args:              strings.Split("entry configure --name foo -o temp --clusterID cid", " "),
			expectedException: true,
			expectedOutput:    "Error: expecting a WorkloadGroup artifact file or the name and namespace of an existing WorkloadGroup\n",
		},
		{
			description:       "Invalid command args - missing valid input spec",
			args:              strings.Split("entry configure -n bar -o temp --clusterID cid", " "),

      openAPIV3Schema:
        properties:
          spec:
            description: 'Configuration affecting service registry. See more details
              at: https://istio.io/docs/reference/config/networking/service-entry.html'
            properties:
              addresses:
                description: The virtual IP addresses associated with the service.
                items:
                  type: string

  // If all API server instances agree on the same encoding storage version,
  // then this field is set to that version. Otherwise this field is left empty.
  // API servers should finish updating its storageVersionStatus entry before
  // serving write operations, so that this field will be in sync with the reality.
  // +optional
  optional string commonEncodingVersion = 2;

  // The latest available observations of the storageVersion's state.

// 2. Get all pod ips (might be several, v6/v4)
// 3. update ipsets accordingly
func addPodToHostNSIpset(pod *corev1.Pod, podIPs []netip.Addr, hostsideProbeSet *ipset.IPSet) error {
	// Add the pod UID as an ipset entry comment, so we can (more) easily find and delete
	// all relevant entries for a pod later.
	podUID := string(pod.ObjectMeta.UID)
	ipProto := uint8(unix.IPPROTO_TCP)

	var ipsetAddrErrs []error

}

// PodSchedulingContextStatus describes where resources for the Pod can be allocated.
message PodSchedulingContextStatus {
  // ResourceClaims describes resource availability for each
  // pod.spec.resourceClaim entry where the corresponding ResourceClaim
  // uses "WaitForFirstConsumer" allocation mode.
  //
  // +listType=map
  // +listMapKey=name
  // +optional
  repeated ResourceClaimSchedulingStatus resourceClaims = 1;
}

      openAPIV3Schema:
        properties:
          spec:
            description: 'Configuration affecting service registry. See more details
              at: https://istio.io/docs/reference/config/networking/service-entry.html'
            properties:
              addresses:
                description: The virtual IP addresses associated with the service.
                items:
                  type: string

	res, err := netlink.IpsetList(name)
	if err != nil {
		return fmt.Errorf("failed to list ipset %s: %w", name, err)
	}
	for _, entry := range res.Entries {
		if entry.Comment == comment {
			err := netlink.IpsetDel(name, &entry)
			if err != nil {
				return fmt.Errorf("failed to delete IP %s from ipset %s: %w", entry.IP, name, err)
			}
		}
	}
	return nil
}

  // "*" matches all verbs and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `apiGroups` is a list of matching API groups and may not be empty.
  // "*" matches all API groups and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string apiGroups = 2;

  // "*" matches all verbs and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `apiGroups` is a list of matching API groups and may not be empty.
  // "*" matches all API groups and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string apiGroups = 2;

  repeated HTTPIngressPath paths = 1;
}

// IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed
// to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs
// that should not be included within this rule.
message IPBlock {
  // cidr is a string representing the IPBlock
  // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
  optional string cidr = 1;