Right now when we update a listener:

• Old connections might get interrupted
• No graceful shutdown period
• Not following Envoy's drain behavior

Basic draining support

• Let existing connections finish naturally
• New connections go to the new listener version
• Follow Envoy's timeout behavior (5 seconds for HTTP, global timeout for TCP)

HTTP connection draining

• HTTP/1.1: Add Connection: close header, wait for requests to finish
• HTTP/2: Send GOAWAY frame, wait for streams to complete
• Use the drain_timeout from HTTP connection manager config

TCP connection draining

• Use global server drain timeout
• Graceful socket shutdown with SO_LINGER