diff --git a/staging/src/k8s.io/apiserver/pkg/util/proxy/proxy_test.go b/staging/src/k8s.io/apiserver/pkg/util/proxy/proxy_test.go
index 9539e73b020..efbda8c4b89 100644
--- a/staging/src/k8s.io/apiserver/pkg/util/proxy/proxy_test.go
+++ b/staging/src/k8s.io/apiserver/pkg/util/proxy/proxy_test.go
@@ -20,7 +20,7 @@ import (
 	"net/url"
 	"testing"
 
-	"k8s.io/api/core/v1"
+	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	v1listers "k8s.io/client-go/listers/core/v1"
@@ -118,6 +118,59 @@ func TestResolve(t *testing.T) {
 			clusterMode:  expectation{url: "https://hit:443"},
 			endpointMode: expectation{error: true},
 		},
+		{
+			name: "endpoint without subset",
+			services: []*v1.Service{
+				{
+					ObjectMeta: metav1.ObjectMeta{Namespace: "one", Name: "alfa"},
+					Spec: v1.ServiceSpec{
+						Type:      v1.ServiceTypeClusterIP,
+						ClusterIP: "hit",
+						Ports: []v1.ServicePort{
+							{Name: "https", Port: 443, TargetPort: intstr.FromInt(1443)},
+							{Port: 1234, TargetPort: intstr.FromInt(1234)},
+						},
+					},
+				},
+			},
+			endpoints: func(svc *v1.Service) []*v1.Endpoints {
+				return []*v1.Endpoints{{
+					ObjectMeta: metav1.ObjectMeta{Namespace: svc.Namespace, Name: svc.Name},
+					Subsets:    []v1.EndpointSubset{},
+				}}
+			},
+
+			clusterMode:  expectation{url: "https://hit:443"},
+			endpointMode: expectation{error: true},
+		},
+		{
+			name: "endpoint subset without addresses",
+			services: []*v1.Service{
+				{
+					ObjectMeta: metav1.ObjectMeta{Namespace: "one", Name: "alfa"},
+					Spec: v1.ServiceSpec{
+						Type:      v1.ServiceTypeClusterIP,
+						ClusterIP: "hit",
+						Ports: []v1.ServicePort{
+							{Name: "https", Port: 443, TargetPort: intstr.FromInt(1443)},
+							{Port: 1234, TargetPort: intstr.FromInt(1234)},
+						},
+					},
+				},
+			},
+			endpoints: func(svc *v1.Service) []*v1.Endpoints {
+				return []*v1.Endpoints{{
+					ObjectMeta: metav1.ObjectMeta{Namespace: svc.Namespace, Name: svc.Name},
+					Subsets: []v1.EndpointSubset{{
+						Addresses: []v1.EndpointAddress{},
+						Ports:     []v1.EndpointPort{{Name: "https", Port: 443}},
+					}},
+				}}
+			},
+
+			clusterMode:  expectation{url: "https://hit:443"},
+			endpointMode: expectation{error: true},
+		},
 		{
 			name: "none cluster ip",
 			services: []*v1.Service{
@@ -190,6 +243,21 @@ func TestResolve(t *testing.T) {
 			clusterMode:  expectation{url: "https://foo.bar.com:443"},
 			endpointMode: expectation{error: true},
 		},
+		{
+			name: "unsupported service",
+			services: []*v1.Service{
+				{
+					ObjectMeta: metav1.ObjectMeta{Namespace: "one", Name: "alfa"},
+					Spec: v1.ServiceSpec{
+						Type: "unsupported",
+					},
+				},
+			},
+			endpoints: nil,
+
+			clusterMode:  expectation{error: true},
+			endpointMode: expectation{error: true},
+		},
 		{
 			name:      "missing service",
 			services:  nil,