It is simple to minimize the amount of affected application by correctly setting terminationGracePeriodSeconds. If this value is higher than life time of the longest TCP connection to a Ztunnel which is being upgraded, there should be no disruptions.

We need to document this option as the simplest one. This will not work if there are some really long life connections.

Following steps should achieve zero downtime upgrade:

1. set high enough terminationGracePeriodSeconds
2. set ztunnel DaemonSet update strategy to OnDelete
3. trigger the ztunnel upgrade
4. drain the node where the ztunnel is being upgraded
5. remove old ztunnel and wait for new one to start
6. mark the node as scheduable again
7. repeat for all nodes