}
	return eventC
}

func PushCNIEvent(cniClient CNIEventClient, event *skel.CmdArgs, prevResIps []*cniv1.IPConfig, podName, podNamespace string) error {
	if event == nil {
		return fmt.Errorf("unable to push CNI event, CmdArgs event was nil")
	}

	var ncconfigs []nodeagent.IPConfig
	for _, ipc := range prevResIps {

	client.RunAndWait(ctx.Done())

	payload, _ := json.Marshal(valid)

	// serialize our fake plugin event
	addEvent, err := processAddEvent(payload)
	assert.Equal(t, err, nil)

	// Push it thru the handler
	pluginServer.ReconcileCNIAddEvent(ctx, addEvent)

	waitForMockCalls()

	assertPodAnnotated(t, client, pod)
	// Assert expected calls actually made
	fs.AssertExpectations(t)
}

# Target: docker
#-----------------------------------------------------------------------------
.PHONY: push

# for now docker is limited to Linux compiles - why ?
include tools/istio-docker.mk

push: docker.push ## Build and push docker images to registry defined by $HUB and $TAG

#-----------------------------------------------------------------------------

container_kubeconfig=''

# docker conditional host mount (needed for make docker push)
if [[ -d "${HOME}/.docker" ]]; then
  CONDITIONAL_HOST_MOUNTS+="--mount type=bind,source=${HOME}/.docker,destination=/config/.docker,readonly "
fi

# gcloud conditional host mount (needed for docker push with the gcloud auth configure-docker)
if [[ -d "${HOME}/.config/gcloud" ]]; then

	err := PushCNIEvent(cniC, fakeCmdArgs, []*cniv1.IPConfig{&fakePrevResultIPConfig}, "testpod", "testns")

	assert.Error(t, err)
	assert.Equal(t, strings.Contains(err.Error(), fmt.Sprintf("unable to push CNI event, error was %d", http.StatusInternalServerError)), true)
}

func TestPushCNIAddEventGoodPayload(t *testing.T) {
	testPod := "testpod"
	testNS := "testns"

                "uid": "${datasource}"
              },
              "expr": "sum(rate(pilot_xds_push_context_errors{app=\"istiod\"}[1m]))",
              "format": "time_series",
              "hide": false,
              "intervalFactor": 1,
              "legendFormat": "Push Context Errors",
              "refId": "K"
            },
            {
              "datasource": {

          - path: spec.template.spec.containers.[name:discovery].ports.[containerPort:8080].containerPort
            value: 8090 # OVERRIDDEN
          - path: 'spec.template.spec.volumes[100]' #push to the list
            value:
              configMap:
                name: my-config-map
              name: my-volume-name
          - path: 'spec.template.spec.containers[0].volumeMounts[100]'
            value:

"intervalFactor": 1, "legendFormat": "Config Rejection Rate", "refId": "E" }, { "expr": "sum(rate(pilot_xds_push_context_errors{app=\"istiod\"}[1m]))", "format": "time_series", "hide": false, "intervalFactor": 1, "legendFormat": "Push Context Errors", "refId": "K" }, { "expr": "sum(rate(pilot_xds_write_timeout{app=\"istiod\"}[1m]))", "format": "time_series", "intervalFactor": 1, "legendFormat": "Push Timeouts", "refId": "G" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null,...

The Push Queue is mostly a normal queue, but it has some special logic to merge push requests for each given proxy. This results in each proxy having 0 or 1 outstanding push requests; if additional updates come in the existing push request is just expanded.

Another job polls this queue and triggers each client to start a push.

```mermaid
graph TD
    subgraph Config Flow

is still interested in this certificate (ie, Envoy is still connected and requesting the certificate), the SDS server will send another request
to generate a new secret and push the updated certificate to Envoy. This ensures that we do not permanently watch certificates even after