// We will get an event every time the pod changes. The repair is not instantaneous, though -- it will only recover
	// once the pod restarts (in CrashLoopBackoff), which can take some time.
	// We don't want to constantly try to apply the iptables rules, which is unneeded and will fail.
	// Instead, we track which UIDs we repaired and skip them if already repaired.
	//

// the current generation of the targetResource, adding new versions
// as they are created.
func getAndWatchResource(ictx context.Context, cliCtx cli.Context) *watcher {
	g := withContext(ictx)
	// copy nameflag to avoid race
	nf := nameflag
	g.Go(func(result chan string) error {
		// retrieve latest generation from Kubernetes
		kc, err := cliCtx.CLIClient()
		if err != nil {
			return err
		}
		dclient := kc.Dynamic()