ipFamily = v1.IPv6Protocol
				otherIPFamily = v1.IPv4Protocol
			}

			cidrMap := MapCIDRsByIPFamily(testcase.ipString)

			var cidrStr []string
			for _, cidr := range cidrMap[ipFamily] {
				cidrStr = append(cidrStr, cidr.String())
			}
			var cidrStrOther []string
			for _, cidr := range cidrMap[otherIPFamily] {
				cidrStrOther = append(cidrStrOther, cidr.String())
			}

		cel.MemberOverload("cidr_contains_cidr", []*cel.Type{apiservercel.CIDRType, apiservercel.CIDRType}, cel.BoolType,
			cel.BinaryBinding(cidrContainsCIDR)),
	},
	"ip": {
		cel.MemberOverload("cidr_ip", []*cel.Type{apiservercel.CIDRType}, apiservercel.IPType,
			cel.UnaryBinding(cidrToIP)),
	},
	"prefixLength": {
		cel.MemberOverload("cidr_prefix_length", []*cel.Type{apiservercel.CIDRType}, cel.IntType,

			cost := uint64(math.Ceil(float64(actualSize(args[0])) * common.StringTraversalCostFactor))
			return &cost
		}
	case "ip":
		// IP and CIDR parsing is a string traversal.
		if len(args) >= 1 {
			if overloadId == "cidr_ip" {
				// The IP member of the CIDR object is just accessing a field.
				// Nominal cost.
				cost := uint64(1)
				return &cost
			}