go func() {
			log.Debug("handling conn")
			if err := z.handleConn(ctx, conn); err != nil {
				log.Errorf("failed to handle conn: %v", err)
			}
		}()
	}
}

// ZDS protocol is very simple, for every message sent, and ack is sent.
// the ack only has temporal correlation (i.e. it is the first and only ack msg after the message was sent)

      - default
    - key: istio-injection
      operator: DoesNotExist
  objectSelector:
    matchExpressions:
    - key: istio.io/rev
      operator: NotIn
      values:
      - canary
  reinvocationPolicy: Never
  rules:
  - apiGroups:
    - ""
    apiVersions:
    - v1
    operations:
    - CREATE
    resources:
    - pods
    scope: '*'
  sideEffects: None
  timeoutSeconds: 10
---

  // when this priority class should be used.
  // +optional
  optional string description = 4;

  // preemptionPolicy is the Policy for preempting pods with lower priority.
  // One of Never, PreemptLowerPriority.
  // Defaults to PreemptLowerPriority if unset.
  // +optional
  optional string preemptionPolicy = 5;
}

// PriorityClassList is a collection of priority classes.
message PriorityClassList {

//
// The sign will be omitted unless the number is negative.
//
// Examples:
//
// - 1.5 will be serialized as "1500m"
// - 1.5Gi will be serialized as "1536Mi"
//
// Note that the quantity will NEVER be internally represented by a
// floating point number. That is the whole point of this exercise.
//
// Non-canonical values will still parse as long as they are well formed,

  // (typically AWS load-balancers)
  // +optional
  optional string hostname = 2;

  // Ports is a list of records of service ports
  // If used, every port defined in the service should have an entry in it
  // +listType=atomic
  // +optional
  repeated PortStatus ports = 4;
}

// LoadBalancerStatus represents the status of a load-balancer.

  // according to whatever system is managing the endpoint. A nil value
  // indicates an unknown state. In most cases consumers should interpret this
  // unknown state as ready. For compatibility reasons, ready should never be
  // "true" for terminating endpoints, except when the normal readiness
  // behavior is being explicitly overridden, for example when the associated
  // Service has set the publishNotReadyAddresses flag.
  // +optional

  repeated Carp items = 2;
}

// CarpSpec is a description of a carp
message CarpSpec {
  // Restart policy for all containers within the carp.
  // One of Always, OnFailure, Never.
  // Default to Always.
  // More info: http://kubernetes.io/docs/user-guide/carp-states#restartpolicy
  // +optional
  optional string restartPolicy = 3;

	testDoAddRun(t, cniConf, excludedNS, pod, ns)

	wasCalled := serverClose()
	// If the pod is being added to a namespace that is explicitly excluded by plugin config denylist
	// it should never be added, even if the namespace has the annotation
	assert.Equal(t, wasCalled, false)
}

func TestCmdAdd(t *testing.T) {
	pod, ns := buildFakePodAndNSForClient()

  // level:
  //
  //             ACV(l) = ceil( SCL * ACS(l) / ( sum[priority levels k] ACS(k) ) )
  //
  // bigger numbers of ACS mean more reserved concurrent requests (at the
  // expense of every other PL).
  // This field has a default value of 30.
  // +optional
  optional int32 assuredConcurrencyShares = 1;

  // `limitResponse` indicates what to do with requests that can not be executed right now

  //
  // NominalCL(i)  = ceil( ServerCL * NCS(i) / sum_ncs )
  // sum_ncs = sum[limited priority level k] NCS(k)
  //
  // Bigger numbers mean a larger nominal concurrency limit,
  // at the expense of every other Limited priority level.
  // This field has a default value of 30.
  // +optional
  optional int32 nominalConcurrencyShares = 1;