diff --git a/pkg/registry/core/service/storage/rest_test.go b/pkg/registry/core/service/storage/rest_test.go
index d03271af12c..832c042230c 100644
--- a/pkg/registry/core/service/storage/rest_test.go
+++ b/pkg/registry/core/service/storage/rest_test.go
@@ -18,7 +18,6 @@ package storage
 
 import (
 	"net"
-	"reflect"
 	"testing"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -119,262 +118,6 @@ func makeIPNet6(t *testing.T) *net.IPNet {
 	return net
 }
 
-func TestServiceRegistryUpdateUnspecifiedAllocations(t *testing.T) {
-	type proof func(t *testing.T, s *api.Service)
-	prove := func(proofs ...proof) []proof {
-		return proofs
-	}
-	proveClusterIP := func(idx int, ip string) proof {
-		return func(t *testing.T, s *api.Service) {
-			if want, got := ip, s.Spec.ClusterIPs[idx]; want != got {
-				t.Errorf("wrong ClusterIPs[%d]: want %q, got %q", idx, want, got)
-			}
-		}
-	}
-	proveNodePort := func(idx int, port int32) proof {
-		return func(t *testing.T, s *api.Service) {
-			got := s.Spec.Ports[idx].NodePort
-			if port > 0 && got != port {
-				t.Errorf("wrong Ports[%d].NodePort: want %d, got %d", idx, port, got)
-			} else if port < 0 && got == -port {
-				t.Errorf("wrong Ports[%d].NodePort: wanted anything but %d", idx, got)
-			}
-		}
-	}
-	proveHCNP := func(port int32) proof {
-		return func(t *testing.T, s *api.Service) {
-			got := s.Spec.HealthCheckNodePort
-			if port > 0 && got != port {
-				t.Errorf("wrong HealthCheckNodePort: want %d, got %d", port, got)
-			} else if port < 0 && got == -port {
-				t.Errorf("wrong HealthCheckNodePort: wanted anything but %d", got)
-			}
-		}
-	}
-
-	testCases := []struct {
-		name        string
-		create      *api.Service // Needs clusterIP, NodePort, and HealthCheckNodePort allocated
-		update      *api.Service // Needs clusterIP, NodePort, and/or HealthCheckNodePort blank
-		expectError bool
-		prove       []proof
-	}{{
-		name: "single-ip_single-port",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetClusterIPs("1.2.3.4"),
-			svctest.SetNodePorts(30093),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal)),
-		prove: prove(
-			proveClusterIP(0, "1.2.3.4"),
-			proveNodePort(0, 30093),
-			proveHCNP(30118)),
-	}, {
-		name: "multi-ip_multi-port",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
-			svctest.SetClusterIPs("1.2.3.4", "2000::1"),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 30076),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP))),
-		prove: prove(
-			proveClusterIP(0, "1.2.3.4"),
-			proveClusterIP(1, "2000::1"),
-			proveNodePort(0, 30093),
-			proveNodePort(1, 30076),
-			proveHCNP(30118)),
-	}, {
-		name: "multi-ip_partial",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
-			svctest.SetClusterIPs("1.2.3.4", "2000::1"),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 30076),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetClusterIPs("1.2.3.4")),
-		expectError: true,
-	}, {
-		name: "multi-port_partial",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 30076),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 0)), // provide just 1 value
-		prove: prove(
-			proveNodePort(0, 30093),
-			proveNodePort(1, 30076),
-			proveHCNP(30118)),
-	}, {
-		name: "swap-ports",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 30076),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				// swapped from above
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP),
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP))),
-		prove: prove(
-			proveNodePort(0, 30076),
-			proveNodePort(1, 30093),
-			proveHCNP(30118)),
-	}, {
-		name: "partial-swap-ports",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 30076),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30076, 0), // set [0] to [1], omit [1]
-			svctest.SetHealthCheckNodePort(30118)),
-		prove: prove(
-			proveNodePort(0, 30076),
-			proveNodePort(1, -30076),
-			proveHCNP(30118)),
-	}, {
-		name: "swap-port-with-hcnp",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 30076),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30076, 30118)), // set [0] to [1], set [1] to HCNP
-		expectError: true,
-	}, {
-		name: "partial-swap-port-with-hcnp",
-		create: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30093, 30076),
-			svctest.SetHealthCheckNodePort(30118)),
-		update: svctest.MakeService("foo",
-			svctest.SetTypeLoadBalancer,
-			svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
-			svctest.SetPorts(
-				svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
-				svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
-			svctest.SetNodePorts(30118, 0)), // set [0] to HCNP, omit [1]
-		expectError: true,
-	}}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			ctx := genericapirequest.NewDefaultContext()
-			storage, server := NewTestREST(t, []api.IPFamily{api.IPv4Protocol, api.IPv6Protocol})
-			defer server.Terminate(t)
-
-			svc := tc.create.DeepCopy()
-			obj, err := storage.Create(ctx, svc.DeepCopy(), rest.ValidateAllObjectFunc, &metav1.CreateOptions{})
-			if err != nil {
-				t.Fatalf("unexpected error on create: %v", err)
-			}
-			createdSvc := obj.(*api.Service)
-			if createdSvc.Spec.ClusterIP == "" {
-				t.Fatalf("expected ClusterIP to be set")
-			}
-			if len(createdSvc.Spec.ClusterIPs) == 0 {
-				t.Fatalf("expected ClusterIPs to be set")
-			}
-			for i := range createdSvc.Spec.Ports {
-				if createdSvc.Spec.Ports[i].NodePort == 0 {
-					t.Fatalf("expected NodePort[%d] to be set", i)
-				}
-			}
-			if createdSvc.Spec.HealthCheckNodePort == 0 {
-				t.Fatalf("expected HealthCheckNodePort to be set")
-			}
-
-			// Update - change the selector to be sure.
