if !ok {
						time.Sleep(1 * time.Second)
						// Upon an error on watch channel
						// re-init the watch channel.
						goto outerLoop
					}
					if err := watchResp.Err(); err != nil {
						iamLogIf(ctx, err)
						// log and retry.
						time.Sleep(1 * time.Second)
						// Upon an error on watch channel
						// re-init the watch channel.
						goto outerLoop
					}

				gvr := action.GetResource()
				ns := action.GetNamespace()
				watch, err := fc.Tracker().Watch(gvr, ns)
				if err != nil {
					return false, nil, err
				}
				// Kubernetes Fake watches do not add initial state, but real server does
				// https://kubernetes.io/docs/reference/using-api/api-concepts/#semantics-for-watch

	}

	fileModified, errChan := make(chan struct{}), make(chan error)
	go watchFiles(watcher, fileModified, errChan)

	for _, path := range paths {
		if !file.Exists(path) {
			log.Infof("file watcher skipping watch on non-existent path: %v", path)
			continue
		}
		if err := watcher.Add(path); err != nil {
			if closeErr := watcher.Close(); closeErr != nil {
				err = fmt.Errorf("%s: %w", closeErr.Error(), err)
			}

		// based on atomic flag, as set by installer
		// TODO nodeagent watch server should affect this too, and drop atomic flag
		installDaemonReady, watchServerReady := nodeagent.StartHealthServer()

		if cfg.InstallConfig.AmbientEnabled {
			// Start ambient controller

			// node agent will spawn a goroutine and watch the K8S API for events,
			// as well as listen for messages from the CNI binary.

		l.LogAndPrintf("Installing operator controller in namespace: %s using image: %s/operator:%s",
			oiArgs.common.operatorNamespace, oiArgs.common.hub, oiArgs.common.tag)
	}

	l.LogAndPrintf("Operator controller will watch namespaces: %s", oiArgs.common.watchedNamespaces)

	vals, mstr, err := renderOperatorManifest(args, &oiArgs.common)
	if err != nil {
		l.LogAndFatal(err)
	}

				Version: "25",
			}), args)
			err := rootCmd.Execute()
			assert.NoError(t, err)

			readActions := map[string]bool{
				"get":   true,
				"list":  true,
				"watch": true,
			}

			actions := extendedClient.Kube().(*fake.Clientset).Actions()
			for _, action := range actions {
				if v := readActions[action.GetVerb()]; !v {

			return err
		}
		dclient := kc.Dynamic()
		r := dclient.Resource(targetSchema.GroupVersionResource()).Namespace(cliCtx.Namespace())
		watch, err := r.Watch(context.TODO(), metav1.ListOptions{FieldSelector: "metadata.name=" + nf})
		if err != nil {
			return err
		}
		for w := range watch.ResultChan() {
			o, ok := w.Object.(metav1.Object)
			if !ok {
				continue
			}
			if o.GetName() == nf {

// If an error occurs or context is canceled, the function will return an error.
func (in *Installer) sleepWatchInstall(ctx context.Context, installedBinFiles sets.String) error {
	// Watch our specific binaries, in each configured binary dir.
	// We may or may not be the only CNI plugin in play, and if we are not
	// we shouldn't fire events for binaries that are not ours.
	var binPaths []string

}

func (sys *IAMSys) periodicRoutines(ctx context.Context, baseInterval time.Duration) {
	// Watch for IAM config changes for iamStorageWatcher.
	watcher, isWatcher := sys.store.IAMStorageAPI.(iamStorageWatcher)
	if isWatcher {
		go func() {
			ch := watcher.watch(ctx, iamConfigPrefix)
			for event := range ch {
				if err := sys.loadWatchedEvent(ctx, event); err != nil {
					// we simply log errors

}

// iamStorageWatcher is implemented by `IAMStorageAPI` implementers that
// additionally support watching storage for changes.
type iamStorageWatcher interface {
	watch(ctx context.Context, keyPath string) <-chan iamWatchEvent
}

// Set default canned policies only if not already overridden by users.
func setDefaultCannedPolicies(policies map[string]PolicyDoc) {