// since right now it depends on the service-cidr flags and
		// sets the default IPFamily that may not be coherent with the
		// existing default ServiceCIDR
		primaryClusterIPAllocator, err = ipallocator.NewMetaAllocator(
			networkingv1alphaClient,
			c.Informers.Networking().V1alpha1().ServiceCIDRs(),
			c.Informers.Networking().V1alpha1().IPAddresses(),
			netutils.IsIPv6CIDR(&serviceClusterIPRange),
		)
		if err != nil {

}

// ServiceCIDRList contains a list of ServiceCIDR objects.
message ServiceCIDRList {
  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional
  optional .k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // items is the list of ServiceCIDRs.
  repeated ServiceCIDR items = 2;
}

// ServiceCIDRList contains a list of ServiceCIDR objects.
type ServiceCIDRList struct {
	metav1.TypeMeta `json:",inline"`
	// Standard object's metadata.
	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
	// +optional
	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
	// items is the list of ServiceCIDRs.

	"status":   "status represents the current state of the ServiceCIDR. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
}

func (ServiceCIDR) SwaggerDoc() map[string]string {
	return map_ServiceCIDR
}

var map_ServiceCIDRList = map[string]string{
	"":         "ServiceCIDRList contains a list of ServiceCIDR objects.",

	// staleChains contains information about chains to be deleted later
	staleChains map[string]time.Time

	// serviceCIDRs is a comma separated list of ServiceCIDRs belonging to the IPFamily
	// which proxier is operating on, can be directly consumed by knftables.
	serviceCIDRs string

	logger klog.Logger
}

// Proxier implements proxy.Provider
var _ proxy.Provider = &Proxier{}

				rbacv1helpers.NewRule("get", "list", "watch", "patch", "update").Groups(networkingGroup).Resources("servicecidrs").RuleOrDie(),
				rbacv1helpers.NewRule("patch", "update").Groups(networkingGroup).Resources("servicecidrs/finalizers").RuleOrDie(),
				rbacv1helpers.NewRule("patch", "update").Groups(networkingGroup).Resources("servicecidrs/status").RuleOrDie(),

		// apisstorage.Resource("csistoragecapacities").WithVersion("v1beta1"),
		networking.Resource("ipaddresses").WithVersion("v1alpha1"),
		networking.Resource("servicecidrs").WithVersion("v1alpha1"),
		certificates.Resource("clustertrustbundles").WithVersion("v1alpha1"),
		storage.Resource("volumeattributesclasses").WithVersion("v1alpha1"),

	serviceCIDR := &networkingv1alpha1.ServiceCIDR{
		ObjectMeta: metav1.ObjectMeta{
			Name: name,
		},
		Spec: networkingv1alpha1.ServiceCIDRSpec{},
	}
	serviceCIDR.Spec.CIDRs = append(serviceCIDR.Spec.CIDRs, primary)
	if secondary != "" {
		serviceCIDR.Spec.CIDRs = append(serviceCIDR.Spec.CIDRs, secondary)
	}
	return serviceCIDR
}

func (proxier *metaProxier) OnNodeSynced() {
	proxier.ipv4Proxier.OnNodeSynced()
	proxier.ipv6Proxier.OnNodeSynced()
}

// OnServiceCIDRsChanged is called whenever a change is observed
// in any of the ServiceCIDRs, and provides complete list of service cidrs.
func (proxier *metaProxier) OnServiceCIDRsChanged(cidrs []string) {
	proxier.ipv4Proxier.OnServiceCIDRsChanged(cidrs)
	proxier.ipv6Proxier.OnServiceCIDRsChanged(cidrs)

    routed away from there, there's nothing to do.)

  - We install a `reject` rule for ClusterIPs matching `@cluster-ips` set and a `drop`
    rule for ClusterIPs belonging to any of the ServiceCIDRs in `forward` and `output` hook, with a 
    higher (i.e. less urgent) priority than the DNAT chains making sure all valid
    traffic directed for ClusterIPs is already DNATed. Drop rule will only