIPs: true,
  8177  			prove:            prove(proveNumFamilies(1)),
  8178  		},
  8179  		update: svcTestCase{
  8180  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8181  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8182  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8183  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  8184  			expectError: true,
  8185  		},
  8186  	}, {
  8187  		name: "policy:single_families:dual_ips:single",
  8188  		line: line(),
  8189  		create: svcTestCase{
  8190  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8191  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8192  				svctest.SetClusterIPs("2000::1")),
  8193  			expectClusterIPs: true,
  8194  			prove:            prove(proveNumFamilies(1)),
  8195  		},
  8196  		update: svcTestCase{
  8197  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8198  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8199  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8200  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8201  				svctest.SetClusterIPs("2000::1")),
  8202  			expectError: true,
  8203  		},
  8204  	}, {
  8205  		name: "policy:single_families:dual_ips:dual",
  8206  		line: line(),
  8207  		create: svcTestCase{
  8208  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8209  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8210  				svctest.SetClusterIPs("2000::1")),
  8211  			expectClusterIPs: true,
  8212  			prove:            prove(proveNumFamilies(1)),
  8213  		},
  8214  		update: svcTestCase{
  8215  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8216  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8217  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8218  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8219  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8220  			expectError: true,
  8221  		},
  8222  	}, {
  8223  		name: "policy:prefer_families:nil_ips:nil",
  8224  		line: line(),
  8225  		create: svcTestCase{
  8226  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8227  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8228  				svctest.SetClusterIPs("2000::1")),
  8229  			expectClusterIPs: true,
  8230  			prove:            prove(proveNumFamilies(1)),
  8231  		},
  8232  		update: svcTestCase{
  8233  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8234  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8235  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  8236  			expectClusterIPs: true,
  8237  			prove:            prove(proveNumFamilies(2)),
  8238  		},
  8239  	}, {
  8240  		name: "policy:prefer_families:nil_ips:single",
  8241  		line: line(),
  8242  		create: svcTestCase{
  8243  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8244  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8245  				svctest.SetClusterIPs("2000::1")),
  8246  			expectClusterIPs: true,
  8247  			prove:            prove(proveNumFamilies(1)),
  8248  		},
  8249  		update: svcTestCase{
  8250  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8251  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8252  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8253  				svctest.SetClusterIPs("2000::1")),
  8254  			expectClusterIPs: true,
  8255  			prove:            prove(proveNumFamilies(2)),
  8256  		},
  8257  	}, {
  8258  		name: "policy:prefer_families:nil_ips:dual",
  8259  		line: line(),
  8260  		create: svcTestCase{
  8261  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8262  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8263  				svctest.SetClusterIPs("2000::1")),
  8264  			expectClusterIPs: true,
  8265  			prove:            prove(proveNumFamilies(1)),
  8266  		},
  8267  		update: svcTestCase{
  8268  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8269  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8270  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8271  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8272  			expectClusterIPs: true,
  8273  			prove:            prove(proveNumFamilies(2)),
  8274  		},
  8275  	}, {
  8276  		name: "policy:prefer_families:single_ips:nil",
  8277  		line: line(),
  8278  		create: svcTestCase{
  8279  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8280  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8281  				svctest.SetClusterIPs("2000::1")),
  8282  			expectClusterIPs: true,
  8283  			prove:            prove(proveNumFamilies(1)),
  8284  		},
  8285  		update: svcTestCase{
  8286  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8287  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8288  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8289  				svctest.SetIPFamilies(api.IPv6Protocol)),
  8290  			expectClusterIPs: true,
  8291  			prove:            prove(proveNumFamilies(2)),
  8292  		},
  8293  	}, {
  8294  		name: "policy:prefer_families:single_ips:single",
  8295  		line: line(),
  8296  		create: svcTestCase{
  8297  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8298  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8299  				svctest.SetClusterIPs("2000::1")),
  8300  			expectClusterIPs: true,
  8301  			prove:            prove(proveNumFamilies(1)),
  8302  		},
  8303  		update: svcTestCase{
  8304  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8305  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8306  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8307  				svctest.SetIPFamilies(api.IPv6Protocol),
  8308  				svctest.SetClusterIPs("2000::1")),
  8309  			expectClusterIPs: true,
  8310  			prove:            prove(proveNumFamilies(2)),
  8311  		},
  8312  	}, {
  8313  		name: "policy:prefer_families:single_ips:dual",
  8314  		line: line(),
  8315  		create: svcTestCase{
  8316  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8317  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8318  				svctest.SetClusterIPs("2000::1")),
  8319  			expectClusterIPs: true,
  8320  			prove:            prove(proveNumFamilies(1)),
  8321  		},
  8322  		update: svcTestCase{
  8323  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8324  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8325  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8326  				svctest.SetIPFamilies(api.IPv6Protocol),
  8327  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8328  			expectClusterIPs: true,
  8329  			prove:            prove(proveNumFamilies(2)),
  8330  		},
  8331  	}, {
  8332  		name: "policy:prefer_families:dual_ips:nil",
  8333  		line: line(),
  8334  		create: svcTestCase{
  8335  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8336  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8337  				svctest.SetClusterIPs("2000::1")),
  8338  			expectClusterIPs: true,
  8339  			prove:            prove(proveNumFamilies(1)),
  8340  		},
  8341  		update: svcTestCase{
  8342  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8343  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8344  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8345  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  8346  			expectClusterIPs: true,
  8347  			prove:            prove(proveNumFamilies(2)),
  8348  		},
  8349  	}, {
  8350  		name: "policy:prefer_families:dual_ips:single",
  8351  		line: line(),
  8352  		create: svcTestCase{
  8353  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8354  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8355  				svctest.SetClusterIPs("2000::1")),
  8356  			expectClusterIPs: true,
  8357  			prove:            prove(proveNumFamilies(1)),
  8358  		},
  8359  		update: svcTestCase{
  8360  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8361  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8362  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8363  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8364  				svctest.SetClusterIPs("2000::1")),
  8365  			expectClusterIPs: true,
  8366  			prove:            prove(proveNumFamilies(2)),
  8367  		},
  8368  	}, {
  8369  		name: "policy:prefer_families:dual_ips:dual",
  8370  		line: line(),
  8371  		create: svcTestCase{
  8372  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8373  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8374  				svctest.SetClusterIPs("2000::1")),
  8375  			expectClusterIPs: true,
  8376  			prove:            prove(proveNumFamilies(1)),
  8377  		},
  8378  		update: svcTestCase{
  8379  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8380  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8381  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8382  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8383  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8384  			expectClusterIPs: true,
  8385  			prove:            prove(proveNumFamilies(2)),
  8386  		},
  8387  	}, {
  8388  		name: "policy:require_families:nil_ips:nil",
  8389  		line: line(),
  8390  		create: svcTestCase{
  8391  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8392  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8393  				svctest.SetClusterIPs("2000::1")),
  8394  			expectClusterIPs: true,
  8395  			prove:            prove(proveNumFamilies(1)),
  8396  		},
  8397  		update: svcTestCase{
  8398  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8399  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8400  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  8401  			expectClusterIPs: true,
  8402  			prove:            prove(proveNumFamilies(2)),
  8403  		},
  8404  	}, {
  8405  		name: "policy:require_families:nil_ips:single",
  8406  		line: line(),
  8407  		create: svcTestCase{
  8408  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8409  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8410  				svctest.SetClusterIPs("2000::1")),
  8411  			expectClusterIPs: true,
  8412  			prove:            prove(proveNumFamilies(1)),
  8413  		},
  8414  		update: svcTestCase{
  8415  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8416  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8417  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8418  				svctest.SetClusterIPs("2000::1")),
  8419  			expectClusterIPs: true,
  8420  			prove:            prove(proveNumFamilies(2)),
  8421  		},
  8422  	}, {
  8423  		name: "policy:require_families:nil_ips:dual",
  8424  		line: line(),
  8425  		create: svcTestCase{
  8426  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8427  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8428  				svctest.SetClusterIPs("2000::1")),
  8429  			expectClusterIPs: true,
  8430  			prove:            prove(proveNumFamilies(1)),
  8431  		},
  8432  		update: svcTestCase{
  8433  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8434  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8435  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8436  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8437  			expectClusterIPs: true,
  8438  			prove:            prove(proveNumFamilies(2)),
  8439  		},
  8440  	}, {
  8441  		name: "policy:require_families:single_ips:nil",
  8442  		line: line(),
  8443  		create: svcTestCase{
  8444  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8445  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8446  				svctest.SetClusterIPs("2000::1")),
  8447  			expectClusterIPs: true,
  8448  			prove:            prove(proveNumFamilies(1)),
  8449  		},
  8450  		update: svcTestCase{
  8451  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8452  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8453  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8454  				svctest.SetIPFamilies(api.IPv6Protocol)),
  8455  			expectClusterIPs: true,
  8456  			prove:            prove(proveNumFamilies(2)),
  8457  		},
  8458  	}, {
  8459  		name: "policy:require_families:single_ips:single",
  8460  		line: line(),
  8461  		create: svcTestCase{
  8462  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8463  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8464  				svctest.SetClusterIPs("2000::1")),
  8465  			expectClusterIPs: true,
  8466  			prove:            prove(proveNumFamilies(1)),
  8467  		},
  8468  		update: svcTestCase{
  8469  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8470  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8471  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8472  				svctest.SetIPFamilies(api.IPv6Protocol),
  8473  				svctest.SetClusterIPs("2000::1")),
  8474  			expectClusterIPs: true,
  8475  			prove:            prove(proveNumFamilies(2)),
  8476  		},
  8477  	}, {
  8478  		name: "policy:require_families:single_ips:dual",
  8479  		line: line(),
  8480  		create: svcTestCase{
  8481  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8482  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8483  				svctest.SetClusterIPs("2000::1")),
  8484  			expectClusterIPs: true,
  8485  			prove:            prove(proveNumFamilies(1)),
  8486  		},
  8487  		update: svcTestCase{
  8488  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8489  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8490  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8491  				svctest.SetIPFamilies(api.IPv6Protocol),
  8492  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8493  			expectClusterIPs: true,
  8494  			prove:            prove(proveNumFamilies(2)),
  8495  		},
  8496  	}, {
  8497  		name: "policy:require_families:dual_ips:nil",
  8498  		line: line(),
  8499  		create: svcTestCase{
  8500  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8501  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8502  				svctest.SetClusterIPs("2000::1")),
  8503  			expectClusterIPs: true,
  8504  			prove:            prove(proveNumFamilies(1)),
  8505  		},
  8506  		update: svcTestCase{
  8507  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8508  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8509  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8510  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  8511  			expectClusterIPs: true,
  8512  			prove:            prove(proveNumFamilies(2)),
  8513  		},
  8514  	}, {
  8515  		name: "policy:require_families:dual_ips:single",
  8516  		line: line(),
  8517  		create: svcTestCase{
  8518  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8519  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8520  				svctest.SetClusterIPs("2000::1")),
  8521  			expectClusterIPs: true,
  8522  			prove:            prove(proveNumFamilies(1)),
  8523  		},
  8524  		update: svcTestCase{
  8525  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8526  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8527  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8528  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8529  				svctest.SetClusterIPs("2000::1")),
  8530  			expectClusterIPs: true,
  8531  			prove:            prove(proveNumFamilies(2)),
  8532  		},
  8533  	}, {
  8534  		name: "policy:require_families:dual_ips:dual",
  8535  		line: line(),
  8536  		create: svcTestCase{
  8537  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8538  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8539  				svctest.SetClusterIPs("2000::1")),
  8540  			expectClusterIPs: true,
  8541  			prove:            prove(proveNumFamilies(1)),
  8542  		},
  8543  		update: svcTestCase{
  8544  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8545  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8546  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8547  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  8548  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8549  			expectClusterIPs: true,
  8550  			prove:            prove(proveNumFamilies(2)),
  8551  		},
  8552  	}, {
  8553  		name: "single-dual_wrong_order_families",
  8554  		line: line(),
  8555  		create: svcTestCase{
  8556  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8557  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8558  				svctest.SetClusterIPs("2000::1")),
  8559  			expectClusterIPs: true,
  8560  			prove:            prove(proveNumFamilies(1)),
  8561  		},
  8562  		update: svcTestCase{
  8563  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8564  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8565  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  8566  			expectError: true,
  8567  		},
  8568  	}, {
  8569  		name: "single-dual_wrong_order_ips",
  8570  		line: line(),
  8571  		create: svcTestCase{
  8572  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8573  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8574  				svctest.SetClusterIPs("2000::1")),
  8575  			expectClusterIPs: true,
  8576  			prove:            prove(proveNumFamilies(1)),
  8577  		},
  8578  		update: svcTestCase{
  8579  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8580  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8581  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8582  			expectError: true,
  8583  		},
  8584  	}, {
  8585  		name: "single-dual_ip_in_use",
  8586  		line: line(),
  8587  		create: svcTestCase{
  8588  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8589  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8590  				svctest.SetClusterIPs("2000::1")),
  8591  			expectClusterIPs: true,
  8592  			prove:            prove(proveNumFamilies(1)),
  8593  		},
  8594  		beforeUpdate: func(t *testing.T, storage *wrapperRESTForTests) {
  8595  			alloc := storage.alloc.serviceIPAllocatorsByFamily[api.IPv4Protocol]
  8596  			ip := "10.0.0.1"
  8597  			if err := alloc.Allocate(netutils.ParseIPSloppy(ip)); err != nil {
  8598  				t.Fatalf("test is incorrect, unable to preallocate IP %q: %v", ip, err)
  8599  			}
  8600  		},
  8601  		update: svcTestCase{
  8602  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8603  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8604  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8605  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  8606  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  8607  			expectError: true,
  8608  		},
  8609  	}}
  8610  
  8611  	t.Run("dualstack:v6v4", func(t *testing.T) {
  8612  		helpTestCreateUpdateDeleteWithFamilies(t, testCasesV6V4, []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol})
  8613  	})
  8614  
  8615  	// Headless cases: Covers the full matrix of:
  8616  	//    policy={nil, single, prefer, require}
  8617  	//    families={nil, single, dual}
  8618  	testCasesHeadless := []cudTestCase{{
  8619  		name: "policy:nil_families:nil",
  8620  		line: line(),
  8621  		create: svcTestCase{
  8622  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8623  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8624  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8625  			expectHeadless: true,
  8626  			prove:          prove(proveNumFamilies(1)),
  8627  		},
  8628  		update: svcTestCase{
  8629  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8630  				svctest.SetSelector(map[string]string{"k2": "v2"})),
  8631  			expectHeadless: true,
  8632  			prove:          prove(proveNumFamilies(1)),
  8633  		},
  8634  	}, {
  8635  		name: "policy:nil_families:single",
  8636  		line: line(),
  8637  		create: svcTestCase{
  8638  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8639  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8640  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8641  			expectHeadless: true,
  8642  			prove:          prove(proveNumFamilies(1)),
  8643  		},
  8644  		update: svcTestCase{
  8645  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8646  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8647  				svctest.SetIPFamilies("IPv4")),
  8648  			expectHeadless: true,
  8649  			prove:          prove(proveNumFamilies(1)),
  8650  		},
  8651  	}, {
  8652  		name: "policy:nil_families:dual",
  8653  		line: line(),
  8654  		create: svcTestCase{
  8655  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8656  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8657  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8658  			expectHeadless: true,
  8659  			prove:          prove(proveNumFamilies(1)),
  8660  		},
  8661  		update: svcTestCase{
  8662  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8663  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8664  				svctest.SetIPFamilies("IPv4", "IPv6")),
  8665  			expectError: true,
  8666  		},
  8667  	}, {
  8668  		name: "policy:single_families:nil",
  8669  		line: line(),
  8670  		create: svcTestCase{
  8671  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8672  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8673  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8674  			expectHeadless: true,
  8675  			prove:          prove(proveNumFamilies(1)),
  8676  		},
  8677  		update: svcTestCase{
  8678  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8679  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8680  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  8681  			expectHeadless: true,
  8682  			prove:          prove(proveNumFamilies(1)),
  8683  		},
  8684  	}, {
  8685  		name: "policy:single_families:single",
  8686  		line: line(),
  8687  		create: svcTestCase{
  8688  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8689  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8690  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8691  			expectHeadless: true,
  8692  			prove:          prove(proveNumFamilies(1)),
  8693  		},
  8694  		update: svcTestCase{
  8695  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8696  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8697  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8698  				svctest.SetIPFamilies("IPv4")),
  8699  			expectHeadless: true,
  8700  			prove:          prove(proveNumFamilies(1)),
  8701  		},
  8702  	}, {
  8703  		name: "policy:single_families:dual",
  8704  		line: line(),
  8705  		create: svcTestCase{
  8706  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8707  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8708  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8709  			expectHeadless: true,
  8710  			prove:          prove(proveNumFamilies(1)),
  8711  		},
  8712  		update: svcTestCase{
  8713  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8714  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8715  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8716  				svctest.SetIPFamilies("IPv4", "IPv6")),
  8717  			expectError: true,
  8718  		},
  8719  	}, {
  8720  		name: "policy:prefer_families:nil",
  8721  		line: line(),
  8722  		create: svcTestCase{
  8723  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8724  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8725  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8726  			expectHeadless: true,
  8727  			prove:          prove(proveNumFamilies(1)),
  8728  		},
  8729  		update: svcTestCase{
  8730  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8731  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8732  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  8733  			expectHeadless: true,
  8734  			prove:          prove(proveNumFamilies(2)),
  8735  		},
  8736  	}, {
  8737  		name: "policy:prefer_families:single",
  8738  		line: line(),
  8739  		create: svcTestCase{
  8740  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8741  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8742  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8743  			expectHeadless: true,
  8744  			prove:          prove(proveNumFamilies(1)),
  8745  		},
  8746  		update: svcTestCase{
  8747  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8748  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8749  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8750  				svctest.SetIPFamilies("IPv4")),
  8751  			expectHeadless: true,
  8752  			prove:          prove(proveNumFamilies(2)),
  8753  		},
  8754  	}, {
  8755  		name: "policy:prefer_families:dual",
  8756  		line: line(),
  8757  		create: svcTestCase{
  8758  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8759  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8760  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8761  			expectHeadless: true,
  8762  			prove:          prove(proveNumFamilies(1)),
  8763  		},
  8764  		update: svcTestCase{
  8765  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8766  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8767  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  8768  				svctest.SetIPFamilies("IPv4", "IPv6")),
  8769  			expectHeadless: true,
  8770  			prove:          prove(proveNumFamilies(2)),
  8771  		},
  8772  	}, {
  8773  		name: "policy:require_families:nil",
  8774  		line: line(),
  8775  		create: svcTestCase{
  8776  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8777  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8778  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8779  			expectHeadless: true,
  8780  			prove:          prove(proveNumFamilies(1)),
  8781  		},
  8782  		update: svcTestCase{
  8783  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8784  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8785  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  8786  			expectHeadless: true,
  8787  			prove:          prove(proveNumFamilies(2)),
  8788  		},
  8789  	}, {
  8790  		name: "policy:require_families:single",
  8791  		line: line(),
  8792  		create: svcTestCase{
  8793  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8794  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8795  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8796  			expectHeadless: true,
  8797  			prove:          prove(proveNumFamilies(1)),
  8798  		},
  8799  		update: svcTestCase{
  8800  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8801  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8802  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8803  				svctest.SetIPFamilies("IPv4")),
  8804  			expectHeadless: true,
  8805  			prove:          prove(proveNumFamilies(2)),
  8806  		},
  8807  	}, {
  8808  		name: "policy:require_families:dual",
  8809  		line: line(),
  8810  		create: svcTestCase{
  8811  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8812  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  8813  				svctest.SetClusterIPs(api.ClusterIPNone)),
  8814  			expectHeadless: true,
  8815  			prove:          prove(proveNumFamilies(1)),
  8816  		},
  8817  		update: svcTestCase{
  8818  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8819  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8820  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8821  				svctest.SetIPFamilies("IPv4", "IPv6")),
  8822  			expectHeadless: true,
  8823  			prove:          prove(proveNumFamilies(2)),
  8824  		},
  8825  	}}
  8826  
  8827  	t.Run("headless", func(t *testing.T) {
  8828  		helpTestCreateUpdateDeleteWithFamilies(t, testCasesHeadless, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
  8829  	})
  8830  }
  8831  
  8832  // Proves that updates from dual-stack.
