errs = multierror.Append(errs, multierror.Prefix(err, "invalid proxy admin port:"))
	}

	if err := ValidateControlPlaneAuthPolicy(config.ControlPlaneAuthPolicy); err != nil {
		errs = multierror.Append(errs, multierror.Prefix(err, "invalid authentication policy:"))
	}

	if err := ValidatePort(int(config.StatusPort)); err != nil {

package istiomultierror

import (
	"fmt"
	"strings"

	"github.com/hashicorp/go-multierror"
)

// MultiErrorFormat provides a format for multierrors. This matches the default format, but if there
// is only one error we will not expand to multiple lines.
func MultiErrorFormat() multierror.ErrorFormatFunc {
	return func(es []error) string {
		if len(es) == 1 {
			return es[0].Error()
		}

		warning, err := v.validateResource(*istioNamespace, defaultNamespace, &un, writer)
		if err != nil {
			errs = multierror.Append(errs, multierror.Prefix(err, fmt.Sprintf("%s/%s/%s:",
				un.GetKind(), un.GetNamespace(), un.GetName())))
		}
		if warning != nil {
			warnings = multierror.Append(warnings, multierror.Prefix(warning, fmt.Sprintf("%s/%s/%s:",
				un.GetKind(), un.GetNamespace(), un.GetName())))
		}
	}
}

	if len(s.Hostname) == 0 {
		errs = multierror.Append(errs, fmt.Errorf("invalid empty hostname"))
	}
	parts := strings.Split(string(s.Hostname), ".")
	for _, part := range parts {
		if !labels.IsDNS1123Label(part) {
			errs = multierror.Append(errs, fmt.Errorf("invalid hostname part: %q", part))
		}
	}

	// Require at least one port
	if len(s.Ports) == 0 {

	port, err := parsePort(config.Port)
	if err != nil {
		errs = multierror.Append(errs, err)
	}
	hostname, cluster, err := model.LookupCluster(push, config.Service, port)
	if err != nil {
		model.IncLookupClusterFailures("authz")
		errs = multierror.Append(errs, err)
	}
	status, err := parseStatusOnError(config.StatusOnError)
	if err != nil {
		errs = multierror.Append(errs, err)
	}
	if config.PathPrefix != "" {

		return nil
	})
}

func (i *istioImpl) cleanupCluster(c cluster.Cluster, errG *multierror.Group) {
	scopes.Framework.Infof("clean up cluster %s", c.Name())
	errG.Go(func() (err error) {
		if e := i.installer.Close(c); e != nil {
			err = multierror.Append(err, e)
		}

		})
		if err != nil {
			if multiErr, ok := err.(*multierror.Error); ok {
				for _, err := range multiErr.WrappedErrors() {
					ctx.Report(gv, morePreciseMessage(r, err, true))
				}
			} else {
				ctx.Report(gv, morePreciseMessage(r, err, true))
			}
		}
		if warnings != nil {
			if multiErr, ok := warnings.(*multierror.Error); ok {
				for _, err := range multiErr.WrappedErrors() {

package builder

import (
	"fmt"
	"strings"

	"github.com/hashicorp/go-multierror"

	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/util/istiomultierror"
)

var authzLog = log.RegisterScope("authorization", "Istio Authorization Policy")

type AuthzLogger struct {
	debugMsg []string
	errMsg   *multierror.Error
}

func (al *AuthzLogger) AppendDebugf(format string, args ...any) {

// See the License for the specific language governing permissions and
// limitations under the License.

package forwarder

import (
	"context"
	"fmt"

	"github.com/hashicorp/go-multierror"
	"go.uber.org/atomic"
	"golang.org/x/sync/semaphore"
)

const (
	maxConcurrencyPerForward = 20
)

type executor struct {
	totalRequests  *atomic.Uint64
	activeRequests *atomic.Uint64

// enableDefaultInjection takes a namespaces and relabels it such that it will have a default sidecar injected
func enableDefaultInjection(ns namespace.Instance) error {
	var errs *multierror.Error
	errs = multierror.Append(errs, ns.SetLabel("istio-injection", "enabled"))
	errs = multierror.Append(errs, ns.RemoveLabel("istio.io/rev"))
	return errs.ErrorOrNil()