issue:
- 43705

releaseNotes:
- |
  **Added** `istioctl analyze` will display a error when encountering the following two situations:
  - For any namespace, if there are multiple Telemetry CRs without selector,
  - For any namespace, if there are multiple telemetry CRs with selector that select the same workload.
  

					}),
			},
			proxy:    newMeta("test-ns", map[string]string{"test": "selector"}, nil),
			expected: &meshconfig.ProxyConfig{Concurrency: v(3)},
		},
		{
			name: "multiple matching workload CRs, oldest applies",
			configs: []config.Config{
				setCreationTimestamp(newProxyConfig("workload-a", "test-ns",
					&v1beta1.ProxyConfig{
						Selector: selector(map[string]string{
							"test": "selector",

	}

	workloadConfig := p.mergedWorkloadConfig(meta.Namespace, meta.Labels)

	// Check for proxy.istio.io/config annotation and merge it with lower priority than the
	// workload-matching ProxyConfig CRs.
	if v, ok := meta.Annotations[annotation.ProxyConfig.Name]; ok {
		pca, err := proxyConfigFromAnnotation(v)
		if err == nil {
			workloadConfig = mergeWithPrecedence(workloadConfig, pca)
		}
	}

// Controller defines the controller for the gateway-api. The controller acts a bit different from most.
// Rather than watching the CRs directly, we depend on the existing model.ConfigStoreController which
// already watches all CRs. When there are updates, a new PushContext will be computed, which will eventually

			installWithCRFile(t, t, cs, istioCtl, "default", "v2")
			installWithCRFile(t, t, cs, istioCtl, "default", "")

			// istio control plane resources expected to be deleted after deleting CRs
			cleanupInClusterCRs(t, cs)

			// test operator remove command
			scopes.Framework.Infof("checking operator remove command for default revision")
			removeCmd := []string{
				"operator", "remove",

	"istio.io/istio/pkg/test/util/retry"
)

// TestCase represents reachability test cases.
type TestCase struct {
	// ConfigFile is the name of the yaml contains the authentication policy and destination rule CRs
	// that are needed for the test setup.
	// The file is expected in the tests/integration/security/reachability/testdata folder.
	ConfigFile string
	Namespace  namespace.Instance

		{Group: "apiextensions.k8s.io", Resource: "customresourcedefinitions"}: true,
	}
}

// CRDFinalizer is a controller that finalizes the CRD by deleting all the CRs associated with it.
type CRDFinalizer struct {
	crdClient      client.CustomResourceDefinitionsGetter
	crClientGetter CRClientGetter

	crdLister listers.CustomResourceDefinitionLister
	crdSynced cache.InformerSynced

		}
	}

	shirtv1beta1Client := dynamicClient.Resource(schema.GroupVersionResource{Group: crd.Spec.Group, Version: crd.Spec.Versions[0].Name, Resource: crd.Spec.Names.Plural})

	// read CRs with the v1beta1 client and
	// wait until conversion webhook is called the first time
	if err := wait.PollUntilContextTimeout(ctx, time.Millisecond*100, wait.ForeverTestTimeout, true, func(ctx context.Context) (bool, error) {

	if err != nil {
		return nil, err
	}
	out, err := p.Runner.RunCmd("get --all-namespaces "+strings.Join(crds, ",")+" -o yaml", "", p.KubeConfig, p.KubeContext, p.DryRun)
	return map[string]string{
		"crs": out,
	}, err
}

// GetClusterInfo returns the cluster info.
func GetClusterInfo(p *Params) (map[string]string, error) {

step.
1. Overlays in the user CR are applied to the rendered manifests. No values are ever defined in configuration profile
CRs at this layer, so no merge is performed in this step.

## CLI

The CLI `mesh` command is implemented in the [cmd/mesh](../operator/cmd/mesh/)
subdirectory as a Cobra command with the following subcommands: