shouldBeEnabled := util.PodRedirectionEnabled(ns, newPod)

		// We should check the latest annotation vs desired status
		changeNeeded := isAnnotated != shouldBeEnabled

		log.Debugf("Pod %s events: wasAnnotated(%v), isAnnotated(%v), shouldBeEnabled(%v), changeNeeded(%v), oldPod(%+v), newPod(%+v)",

	for {
		// if sleepWatchInstall yields without error, that means the config might have been modified in some fashion.
		// so we rerun `install`, which will update the modified config if it has fallen out of sync with
		// our desired state
		err := in.sleepWatchInstall(ctx, installedBins)
		if err != nil {
			installLog.Error("error watching node CNI config")
			return err
		}

			res := ObjectToInstance(dr)
			messages.Add(msg.NewUpdateIncompatibility(res,
				"VERIFY_CERTIFICATE_AT_CLIENT", "1.20",
				"previously, TLS verification was skipped. Set `insecureSkipVerify` if this behavior is desired", "1.20"))
		}
		if sniImpacted {
			res := ObjectToInstance(dr)
			messages.Add(msg.NewUpdateIncompatibility(res,
				"ENABLE_AUTO_SNI", "1.20",