},
               "expr": "sum by (pod) (rate(istio_xds_connection_terminations_total{pod=~\"ztunnel-.*\"}[$__rate_interval]))",
               "legendFormat": "XDS Connection Terminations ({{pod}})"
            }
         ],
         "title": "XDS Connections",
         "type": "timeseries"
      },
      {
         "datasource": {
            "type": "datasource",
            "uid": "-- Mixed --"
         },

    lock.assertNotHeld()

    val connection = this.connection
    if (connection != null) {
      connection.lock.assertNotHeld()
      val toClose: Socket? =
        connection.withLock {
          // Sets this.connection to null.
          releaseConnectionNoEvents()
        }
      if (this.connection == null) {
        toClose?.closeQuietly()

  }

  /**
   * Return the route from [connection] if it should be retried, even if the connection itself is
   * unhealthy. The biggest gotcha here is that we shouldn't reuse routes from coalesced
   * connections.
   */
  private fun retryRoute(connection: RealConnection): Route? {
    return connection.withLock {
      when {
        connection.routeFailureCount != 0 -> null

    override val call: Call,
    val connection: Connection,
  ) : CallEvent()

  data class ConnectionReleased(
    override val timestampNs: Long,
    override val call: Call,
    val connection: Connection,
  ) : CallEvent() {
    override fun closes(event: CallEvent): Boolean = event is ConnectionAcquired && call == event.call && connection == event.connection
  }

  data class CallStart(

      MockResponse(body = "XXX"),
    )
    val connections: MutableList<RealConnection?> = ArrayList()
    val localClient =
      client.newBuilder().eventListener(
        object : EventListener() {
          override fun connectionAcquired(
            call: Call,
            connection: Connection,
          ) {
            connections.add(connection as RealConnection)
          }
        },

   * That may happen later by the connection pool thread.
   */
  fun cancel()

  /**
   * Carries an exchange. This is usually a connection, but it could also be a connect plan for
   * CONNECT tunnels. Note that CONNECT tunnels are significantly less capable than connections.
   */
  interface Carrier {
    val route: Route

    fun trackFailure(

          'pilot_xds_push_context_errors'
        ),
      ],

      xdsConnections: [
        self.query(
          'Connections (client reported)',
          'sum(envoy_cluster_upstream_cx_active{cluster_name="xds-grpc"})'
        ),
        self.query(
          'Connections (server reported)',
          sum('pilot_xds')
        ),
      ],

      pushTime:
        self.query(
          '{{le}}',

  private var trailers: Headers? = null

  /** Returns true if this connection is closed. */
  val isClosed: Boolean
    get() = state == STATE_CLOSED

  override fun createRequestBody(
    request: Request,
    contentLength: Long,
  ): Sink {
    return when {
      request.body?.isDuplex() == true -> throw ProtocolException(
        "Duplex connections are not supported for HTTP/1",
      )

 * Fix: Respect read timeouts on recycled connections.
 * Fix: Transmit multiple cookie values as a single header with delimiter.
 * Fix: Ensure `null` is never returned from a connection's `getHeaderFields()`.
 * Fix: Persist proper `Content-Encoding` header to cache for GZip responses.
 * Fix: Eliminate rare race condition in SPDY streams that would prevent connection reuse.

Auto Registration controller is pretty unique as a controller - the inputs to the controller are XDS connections. In response to each XDS connection, a `WorkloadEntry` is created to register the XDS client (which is generally `istio-proxy` running on a VM) to the mesh. This `WorkloadEntry` is tied to the lifecycle of the connection, with some logic to ensure that temporary downtime (reconnecting, etc) does not remove the `WorkloadEntry`.

The Health Check controller additionally controls...