-			svc = tc.update.DeepCopy()
-			svc.Spec.Selector = map[string]string{"bar": "baz2"}
-			svc.ResourceVersion = createdSvc.ResourceVersion
-
-			obj, _, err = storage.Update(ctx, svc.Name, rest.DefaultUpdatedObjectInfo(svc.DeepCopy()),
-				rest.ValidateAllObjectFunc, rest.ValidateAllObjectUpdateFunc, false, &metav1.UpdateOptions{})
-			if tc.expectError {
-				if err == nil {
-					t.Fatalf("unexpected success on update")
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error on update: %v", err)
-			}
-			updatedSvc := obj.(*api.Service)
-
-			if want, got := createdSvc.Spec.ClusterIP, updatedSvc.Spec.ClusterIP; want != got {
-				t.Errorf("expected ClusterIP to not change: wanted %v, got %v", want, got)
-			}
-			if want, got := createdSvc.Spec.ClusterIPs, updatedSvc.Spec.ClusterIPs; !reflect.DeepEqual(want, got) {
-				t.Errorf("expected ClusterIPs to not change: wanted %v, got %v", want, got)
-			}
-
-			for _, proof := range tc.prove {
-				proof(t, updatedSvc)
-			}
-		})
-	}
-}
-
 func TestServiceStorageValidatesUpdate(t *testing.T) {
 	ctx := genericapirequest.NewDefaultContext()
 	storage, server := NewTestREST(t, []api.IPFamily{api.IPv4Protocol})
diff --git a/pkg/registry/core/service/storage/storage_test.go b/pkg/registry/core/service/storage/storage_test.go
index 5399b8169b7..d5fad0fd5dd 100644
--- a/pkg/registry/core/service/storage/storage_test.go
+++ b/pkg/registry/core/service/storage/storage_test.go
@@ -6296,6 +6296,272 @@ func TestUpdateDryRun(t *testing.T) {
 	}
 }
 
+func TestUpdatePatchAllocatedValues(t *testing.T) {
+	prove := func(proofs ...svcTestProof) []svcTestProof {
+		return proofs
+	}
+	proveClusterIP := func(idx int, ip string) svcTestProof {
+		return func(t *testing.T, storage *GenericREST, before, after *api.Service) {
+			if want, got := ip, after.Spec.ClusterIPs[idx]; want != got {
+				t.Errorf("wrong ClusterIPs[%d]: want %q, got %q", idx, want, got)
+			}
+		}
+	}
+	proveNodePort := func(idx int, port int32) svcTestProof {
+		return func(t *testing.T, storage *GenericREST, before, after *api.Service) {
+			got := after.Spec.Ports[idx].NodePort
+			if port > 0 && got != port {
+				t.Errorf("wrong Ports[%d].NodePort: want %d, got %d", idx, port, got)
+			} else if port < 0 && got == -port {
+				t.Errorf("wrong Ports[%d].NodePort: wanted anything but %d", idx, got)
+			}
+		}
+	}
+	proveHCNP := func(port int32) svcTestProof {
+		return func(t *testing.T, storage *GenericREST, before, after *api.Service) {
+			got := after.Spec.HealthCheckNodePort
+			if port > 0 && got != port {
+				t.Errorf("wrong HealthCheckNodePort: want %d, got %d", port, got)
+			} else if port < 0 && got == -port {
+				t.Errorf("wrong HealthCheckNodePort: wanted anything but %d", got)
+			}
+		}
+	}
+
+	// each create needs clusterIP, NodePort, and HealthCheckNodePort allocated
+	// each update needs clusterIP, NodePort, and/or HealthCheckNodePort blank
+	testCases := []cudTestCase{{
+		name: "single-ip_single-port",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetClusterIPs("10.0.0.1"),
+				svctest.SetNodePorts(30093),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+			prove: prove(
+				proveClusterIP(0, "10.0.0.1"),
+				proveNodePort(0, 30093),
+				proveHCNP(30118)),
+		},
+	}, {
+		name: "multi-ip_multi-port",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
+				svctest.SetClusterIPs("10.0.0.1", "2000::1"),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 30076),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP))),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+			prove: prove(
+				proveClusterIP(0, "10.0.0.1"),
+				proveClusterIP(1, "2000::1"),
+				proveNodePort(0, 30093),
+				proveNodePort(1, 30076),
+				proveHCNP(30118)),
+		},
+	}, {
+		name: "multi-ip_partial",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetIPFamilyPolicy(api.IPFamilyPolicyPreferDualStack),
+				svctest.SetClusterIPs("10.0.0.1", "2000::1"),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 30076),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetClusterIPs("10.0.0.1")),
+			expectError: true,
+		},
+	}, {
+		name: "multi-port_partial",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 30076),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 0)), // provide just 1 value
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+			prove: prove(
+				proveNodePort(0, 30093),
+				proveNodePort(1, 30076),
+				proveHCNP(30118)),
+		},
+	}, {
+		name: "swap-ports",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 30076),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					// swapped from above
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP),