  8833  func TestUpdateIPsFromDualStack(t *testing.T) {
  8834  	prove := func(proofs ...svcTestProof) []svcTestProof {
  8835  		return proofs
  8836  	}
  8837  	proveNumFamilies := func(n int) svcTestProof {
  8838  		return func(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
  8839  			t.Helper()
  8840  			if got := len(after.Spec.IPFamilies); got != n {
  8841  				t.Errorf("wrong number of ipFamilies: expected %d, got %d", n, got)
  8842  			}
  8843  		}
  8844  	}
  8845  
  8846  	// Dual-stack v4,v6 cases: Covers the full matrix of:
  8847  	//    policy={nil, single, prefer, require}
  8848  	//    families={nil, single, dual}
  8849  	//    ips={nil, single, dual}
  8850  	testCasesV4V6 := []cudTestCase{{
  8851  		name: "policy:nil_families:nil_ips:nil",
  8852  		line: line(),
  8853  		create: svcTestCase{
  8854  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8855  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8856  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8857  			expectClusterIPs: true,
  8858  			prove:            prove(proveNumFamilies(2)),
  8859  		},
  8860  		update: svcTestCase{
  8861  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8862  				svctest.SetSelector(map[string]string{"k2": "v2"})),
  8863  			expectClusterIPs: true,
  8864  			prove:            prove(proveNumFamilies(2)),
  8865  		},
  8866  	}, {
  8867  		name: "policy:nil_families:nil_ips:single",
  8868  		line: line(),
  8869  		create: svcTestCase{
  8870  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8871  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8872  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8873  			expectClusterIPs: true,
  8874  			prove:            prove(proveNumFamilies(2)),
  8875  		},
  8876  		update: svcTestCase{
  8877  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8878  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8879  				svctest.SetClusterIPs("10.0.0.1")),
  8880  			expectError: true,
  8881  		},
  8882  	}, {
  8883  		name: "policy:nil_families:nil_ips:dual",
  8884  		line: line(),
  8885  		create: svcTestCase{
  8886  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8887  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8888  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8889  			expectClusterIPs: true,
  8890  			prove:            prove(proveNumFamilies(2)),
  8891  		},
  8892  		update: svcTestCase{
  8893  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8894  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8895  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8896  			expectClusterIPs: true,
  8897  			prove:            prove(proveNumFamilies(2)),
  8898  		},
  8899  	}, {
  8900  		name: "policy:nil_families:single_ips:nil",
  8901  		line: line(),
  8902  		create: svcTestCase{
  8903  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8904  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8905  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8906  			expectClusterIPs: true,
  8907  			prove:            prove(proveNumFamilies(2)),
  8908  		},
  8909  		update: svcTestCase{
  8910  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8911  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8912  				svctest.SetIPFamilies(api.IPv4Protocol)),
  8913  			expectError: true,
  8914  		},
  8915  	}, {
  8916  		name: "policy:nil_families:single_ips:single",
  8917  		line: line(),
  8918  		create: svcTestCase{
  8919  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8920  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8921  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8922  			expectClusterIPs: true,
  8923  			prove:            prove(proveNumFamilies(2)),
  8924  		},
  8925  		update: svcTestCase{
  8926  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8927  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8928  				svctest.SetIPFamilies(api.IPv4Protocol),
  8929  				svctest.SetClusterIPs("10.0.0.1")),
  8930  			expectError: true,
  8931  		},
  8932  	}, {
  8933  		name: "policy:nil_families:single_ips:dual",
  8934  		line: line(),
  8935  		create: svcTestCase{
  8936  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8937  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8938  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8939  			expectClusterIPs: true,
  8940  			prove:            prove(proveNumFamilies(2)),
  8941  		},
  8942  		update: svcTestCase{
  8943  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8944  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8945  				svctest.SetIPFamilies(api.IPv4Protocol),
  8946  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8947  			expectError: true,
  8948  		},
  8949  	}, {
  8950  		name: "policy:nil_families:dual_ips:nil",
  8951  		line: line(),
  8952  		create: svcTestCase{
  8953  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8954  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8955  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8956  			expectClusterIPs: true,
  8957  			prove:            prove(proveNumFamilies(2)),
  8958  		},
  8959  		update: svcTestCase{
  8960  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8961  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8962  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  8963  			expectClusterIPs: true,
  8964  			prove:            prove(proveNumFamilies(2)),
  8965  		},
  8966  	}, {
  8967  		name: "policy:nil_families:dual_ips:single",
  8968  		line: line(),
  8969  		create: svcTestCase{
  8970  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8971  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8972  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8973  			expectClusterIPs: true,
  8974  			prove:            prove(proveNumFamilies(2)),
  8975  		},
  8976  		update: svcTestCase{
  8977  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8978  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8979  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  8980  				svctest.SetClusterIPs("10.0.0.1")),
  8981  			expectError: true,
  8982  		},
  8983  	}, {
  8984  		name: "policy:nil_families:dual_ips:dual",
  8985  		line: line(),
  8986  		create: svcTestCase{
  8987  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8988  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  8989  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8990  			expectClusterIPs: true,
  8991  			prove:            prove(proveNumFamilies(2)),
  8992  		},
  8993  		update: svcTestCase{
  8994  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  8995  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  8996  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  8997  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  8998  			expectClusterIPs: true,
  8999  			prove:            prove(proveNumFamilies(2)),
  9000  		},
  9001  	}, {
  9002  		name: "policy:single_families:nil_ips:nil",
  9003  		line: line(),
  9004  		create: svcTestCase{
  9005  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9006  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9007  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9008  			expectClusterIPs: true,
  9009  			prove:            prove(proveNumFamilies(2)),
  9010  		},
  9011  		update: svcTestCase{
  9012  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9013  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9014  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  9015  			expectClusterIPs: true,
  9016  			prove:            prove(proveNumFamilies(1)),
  9017  		},
  9018  	}, {
  9019  		name: "policy:single_families:nil_ips:single",
  9020  		line: line(),
  9021  		create: svcTestCase{
  9022  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9023  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9024  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9025  			expectClusterIPs: true,
  9026  			prove:            prove(proveNumFamilies(2)),
  9027  		},
  9028  		update: svcTestCase{
  9029  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9030  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9031  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9032  				svctest.SetClusterIPs("10.0.0.1")),
  9033  			expectClusterIPs: true,
  9034  			prove:            prove(proveNumFamilies(1)),
  9035  		},
  9036  	}, {
  9037  		name: "policy:single_families:nil_ips:dual",
  9038  		line: line(),
  9039  		create: svcTestCase{
  9040  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9041  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9042  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9043  			expectClusterIPs: true,
  9044  			prove:            prove(proveNumFamilies(2)),
  9045  		},
  9046  		update: svcTestCase{
  9047  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9048  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9049  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9050  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9051  			expectClusterIPs:     true,
  9052  			expectStackDowngrade: true,
  9053  			prove:                prove(proveNumFamilies(1)),
  9054  		},
  9055  	}, {
  9056  		name: "policy:single_families:single_ips:nil",
  9057  		line: line(),
  9058  		create: svcTestCase{
  9059  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9060  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9061  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9062  			expectClusterIPs: true,
  9063  			prove:            prove(proveNumFamilies(2)),
  9064  		},
  9065  		update: svcTestCase{
  9066  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9067  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9068  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9069  				svctest.SetIPFamilies(api.IPv4Protocol)),
  9070  			expectClusterIPs: true,
  9071  			prove:            prove(proveNumFamilies(1)),
  9072  		},
  9073  	}, {
  9074  		name: "policy:single_families:single_ips:single",
  9075  		line: line(),
  9076  		create: svcTestCase{
  9077  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9078  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9079  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9080  			expectClusterIPs: true,
  9081  			prove:            prove(proveNumFamilies(2)),
  9082  		},
  9083  		update: svcTestCase{
  9084  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9085  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9086  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9087  				svctest.SetIPFamilies(api.IPv4Protocol),
  9088  				svctest.SetClusterIPs("10.0.0.1")),
  9089  			expectClusterIPs: true,
  9090  			prove:            prove(proveNumFamilies(1)),
  9091  		},
  9092  	}, {
  9093  		name: "policy:single_families:single_ips:dual",
  9094  		line: line(),
  9095  		create: svcTestCase{
  9096  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9097  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9098  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9099  			expectClusterIPs: true,
  9100  			prove:            prove(proveNumFamilies(2)),
  9101  		},
  9102  		update: svcTestCase{
  9103  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9104  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9105  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9106  				svctest.SetIPFamilies(api.IPv4Protocol),
  9107  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9108  			expectClusterIPs:     true,
  9109  			expectStackDowngrade: true,
  9110  			prove:                prove(proveNumFamilies(1)),
  9111  		},
  9112  	}, {
  9113  		name: "policy:single_families:dual_ips:nil",
  9114  		line: line(),
  9115  		create: svcTestCase{
  9116  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9117  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9118  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9119  			expectClusterIPs: true,
  9120  			prove:            prove(proveNumFamilies(2)),
  9121  		},
  9122  		update: svcTestCase{
  9123  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9124  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9125  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9126  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  9127  			expectClusterIPs:     true,
  9128  			expectStackDowngrade: true,
  9129  			prove:                prove(proveNumFamilies(1)),
  9130  		},
  9131  	}, {
  9132  		name: "policy:single_families:dual_ips:single",
  9133  		line: line(),
  9134  		create: svcTestCase{
  9135  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9136  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9137  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9138  			expectClusterIPs: true,
  9139  			prove:            prove(proveNumFamilies(2)),
  9140  		},
  9141  		update: svcTestCase{
  9142  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9143  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9144  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9145  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  9146  				svctest.SetClusterIPs("10.0.0.1")),
  9147  			expectClusterIPs:     true,
  9148  			expectStackDowngrade: true,
  9149  			prove:                prove(proveNumFamilies(1)),
  9150  		},
  9151  	}, {
  9152  		name: "policy:single_families:dual_ips:dual",
  9153  		line: line(),
  9154  		create: svcTestCase{
  9155  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9156  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9157  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9158  			expectClusterIPs: true,
  9159  			prove:            prove(proveNumFamilies(2)),
  9160  		},
  9161  		update: svcTestCase{
  9162  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9163  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9164  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9165  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  9166  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9167  			expectClusterIPs:     true,
  9168  			expectStackDowngrade: true,
  9169  			prove:                prove(proveNumFamilies(1)),
  9170  		},
  9171  	}, {
  9172  		name: "policy:prefer_families:nil_ips:nil",
  9173  		line: line(),
  9174  		create: svcTestCase{
  9175  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9176  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9177  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9178  			expectClusterIPs: true,
  9179  			prove:            prove(proveNumFamilies(2)),
  9180  		},
  9181  		update: svcTestCase{
  9182  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9183  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9184  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  9185  			expectClusterIPs: true,
  9186  			prove:            prove(proveNumFamilies(2)),
  9187  		},
  9188  	}, {
  9189  		name: "policy:prefer_families:nil_ips:single",
  9190  		line: line(),
  9191  		create: svcTestCase{
  9192  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9193  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9194  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9195  			expectClusterIPs: true,
  9196  			prove:            prove(proveNumFamilies(2)),
  9197  		},
  9198  		update: svcTestCase{
  9199  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9200  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9201  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9202  				svctest.SetClusterIPs("10.0.0.1")),
  9203  			expectError: true,
  9204  		},
  9205  	}, {
  9206  		name: "policy:prefer_families:nil_ips:dual",
  9207  		line: line(),
  9208  		create: svcTestCase{
  9209  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9210  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9211  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9212  			expectClusterIPs: true,
  9213  			prove:            prove(proveNumFamilies(2)),
  9214  		},
  9215  		update: svcTestCase{
  9216  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9217  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9218  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9219  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9220  			expectClusterIPs: true,
  9221  			prove:            prove(proveNumFamilies(2)),
  9222  		},
  9223  	}, {
  9224  		name: "policy:prefer_families:single_ips:nil",
  9225  		line: line(),
  9226  		create: svcTestCase{
  9227  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9228  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9229  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9230  			expectClusterIPs: true,
  9231  			prove:            prove(proveNumFamilies(2)),
  9232  		},
  9233  		update: svcTestCase{
  9234  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9235  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9236  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9237  				svctest.SetIPFamilies(api.IPv4Protocol)),
  9238  			expectError: true,
  9239  		},
  9240  	}, {
  9241  		name: "policy:prefer_families:single_ips:single",
  9242  		line: line(),
  9243  		create: svcTestCase{
  9244  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9245  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9246  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9247  			expectClusterIPs: true,
  9248  			prove:            prove(proveNumFamilies(2)),
  9249  		},
  9250  		update: svcTestCase{
  9251  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9252  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9253  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9254  				svctest.SetIPFamilies(api.IPv4Protocol),
  9255  				svctest.SetClusterIPs("10.0.0.1")),
  9256  			expectError: true,
  9257  		},
  9258  	}, {
  9259  		name: "policy:prefer_families:single_ips:dual",
  9260  		line: line(),
  9261  		create: svcTestCase{
