static <K, V> PopulatableMapAsMultimap<K, V> create() {
      return new PopulatableMapAsMultimap<>();
    }

    @SuppressWarnings("unchecked") // all methods throw immediately
    PopulatableMapAsMultimap() {
      this.map = newHashMap();
      this.unusableDelegate =
          (SetMultimap<K, V>)
              newProxyInstance(
                  SetMultimap.class.getClassLoader(),

  // The duration in seconds before the object should be deleted. Value must be non-negative integer.
  // The value zero indicates delete immediately. If this value is nil, the default grace period for the
  // specified type will be used.
  // Defaults to a per object value if not specified. zero means delete immediately.
  // +optional
  optional int64 gracePeriodSeconds = 1;

When a new identity is discovered on the node, it will be enqueued for fetching at a low priority, as an optimization.
However, if a request needs a certain identity that we have not fetched yet, it will be immediately requested.

Ztunnel additionally will handle the rotation of these certificates (typically 24hr expiration) as they approach expiry.

## Telemetry

  // guarantees (e.g. finalizers) will be honored. If this field is unset,
  // the Job won't be automatically deleted. If this field is set to zero,
  // the Job becomes eligible to be deleted immediately after it finishes.
  // +optional
  optional int32 ttlSecondsAfterFinished = 8;

  // completionMode specifies how Pod completions are tracked. It can be
  // `NonIndexed` (default) or `Indexed`.
  //

    @CheckForNull ValueEntry<K, V> nextInValueBucket;
    /*
     * The *InValueSet and *InMultimap fields below are null after construction, but we almost
     * always call succeedsIn*() to initialize them immediately thereafter.
     *
     * The exception is the *InValueSet fields of multimapHeaderEntry, which are never set. (That
     * works out fine as long as we continue to be careful not to try to delete them or iterate

   * range may be empty; for example, the gap between {@code [1..5)} {@code [5..7)} yields the empty
   * range {@code [5..5)}.
   *
   * <p>The gap exists if and only if the two ranges are either disconnected or immediately adjacent
   * (any intersection must be an empty range).
   *
   * <p>The gap operation is commutative.
   *
   * @throws IllegalArgumentException if this range and {@code otherRange} have a nonempty

    ServiceManagerState(ImmutableCollection<Service> services) {
      this.numberOfServices = services.size();
      servicesByState.putAll(NEW, services);
    }

    /**
     * Attempts to start the timer immediately prior to the service being started via {@link
     * Service#startAsync()}.
     */
    void tryStartTiming(Service service) {
      monitor.enter();
      try {

    ServiceManagerState(ImmutableCollection<Service> services) {
      this.numberOfServices = services.size();
      servicesByState.putAll(NEW, services);
    }

    /**
     * Attempts to start the timer immediately prior to the service being started via {@link
     * Service#startAsync()}.
     */
    void tryStartTiming(Service service) {
      monitor.enter();
      try {

   * The page replacement algorithm's data structures are kept casually consistent with the map. The
   * ordering of writes to a segment is sequentially consistent. An update to the map and recording
   * of reads may not be immediately reflected on the algorithm's data structures. These structures
   * are guarded by a lock and operations are applied in batches to avoid lock contention. The

  // This can not be 0 if MaxSurge is 0.
  // By default, a fixed value of 1 is used.
  // Example: when this is set to 30%, the old RC can be scaled down to 70% of desired pods
  // immediately when the rolling update starts. Once new pods are ready, old RC
  // can be scaled down further, followed by scaling up the new RC, ensuring
  // that the total number of pods available at all times during the update is at