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP))),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+			prove: prove(
+				proveNodePort(0, 30076),
+				proveNodePort(1, 30093),
+				proveHCNP(30118)),
+		},
+	}, {
+		name: "partial-swap-ports",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 30076),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30076, 0), // set [0] to [1]'s value, omit [1]
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+			prove: prove(
+				proveNodePort(0, 30076),
+				proveNodePort(1, -30076),
+				proveHCNP(30118)),
+		},
+	}, {
+		name: "swap-port-with-hcnp",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 30076),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30076, 30118)), // set [0] to HCNP's value
+			expectError: true,
+		},
+	}, {
+		name: "partial-swap-port-with-hcnp",
+		create: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30093, 30076),
+				svctest.SetHealthCheckNodePort(30118)),
+			expectClusterIPs:          true,
+			expectNodePorts:           true,
+			expectHealthCheckNodePort: true,
+		},
+		update: svcTestCase{
+			svc: svctest.MakeService("foo",
+				svctest.SetTypeLoadBalancer,
+				svctest.SetExternalTrafficPolicy(api.ServiceExternalTrafficPolicyTypeLocal),
+				svctest.SetPorts(
+					svctest.MakeServicePort("p", 867, intstr.FromInt(867), api.ProtocolTCP),
+					svctest.MakeServicePort("q", 5309, intstr.FromInt(5309), api.ProtocolTCP)),
+				svctest.SetNodePorts(30118, 0)), // set [0] to HCNP's value, omit [1]
+			expectError: true,
+		},
+	}}
+
+	helpTestCreateUpdateDelete(t, testCases)
+}
+
 // Proves that updates from single-stack work.
 func TestUpdateIPsFromSingleStack(t *testing.T) {
 	prove := func(proofs ...svcTestProof) []svcTestProof {
@@ -10382,95 +10648,107 @@ func TestFeaturePorts(t *testing.T) {
 	}, {
 		name: "swap_ports",
 		create: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 80, intstr.FromInt(80), api.ProtocolTCP),
 					svctest.MakeServicePort("q", 443, intstr.FromInt(443), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 		update: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("q", 443, intstr.FromInt(443), api.ProtocolTCP),
 					svctest.MakeServicePort("p", 80, intstr.FromInt(80), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 	}, {
 		name: "modify_ports",
 		create: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 80, intstr.FromInt(80), api.ProtocolTCP),
 					svctest.MakeServicePort("q", 443, intstr.FromInt(443), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 		update: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 8080, intstr.FromInt(8080), api.ProtocolTCP),
 					svctest.MakeServicePort("q", 8443, intstr.FromInt(8443), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 	}, {
 		name: "modify_protos",
 		create: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 80, intstr.FromInt(80), api.ProtocolTCP),
 					svctest.MakeServicePort("q", 443, intstr.FromInt(443), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 		update: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 80, intstr.FromInt(80), api.ProtocolUDP),
 					svctest.MakeServicePort("q", 443, intstr.FromInt(443), api.ProtocolUDP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 	}, {
 		name: "modify_ports_and_protos",
 		create: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 80, intstr.FromInt(80), api.ProtocolTCP),
 					svctest.MakeServicePort("q", 443, intstr.FromInt(443), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 		update: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("r", 53, intstr.FromInt(53), api.ProtocolTCP),
 					svctest.MakeServicePort("s", 53, intstr.FromInt(53), api.ProtocolUDP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 	}, {
 		name: "add_alt_proto",
 		create: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 53, intstr.FromInt(53), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 		update: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 53, intstr.FromInt(53), api.ProtocolTCP),
 					svctest.MakeServicePort("q", 53, intstr.FromInt(53), api.ProtocolUDP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 	}, {
 		name: "wipe_all",
 		create: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts(
 					svctest.MakeServicePort("p", 80, intstr.FromInt(80), api.ProtocolTCP),
 					svctest.MakeServicePort("q", 443, intstr.FromInt(443), api.ProtocolTCP))),
 			expectClusterIPs: true,
+			expectNodePorts:  true,
 		},
 		update: svcTestCase{
-			svc: svctest.MakeService("foo", svctest.SetTypeClusterIP,
+			svc: svctest.MakeService("foo", svctest.SetTypeNodePort,
 				svctest.SetPorts()),
-			expectError: true,
+			expectError:     true,
+			expectNodePorts: true,
 		},
 	}}