This command finds a Prometheus pod running in the specified istio system
namespace. It then executes a series of queries per requested workload to
find the following top-level workload metrics: total requests per second,
error rate, and request latency at p50, p90, and p99 percentiles. The
query results are printed to the console, organized by workload name.

All metrics returned are from server-side reports. This means that latencies

      "ResponseBodyEnd", "ConnectionReleased", "CallEnd",
    )
  }

  @Test
  fun failedCallEventSequence() {
    server.enqueue(
      MockResponse.Builder()
        .headersDelay(2, TimeUnit.SECONDS)
        .build(),
    )
    client =
      client.newBuilder()
        .readTimeout(Duration.ofMillis(250))
        .build()
    val call =
      client.newCall(
        Request.Builder()

  // An update strategy to replace existing DaemonSet pods with new pods.
  // +optional
  optional DaemonSetUpdateStrategy updateStrategy = 3;

  // The minimum number of seconds for which a newly created DaemonSet pod should
  // be ready without any of its container crashing, for it to be considered
  // available. Defaults to 0 (pod will be considered available as soon as it
  // is ready).

					mu.Lock()
					offlineEndpoints = append(offlineEndpoints, fmt.Errorf("%s is unreachable: %w", clnt, grid.ErrDisconnected))
					mu.Unlock()
					return
				}

				ctx, cancel := context.WithTimeout(ctx, 2*time.Second)
				defer cancel()

				err := clnt.Verify(ctx, srcCfg)
				mu.Lock()
				if err != nil {
					bootstrapTraceMsg(fmt.Sprintf("bootstrapVerify: %v, endpoint: %s", err, clnt))
					if !isNetworkError(err) {

    // First CONNECT call needs a new connection.
    assertThat(server.takeRequest().sequenceNumber).isEqualTo(0)

    // Second CONNECT call needs a new connection.
    assertThat(server.takeRequest().sequenceNumber).isEqualTo(0)

    // GET reuses the connection from the second connect.
    assertThat(server.takeRequest().sequenceNumber).isEqualTo(1)
  }

  @Test

1. While `ztunnel-old` will not accept *new* connections, it will continue processing existing connections.
1. After `drain period` seconds, `ztunnel-old` will forcefully terminate any outstanding connections.

> [!NOTE]
> Kubernetes will eventually `SIGQUIT` our process if we do not terminate in time.

                logger.debug("Shutting down thread executor.");
            }
            executor.shutdown();
            executor.awaitTermination(executorTerminationTimeout, TimeUnit.SECONDS);
        } catch (final InterruptedException e) {
            if (logger.isDebugEnabled()) {
                logger.debug("Failed to interrupt executor.", e);
            }
        } finally {

      T first = shuffledList.get(0);
      T second = shuffledList.get(1);
      T third = shuffledList.get(2);
      T[] rest = shuffledList.subList(3, shuffledList.size()).toArray(emptyArray);

      assertEquals(min, ordering.min(shuffledList));
      assertEquals(min, ordering.min(shuffledList.iterator()));
      assertEquals(min, ordering.min(first, second, third, rest));
      assertEquals(min, ordering.min(min, max));

      T first = shuffledList.get(0);
      T second = shuffledList.get(1);
      T third = shuffledList.get(2);
      T[] rest = shuffledList.subList(3, shuffledList.size()).toArray(emptyArray);

      assertEquals(min, ordering.min(shuffledList));
      assertEquals(min, ordering.min(shuffledList.iterator()));
      assertEquals(min, ordering.min(first, second, third, rest));
      assertEquals(min, ordering.min(min, max));

    The HTTP authorization credentials in the result of using `HTTPBearer` or
    `HTTPDigest` in a dependency.

    The HTTP authorization header value is split by the first space.

    The first part is the `scheme`, the second part is the `credentials`.

    For example, in an HTTP Bearer token scheme, the client will send a header
    like:

    ```
    Authorization: Bearer deadbeef12346
    ```

    In this case: