This is done by an HTTP server running on `/var/run/istio-cni/pluginevent.sock`.

An alternative flow is when a pod is enrolled into ambient mode after it starts up.
In this case, the CNI Agent is watching for Pod events from the API server directly and performing the same setup.
Note this is done while the Pod is running, unlike the CNI plugin flow which occurs before the Pod starts.

    }

    @Override
    public void transferFailed(TransferEvent event) {
        transferCompleted(event);

        println(
                "transferFailed",
                event.getException().getClass() + ": " + event.getException().getMessage());
    }

    private void transferCompleted(TransferEvent event) {
        downloads.remove(event.getResource());

        StringBuilder buffer = new StringBuilder(64);

  /** Returns the original request that initiated this event source. */
  fun request(): Request

  /**
   * Immediately and violently release resources held by this event source. This does nothing if
   * the event source has already been closed or canceled.
   */
  fun cancel()

  fun interface Factory {
    /**
     * Creates a new event source and immediately returns it. Creating an event source initiates an

  ) : ConnectionEvent() {
    override fun closes(event: ConnectionEvent): Boolean = event is ConnectStart && call == event.call && route == event.route
  }

  data class ConnectEnd(
    override val timestampNs: Long,
    override val connection: Connection,
    val route: Route,
    val call: Call,
  ) : ConnectionEvent() {

jobs:
  cherrypick:
    name: Cherrypick to ${{ github.event.inputs.release_branch}} - ${{ github.event.inputs.git_commit }}
    runs-on: ubuntu-latest
    if: github.repository == 'tensorflow/tensorflow' # Don't do this in forks
    steps:
    - name: Checkout code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        ref: ${{ github.event.inputs.release_branch }}

  }

  @AfterEach
  fun after() {
    listener.assertExhausted()
  }

  @Test
  fun event() {
    server.enqueue(
      MockResponse.Builder()
        .body(
          """
          |data: hey
          |
          |
          """.trimMargin(),
        ).setHeader("content-type", "text/event-stream")
        .build(),
    )
    val source = newEventSource()

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  4096;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '

            gcr.io/tensorflow-sigs/build:${{ github.event.number }}-${{ matrix.python-version }}
            us-central1-docker.pkg.dev/tensorflow-sigs/tensorflow/build:${{ github.event.number }}-${{ matrix.python-version }}
          cache-from: |
            type=registry,ref=tensorflow/build:latest-${{ matrix.python-version }}
            type=registry,ref=gcr.io/tensorflow-sigs/build:${{ github.event.number }}-${{ matrix.python-version }}

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections  4096;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '

    name: Scorecards analysis
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload the results to code-scanning dashboard.
      security-events: write
      # Needed to publish results and get a badge (see publish_results below).
      id-token: write

    steps:
      - name: "Checkout code"