return []string{}
	}

	c.muTree.Lock()
	defer c.muTree.Unlock()
	serviceCIDRs := []string{}
	// walk the tree to get all the ServiceCIDRs that contain this IP address
	prefixes := c.tree.GetHostIPPrefixMatches(address)
	for _, v := range prefixes {
		serviceCIDRs = append(serviceCIDRs, v.UnsortedList()...)
	}

	return serviceCIDRs
}

func (c *Controller) worker(ctx context.Context) {

		ObjectMeta: metav1.ObjectMeta{
			Name: DefaultServiceCIDRName,
		},
		Spec: networkingapiv1alpha1.ServiceCIDRSpec{
			CIDRs: c.cidrs,
		},
	}
	serviceCIDR, err = c.client.NetworkingV1alpha1().ServiceCIDRs().Create(context.Background(), serviceCIDR, metav1.CreateOptions{})
	if err != nil && !apierrors.IsAlreadyExists(err) {

	defer func() {
		klog.V(2).Infof("Finished sync for CIDRs took %v", time.Since(now))
	}()

	serviceCIDRs, err := c.serviceCIDRLister.List(labels.Everything())
	if err != nil {
		return err
	}

	cidrsSet := sets.New[string]()
	cidrReady := map[string]bool{}
	for _, serviceCIDR := range serviceCIDRs {
		ready := true
		if !isReady(serviceCIDR) || !serviceCIDR.DeletionTimestamp.IsZero() {
			ready = false

	// staleChains contains information about chains to be deleted later
	staleChains map[string]time.Time

	// serviceCIDRs is a comma separated list of ServiceCIDRs belonging to the IPFamily
	// which proxier is operating on, can be directly consumed by knftables.
	serviceCIDRs string

	logger klog.Logger
}

// Proxier implements proxy.Provider
var _ proxy.Provider = &Proxier{}

		// apisstorage.Resource("csistoragecapacities").WithVersion("v1beta1"),
		networking.Resource("ipaddresses").WithVersion("v1alpha1"),
		networking.Resource("servicecidrs").WithVersion("v1alpha1"),
		certificates.Resource("clustertrustbundles").WithVersion("v1alpha1"),
		storage.Resource("volumeattributesclasses").WithVersion("v1alpha1"),

		cidrQueue: workqueue.NewTypedRateLimitingQueueWithConfig(
			workqueue.DefaultTypedControllerRateLimiter[string](),
			workqueue.TypedRateLimitingQueueConfig[string]{Name: "servicecidrs"},
		),
		svcQueue: workqueue.NewTypedRateLimitingQueueWithConfig(
			workqueue.DefaultTypedControllerRateLimiter[string](),
			workqueue.TypedRateLimitingQueueConfig[string]{Name: "services"},
		),

// notifications about ServiceCIDR object changes.
type ServiceCIDRHandler interface {
	// OnServiceCIDRsChanged is called whenever a change is observed
	// in any of the ServiceCIDRs, and provides complete list of service cidrs.
	OnServiceCIDRsChanged(cidrs []string)
}

// ServiceCIDRConfig tracks a set of service configurations.
type ServiceCIDRConfig struct {

	// invocation into a Run() method.
	nftablesFamily := knftables.IPv4Family
	podCIDR := "10.0.0.0/8"
	serviceCIDRs := "172.30.0.0/16"
	if ipFamily == v1.IPv6Protocol {
		nftablesFamily = knftables.IPv6Family
		podCIDR = "fd00:10::/64"
		serviceCIDRs = "fd00:10:96::/112"
	}
	detectLocal := proxyutil.NewDetectLocalByCIDR(podCIDR)

		informers.WithTweakListOptions(func(options *metav1.ListOptions) {
			options.LabelSelector = labelSelector.String()
		}))

	// Create configs (i.e. Watches for Services, EndpointSlices and ServiceCIDRs)
	// Note: RegisterHandler() calls need to happen before creation of Sources because sources
	// only notify on changes, and the initial update (on process start) may be lost if no handlers
	// are registered yet.

	proxier.mu.Unlock()

	// Sync unconditionally - this is called once per lifetime.
	proxier.syncProxyRules()
}

// OnServiceCIDRsChanged is called whenever a change is observed
// in any of the ServiceCIDRs, and provides complete list of service cidrs.
func (proxier *Proxier) OnServiceCIDRsChanged(_ []string) {}

func (proxier *Proxier) cleanupAllPolicies() {
	for svcName, svc := range proxier.svcPortMap {