port: {{ .Values.service.port }}
      protocol: TCP
      {{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }}
      nodePort: {{ .Values.service.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioAPIPort }}
      {{- end }}
  {{- if .Values.service.externalIPs }}
  externalIPs:
    {{- range $i , $ip := .Values.service.externalIPs }}
    - {{ $ip }}
    {{- end }}
  {{- end }}

  name: istio-pilot
  namespace: istio-system
spec:
  type: ClusterIP
  ports:
  - name: grpc-xds
    port: 15010
    protocol: TCP
    targetPort: 15010
  - name: http-monitoring
    port: 15014
    protocol: TCP
    targetPort: 15014
  selector:
    istio: pilot
`

	manifestDiffTests := []struct {
		desc        string
		yamlStringA string
		yamlStringB string

	prefix := strings.ReplaceAll(statPattern, serviceStatPattern, shortHostName(host, attributes))
	prefix = strings.ReplaceAll(prefix, serviceFQDNStatPattern, host)
	prefix = strings.ReplaceAll(prefix, subsetNameStatPattern, subset)
	prefix = strings.ReplaceAll(prefix, serviceTargetPortStatPattern, strconv.Itoa(targetPort))

            ports:
            ## You can add custom gateway ports - google ILB default quota is 5 ports,
            - port: 15011
              name: grpc-pilot-mtls
            - port: 8060
              targetPort: 8060
              name: tcp-citadel-grpc-tls
            # Port 5353 is forwarded to kube-dns
            - port: 5353
              name: tcp-dns
          overlays:
            - kind: Deployment

apiVersion: v1
kind: Service
metadata:
  name: svc-no-selector
  namespace: default
spec:
  ports:
    - name: https
      port: 443
      protocol: TCP
      targetPort: 6443
---
# this deployment is not associated with any service, so it should generate a warning
apiVersion: apps/v1
kind: Deployment
metadata:
  name: helloworld-v2
  namespace: default
  labels:
    app: helloworld
    version: v2
spec:

      name: grpc-xds # plaintext
      protocol: TCP
    - port: 15012
      name: https-dns # mTLS with k8s-signed cert
      protocol: TCP
    - port: 443
      name: https-webhook # validation and injection
      targetPort: 15017
      protocol: TCP
    - port: 15014
      name: http-monitoring # prometheus stats
      protocol: TCP
  selector:
    app: istiod
    {{- if ne .Values.revision "" }}

      }
    ]
  },
  "spec": {
    "ports": [
      {
        "name": "nameValue",
        "protocol": "protocolValue",
        "appProtocol": "appProtocolValue",
        "port": 3,
        "targetPort": "targetPortValue",
        "nodePort": 5
      }
    ],
    "selector": {
      "selectorKey": "selectorValue"
    },
    "clusterIP": "clusterIPValue",
    "clusterIPs": [
      "clusterIPsValue"

apiVersion: v1
kind: Service
metadata:
  name: httpbin
  labels:
    app: httpbin
    service: httpbin
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 8080
  selector:
    app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpbin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpbin
      version: v1

      protocol: TCP
      {{- if (and (eq .Values.consoleService.type "NodePort") ( .Values.consoleService.nodePort)) }}
      nodePort: {{ .Values.consoleService.nodePort }}
      {{- else }}
      targetPort: {{ .Values.minioConsolePort }}
      {{- end }}
  {{- if .Values.consoleService.externalIPs }}
  externalIPs:
    {{- range $i , $ip := .Values.consoleService.externalIPs }}
    - {{ $ip }}
    {{- end }}

  annotations:
    # no such Istio annotation
    networking.istio.io/exportThree: bar
    # Valid Istio annotation
    networking.istio.io/exportTo: baz
spec:
  ports:
  - name: http
    port: 8000
    targetPort: 80
  selector:
    app: httpbin
---
# K8s object with invalid Istio annotations
apiVersion: v1
kind: Pod
metadata:
  name: invalid-annotations
  annotations: