fail   bool
	}{{
		name:   "create: without externalIPs",
		newSvc: makeSvc(),
	}, {
		name:   "create: with externalIPs",
		newSvc: makeSvc("1.1.1.1"),
		fail:   true,
	}, {
		name:   "update: same externalIPs",
		newSvc: makeSvc("1.1.1.1", "2.2.2.2"),
		oldSvc: makeSvc("1.1.1.1", "2.2.2.2"),
	}, {
		name:   "update: reorder externalIPs",
		newSvc: makeSvc("1.1.1.1", "2.2.2.2"),
		oldSvc: makeSvc("2.2.2.2", "1.1.1.1"),

      nodePort: {{ .Values.service.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioAPIPort }}
      {{- end }}
  {{- if .Values.service.externalIPs }}
  externalIPs:
    {{- range $i , $ip := .Values.service.externalIPs }}
    - {{ $ip }}
    {{- end }}
  {{- end }}
  selector:
    app: {{ template "minio.name" . }}

	// SessionAffinityType returns service session affinity type
	SessionAffinityType() v1.ServiceAffinity
	// StickyMaxAgeSeconds returns service max connection age
	StickyMaxAgeSeconds() int
	// ExternalIPs returns service ExternalIPs
	ExternalIPs() []net.IP
	// LoadBalancerVIPs returns service LoadBalancerIPs which are VIP mode
	LoadBalancerVIPs() []net.IP
	// Protocol returns service protocol.
	Protocol() v1.Protocol

    targetPort: 15012
  - name: tls-webhook
    port: 15017
    targetPort: 15017
{{- else }}
{{ .Values.service.ports | toYaml | indent 4 }}
{{- end }}
{{- if .Values.service.externalIPs }}
  externalIPs: {{- range .Values.service.externalIPs }}
    - {{.}}
  {{- end }}
{{- end }}
  selector:
    {{- include "gateway.selectorLabels" . | nindent 4 }}

		return nil
	}

	klog.V(4).Infof("Denying new use of ExternalIPs on Service %s/%s", newSvc.Namespace, newSvc.Name)
	return admission.NewForbidden(attr, fmt.Errorf("Use of external IPs is denied by admission control"))
}

func isSubset(newSvc, oldSvc *core.Service) bool {
	// If new has none, it's a subset.
	if len(newSvc.Spec.ExternalIPs) == 0 {
		return true
	}

      nodePort: {{ .Values.consoleService.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioConsolePort }}
      {{- end }}
  {{- if .Values.consoleService.externalIPs }}
  externalIPs:
    {{- range $i , $ip := .Values.consoleService.externalIPs }}
    - {{ $ip }}
    {{- end }}
  {{- end }}
  selector:
    app: {{ template "minio.name" . }}

			warnings = append(warnings, getWarningsForIP(field.NewPath("spec").Child("clusterIPs").Index(i), clusterIP)...)
		}
	}

	for i, externalIP := range service.Spec.ExternalIPs {
		warnings = append(warnings, getWarningsForIP(field.NewPath("spec").Child("externalIPs").Index(i), externalIP)...)
	}

	if len(service.Spec.LoadBalancerIP) > 0 {

			expectedNatRules:    325,
		},

		{
			name: "0 Services 0 EndpointsPerService - LoadBalancer",
			svcFunc: func(svc *v1.Service) {
				svc.Spec.Type = v1.ServiceTypeLoadBalancer
				svc.Spec.ExternalIPs = []string{"1.2.3.4"}
				svc.Spec.LoadBalancerSourceRanges = []string{" 1.2.3.4/28"}
				svc.Status.LoadBalancer.Ingress = []v1.LoadBalancerIngress{{
					IP: "1.2.3.4",
				}}
			},
			services:            0,

	})
	checkExternalPolicyLocal(false, &v1.Service{
		Spec: v1.ServiceSpec{
			Type:        v1.ServiceTypeClusterIP,
			ExternalIPs: []string{"1.2.3.4"},
		},
	})
	checkExternalPolicyLocal(false, &v1.Service{
		Spec: v1.ServiceSpec{
			Type:                  v1.ServiceTypeClusterIP,
			ExternalIPs:           []string{"1.2.3.4"},
			ExternalTrafficPolicy: v1.ServiceExternalTrafficPolicyCluster,
		},
	})

					svcInfo.port != expectedInfo.port ||
					svcInfo.protocol != expectedInfo.protocol ||
					svcInfo.healthCheckNodePort != expectedInfo.healthCheckNodePort ||
					!reflect.DeepEqual(svcInfo.externalIPs, expectedInfo.externalIPs) ||
					!reflect.DeepEqual(svcInfo.loadBalancerSourceRanges, expectedInfo.loadBalancerSourceRanges) ||
					!reflect.DeepEqual(svcInfo.loadBalancerVIPs, expectedInfo.loadBalancerVIPs) {