routed away from there, there's nothing to do.)

  - We install a `reject` rule for ClusterIPs matching `@cluster-ips` set and a `drop`
    rule for ClusterIPs belonging to any of the ServiceCIDRs in `forward` and `output` hook, with a 
    higher (i.e. less urgent) priority than the DNAT chains making sure all valid
    traffic directed for ClusterIPs is already DNATed. Drop rule will only

		cidrQueue: workqueue.NewTypedRateLimitingQueueWithConfig(
			workqueue.DefaultTypedControllerRateLimiter[string](),
			workqueue.TypedRateLimitingQueueConfig[string]{Name: "servicecidrs"},
		),
		svcQueue: workqueue.NewTypedRateLimitingQueueWithConfig(
			workqueue.DefaultTypedControllerRateLimiter[string](),
			workqueue.TypedRateLimitingQueueConfig[string]{Name: "services"},
		),

// notifications about ServiceCIDR object changes.
type ServiceCIDRHandler interface {
	// OnServiceCIDRsChanged is called whenever a change is observed
	// in any of the ServiceCIDRs, and provides complete list of service cidrs.
	OnServiceCIDRsChanged(cidrs []string)
}

// ServiceCIDRConfig tracks a set of service configurations.
type ServiceCIDRConfig struct {

                "get",
                "list",
                "patch",
                "update",
                "watch"
              ]
            },
            {
              "resource": "servicecidrs",
              "responseKind": {
                "group": "",
                "kind": "ServiceCIDR",
                "version": ""
              },
              "scope": "Cluster",

                "get",
                "list",
                "patch",
                "update",
                "watch"
              ]
            },
            {
              "resource": "servicecidrs",
              "responseKind": {
                "group": "",
                "kind": "ServiceCIDR",
                "version": ""
              },
              "scope": "Cluster",

	// invocation into a Run() method.
	nftablesFamily := knftables.IPv4Family
	podCIDR := "10.0.0.0/8"
	serviceCIDRs := "172.30.0.0/16"
	if ipFamily == v1.IPv6Protocol {
		nftablesFamily = knftables.IPv6Family
		podCIDR = "fd00:10::/64"
		serviceCIDRs = "fd00:10:96::/112"
	}
	detectLocal := proxyutil.NewDetectLocalByCIDR(podCIDR)

		informers.WithTweakListOptions(func(options *metav1.ListOptions) {
			options.LabelSelector = labelSelector.String()
		}))

	// Create configs (i.e. Watches for Services, EndpointSlices and ServiceCIDRs)
	// Note: RegisterHandler() calls need to happen before creation of Sources because sources
	// only notify on changes, and the initial update (on process start) may be lost if no handlers
	// are registered yet.

            "type": "string"
          },
          "items": {
            "description": "items is the list of ServiceCIDRs.",
            "items": {
              "allOf": [
                {
                  "$ref": "#/components/schemas/io.k8s.api.networking.v1alpha1.ServiceCIDR"
                }
              ],

		eventsRule(),
	}
	if utilfeature.DefaultFeatureGate.Enabled(features.MultiCIDRServiceAllocator) {
		nodeProxierRules = append(nodeProxierRules, rbacv1helpers.NewRule("list", "watch").Groups(networkingGroup).Resources("servicecidrs").RuleOrDie())
	}

	nodeProxierRules = append(nodeProxierRules, rbacv1helpers.NewRule("list", "watch").Groups(discoveryGroup).Resources("endpointslices").RuleOrDie())
	roles = append(roles, rbacv1.ClusterRole{

	proxier.mu.Unlock()

	// Sync unconditionally - this is called once per lifetime.
	proxier.syncProxyRules()
}

// OnServiceCIDRsChanged is called whenever a change is observed
// in any of the ServiceCIDRs, and provides complete list of service cidrs.
func (proxier *Proxier) OnServiceCIDRsChanged(_ []string) {}

func (proxier *Proxier) cleanupAllPolicies() {
	for svcName, svc := range proxier.svcPortMap {