Payload: &zdsapi.WorkloadRequest_Add{
					Add: &zdsapi.AddWorkload{
						Uid:          uid,
						WorkloadInfo: wl.Workload,
					},
				},
			}, &fd)
		} else {
			log.Infof("netns not available for local pod %s. sending keep to ztunnel", uid)
			resp, err = conn.sendMsgAndWaitForAck(&zdsapi.WorkloadRequest{
				Payload: &zdsapi.WorkloadRequest_Keep{

		PodNamespace: "funkyns",
	}

	payload, _ := json.Marshal(valid)

	addEvent, err := processAddEvent(payload)

	assert.NoError(t, err)
	assert.Equal(t, valid, addEvent)
}

func TestProcessAddEventBadPayload(t *testing.T) {
	valid := CNIPluginAddEvent{
		Netns:        "/var/netns/foo",
		PodName:      "pod-bingo",
		PodNamespace: "funkyns",
	}

	payload, _ := json.Marshal(valid)

	// in theory we should close the fd, but it's just a test..

	assert.Equal(t, m.Payload.(*zdsapi.WorkloadRequest_Add).Add.Uid, uid)
	// send ack so the server doesn't wait for us.
	sendAck(ztunClient)

	// second message should be the snap sent message
	m, fds = readRequest(t, ztunClient)
	assert.Equal(t, len(fds), 0)

	sent := m.Payload.(*zdsapi.WorkloadRequest_SnapshotSent).SnapshotSent
	if sent == nil {

				},
			},
			Containers: []corev1.Container{
				{
					Name: "payload-container",
				},
			},
		},
		Status: corev1.PodStatus{
			InitContainerStatuses: []corev1.ContainerStatus{
				*args.InitContainerStatus,
			},
			ContainerStatuses: []corev1.ContainerStatus{
				{
					Name: "payload-container",
					State: corev1.ContainerState{
						Waiting: &corev1.ContainerStateWaiting{

		http.Error(w, err.Error(), http.StatusInternalServerError)
		return
	}
	msg, err := processAddEvent(data)
	if err != nil {
		log.Errorf("Failed to process CNI event payload: %v", err)
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	if err := s.ReconcileCNIAddEvent(req.Context(), msg); err != nil {
		log.Errorf("Failed to handle add event: %v", err)

message NodeConfigStatus {
  // Assigned reports the checkpointed config the node will try to use.
  // When Node.Spec.ConfigSource is updated, the node checkpoints the associated
  // config payload to local disk, along with a record indicating intended
  // config. The node refers to this record to choose its config checkpoint, and
  // reports this record in Assigned. Assigned only updates in the status after

                      type: array
                    outputPayloadToHeader:
                      description: This field specifies the header name to output
                        a successfully verified JWT payload to the backend.
                      type: string
                    timeout:
                      description: The maximum amount of time that the resolver, determined

the claim to be copied from. type: string header: description: The name of the header to be created. type: string type: object type: array outputPayloadToHeade: description: This field specifies the header name to output a successfully verified JWT payload to the backend. type: string required: - issuer type: object type: array selector: description: Optional. properties: matchLabels: additionalProperties: type: string description: One or more labels that indicate a specific set of pods/VMs on which...

                      type: array
                    outputPayloadToHeader:
                      description: This field specifies the header name to output
                        a successfully verified JWT payload to the backend.
                      type: string
                    timeout:
                      description: The maximum amount of time that the resolver, determined