Which Google Kubernetes Engine (GKE) resource should you reference as the target when applying a new Cloud Armor policy to a deployed application?