  9262  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9263  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9264  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9265  			expectClusterIPs: true,
  9266  			prove:            prove(proveNumFamilies(2)),
  9267  		},
  9268  		update: svcTestCase{
  9269  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9270  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9271  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9272  				svctest.SetIPFamilies(api.IPv4Protocol),
  9273  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9274  			expectError: true,
  9275  		},
  9276  	}, {
  9277  		name: "policy:prefer_families:dual_ips:nil",
  9278  		line: line(),
  9279  		create: svcTestCase{
  9280  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9281  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9282  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9283  			expectClusterIPs: true,
  9284  			prove:            prove(proveNumFamilies(2)),
  9285  		},
  9286  		update: svcTestCase{
  9287  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9288  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9289  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9290  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  9291  			expectClusterIPs: true,
  9292  			prove:            prove(proveNumFamilies(2)),
  9293  		},
  9294  	}, {
  9295  		name: "policy:prefer_families:dual_ips:single",
  9296  		line: line(),
  9297  		create: svcTestCase{
  9298  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9299  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9300  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9301  			expectClusterIPs: true,
  9302  			prove:            prove(proveNumFamilies(2)),
  9303  		},
  9304  		update: svcTestCase{
  9305  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9306  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9307  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9308  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  9309  				svctest.SetClusterIPs("10.0.0.1")),
  9310  			expectError: true,
  9311  		},
  9312  	}, {
  9313  		name: "policy:prefer_families:dual_ips:dual",
  9314  		line: line(),
  9315  		create: svcTestCase{
  9316  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9317  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9318  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9319  			expectClusterIPs: true,
  9320  			prove:            prove(proveNumFamilies(2)),
  9321  		},
  9322  		update: svcTestCase{
  9323  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9324  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9325  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9326  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  9327  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9328  			expectClusterIPs: true,
  9329  			prove:            prove(proveNumFamilies(2)),
  9330  		},
  9331  	}, {
  9332  		name: "policy:require_families:nil_ips:nil",
  9333  		line: line(),
  9334  		create: svcTestCase{
  9335  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9336  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9337  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9338  			expectClusterIPs: true,
  9339  			prove:            prove(proveNumFamilies(2)),
  9340  		},
  9341  		update: svcTestCase{
  9342  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9343  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9344  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
  9345  			expectClusterIPs: true,
  9346  			prove:            prove(proveNumFamilies(2)),
  9347  		},
  9348  	}, {
  9349  		name: "policy:require_families:nil_ips:single",
  9350  		line: line(),
  9351  		create: svcTestCase{
  9352  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9353  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9354  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9355  			expectClusterIPs: true,
  9356  			prove:            prove(proveNumFamilies(2)),
  9357  		},
  9358  		update: svcTestCase{
  9359  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9360  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9361  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9362  				svctest.SetClusterIPs("10.0.0.1")),
  9363  			expectError: true,
  9364  		},
  9365  	}, {
  9366  		name: "policy:require_families:nil_ips:dual",
  9367  		line: line(),
  9368  		create: svcTestCase{
  9369  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9370  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9371  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9372  			expectClusterIPs: true,
  9373  			prove:            prove(proveNumFamilies(2)),
  9374  		},
  9375  		update: svcTestCase{
  9376  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9377  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9378  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9379  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9380  			expectClusterIPs: true,
  9381  			prove:            prove(proveNumFamilies(2)),
  9382  		},
  9383  	}, {
  9384  		name: "policy:require_families:single_ips:nil",
  9385  		line: line(),
  9386  		create: svcTestCase{
  9387  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9388  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9389  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9390  			expectClusterIPs: true,
  9391  			prove:            prove(proveNumFamilies(2)),
  9392  		},
  9393  		update: svcTestCase{
  9394  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9395  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9396  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9397  				svctest.SetIPFamilies(api.IPv4Protocol)),
  9398  			expectError: true,
  9399  		},
  9400  	}, {
  9401  		name: "policy:require_families:single_ips:single",
  9402  		line: line(),
  9403  		create: svcTestCase{
  9404  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9405  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9406  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9407  			expectClusterIPs: true,
  9408  			prove:            prove(proveNumFamilies(2)),
  9409  		},
  9410  		update: svcTestCase{
  9411  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9412  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9413  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9414  				svctest.SetIPFamilies(api.IPv4Protocol),
  9415  				svctest.SetClusterIPs("10.0.0.1")),
  9416  			expectError: true,
  9417  		},
  9418  	}, {
  9419  		name: "policy:require_families:single_ips:dual",
  9420  		line: line(),
  9421  		create: svcTestCase{
  9422  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9423  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9424  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9425  			expectClusterIPs: true,
  9426  			prove:            prove(proveNumFamilies(2)),
  9427  		},
  9428  		update: svcTestCase{
  9429  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9430  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9431  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9432  				svctest.SetIPFamilies(api.IPv4Protocol),
  9433  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9434  			expectError: true,
  9435  		},
  9436  	}, {
  9437  		name: "policy:require_families:dual_ips:nil",
  9438  		line: line(),
  9439  		create: svcTestCase{
  9440  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9441  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9442  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9443  			expectClusterIPs: true,
  9444  			prove:            prove(proveNumFamilies(2)),
  9445  		},
  9446  		update: svcTestCase{
  9447  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9448  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9449  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9450  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol)),
  9451  			expectClusterIPs: true,
  9452  			prove:            prove(proveNumFamilies(2)),
  9453  		},
  9454  	}, {
  9455  		name: "policy:require_families:dual_ips:single",
  9456  		line: line(),
  9457  		create: svcTestCase{
  9458  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9459  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9460  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9461  			expectClusterIPs: true,
  9462  			prove:            prove(proveNumFamilies(2)),
  9463  		},
  9464  		update: svcTestCase{
  9465  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9466  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9467  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9468  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  9469  				svctest.SetClusterIPs("10.0.0.1")),
  9470  			expectError: true,
  9471  		},
  9472  	}, {
  9473  		name: "policy:require_families:dual_ips:dual",
  9474  		line: line(),
  9475  		create: svcTestCase{
  9476  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9477  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9478  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9479  			expectClusterIPs: true,
  9480  			prove:            prove(proveNumFamilies(2)),
  9481  		},
  9482  		update: svcTestCase{
  9483  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9484  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9485  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9486  				svctest.SetIPFamilies(api.IPv4Protocol, api.IPv6Protocol),
  9487  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9488  			expectClusterIPs: true,
  9489  			prove:            prove(proveNumFamilies(2)),
  9490  		},
  9491  	}, {
  9492  		name: "dual-single_wrong_order_families",
  9493  		line: line(),
  9494  		create: svcTestCase{
  9495  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9496  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9497  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9498  			expectClusterIPs: true,
  9499  			prove:            prove(proveNumFamilies(2)),
  9500  		},
  9501  		update: svcTestCase{
  9502  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9503  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9504  				svctest.SetIPFamilies(api.IPv6Protocol)),
  9505  			expectError: true,
  9506  		},
  9507  	}, {
  9508  		name: "dual-single_wrong_order_ips",
  9509  		line: line(),
  9510  		create: svcTestCase{
  9511  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9512  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9513  				svctest.SetClusterIPs("10.0.0.1", "2000::1")),
  9514  			expectClusterIPs: true,
  9515  			prove:            prove(proveNumFamilies(2)),
  9516  		},
  9517  		update: svcTestCase{
  9518  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9519  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9520  				svctest.SetClusterIPs("2000::1")),
  9521  			expectError: true,
  9522  		},
  9523  	}}
  9524  
  9525  	t.Run("dualstack:v4v6", func(t *testing.T) {
  9526  		helpTestCreateUpdateDeleteWithFamilies(t, testCasesV4V6, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
  9527  	})
  9528  
  9529  	// Dual-stack v6,v4 cases: Covers the full matrix of:
  9530  	//    policy={nil, single, prefer, require}
  9531  	//    families={nil, single, dual}
  9532  	//    ips={nil, single, dual}
  9533  	testCasesV6V4 := []cudTestCase{{
  9534  		name: "policy:nil_families:nil_ips:nil",
  9535  		line: line(),
  9536  		create: svcTestCase{
  9537  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9538  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9539  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9540  			expectClusterIPs: true,
  9541  			prove:            prove(proveNumFamilies(2)),
  9542  		},
  9543  		update: svcTestCase{
  9544  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9545  				svctest.SetSelector(map[string]string{"k2": "v2"})),
  9546  			expectClusterIPs: true,
  9547  			prove:            prove(proveNumFamilies(2)),
  9548  		},
  9549  	}, {
  9550  		name: "policy:nil_families:nil_ips:single",
  9551  		line: line(),
  9552  		create: svcTestCase{
  9553  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9554  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9555  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9556  			expectClusterIPs: true,
  9557  			prove:            prove(proveNumFamilies(2)),
  9558  		},
  9559  		update: svcTestCase{
  9560  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9561  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9562  				svctest.SetClusterIPs("2000::1")),
  9563  			expectError: true,
  9564  		},
  9565  	}, {
  9566  		name: "policy:nil_families:nil_ips:dual",
  9567  		line: line(),
  9568  		create: svcTestCase{
  9569  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9570  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9571  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9572  			expectClusterIPs: true,
  9573  			prove:            prove(proveNumFamilies(2)),
  9574  		},
  9575  		update: svcTestCase{
  9576  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9577  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9578  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9579  			expectClusterIPs: true,
  9580  			prove:            prove(proveNumFamilies(2)),
  9581  		},
  9582  	}, {
  9583  		name: "policy:nil_families:single_ips:nil",
  9584  		line: line(),
  9585  		create: svcTestCase{
  9586  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9587  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9588  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9589  			expectClusterIPs: true,
  9590  			prove:            prove(proveNumFamilies(2)),
  9591  		},
  9592  		update: svcTestCase{
  9593  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9594  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9595  				svctest.SetIPFamilies(api.IPv6Protocol)),
  9596  			expectError: true,
  9597  		},
  9598  	}, {
  9599  		name: "policy:nil_families:single_ips:single",
  9600  		line: line(),
  9601  		create: svcTestCase{
  9602  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9603  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9604  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9605  			expectClusterIPs: true,
  9606  			prove:            prove(proveNumFamilies(2)),
  9607  		},
  9608  		update: svcTestCase{
  9609  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9610  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9611  				svctest.SetIPFamilies(api.IPv6Protocol),
  9612  				svctest.SetClusterIPs("2000::1")),
  9613  			expectError: true,
  9614  		},
  9615  	}, {
  9616  		name: "policy:nil_families:single_ips:dual",
  9617  		line: line(),
  9618  		create: svcTestCase{
  9619  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9620  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9621  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9622  			expectClusterIPs: true,
  9623  			prove:            prove(proveNumFamilies(2)),
  9624  		},
  9625  		update: svcTestCase{
  9626  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9627  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9628  				svctest.SetIPFamilies(api.IPv6Protocol),
  9629  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9630  			expectError: true,
  9631  		},
  9632  	}, {
  9633  		name: "policy:nil_families:dual_ips:nil",
  9634  		line: line(),
  9635  		create: svcTestCase{
  9636  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9637  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9638  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9639  			expectClusterIPs: true,
  9640  			prove:            prove(proveNumFamilies(2)),
  9641  		},
  9642  		update: svcTestCase{
  9643  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9644  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9645  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  9646  			expectClusterIPs: true,
  9647  			prove:            prove(proveNumFamilies(2)),
  9648  		},
  9649  	}, {
  9650  		name: "policy:nil_families:dual_ips:single",
  9651  		line: line(),
  9652  		create: svcTestCase{
  9653  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9654  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9655  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9656  			expectClusterIPs: true,
  9657  			prove:            prove(proveNumFamilies(2)),
  9658  		},
  9659  		update: svcTestCase{
  9660  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9661  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9662  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  9663  				svctest.SetClusterIPs("2000::1")),
  9664  			expectError: true,
  9665  		},
  9666  	}, {
  9667  		name: "policy:nil_families:dual_ips:dual",
  9668  		line: line(),
  9669  		create: svcTestCase{
  9670  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9671  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9672  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9673  			expectClusterIPs: true,
  9674  			prove:            prove(proveNumFamilies(2)),
  9675  		},
  9676  		update: svcTestCase{
  9677  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9678  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9679  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  9680  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9681  			expectClusterIPs: true,
  9682  			prove:            prove(proveNumFamilies(2)),
  9683  		},
  9684  	}, {
  9685  		name: "policy:single_families:nil_ips:nil",
  9686  		line: line(),
  9687  		create: svcTestCase{
  9688  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9689  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9690  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9691  			expectClusterIPs: true,
