istioNamespace string,
) error {
	meshCfg, err := getMeshConfig(kubeClient, istioNamespace)
	if err != nil {
		return fmt.Errorf("failed to fetch mesh config: %v", err)
	}

	workloadPAList, err := configClient.SecurityV1beta1().PeerAuthentications(workloadNamespace).List(context.Background(), metav1.ListOptions{})
	if err != nil {

  // still succeed if there are no other errors, and will only persist
  // the last of any duplicate fields. This is the default in v1.23+
  // - Strict: This will fail the request with a BadRequest error if
  // any unknown fields would be dropped from the object, or if any
  // duplicate fields are present. The error returned from the server
  // will contain all unknown and duplicate fields encountered.

                "uid": "${datasource}"
              },
              "expr": "sum(rate(pilot_total_xds_internal_errors{app=\"istiod\"}[1m]))",
              "format": "time_series",
              "hide": false,
              "intervalFactor": 1,
              "legendFormat": "Internal Errors",
              "refId": "H"
            },
            {
              "datasource": {