serviceCIDRs.Insert(v.UnsortedList()...)
				return false
			})
			if serviceCIDRs.Len() == 1 && serviceCIDRs.Has(serviceCIDR.Name) {
				hasParent = false
			}
		}
	}

	// All the existing IP addresses will be contained on the parent ServiceCIDRs,
	// it is safe to delete, remove the finalizer.
	if hasParent {
		logger.V(2).Info("Removing finalizer for ServiceCIDR", "ServiceCIDR", serviceCIDR.String())

			CIDRs: c.cidrs,
		},
	}
	serviceCIDR, err = c.client.NetworkingV1alpha1().ServiceCIDRs().Create(context.Background(), serviceCIDR, metav1.CreateOptions{})
	if err != nil && !apierrors.IsAlreadyExists(err) {
		c.eventRecorder.Eventf(serviceCIDR, v1.EventTypeWarning, "KubernetesDefaultServiceCIDRError", "The default ServiceCIDR can not be created")
		return err
	}
	c.syncStatus(serviceCIDR)
	return nil
}

		klog.V(2).Infof("Finished sync for CIDRs took %v", time.Since(now))
	}()

	serviceCIDRs, err := c.serviceCIDRLister.List(labels.Everything())
	if err != nil {
		return err
	}

	cidrsSet := sets.New[string]()
	cidrReady := map[string]bool{}
	for _, serviceCIDR := range serviceCIDRs {
		ready := true
		if !isReady(serviceCIDR) || !serviceCIDR.DeletionTimestamp.IsZero() {
			ready = false
		}

	// staleChains contains information about chains to be deleted later
	staleChains map[string]time.Time

	// serviceCIDRs is a comma separated list of ServiceCIDRs belonging to the IPFamily
	// which proxier is operating on, can be directly consumed by knftables.
	serviceCIDRs string

	logger klog.Logger
}

// Proxier implements proxy.Provider
var _ proxy.Provider = &Proxier{}

		// apisstorage.Resource("csistoragecapacities").WithVersion("v1beta1"),
		networking.Resource("ipaddresses").WithVersion("v1alpha1"),
		networking.Resource("servicecidrs").WithVersion("v1alpha1"),
		certificates.Resource("clustertrustbundles").WithVersion("v1alpha1"),
		storage.Resource("volumeattributesclasses").WithVersion("v1alpha1"),

	if err == nil {
		r.cidrQueue.Forget(key)
		return
	}

	if r.cidrQueue.NumRequeues(key) < maxRetries {
		klog.V(2).InfoS("Error syncing ServiceCIDR, retrying", "serviceCIDR", key, "err", err)
		r.cidrQueue.AddRateLimited(key)
		return
	}

	klog.Warningf("Dropping ServiceCIDR %q out of the queue: %v", key, err)
	r.cidrQueue.Forget(key)
	runtime.HandleError(err)
}

// events on ServiceCIDR objects and call downstream event handlers.
func (c *ServiceCIDRConfig) handleServiceCIDREvent(oldObj, newObj interface{}) {
	var oldServiceCIDR, newServiceCIDR *networkingv1alpha1.ServiceCIDR
	var ok bool

	if oldObj != nil {
		oldServiceCIDR, ok = oldObj.(*networkingv1alpha1.ServiceCIDR)
		if !ok {

	// invocation into a Run() method.
	nftablesFamily := knftables.IPv4Family
	podCIDR := "10.0.0.0/8"
	serviceCIDRs := "172.30.0.0/16"
	if ipFamily == v1.IPv6Protocol {
		nftablesFamily = knftables.IPv6Family
		podCIDR = "fd00:10::/64"
		serviceCIDRs = "fd00:10:96::/112"
	}
	detectLocal := proxyutil.NewDetectLocalByCIDR(podCIDR)

		informers.WithTweakListOptions(func(options *metav1.ListOptions) {
			options.LabelSelector = labelSelector.String()
		}))

	// Create configs (i.e. Watches for Services, EndpointSlices and ServiceCIDRs)
	// Note: RegisterHandler() calls need to happen before creation of Sources because sources
	// only notify on changes, and the initial update (on process start) may be lost if no handlers
	// are registered yet.

	proxier.mu.Unlock()

	// Sync unconditionally - this is called once per lifetime.
	proxier.syncProxyRules()
}

// OnServiceCIDRsChanged is called whenever a change is observed
// in any of the ServiceCIDRs, and provides complete list of service cidrs.
func (proxier *Proxier) OnServiceCIDRsChanged(_ []string) {}

func (proxier *Proxier) cleanupAllPolicies() {
	for svcName, svc := range proxier.svcPortMap {