  9692  			prove:            prove(proveNumFamilies(2)),
  9693  		},
  9694  		update: svcTestCase{
  9695  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9696  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9697  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
  9698  			expectClusterIPs: true,
  9699  			prove:            prove(proveNumFamilies(1)),
  9700  		},
  9701  	}, {
  9702  		name: "policy:single_families:nil_ips:single",
  9703  		line: line(),
  9704  		create: svcTestCase{
  9705  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9706  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9707  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9708  			expectClusterIPs: true,
  9709  			prove:            prove(proveNumFamilies(2)),
  9710  		},
  9711  		update: svcTestCase{
  9712  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9713  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9714  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9715  				svctest.SetClusterIPs("2000::1")),
  9716  			expectClusterIPs: true,
  9717  			prove:            prove(proveNumFamilies(1)),
  9718  		},
  9719  	}, {
  9720  		name: "policy:single_families:nil_ips:dual",
  9721  		line: line(),
  9722  		create: svcTestCase{
  9723  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9724  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9725  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9726  			expectClusterIPs: true,
  9727  			prove:            prove(proveNumFamilies(2)),
  9728  		},
  9729  		update: svcTestCase{
  9730  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9731  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9732  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9733  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9734  			expectClusterIPs:     true,
  9735  			expectStackDowngrade: true,
  9736  			prove:                prove(proveNumFamilies(1)),
  9737  		},
  9738  	}, {
  9739  		name: "policy:single_families:single_ips:nil",
  9740  		line: line(),
  9741  		create: svcTestCase{
  9742  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9743  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9744  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9745  			expectClusterIPs: true,
  9746  			prove:            prove(proveNumFamilies(2)),
  9747  		},
  9748  		update: svcTestCase{
  9749  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9750  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9751  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9752  				svctest.SetIPFamilies(api.IPv6Protocol)),
  9753  			expectClusterIPs: true,
  9754  			prove:            prove(proveNumFamilies(1)),
  9755  		},
  9756  	}, {
  9757  		name: "policy:single_families:single_ips:single",
  9758  		line: line(),
  9759  		create: svcTestCase{
  9760  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9761  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9762  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9763  			expectClusterIPs: true,
  9764  			prove:            prove(proveNumFamilies(2)),
  9765  		},
  9766  		update: svcTestCase{
  9767  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9768  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9769  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9770  				svctest.SetIPFamilies(api.IPv6Protocol),
  9771  				svctest.SetClusterIPs("2000::1")),
  9772  			expectClusterIPs: true,
  9773  			prove:            prove(proveNumFamilies(1)),
  9774  		},
  9775  	}, {
  9776  		name: "policy:single_families:single_ips:dual",
  9777  		line: line(),
  9778  		create: svcTestCase{
  9779  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9780  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9781  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9782  			expectClusterIPs: true,
  9783  			prove:            prove(proveNumFamilies(2)),
  9784  		},
  9785  		update: svcTestCase{
  9786  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9787  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9788  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9789  				svctest.SetIPFamilies(api.IPv6Protocol),
  9790  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9791  			expectClusterIPs:     true,
  9792  			expectStackDowngrade: true,
  9793  			prove:                prove(proveNumFamilies(1)),
  9794  		},
  9795  	}, {
  9796  		name: "policy:single_families:dual_ips:nil",
  9797  		line: line(),
  9798  		create: svcTestCase{
  9799  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9800  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9801  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9802  			expectClusterIPs: true,
  9803  			prove:            prove(proveNumFamilies(2)),
  9804  		},
  9805  		update: svcTestCase{
  9806  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9807  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9808  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9809  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  9810  			expectClusterIPs:     true,
  9811  			expectStackDowngrade: true,
  9812  			prove:                prove(proveNumFamilies(1)),
  9813  		},
  9814  	}, {
  9815  		name: "policy:single_families:dual_ips:single",
  9816  		line: line(),
  9817  		create: svcTestCase{
  9818  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9819  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9820  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9821  			expectClusterIPs: true,
  9822  			prove:            prove(proveNumFamilies(2)),
  9823  		},
  9824  		update: svcTestCase{
  9825  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9826  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9827  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9828  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  9829  				svctest.SetClusterIPs("2000::1")),
  9830  			expectClusterIPs:     true,
  9831  			expectStackDowngrade: true,
  9832  			prove:                prove(proveNumFamilies(1)),
  9833  		},
  9834  	}, {
  9835  		name: "policy:single_families:dual_ips:dual",
  9836  		line: line(),
  9837  		create: svcTestCase{
  9838  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9839  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9840  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9841  			expectClusterIPs: true,
  9842  			prove:            prove(proveNumFamilies(2)),
  9843  		},
  9844  		update: svcTestCase{
  9845  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9846  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9847  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
  9848  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  9849  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9850  			expectClusterIPs:     true,
  9851  			expectStackDowngrade: true,
  9852  			prove:                prove(proveNumFamilies(1)),
  9853  		},
  9854  	}, {
  9855  		name: "policy:prefer_families:nil_ips:nil",
  9856  		line: line(),
  9857  		create: svcTestCase{
  9858  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9859  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9860  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9861  			expectClusterIPs: true,
  9862  			prove:            prove(proveNumFamilies(2)),
  9863  		},
  9864  		update: svcTestCase{
  9865  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9866  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9867  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
  9868  			expectClusterIPs: true,
  9869  			prove:            prove(proveNumFamilies(2)),
  9870  		},
  9871  	}, {
  9872  		name: "policy:prefer_families:nil_ips:single",
  9873  		line: line(),
  9874  		create: svcTestCase{
  9875  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9876  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9877  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9878  			expectClusterIPs: true,
  9879  			prove:            prove(proveNumFamilies(2)),
  9880  		},
  9881  		update: svcTestCase{
  9882  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9883  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9884  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9885  				svctest.SetClusterIPs("2000::1")),
  9886  			expectError: true,
  9887  		},
  9888  	}, {
  9889  		name: "policy:prefer_families:nil_ips:dual",
  9890  		line: line(),
  9891  		create: svcTestCase{
  9892  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9893  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9894  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9895  			expectClusterIPs: true,
  9896  			prove:            prove(proveNumFamilies(2)),
  9897  		},
  9898  		update: svcTestCase{
  9899  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9900  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9901  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9902  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9903  			expectClusterIPs: true,
  9904  			prove:            prove(proveNumFamilies(2)),
  9905  		},
  9906  	}, {
  9907  		name: "policy:prefer_families:single_ips:nil",
  9908  		line: line(),
  9909  		create: svcTestCase{
  9910  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9911  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9912  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9913  			expectClusterIPs: true,
  9914  			prove:            prove(proveNumFamilies(2)),
  9915  		},
  9916  		update: svcTestCase{
  9917  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9918  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9919  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9920  				svctest.SetIPFamilies(api.IPv6Protocol)),
  9921  			expectError: true,
  9922  		},
  9923  	}, {
  9924  		name: "policy:prefer_families:single_ips:single",
  9925  		line: line(),
  9926  		create: svcTestCase{
  9927  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9928  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9929  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9930  			expectClusterIPs: true,
  9931  			prove:            prove(proveNumFamilies(2)),
  9932  		},
  9933  		update: svcTestCase{
  9934  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9935  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9936  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9937  				svctest.SetIPFamilies(api.IPv6Protocol),
  9938  				svctest.SetClusterIPs("2000::1")),
  9939  			expectError: true,
  9940  		},
  9941  	}, {
  9942  		name: "policy:prefer_families:single_ips:dual",
  9943  		line: line(),
  9944  		create: svcTestCase{
  9945  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9946  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9947  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9948  			expectClusterIPs: true,
  9949  			prove:            prove(proveNumFamilies(2)),
  9950  		},
  9951  		update: svcTestCase{
  9952  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9953  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9954  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9955  				svctest.SetIPFamilies(api.IPv6Protocol),
  9956  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9957  			expectError: true,
  9958  		},
  9959  	}, {
  9960  		name: "policy:prefer_families:dual_ips:nil",
  9961  		line: line(),
  9962  		create: svcTestCase{
  9963  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9964  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9965  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9966  			expectClusterIPs: true,
  9967  			prove:            prove(proveNumFamilies(2)),
  9968  		},
  9969  		update: svcTestCase{
  9970  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9971  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9972  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9973  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
  9974  			expectClusterIPs: true,
  9975  			prove:            prove(proveNumFamilies(2)),
  9976  		},
  9977  	}, {
  9978  		name: "policy:prefer_families:dual_ips:single",
  9979  		line: line(),
  9980  		create: svcTestCase{
  9981  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9982  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
  9983  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
  9984  			expectClusterIPs: true,
  9985  			prove:            prove(proveNumFamilies(2)),
  9986  		},
  9987  		update: svcTestCase{
  9988  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
  9989  				svctest.SetSelector(map[string]string{"k2": "v2"}),
  9990  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
  9991  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
  9992  				svctest.SetClusterIPs("2000::1")),
  9993  			expectError: true,
  9994  		},
  9995  	}, {
  9996  		name: "policy:prefer_families:dual_ips:dual",
  9997  		line: line(),
  9998  		create: svcTestCase{
  9999  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10000  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10001  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10002  			expectClusterIPs: true,
 10003  			prove:            prove(proveNumFamilies(2)),
 10004  		},
 10005  		update: svcTestCase{
 10006  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10007  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10008  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
 10009  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
 10010  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10011  			expectClusterIPs: true,
 10012  			prove:            prove(proveNumFamilies(2)),
 10013  		},
 10014  	}, {
 10015  		name: "policy:require_families:nil_ips:nil",
 10016  		line: line(),
 10017  		create: svcTestCase{
 10018  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10019  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10020  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10021  			expectClusterIPs: true,
 10022  			prove:            prove(proveNumFamilies(2)),
 10023  		},
 10024  		update: svcTestCase{
 10025  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10026  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10027  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
 10028  			expectClusterIPs: true,
 10029  			prove:            prove(proveNumFamilies(2)),
 10030  		},
 10031  	}, {
 10032  		name: "policy:require_families:nil_ips:single",
 10033  		line: line(),
 10034  		create: svcTestCase{
 10035  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10036  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10037  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10038  			expectClusterIPs: true,
 10039  			prove:            prove(proveNumFamilies(2)),
 10040  		},
 10041  		update: svcTestCase{
 10042  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10043  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10044  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10045  				svctest.SetClusterIPs("2000::1")),
 10046  			expectError: true,
 10047  		},
 10048  	}, {
 10049  		name: "policy:require_families:nil_ips:dual",
 10050  		line: line(),
 10051  		create: svcTestCase{
 10052  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10053  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10054  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10055  			expectClusterIPs: true,
 10056  			prove:            prove(proveNumFamilies(2)),
 10057  		},
 10058  		update: svcTestCase{
 10059  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10060  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10061  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10062  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10063  			expectClusterIPs: true,
 10064  			prove:            prove(proveNumFamilies(2)),
 10065  		},
 10066  	}, {
 10067  		name: "policy:require_families:single_ips:nil",
 10068  		line: line(),
 10069  		create: svcTestCase{
 10070  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10071  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10072  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10073  			expectClusterIPs: true,
 10074  			prove:            prove(proveNumFamilies(2)),
 10075  		},
 10076  		update: svcTestCase{
 10077  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10078  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10079  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10080  				svctest.SetIPFamilies(api.IPv6Protocol)),
 10081  			expectError: true,
 10082  		},
 10083  	}, {
 10084  		name: "policy:require_families:single_ips:single",
 10085  		line: line(),
 10086  		create: svcTestCase{
 10087  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10088  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10089  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10090  			expectClusterIPs: true,
 10091  			prove:            prove(proveNumFamilies(2)),
 10092  		},
 10093  		update: svcTestCase{
 10094  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10095  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10096  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10097  				svctest.SetIPFamilies(api.IPv6Protocol),
 10098  				svctest.SetClusterIPs("2000::1")),
 10099  			expectError: true,
 10100  		},
 10101  	}, {
 10102  		name: "policy:require_families:single_ips:dual",
 10103  		line: line(),
 10104  		create: svcTestCase{
 10105  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10106  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10107  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10108  			expectClusterIPs: true,
 10109  			prove:            prove(proveNumFamilies(2)),
 10110  		},
 10111  		update: svcTestCase{
 10112  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10113  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10114  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10115  				svctest.SetIPFamilies(api.IPv6Protocol),
