or when the ztunnel pod is restarted in the same pod (remove old entries when the same uid connects again, but with different boot id?)

	save a queue of what needs to be sent to the ztunnel pod and send it one by one when it connects.

	when a new ztunnel connects with different uid, only propagate deletes to older ztunnels.
*/

type connMgr struct {
	connectionSet map[*ZtunnelConnection]struct{}

	mt := monitortest.New(t)
	setupLogging()
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	fixture := connect(ctx)
	ztunClient := fixture.ztunClient
	uid := fixture.uid

	m, fds := readRequest(t, ztunClient)
	// we got am essage from ztun, so it should have observed us being connected
	mt.Assert(ztunnelConnected.Name(), nil, monitortest.Exactly(1))

    # the associated address in configSource, if nothing is specified
    # the default MCP is assumed.
    configSource:
      subscribedResources: []

    # The following is used to limit how long a sidecar can be connected
    # to a pilot. It balances out load across pilot instances at the cost of
    # increasing system churn.
    keepaliveMaxServerConnectionAge: 30m

    # Additional labels to apply to the deployment.

    # the associated address in configSource, if nothing is specified
    # the default MCP is assumed.
    configSource:
      subscribedResources: []
    # The following is used to limit how long a sidecar can be connected
    # to a pilot. It balances out load across pilot instances at the cost of
    # increasing system churn.
    keepaliveMaxServerConnectionAge: 30m
    # Additional labels to apply to the deployment.

```console
$ journalctl -t kubelet -n 1000 | less
```

#### GKE via Stackdriver Log Viewer

Each GKE cluster's will have many categories of logs collected by Stackdriver.  Logs can be monitored via
the project's [log viewer](https://cloud.google.com/logging/docs/view/overview) and/or the `gcloud logging read`
capability.

  // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
  // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
  //
  // Defaults to "Equivalent"
  // +optional
  optional string matchPolicy = 9;

  // NamespaceSelector decides whether to run the webhook on an object based

  // and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
  // a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.
  //
  // Defaults to "Exact"
  // +optional
  optional string matchPolicy = 9;

  // NamespaceSelector decides whether to run the webhook on an object based

message HorizontalPodAutoscalerSpec {
  // scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
  // should be collected, as well as to actually change the replica count.
  optional CrossVersionObjectReference scaleTargetRef = 1;

  // minReplicas is the lower limit for the number of replicas to which the autoscaler

message HorizontalPodAutoscalerSpec {
  // scaleTargetRef points to the target resource to scale, and is used to the pods for which metrics
  // should be collected, as well as to actually change the replica count.
  optional CrossVersionObjectReference scaleTargetRef = 1;

  // minReplicas is the lower limit for the number of replicas to which the autoscaler

  // specific to ephemeral containers. Fields in common with Container are in the
  // following inlined struct so than an EphemeralContainer may easily be converted
  // to a Container.
  optional EphemeralContainerCommon ephemeralContainerCommon = 1;

  // If set, the name of the container from PodSpec that this ephemeral container targets.