message StatefulSetOrdinals {
  // start is the number representing the first replica's index. It may be used
  // to number replicas from an alternate index (eg: 1-indexed) over the default
  // 0-indexed names, or to orchestrate progressive movement of replicas from
  // one StatefulSet to another.
  // If set, replica indices will be in the range:
  //   [.spec.ordinals.start, .spec.ordinals.start + .spec.replicas).

net_bits = 128 if type(net) == IPv6Network else 32;
net_len = pow(2, net_bits - net.prefixlen)
start, end = int(net_len / 4 * 3), net_len
if net_len > 2000:
  start, end = 1000, 2000

[print(str(ip) + "/" + str(ip.max_prefixlen)) for ip in islice(ip_network('$CIDR').hosts(), start, end)]
EOF
}

function ips_to_cidrs() {
  IP_RANGE_START="$1"
  IP_RANGE_END="$2"
  python3 - <<EOF

	log.Infof("Recreating kubebuilder test environment\n")

	if testenv != nil {
		testenv.Stop()
	}

	var err error
	testenv = &envtest.Environment{}
	testRestConfig, err := testenv.Start()
	if err != nil {
		return err
	}

	_, err = kubernetes.NewForConfig(testRestConfig)
	testRestConfig.QPS = 50
	testRestConfig.Burst = 100
	if err != nil {
		return err
	}

	}

	for _, pod := range pods {
		fw, err := kubeClient.NewPortForwarder(pod.Name, pod.Namespace, "localhost", 0, centralOpts.XdsPodPort)
		if err != nil {
			return nil, err
		}
		err = fw.Start()
		if err != nil {
			return nil, err
		}
		defer fw.Close()
		xdsOpts.Xds = fw.Address()
		response, err := GetXdsResponse(dr, istioNamespace, tokenServiceAccount, xdsOpts, dialOpts)
		if err != nil {

			if err != nil {
				return fmt.Errorf("could not build port forwarder for ControlZ %s: %v", podName, err)
			}
			defer portForwarder.Close()
			err = portForwarder.Start()
			if err != nil {
				return fmt.Errorf("could not start port forwarder for ControlZ %s: %v", podName, err)
			}

			ctrlzClient := &ControlzClient{
				baseURL: &url.URL{
					Scheme: "http",
					Host:   portForwarder.Address(),

    spec:
      {{- if ge .KubeVersion 122 }}
      {{/* safe since 1.22: https://github.com/kubernetes/kubernetes/pull/103326. */}}
      securityContext:
        sysctls:
        - name: net.ipv4.ip_unprivileged_port_start
          value: "0"
      {{- end }}
      serviceAccountName: {{.ServiceAccount | quote}}
      containers:
      - name: istio-proxy

		currentPodSnapshot:   podNsMap,
		podNs:                podNs,
		iptablesConfigurator: iptablesConfigurator,
		netnsRunner:          NetnsDo,
		hostsideProbeIPSet:   probeSet,
	}
}

func (s *NetServer) Start(ctx context.Context) {
	log.Debug("starting ztunnel server")
	go s.ztunnelServer.Run(ctx)
}

func (s *NetServer) Stop() {
	log.Debug("removing host iptables rules")
	s.iptablesConfigurator.DeleteHostRules()

  // claim.
  //
  // The object must be in the same namespace as the ResourceClaim.
  // +optional
  optional ResourceClaimParametersReference parametersRef = 2;

  // Allocation can start immediately or when a Pod wants to use the
  // resource. "WaitForFirstConsumer" is the default.
  // +optional
  optional string allocationMode = 3;
}

	waitTimeout time.Duration, l clog.Logger,
) error {
	// Needed in case we are running a test through this path that doesn't start a new process.
	cache.FlushObjectCaches()
	opts := &helmreconciler.Options{
		DryRun: dryRun, Log: l, WaitTimeout: waitTimeout, ProgressLog: progress.NewLog(),
		Force: force,
	}

					podPort = v.TargetPort.IntValue()
					break
				}
			}
			f, err := e.client.NewPortForwarder(pod.Name, pod.Namespace, "", 0, podPort)
			if err != nil {
				return nil, err
			}
			if err := f.Start(); err != nil {
				return nil, err
			}
			address = fmt.Sprintf("https://%s%s", f.Address(), *cc.Service.Path)
			defer func() {
				f.Close()
				f.WaitForStop()
			}()
		}