 10116  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10117  			expectError: true,
 10118  		},
 10119  	}, {
 10120  		name: "policy:require_families:dual_ips:nil",
 10121  		line: line(),
 10122  		create: svcTestCase{
 10123  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10124  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10125  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10126  			expectClusterIPs: true,
 10127  			prove:            prove(proveNumFamilies(2)),
 10128  		},
 10129  		update: svcTestCase{
 10130  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10131  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10132  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10133  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol)),
 10134  			expectClusterIPs: true,
 10135  			prove:            prove(proveNumFamilies(2)),
 10136  		},
 10137  	}, {
 10138  		name: "policy:require_families:dual_ips:single",
 10139  		line: line(),
 10140  		create: svcTestCase{
 10141  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10142  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10143  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10144  			expectClusterIPs: true,
 10145  			prove:            prove(proveNumFamilies(2)),
 10146  		},
 10147  		update: svcTestCase{
 10148  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10149  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10150  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10151  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
 10152  				svctest.SetClusterIPs("2000::1")),
 10153  			expectError: true,
 10154  		},
 10155  	}, {
 10156  		name: "policy:require_families:dual_ips:dual",
 10157  		line: line(),
 10158  		create: svcTestCase{
 10159  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10160  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10161  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10162  			expectClusterIPs: true,
 10163  			prove:            prove(proveNumFamilies(2)),
 10164  		},
 10165  		update: svcTestCase{
 10166  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10167  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10168  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10169  				svctest.SetIPFamilies(api.IPv6Protocol, api.IPv4Protocol),
 10170  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10171  			expectClusterIPs: true,
 10172  			prove:            prove(proveNumFamilies(2)),
 10173  		},
 10174  	}, {
 10175  		name: "dual-single_wrong_order_families",
 10176  		line: line(),
 10177  		create: svcTestCase{
 10178  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10179  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10180  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10181  			expectClusterIPs: true,
 10182  			prove:            prove(proveNumFamilies(2)),
 10183  		},
 10184  		update: svcTestCase{
 10185  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10186  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
 10187  				svctest.SetIPFamilies(api.IPv4Protocol)),
 10188  			expectError: true,
 10189  		},
 10190  	}, {
 10191  		name: "dual-single_wrong_order_ips",
 10192  		line: line(),
 10193  		create: svcTestCase{
 10194  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10195  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10196  				svctest.SetClusterIPs("2000::1", "10.0.0.1")),
 10197  			expectClusterIPs: true,
 10198  			prove:            prove(proveNumFamilies(2)),
 10199  		},
 10200  		update: svcTestCase{
 10201  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10202  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
 10203  				svctest.SetClusterIPs("10.0.0.1")),
 10204  			expectError: true,
 10205  		},
 10206  	}}
 10207  
 10208  	t.Run("dualstack:v6v4", func(t *testing.T) {
 10209  		helpTestCreateUpdateDeleteWithFamilies(t, testCasesV6V4, []api.IPFamily{api.IPv6Protocol, api.IPv4Protocol})
 10210  	})
 10211  
 10212  	// Headless cases: Covers the full matrix of:
 10213  	//    policy={nil, single, prefer, require}
 10214  	//    families={nil, single, dual}
 10215  	testCasesHeadless := []cudTestCase{{
 10216  		name: "policy:nil_families:nil",
 10217  		line: line(),
 10218  		create: svcTestCase{
 10219  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10220  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10221  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10222  			expectHeadless: true,
 10223  			prove:          prove(proveNumFamilies(2)),
 10224  		},
 10225  		update: svcTestCase{
 10226  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10227  				svctest.SetSelector(map[string]string{"k2": "v2"})),
 10228  			expectHeadless: true,
 10229  			prove:          prove(proveNumFamilies(2)),
 10230  		},
 10231  	}, {
 10232  		name: "policy:nil_families:single",
 10233  		line: line(),
 10234  		create: svcTestCase{
 10235  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10236  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10237  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10238  			expectHeadless: true,
 10239  			prove:          prove(proveNumFamilies(2)),
 10240  		},
 10241  		update: svcTestCase{
 10242  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10243  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10244  				svctest.SetIPFamilies("IPv4")),
 10245  			expectError: true,
 10246  		},
 10247  	}, {
 10248  		name: "policy:nil_families:dual",
 10249  		line: line(),
 10250  		create: svcTestCase{
 10251  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10252  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10253  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10254  			expectHeadless: true,
 10255  			prove:          prove(proveNumFamilies(2)),
 10256  		},
 10257  		update: svcTestCase{
 10258  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10259  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10260  				svctest.SetIPFamilies("IPv4", "IPv6")),
 10261  			expectHeadless: true,
 10262  			prove:          prove(proveNumFamilies(2)),
 10263  		},
 10264  	}, {
 10265  		name: "policy:single_families:nil",
 10266  		line: line(),
 10267  		create: svcTestCase{
 10268  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10269  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10270  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10271  			expectHeadless: true,
 10272  			prove:          prove(proveNumFamilies(2)),
 10273  		},
 10274  		update: svcTestCase{
 10275  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10276  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10277  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack)),
 10278  			expectHeadless: true,
 10279  			prove:          prove(proveNumFamilies(1)),
 10280  		},
 10281  	}, {
 10282  		name: "policy:single_families:single",
 10283  		line: line(),
 10284  		create: svcTestCase{
 10285  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10286  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10287  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10288  			expectHeadless: true,
 10289  			prove:          prove(proveNumFamilies(2)),
 10290  		},
 10291  		update: svcTestCase{
 10292  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10293  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10294  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
 10295  				svctest.SetIPFamilies("IPv4")),
 10296  			expectHeadless: true,
 10297  			prove:          prove(proveNumFamilies(1)),
 10298  		},
 10299  	}, {
 10300  		name: "policy:single_families:dual",
 10301  		line: line(),
 10302  		create: svcTestCase{
 10303  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10304  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10305  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10306  			expectHeadless: true,
 10307  			prove:          prove(proveNumFamilies(2)),
 10308  		},
 10309  		update: svcTestCase{
 10310  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10311  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10312  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicySingleStack),
 10313  				svctest.SetIPFamilies("IPv4", "IPv6")),
 10314  			expectHeadless:       true,
 10315  			expectStackDowngrade: true,
 10316  			prove:                prove(proveNumFamilies(1)),
 10317  		},
 10318  	}, {
 10319  		name: "policy:prefer_families:nil",
 10320  		line: line(),
 10321  		create: svcTestCase{
 10322  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10323  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10324  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10325  			expectHeadless: true,
 10326  			prove:          prove(proveNumFamilies(2)),
 10327  		},
 10328  		update: svcTestCase{
 10329  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10330  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10331  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack)),
 10332  			expectHeadless: true,
 10333  			prove:          prove(proveNumFamilies(2)),
 10334  		},
 10335  	}, {
 10336  		name: "policy:prefer_families:single",
 10337  		line: line(),
 10338  		create: svcTestCase{
 10339  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10340  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10341  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10342  			expectHeadless: true,
 10343  			prove:          prove(proveNumFamilies(2)),
 10344  		},
 10345  		update: svcTestCase{
 10346  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10347  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10348  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
 10349  				svctest.SetIPFamilies("IPv4")),
 10350  			expectError: true,
 10351  		},
 10352  	}, {
 10353  		name: "policy:prefer_families:dual",
 10354  		line: line(),
 10355  		create: svcTestCase{
 10356  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10357  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10358  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10359  			expectHeadless: true,
 10360  			prove:          prove(proveNumFamilies(2)),
 10361  		},
 10362  		update: svcTestCase{
 10363  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10364  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10365  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
 10366  				svctest.SetIPFamilies("IPv4", "IPv6")),
 10367  			expectHeadless: true,
 10368  			prove:          prove(proveNumFamilies(2)),
 10369  		},
 10370  	}, {
 10371  		name: "policy:require_families:nil",
 10372  		line: line(),
 10373  		create: svcTestCase{
 10374  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10375  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10376  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10377  			expectHeadless: true,
 10378  			prove:          prove(proveNumFamilies(2)),
 10379  		},
 10380  		update: svcTestCase{
 10381  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10382  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10383  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack)),
 10384  			expectHeadless: true,
 10385  			prove:          prove(proveNumFamilies(2)),
 10386  		},
 10387  	}, {
 10388  		name: "policy:require_families:single",
 10389  		line: line(),
 10390  		create: svcTestCase{
 10391  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10392  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10393  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10394  			expectHeadless: true,
 10395  			prove:          prove(proveNumFamilies(2)),
 10396  		},
 10397  		update: svcTestCase{
 10398  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10399  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10400  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10401  				svctest.SetIPFamilies("IPv4")),
 10402  			expectError: true,
 10403  		},
 10404  	}, {
 10405  		name: "policy:require_families:dual",
 10406  		line: line(),
 10407  		create: svcTestCase{
 10408  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10409  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10410  				svctest.SetClusterIPs(api.ClusterIPNone)),
 10411  			expectHeadless: true,
 10412  			prove:          prove(proveNumFamilies(2)),
 10413  		},
 10414  		update: svcTestCase{
 10415  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10416  				svctest.SetSelector(map[string]string{"k2": "v2"}),
 10417  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyRequireDualStack),
 10418  				svctest.SetIPFamilies("IPv4", "IPv6")),
 10419  			expectHeadless: true,
 10420  			prove:          prove(proveNumFamilies(2)),
 10421  		},
 10422  	}}
 10423  
 10424  	t.Run("headless", func(t *testing.T) {
 10425  		helpTestCreateUpdateDeleteWithFamilies(t, testCasesHeadless, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
 10426  	})
 10427  }
 10428  
 10429  func TestFeatureExternalName(t *testing.T) {
 10430  	testCases := []cudTestCase{{
 10431  		name: "valid-valid",
 10432  		create: svcTestCase{
 10433  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10434  		},
 10435  		update: svcTestCase{
 10436  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName, svctest.SetExternalName("updated.example.com")),
 10437  		},
 10438  	}, {
 10439  		name: "valid-blank",
 10440  		create: svcTestCase{
 10441  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10442  		},
 10443  		update: svcTestCase{
 10444  			svc:         svctest.MakeService("foo", svctest.SetTypeExternalName, svctest.SetExternalName("")),
 10445  			expectError: true,
 10446  		},
 10447  	}}
 10448  
 10449  	helpTestCreateUpdateDelete(t, testCases)
 10450  }
 10451  
 10452  func TestFeatureSelector(t *testing.T) {
 10453  	testCases := []cudTestCase{{
 10454  		name: "valid-valid",
 10455  		create: svcTestCase{
 10456  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10457  			expectClusterIPs: true,
 10458  		},
 10459  		update: svcTestCase{
 10460  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10461  				func(s *api.Service) {
 10462  					s.Spec.Selector = map[string]string{"updated": "value"}
 10463  				}),
 10464  			expectClusterIPs: true,
 10465  		},
 10466  	}, {
 10467  		name: "valid-nil",
 10468  		create: svcTestCase{
 10469  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10470  			expectClusterIPs: true,
 10471  		},
 10472  		update: svcTestCase{
 10473  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10474  				func(s *api.Service) {
 10475  					s.Spec.Selector = nil
 10476  				}),
 10477  			expectClusterIPs: true,
 10478  		},
 10479  	}, {
 10480  		name: "valid-empty",
 10481  		create: svcTestCase{
 10482  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10483  			expectClusterIPs: true,
 10484  		},
 10485  		update: svcTestCase{
 10486  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10487  				func(s *api.Service) {
 10488  					s.Spec.Selector = map[string]string{}
 10489  				}),
 10490  			expectClusterIPs: true,
 10491  		},
 10492  	}, {
 10493  		name: "nil-valid",
 10494  		create: svcTestCase{
 10495  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10496  				func(s *api.Service) {
 10497  					s.Spec.Selector = nil
 10498  				}),
 10499  			expectClusterIPs: true,
 10500  		},
 10501  		update: svcTestCase{
 10502  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10503  			expectClusterIPs: true,
 10504  		},
 10505  	}, {
 10506  		name: "empty-valid",
 10507  		create: svcTestCase{
 10508  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10509  				func(s *api.Service) {
 10510  					s.Spec.Selector = map[string]string{}
 10511  				}),
 10512  			expectClusterIPs: true,
 10513  		},
 10514  		update: svcTestCase{
 10515  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10516  			expectClusterIPs: true,
 10517  		},
 10518  	}}
 10519  
 10520  	helpTestCreateUpdateDelete(t, testCases)
 10521  }
 10522  
 10523  func TestFeatureClusterIPs(t *testing.T) {
 10524  	testCases := []cudTestCase{{
 10525  		name: "clusterIP:valid-headless",
 10526  		create: svcTestCase{
 10527  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10528  			expectClusterIPs: true,
 10529  		},
 10530  		update: svcTestCase{
 10531  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10532  				svctest.SetHeadless),
 10533  			expectError: true,
 10534  		},
 10535  	}, {
 10536  		name: "clusterIP:headless-valid",
 10537  		create: svcTestCase{
 10538  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10539  				svctest.SetHeadless),
 10540  			expectHeadless: true,
 10541  		},
 10542  		update: svcTestCase{
 10543  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10544  				svctest.SetClusterIP("10.0.0.93")),
 10545  			expectError: true,
 10546  		},
 10547  	}, {
 10548  		name: "clusterIP:valid-valid",
 10549  		create: svcTestCase{
 10550  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10551  				svctest.SetClusterIP("10.0.0.93")),
 10552  			expectClusterIPs: true,
 10553  		},
 10554  		update: svcTestCase{
 10555  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10556  				svctest.SetClusterIP("10.0.0.76")),
 10557  			expectError: true,
 10558  		},
 10559  	}, {
 10560  		name: "clusterIPs:valid-valid",
 10561  		create: svcTestCase{
 10562  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10563  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
 10564  				svctest.SetClusterIPs("10.0.0.93", "2000::93")),
 10565  			expectClusterIPs: true,
 10566  		},
 10567  		update: svcTestCase{
 10568  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10569  				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
 10570  				svctest.SetClusterIPs("10.0.0.76", "2000::76")),
 10571  			expectError: true,
 10572  		},
 10573  	}}
 10574  
 10575  	helpTestCreateUpdateDelete(t, testCases)
 10576  }
