The ipset is used to track locally allocated CIDRs. If requested, external traffic sent to pods within these CIDR ranges will avoid SNAT'ing (NYI).
It's going to be used by net/bridge.go.