t.Fatalf("expected allocator to be empty, got %d", r.Free())
	}
	cidr2 := newServiceCIDR("cidr2", "192.168.0.0/28")
	_, err = r.client.ServiceCIDRs().Create(context.Background(), cidr2, metav1.CreateOptions{})
	if err != nil {
		t.Fatal(err)
	}
	r.addServiceCIDR(cidr2)
	err = r.client.ServiceCIDRs().Delete(context.Background(), cidr.Name, metav1.DeleteOptions{})
	if err != nil {
		t.Fatal(err)
	}

// cidr('192.168.0.1/24').ip().family() // returns '4'
// cidr('::1/128').ip() // returns ipAddr('::1')
// cidr('::1/128').ip().family() // returns '6'
// cidr('192.168.0.0/24').masked() // returns cidr('192.168.0.0/24')
// cidr('192.168.0.1/24').masked() // returns cidr('192.168.0.0/24')
// cidr('192.168.0.0/24') == cidr('192.168.0.0/24').masked() // returns true, CIDR was already in canonical format

	"github.com/google/cel-go/common/types"
	"github.com/google/cel-go/common/types/ref"
)

// CIDR provides a CEL representation of an network address.
type CIDR struct {
	netip.Prefix
}

var (
	CIDRType = cel.OpaqueType("net.CIDR")
)

// ConvertToNative implements ref.Val.ConvertToNative.
func (d CIDR) ConvertToNative(typeDesc reflect.Type) (any, error) {
	if reflect.TypeOf(d.Prefix).AssignableTo(typeDesc) {

	tests := []struct {
		name  string
		cidrs []*networkingapiv1alpha1.ServiceCIDR
		cidr  *networkingapiv1alpha1.ServiceCIDR
		want  []string
	}{
		{
			name: "empty",
			cidr: makeServiceCIDR(defaultservicecidr.DefaultServiceCIDRName, "192.168.0.0/24", "2001:db2::/64"),
			want: []string{},
		}, {
			name: "one CIDR",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{

		{
			name: "existing default service CIDR not matching cidrs",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{
				{
					ObjectMeta: metav1.ObjectMeta{
						Name: DefaultServiceCIDRName,
					},
					Spec: networkingapiv1alpha1.ServiceCIDRSpec{
						CIDRs: []string{"fd00::/112"},
					},
				},
			},
		},
		{
			name: "existing default service CIDR not ready",
			cidrs: []*networkingapiv1alpha1.ServiceCIDR{
				{

	for _, str := range npa.cidrStrings {
		_, cidr, _ := netutils.ParseCIDRSloppy(str)

		if netutils.IsIPv4CIDR(cidr) {
			if cidr.IP.IsLoopback() || cidr.Contains(ipv4LoopbackStart) {
				npa.containsIPv4Loopback = true
			}
		}

		if IsZeroCIDR(str) {
			// Ignore everything else
			npa.cidrs = []*net.IPNet{cidr}
			npa.matchAll = true
			break
		}

		npa.cidrs = append(npa.cidrs, cidr)
	}

	return npa
}

		}
		// Allocate until full.
		var cidrs []*net.IPNet
		for {
			cidr, err := set.AllocateNext()
			if err != nil {
				if err == cidrset.ErrCIDRRangeNoCIDRsRemaining {
					break
				}
				t.Errorf("set.AllocateNext() = %v, want %v", err, cidrset.ErrCIDRRangeNoCIDRsRemaining)
				continue TestCase
			}
			cidrs = append(cidrs, cidr)
		}
		// No allocated CIDR range should intersect with serviceCIDR.

			return fmt.Errorf("node:%s has an allocated cidr: %v at index:%v that does not exist in cluster cidrs configuration", node.Name, cidr, idx)
		}

		logger.V(4).Info("Release CIDR for node", "CIDR", cidr, "node", klog.KObj(node))
		if err = r.cidrSets[idx].Release(podCIDR); err != nil {
			return fmt.Errorf("error when releasing CIDR %v: %v", cidr, err)
		}
	}
	return nil
}

	}
	cidrs = checkOK("192.168.0.1/32,192.168.0.2/32")
	if len(cidrs) != 2 {
		t.Errorf("Expected two CIDRs: %v", cidrs.StringSlice())
	}
	cidrs = checkOK("  192.168.0.1/32 , 192.168.0.2/32   ")
	if len(cidrs) != 2 {
		t.Errorf("Expected two CIDRs: %v", cidrs.StringSlice())
	}
	// check LoadBalancerSourceRanges not specified
	svc := api.Service{}
	cidrs, err := GetLoadBalancerSourceRanges(&svc)
	if err != nil {

	// if cidrs has an error then the previous call will fail
	// safe to ignore error checking on next call
	dualstack, _ := netutils.IsDualStackCIDRs(cidrs)

	return cidrs, dualstack, nil
}

// setNodeCIDRMaskSizes returns the IPv4 and IPv6 node cidr mask sizes to the value provided
// for --node-cidr-mask-size-ipv4 and --node-cidr-mask-size-ipv6 respectively. If value not provided,
// then it will return default IPv4 and IPv6 cidr mask sizes.