 10577  
 10578  func TestFeaturePorts(t *testing.T) {
 10579  	testCases := []cudTestCase{{
 10580  		name: "add_port",
 10581  		create: svcTestCase{
 10582  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10583  				svctest.SetPorts(
 10584  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP))),
 10585  			expectClusterIPs: true,
 10586  		},
 10587  		update: svcTestCase{
 10588  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10589  				svctest.SetPorts(
 10590  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10591  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10592  			expectClusterIPs: true,
 10593  		},
 10594  	}, {
 10595  		name: "add_port_ClusterIP-NodePort",
 10596  		create: svcTestCase{
 10597  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10598  				svctest.SetPorts(
 10599  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP))),
 10600  			expectClusterIPs: true,
 10601  		},
 10602  		update: svcTestCase{
 10603  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10604  				svctest.SetPorts(
 10605  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10606  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10607  			expectClusterIPs: true,
 10608  			expectNodePorts:  true,
 10609  		},
 10610  	}, {
 10611  		name: "add_port_NodePort-ClusterIP",
 10612  		create: svcTestCase{
 10613  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10614  				svctest.SetPorts(
 10615  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP))),
 10616  			expectClusterIPs: true,
 10617  			expectNodePorts:  true,
 10618  		},
 10619  		update: svcTestCase{
 10620  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10621  				svctest.SetPorts(
 10622  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10623  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10624  			expectClusterIPs: true,
 10625  		},
 10626  	}, {
 10627  		name: "remove_port",
 10628  		create: svcTestCase{
 10629  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10630  				svctest.SetPorts(
 10631  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10632  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10633  			expectClusterIPs: true,
 10634  		},
 10635  		update: svcTestCase{
 10636  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10637  				svctest.SetPorts(
 10638  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP))),
 10639  			expectClusterIPs: true,
 10640  		},
 10641  	}, {
 10642  		name: "remove_port_ClusterIP-NodePort",
 10643  		create: svcTestCase{
 10644  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10645  				svctest.SetPorts(
 10646  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10647  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10648  			expectClusterIPs: true,
 10649  		},
 10650  		update: svcTestCase{
 10651  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10652  				svctest.SetPorts(
 10653  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP))),
 10654  			expectClusterIPs: true,
 10655  			expectNodePorts:  true,
 10656  		},
 10657  	}, {
 10658  		name: "remove_port_NodePort-ClusterIP",
 10659  		create: svcTestCase{
 10660  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10661  				svctest.SetPorts(
 10662  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10663  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10664  			expectClusterIPs: true,
 10665  			expectNodePorts:  true,
 10666  		},
 10667  		update: svcTestCase{
 10668  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10669  				svctest.SetPorts(
 10670  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP))),
 10671  			expectClusterIPs: true,
 10672  		},
 10673  	}, {
 10674  		name: "swap_ports",
 10675  		create: svcTestCase{
 10676  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10677  				svctest.SetPorts(
 10678  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10679  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10680  			expectClusterIPs: true,
 10681  			expectNodePorts:  true,
 10682  		},
 10683  		update: svcTestCase{
 10684  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10685  				svctest.SetPorts(
 10686  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP),
 10687  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP))),
 10688  			expectClusterIPs: true,
 10689  			expectNodePorts:  true,
 10690  		},
 10691  	}, {
 10692  		name: "modify_ports",
 10693  		create: svcTestCase{
 10694  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10695  				svctest.SetPorts(
 10696  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10697  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10698  			expectClusterIPs: true,
 10699  			expectNodePorts:  true,
 10700  		},
 10701  		update: svcTestCase{
 10702  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10703  				svctest.SetPorts(
 10704  					svctest.MakeServicePort("p", 8080, intstr.FromInt32(8080), api.ProtocolTCP),
 10705  					svctest.MakeServicePort("q", 8443, intstr.FromInt32(8443), api.ProtocolTCP))),
 10706  			expectClusterIPs: true,
 10707  			expectNodePorts:  true,
 10708  		},
 10709  	}, {
 10710  		name: "modify_protos",
 10711  		create: svcTestCase{
 10712  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10713  				svctest.SetPorts(
 10714  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10715  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10716  			expectClusterIPs: true,
 10717  			expectNodePorts:  true,
 10718  		},
 10719  		update: svcTestCase{
 10720  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10721  				svctest.SetPorts(
 10722  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolUDP),
 10723  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolUDP))),
 10724  			expectClusterIPs: true,
 10725  			expectNodePorts:  true,
 10726  		},
 10727  	}, {
 10728  		name: "modify_ports_and_protos",
 10729  		create: svcTestCase{
 10730  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10731  				svctest.SetPorts(
 10732  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10733  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10734  			expectClusterIPs: true,
 10735  			expectNodePorts:  true,
 10736  		},
 10737  		update: svcTestCase{
 10738  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10739  				svctest.SetPorts(
 10740  					svctest.MakeServicePort("r", 53, intstr.FromInt32(53), api.ProtocolTCP),
 10741  					svctest.MakeServicePort("s", 53, intstr.FromInt32(53), api.ProtocolUDP))),
 10742  			expectClusterIPs: true,
 10743  			expectNodePorts:  true,
 10744  		},
 10745  	}, {
 10746  		name: "add_alt_proto",
 10747  		create: svcTestCase{
 10748  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10749  				svctest.SetPorts(
 10750  					svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP))),
 10751  			expectClusterIPs: true,
 10752  			expectNodePorts:  true,
 10753  		},
 10754  		update: svcTestCase{
 10755  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10756  				svctest.SetPorts(
 10757  					svctest.MakeServicePort("p", 53, intstr.FromInt32(53), api.ProtocolTCP),
 10758  					svctest.MakeServicePort("q", 53, intstr.FromInt32(53), api.ProtocolUDP))),
 10759  			expectClusterIPs: true,
 10760  			expectNodePorts:  true,
 10761  		},
 10762  	}, {
 10763  		name: "wipe_all",
 10764  		create: svcTestCase{
 10765  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10766  				svctest.SetPorts(
 10767  					svctest.MakeServicePort("p", 80, intstr.FromInt32(80), api.ProtocolTCP),
 10768  					svctest.MakeServicePort("q", 443, intstr.FromInt32(443), api.ProtocolTCP))),
 10769  			expectClusterIPs: true,
 10770  			expectNodePorts:  true,
 10771  		},
 10772  		update: svcTestCase{
 10773  			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 10774  				svctest.SetPorts()),
 10775  			expectError:     true,
 10776  			expectNodePorts: true,
 10777  		},
 10778  	}}
 10779  
 10780  	helpTestCreateUpdateDelete(t, testCases)
 10781  }
 10782  
 10783  func TestFeatureSessionAffinity(t *testing.T) {
 10784  	testCases := []cudTestCase{{
 10785  		name: "None-ClientIPNoConfig",
 10786  		create: svcTestCase{
 10787  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10788  				svctest.SetSessionAffinity(api.ServiceAffinityNone)),
 10789  			expectClusterIPs: true,
 10790  		},
 10791  		update: svcTestCase{
 10792  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10793  				func(s *api.Service) {
 10794  					// Set it without setting the config
 10795  					s.Spec.SessionAffinity = api.ServiceAffinityClientIP
 10796  				}),
 10797  			expectError: true,
 10798  		},
 10799  	}, {
 10800  		name: "None-ClientIP",
 10801  		create: svcTestCase{
 10802  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10803  				svctest.SetSessionAffinity(api.ServiceAffinityNone)),
 10804  			expectClusterIPs: true,
 10805  		},
 10806  		update: svcTestCase{
 10807  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10808  				svctest.SetSessionAffinity(api.ServiceAffinityClientIP)),
 10809  			expectClusterIPs: true,
 10810  		},
 10811  	}, {
 10812  		name: "ClientIP-NoneWithConfig",
 10813  		create: svcTestCase{
 10814  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10815  				svctest.SetSessionAffinity(api.ServiceAffinityClientIP)),
 10816  			expectClusterIPs: true,
 10817  		},
 10818  		update: svcTestCase{
 10819  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10820  				svctest.SetSessionAffinity(api.ServiceAffinityClientIP),
 10821  				func(s *api.Service) {
 10822  					// Set it without wiping the config
 10823  					s.Spec.SessionAffinity = api.ServiceAffinityNone
 10824  				}),
 10825  			expectError: true,
 10826  		},
 10827  	}, {
 10828  		name: "ClientIP-None",
 10829  		create: svcTestCase{
 10830  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10831  				svctest.SetSessionAffinity(api.ServiceAffinityClientIP)),
 10832  			expectClusterIPs: true,
 10833  		},
 10834  		update: svcTestCase{
 10835  			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
 10836  				svctest.SetSessionAffinity(api.ServiceAffinityNone),
 10837  				func(s *api.Service) {
 10838  					s.Spec.SessionAffinityConfig = nil
 10839  				}),
 10840  			expectClusterIPs: true,
 10841  		},
 10842  	}}
 10843  
 10844  	helpTestCreateUpdateDelete(t, testCases)
 10845  }
 10846  
 10847  func TestFeatureType(t *testing.T) {
 10848  	testCases := []cudTestCase{{
 10849  		name: "ExternalName-ClusterIP",
 10850  		create: svcTestCase{
 10851  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10852  		},
 10853  		update: svcTestCase{
 10854  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10855  			expectClusterIPs: true,
 10856  		},
 10857  	}, {
 10858  		name: "ClusterIP-ExternalName",
 10859  		create: svcTestCase{
 10860  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10861  			expectClusterIPs: true,
 10862  		},
 10863  		update: svcTestCase{
 10864  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10865  		},
 10866  	}, {
 10867  		name: "ExternalName-NodePort",
 10868  		create: svcTestCase{
 10869  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10870  		},
 10871  		update: svcTestCase{
 10872  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
 10873  			expectClusterIPs: true,
 10874  			expectNodePorts:  true,
 10875  		},
 10876  	}, {
 10877  		name: "NodePort-ExternalName",
 10878  		create: svcTestCase{
 10879  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
 10880  			expectClusterIPs: true,
 10881  			expectNodePorts:  true,
 10882  		},
 10883  		update: svcTestCase{
 10884  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10885  		},
 10886  	}, {
 10887  		name: "ExternalName-LoadBalancer",
 10888  		create: svcTestCase{
 10889  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10890  		},
 10891  		update: svcTestCase{
 10892  			svc:              svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 10893  			expectClusterIPs: true,
 10894  			expectNodePorts:  true,
 10895  		},
 10896  	}, {
 10897  		name: "LoadBalancer-ExternalName",
 10898  		create: svcTestCase{
 10899  			svc:              svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 10900  			expectClusterIPs: true,
 10901  			expectNodePorts:  true,
 10902  		},
 10903  		update: svcTestCase{
 10904  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10905  		},
 10906  	}, {
 10907  		name: "ClusterIP-NodePort",
 10908  		create: svcTestCase{
 10909  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10910  			expectClusterIPs: true,
 10911  		},
 10912  		update: svcTestCase{
 10913  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
 10914  			expectClusterIPs: true,
 10915  			expectNodePorts:  true,
 10916  		},
 10917  	}, {
 10918  		name: "NodePort-ClusterIP",
 10919  		create: svcTestCase{
 10920  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
 10921  			expectClusterIPs: true,
 10922  			expectNodePorts:  true,
 10923  		},
 10924  		update: svcTestCase{
 10925  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10926  			expectClusterIPs: true,
 10927  		},
 10928  	}, {
 10929  		name: "ClusterIP-LoadBalancer",
 10930  		create: svcTestCase{
 10931  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10932  			expectClusterIPs: true,
 10933  		},
 10934  		update: svcTestCase{
 10935  			svc:              svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 10936  			expectClusterIPs: true,
 10937  			expectNodePorts:  true,
 10938  		},
 10939  	}, {
 10940  		name: "LoadBalancer-ClusterIP",
 10941  		create: svcTestCase{
 10942  			svc:              svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 10943  			expectClusterIPs: true,
 10944  			expectNodePorts:  true,
 10945  		},
 10946  		update: svcTestCase{
 10947  			svc:              svctest.MakeService("foo", svctest.SetTypeClusterIP),
 10948  			expectClusterIPs: true,
 10949  		},
 10950  	}, {
 10951  		name: "NodePort-LoadBalancer",
 10952  		create: svcTestCase{
 10953  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
 10954  			expectClusterIPs: true,
 10955  			expectNodePorts:  true,
 10956  		},
 10957  		update: svcTestCase{
 10958  			svc:              svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 10959  			expectClusterIPs: true,
 10960  			expectNodePorts:  true,
 10961  		},
 10962  	}, {
 10963  		name: "LoadBalancer-NodePort",
 10964  		create: svcTestCase{
 10965  			svc:              svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 10966  			expectClusterIPs: true,
 10967  			expectNodePorts:  true,
 10968  		},
 10969  		update: svcTestCase{
 10970  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
 10971  			expectClusterIPs: true,
 10972  			expectNodePorts:  true,
 10973  		},
 10974  	}, {
 10975  		name: "Headless-ExternalName",
 10976  		create: svcTestCase{
 10977  			svc:            svctest.MakeService("foo", svctest.SetHeadless),
 10978  			expectHeadless: true,
 10979  		},
 10980  		update: svcTestCase{
 10981  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10982  		},
 10983  	}, {
 10984  		name: "ExternalName-Headless",
 10985  		create: svcTestCase{
 10986  			svc: svctest.MakeService("foo", svctest.SetTypeExternalName),
 10987  		},
 10988  		update: svcTestCase{
 10989  			svc:            svctest.MakeService("foo", svctest.SetHeadless),
 10990  			expectHeadless: true,
 10991  		},
 10992  	}, {
 10993  		name: "Headless-NodePort",
 10994  		create: svcTestCase{
 10995  			svc:            svctest.MakeService("foo", svctest.SetHeadless),
 10996  			expectHeadless: true,
 10997  		},
 10998  		update: svcTestCase{
 10999  			svc:         svctest.MakeService("foo", svctest.SetTypeNodePort),
 11000  			expectError: true,
 11001  		},
 11002  	}, {
 11003  		name: "NodePort-Headless",
 11004  		create: svcTestCase{
 11005  			svc:              svctest.MakeService("foo", svctest.SetTypeNodePort),
 11006  			expectClusterIPs: true,
 11007  			expectNodePorts:  true,
 11008  		},
 11009  		update: svcTestCase{
 11010  			svc:         svctest.MakeService("foo", svctest.SetHeadless),
 11011  			expectError: true,
 11012  		},
 11013  	}, {
 11014  		name: "Headless-LoadBalancer",
 11015  		create: svcTestCase{
 11016  			svc:            svctest.MakeService("foo", svctest.SetHeadless),
 11017  			expectHeadless: true,
 11018  		},
 11019  		update: svcTestCase{
 11020  			svc:         svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 11021  			expectError: true,
 11022  		},
 11023  	}, {
 11024  		name: "LoadBalancer-Headless",
 11025  		create: svcTestCase{
 11026  			svc:              svctest.MakeService("foo", svctest.SetTypeLoadBalancer),
 11027  			expectClusterIPs: true,
 11028  			expectNodePorts:  true,
 11029  		},
 11030  		update: svcTestCase{
 11031  			svc:         svctest.MakeService("foo", svctest.SetHeadless),
 11032  			expectError: true,
 11033  		},
 11034  	}}
 11035  
 11036  	helpTestCreateUpdateDelete(t, testCases)
 11037  }
 11038  
 11039  func TestFeatureExternalTrafficPolicy(t *testing.T) {
 11040  	testCases := []cudTestCase{{
 11041  		name: "ExternalName_policy:none_hcnp:specified",
 11042  		create: svcTestCase{
 11043  			svc: svctest.MakeService("foo",
 11044  				svctest.SetTypeExternalName,
 11045  				svctest.SetExternalTrafficPolicy(""),
 11046  				svctest.SetHealthCheckNodePort(30000)),
 11047  			expectError: true,
 11048  		},
 11049  	}, {
 11050  		name: "ExternalName_policy:Cluster_hcnp:none",
 11051  		create: svcTestCase{
 11052  			svc: svctest.MakeService("foo",
 11053  				svctest.SetTypeExternalName,
 11054  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11055  			expectError: true,
 11056  		},
 11057  	}, {
 11058  		name: "ExternalName_policy:Cluster_hcnp:specified",
 11059  		create: svcTestCase{
 11060  			svc: svctest.MakeService("foo",
 11061  				svctest.SetTypeExternalName,
 11062  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster),
 11063  				svctest.SetHealthCheckNodePort(30000)),
 11064  			expectError: true,
 11065  		},
 11066  	}, {
