description: IPAddressPoolSpec defines the desired state of IPAddressPool.
            properties:
              addresses:
                description: A list of IP address ranges over which MetalLB has authority.
                  You can list multiple ranges in a single pool, they will all share
                  the same settings. Each range can be either a CIDR prefix, or an
                  explicit start-end range of IPs.

message NodeSpec {
  // PodCIDR represents the pod IP range assigned to the node.
  // +optional
  optional string podCIDR = 1;

  // podCIDRs represents the IP ranges assigned to the node for usage by Pods on that node. If this
  // field is specified, the 0th entry must match the podCIDR field. It may contain at most 1 value for
  // each of IPv4 and IPv6.
  // +optional

  // +optional
  optional string rule = 1;

  // ranges are the allowed ranges of fs groups.  If you would like to force a single
  // fs group then supply a single range with the same start and end. Required for MustRunAs.
  // +optional
  repeated IDRange ranges = 2;
}

// HostPortRange defines a range of host ports that will be enabled by a policy

	// APIPA/"link-local" IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.
	//
	// IPv6 link local ranges are designed to be collision-resistant by default, and so probably never need to be overridden
	DefaultHostProbeSNATIP   = "169.254.7.127"
	DefaultHostProbeSNATIPV6 = "fd16:9254:7127:1337:ffff:ffff:ffff:ffff"
)

                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.111.182.109",
                              "prefix_len": 32
                            }
                          ],

		switch tc.TypeUrl {
		case IPMatcher:
			ip := protoconv.SilentlyUnmarshalAny[matcher.IPMatcher](tc)
			m = map[string]*matcher.Matcher_OnMatch{}
			for _, rm := range ip.GetRangeMatchers() {
				for _, r := range rm.Ranges {
					cidr := r.AddressPrefix
					pl := r.PrefixLen.GetValue()
					if pl != 32 && pl != 128 {
						cidr += fmt.Sprintf("/%d", pl)
					}
					m[cidr] = rm.OnMatch
				}
			}
		default:

            "cluster": "BlackHoleCluster"
           }
          }
         ],
         "name": "virtualInbound-blackhole"
        },
        {
         "filter_chain_match": {
          "prefix_ranges": [
           {
            "address_prefix": "0.0.0.0",
            "prefix_len": 0
           }
          ],
          "transport_protocol": "tls",
          "application_protocols": [

                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.104.171.68",
                              "prefix_len": 32
                            }
                          ],

| HOST_PROBE_SNAT_IPV6 | "fd16:9254:7127:1337:ffff:ffff:ffff:ffff" | IPv6 link local ranges are designed to be collision-resistant by default, and so this probably never needs to be overridden |

## Sidecar Mode Implementation Details

      # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly
      # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16"
      # would only capture egress traffic on those two IP Ranges, all other outbound traffic would
      # be allowed by the sidecar
      includeIPRanges: "*"
      excludeIPRanges: ""
      includeOutboundPorts: ""
      excludeOutboundPorts: ""