It is simple to minimize the amount of affected application by correctly setting terminationGracePeriodSeconds. If this value is higher than life time of the longest TCP connection to a Ztunnel which is being upgraded, there should be no disruptions.

We need to document this option as the simplest one. This will not work if there are some really long life connections.