 11067  		name: "ExternalName_policy:Local_hcnp:none",
 11068  		create: svcTestCase{
 11069  			svc: svctest.MakeService("foo",
 11070  				svctest.SetTypeExternalName,
 11071  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
 11072  			expectError: true,
 11073  		},
 11074  	}, {
 11075  		name: "ExternalName_policy:Local_hcnp:specified",
 11076  		create: svcTestCase{
 11077  			svc: svctest.MakeService("foo",
 11078  				svctest.SetTypeExternalName,
 11079  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11080  				svctest.SetHealthCheckNodePort(30000)),
 11081  			expectError: true,
 11082  		},
 11083  	}, {
 11084  		name: "ClusterIP_policy:none_hcnp:none_policy:Cluster_hcnp:none",
 11085  		create: svcTestCase{
 11086  			svc: svctest.MakeService("foo",
 11087  				svctest.SetTypeClusterIP,
 11088  				svctest.SetExternalTrafficPolicy("")),
 11089  			expectClusterIPs: true,
 11090  		},
 11091  		update: svcTestCase{
 11092  			svc: svctest.MakeService("foo",
 11093  				svctest.SetTypeClusterIP,
 11094  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11095  			expectError: true,
 11096  		},
 11097  	}, {
 11098  		name: "ClusterIP_policy:none_hcnp:specified",
 11099  		create: svcTestCase{
 11100  			svc: svctest.MakeService("foo",
 11101  				svctest.SetTypeClusterIP,
 11102  				svctest.SetExternalTrafficPolicy(""),
 11103  				svctest.SetHealthCheckNodePort(30000)),
 11104  			expectError: true,
 11105  		},
 11106  	}, {
 11107  		name: "ClusterIP_policy:Cluster_hcnp:none",
 11108  		create: svcTestCase{
 11109  			svc: svctest.MakeService("foo",
 11110  				svctest.SetTypeClusterIP,
 11111  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11112  			expectError: true,
 11113  		},
 11114  	}, {
 11115  		name: "ClusterIP_policy:Cluster_hcnp:specified",
 11116  		create: svcTestCase{
 11117  			svc: svctest.MakeService("foo",
 11118  				svctest.SetTypeClusterIP,
 11119  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster),
 11120  				svctest.SetHealthCheckNodePort(30000)),
 11121  			expectError: true,
 11122  		},
 11123  	}, {
 11124  		name: "ClusterIP_policy:Local_hcnp:none",
 11125  		create: svcTestCase{
 11126  			svc: svctest.MakeService("foo",
 11127  				svctest.SetTypeClusterIP,
 11128  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
 11129  			expectError: true,
 11130  		},
 11131  	}, {
 11132  		name: "ClusterIP_policy:Local_hcnp:specified",
 11133  		create: svcTestCase{
 11134  			svc: svctest.MakeService("foo",
 11135  				svctest.SetTypeClusterIP,
 11136  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11137  				svctest.SetHealthCheckNodePort(30000)),
 11138  			expectError: true,
 11139  		},
 11140  	}, {
 11141  		name: "NodePort_policy:none_hcnp:none",
 11142  		create: svcTestCase{
 11143  			svc: svctest.MakeService("foo",
 11144  				svctest.SetTypeNodePort,
 11145  				svctest.SetExternalTrafficPolicy("")),
 11146  			expectError: true,
 11147  		},
 11148  	}, {
 11149  		name: "NodePort_policy:none_hcnp:specified",
 11150  		create: svcTestCase{
 11151  			svc: svctest.MakeService("foo",
 11152  				svctest.SetTypeNodePort,
 11153  				svctest.SetExternalTrafficPolicy(""),
 11154  				svctest.SetHealthCheckNodePort(30000)),
 11155  			expectError: true,
 11156  		},
 11157  	}, {
 11158  		name: "NodePort_policy:Cluster_hcnp:none_policy:Local_hcnp:none",
 11159  		create: svcTestCase{
 11160  			svc: svctest.MakeService("foo",
 11161  				svctest.SetTypeNodePort,
 11162  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11163  			expectClusterIPs:          true,
 11164  			expectNodePorts:           true,
 11165  			expectHealthCheckNodePort: false,
 11166  		},
 11167  		update: svcTestCase{
 11168  			svc: svctest.MakeService("foo",
 11169  				svctest.SetTypeNodePort,
 11170  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
 11171  			expectClusterIPs:          true,
 11172  			expectNodePorts:           true,
 11173  			expectHealthCheckNodePort: false,
 11174  		},
 11175  	}, {
 11176  		name: "NodePort_policy:Cluster_hcnp:specified",
 11177  		create: svcTestCase{
 11178  			svc: svctest.MakeService("foo",
 11179  				svctest.SetTypeNodePort,
 11180  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster),
 11181  				svctest.SetHealthCheckNodePort(30000)),
 11182  			expectError: true,
 11183  		},
 11184  	}, {
 11185  		name: "NodePort_policy:Local_hcnp:none_policy:Cluster_hcnp:none",
 11186  		create: svcTestCase{
 11187  			svc: svctest.MakeService("foo",
 11188  				svctest.SetTypeNodePort,
 11189  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
 11190  			expectClusterIPs:          true,
 11191  			expectNodePorts:           true,
 11192  			expectHealthCheckNodePort: false,
 11193  		},
 11194  		update: svcTestCase{
 11195  			svc: svctest.MakeService("foo",
 11196  				svctest.SetTypeNodePort,
 11197  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11198  			expectClusterIPs:          true,
 11199  			expectNodePorts:           true,
 11200  			expectHealthCheckNodePort: false,
 11201  		},
 11202  	}, {
 11203  		name: "NodePort_policy:Local_hcnp:specified",
 11204  		create: svcTestCase{
 11205  			svc: svctest.MakeService("foo",
 11206  				svctest.SetTypeNodePort,
 11207  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11208  				svctest.SetHealthCheckNodePort(30000)),
 11209  			expectError: true,
 11210  		},
 11211  	}, {
 11212  		name: "LoadBalancer_policy:none_hcnp:none",
 11213  		create: svcTestCase{
 11214  			svc: svctest.MakeService("foo",
 11215  				svctest.SetTypeLoadBalancer,
 11216  				svctest.SetExternalTrafficPolicy("")),
 11217  			expectError: true,
 11218  		},
 11219  	}, {
 11220  		name: "LoadBalancer_policy:none_hcnp:specified",
 11221  		create: svcTestCase{
 11222  			svc: svctest.MakeService("foo",
 11223  				svctest.SetTypeLoadBalancer,
 11224  				svctest.SetExternalTrafficPolicy(""),
 11225  				svctest.SetHealthCheckNodePort(30000)),
 11226  			expectError: true,
 11227  		},
 11228  	}, {
 11229  		name: "LoadBalancer_policy:Cluster_hcnp:none_policy:Local_hcnp:none",
 11230  		create: svcTestCase{
 11231  			svc: svctest.MakeService("foo",
 11232  				svctest.SetTypeLoadBalancer,
 11233  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11234  			expectClusterIPs:          true,
 11235  			expectNodePorts:           true,
 11236  			expectHealthCheckNodePort: false,
 11237  		},
 11238  		update: svcTestCase{
 11239  			svc: svctest.MakeService("foo",
 11240  				svctest.SetTypeLoadBalancer,
 11241  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
 11242  			expectClusterIPs:          true,
 11243  			expectNodePorts:           true,
 11244  			expectHealthCheckNodePort: true,
 11245  		},
 11246  	}, {
 11247  		name: "LoadBalancer_policy:Cluster_hcnp:none_policy:Local_hcnp:specified",
 11248  		create: svcTestCase{
 11249  			svc: svctest.MakeService("foo",
 11250  				svctest.SetTypeLoadBalancer,
 11251  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11252  			expectClusterIPs:          true,
 11253  			expectNodePorts:           true,
 11254  			expectHealthCheckNodePort: false,
 11255  		},
 11256  		update: svcTestCase{
 11257  			svc: svctest.MakeService("foo",
 11258  				svctest.SetTypeLoadBalancer,
 11259  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11260  				svctest.SetHealthCheckNodePort(30000)),
 11261  			expectClusterIPs:          true,
 11262  			expectNodePorts:           true,
 11263  			expectHealthCheckNodePort: true,
 11264  		},
 11265  	}, {
 11266  		name: "LoadBalancer_policy:Cluster_hcnp:specified",
 11267  		create: svcTestCase{
 11268  			svc: svctest.MakeService("foo",
 11269  				svctest.SetTypeLoadBalancer,
 11270  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster),
 11271  				svctest.SetHealthCheckNodePort(30000)),
 11272  			expectError: true,
 11273  		},
 11274  	}, {
 11275  		name: "LoadBalancer_policy:Local_hcnp:none_policy:Cluster_hcnp:none",
 11276  		create: svcTestCase{
 11277  			svc: svctest.MakeService("foo",
 11278  				svctest.SetTypeLoadBalancer,
 11279  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
 11280  			expectClusterIPs:          true,
 11281  			expectNodePorts:           true,
 11282  			expectHealthCheckNodePort: true,
 11283  		},
 11284  		update: svcTestCase{
 11285  			svc: svctest.MakeService("foo",
 11286  				svctest.SetTypeLoadBalancer,
 11287  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11288  			expectClusterIPs:          true,
 11289  			expectNodePorts:           true,
 11290  			expectHealthCheckNodePort: false,
 11291  		},
 11292  	}, {
 11293  		name: "LoadBalancer_policy:Local_hcnp:specified_policy:Cluster_hcnp:none",
 11294  		create: svcTestCase{
 11295  			svc: svctest.MakeService("foo",
 11296  				svctest.SetTypeLoadBalancer,
 11297  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11298  				svctest.SetHealthCheckNodePort(30000)),
 11299  			expectClusterIPs:          true,
 11300  			expectNodePorts:           true,
 11301  			expectHealthCheckNodePort: true,
 11302  		},
 11303  		update: svcTestCase{
 11304  			svc: svctest.MakeService("foo",
 11305  				svctest.SetTypeLoadBalancer,
 11306  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyCluster)),
 11307  			expectClusterIPs:          true,
 11308  			expectNodePorts:           true,
 11309  			expectHealthCheckNodePort: false,
 11310  		},
 11311  	}, {
 11312  		name: "LoadBalancer_policy:Local_hcnp:specified_policy:Cluster_hcnp:different",
 11313  		create: svcTestCase{
 11314  			svc: svctest.MakeService("foo",
 11315  				svctest.SetTypeLoadBalancer,
 11316  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11317  				svctest.SetHealthCheckNodePort(30000)),
 11318  			expectClusterIPs:          true,
 11319  			expectNodePorts:           true,
 11320  			expectHealthCheckNodePort: true,
 11321  		},
 11322  		update: svcTestCase{
 11323  			svc: svctest.MakeService("foo",
 11324  				svctest.SetTypeLoadBalancer,
 11325  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11326  				svctest.SetHealthCheckNodePort(30001)),
 11327  			expectError: true,
 11328  		},
 11329  	}, {
 11330  		name: "LoadBalancer_policy:Local_hcnp:none_policy:Inalid",
 11331  		create: svcTestCase{
 11332  			svc: svctest.MakeService("foo",
 11333  				svctest.SetTypeLoadBalancer,
 11334  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal)),
 11335  			expectClusterIPs:          true,
 11336  			expectNodePorts:           true,
 11337  			expectHealthCheckNodePort: true,
 11338  		},
 11339  		update: svcTestCase{
 11340  			svc: svctest.MakeService("foo",
 11341  				svctest.SetTypeLoadBalancer,
 11342  				svctest.SetExternalTrafficPolicy("Invalid")),
 11343  			expectError: true,
 11344  		},
 11345  	}, {
 11346  		name: "LoadBalancer_policy:Local_hcnp:negative",
 11347  		create: svcTestCase{
 11348  			svc: svctest.MakeService("foo",
 11349  				svctest.SetTypeLoadBalancer,
 11350  				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyLocal),
 11351  				svctest.SetHealthCheckNodePort(-1)),
 11352  			expectError: true,
 11353  		},
 11354  	}}
 11355  
 11356  	helpTestCreateUpdateDelete(t, testCases)
 11357  }
 11358  
 11359  func TestFeatureInternalTrafficPolicy(t *testing.T) {
 11360  	prove := func(proofs ...svcTestProof) []svcTestProof {
 11361  		return proofs
 11362  	}
 11363  	proveITP := func(want api.ServiceInternalTrafficPolicy) svcTestProof {
 11364  		return func(t *testing.T, storage *wrapperRESTForTests, before, after *api.Service) {
 11365  			t.Helper()
 11366  			if got := after.Spec.InternalTrafficPolicy; got == nil {
 11367  				if want != "" {
 11368  					t.Errorf("internalTrafficPolicy was nil")
 11369  				}
 11370  			} else if *got != want {
 11371  				if want == "" {
 11372  					want = "nil"
 11373  				}
 11374  				t.Errorf("wrong internalTrafficPoilcy: expected %s, got %s", want, *got)
 11375  			}
 11376  		}
 11377  	}
 11378  
 11379  	testCases := []cudTestCase{{
 11380  		name: "ExternalName_policy:none-ExternalName_policy:none",
 11381  		create: svcTestCase{
 11382  			svc: svctest.MakeService("foo",
 11383  				svctest.SetTypeExternalName),
 11384  			prove: prove(proveITP("")),
 11385  		},
 11386  		update: svcTestCase{
 11387  			svc: svctest.MakeService("foo",
 11388  				svctest.SetTypeExternalName),
 11389  			prove: prove(proveITP("")),
 11390  		},
 11391  	}, {
 11392  		name: "ClusterIP_policy:none-ClusterIP_policy:Local",
 11393  		create: svcTestCase{
 11394  			svc: svctest.MakeService("foo",
 11395  				svctest.SetTypeClusterIP),
 11396  			expectClusterIPs: true,
 11397  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11398  		},
 11399  		update: svcTestCase{
 11400  			svc: svctest.MakeService("foo",
 11401  				svctest.SetTypeClusterIP,
 11402  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11403  			expectClusterIPs: true,
 11404  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11405  		},
 11406  	}, {
 11407  		name: "ClusterIP_policy:Cluster-ClusterIP_policy:Local",
 11408  		create: svcTestCase{
 11409  			svc: svctest.MakeService("foo",
 11410  				svctest.SetTypeClusterIP,
 11411  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyCluster)),
 11412  			expectClusterIPs: true,
 11413  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11414  		},
 11415  		update: svcTestCase{
 11416  			svc: svctest.MakeService("foo",
 11417  				svctest.SetTypeClusterIP,
 11418  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11419  			expectClusterIPs: true,
 11420  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11421  		},
 11422  	}, {
 11423  		name: "NodePort_policy:none-NodePort_policy:Local",
 11424  		create: svcTestCase{
 11425  			svc: svctest.MakeService("foo",
 11426  				svctest.SetTypeNodePort),
 11427  			expectClusterIPs: true,
 11428  			expectNodePorts:  true,
 11429  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11430  		},
 11431  		update: svcTestCase{
 11432  			svc: svctest.MakeService("foo",
 11433  				svctest.SetTypeNodePort,
 11434  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11435  			expectClusterIPs: true,
 11436  			expectNodePorts:  true,
 11437  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11438  		},
 11439  	}, {
 11440  		name: "NodePort_policy:Cluster-NodePort_policy:Local",
 11441  		create: svcTestCase{
 11442  			svc: svctest.MakeService("foo",
 11443  				svctest.SetTypeNodePort,
 11444  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyCluster)),
 11445  			expectClusterIPs: true,
 11446  			expectNodePorts:  true,
 11447  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11448  		},
 11449  		update: svcTestCase{
 11450  			svc: svctest.MakeService("foo",
 11451  				svctest.SetTypeNodePort,
 11452  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11453  			expectClusterIPs: true,
 11454  			expectNodePorts:  true,
 11455  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11456  		},
 11457  	}, {
 11458  		name: "LoadBalancer_policy:none-LoadBalancer_policy:Local",
 11459  		create: svcTestCase{
 11460  			svc: svctest.MakeService("foo",
 11461  				svctest.SetTypeLoadBalancer),
 11462  			expectClusterIPs: true,
 11463  			expectNodePorts:  true,
 11464  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11465  		},
 11466  		update: svcTestCase{
 11467  			svc: svctest.MakeService("foo",
 11468  				svctest.SetTypeLoadBalancer,
 11469  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11470  			expectClusterIPs: true,
 11471  			expectNodePorts:  true,
 11472  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11473  		},
 11474  	}, {
 11475  		name: "LoadBalancer_policy:Cluster-LoadBalancer_policy:Local",
 11476  		create: svcTestCase{
 11477  			svc: svctest.MakeService("foo",
 11478  				svctest.SetTypeLoadBalancer,
 11479  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyCluster)),
 11480  			expectClusterIPs: true,
 11481  			expectNodePorts:  true,
 11482  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11483  		},
 11484  		update: svcTestCase{
 11485  			svc: svctest.MakeService("foo",
 11486  				svctest.SetTypeLoadBalancer,
 11487  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11488  			expectClusterIPs: true,
 11489  			expectNodePorts:  true,
 11490  			prove:            prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11491  		},
 11492  	}, {
 11493  		name: "Headless_policy:none-Headless_policy:Local",
 11494  		create: svcTestCase{
 11495  			svc: svctest.MakeService("foo",
 11496  				svctest.SetHeadless),
 11497  			expectHeadless: true,
 11498  			prove:          prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11499  		},
 11500  		update: svcTestCase{
 11501  			svc: svctest.MakeService("foo",
 11502  				svctest.SetHeadless,
 11503  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11504  			expectHeadless: true,
 11505  			prove:          prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11506  		},
 11507  	}, {
 11508  		name: "Headless_policy:Cluster-Headless_policy:Local",
 11509  		create: svcTestCase{
 11510  			svc: svctest.MakeService("foo",
 11511  				svctest.SetHeadless,
 11512  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyCluster)),
 11513  			expectHeadless: true,
 11514  			prove:          prove(proveITP(api.ServiceInternalTrafficPolicyCluster)),
 11515  		},
 11516  		update: svcTestCase{
 11517  			svc: svctest.MakeService("foo",
 11518  				svctest.SetHeadless,
 11519  				svctest.SetInternalTrafficPolicy(api.ServiceInternalTrafficPolicyLocal)),
 11520  			expectHeadless: true,
 11521  			prove:          prove(proveITP(api.ServiceInternalTrafficPolicyLocal)),
 11522  		},
 11523  	}}
 11524  
 11525  	helpTestCreateUpdateDelete(t, testCases)
 11526  }
 11527  
 11528  // TODO(thockin): We need to look at feature-tests for:
 11529  //   externalIPs, lbip, lbsourceranges, externalname, PublishNotReadyAddresses, AllocateLoadBalancerNodePorts, LoadBalancerClass, status
 11530  
 11531  // this is local because it's not fully fleshed out enough for general use.
