expect:
        verifyEmpty(selectors)
    }

    def 'can add a selector not marked as deferring'() {
        given:
        def selector = Mock(ResolvableSelectorState)

        when:
        selectors.add(selector, false)

        then:
        selectors.size() == 1
        selectors.first() == selector
        selectors.iterator().next() == selector
        !selectors.checkDeferSelection()
    }

        def selector1 = selector(10, "org", "dep1", "1.0")
        root.outgoingEdges >> [dep(selector1, 1, 2)]

        def conf1 = node(2, "org", "dep1", "1.0")
        def selector2 = selector(11, "org", "dep2", "1.0")
        conf1.outgoingEdges >> [dep(selector2, 2, 3)]

        def conf2 = node(2, "org", "dep1", "1.0")
        def selector3 = selector(12, "org", "dep3", "1.0")

	// Using an index for selectoes is problematic because selector != label
	// We can match a label to a selector, but we can't generate a selector from a label.
	c.ForEach(gvk.Telemetry, func(rs *resource.Instance) bool {
		s := rs.Message.(*v1alpha1.Telemetry)

		// For this analysis, ignore Telemetries with no selectors specified at all.
		if s.Selector == nil || len(s.GetSelector().MatchLabels) == 0 {

	"istio.io/istio/pkg/config/analysis/msg"
	"istio.io/istio/pkg/config/resource"
	"istio.io/istio/pkg/config/schema/gvk"
)

// SelectorAnalyzer validates, per namespace, that:
// * sidecar resources that define a workload selector match at least one pod
// * there aren't multiple sidecar resources that select overlapping pods
type SelectorAnalyzer struct{}

var _ analysis.Analyzer = &SelectorAnalyzer{}

// Metadata implements Analyzer

        result.projectPath == selector.projectPath
        result.projectPath() == selector.projectPath()
        result.projectName == selector.projectName
        result.requestedCapabilities == selector.requestedCapabilities
    }

    def "serializes root build ProjectComponentSelector"() {
        given:

spec:
  containers:
  - image: proxyv2:1.3.1
    name: istio-proxy
---
# only selector is set, should be ineffective
apiVersion: security.istio.io/v1
kind: RequestAuthentication
metadata:
  namespace: default
  name: ra-ineffective
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: bookinfo-gateway
---
# only selector is set, should be ineffective
apiVersion: security.istio.io/v1

kind: Sidecar
metadata:
  name: no-selector # Since this is the only Sidecar in the namespace without a workload selector, no conflict
  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace

apiVersion: v1
kind: Pod
metadata:
  name: selector-test-pod
  labels:
    name: selector-test-pod
    unique-label: bingbang
spec:
  containers:
  - name: kubernetes-pause

    }

    def "fails with combination of selectors (#selector1 and #selector2)"() {
        buildFile << """
            dependencies {
               conf 'org:test:$selector1'
               conf 'org:testB:1.0'
            }
        """
        repository {
            'org:test' {
                '1.0'()

	})

	return meshConfig
}

func hasMatchingPodsRunning(selector klabels.Selector, podLabelsMap map[string][]klabels.Set) bool {
	for _, setList := range podLabelsMap {
		if hasMatchingPodsRunningIn(selector, setList) {
			return true
		}
	}
	return false
}

func hasMatchingPodsRunningIn(selector klabels.Selector, setList []klabels.Set) bool {
	hasMatchingPods := false