RequiresLocalControlPlane().
		Run(func(t framework.TestContext) {
			c := t.Clusters().Default()
			var svc *corev1.Service
			svc, _, err := testKube.WaitUntilServiceEndpointsAreReady(c.Kube(), "istio-system", "istio-ingressgateway")
			if err != nil {
				t.Fatalf("error getting ingress gateway svc ips: %v", err)
			}
			for _, ip := range svc.Spec.ClusterIPs {

		add rule ip6 kube-proxy cluster-ips-check ip6 daddr @cluster-ips reject comment "Reject traffic to invalid ports of ClusterIPs"
		add rule ip6 kube-proxy cluster-ips-check ip6 daddr { fd00:10:96::/112 } drop comment "Drop traffic to unallocated ClusterIPs"
		add rule ip6 kube-proxy endpoint-2CRNCTTE-ns1/svc1/tcp/p80__fd00.10.180..2.1/80 ip6 saddr fd00:10:180::2:1 jump mark-for-masquerade

	if len(ips) == 0 {
		return nil
	}
	svc := &v1.Service{
		ObjectMeta: metav1.ObjectMeta{Namespace: "bar", Name: name},
		Spec: v1.ServiceSpec{
			ClusterIP:  ips[0],
			ClusterIPs: ips,
			Type:       v1.ServiceTypeClusterIP,
		},
	}
	return svc
}

func newServiceCIDR(name, primary, secondary string) *networkingv1alpha1.ServiceCIDR {

	if len(healthCheckNodePorts) != 0 {
		t.Errorf("expected 0 healthcheck ports, got %v", healthCheckNodePorts)
	}

	// All services but one were deleted. While you'd expect only the ClusterIPs
	// from the three deleted services here, we still have the ClusterIP for
	// the not-deleted service, because one of it's ServicePorts was deleted.

// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

// ServiceCIDR defines a range of IP addresses using CIDR format (e.g. 192.168.0.0/24 or 2001:db2::/64).
// This range is used to allocate ClusterIPs to Service objects.
type ServiceCIDR struct {
	metav1.TypeMeta
	// Standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	// +optional

func validateClusterCA(insecureConfig *clientcmdapi.Config, pubKeyPins *pubkeypin.Set) ([]byte, error) {
	var clusterCABytes []byte
	for _, cluster := range insecureConfig.Clusters {
		clusterCABytes = cluster.CertificateAuthorityData
	}

	clusterCAs, err := certutil.ParseCertsPEM(clusterCABytes)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to parse cluster CA from the %s ConfigMap", bootstrapapi.ConfigMapClusterInfo)

			expectedError: true,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.desc, func(t *testing.T) {
			if tc.hasClusterDNS {
				configurer.clusterDNS = testClusterDNS
			} else {
				configurer.clusterDNS = nil
			}
			pod.Spec.DNSPolicy = tc.dnsPolicy
			pod.Spec.HostNetwork = tc.hostNetwork

			resType, err := getPodDNSType(pod)
			if tc.expectedError {
				if err == nil {

          return mlir::failure();
      }
    }
    return success();
  }

  ClusterMap clusters;
  result = CollectAndGroupClusterOps(block, &clusters);
  if (failed(result)) return result;

  for (const auto& cluster_metadata_and_ops : clusters) {
    const auto& cluster_ops = cluster_metadata_and_ops.getSecond();

    auto cluster_metadata =

		// Ignore events for MCS services that were triggered by this controller.
		return
	}

	// This method is called concurrently from each cluster's queue. Process it in `this` cluster's queue
	// in order to synchronize event processing.
	ic.queue.Push(func() error {
		namespacedName := namespacedNameForService(curr)

		// Lookup the previous MCS service if there was one.

	for _, c := range ctx.Clusters().Configs().Remotes() {
		if err = i.reinstallConfigCluster(c); err != nil {
			return i, err
		}
	}

	// Install (non-config) remote clusters.
	errG = multierror.Group{}
	for _, c := range ctx.Clusters().Remotes(ctx.Clusters().Configs()...) {
		c := c
		errG.Go(func() error {
			if err := i.installRemoteCluster(c); err != nil {