 11532  func makePod(name string, ips ...string) api.Pod {
 11533  	p := api.Pod{
 11534  		ObjectMeta: metav1.ObjectMeta{
 11535  			Name:      name,
 11536  			Namespace: metav1.NamespaceDefault,
 11537  		},
 11538  		Spec: api.PodSpec{
 11539  			RestartPolicy: api.RestartPolicyAlways,
 11540  			DNSPolicy:     api.DNSDefault,
 11541  			Containers:    []api.Container{{Name: "ctr", Image: "img", ImagePullPolicy: api.PullIfNotPresent, TerminationMessagePolicy: api.TerminationMessageReadFile}},
 11542  		},
 11543  		Status: api.PodStatus{
 11544  			PodIPs: []api.PodIP{},
 11545  		},
 11546  	}
 11547  
 11548  	for _, ip := range ips {
 11549  		p.Status.PodIPs = append(p.Status.PodIPs, api.PodIP{IP: ip})
 11550  	}
 11551  
 11552  	return p
 11553  }
 11554  
 11555  func TestServiceRegistryResourceLocation(t *testing.T) {
 11556  	pods := []api.Pod{
 11557  		makePod("unnamed", "1.2.3.4", "1.2.3.5"),
 11558  		makePod("named", "1.2.3.6", "1.2.3.7"),
 11559  		makePod("no-endpoints", "9.9.9.9"), // to prove this does not get chosen
 11560  	}
 11561  
 11562  	endpoints := []*api.Endpoints{
 11563  		epstest.MakeEndpoints("unnamed",
 11564  			[]api.EndpointAddress{
 11565  				epstest.MakeEndpointAddress("1.2.3.4", "unnamed"),
 11566  			},
 11567  			[]api.EndpointPort{
 11568  				epstest.MakeEndpointPort("", 80),
 11569  			}),
 11570  		epstest.MakeEndpoints("unnamed2",
 11571  			[]api.EndpointAddress{
 11572  				epstest.MakeEndpointAddress("1.2.3.5", "unnamed"),
 11573  			},
 11574  			[]api.EndpointPort{
 11575  				epstest.MakeEndpointPort("", 80),
 11576  			}),
 11577  		epstest.MakeEndpoints("named",
 11578  			[]api.EndpointAddress{
 11579  				epstest.MakeEndpointAddress("1.2.3.6", "named"),
 11580  			},
 11581  			[]api.EndpointPort{
 11582  				epstest.MakeEndpointPort("p", 80),
 11583  				epstest.MakeEndpointPort("q", 81),
 11584  			}),
 11585  		epstest.MakeEndpoints("no-endpoints", nil, nil), // to prove this does not get chosen
 11586  	}
 11587  
 11588  	storage, _, server := newStorageWithPods(t, []api.IPFamily{api.IPv4Protocol}, pods, endpoints)
 11589  	defer server.Terminate(t)
 11590  	defer storage.Store.DestroyFunc()
 11591  
 11592  	ctx := genericapirequest.NewDefaultContext()
 11593  	for _, name := range []string{"unnamed", "unnamed2", "no-endpoints"} {
 11594  		_, err := storage.Create(ctx,
 11595  			svctest.MakeService(name,
 11596  				svctest.SetPorts(
 11597  					svctest.MakeServicePort("", 93, intstr.FromInt32(80), api.ProtocolTCP))),
 11598  			rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
 11599  		if err != nil {
 11600  			t.Fatalf("unexpected error creating service %q: %v", name, err)
 11601  		}
 11602  
 11603  	}
 11604  	_, err := storage.Create(ctx,
 11605  		svctest.MakeService("named",
 11606  			svctest.SetPorts(
 11607  				svctest.MakeServicePort("p", 93, intstr.FromInt32(80), api.ProtocolTCP),
 11608  				svctest.MakeServicePort("q", 76, intstr.FromInt32(81), api.ProtocolTCP))),
 11609  		rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
 11610  	if err != nil {
 11611  		t.Fatalf("unexpected error creating service %q: %v", "named", err)
 11612  	}
 11613  	redirector := rest.Redirector(storage)
 11614  
 11615  	cases := []struct {
 11616  		query  string
 11617  		err    bool
 11618  		expect string
 11619  	}{{
 11620  		query:  "unnamed",
 11621  		expect: "//1.2.3.4:80",
 11622  	}, {
 11623  		query:  "unnamed:",
 11624  		expect: "//1.2.3.4:80",
 11625  	}, {
 11626  		query:  "unnamed:93",
 11627  		expect: "//1.2.3.4:80",
 11628  	}, {
 11629  		query:  "http:unnamed:",
 11630  		expect: "http://1.2.3.4:80",
 11631  	}, {
 11632  		query:  "http:unnamed:93",
 11633  		expect: "http://1.2.3.4:80",
 11634  	}, {
 11635  		query: "unnamed:80",
 11636  		err:   true,
 11637  	}, {
 11638  		query:  "unnamed2",
 11639  		expect: "//1.2.3.5:80",
 11640  	}, {
 11641  		query:  "named:p",
 11642  		expect: "//1.2.3.6:80",
 11643  	}, {
 11644  		query:  "named:q",
 11645  		expect: "//1.2.3.6:81",
 11646  	}, {
 11647  		query:  "named:93",
 11648  		expect: "//1.2.3.6:80",
 11649  	}, {
 11650  		query:  "named:76",
 11651  		expect: "//1.2.3.6:81",
 11652  	}, {
 11653  		query:  "http:named:p",
 11654  		expect: "http://1.2.3.6:80",
 11655  	}, {
 11656  		query:  "http:named:q",
 11657  		expect: "http://1.2.3.6:81",
 11658  	}, {
 11659  		query: "named:bad",
 11660  		err:   true,
 11661  	}, {
 11662  		query: "no-endpoints",
 11663  		err:   true,
 11664  	}, {
 11665  		query: "non-existent",
 11666  		err:   true,
 11667  	}}
 11668  	for _, tc := range cases {
 11669  		t.Run(tc.query, func(t *testing.T) {
 11670  			location, _, err := redirector.ResourceLocation(ctx, tc.query)
 11671  			if tc.err == false && err != nil {
 11672  				t.Fatalf("unexpected error: %v", err)
 11673  			}
 11674  			if tc.err && err == nil {
 11675  				t.Fatalf("unexpected success")
 11676  			}
 11677  			if !tc.err {
 11678  				if location == nil {
 11679  					t.Errorf("unexpected location: %v", location)
 11680  				}
 11681  				if e, a := tc.expect, location.String(); e != a {
 11682  					t.Errorf("expected %q, but got %q", e, a)
 11683  				}
 11684  			}
 11685  		})
 11686  	}
 11687  }
 11688  
 11689  func TestUpdateServiceLoadBalancerStatus(t *testing.T) {
 11690  	storage, statusStorage, server := newStorage(t, []api.IPFamily{api.IPv4Protocol})
 11691  	defer server.Terminate(t)
 11692  	defer storage.Store.DestroyFunc()
 11693  	defer statusStorage.store.DestroyFunc()
 11694  
 11695  	ipModeVIP := api.LoadBalancerIPModeVIP
 11696  	ipModeProxy := api.LoadBalancerIPModeProxy
 11697  	ipModeDummy := api.LoadBalancerIPMode("dummy")
 11698  
 11699  	testCases := []struct {
 11700  		name                   string
 11701  		ipModeEnabled          bool
 11702  		statusBeforeUpdate     api.ServiceStatus
 11703  		newStatus              api.ServiceStatus
 11704  		expectedStatus         api.ServiceStatus
 11705  		expectErr              bool
 11706  		expectedReasonForError metav1.StatusReason
 11707  	}{
 11708  		/*LoadBalancerIPMode disabled*/
 11709  		{
 11710  			name:               "LoadBalancerIPMode disabled, ipMode not used in old, not used in new",
 11711  			ipModeEnabled:      false,
 11712  			statusBeforeUpdate: api.ServiceStatus{},
 11713  			newStatus: api.ServiceStatus{
 11714  				LoadBalancer: api.LoadBalancerStatus{
 11715  					Ingress: []api.LoadBalancerIngress{{
 11716  						IP: "1.2.3.4",
 11717  					}},
 11718  				},
 11719  			},
 11720  			expectedStatus: api.ServiceStatus{
 11721  				LoadBalancer: api.LoadBalancerStatus{
 11722  					Ingress: []api.LoadBalancerIngress{{
 11723  						IP: "1.2.3.4",
 11724  					}},
 11725  				},
 11726  			},
 11727  			expectErr: false,
 11728  		}, {
 11729  			name:          "LoadBalancerIPMode disabled, ipMode used in old and in new",
 11730  			ipModeEnabled: false,
 11731  			statusBeforeUpdate: api.ServiceStatus{
 11732  				LoadBalancer: api.LoadBalancerStatus{
 11733  					Ingress: []api.LoadBalancerIngress{{
 11734  						IP:     "1.2.3.4",
 11735  						IPMode: &ipModeVIP,
 11736  					}},
 11737  				},
 11738  			},
 11739  			newStatus: api.ServiceStatus{
 11740  				LoadBalancer: api.LoadBalancerStatus{
 11741  					Ingress: []api.LoadBalancerIngress{{
 11742  						IP:     "1.2.3.4",
 11743  						IPMode: &ipModeProxy,
 11744  					}},
 11745  				},
 11746  			},
 11747  			expectedStatus: api.ServiceStatus{
 11748  				LoadBalancer: api.LoadBalancerStatus{
 11749  					Ingress: []api.LoadBalancerIngress{{
 11750  						IP:     "1.2.3.4",
 11751  						IPMode: &ipModeProxy,
 11752  					}},
 11753  				},
 11754  			},
 11755  			expectErr: false,
 11756  		}, {
 11757  			name:          "LoadBalancerIPMode disabled, ipMode not used in old, used in new",
 11758  			ipModeEnabled: false,
 11759  			statusBeforeUpdate: api.ServiceStatus{
 11760  				LoadBalancer: api.LoadBalancerStatus{
 11761  					Ingress: []api.LoadBalancerIngress{{
 11762  						IP: "1.2.3.4",
 11763  					}},
 11764  				},
 11765  			},
 11766  			newStatus: api.ServiceStatus{
 11767  				LoadBalancer: api.LoadBalancerStatus{
 11768  					Ingress: []api.LoadBalancerIngress{{
 11769  						IP:     "1.2.3.4",
 11770  						IPMode: &ipModeProxy,
 11771  					}},
 11772  				},
 11773  			},
 11774  			expectedStatus: api.ServiceStatus{
 11775  				LoadBalancer: api.LoadBalancerStatus{
 11776  					Ingress: []api.LoadBalancerIngress{{
 11777  						IP: "1.2.3.4",
 11778  					}},
 11779  				},
 11780  			},
 11781  			expectErr: false,
 11782  		}, {
 11783  			name:          "LoadBalancerIPMode disabled, ipMode used in old, not used in new",
 11784  			ipModeEnabled: false,
 11785  			statusBeforeUpdate: api.ServiceStatus{
 11786  				LoadBalancer: api.LoadBalancerStatus{
 11787  					Ingress: []api.LoadBalancerIngress{{
 11788  						IP:     "1.2.3.4",
 11789  						IPMode: &ipModeVIP,
 11790  					}},
 11791  				},
 11792  			},
 11793  			newStatus: api.ServiceStatus{
 11794  				LoadBalancer: api.LoadBalancerStatus{
 11795  					Ingress: []api.LoadBalancerIngress{{
 11796  						IP: "1.2.3.4",
 11797  					}},
 11798  				},
 11799  			},
 11800  			expectedStatus: api.ServiceStatus{
 11801  				LoadBalancer: api.LoadBalancerStatus{
 11802  					Ingress: []api.LoadBalancerIngress{{
 11803  						IP: "1.2.3.4",
 11804  					}},
 11805  				},
 11806  			},
 11807  			expectErr: false,
 11808  		},
 11809  		/*LoadBalancerIPMode enabled*/
 11810  		{
 11811  			name:               "LoadBalancerIPMode enabled, ipMode not used in old, not used in new",
 11812  			ipModeEnabled:      true,
 11813  			statusBeforeUpdate: api.ServiceStatus{},
 11814  			newStatus: api.ServiceStatus{
 11815  				LoadBalancer: api.LoadBalancerStatus{
 11816  					Ingress: []api.LoadBalancerIngress{{
 11817  						IP: "1.2.3.4",
 11818  					}},
 11819  				},
 11820  			},
 11821  			expectedStatus:         api.ServiceStatus{},
 11822  			expectErr:              true,
 11823  			expectedReasonForError: metav1.StatusReasonInvalid,
 11824  		}, {
 11825  			name:          "LoadBalancerIPMode enabled, ipMode used in old and in new",
 11826  			ipModeEnabled: true,
 11827  			statusBeforeUpdate: api.ServiceStatus{
 11828  				LoadBalancer: api.LoadBalancerStatus{
 11829  					Ingress: []api.LoadBalancerIngress{{
 11830  						IP:     "1.2.3.4",
 11831  						IPMode: &ipModeProxy,
 11832  					}},
 11833  				},
 11834  			},
 11835  			newStatus: api.ServiceStatus{
 11836  				LoadBalancer: api.LoadBalancerStatus{
 11837  					Ingress: []api.LoadBalancerIngress{{
 11838  						IP:     "1.2.3.4",
 11839  						IPMode: &ipModeVIP,
 11840  					}},
 11841  				},
 11842  			},
 11843  			expectedStatus: api.ServiceStatus{
 11844  				LoadBalancer: api.LoadBalancerStatus{
 11845  					Ingress: []api.LoadBalancerIngress{{
 11846  						IP:     "1.2.3.4",
 11847  						IPMode: &ipModeVIP,
 11848  					}},
 11849  				},
 11850  			},
 11851  			expectErr: false,
 11852  		}, {
 11853  			name:          "LoadBalancerIPMode enabled, ipMode not used in old, used in new",
 11854  			ipModeEnabled: true,
 11855  			statusBeforeUpdate: api.ServiceStatus{
 11856  				LoadBalancer: api.LoadBalancerStatus{
 11857  					Ingress: []api.LoadBalancerIngress{{
 11858  						IP: "1.2.3.4",
 11859  					}},
 11860  				},
 11861  			},
 11862  			newStatus: api.ServiceStatus{
 11863  				LoadBalancer: api.LoadBalancerStatus{
 11864  					Ingress: []api.LoadBalancerIngress{{
 11865  						IP:     "1.2.3.4",
 11866  						IPMode: &ipModeProxy,
 11867  					}},
 11868  				},
 11869  			},
 11870  			expectedStatus: api.ServiceStatus{
 11871  				LoadBalancer: api.LoadBalancerStatus{
 11872  					Ingress: []api.LoadBalancerIngress{{
 11873  						IP:     "1.2.3.4",
 11874  						IPMode: &ipModeProxy,
 11875  					}},
 11876  				},
 11877  			},
 11878  			expectErr: false,
 11879  		}, {
 11880  			name:          "LoadBalancerIPMode enabled, ipMode used in old, not used in new",
 11881  			ipModeEnabled: true,
 11882  			statusBeforeUpdate: api.ServiceStatus{
 11883  				LoadBalancer: api.LoadBalancerStatus{
 11884  					Ingress: []api.LoadBalancerIngress{{
 11885  						IP:     "1.2.3.4",
 11886  						IPMode: &ipModeVIP,
 11887  					}},
 11888  				},
 11889  			},
 11890  			newStatus: api.ServiceStatus{
 11891  				LoadBalancer: api.LoadBalancerStatus{
 11892  					Ingress: []api.LoadBalancerIngress{{
 11893  						IP: "1.2.3.4",
 11894  					}},
 11895  				},
 11896  			},
 11897  			expectedStatus:         api.ServiceStatus{},
 11898  			expectErr:              true,
 11899  			expectedReasonForError: metav1.StatusReasonInvalid,
 11900  		}, {
 11901  			name:          "LoadBalancerIPMode enabled, ipMode not used in old, invalid value used in new",
 11902  			ipModeEnabled: true,
 11903  			statusBeforeUpdate: api.ServiceStatus{
 11904  				LoadBalancer: api.LoadBalancerStatus{
 11905  					Ingress: []api.LoadBalancerIngress{{
 11906  						IP: "1.2.3.4",
 11907  					}},
 11908  				},
 11909  			},
 11910  			newStatus: api.ServiceStatus{
 11911  				LoadBalancer: api.LoadBalancerStatus{
 11912  					Ingress: []api.LoadBalancerIngress{{
 11913  						IP:     "1.2.3.4",
 11914  						IPMode: &ipModeDummy,
 11915  					}},
 11916  				},
 11917  			},
 11918  			expectedStatus:         api.ServiceStatus{},
 11919  			expectErr:              true,
 11920  			expectedReasonForError: metav1.StatusReasonInvalid,
 11921  		},
 11922  	}
 11923  
 11924  	for _, tc := range testCases {
 11925  		t.Run(tc.name, func(t *testing.T) {
 11926  
 11927  			svc := svctest.MakeService("foo", svctest.SetTypeLoadBalancer)
 11928  			ctx := genericapirequest.NewDefaultContext()
 11929  			obj, err := storage.Create(ctx, svc, rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
 11930  			if err != nil {
 11931  				t.Errorf("created svc: %s", err)
 11932  			}
 11933  			defer storage.Delete(ctx, svc.Name, rest.ValidateAllObjectFunc, &metav1.DeleteOptions{})
 11934  
 11935  			// prepare status
 11936  			if loadbalancerIPModeInUse(tc.statusBeforeUpdate) {
 11937  				defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.LoadBalancerIPMode, true)()
 11938  			}
 11939  			oldSvc := obj.(*api.Service).DeepCopy()
 11940  			oldSvc.Status = tc.statusBeforeUpdate
 11941  			obj, _, err = statusStorage.Update(ctx, oldSvc.Name, rest.DefaultUpdatedObjectInfo(oldSvc), rest.ValidateAllObjectFunc, rest.ValidateAllObjectUpdateFunc, false, &metav1.UpdateOptions{})
 11942  			if err != nil {
 11943  				t.Errorf("updated status: %s", err)
 11944  			}
 11945  
 11946  			defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, features.LoadBalancerIPMode, tc.ipModeEnabled)()
 11947  			newSvc := obj.(*api.Service).DeepCopy()
 11948  			newSvc.Status = tc.newStatus
 11949  			obj, _, err = statusStorage.Update(ctx, newSvc.Name, rest.DefaultUpdatedObjectInfo(newSvc), rest.ValidateAllObjectFunc, rest.ValidateAllObjectUpdateFunc, false, &metav1.UpdateOptions{})
 11950  			if err != nil {
 11951  				if tc.expectErr && tc.expectedReasonForError == errors.ReasonForError(err) {
 11952  					return
 11953  				}
 11954  				t.Errorf("updated status: %s", err)
 11955  			}
 11956  
 11957  			updated := obj.(*api.Service)
 11958  			if !reflect.DeepEqual(tc.expectedStatus, updated.Status) {
 11959  				t.Errorf("%v: unexpected svc status: %v", tc.name, cmp.Diff(tc.expectedStatus, updated.Status))
 11960  			}
 11961  		})
 11962  	}
 11963  }
 11964  
 11965  func loadbalancerIPModeInUse(status api.ServiceStatus) bool {
 11966  	for _, ing := range status.LoadBalancer.Ingress {
 11967  		if ing.IPMode != nil {
 11968  			return true
 11969  		}
 11970  	}
 11971  	return false
 11972  }