spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z

 * limitations under the License.
 *
 */
package mockwebserver3.internal

internal fun sleepNanos(nanos: Long) {
  val ms = nanos / 1_000_000L
  val ns = nanos - (ms * 1_000_000L)
  if (ms > 0L || nanos > 0) {
    Thread.sleep(ms, ns.toInt())
  }

 */
fun formatDuration(ns: Long): String {
  val s =
    when {
      ns <= -999_500_000 -> "${(ns - 500_000_000) / 1_000_000_000} s "
      ns <= -999_500 -> "${(ns - 500_000) / 1_000_000} ms"
      ns <= 0 -> "${(ns - 500) / 1_000} µs"
      ns < 999_500 -> "${(ns + 500) / 1_000} µs"
      ns < 999_500_000 -> "${(ns + 500_000) / 1_000_000} ms"
      else -> "${(ns + 500_000_000) / 1_000_000_000} s "
    }

    client.initWebSocket(random, pingIntervalMillis = 500)
    taskFaker.advanceUntil(ns(500L))
    server.processNextFrame() // Ping.
    client.processNextFrame() // Pong.
    taskFaker.advanceUntil(ns(1000L))
    server.processNextFrame() // Ping.
    client.processNextFrame() // Pong.
    taskFaker.advanceUntil(ns(1500L))
    server.processNextFrame() // Ping.
    client.processNextFrame() // Pong.
  }

    if (http2Connection != null) {
      return http2Connection.isHealthy(nowNs)
    }

    val idleDurationNs = lock.withLock { nowNs - idleAtNs }
    if (idleDurationNs >= IDLE_CONNECTION_HEALTHY_NS && doExtensiveChecks) {
      return socket.isHealthy(source)
    }

    return true
  }

  /** Refuse incoming streams. */
  @Throws(IOException::class)
  override fun onStream(stream: Http2Stream) {

<?xml version="1.0" encoding="UTF-8" ?>

<taglib xmlns="http://java.sun.com/xml/ns/j2ee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-jsptaglibrary_2_0.xsd"
  version="2.0">
    
  <description>JSTL 1.1 functions library</description>
  <display-name>JSTL functions</display-name>
  <tlib-version>1.1</tlib-version>
  <short-name>fe</short-name>

import okhttp3.TestUtil.assertSuppressed
import okhttp3.internal.DoubleInetAddressDns
import okhttp3.internal.connection.RealConnection
import okhttp3.internal.connection.RealConnection.Companion.IDLE_CONNECTION_HEALTHY_NS
import okhttp3.internal.http.RecordingProxySelector
import okhttp3.testing.Flaky
import okhttp3.testing.PlatformRule
import okio.BufferedSink
import org.junit.jupiter.api.Assertions.assertEquals

1. Create the `WATCH_NAMESPACE` and `LEADER_ELECTION_NAMESPACE` if they are not created yet.

```bash
kubectl create ns $WATCH_NAMESPACE --dry-run -o yaml | kubectl apply -f -
kubectl create ns $LEADER_ELECTION_NAMESPACE --dry-run -o yaml | kubectl apply -f -
```

1. From the istio repo root directory, run `go run ./operator/cmd/operator/*.go server`

## Certificates

Ztunnel certificates are based on the standard Istio SPIFFE format: `spiffe://<trust domain>/ns/<ns>/sa/<sa>`.

However, the identities of the certificates will be of the actual user workloads, not Ztunnel's own identity.

pkg net, method (*Resolver) LookupIPAddr(context.Context, string) ([]IPAddr, error)
pkg net, method (*Resolver) LookupMX(context.Context, string) ([]*MX, error)
pkg net, method (*Resolver) LookupNS(context.Context, string) ([]*NS, error)
pkg net, method (*Resolver) LookupPort(context.Context, string, string) (int, error)
pkg net, method (*Resolver) LookupSRV(context.Context, string, string, string) (string, []*SRV, error)