client.initWebSocket(random, pingIntervalMillis = 500)
    taskFaker.advanceUntil(ns(500L))
    server.processNextFrame() // Ping.
    client.processNextFrame() // Pong.
    taskFaker.advanceUntil(ns(1000L))
    server.processNextFrame() // Ping.
    client.processNextFrame() // Pong.
    taskFaker.advanceUntil(ns(1500L))
    server.processNextFrame() // Ping.
    client.processNextFrame() // Pong.
  }

 */
fun formatDuration(ns: Long): String {
  val s =
    when {
      ns <= -999_500_000 -> "${(ns - 500_000_000) / 1_000_000_000} s "
      ns <= -999_500 -> "${(ns - 500_000) / 1_000_000} ms"
      ns <= 0 -> "${(ns - 500) / 1_000} µs"
      ns < 999_500 -> "${(ns + 500) / 1_000} µs"
      ns < 999_500_000 -> "${(ns + 500_000) / 1_000_000} ms"
      else -> "${(ns + 500_000_000) / 1_000_000_000} s "
    }

spiffe://cluster.local/ns/istio-system/sa/istiod         Leaf     Available        true           e5dfb59150b2ba7f108d93dcec5aa613     2033-03-22T13:04:57Z     2023-03-21T13:02:57Z
spiffe://cluster.local/ns/istio-system/sa/istiod         Root     Available        false          8a516645c40ce76c2c0d27ab4e2461c1     2022-03-18T13:04:49Z     2022-03-21T13:04:49Z

import okhttp3.TestUtil.assertSuppressed
import okhttp3.internal.DoubleInetAddressDns
import okhttp3.internal.connection.RealConnection
import okhttp3.internal.connection.RealConnection.Companion.IDLE_CONNECTION_HEALTHY_NS
import okhttp3.internal.http.RecordingProxySelector
import okhttp3.testing.Flaky
import okhttp3.testing.PlatformRule
import okio.BufferedSink
import org.junit.jupiter.api.Assertions.assertEquals

 * limitations under the License.
 *
 */
package mockwebserver3.internal

internal fun sleepNanos(nanos: Long) {
  val ms = nanos / 1_000_000L
  val ns = nanos - (ms * 1_000_000L)
  if (ms > 0L || nanos > 0) {
    Thread.sleep(ms, ns.toInt())
  }

    if (http2Connection != null) {
      return http2Connection.isHealthy(nowNs)
    }

    val idleDurationNs = lock.withLock { nowNs - idleAtNs }
    if (idleDurationNs >= IDLE_CONNECTION_HEALTHY_NS && doExtensiveChecks) {
      return socket.isHealthy(source)
    }

    return true
  }

  /** Refuse incoming streams. */
  @Throws(IOException::class)
  override fun onStream(stream: Http2Stream) {

## Certificates

Ztunnel certificates are based on the standard Istio SPIFFE format: `spiffe://<trust domain>/ns/<ns>/sa/<sa>`.

However, the identities of the certificates will be of the actual user workloads, not Ztunnel's own identity.

    this.withLock {
      if (degradedPongsReceived < degradedPingsSent) return // Already awaiting a degraded pong.
      degradedPingsSent++
      degradedPongDeadlineNs = System.nanoTime() + DEGRADED_PONG_TIMEOUT_NS
    }
    writerQueue.execute("$connectionName ping") {
      writePing(false, DEGRADED_PING, 0)
    }
  }

  class Builder(

      call2.execute()
    }

    // But after the degraded pong timeout, that connection is abandoned.
    Thread.sleep(TimeUnit.NANOSECONDS.toMillis(Http2Connection.DEGRADED_PONG_TIMEOUT_NS.toLong()))
    val call3 = client.newCall(Request(server.url("/")))
    call3.execute().use { response ->
      assertThat(
        response.body.string(),
      ).isEqualTo("fresh connection")
    }
  }

    assertThat(connection.isHealthy(System.nanoTime())).isTrue()

    // But if the ping doesn't arrive, the connection goes unhealthy.
    Thread.sleep(TimeUnit.NANOSECONDS.toMillis(Http2Connection.DEGRADED_PONG_TIMEOUT_NS.toLong()))
    assertThat(connection.isHealthy(System.nanoTime())).isFalse()

    // When a pong does arrive, the connection becomes healthy again.
    connection.writePingAndAwaitPong()